A joint cyber warning exposes a deeper gap: governments can identify threats, but cannot always compel timely reports from critical systems.
A public warning can be precise and still leave a government unable to require the next report. In early October, the United States, the United Kingdom, Australia, Canada, Japan, New Zealand and Spain published a joint cybersecurity advisory stating that Chinese government-linked actors, enabled by a China-based firm, Integrity Technology Group, had combined automated tools and hands-on techniques to steal sensitive data, including from United States critical infrastructure sectors. The authoring agencies presented that conclusion as the product of investigations, not as a courtroom finding, and this analysis treats it as their official claim. Less than a year earlier, in December 2025, London had already sanctioned the same company for, in the British government's account, controlling a covert network and assisting attacks that included UK public-sector systems. The harder question is whether the same governments have built the reporting rules, institutional capacity and funding needed to turn the next incident in a power network, a hospital or a port into a timely official picture, rather than another advisory after the fact.
This analysis argues that the gap is institutional rather than informational. Allied agencies can now describe, in public, a commercial enabler of activity they link to a state. What remains uneven, and in some of the largest markets still unfinished, is the legal clock that would require critical-infrastructure operators to report a significant incident in time for others to be warned. Australia already imposes short, mandatory deadlines. India already requires many organizations to notify the Indian Computer Emergency Response Team (CERT-In) within six hours, yet the totals it publishes cannot be read as a record of attacks on critical systems, and the personal-data breach duties in the 2025 data-protection rules do not take effect until May 2027. The United States, a co-author of the October advisory, is still waiting for a final rule under a 2022 reporting law. The United Kingdom is rewriting its 72-hour duty in a bill that has not received Royal Assent. The European Union wrote 24- and 72-hour duties into Directive (EU) 2022/2555, the NIS 2 Directive, then spent two years referring some of its largest economies to court for not transposing them. The six cases therefore comprise four national signatories to the advisory—the United States, the United Kingdom, Australia and New Zealand—alongside India, where a six-hour reporting obligation is already in force, and the European Union, whose experience illustrates how regional legislation can be held back by uneven national implementation.
The October advisory is best read as an intelligence product, and as a claim about attribution, not as a substitute for a reporting clock. The Cybersecurity and Infrastructure Security Agency (CISA), the Federal Bureau of Investigation (FBI) and the National Security Agency (NSA) issued it with the UK National Cyber Security Centre, the Australian Signals Directorate's Australian Cyber Security Centre (ASD's ACSC), the Canadian Centre for Cyber Security, Japan's National Police Agency and National Cybersecurity Office, New Zealand's National Cyber Security Centre and Spain's Centro Nacional de Inteligencia. The agencies said the actors had targeted United States government services and facilities, critical manufacturing, healthcare and public health, and information technology, and had also reached law enforcement, education and religious organizations, as well as organizations in Southeast Asia, Africa and North America. A CISA press statement called Integrity Technology Group a "key enabler" of malicious activity and said the tactics were consistent with activity publicly known as Flax Typhoon, Ethereal Panda and Red Juliett. Those labels do not, by themselves, create a reporting duty on a hospital, a grid operator or a port.
If the point of such a warning is to help defenders act in time, the United States still lacks the mandatory intake system Congress ordered more than four years ago. The Cyber Incident Reporting for Critical Infrastructure Act of 2022 (CIRCIA), enacted in March 2022, directs CISA to issue rules requiring covered entities to report covered cyber incidents no later than 72 hours after they reasonably believe an incident occurred, and ransomware payments within 24 hours of making them. CISA published a notice of proposed rulemaking on April 4, 2024. The statute, as CISA records, required a final rule within 18 months of that notice, a mark that fell in October 2025. On October 1, 2026, the Department of Homeland Security (DHS) sent a final rule to the White House Office of Information and Regulatory Affairs (OIRA) for review. As of November 13, 2026, the review was still listed as pending. CISA's CIRCIA page, which does not yet record that filing, says multiple funding lapses delayed the work and that reporting under the statute will not be required until a final rule takes effect. Until then, the agency asks for voluntary sharing.
