CIRCIA's 72-Hour Reporting Clock: What Financial Institutions Must Know Before the Final Rule Takes Effect

Your SIEM fires at 11:47 PM. By midnight, your incident commander has confirmed ransomware encrypting file servers across two data centers. By 12:30 AM, forensics is engaged and containment is underway. By 6 AM, spread is stopped.

Then someone asks: “What do we report and to whom?”

If you’re a banking organization, the FFIEC 36-hour clock is already running. If you’re publicly traded, the SEC’s 4-business-day materiality window is in play. If you’re a non-bank financial institution, FTC Safeguards’ 30-day notification may apply. And as of CIRCIA — the Cyber Incident Reporting for Critical Infrastructure Act, signed in March 2022 — you may also have a 72-hour window to notify CISA.

Four federal reporting clocks. Different triggers. Different recipients. Different definitions of “reportable.” All potentially running simultaneously. CIRCIA’s final rule has been targeting 2026 for finalization, and whether it dropped in the last few weeks or lands imminently, the window to prepare is now.

TL;DR

• CIRCIA requires 72-hour reporting of substantial cyber incidents and 24-hour reporting of ransomware payments to CISA
• Applies to “covered entities” in financial services and 15 other critical infrastructure sectors that exceed SBA small business size standards
• A single incident can trigger CIRCIA and the FFIEC 36-hour rule, SEC 4-day clock, FTC Safeguards 30-day notification, and state breach laws simultaneously
• The 72-hour clock starts from “reasonable belief,” not investigation completion — initial reports can be incomplete
• CIRCIA includes a meaningful liability shield: reports are not subject to FOIA and cannot be used in civil litigation against the filer

What CIRCIA Does — And Doesn’t Do

CIRCIA doesn’t create cybersecurity requirements. It doesn’t tell you what controls to implement, what frameworks to follow, or what your minimum security posture should be. It does one thing: if a substantial cyber incident occurs, report it to CISA within 72 hours.

The policy rationale is straightforward. When ransomware hits a financial services firm, the same actor may be targeting utilities, healthcare providers, and payment infrastructure simultaneously. Siloed incident response means federal coordinators can’t connect the dots fast enough to protect the next target. CIRCIA’s centralized reporting is designed to enable sector-wide threat intelligence sharing in near real time.

What it means for compliance teams: CIRCIA is a notification obligation layered on top of your existing security program. You don’t need a new control framework — you need a new branch in your incident response plan.

Who Is Covered: The Financial Services Sector and SBA Size Threshold

Financial services is one of 16 federally designated critical infrastructure sectors under Presidential Policy Directive 21. CIRCIA applies to entities in those sectors that exceed SBA small business size standards.

For financial services, the thresholds depend on your NAICS classification:

• Banks and savings institutions: Most fall under annual receipts thresholds ranging from $47.5 million to higher amounts depending on subsector
• Securities broker-dealers and investment advisers: Employee-count or revenue thresholds by product type
• Money services businesses and fintechs: Depends on specific NAICS classification — payments firms, lenders, and crypto platforms each map to different SBA size standards
• Credit unions: Member-count and asset thresholds

If you qualify as a small business under SBA standards for your NAICS code, CIRCIA’s proposed rule would exempt you. This exempts most early-stage fintechs. But for any institution with meaningful scale — community banks, credit unions over $100 million in assets, growth-stage fintech platforms, broker-dealers — covered entity status is likely.

The safest approach: assume coverage, confirm with counsel using your specific NAICS code, and build reporting infrastructure regardless. The cost of over-preparation is low. The cost of a missed 72-hour deadline is not.

What Is a “Covered Cyber Incident”?

The NPRM defined covered cyber incident as a substantial cyber incident. “Substantial” is where the complexity lives — and where most incident response plans need to add specificity.

The proposed rule’s substantial criteria included:

Availability impacts: Outages affecting 25% or more of critical systems or functions, or any outage lasting 8 or more continuous hours on critical systems. A ransomware event that locked systems for 12 hours but from which you restored cleanly likely qualifies.

