CISA extended the rulemaking timeline for the Cyber Incident Reporting for Critical Infrastructure Act to May 2026, a move designed to address stakeholder feedback and streamline requirements. This extension follows a period where financial industry groups argued that the original proposal failed to balance regulatory intelligence with operational security needs. The agency now faces a compressed schedule to finalize rules before the statutory deadline passed in October 2025 without a final action. As of now, the administrative target for the final rule sits at September 2026, creating a tight window for implementation. I see this delay as a necessary correction rather than a failure, given the complexity of harmonizing dozens of existing federal reporting obligations.
Leadership and Stakeholder Pressure
Jeff Greene, a former National Security Council official and NIST director, is taking over a senior advisory role at CISA to replace Eric Goldstein. Greene brings decades of experience from both the private sector and government, including roles at Symantec and Aspen Digital. His appointment signals a shift toward policy-heavy leadership as the agency ramps up for the new incident reporting law. Meanwhile, Mike Duffy has stepped into the acting federal chief information security officer role, succeeding Chris DeRusha. These personnel changes occur while CISA struggles with hiring technical talent and managing internal morale issues. Insiders have noted that the agency often prioritizes public image over solving thorny cybersecurity problems, a perception that complicates its mission execution.
The pressure on CISA comes from multiple directions. The American Bankers Association, Bank Policy Institute, Institute of International Bankers, and Securities Industry and Financial Markets Association sent a letter warning that the proposed rule risks straining the U.S. financial system’s cyber defenses. They argued that requiring reports within 72 hours diverts front-line defenders from stopping attacks. The associations demanded that CISA limit reporting scope to substantial incidents affecting critical services and clarify that requirements apply only to U.S. operations. They also pushed for reduced data retention periods and fewer supplemental reports to prevent tying up response resources. In contrast, cybersecurity expert Josh Corman criticized efforts to exclude small businesses, arguing that even five-person companies can conform to reporting obligations. He warned that excluding smaller entities in life-safety sectors like healthcare creates flawed data that benefits adversaries. CISA estimates the rule will cost $2.6 billion over 11 years, with more than 316,000 entities affected.
Operational Mechanics and Scope
The proposed rule defines covered entities broadly, including all organizations in critical infrastructure sectors except small businesses, or those meeting specific sector-based criteria. This scope extends beyond traditional critical infrastructure owners to include supporting entities like managed service providers and cloud vendors. If your business serves regulated clients, you should expect contract changes involving faster notification windows and deeper logging requirements within the next 18 months. The 72-hour clock starts when an organization forms a "reasonable belief" that an incident occurred, which could be as early as a help desk ticket escalation. Ransom payments require reporting within 24 hours, even if a third party makes the payment on the organization’s behalf.
CISA is hosting virtual town halls between March 9 and April 2, 2026, to pressure-test these scope mechanics. Participants must register by 5:00 p.m. ET two business days before each session, and all remarks are recorded and placed in the public docket. Written materials submitted within seven days after a meeting also become part of the official record. This transparency means that any comment becomes a permanent part of the regulatory history. The agency is explicitly soliciting feedback on size thresholds and whether to include open-source software repositories in the coverage. For small businesses, the gray zone between exemption and applicability remains a significant risk. Many sit in a position where their status hinges on SBA size definitions layered with sector-specific criteria. I recommend that organizations review their vendor agreements now, replacing vague language like "promptly" with specific, measurable timelines to prepare for the incoming compliance landscape.
