CISA targets September 2026 for the final CIRCIA rule, which will require incident reporting from covered entities in sixteen critical infrastructure sectors. An organization is covered if it either exceeds SBA size standards for its industry or meets sector-based criteria, regardless of size. The rule applies broadly to any entity with U.S. legal presence participating in critical infrastructure sectors, not just owners and operators.