Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA) Reporting Requirements
CISA's CIRCIA rule requires auto dealers to report cyber incidents and ransomware payments to CISA within 72 and 24 hours respectively, with enforcement starting in 2026.
Aforeworn detected this change in the Auto Dealer F&I Compliance space on July 6, 2026 and published this briefing so affected operators are forewarned rather than caught off guard. It is rated High urgency. All auto dealers (franchise, independent, BHPH) and F&I managers handling customer data or digital systems. should confirm how it applies to their specific situation before acting. There is a time constraint attached: Rule effective 90 days after publication (likely July 2024); compliance required by 2026.. Acting after that point can mean penalties, a lapsed licence, or lost eligibility — exactly the kind of surprise Aforeworn exists to prevent. Aforeworn monitors Auto Dealer F&I Compliance continuously and turns every detected change into a plain-English briefing like this one, so you always know first. Forewarned is forearmed.
What changed
New mandatory federal cyber incident reporting obligations under CIRCIA, enforced by CISA.
Who it affects
All auto dealers (franchise, independent, BHPH) and F&I managers handling customer data or digital systems.
What you must do
Implement incident response plan, ensure ability to detect and report covered cyber incidents within 72 hours and ransomware payments within 24 hours.
Deadline
Rule effective 90 days after publication (likely July 2024); compliance required by 2026.
Never miss a change like this again
Aforeworn watches Auto Dealer F&I Compliance around the clock and alerts you the moment a rule moves — with a plain-English brief on what to do.
Start your free trialRelated changes in Auto Dealer F&I Compliance
- Regulations and policy | Consumer Financial Protection Bureau
- Automobiles | Federal Trade Commission
- Small Business Lending Under the Equal Credit Opportunity Act (Regulation B)
- Concept Release on Residential Mortgage-Backed Securities Disclosures and Enhancements to Asset-Backed Securities Registration
- Car Loan Interest Deduction