CIRCIA and State Government: Why Mandatory Incident Reporting Is an Organizational Problem Before It's a Technical One

What CIRCIA Requires

Congress enacted CIRCIA on March 15, 2022 (Pub. L. 117-103, codified at 6 U.S.C. §§ 681–681g), directing CISA to issue regulations establishing two mandatory reporting requirements for covered critical infrastructure entities:

• Covered cyber incidents: report to CISA within 72 hours of reasonably believing a covered cyber incident has occurred.
• Ransomware payments: report to CISA within 24 hours of making any ransom payment, whether or not the underlying incident meets the broader reporting threshold.
• Supplemental reports: submit updated reports when substantially new or different information is available, or when a ransom payment follows an initial incident report.

CISA published a Notice of Proposed Rulemaking on April 4, 2024 (89 Fed. Reg. 23644). The proposed rule defines a "covered cyber incident" as a substantial cyber incident meeting at least one of four threshold conditions: substantial loss of confidentiality, integrity, or availability of an information system; serious impact on the safety and resiliency of operational systems and processes; disruption of business or industrial operations; or unauthorized access through a third-party provider, cloud service, managed service provider, or supply chain compromise. These are the proposed definitions; the final rule's precise language may differ.

These are not voluntary information-sharing arrangements for most covered entities: CISA can issue requests for information and subpoenas, and the Attorney General can enforce a subpoena in federal district court (6 U.S.C. § 681d). State, local, tribal and territorial government entities are the exception. Section 681d(f) says the enforcement section "shall not apply" to them, and the NPRM acknowledges the reporting requirement is unenforceable against state and local governments. That makes the case for state readiness one of governance and accountability, not penalty avoidance. In Spartan X's assessment, a state that fails to report forgoes the federal visibility and threat context that reporting is meant to produce, at the moment it most needs them.

Why State Government Is Covered

The statute does not name covered sectors or entities; it leaves a clear description of covered entities to the final rule. Coverage for state government therefore rests on the NPRM's proposed criterion, which would make a state, local, tribal or territorial government entity for a jurisdiction with a population of 50,000 or more a covered entity (proposed 6 CFR 226.2). That is a proposal, not law, but every state government would clear the threshold if it is adopted (the least populous state, Wyoming, had an estimated 587,618 residents in 2024, per the Census Bureau).

CIRCIA's statutory definition of a covered entity refers to the critical infrastructure sectors defined in Presidential Policy Directive 21 (February 12, 2013). National Security Memorandum 22 rescinded and replaced PPD-21 on April 30, 2024, kept 16 sectors, and renamed this one the Government Services and Facilities Sector. CISA's sector page describes it as encompassing federal, state, local, tribal and territorial facilities, including courthouses, and, through its Education Facilities Subsector, public schools.

State agencies are not peripheral to this framework. CISA's June 2026 CIRCIA town halls included the Government Facilities Sector in a combined eight-sector session on June 16. The Federal Register notice framed the sessions as input on "refining the scope and burden" of the proposal, so the final coverage lines may move.

The exposure runs beyond the Government Facilities Sector. Many state agencies independently qualify in other sectors:

• Emergency Services Sector: state emergency management agencies, state fusion centers, public safety answering points (PSAPs)
• Healthcare and Public Health Sector: state health departments with operational public health IT, Medicaid agency systems, state hospital authorities
• Water and Wastewater Systems Sector: state water authorities with operational technology systems, state drinking water regulatory programs with connected monitoring systems
• Transportation Systems Sector: state departments of transportation operating traffic management, bridge management, and freight systems

As a hypothetical, a state with 40 principal executive agencies might find a dozen operating in sectors beyond government facilities, each potentially subject to different Sector Risk Management Agency guidance on top of CIRCIA's baseline requirements. Under the NPRM, coverage attaches to the state, local, tribal or territorial government entity, so the sector mapping is chiefly a tool for understanding exposure, and counsel should confirm whether your agencies are treated as one entity or several.

The Governance Architecture That Does Not Fit

CIRCIA's compliance model assumes a covered entity is an organization with a CISO who has operational authority over its information systems and can represent it as a reporting entity. That describes a private utility. It does not describe a state government.

Structures vary by state, and this is a general pattern rather than a surveyed finding: the CISO may sit in the governor's office, the budget agency, or a central IT department, with policy authority but without direct operational access to agency-level IT environments. Agency CIOs run their own infrastructure under their own agency leadership. The state CISO may not know, in real time, whether the Department of Revenue's tax filing system has experienced a qualifying incident unless the agency decides to report it upward.

To illustrate the risk, consider a hypothetical scenario: ransomware hits a state Department of Motor Vehicles on a Friday evening. The agency's IT team spends 48 hours in containment mode before briefing the agency director. The agency director calls the state CISO on Monday morning. If CISA's 72-hour clock runs from the DMV's team's initial assessment — which is when the covered entity "reasonably believed" the incident occurred — the reporting window may already be closed before the state CISO's office knows the incident happened.

This is not a technology problem. No SIEM integration resolves the question of whether a state agency IT team will treat the first 48 hours as an internal response exercise or as a compliance event requiring immediate upward notification. That is an organizational design problem requiring explicit policy, executive authority, and rehearsal.

A Decision Sequence for State CISOs

Readiness work divides into three categories: scoping, structure, and procedure. The first two do not wait for the final rule.

