{"id":952,"date":"2026-10-09T11:33:27","date_gmt":"2026-10-09T11:33:27","guid":{"rendered":"https:\/\/regulasshipping.com\/blog\/us-ports-press-for-a-single-circia-report-as-cisa-rule-hits-oira\/"},"modified":"2026-10-09T11:34:27","modified_gmt":"2026-10-09T11:34:27","slug":"us-ports-press-for-a-single-circia-report-as-cisa-rule-hits-oira","status":"publish","type":"post","link":"https:\/\/regulasshipping.com\/blog\/us-ports-press-for-a-single-circia-report-as-cisa-rule-hits-oira\/","title":{"rendered":"US ports press for a single CIRCIA report as CISA rule hits OIRA"},"content":{"rendered":"

The White House Office of Information and Regulatory Affairs received the Cybersecurity and Infrastructure Security Agency\u2019s final rule implementing the Cyber Incident Reporting for Critical Infrastructure Act of 2022 on Thursday, 1 October. The pending Executive Order 12866 review is logged under RIN 1670-AA04, title \u201cCyber Incident Reporting for Critical Infrastructure Act (CIRCIA) Reporting Requirements,\u201d agency DHS \/ CISA, stage Final Rule, legal deadline Statutory. Covington\u2019s 8 October note and John Gallagher\u2019s 9 October Seatrade Maritime write-through are the industry reads of that docket. The final text is not in the Federal Register. It is not in force. It does not change the Coast Guard\u2019s already-effective Marine Transportation System cybersecurity rule, and it is not a US port-entry instrument.<\/p>\n

CIRCIA, enacted in March 2022 as Division Y of the Consolidated Appropriations Act, directs CISA to collect reports of covered cyber incidents within 72 hours and ransom payments within 24 hours. CISA published its notice of proposed rulemaking on 4 April 2024. The NPRM estimated coverage of about 316,000 entities across all 16 critical-infrastructure sectors. After hundreds of comments, CISA held town halls in June 2026. Thursday\u2019s OIRA receipt is the last executive-review step before publication. OIRA review can run up to 90 days, or longer if extended, which would push Federal Register publication into early 2027. Implementing regulations are unlikely to take effect for at least 60 days after publication. The precise effective date will be in the final rule text, not in the 1 October receipt stamp.<\/p>\n

What ports and carriers are actually asking for<\/h2>\n

Seatrade\u2019s 9 October piece is the maritime sector\u2019s read, not a substitute for the unpublished final rule. The Association of American Port Authorities, the National Association of Waterfront Employers and US-flag containership operator Matson Navigation are pressing for a formal CIRCIA Agreement between CISA and the Coast Guard so that a single cyber incident report to the Coast Guard can satisfy CIRCIA. The Port of Oakland told CISA that diverting limited resources to duplicative compliance \u201charms not only our cybersecurity posture, but also our mutual national security interest.\u201d The Port of Virginia, which also wants a CISA\u2013Coast Guard reporting agreement, said it has learned of several maritime cyber incidents from news reports rather than from federal partners, and that early notification would have allowed earlier threat mitigation. Virginia asked for two-way communication so ports can prepare, respond and prevent compromise.<\/p>\n

That overlap is not a hypothetical. CISA\u2019s 2024 NPRM itself said the proposed approach for the maritime sector \u201cwill result in two separate cyber incident reporting requirements for entities that are subject to both [the Maritime Transportation Security Act] and CIRCIA.\u201d CISA and the Coast Guard said they were committed to exploring the \u201csubstantially similar reporting\u201d exception, or other mechanisms, so that an MTSA entity could comply with both regimes through one report. AAPA\u2019s earlier comments argued that, once the Coast Guard\u2019s Marine Transportation System cybersecurity rule is fully implemented, ports should qualify for that exception. No published CIRCIA Agreement is on the 1 October OIRA record. Do not brief a single-portal deal as already signed.<\/p>\n

