CIRCIA
Covered Cyber Incident reporting for critical infrastructure operators
The Cyber Incident Reporting for Critical Infrastructure Act of 2022 (CIRCIA) requires covered entities to report Covered Cyber Incidents to CISA within 72 hours and ransom payments within 24 hours. The implementing rule is in process at CISA. Producing systems should be ready to surface chain-of-custody evidence on demand.
Asqav signs every AI agent action with ML-DSA-65 (FIPS 204), and the circia_covered_cyber_incident token on incident_class flags Actions that fall in scope. Audit Pack export exposes the time-window query so the producing system can reconstitute the chain segment plus anchors when CISA requests evidence.
The receipt format is profiled in the IETF Internet-Draft draft-marques-asqav-compliance-receipts, which binds the format to CIRCIA emission requirements.
Requirements
| Element | Requirement | Asqav binding |
|---|---|---|
| Incident classification | Covered entities classify incidents per the CIRCIA Covered Cyber Incident definition. | Producers tag in-scope Actions with incident_class: ["circia_covered_cyber_incident"]. The token is canonical. Mismatched values are rejected at sign time. |
| 72-hour CISA notice | Report Covered Cyber Incidents within 72 hours of reasonable belief. | Synchronous anchoring at issuance under compliance_regimes: [circia] means every receipt is timestamped before commit. The producer cannot retro-date the discovery window. |
| Chain-of-custody | Preserve evidence the incident occurred and was acted on. | Per-agent hash chain plus RFC 3161 / OpenTimestamps anchors. Audit Pack export packages the window plus a signed manifest. The chain rederives on every public verify. |
| Retention | Retain incident records pending CISA review. | Retention floor 731 days (2 years) enforced in tier_config.py. Records are queryable through the verify and audit-pack endpoints across the full window. |
CIRCIA's implementing rule is in process at CISA. The bindings above target the statutory text. The rule may add specific evidence formats. See the docs for the incident vocabulary and the IETF draft for the binding text.