Friday at 4:40 PM and the 72 Hour Clock Is Running: A CIRCIA Readiness Plan Before the Final Rule Lands

The views expressed are my own and do not represent those of my employer.

Imagine a security director at a mid sized public company. It is 4:40 on a Friday afternoon. The incident commander calls with news nobody wants. Ransomware has hit a cluster of file servers, the backups are partly damaged, and a ransom note names a price. The general counsel is on a flight. The CFO is at a school event. Two people on the call think the company is regulated by CISA. One thinks it is not.

Nobody on that call knows who decides what gets reported, to whom, or by when. The clock is already running. It does not care that it is the weekend.

That scene is fictional, but the gap behind it is real. I have watched security leaders build excellent technical response and then stumble on a simple question: who says the words "this is reportable"? CIRCIA is about to make that question harder, because it adds a federal clock measured in hours on top of clocks measured in business days and calendar days.

CISA sent the final CIRCIA rule to the White House for review on October 1, 2026. Inside Privacy reported that the submission went to the Office of Information and Regulatory Affairs, one of the last steps before publication in the Federal Register. The text is not public. You cannot read the rule yet, but you can build the muscle it will demand. This post is the plan I would run today.

Where the Rule Stands and What You Can Count On

Start with what is settled. Two deadlines come straight from the CIRCIA statute. Covered entities must report covered cyber incidents to CISA within 72 hours after reasonably believing one has occurred, and ransom payments within 24 hours after the payment has been disbursed. The final rule can define who is covered and what counts as reportable. It does not get to rewrite those two numbers.

Now the open items. Law firm Wiley noted on October 6 that commenters focused on covered entity scope, incident triggers, reporting timelines, recordkeeping, and harmonization with existing federal, state and international obligations. Wiley also said it remains unclear how extensively CISA changed the proposal. The scope question is not small. In the proposal, CISA estimated about 316,000 entities across 16 critical infrastructure sectors would be subject to reporting.

Timing is also soft. CISA missed the statutory deadline of October 2025, then target dates of May 2026 and September 2026. OIRA review can take up to 90 days, or longer if OIRA seeks an extension, which would push publication into early next year. Treat the next three to six months as your build window. Do not treat it as a reason to wait.

Five Clocks, Five Starting Events

Open a blank page and list every reporting duty your company already carries. Then write down, for each one, the event that starts the clock. This is the single most useful exercise in the plan, because the clocks do not start on the same event.

SEC Form 8-K, Item 1.05. The deadline is tied to the registrant's determination that an incident is material, not to discovery, and the filing is due within four business days of that determination. A later ransomware payment does not relieve a registrant of the Item 1.05 requirement.

DFARS 252.204-7012. If you hold defense contracts that carry this clause, you report to DoD through DIBNet within 72 hours of discovery. Those are consecutive hours, so weekends and holidays count. Reporting needs a DoD approved medium assurance certificate, which you want in hand before an incident.

HIPAA. If you sponsor a health plan or act as a business associate, notification is due without unreasonable delay and no later than 60 calendar days after discovery. HHS treats the 60 days as an outer limit. Waiting until day 60 after compiling the information on day 10 would be an unreasonable delay.

State breach laws. States can set their own, faster clocks on top of HIPAA. In one 2026 comparison table, Arizona sits at 45 days and California at 30 days. Your counsel owns the full state matrix. Your job is to make sure the matrix is attached to the incident record and not buried in a legal folder.

CIRCIA. Under the proposal, the 72 hours run from the moment the entity reasonably believes a covered incident has occurred. Ropes & Gray called this a significant change from the 30 to 60 days in most state breach notification requirements. The ransom payment clock is separate and starts when money moves.

These clocks do not start on the same event. Discovery, belief, determination and payment each trigger a different obligation, and your plan has to know which one just happened.

The Trigger Gap: Why "Reasonably Believes" Is the Phrase to Watch

Put the SEC and CIRCIA clocks side by side. The SEC clock starts when you decide an incident is material. That decision must itself be made without unreasonable delay after discovery. The CIRCIA clock, as proposed, starts earlier, at reasonable belief that a covered incident occurred.

That order matters. You could owe CISA a report before you have decided anything about materiality. The CISA report and the later 8-K must tell the same story. If your first federal filing describes scope one way and your 8-K describes it another, you have created a problem that no technical control fixes.

The second gap is third parties. The proposed definition of a substantial cyber incident reaches substantial loss of confidentiality, integrity or availability, disruption of your ability to deliver goods or services, and unauthorized access caused by a supply chain compromise. Paul Weiss read the proposal as requiring report of all supply chain compromises and other incidents facilitated by third parties. A breach at a vendor with access to your systems can start your clock. Your vendor management program now feeds your incident reporting process, whether it knows it or not.

I covered the communications side of response in my post on NIST CSF 2.0 Response Communications (RS.CO). Reread it with these clocks in mind. The outward facing duties in that category just became more precise.

Who Decides, and By When

Here is a scenario I have seen play out at multiple organizations. Everyone agrees the incident is serious. Nobody owns the sentence "this triggers a filing." The conversation drifts, each executive assumes someone else is deciding, and the hours burn quietly. The failure is not technical. It is a decision rights failure.

