Does the Coming CIRCIA Rule Replace Your DFARS Incident Reporting?

You already report cyber incidents to DoD within 72 hours. A second federal reporting law is almost here.

CIRCIA is the Cyber Incident Reporting for Critical Infrastructure Act of 2022. CISA is the Cybersecurity and Infrastructure Security Agency. On October 1, 2026, CISA sent the final CIRCIA rule to the White House review office. The review office is the Office of Information and Regulatory Affairs, or OIRA. OIRA lists the rule as pending review on October 13, 2026, under tracking number RIN 1670-AA04. RIN is the Regulation Identifier Number, the federal tracking code for a rule. (OIRA review list)

What CIRCIA will require

CIRCIA tells CISA to write rules requiring covered entities in critical infrastructure sectors to report cyber incidents to CISA. The headline duty is a covered cyber incident report to CISA within 72 hours of reasonable belief. The second duty is a ransomware payment report within 24 hours of paying a ransom. (CIRCIA proposed rule, 2024-06526)

Those duties are not in force yet. They start only when the final rule is published and takes effect.

Does it replace your DFARS 7012 duty?

No. The two duties sit in different laws and go to different agencies.

DFARS 252.204-7012 requires defense contractors to report cyber incidents to DoD within 72 hours of discovery through DIBNET. DIBNET is the DoD cyber incident reporting portal. DFARS stands for the Defense Federal Acquisition Regulation Supplement. (DFARS 252.204-7012)

A report to CISA will not satisfy the DFARS clause. A DIBNET report will not satisfy CIRCIA. Plan for two reports, on two clocks, to two agencies.

Defense contractors are squarely in the overlap. The Defense Industrial Base is a critical infrastructure sector, so many contractors will qualify as covered entities.

What to do now

1. Keep your DIBNET playbook current. DFARS 7012 is in force today, whatever happens with CIRCIA.
2. Name the person who decides an incident meets the reasonable belief bar, and the person who files with CISA. Write both names down before an incident happens.
3. Build one intake form that feeds both reports. Draft the facts once, then file twice.
4. Preserve forensic evidence. DFARS requires system images kept for at least 90 days, which also answers CISA follow-up questions.
5. Treat the 24-hour ransomware payment report as a new duty. DFARS has no equivalent. Talk to your lawyer before any payment decision, not during one.
6. Watch the Federal Register for RIN 1670-AA04. When the final rule publishes, read it before changing any process.

One warning: the exact covered-entity thresholds and report contents may change in the final rule. The 2024 proposal is a draft, not the law.

PolicyCortex reads live Azure configuration for incident-relevant evidence and maps findings to NIST 800-171 controls: PolicyCortex.

Sources

• OIRA EO 12866 review list, October 13, 2026: RIN 1670-AA04, CIRCIA Reporting Requirements, Final Rule, received 10/01/2026, Pending Review: https://www.reginfo.gov/public/do/eoReviewSearch?RIN=0750
• CIRCIA NPRM, Federal Register 2024-06526, April 4, 2024: https://www.federalregister.gov/documents/2024/04/04/2024-06526/cyber-incident-reporting-for-critical-infrastructure-act-circia-reporting-requirements
• DFARS 252.204-7012, Safeguarding Covered Defense Information and Cyber Incident Reporting (May 2024): https://www.acquisition.gov/dfars/252.204-7012-safeguarding-covered-defense-information-and-cyber-incident-reporting.
• CIRCIA rulemaking town hall notice, Federal Register 2026-02948, February 13, 2026: https://www.federalregister.gov/documents/2026/02/13/2026-02948/cyber-incident-reporting-for-critical-infrastructure-act-circia-rulemaking-town-hall-meetings