CIRCIA Final Rule Is Coming: What Defense Contractors Need to Know

---

Transcript

Jacob: All right, folks. It’s October 2026, and last week the CIRCIA final rule crossed a big milestone ahead of publication, at long last. Will defense contractors get saddled with a new cyber incident reporting requirement on top of the obligations that already exist in DFARS clause 252.204-7012? Or will the government come together in harmony to relieve yet another burden on companies already struggling with existing cybersecurity requirements? We won’t know until the final rule is published, and we now expect that to happen before the end of 2026. That’s what we’re going to talk about today.

Jason, in June we talked about CISA hosting a series of town hall listening sessions, everybody’s favorite, to gather more feedback on the CIRCIA proposed rule, which was published back in 2024. The defense industrial base is just one of 16 critical infrastructure sectors affected, but it felt like most of the participation in the town halls was from defense contractors.

Jason: Yeah, because this rule is one of several dominoes wobbling in the air, about to tumble and affect the DIB, and they’re paying attention. Part of the reason is the requirements in the rule, but also the conflict with the requirements they already have. That was evident in the RFI responses calling for harmonization in the CMMC task force reform, and this rule was specifically called out. The other rules called out are part of those dominoes still waiting to fall that will affect the DIB.

Jacob: Absolutely. We’ll talk about the chances of this being harmonized with existing obligations, and maybe why people think that’s more straightforward than it is. But like I said, we won’t know until the final rule is published. Isn’t that fun? A surprise for everybody.

When Will the CIRCIA Final Rule Arrive?

Jacob: The best ballpark estimate based on what we know in October 2026 is sometime in the next three to six months. Personally, I expect it before the end of 2026, and definitely before the end of Q1 2027.

The final rule implements the Cyber Incident Reporting for Critical Infrastructure Act of 2022, known as CIRCIA. It was officially sent to the Office of Information and Regulatory Affairs, the heart of the rulemaking apparatus within the Office of Management and Budget, for review on October 1st, 2026. On paper, that review can take up to 90 days, extendable to 120. But reviews typically don’t take that long, and CISA and DHS rules usually don’t take the full 90, especially when there’s a statutory deadline, as there is here. This isn’t a regulation the agency is creating on its own. Congress passed a law directing them to issue a rule by a certain deadline, and that deadline was October 2025, a year ago. So it isn’t the end of the world that they missed it, but it’s another reason it will be sooner rather than later.

Congress has been very involved in the rulemaking process: through the proposed rule, the town hall listening sessions, public comments from the authors of the statute, and hearings. So I think it’s very unlikely OIRA review gets drawn out. There’s a lot of inertia, and it’s already behind schedule. After review, the final rule goes to the Federal Register. The published rule will contain an effective date after which the regulation is in force, and once it’s published, we’ll know whether you have a secondary reporting obligation or not.

Jason: I’d add one more reason. The listening sessions were like the final step before they submit the rule, a last round of public feedback. They were jotting down responses off camera. I was in all of the sessions and heard most of what was said. Most of it came from defense contractors asking for unification, with no other pushback besides that and the granularity of the incident reporting requirements, and how much of a burden this would be. “Burden” was a word used on multiple occasions. So I don’t think there was any substantial feedback they’ll take actionable items from, and they’re going into review with the same rule that went in as a proposed rule, if I’m not mistaken, Jacob. This thing is probably going to fly.

Jacob: That’s what I recall. And there have been a lot of critical infrastructure cyber incidents, in and outside the DIB, in the years since CIRCIA passed, so I don’t foresee them changing the text significantly. But we won’t know until it’s published. When rulemaking happens normally, unlike CMMC rulemaking in past years, you don’t get updates. There are no industry events where they hint at what they’re thinking. That’s technically how the system is supposed to work, so we’ll all find out together.

Jason: And you see security strategies and statements listing critical infrastructure, especially incident reporting, as pillars of their foremost priorities. That makes you think this isn’t a side project for anyone working on it.

Will CISA Accept DFARS 7012 Reports?