The Coast Guard rule that is already running<\/h2>\n

The Coast Guard\u2019s Cybersecurity in the Marine Transportation System final rule was published on 17 January 2025, became effective on 16 July 2025, and is codified at 33 CFR Parts 101 and 160. It applies to US-flagged vessels, Outer Continental Shelf facilities, and facilities regulated under the Maritime Transportation Security Act of 2002. From 16 July 2025, regulated entities must report \u201creportable cyber incidents\u201d to the National Response Center without delay. By 12 January 2026, personnel with access to information-technology or operational-technology systems were required to complete initial cybersecurity training. By 16 July 2027, owners and operators must designate a Cybersecurity Officer, conduct a Cybersecurity Assessment, and submit a Cybersecurity Plan to the Coast Guard for approval. CRS, writing in June 2026 as R49009, recorded that the Coast Guard had separately asked whether a two-to-five-year additional delay should be granted for US-flagged vessels; as of that report, no final decision on that delay had been published.<\/p>\n

The definitions and clocks do not match CIRCIA\u2019s statute. The Coast Guard product is an immediate NRC report of a reportable cyber incident, plus a phased plan, officer and training regime. CIRCIA\u2019s statute is a 72-hour covered-cyber-incident report and a 24-hour ransom-payment report to CISA. TSA\u2019s still-proposed surface cyber rule is a third overlay for high-risk pipeline, freight-rail, passenger-rail and bus operators, with a proposed 24-hour report to CISA. A marine terminal that also handles a pipeline or rail interface can sit under more than one of those clocks. CRS put the CIRCIA NPRM\u2019s estimated population at about 316,000 entities and TSA\u2019s at about 293 high-risk operators. Those figures are NPRM estimates, not the unpublished CIRCIA final rule\u2019s scope.<\/p>\n

Operational implications<\/h2>\n

An OIRA receipt is a process fact. It is not a reporting instruction, not a covered-entity list, and not a reason to retire the NRC number. Until the final rule is published and effective, MTSA facilities and US-flag vessels keep reporting reportable cyber incidents to the NRC without delay under 33 CFR, keep the January 2026 training box, and keep the July 2027 CySO \/ assessment \/ plan clock. A DPA who treats Thursday as \u201cCIRCIA is live\u201d will file to the wrong desk on the wrong timeline. A DPA who treats Thursday as \u201cnothing to do until 2027\u201d will walk into a dual-report week with no playbook for which facts go to the NRC, which facts would later go to CISA, and which ransom-payment facts have a 24-hour statutory fuse.<\/p>\n

The useful work in this window is the matrix, not a new SMS annex written against an unseen final text. Identify which hulls, terminals, OCS units and MTSA facilities you operate that already sit under the Coast Guard rule. Identify which of those would also be a CIRCIA covered entity if the final rule stays close to the NPRM\u2019s 16-sector scope. Write a single incident-response timeline that can spawn an immediate NRC report and, if the final rule so requires, a 72-hour CISA report and a 24-hour ransom-payment report, without making the watchstander fill two forms in the first hour. Watch OIRA and the Federal Register for whether a CIRCIA Agreement, or a substantially similar reporting exception, actually appears in the final text. AAPA, NAWE and Matson have asked for that exception. They have not been given it in a published instrument.<\/p>\n

Do not recast 1 October as a completed CISA regulation, a worldwide port cyber code, a substitute for the Coast Guard MTS rule, or a US port-entry denial. Do not fold it into a Hormuz kinetic file or into an unpublished Holland & Knight \/ MTS CYBER Act recap. The confirmed facts are RIN 1670-AA04 at OIRA as a Final Rule received 1 October, the statutory 72-hour \/ 24-hour CIRCIA clocks, the Coast Guard\u2019s already-running NRC-without-delay duty, and a maritime-sector request for one report that has not yet been granted in the public docket.<\/p>\n

What Operators Should Note<\/h2>\n