The Cybersecurity and Infrastructure Security Agency (CISA) will hold online town hall meetings to discuss the new Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA), which is part of the government’s ongoing efforts to improve the way it collects and responds to cybersecurity events. All stakeholders who attend these events can directly shape the future of the United States’ ability to report and respond to cyberattacks.
The virtual town hall schedule: Details on timing and participation
When will these town hall meetings take place? The designated Cybersecurity and Infrastructure Security Agency (CISA) announcement in the Federal Register outlines that there will be several sector-specific town hall sessions from March 9 through March 19, 2026, followed by two general town hall meetings on March 31 and April 2, 2026. Each meeting will last approximately 120 minutes and will be held virtually so people can access them no matter their location in the country.
The sessions are split by sector, allowing healthcare leaders to participate in one session and energy professionals in another. This allows a good concern within each sector to be raised in the appropriate groups, and keeps the discussion on topic for the participants in that group. In the next segment, we zoom out to get a clear picture of the discussion, what stakeholders are addressing, and the importance of additional town halls
A closer look at the discussion and what stakeholders are addressing
Hospitals and health systems, among other groups, have voiced worries that reporting timelines, e.g., 24 hours for ransomware payments and 72 hours for incidents, may pose unnecessary challenges when combined with their pre-existing reporting requirements.
Some people are unsure what types of incidents occur that warrant notification or whether a minor breach would trigger the need for reportable incident reporting. These are difficult questions; these are exactly the types of discussions that CISA wants to facilitate through the town hall meetings so that the final rule will be more applicable, balanced, and able to assist in achieving the national cybersecurity objectives, as the agency sunsets 10 emergency cyber directives.
The next step: How ideas move from input to implementation
The outcome of the town halls will then be reviewed by CISA, and, if needed, revisions will be made to the draft rule. Once this occurs, a final version of the rule will be published; however, it will not become effective until 2026 or later.
There are a lot of steps between the time you submit a proposal and the time it gets approved and implemented, and town halls present an opportunity for community members and other stakeholders to provide input on how the policy should ultimately look before the policy gets finalized. You need to pay close attention now before it’s too late because you can have an impact on how this policy will ultimately turn out.
The importance of these additional town halls and what they really represent
At their first glance, virtual town halls may appear to be informal Zoom meetings; however, they are also very important steps in the refinement process of how the law will apply in practice.
The new Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA) requires that many organizations, such as those involved with critical infrastructure sectors, be subject to the obligation of reporting all reportable cyber incidents and any ransom payments made to the CISA within a specific timeline.
With the occurrence of cyberattacks every day, these special town hall meetings go beyond just presenting technology presentations; they give companies, experts, or even individuals in attendance a platform to influence what decisions will be made to counteract threats posed by digital attacks to America, leading to the U.S. intelligence agency issuing new security guidance. The next piece of this puzzle might very well contain your input.
