Your security operations center detects unusual lateral movement at 2:47 AM. By 6:00 AM, your incident response team has contained the activity. By noon, you're writing reports. But which reports? And to whom?
The GAO recently identified 80 regulations across nine critical infrastructure sectors with overlapping reporting requirements. That means roughly 70% of the 117 regulations they reviewed ask for the same types of information, sent to different federal agencies. When CIRCIA's final rule arrives in September 2026, you'll add another reporting obligation to that stack.
The decision you're facing isn't whether to report. It's how to route your limited compliance resources without creating gaps or duplicating effort.
The Decision You're Facing
You need to determine which reporting path matches your incident or activity. The wrong choice doesn't just waste time. It delays the reports that actually matter, creates confusion during audits, and pulls your security team away from containment work.
Three factors drive every routing decision: what happened, when the clock started, and who regulates your sector.
Key Factors That Affect Your Choice
Incident severity and scope. If you're dealing with a substantial cyberattack, CIRCIA's 72-Hour Notification Requirement applies. "Substantial" means the incident has caused, or is reasonably likely to cause, substantial harm. That's your trigger. If the event doesn't meet that threshold, you're likely reporting under a sector-specific rule instead.
Timing of the obligation. CIRCIA starts the clock when you formulate a reasonable belief that a substantial incident occurred. Other regulations tie reporting to discovery, confirmation, or specific operational thresholds. A financial services entity under NYDFS Cybersecurity Regulation reports within 72 hours of determining a cybersecurity event has occurred. The language is similar, but the scope differs.
Your sector's existing requirements. If you operate critical infrastructure in energy, you're already reporting under North American Electric Reliability Corporation Critical Infrastructure Protection standards. Healthcare entities report breaches under the Health Information Technology for Economic and Clinical Health Act. Each sector has its own baseline. CIRCIA layers on top of those, which means you're often filing multiple reports about the same event.
Path A: Incident-Driven Reporting Under CIRCIA
Choose this path when you've identified a substantial cyberattack and you operate in one of the 16 critical infrastructure sectors.
When to choose this path:
- The incident meets CIRCIA's substantial harm threshold
- You've formulated a reasonable belief (not certainty) that the attack occurred
- 72 hours haven't passed since that belief was formed
What you'll report:
- Description of the cyberattack, including tactics and techniques observed
- Impact or potential impact on your operations
- Information about the threat actor, if known
- Your response actions
Resource implications: You're writing this report while your Computer Security Incident Response Team is still in Containment, Eradication, and Recovery. That means you'll be drafting with incomplete information. Build templates now that capture what CISA needs without requiring your incident commander to stop work every hour for status updates.
If your sector already requires incident reporting to another agency within a similar timeframe, you're now writing two reports. The GAO found 48 regulations that require cybersecurity incident reporting. Odds are high you're covered by more than one.
Path B: Plan and Posture Reporting Under Sector Rules
Choose this path when you're submitting cybersecurity plans, technical configurations, or compliance documentation.
When to choose this path:
- You're documenting your security program, not responding to an active incident
- The regulation asks for your cybersecurity plan, risk assessment, or control implementation evidence
- The deadline is tied to a calendar date or operational milestone, not an event
What you'll report: The GAO identified 52 regulations requiring cybersecurity plans or other technical information. These reports describe your controls, not your incidents. You're explaining how you implement Role-Based Access Control, how you've deployed Zero Trust Architecture, or how you're meeting specific technical safeguards.
Resource implications: This is where overlap becomes expensive. If you operate in multiple sectors or fall under multiple regulators, you're often describing the same controls in different formats. Your ISO/IEC 27001 Statement of Applicability covers many of the same controls as your NIST Cybersecurity Framework (CSF) 2.0 implementation plan. But each regulator wants its own document.
Map your control frameworks once. Build a crosswalk between ISO/IEC 27002 controls, NIST Cybersecurity Framework (CSF) 2.0 2.0 functions, and your sector-specific requirements. When a regulator asks how you implement Privileged Access Management, you pull from the same source of truth and reformat for the audience.
Path C: Audit and Assessment Reporting
Choose this path when you're submitting third-party audit results or internal assessment findings.
When to choose this path:
- The regulation requires an independent review, audit, or assessment
- You've completed a SOC 2 Type II examination, penetration test, or control assessment
- The deadline is annual, biennial, or tied to a certification cycle
What you'll report: The GAO found 25 regulations requiring reviews, audits, or assessments. You're not describing an incident or your plan. You're providing evidence that someone independent verified your controls work.
Resource implications: If you're already getting a SOC 2 Type II report for customer contracts, ask whether that examination scope covers your regulatory obligations. Many sector-specific audit requirements overlap with SOC 2 trust services criteria. You might satisfy multiple obligations with one engagement if you scope it correctly.
The same logic applies to penetration testing. If your regulation requires annual penetration testing and you're already testing for PCI DSS compliance or customer requirements, align the timing and scope. One test, multiple reports.
Summary Matrix
| Reporting Type | Trigger | Typical Deadline | Primary Audience | Overlap Risk |
|---|---|---|---|---|
| CIRCIA Incident | Substantial cyberattack | 72 hours from reasonable belief | CISA | High, likely duplicates sector incident reporting |
| Sector Incident | Cybersecurity event per sector definition | Varies (often 24-72 hours) | Sector regulator | High, often duplicates CIRCIA for same event |
| Plan/Posture | Calendar or operational milestone | Annual, biennial, or on change | Sector regulator | Medium, control descriptions repeat across frameworks |
| Audit/Assessment | Completion of independent review | Post-audit (often 30-90 days) | Sector regulator, customers | Medium, scope overlaps with other audit obligations |
The GAO is developing an implementation plan to streamline these requirements. Until that arrives, your job is to route reports efficiently without missing obligations. Build your templates now. Map your frameworks once. And when your incident commander asks which report to write first, you'll have an answer that doesn't start with "all of them."
