The Cybersecurity and Infrastructure Security Agency (CISA) said Monday that an ongoing Department of Homeland Security (DHS) shutdown will probably delay the final Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA) rule.
Town hall meetings scheduled for weeks in March and April to discuss the final CIRCIA rule have been postponed, CISA said in a statement. The agency said it will publish a revised town hall schedule once the department reopens.
The CIRCIA cyber incident reporting rule would require covered organizations to report major incidents to CISA within 72 hours and ransom payments within 24 hours. Five industry-specific town halls and two general town halls were intended to hear feedback on the final rule.
While the final rule has already encountered delays – it was supposed to be enacted in October 2025, but that date was later extended to May 2026 – CISA said the postponed town halls “will likely result in a delay to the issuance of the final rule.”
Currently, CISA – like most DHS components – is working at a limited capacity while the department awaits new appropriations from Congress.
Unlike the rest of the federal government, DHS did not receive any fiscal year 2026 appropriations under the latest funding agreement while congressional Republicans and Democrats are in a standoff over immigration enforcement policies.
The new delay to the CIRCIA rule was not unexpected. Madhu Gottumukkala, former acting director of CISA, told lawmakers in February that if the DHS shutdown continued, the final rule would be pushed back.