Integrity violations: Unauthorized modification or destruction of data at scale — particularly data affecting customer accounts, payment processing, or regulated information.

Access violations: Unauthorized access to sensitive data categories: customer financial information, security credentials, PII subject to Gramm-Leach-Bliley or state privacy laws, government-regulated data.

Ransomware deployment: Any ransomware deployed on systems containing sensitive data, regardless of whether data was exfiltrated, a ransom was demanded, or the attacker succeeded in encrypting files. The presence of ransomware on a qualifying system is the trigger — containment doesn’t undo reportability.

Critical function disruption: Any incident disrupting your ability to process payments, clear and settle transactions, or provide financial services that other parties depend on. This threshold is particularly relevant for community banks that provide ACH origination for local businesses, fintechs running payment rails others depend on, or any firm in a critical spot in the financial infrastructure stack.

The final rule may refine these thresholds — CISA received significant industry comment pushing back on the breadth of the “25% of critical assets” standard. But the categories themselves are likely to survive.

The 72-Hour Reporting Requirement

Once you reasonably believe a covered cyber incident has occurred, the 72-hour clock starts. Not 72 hours from forensic confirmation. Not 72 hours from scope determination. From reasonable belief.

This is a meaningful operational change for teams conditioned to investigate, confirm, scope, loop in legal and communications, and then notify. CIRCIA’s initial report is explicitly designed to be incomplete — CISA expects supplemental reports as investigation progresses. The initial filing is a flag, not a final accounting.

The CIRCIA report contains:

• Covered entity identity and contact information
• Incident description: what happened, when you first detected it, when you believe it started
• Systems and data affected (to the extent known)
• Threat actor indicators (IP addresses, malware signatures, TTPs where known)
• Actions taken: containment, remediation, escalation
• Whether a ransomware payment was made or is being considered

Reports are submitted through CISA’s centralized reporting portal (reporting.cisa.gov). Pre-registration before an incident saves critical time during an active response.

The 24-Hour Ransomware Payment Clock

Separate from incident reporting, CIRCIA requires notification to CISA within 24 hours of making a ransomware payment — by anyone, on your behalf, including your cyber insurer or incident response firm.

This is the shorter of the two clocks and one that organizations frequently miss because the payment decision often involves actors outside the core incident response team. Your cyber insurer may be negotiating independently. Your external IR firm may make a payment as part of decryption key recovery. Both trigger your 24-hour window.

The ransom payment report is not a substitute for the incident report — they’re separate obligations with separate clocks. An organization that paid a ransom has both a 24-hour ransom payment obligation and potentially a 72-hour incident report obligation running simultaneously.

One critical note: CIRCIA ransomware payment reporting is separate from OFAC sanctions compliance. If there’s any reason to believe the ransomware actor is a designated entity, you still need an OFAC analysis and potentially a specific license before payment. Notifying CISA doesn’t resolve OFAC exposure.

The Reporting Clock Comparison

A single ransomware incident affecting customer data at a public banking organization could trigger all of the following:

See the FFIEC 36-hour computer-security incident notification rule for the banking regulator obligation in detail. For the SEC’s 4-day materiality clock, the incident triage techniques post covers how to structure that determination. State law obligations are mapped in the 50-state breach notification comparison.

CIRCIA’s Liability Shield: An Unusually Strong Protection

Most mandatory reporting obligations create evidentiary risk: what you report can be discovered in litigation and used against you. CIRCIA inverts that — it protects compliant filers.

Reports submitted under CIRCIA are:

• Exempt from FOIA. Neither the report nor information derived solely from the report can be obtained via Freedom of Information Act request. This applies to reports held by CISA and to reports shared with other federal agencies through CIRCIA’s authorized sharing channels.
• Inadmissible in civil litigation. A plaintiff’s attorney cannot subpoena your CIRCIA report and use it to establish breach of duty or damages. This is a significant protection in the ransomware litigation context, where class actions routinely follow major incidents.
• Protected from privilege waiver. Sharing information with CISA under CIRCIA does not waive attorney-client privilege, work product protection, or any other applicable privilege.
• Shielded from enforcement use. CISA cannot share CIRCIA report contents with other agencies for the purpose of regulatory enforcement against the reporting entity.