The budget that would have to run that system is still a request, not a finished appropriation, and it adds no money for the program. CISA's fiscal year 2027 congressional justification, presented in April 2026, asks for $2.5 billion, 2,865 positions and 2,528 full-time equivalents, 867 positions and 766 full-time equivalents below the 3,732 positions and 3,294 full-time equivalents in the fiscal year 2026 annualized continuing-resolution baseline. Operations and Support, the main account, would fall by $360.5 million, from $2.38 billion to $2.02 billion. The same document includes $325.2 million for functions transferred from the Countering Weapons of Mass Destruction Office, so the $2.5 billion headline is not a like-for-like cut in cyber work. On the reporting program it is explicit: CIRCIA is listed as a cost driver "included for tracking purposes," and "there is no new funding for CIRICA in the FY 2027 President's Budget," typographical error included. Acting Director Nick Andersen, testifying on April 16, 2026, described the $2.5 billion request as a focus on the mission Congress authorized in 2018. These figures describe a proposed staffing and budgetary baseline, not CISA's actual onboard workforce or an enacted appropriation. They nevertheless indicate the resource constraints under which the agency would be expected to implement the proposed reporting framework.
The request and the continuing-resolution baseline are compared below.
Chart 1: Positions and full-time equivalents in CISA's fiscal year 2027 President's request compared with the fiscal year 2026 annualized continuing-resolution baseline. Source: DHS, CISA FY2027 Congressional Justification, April 2026. Data cut-off: November 13, 2026.
CISA has already explained why a rule of this kind would matter, which makes the lag harder to treat as a paperwork delay. The agency says incident reports would let it assist victims, "analyze incoming reporting across sectors to spot trends, and quickly share that information with network defenders to warn other potential victims." A joint advisory performs a similar warning function, but only after investigators have already built a case. A 72-hour report is supposed to arrive while an incident is still unfolding. A government that can coordinate a seven-country warning about a named company, yet still cannot require a covered operator to file a standard report, has built the after-action machinery more completely than the intake system.
India's problem is different, and in one respect more advanced: a short mandatory clock already exists, but the public statistics do not show what it captures in critical systems. Directions issued by CERT-In on April 28, 2022, under section 70B of the Information Technology Act, 2000, require service providers, intermediaries, data centers, bodies corporate and government organizations to report specified cyber incidents to CERT-In within six hours of noticing them or being told of them. That duty is already in force, and it is among the shortest official reporting clocks in this comparison. However, it is a broad, cross-sector cyber-incident reporting requirement rather than a dedicated critical-infrastructure reporting regime. The National Critical Information Infrastructure Protection Centre (NCIIPC), established under section 70A of the same Act, is the national nodal agency for critical information infrastructure and, the government told Parliament in August, sends regular alerts to protected-system entities and conducts periodic risk assessments. A finance incident team under CERT-In has been operating since May 2022, and a power-sector team since September 2024, according to a Ministry of Electronics and Information Technology (MeitY) reply. What is missing from the public record is a series showing how many of the incidents arriving inside that six-hour window involved a notified critical system.
The totals CERT-In does publish are large enough to be mistaken for that record, and they are not it. In a Lok Sabha reply given on August 12, 2026, and released by the Press Information Bureau on August 14, the government said CERT-In had observed 1,592,917 cyber security incidents in 2023, 2,041,360 in 2024 and 2,944,248 in 2025. Those figures cover incidents "reported to and tracked by" the agency. They are not limited to critical infrastructure, or even to government systems. Nor do they establish how many incidents were successful intrusions, how severe they were, or how many involved systems whose failure would disrupt essential services. The official all-incident series is shown below.
Chart 2: Total cyber security incidents reported to and tracked by CERT-In. Source: Press Information Bureau, August 14, 2026, citing a Lok Sabha reply of August 12, 2026. Data cut-off: November 13, 2026.
A second official series, confined to government systems, is sharper and still not a critical-infrastructure count. Answering Lok Sabha Unstarred Question 2761 on August 5, 2026, the Minister of State for Electronics and Information Technology, Jitin Prasada, gave the number of incidents "that belong to Central Ministries/Departments and State Governments, including those of Maharashtra," from 192,439 in 2022 to 1,821,767 in 2025, and 1,075,220 in 2026 through June. The jump after 2023 is large. Because the definition is institutional rather than functional, a breached state website and an intrusion into a notified power or telecom system would sit in the same column, if they appear at all. The 2026 figure is a half-year total and should not be annualized. Neither this series nor the 2.94 million all-incident count answers the question a critical-infrastructure debate requires: how often a system whose failure would matter to the public was actually hit. The government-only series is set out below.
