CIRCIA reporting deadline puts OT data integrity under the microscope

The U.S. government is moving closer to requiring covered critical infrastructure organizations to report significant cyber incidents within 72 hours and ransomware payments within 24 hours. But for operators of industrial control systems, the challenge will extend beyond deadline compliance; they must first determine whether an incident has occurred, establish what was compromised and decide whether the data driving physical processes can still be trusted.

On October 1, 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) submitted the draft of its final rule implementing the Cyber Incident Reporting for Critical Infrastructure Act of 2022 (CIRCIA) to the White House Office of Management and Budget and its Office of Information and Regulatory Affairs for interagency review. Publication is expected by the end of 2026.

The rule would establish mandatory reporting requirements for designated critical infrastructure entities, bringing new urgency to incident detection and response in environments where operational technology (OT) was often designed for isolation rather than continuous security monitoring.

As legacy industrial systems connect to cloud platforms, IoT devices and AI services, authentication and network security alone are no longer enough. An attacker might not need to breach a controller or bypass access controls to manipulate a physical process. Altering the data that informs an otherwise authorized decision could be sufficient.

For critical infrastructure operators, the emerging question is whether they can demonstrate the integrity of the measurements, setpoints and commands on which safe operations depend.

CIRCIA raises stakes for incident detection

CIRCIA's proposed 72-hour incident reporting window and 24-hour ransomware payment disclosure window would formalize federal notification obligations for organizations within the rule's scope. The rule is intended to reach organizations across critical infrastructure sectors, but the final rule will determine which entities must report, what incidents qualify and how reporting obligations apply.

The deadlines could expose weaknesses in OT incident response programs that have historically relied on limited logging, manual investigation and assumptions that industrial networks were effectively isolated.

"OT operators will have to prove what happened in their environment, not assume it," said Thomas Plank, CEO of Tributech, an industrial IoT data infrastructure provider.

Remote maintenance, vendor platforms and connections to enterprise IT systems have eroded the traditional air gap at many industrial sites, Plank said. Yet the monitoring and evidence collection needed to investigate incidents have not always kept pace.

The 72-hour clock, which begins when an organization believes a covered cyber incident occurred, creates pressure to identify reportable events, establish scope and maintain a defensible account of what happened. Meanwhile, the 24-hour ransomware payment deadline makes timely disclosure part of an already difficult operational and executive decision.

A central challenge is that a manipulated industrial measurement might not trigger a conventional security alert. If an operator cannot distinguish an authentic reading from a falsified one, the organization could struggle to recognize an incident, let alone report it accurately.

Why authenticated access is not enough

Many industrial control systems were built decades ago, when connectivity meant a serial cable between devices rather than a connection to a cloud service or AI platform. Legacy protocols were not designed to provide modern cryptographic assurances about the identity of a command's origin or the integrity of its contents.

Replacing these systems can require expensive downtime, engineering changes and renewed safety validation. As a result, operators often must secure modern connections around equipment that cannot support contemporary security controls natively.

Booz Allen Hamilton's 2026 white paper on the expansion of frontier AI into OT systems highlights the growing security implications of connecting advanced AI capabilities to industrial environments. As AI systems gain access to operational data and control workflows, the consequences of compromised inputs can extend beyond information security to physical safety, equipment reliability and service continuity. 

Consider a compressor controlled by an AI-assisted optimization system. An attacker alters a pressure reading before it reaches the model, the AI processes the falsified measurement and recommends a new compressor setpoint. An authorized system accepts the recommendation and sends the command through an authenticated connection, thus manipulating a physical process.

Plank argues that operators need to verify data at the boundary between OT and IT, where information leaves industrial environments and commands return. He maintains that this approach can strengthen trust without requiring immediate replacement of legacy controllers, while allowing verification to extend deeper into the plant as equipment is renewed.

From reporting compliance to operational resilience

CIRCIA is principally a reporting law, not a mandate to deploy a particular data-integrity technology. Nevertheless, its requirements could expose a disconnect between regulatory expectations and what operators can actually establish during an incident.

"The most significant gap will be between what regulators expect operators to know and what they can actually know," said Plank. "Reporting rules assume an operator can recognize an incident, scope it and report it within days. Sophisticated data manipulation is designed to prevent exactly that."

That gap may become more consequential as AI systems make decisions using real-time industrial data. Plank suggests organizations prepare for the possibility that some operational inputs have been compromised. In advance, companies should maintain trustworthy records of data and commands, define reportable incidents in OT-specific terms and establish procedures for determining which systems can continue operating safely.

Operators also need known-good configurations and a way to verify that the data and commands used after recovery are trustworthy. Such capabilities can help organizations make better-informed decisions about whether to isolate equipment, continue production or restore a process.

Procurement can help close the gap over time. Requiring new industrial components to protect data integrity, including through applicable IEC 62443-4-2 security requirements, can gradually extend verification closer to controllers and sensors without forcing an immediate replacement of legacy equipment.

In terms of organizational culture, Plank believes verification must be part of routine operations rather than a special security task, and operators should be encouraged to question readings.

"Experienced operators already sense when a reading doesn't fit the process," he said. "The aim is to turn that instinct into habit and protect it, especially as AI recommendations arrive with an authority that discourages questioning."

For covered organizations under CIRCIA, the immediate priority is to understand the final rule's scope, reporting triggers, deadlines and interaction with existing obligations. CISA's OMB review is a significant milestone, but the final text and effective date will determine the precise compliance requirements.

Regardless, as OT environments become more connected and AI systems gain greater influence over physical processes, critical infrastructure operators will need to demonstrate that the information driving operational decisions remains trustworthy.

Richard Livingston is an editor for TechTarget Cybersecurity, covering news, trends and analysis. Livingston's professional background includes editorial positions in the national defense industry covering the U.S. Army Medical Department, as well as offensive and defensive cyber strategy for military and government audiences.