The Cybersecurity and Infrastructure Security Agency has set a new clock running for government contractors worried about how a sweeping cyber-incident-reporting mandate will land. In a Federal Register notice published May 26, 2026 (Document No. 2026-10417), CISA and the Department of Homeland Security announced a revised schedule of virtual stakeholder town halls on the rulemaking under the Cyber Incident Reporting for Critical Infrastructure Act of 2022, known as CIRCIA. Four sessions will run June 15 through June 18, 2026, each from 11:30 a.m. to 3:30 p.m. ET, and the final session on June 18 is the one defense-sector firms cannot afford to miss: it explicitly covers the Defense Industrial Base. As the law firm Wiley has cautioned, these town halls may be the last opportunity for industry to give its views on the scope and impact of the proposed rule.
Why the Sessions Slipped From Spring to June
The town halls were not always scheduled for June. As the Federal Register notice explains, the meetings had originally been set for March and April 2026 but were canceled because of the lapse in DHS appropriations that ended April 30, 2026. With funding restored, CISA reset the calendar and consolidated the outreach into a tight four-day block in mid-June. The agency's goal is to gather direct input from the critical-infrastructure community on the proposed rule before it moves toward a final version.
The June 18 session is not limited to the Defense Industrial Base alone. According to the notice, it groups that sector together with chemical, commercial facilities, critical manufacturing, energy, financial services, information technology, and nuclear stakeholders. That breadth matters for contractors who straddle more than one sector, but the inclusion of the Defense Industrial Base on the agenda is the headline for any firm doing business with the Department of Defense. Both Covington's Inside Privacy team, in its May 27, 2026 analysis, and Wiley, in its May 28, 2026 alert on the rescheduling, flagged the revised schedule and CISA's virtual format, which is designed to let industry participants weigh in on the cyber-incident-reporting requirements without travel, lowering the barrier to participation across the affected sectors.
What CIRCIA Would Require, and Why This Window Counts
CIRCIA traces back to the 2022 statute that directed CISA to write rules requiring covered entities in critical-infrastructure sectors to report significant cyber incidents and ransom payments. CISA published its Notice of Proposed Rulemaking on April 4, 2024, and the eventual final rule is expected to impose mandatory reporting obligations on covered entities for both significant cyber incidents and ransom payments. The reporting framework and the operational and compliance burden it would impose are precisely what industry has spent the rulemaking process debating, and that debate continues as CISA works toward a final rule. The scope of who counts as a covered entity, what qualifies as a covered cyber incident, and how the new obligations would mesh with existing requirements remain open and contested questions.
That is why the timing of these town halls is so consequential. As Wiley observed in its analysis of the revised schedule, the town halls may be the last opportunity for industry to give its views on the scope and impact of this proposed rule before CISA finalizes it. The proposed rule has drawn extensive comment since April 2024 on questions such as which entities count as covered, what qualifies as a covered cyber incident, and how the reporting obligations interact with other federal and sector-specific reporting requirements that contractors already face. A virtual town hall focused on the Defense Industrial Base gives DoD contractors a direct line to raise those concerns in their own voice rather than relying solely on written comments or trade-association filings.
Registration is not optional. The Federal Register notice states that registration is required and closes at 5:00 p.m. ET two business days before each meeting. For the June 18 Defense Industrial Base session, that means the registration window will close days earlier than the session itself, so firms that intend to participate need to act well before the meeting date rather than waiting until the last moment.
What It Means for Contractors
For Defense Industrial Base companies, the June 18 session is the practical centerpiece of this rescheduled outreach. It is the session where defense-sector concerns are formally on the agenda, and given Wiley's warning that this round of town halls may be the last opportunity for industry to give its views on the scope and impact of the proposed rule, treating it as a routine webinar would be a mistake. If your firm has views on how the CIRCIA reporting obligations should be scoped, how covered incidents should be defined, or how the new requirements should mesh with existing DoD and sector obligations, this is the venue to put them on the record before the policy hardens.
The stakes for contractors are concentrated in this comment window. Because the town halls may be industry's last chance to weigh in on the scope and impact of the rule, as Wiley has emphasized, defense firms should use the June 18 session to press their views on how the reporting obligations are defined and how they will interact with the compliance regimes contractors already operate under. What might otherwise be treated as an IT-department reporting question is, for a government contractor, a board-level compliance matter, and the moment to influence its contours is now, while the rule is still in development rather than after it becomes binding.
The immediate action item is procedural but unforgiving: register. Because registration closes at 5:00 p.m. ET two business days before each meeting, contractors who want a seat at the June 18 Defense Industrial Base session should mark that earlier cutoff on their calendars rather than the meeting date. Firms that operate across multiple covered sectors may also want representatives at more than one of the June 15 through June 18 sessions. With the spring cancellations behind it and appropriations restored, CISA has signaled it intends to keep this schedule and move the CIRCIA rule forward, so this compressed June window may well be the last clear opportunity for the Defense Industrial Base to be heard before the reporting mandate becomes binding.
Sources
Federal Register, "Town Hall Meetings To Provide Input on Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA) Rulemaking," Doc. 2026-10417 (May 26, 2026)
Covington Inside Privacy, "CISA Announces Revised Schedule of Town Halls for CIRCIA Rulemaking" (May 27, 2026)
Wiley, "UPDATE: CISA Reschedules Virtual Town Halls on Cyber Incident Reporting Requirements" (May 28, 2026)