This liability shield means that for incidents at or near the CIRCIA threshold, there’s a reasonable argument to file even when you’re uncertain. The risk of an underfiled incident (administrative subpoena, DOJ referral, reputational exposure) is often greater than the risk of overfiling (which the shield largely neutralizes).

How to Prepare Before the Final Rule Is Effective

The NPRM contemplated an 18-month compliance period post-final rule. Even if the final rule dropped in May 2026, mandatory compliance may not begin until late 2027. But preparation should start now — not because of penalty risk, but because CIRCIA readiness requires changes to your IRP, team structure, and tooling that take time to implement properly.

Step 1: Confirm Your Covered Entity Status

Get a definitive legal assessment of whether your organization qualifies as a covered entity under CIRCIA given your NAICS code, revenue, and employee count. This drives the rest of your preparation — there’s no point building CIRCIA-specific infrastructure if you’re exempt, and significant risk in assuming exemption without analysis.

Step 2: Designate a CIRCIA Reporting Lead

Assign a named accountable owner — typically the CISO, VP of Compliance, or General Counsel — for CIRCIA reporting decisions. This person is responsible for knowing the reporting trigger, making the “reasonable belief” determination when an incident occurs, and ensuring a CISA account is established before an incident happens.

Step 3: Map Your Incident Taxonomy to CIRCIA’s Thresholds

Your existing incident severity classification probably doesn’t align with CIRCIA’s “substantial” definition. Run a mapping exercise:

• Which of your current severity levels (P0/P1/P2 or Critical/High/Medium) would trigger the 72-hour window?
• Map the NPRM’s four substantial criteria against your systems and data inventory
• Identify systems that, if ransomware-affected, automatically trigger CIRCIA regardless of scope

The outcome should be a clear decision tree your incident commander can run through in the first hour of an incident response.

Step 4: Add CIRCIA to Your Incident Response Plan

The IRP should name CIRCIA as a parallel reporting obligation with specific sections covering:

• The reporting trigger and “reasonable belief” standard
• The 72-hour clock start point and who makes that determination
• Report preparation responsibilities and who drafts content
• The supplemental report cadence for ongoing incidents
• The 24-hour ransomware payment obligation and who gets notified before any payment is made

If you need a structured incident response template that already maps reporting obligations by incident type, the Incident Response & Breach Notification Kit includes playbooks for the most common financial services incident types — ransomware, unauthorized access, vendor breach — with reporting checklists mapped to federal and state obligations. Get the Incident Response Kit →

Step 5: Register with the CISA Reporting Portal

Create your organization’s account at reporting.cisa.gov before an incident. Discovering you need to register during an active ransomware response adds 30–60 minutes of friction at the worst possible time.

Step 6: Brief Your External IR Retainer and Cyber Insurer

Both your incident response firm and cyber insurer can make decisions that trigger your CIRCIA obligations — particularly the 24-hour ransomware payment clock. Brief them on your CIRCIA obligations and confirm:

• They will notify your reporting lead before any payment decision
• They understand that payments made on your behalf trigger your 24-hour window
• They’ll document timing of payment decisions for your report

So What?

CIRCIA doesn’t change what a security incident is or how you respond to it. What it changes is what you have to do in the first 72 hours — and it means that the reporting decision tree at the top of your incident response plan needs a new branch.

The institutions that will struggle with CIRCIA are the ones that treat it like every other external notification — draft carefully, get legal sign-off, confirm full scope, then send. That process doesn’t fit a 72-hour window that starts from “reasonable belief.”

Start simple: designate a reporting lead, confirm your covered entity status, and add a CIRCIA decision node to your IRP before the first incident tests it. The liability shield protects compliant filers — the risk isn’t in reporting too promptly, it’s in the compliance gap between when you “reasonably believed” something happened and when you actually filed.

Sources: CISA CIRCIA FAQs | NPRM Published March 2024, Federal Register | PwC CIRCIA Overview | Fisher Phillips CIRCIA Analysis | IAPP: CIRCIA Preparation Guide