How managed service providers can help clients with CIRCIA
The Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA) - a U.S. federal law expected in 2026 - creates an opportunity for Managed Service Providers (MSPs) to guide their critical infrastructure clients on how to meet reporting obligations. CIRCIA requires that critical infrastructure companies report cyber incidents within 72 hours and ransomware payments within 24 hours to the Cybersecurity and Infrastructure Security Agency (CISA). Here are tips on how MSPs can prepare and advise.
First, MSPs will need to know the category of each of their critical infrastructure clients. CISA has a broad definition of "critical infrastructure" and many companies are surprised to learn they are in that lane. MSPs need to help them to understand where they belong and the important role they play in national security. Having this understanding and realization is the most important first step.
MSPs can next help their critical infrastructure clients to understand that reporting shifts from optional to mandatory. Their clients should, and will, demand faster detection, clear and clean evidence collection and reporting assistance. MSPs will likely have imposed on them contractual obligations to
fulfill CIRCIA compliance requirements. They should also take steps to enhance detection and logging, as well as test ransomware and OT compromise scenarios. Above all, MSPs must ensure staff are fully trained and aligned with the client compliance obligation required by CIRCIA. And finally, all vendors in their supply chain should be fully vetted with CIRCIA in mind.
The biggest change coming is that MSPs will need to be able to demonstrate CIRCIA readiness. This should include playbooks, SLAs and tabletop-tested IR plans. Critical infrastructure clients will need trusted partners to help them. Deadlines will soon be law, and speed becomes survival. MSPs must be aware of the possibility for expanded incident definitions when meeting reporting requirements. Forensic rigor under attorney-client privilege will be needed in the probable case of federal investigations. And MSPs should expect to make SOC upgrades and add/enhance OT monitoring.
Streamlining overlapping CIRCIA, SEC, and state breach-reporting deadlines will also be essential. Because this can be unfortunately complex, it will be critical to build a unified compliance reporting timeline in IR playbooks. There will be overlapping obligations that will all need to be tracked. This could include state or local laws, too. To the extent possible, pre-build decision trees so that when an event occurs, the playbook is already in place for every conceivable scenario.
To hit CIRCIA's 24/72-hour clocks, budget conscious MSPs should focus first on prioritizing staff training on incident escalation, with their attention on People and Process before Technology, in this case.
With the reporting obligations it is critical to know how quickly to escalate. They should conduct tabletop drills with clients, not just internally, and make improvements as needed, constantly validate logging and ticketing tools and integrating them wherever possible and testing to verify alignment.
For post-CIRCIA statements of work, it will be important for MSPs to be wary of signing anything discussing notification timelines (MSP SLA-type language), data retention obligations (logs, forensic data, etc.) and clear definition of roles (e.g., client files with CISA, MSP provides technical evidence/support, etc.) as they create uninsurable risk. MSPs should pay particular attention to indemnification clauses as well.
CIRCIA will likely indirectly force Software Bill of Materials (SBOM) adoption for MSP tool stacks, so it's a good idea for MSPs to require all vendors to provide full SBOM vulnerability disclosure on an ongoing basis. They should maintain awareness and patching diligence with SBOMs just as they do on endpoints, servers and VMs. MSPs should request attestations from their third parties. The opportunity here for MSPs is to become the indispensable partner for compliance by providing information such as SBOM vulnerability visibility. They can help their clients to understand, measure and assess risk in the services provided just as they do in their own business.