Jacob: Now to the question: will they or won’t they impose another reporting requirement on the DIB? It was very clear in public comments and listening sessions that the DIB says, “We already have a reporting obligation. Just take that one. What’s the big deal?” So the big question is whether CISA will accept cyber incident reports submitted by defense contractors under DFARS clause 252.204-7012. Not CMMC, not 800-171, not FedRAMP, not ITAR, none of that. The bottom half of the clause is all incident reporting obligations that have existed since 2016.

If CISA determines other forms of cyber incident reports aren’t “substantially similar,” and there’s no CIRCIA agreement between CISA and the other federal agencies imposing those requirements, then there’s no reciprocity, and you’ll end up with multiple cyber incident reporting obligations as a defense contractor or as any other operator in a critical infrastructure sector. This isn’t just the DIB, but for most people listening, that’s our focus.

So far, we haven’t heard anything from CISA or DoD about a CIRCIA agreement between the two agencies on 7012 and CIRCIA reporting. In the 2024 proposed rule, CISA said that if and when it enters into a CIRCIA agreement, it will announce and catalog it on a public-facing website. That website doesn’t exist and never has. There apparently are no agency agreements, so they would have to change the rule text or have a website waiting. They haven’t said anything. Nothing CISA described in the rule has triggered to indicate relief from a secondary burden.

On top of that, over the years, and as recently as January 2026, the DoD has said at industry events that no progress has been made between DoD and CISA. I asked Stacy Bostjanick about this back in 2024. In January 2026, I asked Katie Sutton, who doesn’t work for the CIO or for A&S. She’s a completely separate policy person in the Pentagon in charge of cybersecurity policy for the DoD. She had no update. She had no idea what was going on with the CIRCIA agreement or the CIRCIA rule for that matter, which doesn’t give me a lot of confidence. So we won’t know the deal until the rule is published. Like and subscribe.

Jason: One of the lines says that if CISA determines other incident reports are substantially similar, that’s CISA’s determination. If CISA then produces a website saying 7012 incident reporting is good enough for us, that’s good. Some people ask why they haven’t done this yet, because there are so many similarities. But it’s fool’s gold when you look at the 7012 requirements and then get into the meat and potatoes of CIRCIA.

Why the Two 72-Hour Reports Aren’t the Same

Jacob: This is our fourth or fifth episode on the CIRCIA rule over the last several years. The most recent was in June, ahead of the town halls. If you’re telling CISA to accept 7012 reporting, understand what the rule says about “substantially similar” reporting so your comment is more effective. We’ll link that episode for details, but here’s a quick recap.

The town halls in June were full of people telling CISA that the DIB already has an incident reporting requirement, which is true, so CISA should accept DFARS 7012 incident reports as a substitute and keep it moving. That’s 99 percent of what people said. At first glance, the CIRCIA report looks like just another 72-hour cyber incident reporting requirement, but the details are much broader than a 7012 report.

First, the triggers differ. DFARS focuses on incidents affecting controlled unclassified information, the systems processing it, and covered systems. It’s a narrow scope involving only CUI. CIRCIA can be triggered by impacts to the organization itself anywhere: business operations, operational systems, third-party MSPs, supply chain compromises, your OT environments, which are now all the rage. Maybe the DoD would favor that, but the scope and triggers are very different. If you have an incident in your CUI enclave, CIRCIA doesn’t care only about your CUI enclave. They care about everything else. So all the scoping you’ve done for DFARS compliance and CMMC assessment doesn’t matter to CIRCIA.

Jason: And in CIRCIA’s eyes, if you’re the one who’s been compromised, you’re responsible not only for reporting to CISA but also to your supply chain, because those people are affected too. Other people rely on your ability to detect, identify, and report appropriately. Under DFARS, it was only a speckle of your business, and defense contractors still struggled with it. I think something like 20 percent of incidents were successfully reported, according to a statistic I can’t vouch for. I can say CIRCIA, though. [laughter]

The Requirements DFARS 7012 Doesn’t Have

Jacob: To wrap up the list, and watch the June episode for more detail: a CIRCIA report requires more information than a 7012 report. CIRCIA mandates that you report any ransom payment. There are no ransomware incident or payment requirements in a DFARS cyber incident report. CIRCIA has supplemental follow-up reporting obligations. There’s no mandatory supplemental or follow-up report for a 7012 incident. Data preservation timelines differ. DFARS 7012 says to preserve relevant data for 90 days. CIRCIA requires preservation for two years after your last report, so if you have multiple supplemental reports after the initial incident, the two-year clock doesn’t start until the final report in that series.

