---
title: "Map critical-infrastructure cyber incident reporting duties"
url: "https://ailawframework.com/practice/privacy-data-protection-and-cyber/map-critical-infrastructure-cyber-reporting-duties-for-the-asset/united-states"
type: "task_jurisdiction_version"
site: "AI Law Framework"
id: "A25-T1-R15-US"
practice_area: "Privacy, Data Protection & Cyber"
tier: "yellow"
lawyer_review: "required"
jurisdictions: ["US"]
last_reviewed: "2026-10-22"
---

# Map critical-infrastructure cyber incident reporting duties

> Build a table that separates what 6 USC section 681b says on its face from what CISA says is in force today. Do not mark a report as currently required.

Canonical page: https://ailawframework.com/practice/privacy-data-protection-and-cyber/map-critical-infrastructure-cyber-reporting-duties-for-the-asset/united-states  
Last reviewed: 2026-10-22

Site index for agents: https://ailawframework.com/llms.txt

## Key facts

| Fact | Value |
| --- | --- |
| Practice area | [Privacy, Data Protection & Cyber](https://ailawframework.com/practice/privacy-data-protection-and-cyber.md) |
| Human involvement | Yellow: Lawyer and AI draft together |
| How AI is used | Build a table that separates what 6 USC section 681b says on its face from what CISA says is in force today. Do not mark a report as currently required. |
| What the lawyer must review | Section 681b says a covered entity that experiences a covered cyber incident shall report it to CISA not later than 72 hours after the entity reasonably believes the incident occurred, and that the Director may not require reporting any earlier than that. A ransom payment is reportable even if the attack is not a covered cyber incident. The same section says those duties take effect on the dates in the final rule, and that reports are made in the manner the final rule prescribes. CISA's CIRCIA page states that covered-incident and ransom-payment reporting under CIRCIA will not be required until the final rule goes into effect, that CISA is still working on the final rule, and that reporting before then is voluntary. Do not advise a client that the 72-hour report is currently mandatory. Opinion 512: the chronology of an incident is client confidential information. |
| Written for | United States |
| Applies to | [Map critical-infrastructure cyber reporting duties for the asset](https://ailawframework.com/practice/privacy-data-protection-and-cyber/map-critical-infrastructure-cyber-reporting-duties-for-the-asset.md) |

## Checking plan

- What the AI does: Build a table that separates what 6 USC section 681b says on its face from what CISA says is in force today. Do not mark a report as currently required.
- Basis: Checked against the linked sources on 22 October 2026. Confirm the current instrument before reliance.

## Notes

- The statute's 72-hour and ransom-payment rules are tied to the final rule's effective date.
- Voluntary sharing with CISA is not the same as a CIRCIA report.

## Sources

- [6 USC section 681b (required reporting of certain cyber incidents)](https://www.law.cornell.edu/uscode/text/6/681b) (checked 2026-10-22)
- [CISA: Cyber Incident Reporting for Critical Infrastructure Act of 2022 (CIRCIA)](https://www.cisa.gov/topics/cyber-threats-and-advisories/information-sharing/cyber-incident-reporting-critical-infrastructure-act-2022-circia) (checked 2026-10-22)
- [ABA Formal Opinion 512, Generative Artificial Intelligence Tools (29 July 2024)](https://www.americanbar.org/content/dam/aba/administrative/professional_responsibility/ethics-opinions/aba-formal-opinion-512.pdf) (checked 2026-10-22)

## Forms and precedents for this task

| Form or precedent | Kind | AI level | Summary |
| --- | --- | --- | --- |
| [Critical infrastructure cyber incident reporting clocks](https://ailawframework.com/precedents/privacy-data-protection-and-cyber/soci-cyber-incident-clocks.md) | Checklist | Yellow | Record of the 12-hour and 72-hour reporting clocks in the March 2026 CISC guidance on Part 2B of the Security of Critical Infrastructure Act 2018. |

Signed-in accounts can read the full text of each one.

*Practice guidance for planning and review. Confirm current primary sources and the requirements of the actual matter. This is general information, not legal advice.*