CIRCIA's Final Rule Is Coming: Are You a Covered Entity?

A practical readiness guide for healthcare and defense organizations assessing whether CISA's proposed 72-hour reporting rule may apply.

The Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA) final rule is expected soon, with the latest target set for September 2026 after prior delays. The rule is not final yet, but the underlying statutory direction is clear: once in effect, covered entities will face a 72-hour reporting obligation for qualifying cyber incidents and a 24-hour deadline for ransomware payments.

For healthcare organizations managing HIPAA obligations and defense contractors operating under CMMC expectations, the central question is straightforward: will your organization be considered a covered entity, and are your reporting processes mature enough to respond on time?

This article provides a measured overview of the current proposal, outlines how coverage is evaluated, and includes a built-in checklist using the same readiness questions many compliance teams are already asking internally.

What CIRCIA Would Require

CIRCIA is intended to give the Cybersecurity and Infrastructure Security Agency (CISA) earlier visibility into cyber incidents affecting critical infrastructure. While implementation details are still pending final rulemaking, the proposed reporting structure has remained consistent:

1. 72-hour incident reporting: Covered entities would need to report a qualifying cyber incident to CISA within 72 hours of reasonably believing the incident occurred.
2. 24-hour ransomware payment reporting: If a covered entity makes a ransomware payment, or a third party does so on its behalf, that payment would need to be reported within 24 hours.

For compliance leaders, the practical issue is not just legal interpretation. It is whether internal incident response, escalation, legal review, and regulator notification paths are defined well enough to work under a compressed timeline.

Who May Be Covered

Under the proposed rule, an organization may be considered a covered entity if it meets one of two criteria:

• It exceeds the SBA size standard for its industry. This varies by NAICS code and can be based on employee count or annual revenue.
• It meets sector-specific criteria tied to critical infrastructure. Even if an organization falls below an SBA threshold, it may still be covered if disruption could create national security, economic, or public safety consequences.

For Scarlet Comply clients, two sectors deserve particular attention:

• Healthcare & Public Health: Relevant to organizations already managing HIPAA Security Rule requirements, breach notification duties, and Business Associate relationships.
• Defense Industrial Base: Relevant to contractors and subcontractors aligning with CMMC and broader federal security expectations.

That means many mid-sized providers, business associates, defense suppliers, and specialized technology vendors should not assume they are out of scope.

Built-In Checklist: CIRCIA Readiness Questions

Use the checklist below as an initial screening tool for your organization. These readiness questions are especially relevant for HIPAA and CMMC-focused teams.

• Do you operate in one of the 16 critical infrastructure sectors?
• Does your organization exceed the SBA size standard?
• Do you have an incident response plan that can dispatch a report within 72 hours?
• Do you have a clear definition of what constitutes a "reportable incident"?
• Do you have a documented process for notifying CISA (vs. HHS OCR or other regulators)?
• Have you mapped existing obligations (HIPAA, SEC, state breach laws) against CIRCIA?
• Do your Business Associate agreements account for CIRCIA-level notification timelines?

If several of these questions cannot be answered confidently, that does not mean your organization is noncompliant today. It does mean your readiness assumptions should be reviewed before the final rule arrives.

Why This Matters for HIPAA and CMMC Programs

Many organizations already have compliance structures in place and assume those structures will translate cleanly into CIRCIA readiness. That assumption should be tested.

For healthcare organizations

HIPAA incident processes are designed around HHS and breach-notification obligations. CIRCIA introduces a separate federal reporting path to CISA, with a different trigger analysis and a different timeline.

For defense contractors

CMMC programs often emphasize control maturity, evidence, and contract alignment. CIRCIA readiness adds a reporting discipline that depends on fast classification, internal coordination, and clear regulator routing.

For both sectors

Third-party communication timelines matter. If a business associate, managed service provider, or subcontractor detects the issue first, contractual language and escalation rules need to support timely reporting decisions.

Preparing Without Overreacting

A measured approach is the right approach here. Since the rule is not final, organizations do not need panic-driven compliance activity. They do need disciplined preparation in areas that are likely to matter regardless of final wording:

• Confirm whether you operate in a covered sector.
• Validate your SBA size threshold analysis.
• Review whether your incident response plan supports a 72-hour external reporting workflow.
• Define what a reportable incident means internally.
• Separate CISA notification procedures from HIPAA, SEC, and state reporting paths.
• Review BAAs, vendor agreements, and subcontractor obligations for timing gaps.

For organizations managing multiple frameworks, this is where Scarlet Comply can help bring structure to the analysis. Where broader risk operations are involved, Scarlet Comply supports visibility across incidents, controls, and compliance workflows.

Final Point of View

CIRCIA should be treated as a readiness issue now, not a scramble later. The rule is still pending, so the right posture is disciplined preparation, not manufactured urgency. For healthcare and defense organizations, the priority is simple: determine whether you may be covered, identify reporting gaps, and document the decision path before the rule is finalized.

Want to assess your organization more thoroughly? Take the 2-minute Discovery Questionnaire or see how Scarlet Comply structures your incident reporting readiness.