CIRCIA's 72-Hour Cyber Incident Reporting Rule Just Took Effect: The Law Firm Vendor Compliance Playbook for May 2026
CIRCIA — the federal Cyber Incident Reporting for Critical Infrastructure Act — became enforceable in May 2026. Major cyber incidents now trigger a 72-hour reporting clock to CISA, and ransomware payments must be reported within 24 hours. Law firms are critical infrastructure under the rule. Here's what changes for your tech stack.
Published: 2026-05-02T13:29:50.648Z · Category: Industry News · 7 min read
For four years, CIRCIA has been "coming." This month, it's here. The final rule from the Cybersecurity and Infrastructure Security Agency creates the first federal mandatory cyber-incident reporting regime, with criminal subpoena authority behind it. The compliance window is unforgiving — and most law firms have not yet figured out whether they're inside the scope.
Spoiler: many of them are.
⚖️ Why Law Firms Are Inside the Tent
CIRCIA defines "covered entity" expansively. The triggers most law firms hit:
- Sector-by-association: Firms representing clients in 13 of the 16 critical infrastructure sectors (healthcare, financial services, energy, communications, water, transportation, etc.) are typically pulled in as part of those sectors' service ecosystems.
- Size threshold: Firms above the SBA small-business size standard for legal services ($14M+ in annual revenue) are presumptively covered.
- Data type: Firms processing protected health information, financial sector data, or government CUI/FCI data are pulled in regardless of size.
⏱️ The Two Reporting Clocks
| Event | Reporting Window | Mechanism |
|---|---|---|
| Substantial cyber incident | 72 hours from reasonable belief | CIRCIA web portal + supplemental updates |
| Ransomware payment (regardless of size) | 24 hours from payment | CIRCIA web portal |
| Material new information | Promptly (within 72 hours of discovery) | Supplemental report |
| Final close-out report | Upon "substantial completion" of response | Final report submission |
"Substantial cyber incident" is defined as: substantial loss of confidentiality/integrity/availability; serious impact on operations; unauthorized access via supply-chain compromise; or unauthorized access enabling exfiltration of "sensitive information." That last category is broad enough to capture nearly any client-data exfiltration event.
🔗 The Vendor Problem That Catches Most Firms
Here's the trap. CIRCIA's clock starts from "reasonable belief" — and reasonable belief includes notification from a vendor. If your practice management vendor, your DMS, your billing platform, or your e-discovery provider tells you they've experienced a substantial cyber incident affecting your data, your firm's 72-hour clock starts the moment you have that information.
🛡️ The 6 Vendor Controls Your Firm Needs Now
Contractual Notification SLA
Every legal-tech vendor contract must have a defined breach-notification SLA (24 hours is now industry standard) with named contacts and out-of-band channels.
Incident Classification Playbook
Pre-defined criteria for what triggers your firm's reporting obligation, who decides, and within what window. Don't make this decision under pressure.
Data Residency Map
A current, written map of which client data lives in which vendor system. CIRCIA reports require data-type and volume estimates within 72 hours.
SOC 2 Type II Floor
Make Type II attestation a vendor minimum. SOC 2 Type II is no longer a differentiator — it's the floor for any vendor holding privileged data.
Sub-Processor Transparency
Your vendors' sub-processors are now your sub-processors. Require a current sub-processor list and 30-day notice on additions.
Tabletop Cadence
Run a 60-minute tabletop exercise every quarter against the actual 72-hour clock. Most firms discover their playbook breaks at minute 90.
📉 Why Tech Stack Sprawl Becomes a CIRCIA Problem
Every additional vendor multiplies the surface area for an incident — and divides your reporting window. A firm with 12 separate cloud vendors holding client data has 12 separate notification chains, 12 separate sub-processor lists, and 12 separate SOC 2 reports to track. When the clock starts, the firm has minutes — not hours — to investigate scope.
Firms running consolidated platforms have a structurally easier time. When practice management, document management, billing, and accounting all live in one Salesforce-backed platform like CaseQube, the data residency map is one document, the SOC 2 attestation is Salesforce's (Hyperforce), and the audit trail is unified. The 72-hour investigation that used to require coordinating across 8 vendors now requires one query.
📝 The 30-Day CIRCIA Readiness Plan
- Days 1–7: Run the vendor inventory. List every system holding any client data. Pull each vendor's most recent SOC 2.
- Days 8–14: Update each vendor contract for a 24-hour breach-notification SLA. Vendors who refuse become migration candidates.
- Days 15–21: Draft and approve the firm's incident classification playbook. Identify the named decision-maker and after-hours contact.
- Days 22–28: Run the first tabletop. Time the team against the 72-hour clock. Find the breakage. Fix it.
- Days 29–30: Cover memo to the management committee documenting the program. CISA enforcement starts with the question "what was your program?"
🎯 The Strategic Answer Is Consolidation
Every additional vendor in your stack increases your CIRCIA exposure. Every consolidation reduces it. That math doesn't change based on your sector or your size. The firms that will sleep through 2026's first major legal-tech breach are the ones who already trimmed their vendor list to a unified platform with one audit trail and one SOC 2 attestation.
- CIRCIA took effect in May 2026 — most mid-size law firms qualify as covered entities through size, sector association, or data type.
- Substantial incidents trigger a 72-hour CISA reporting window; ransomware payments trigger a 24-hour window.
- The reporting clock includes vendor incidents — your DMS, billing, or PM vendor's breach starts your firm's 72-hour clock.
- Tech stack sprawl is the #1 readiness failure. Consolidated platforms cut breach investigation time by an order of magnitude.
- Before May 31, every firm should have: vendor inventory, contractual notification SLAs, incident playbook, named decision-maker, and a tabletop completed.
Reduce Your CIRCIA Surface Area
One platform. One audit trail. One SOC 2 attestation. CaseQube consolidates practice management, accounting, billing, and AI into a unified Salesforce-backed system — turning a 36-hour breach investigation into a 4-hour query.
See the Architecture →