Fix it on paper, by role, with named deputies. My recommendation is a short chain. The incident commander declares the incident and owns the facts. The CISO owns the technical assessment of whether the incident plausibly meets the substantial threshold. Legal owns the reportability call. The disclosure process owns the materiality call. One named person owns filing, and that person has the credentials and portal access before the incident, not during it.

Then put time boxes on it. Mine look like this, and they are my practice recommendation, not a requirement. By hour 12, a first triage of whether the incident could be covered. By hour 24, a documented go or no go checkpoint. By hour 48, a draft report in hand. By hour 60, legal sign off. Hour 72 is the deadline, never the plan.

Your report does not need to be perfect at the deadline. On DFARS, practitioners note the report does not need to be forensically complete at the 72 hour mark. CIRCIA's proposal likewise contemplates supplemental reports as new information arrives. Build the habit of filing with what you know, flagging what you do not, and updating fast.

If you have not written down who holds which authority, my post on NIST CSF 2.0 Roles, Responsibilities, and Authorities (GV.RR) is the place to start.

A deadline you can meet only if the right person answers the phone on a Saturday is not a deadline you can meet. Name deputies for every role.

Run a Privileged Tabletop That Tests Hour 72

Most tabletops end at containment. Yours needs to end at a filing decision. Ask your general counsel to direct the exercise so the work product has the best chance of staying privileged. I am not a lawyer, and privilege is a legal judgment. Let counsel decide how to structure it and who attends.

Design the scenario to break your assumptions. Start the clock on a Friday at 4:40 PM. At hour six, reveal that a vendor with access to your systems was compromised, and watch whether anyone connects it to a reporting trigger. At hour twenty, give the team conflicting evidence on data exposure. At hour thirty, have a director call the CEO asking whether the company has to tell anyone. At hour forty, introduce an offer from the attackers.

Put a visible clock in the room. Real time pressure changes behavior. People who debate for twenty minutes on a slide will decide in five when the clock is on the wall.

Score the exercise on what matters. How long did it take to reach a named decision on each clock? Who actually showed up? Was the filer able to log in? Did the SEC, DFARS, HIPAA and CIRCIA analyses reach the same factual conclusion about scope? The output is a gap list and a filled decision log, not a slide deck.

The Ransom Payment Path Is Its Own Exercise

Ransom payment reporting deserves a separate drill. Under the proposal, a ransom payment report is due within 24 hours after the payment is disbursed. The duty applies when the entity, or another party on its behalf, makes the payment. Steptoe notes it also covers payments tied to ransomware attacks that do not independently qualify as covered cyber incidents.

The joint report rules add a wrinkle. If a payment happens within 72 hours of reasonable belief that an incident occurred, a joint report can cover both. If the payment comes later, a supplemental report is due within 24 hours of disbursement. Your tabletop should test both paths.

Design the path so that money never moves before the report is queued. Decide who has authority to approve a payment, which is a board and CEO level conversation, and who confirms to you the moment funds leave. If a negotiator or insurer pays on your behalf, your contract with them must require immediate notice. A 24 hour clock that starts without your knowledge is not a clock you can meet.

Keep the SEC angle in the drill too. Paying does not erase the 8-K analysis if the incident was material. Legal owns sanctions screening and law enforcement coordination. Write those steps into the path, owned by counsel, so nobody improvises them at midnight.

The One Page Decision Log

The decision log is the artifact that turns all of this into a repeatable process. It is also the document you will want if a regulator asks why you filed when you did. Keep it to one page so people actually fill it in under pressure. Here is the template I would use.

Header. Incident name, incident commander, log owner, and the time the log was opened.

Clock table. One row per regime: SEC 8-K, DFARS, HIPAA, state laws, CIRCIA incident report, CIRCIA ransom report. For each row, record the trigger event, the time that event occurred or was believed to occur, the computed deadline, and the current status.

Facts known. What you knew at the time of each decision, with the source of each fact. Facts only. No speculation.

Facts unknown. What you did not know and who was working to find out.

Decision and reasoning. The call that was made, who made it, the time, and two or three sentences on why.

Dissent. Anyone who disagreed and what they said. This protects the decision and the people involved.

Next checkpoint. The next time the decision gets revisited, always in hours, never in "tomorrow."

Record retention needs a conversation with counsel. For context, the proposal would require preserving relevant data for no fewer than two years after the last required CIRCIA report or ransom disbursement. DFARS requires image preservation for at least 90 days from submission of the report. Decide now how long the log lives alongside that evidence.

Tell the Board Which Assumptions You Are Making

You cannot wait for the rule to brief the board. You also cannot present the proposal as settled. The honest middle is a short list of written assumptions, each flagged so the board knows what could change.

Assumption one: the clocks hold. The 72 hour and 24 hour windows come from the statute, so I would bet on them staying.

Assumption two: you are covered. Until counsel concludes otherwise, plan as if your company is in scope. The proposal's estimate of roughly 316,000 entities is a reason to assume breadth, not narrowness.

