CIRCIA (Cyber Incident Reporting for Critical Infrastructure Act) CIRCIA-2242a1: 72-Hour Covered Cyber Incident Report

A covered entity that experiences a covered cyber incident must report it to CISA not later than 72 hours after the entity reasonably believes the incident has occurred.