Federal Compliance Guide
Are You Prepared for the 72-Hour Incident Reporting Clock?
CIRCIA requires covered critical infrastructure entities to report substantial cyber incidents to CISA within 72 hours and ransomware payments within 24. Most organizations don't know if they're covered, much less whether their workflow can hit the deadline.
- 10 minutes
- Coverage + readiness
- Priority actions
The clock starts at the moment of reasonable belief — not when forensics confirms it. Most organizations underestimate how fast that is.
0 hrs
Window to file the CISA Incident Reporting Form
0 hrs
Window to report a ransomware payment
0 sectors
Critical infrastructure sectors potentially covered
What the Assessment Covers
Four parts, all scored against the actual CIRCIA reporting workflow. The output is your readiness tier and a prioritized action list.
Coverage Quick Test
- Sector-specific trigger questions
- Validation prompts for legal review
- Verdict: covered, likely, unclear, or not covered
Readiness Score (0–100)
- 10 operational capabilities scored
- Clock-start governance & evidence readiness
- Submission and OT reporting readiness
Reporting Failure Impact
- Downtime hours × hourly loss
- External IR, legal, and comms cost inputs
- Configurable reporting failure multiplier
Filing Workflow
- 72-hour timeline annotated to your gaps
- IRF field-ownership mapping
- One-click jump to the official CISA IRF
Key insight
The hard part of CIRCIA is not the form — it's deciding when the clock started. 'Reasonable belief' is a legal threshold, not a technical one, and a defensible position requires written governance for who can declare an incident, what evidence is required, and how the decision is logged in real time.
How it works
From coverage check to filing-ready in 10 minutes
Coverage test
Sector triggers tailored to you
Score readiness
10 capability questions
Quantify exposure
Reporting-failure cost calculator
Priority actions
Owners, timelines, IRF mapping
Run the Free CIRCIA Readiness Check
Find out if you're a covered entity and whether your team can hit the 72-hour deadline today.
Start CIRCIA Readiness Assessment