thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Governance, Risk, Audit & Privacy · Advanced

Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA)

2022 US law directing CISA to require critical infrastructure entities to report covered cyber incidents and ransom payments.

Definition

CIRCIA requires reporting covered cyber incidents within 72 hours and ransom payments within 24 hours once CISA's final rule takes effect. CISA published a proposed rule in April 2024; the final rule has been delayed and was expected in 2026.

Example

A water utility prepares processes to report covered incidents to CISA within 72 hours under the forthcoming rule.

Exam tip

Know the 72-hour incident and 24-hour ransom payment timelines.

Related terms