CISA's Cyber Incident Reporting Rule Sits at OIRA as the Agency Shrinks to 2,200 Staff Without a Confirmed Director
The final rule under the Cyber Incident Reporting for Critical Infrastructure Act, known as CIRCIA, went to the White House Office of Information and Regulatory Affairs for review on 1 October 2026. It hasn’t been published. When it is, it will require …