Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA)
A 2022 US federal law requiring critical infrastructure operators to report significant incidents to the cybersecurity agency within 72 hours and ransom payments within 24 hours.
The Cyber Incident Reporting for Critical Infrastructure Act, signed on March 15, 2022, tasks the US Cybersecurity and Infrastructure Security Agency with organizing a mandatory reporting regime for entities in critical infrastructure sectors. Two obligations form its core: reporting a substantial cyber incident within 72 hours after the entity reasonably believes it occurred, and reporting a ransom payment within 24 hours after payment. The law is not self-executing: it relies on an implementing rule, proposed in April 2024, that must define covered entities and the content of reports. It shields submitted information from certain regulatory and litigation uses, to encourage reporting. For insurance, CIRCIA adds a hard deadline to a claim's timeline, within which the insurer, the response firm and legal counsel must coordinate. It also makes the federal agency the holder of a loss database the market has never had, which could eventually inform accumulation modeling.
The proposed rule published in April 2024 estimated that about 316,000 entities would fall within the regime and that more than 200,000 reports would be filed over the first eleven years, a volume far beyond any cyber loss database built by the insurance market.
Follow the research
One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.
No spam, one-click unsubscribe, no data ever sold.