Assumption three: the trigger is reasonable belief. Plan on the proposal's formulation, and know that the final rule may adjust the definition of a substantial incident.

Assumption four: you will file more than once. The harmonization path is not built. Covington's 2024 analysis said few if any existing reporting requirements would likely qualify for the substantially similar exception. A Summit 7 discussion in October 2026 noted that the promised public list of CIRCIA agreements does not exist, and DoD officials have said no progress has been made. Meanwhile, the White House's top cyber official said cutting overlap has been a focus of the final rule. Hope for relief. Plan for duplicate filings.

Commit to a revisit date. When the rule publishes, compare it against these assumptions within 30 days and report back to the board on what changed from the 2024 proposal. That one commitment turns uncertainty into a managed risk.

Getting Organizational Support

CIRCIA readiness fails when security presents it as a security project. Frame it as a decision speed and disclosure consistency problem, in the language each audience already uses. I covered the broader playbook in Winning the Room: How to Gain and Keep Executive Support. Here is how it applies to this topic.

The board and audit committee. Do not open with the regulation. Open with exposure. A late or inconsistent report creates regulatory risk, and a mismatch between a federal filing and a public disclosure creates disclosure risk. Ask for three things: endorsement of the written assumptions, confirmation of who holds decision authority, and a request that the tabletop result come back to the committee. My post on board and executive governance under NIST CSF 2.0 shows how to keep that conversation at the right altitude.

The CEO and CFO. Talk about time. Tell them that at some hour of a Saturday they may be asked to decide on a payment or a materiality call, and that you want that decision to be informed and rehearsed. The CFO cares about disclosure accuracy and cash. Give them both.

The general counsel. Make counsel a co owner, not a reviewer. Counsel owns reportability, privilege and the state matrix. Give legal a seat at the tabletop design table from day one.

Business unit and operations leaders. They will hear about disruption and vendor problems before you do. Ask for a simple escalation rule: any outage, vendor breach or extortion contact reaches the incident commander within hours. Explain that this protects their business from a surprise regulatory problem.

Procurement and vendor owners. Ask them to put prompt incident notice into vendor contracts at renewal. Given how the proposal treats third party compromise, a vendor that sits on bad news is now your reporting risk.

The security team. Remove fear. Tell responders that early escalation is rewarded, even when it turns out to be nothing. A team that hides a maybe will cost you the first 24 hours.

Key Points

• CISA sent the CIRCIA final rule to OMB on October 1, 2026. Publication could come late this year or early next year.
• The 72 hour incident clock and 24 hour ransom payment clock come from the statute. Scope, triggers and harmonization are still open.
• Your existing clocks start on different events: materiality determination, discovery, reasonable belief and payment.
• Name the decider for each call by role, with deputies and time boxes.
• Run a privileged tabletop, directed by counsel, that ends at a filing decision on a Friday afternoon.
• Drill the ransom payment path separately and queue the report before money moves.
• Keep a one page decision log and a written set of assumptions for the board.
• Compare the final rule against your assumptions within 30 days of publication.

Pro Tips

Get the credentials now. Filing portals and certificates take time. Whoever files should have tested access today. Do a dry run login quarterly.

Pre draft the narrative. Write a skeleton report with blanks for facts. Under pressure, people fill in blanks faster than they write from nothing, and a skeleton keeps your federal reports and your public statements consistent.

Keep a consolidated clock calendar. Compute business days for the SEC, calendar days for HIPAA and consecutive hours for DFARS and CIRCIA in one tool. Mixed arithmetic at 2 AM produces mistakes.

Rehearse the "not yet reportable" decision. Teams practice saying yes. They rarely practice saying no with a documented reason. A well recorded no is as valuable as a timely yes.

Interview your vendors before the rule. Ask your top suppliers how fast they would tell you about a compromise. Their answer is your real timeline.

Pitfalls to Avoid

Do not wait for the final text to start. The decision rights, the log and the tabletop are useful under any version of the rule. Waiting means building under pressure later.

Do not treat the 2024 proposal as final. The text at OMB may differ. Write assumptions down, label them, and revisit them when the rule publishes.

Do not assume CIRCIA replaces your other filings. No substitution mechanism is visible today. Plan for each regime to stand on its own.

Do not let the tabletop skip the weekend. Real incidents land at inconvenient hours. If your exercise runs only in business hours, you have tested a company that does not exist.

Do not put the filing decision in one head. A single point of failure on vacation is a missed deadline. Cross train the deputies.

Do not let privilege become an excuse for silence. Counsel direction protects the analysis. It does not remove the need for a clear, timely record of who decided what.

Final Thought

The final CIRCIA rule will answer the questions about scope and triggers, but it will not decide who picks up the phone at 4:40 on a Friday. That part is yours, and you can build it now: the map, the roles, the log, the rehearsal and the honest list of assumptions. When the rule publishes, you will not be starting a program. You will be adjusting one.

If this plan helped, share it with the general counsel or the CISO you know who is still waiting on the final text. Tell me in the comments which clock worries you most, and subscribe to InfoSec Made Easy for the follow up once the rule text lands. I read every one.