These questions come from compliance officers and IT security leads at defense contractors who've spent the last two years watching CISA’s Cyber Incident Reporting for Critical Infrastructure Act move through the regulatory pipeline. Now that the final rule has reached the Office of Management and Budget for review, the questions have shifted from "what might this be?" to "how do we actually do this?"
You're already reporting cyber incidents to the Pentagon under DFARS 252.204-7012. You're managing Controlled Unclassified Information under NIST SP 800-171. Now, CIRCIA wants substantial cyber incidents reported within 72 hours and ransom payments within 24 hours to a completely different agency with different definitions and follow-up requirements.
Here's what teams are asking right now.
Q: Can't CISA just accept our DFARS reports and call it done?
That's what everyone wants, but it's not what you're getting.
CIRCIA's 2024 proposal includes a provision for satisfying the requirement with a similar report filed to another federal agency. The catch: CISA and that agency must strike a formal agreement first. According to Jacob Horne, chief cybersecurity evangelist at Summit 7, there's "zero indication that such an agreement has been or will be reached" with the Pentagon.
The problem is structural. DFARS 252.204-7012 reporting requirements focus strictly on incidents involving controlled unclassified information. CIRCIA's scope is broader. It covers substantial cyber incidents affecting your operations, not just CUI compromises. The Congressional Research Service reached a similar conclusion: other regulators aren't likely to drop their own requirements because the rules serve different purposes.
You're looking at parallel reporting streams. One focused on CUI protection failures. One focused on operational impact to critical infrastructure. Different audiences, different thresholds, different follow-up expectations.
Q: What counts as a "substantial" cyber incident under CIRCIA?
This is where the 2024 proposal gets complicated. CISA defined substantial incidents as those meeting specific criteria related to operational disruption, data compromise, or impacts to critical functions. The exact thresholds matter because you've got 72 hours from when you reasonably believe a substantial incident occurred.
Compare that to DFARS reporting, which triggers when you have a reasonable basis to believe CUI was accessed or exfiltrated. The decision trees are different. Under DFARS, you're asking "was CUI involved?" Under CIRCIA, you're asking "did this substantially disrupt operations or compromise critical systems?"
You can't use the same incident triage process for both. Your security operations team needs separate decision frameworks, and they need to understand that a CIRCIA-reportable incident might not trigger DFARS reporting and vice versa.
Q: We're already struggling with CMMC. How are we supposed to add another compliance layer?
You're not alone. The Pentagon suspended the second phase of its Cybersecurity Maturity Model Certification program in July, citing the burden on smaller suppliers. Most contractors, according to Horne, "are not prepared at all because they have yet to comply with existing defense cyber requirements."
CIRCIA doesn't care about your CMMC readiness. It's a separate statutory requirement under the 2022 law. When the final rule publishes, you'll have a compliance deadline whether you've achieved CMMC Level 2 or not.
The practical answer: you need to build incident response procedures that accommodate both regimes. That means your playbooks need CIRCIA decision points, your reporting templates need to cover both CISA and Pentagon requirements, and your team needs training on when to file what report to whom.
Start with your existing incident response plan. Map out where CIRCIA reporting decisions would occur. Identify who makes the "substantial incident" determination and how quickly they can do it. The 72-hour clock starts when you reasonably believe an incident occurred, not when you've completed your investigation.
Q: What about the 24-hour ransom payment reporting? We don't pay ransoms anyway.
That's your policy today. CIRCIA requires reporting within 24 hours of making a ransom payment, which means the rule assumes some covered entities will pay.
Even if you maintain a strict no-payment policy, you need to document that policy and ensure your incident response team knows it. During a ransomware event, you'll be under pressure. Executives might ask about payment options. Your IR plan should explicitly address this scenario and reference both your organizational policy and the CIRCIA reporting obligation if that policy ever changes.
Also consider your supply chain. If a subcontractor or service provider handling your data pays a ransom, does that trigger any reporting obligations for you? The final rule may clarify these scenarios, but you should be thinking through the implications now.
Q: How does CIRCIA's two-year data retention requirement work with our 90-day DFARS retention?
CIRCIA would require two years of incident data retention compared with 90 days under DFARS 252.204-7012. This isn't harmonization. It's an expansion of your data management obligations.
You'll need to maintain incident records, forensic artifacts, and related documentation for CIRCIA-reportable events for two years. That means separate retention policies, separate storage considerations, and separate procedures for handling CISA requests for follow-up information.
The follow-up reports are another wrinkle. CIRCIA requires updates as new details emerge. DFARS has its own supplemental reporting requirements. You're potentially filing multiple follow-ups to multiple agencies about the same incident, each with different information needs.
Build your incident documentation process to accommodate the longest retention period and the most detailed reporting requirement. If you're documenting thoroughly enough to satisfy CIRCIA, you'll have what you need for DFARS as well.
Q: When does this actually take effect?
The final rule reached OMB for review in October 2026. Eric Crusius, who chairs the government contracts group at law firm Hunton Andrews Kurth, said "we should expect to see it before the end of the year."
After publication, you'll likely have an implementation period before reporting obligations begin. Use that time. The 2024 proposal was expected to impact nearly 300,000 organizations nationwide. CISA received significant pushback over breadth and overlap. The final rule may include changes, but the core requirements will remain.
Don't wait for perfect clarity. Start building your parallel reporting processes now. Update your incident response playbooks. Train your team on the different thresholds. Document your decision frameworks.
Where to go for more
Watch the Federal Register for the final rule publication. Review your existing DFARS 252.204-7012 reporting procedures and identify where CIRCIA decision points differ. If you're working with a compliance firm, ask them specifically about CIRCIA readiness and how it intersects with your CMMC timeline.
The Government Accountability Office found that about 70% of federal cybersecurity regulations carry the same kind of reporting requirement as at least one other rule. CIRCIA is one more. You manage it the same way you manage everything else in the defense compliance stack: with detailed procedures, clear ownership, and realistic expectations about what harmonization actually means.
