Regulayer™ / The 156 laws / Security standards
US · CIRCIA (6 U.S.C. §681b)
Critical-infra incident records & preservation.
What the signed record shows
The proof is a signed, tamper-evident record. Anyone can check it, without an account, and nothing has to leave the building to make it. Evidence, not a promise.
Citation: 6 U.S.C. §681b(a)(1)/(2)/(3)/(4)
In the same family
What to do about it
A signed record of which AI you used and what you checked, sealed to the exact file you deliver, made on your own machine and checkable free by anyone you send it to.
Part of the Regulayer™ proof catalogue: 156 laws and standards, one sealed engine. This page is a product description, not legal advice.
What the statute requires, section by section
Cyber Incident Reporting for Critical Infrastructure Act of 2022 (CIRCIA), enacted by Pub. L. 117-103, Div. Y, § 103 (15 March 2022); codified at 6 U.S.C. § 681b. Provisions addressed:
- 6 U.S.C. § 681b(a)(1)
- Covered entity reports a covered cyber incident to CISA no later than 72 hours after reasonable belief it occurred.
- 6 U.S.C. § 681b(a)(2)
- Ransom-payment report to CISA no later than 24 hours after the payment is made.
- 6 U.S.C. § 681b(a)(3)
- Supplemental reports until the incident is concluded and resolved.
- 6 U.S.C. § 681b(a)(4)
- Preservation of data relevant to the covered cyber incident or ransom payment. STATUS (verified June 2026): the CISA implementing rule (6 CFR Part 226) was published as an NPRM on 4 April 2024 and the FINAL RULE HAS NOT BEEN ISSUED. The 72-hour / 24-hour reporting and the data-preservation parameters are therefore NOT YET LEGALLY IN EFFECT and remain subject to the final rule. This mapper does not assert that any reporting obligation is operative.
Taken from the Regulayer™ entry for this instrument, which is built against the primary text.