---
title: "List the facts of a ransom payment without preparing a CIRCIA report"
url: "https://ailawframework.com/practice/technology-media-and-telecommunications-it-contracts/prepare-the-ransomware-or-cyber-extortion-payment-report/united-states"
type: "task_jurisdiction_version"
site: "AI Law Framework"
id: "A24-T20261018-7-US"
practice_area: "Technology, Media & Telecommunications / IT Contracts"
tier: "red"
lawyer_review: "required"
jurisdictions: ["US"]
last_reviewed: "2026-10-22"
---

# List the facts of a ransom payment without preparing a CIRCIA report

> List the payment date, the amount, and the recipient as the documents print them, with the page. Write no sentence of a report.

Canonical page: https://ailawframework.com/practice/technology-media-and-telecommunications-it-contracts/prepare-the-ransomware-or-cyber-extortion-payment-report/united-states  
Last reviewed: 2026-10-22

Site index for agents: https://ailawframework.com/llms.txt

## Key facts

| Fact | Value |
| --- | --- |
| Practice area | [Technology, Media & Telecommunications / IT Contracts](https://ailawframework.com/practice/technology-media-and-telecommunications-it-contracts.md) |
| Human involvement | Red: Lawyer writes; AI may check, clarify or collect data |
| How AI is used | List the payment date, the amount, and the recipient as the documents print them, with the page. Write no sentence of a report. |
| What the lawyer must review | 6 U.S.C. § 681b(a)(1) states that a covered entity that experiences a covered cyber incident shall report it to the Agency not later than 72 hours after the entity reasonably believes the incident occurred, and the Director may not require reporting any earlier than that. Section 681b(a)(2) states that a covered entity that makes a ransom payment as the result of a ransomware attack shall report the payment not later than 24 hours after it is made, even if the attack is not a covered cyber incident. The same section states that paragraphs (1) through (4) take effect on the dates prescribed in the final rule. CISA's CIRCIA page says reporting of covered cyber incidents and ransom payments will not be required until the final rule goes into effect, and that CISA continues to work on that rule. You do not send a report on the strength of these pages. There is no asset-register duty and no annual risk-management-program report in the pages that were opened. |
| Written for | United States |
| Applies to | [Prepare the ransomware or cyber extortion payment report](https://ailawframework.com/practice/technology-media-and-telecommunications-it-contracts/prepare-the-ransomware-or-cyber-extortion-payment-report.md) |

## Checking plan

- What the AI does: List the payment date, the amount, and the recipient as the documents print them, with the page. Write no sentence of a report.
- Basis: Checked against the linked sources on 22 October 2026. Confirm the current instrument before reliance.

## Notes

- The 72-hour and 24-hour periods are in the statute, and the statute says those paragraphs take effect on the dates in the final rule.
- CISA's page, opened on 22 October 2026, says the reporting requirements are not in effect yet.

## Sources

- [6 U.S.C. § 681b, CIRCIA reporting requirements](https://www.law.cornell.edu/uscode/text/6/681b) (checked 2026-10-22)
- [CISA, Cyber Incident Reporting for Critical Infrastructure Act](https://www.cisa.gov/circia) (checked 2026-10-22)

## Forms and precedents for this task

| Form or precedent | Kind | AI level | Summary |
| --- | --- | --- | --- |
| [Ransomware or cyber extortion payment report: fields on the ACSC form](https://ailawframework.com/precedents/technology-media-and-telecommunications-it-contracts/ransomware-payment-report-fields.md) | Checklist | Yellow | Field list for the ransomware and cyber extortion payment report on the cyber.gov.au form. The form cites section 27 of the Cyber Security Act 2024 and a 72-hour period.… |
| [SOCI Act cyber incident report: 12-hour and 72-hour clocks](https://ailawframework.com/precedents/technology-media-and-telecommunications-it-contracts/soci-cyber-incident-clocks.md) | Checklist | Yellow | The CISC description of mandatory cyber incident reporting for a critical infrastructure asset. A significant impact is 12 hours. A relevant impact is 72 hours.… |

Signed-in accounts can read the full text of each one.

*Practice guidance for planning and review. Confirm current primary sources and the requirements of the actual matter. This is general information, not legal advice.*