What do CISA’s CIRCIA cyber incident reporting rules require federal contractors and subcontractors to report? 2026
Mar 9, 2026What do CISA’s CIRCIA cyber incident reporting rules require federal contractors and subcontractors to report? 2026
CISA’s CIRCIA requires contractors to report qualifying cyber incidents to CISA within 72 hours and ransom payments within 24 hours, plus specific data elements; flow-downs, contract clauses, and response plans are required to avoid suspension, termination, or debarment.