CIRCIA's 72-Hour Cyber Incident Reporting Rule Just Took Effect: The Law Firm Vendor Compliance Playbook for May 2026

CIRCIA — the federal Cyber Incident Reporting for Critical Infrastructure Act — became enforceable in May 2026. Major cyber incidents now trigger a 72-hour reporting clock to CISA, and ransomware payments must be reported within 24 hours. Law firms are critical infrastructure under the rule. Here's what changes for your tech stack.