Cyber Incident Reporting for Critical Infrastructure Act of 2022 (CIRCIA)

Federal statute mandating critical infrastructure entities report covered cyber incidents to CISA within 72 hours and ransomware payments within 24 hours.

Enacted to establish unified national situational awareness of cyber threats targeting 16 critical infrastructure sectors. Grants CISA administrative subpoena authorities to compel incident data and provides legal safe harbor and confidentiality protections for submitted reports.