And the enforcement mechanisms differ. DFARS is a contractual requirement with potential contractual remedies. Some of you are very familiar with that. No judgment. CIRCIA is a federal regulatory requirement backed by subpoenas and DOJ referrals. They can issue RFIs on top of you. CISA isn’t in a contractual relationship with you. Congress has handed them statutory authority to regulate you because you’re part of a critical infrastructure sector. They don’t care about contract terms or lowest price technically acceptable. You’re part of a broader chessboard of the cyber war, and they’ve been given the golden ticket to impose requirements on you.

So when you look at how different a 7012 report is from a CIRCIA report, and the authority CISA has been given, that doesn’t seem substantially similar to me. You already have a cyber incident reporting requirement under DFARS 7012, and it’s within 72 hours, but after that, basically nothing is the same. I don’t think CISA would accept it as a reciprocal report just to reduce burden.

Jason: What’s crazy is that to report these things to CISA, you have to have certain controls in place to identify them, but no framework mandates that for these critical infrastructure organizations, for the most part, except…

Jacob: What?

Jason: Except the requirements imposed in their contracts. But CISA is saying you’re doing business with us, so you should have these as a minimum baseline capability.

Jacob: Yep.

Jason: Why aren’t we throwing pitchforks at CISA?

Jacob: That’s a conversation for a different episode. This whole thing is built on the premise that companies have cybersecurity controls and a cybersecurity program in their environments, and as we know, that’s not true. But the horse is already down. In the audience at the CISA town halls, and in the audience with the Department of War CIO, she said these same controls are things every business should be doing, regardless of whether they do business with the government.

Jason: Yep. The capabilities to identify who’s in your system, what they’re doing, whether they do something wrong, and the ability to report it. These are basic.

Jacob: We’ll have to see what the Small Business Administration said in its comments on the proposed rule. We won’t see that until the final rule includes responses. Maybe the SBA was as adamant about this burden on defense contractors as it was about other requirements imposed on contractors. I certainly hope so, because it’s a real requirement, but maybe they know something we don’t.

Why a Second Reporting Requirement Looks Possible

Jacob: Just because your existing 7012 incident reporting requirement says 72 hours doesn’t mean CIRCIA reporting duplicates your existing obligations. They differ in what triggers the reports, what gets reported, how long the reporting continues, what has to be preserved, and how the requirements are enforced.

Jason: So they’re not substantially similar, and there’s not much reason to believe CISA would accept it.

Jacob: Right. So there’s good reason to believe you’ll get a new obligation within the next three-ish months, when this rule is published. At that point we’ll be in a brave new world, alongside other regulations coming around the corner that we’ll cover in future episodes. What do you think? Will CISA say, “No harm, no foul, give us your 7012 reports”? Will CISA and DoD finally bury the hatchet in their longstanding blood feud, where they disagree on requirements and enforcement, and work together so the DIB doesn’t have a secondary requirement? Maybe. Let us know in the comments. Like and subscribe, and follow us everywhere, because we’ll keep up with updates on this rule. It could fly through in two weeks and we’ll suddenly know, or it could take two months. We’ll see you next week.

Jason: See you next week.

AUSA Supply Chain Cyber Readiness Preview

Jacob: All right, folks, thanks for watching to the end. If you’re going to be at AUSA, come hang out with the Summit 7 team at the Supply Chain Cyber Readiness Preview on Tuesday, October 13th. We have exciting news. We’re unveiling a new solution built to remove cost barriers for small suppliers and the prime contractors that rely on them. If you’re a company with 25 or fewer employees, or a prime with many suppliers around that size, and you’re interested in giving those suppliers a fully isolated environment they own and control to help grow their business without added complexity, come hang out with us.