CIRCIA Final Rule Is Coming: What Defense Contractors Need to Know

AUSA Supply Chain Cyber Readiness Preview: https://tinyurl.com/AUSAsupplychain The CIRCIA final rule has entered regulatory review, putting publication potentially just months away. For defense contractors, one major question remains unresolved: will CISA accept existing DFARS 252.204-7012 cyber incident reports, or will contractors have to report the same incident twice? We break down why the two 72-hour reporting requirements are far less similar than they appear, what “substantially similar” actually means, and why CIRCIA could create an entirely new reporting obligation for the defense industrial base. CIRCIA Proposed Rule: https://www.federalregister.gov/documents/2024/04/04/2024-06526/cyber-incident-reporting-for-critical-infrastructure-act-circia-reporting-requirements CIRCIA Pod 1: https://youtu.be/bvwnNSpDZgU?si=bJjZjrhzHJQxqYKH CIRCIA Pod 2: https://youtu.be/ngYSaO5fg5Y?si=vk-9dTSqT1HrNakq CIRCIA Pod 3: https://youtu.be/kUdhl5QfziU?si=kEnHdlWD8D17w0Pf