Scoping (start now, refine after final rule):

1. Inventory state agencies and identify which critical infrastructure sectors each operates within. Begin with a presumption that every principal executive agency falls within the Government Services and Facilities Sector; add sector-specific exposure where it clearly applies. Document the basis, and confirm with counsel whether the NPRM's entity-level coverage treats your agencies as one entity or several.
2. Map existing sector-specific reporting obligations. CIRCIA generally adds to existing requirements rather than replacing them. If your Medicaid agency already reports breaches to HHS under the HIPAA Breach Notification Rule (45 CFR 164.400-414), that obligation remains unless an exception applies. CIRCIA does provide one: where CISA has a CIRCIA Agreement with another federal agency, an entity already required to report substantially similar information within a substantially similar timeframe does not have to file separately (6 U.S.C. § 681b(a)(5)(B)). Map whether any existing obligation could qualify, and identify where obligations overlap and where they conflict.
3. Identify gaps in current reporting authority. Ask specifically: if an incident qualifying under CIRCIA's thresholds occurred at Agency X tonight, who has authority to submit the CISA report on behalf of that agency? If there is no clear answer, that gap is your highest-priority finding.

Structure (requires executive sponsorship):

4. Designate a CIRCIA Reporting Official with documented backup coverage. This person needs either direct authority to submit reports to CISA across state government or a defined escalation path with explicit time constraints.
5. Decide between centralized, distributed, and hybrid reporting architectures. Centralized reporting — state CISO submits for all agencies — requires reliable agency-to-CISO notification well within the 72-hour window, since the state CISO needs time to assess and prepare the report. Distributed reporting — each agency submits for its own qualifying incidents — requires consistent incident classification criteria across agencies with widely varying technical staff and resources. Hybrid approaches assign reporting authority based on the type of agency or the nature of the incident. There is no architecture without failure modes; the question is which failure modes your organization can actually manage.
6. Brief the governor's office and agency heads before the final rule takes effect. CIRCIA's 72-hour clock will not pause for executive awareness-building after an incident. Leadership needs to understand the reporting obligation before an incident, not during one.

Procedure (operational, can be tested now):

7. Write incident classification criteria aligned to CIRCIA's four threshold conditions in language that an agency security team can apply without calling the state CISO first. The goal is consistent, independent classification across agencies.
8. Build inter-agency notification protocols that route qualifying incidents to the state CISO's office within 24 hours of the agency's own initial assessment. That leaves time for state-level triage, incident characterization, and report preparation within the 72-hour window.
9. Run a tabletop exercise with a realistic scenario before the final rule takes effect. A ransomware attack that hits two agencies simultaneously, on a weekend, with conflicting initial assessments about whether a threshold condition has been met, is a better test than a clean single-agency scenario during business hours. The scenario that surfaces organizational gaps is more valuable than the scenario that confirms your procedures work smoothly.

Why Waiting for the Final Rule Is the Wrong Frame

The wait-for-the-final-rule posture has a legitimate application: technical implementation decisions, particularly around reporting system integrations, benefit from waiting for the final rule's specific technical requirements. Some details of the proposed rule will change.

The organizational design steps above do not depend on the final rule's precise definitions. Whether the final rule's threshold for "substantial loss of confidentiality" is somewhat narrower or broader than the NPRM's proposal does not change the structural answer to the question of who holds reporting authority across 40 agencies.

CIRCIA's statute does not specify a post-final-rule compliance window for covered entities; the 18-month and 24-month figures in the law are CISA's rulemaking deadlines (24 months from enactment to publish the NPRM, 18 months after the NPRM to publish the final rule), not grace periods for covered entities, and the reporting requirements take effect on the dates prescribed in the final rule. The final rule could therefore set its own applicability date. State CISOs should not assume a lengthy runway between the final rule's effective date and the moment reporting obligations apply. The organizational work takes months regardless — but that time comes from what the work actually requires, not from statutory permission to delay.

CISA's stated focus on refining scope and burden means the final coverage lines may move, but the compliance challenge for states is organizational before it is technical, and the organizational work has no shortcut.

Sources and further reading

• Consolidated Appropriations Act, 2022, Pub. L. 117-103, Division Y (CIRCIA), full law (Congress.gov)
• 6 U.S.C. § 681b, covered cyber incident and ransom payment reporting (Cornell LII)
• 6 U.S.C. § 681d, noncompliance and subpoenas, including the SLTT exclusion (Cornell LII)
• CISA Notice of Proposed Rulemaking, 89 Fed. Reg. 23644 (April 4, 2024)
• 2026 Regulatory Plan and Unified Agenda entry, RIN 1670-AA04 (Reginfo.gov)
• National Security Memorandum 22 on Critical Infrastructure Security and Resilience (April 30, 2024)
• Presidential Policy Directive 21 (February 12, 2013), since rescinded
• CISA Government Services and Facilities Sector
• CIRCIA town hall schedule, Federal Register (May 26, 2026)
• CISA CIRCIA rulemaking

Spartan X provides cybersecurity strategy and architecture advisory to state government agencies in Colorado and Florida, including risk assessments, security architecture and compliance roadmaps. The organizational design questions CIRCIA raises for state CISOs, such as decentralized IT and centralized accountability, sit squarely in that work. The final rule will sharpen the timeline; it will not change the underlying work.