Chart 3: Cyber security incidents CERT-In attributed to central ministries and departments and to state governments. Source: Lok Sabha Unstarred Question 2761, answered August 5, 2026. The 2026 column runs only through June. Data cut-off: November 13, 2026.
The data-protection rules that would add a second, narrower clock are only partly in force. The Digital Personal Data Protection Act, 2023, was enacted on August 11, 2023. The Digital Personal Data Protection (DPDP) Rules, 2025, were published in the Official Gazette on November 13, 2025 as G.S.R. 846(E). Rule 4, on Consent Managers, took effect on November 13, 2026. The breach-reporting provisions, including Rule 7, take effect in May 2027. When they apply, a Data Fiduciary that becomes aware of a personal data breach must inform affected individuals and the Data Protection Board "without delay," and give the Board a detailed report within seventy-two hours, or longer if the Board allows. That is a privacy-law duty, not a critical-infrastructure duty, and it will not replace CERT-In's six-hour direction. Until May 2027, the newer statute's breach-reporting machinery is not in force. CERT-In's budget is modest beside the volume it records: MeitY's Demand No. 27 for 2026-27 allocates ₹269 crore to "Cyber Security (CERT-In)" (₹1 crore is 10 million rupees), or about US$28.6 million at the Federal Reserve's H.10 rate of ₹93.91 per dollar on November 6, 2026. NCIIPC's budget is not broken out in that demand.
Those Indian figures sit in a wider comparison that is easy to misread if only the advisories are counted. The table below sets the main civilian reporting clocks, and whether they are in force, across the same six jurisdictions.
Jurisdiction | Lead civilian bodies | Mandatory incident clock now in force? | Ransomware-payment reporting | Status as of mid-November 2026 |
|---|---|---|---|---|
India | CERT-In (IT Act, section 70B); NCIIPC (section 70A); National Cyber Security Coordinator under the National Security Council Secretariat | Yes: specified incidents to CERT-In within 6 hours of noticing or being told. DPDP personal-data breach reports to the Board (without delay, then a 72-hour detailed report) are not in force until May 2027. | No separate, generally applicable ransom-payment statute identified in official sources used for this article. | Six-hour CERT-In direction in force since 2022; DPDP Rules gazetted November 13, 2025, with phased commencement. |
United States | CISA (national coordinator); FBI; sector risk-management agencies | No CIRCIA duty in force. Covered incidents would be due in 72 hours, and ransom payments in 24 hours, only after a final rule takes effect. | CIRCIA would require 24-hour reports of ransom payments; not yet in force. | Final rule received by OIRA on October 1, 2026; review pending as of November 13, 2026. |
European Union | National computer security incident response teams and competent authorities; European Union Agency for Cybersecurity (ENISA) supports and aggregates. | Where transposed: early warning within 24 hours of becoming aware of a significant incident, incident notification within 72 hours, final report within one month, under Article 23 of Directive (EU) 2022/2555 (NIS 2). | Not a uniform EU ransom-payment reporting law; incident duties can capture some extortion effects where the incident is "significant". | Transposition deadline was October 17, 2024. On July 8, 2026, the Commission referred Ireland, Spain, France and the Netherlands to the Court of Justice for failing to notify full transposition. |
United Kingdom | National Cyber Security Centre, part of Government Communications Headquarters (GCHQ); sector regulators under the Network and Information Systems regime. | Current regime: notification to the regulator within 72 hours after the organization becomes aware, with the regulator then notifying the NCSC, and only for incidents that have disrupted essential or digital services, per the government's own factsheet. | No generally applicable ransom-payment reporting duty identified in the official sources used here. | The Cyber Security and Resilience (Network and Information Systems) Bill would add a 24-hour initial notice to the regulator and the NCSC and a 72-hour full report, and would widen the incidents covered. The Commons is due to consider Lords amendments on November 24, 2026. Commencement would follow by secondary legislation after Royal Assent. |
Australia | ASD's ACSC; Department of Home Affairs / Critical Infrastructure Security Centre. | Yes, under the Security of Critical Infrastructure Act 2018: a critical incident with a significant impact on availability must be notified to ASD's ACSC within 12 hours of becoming aware; other incidents with a relevant impact, within 72 hours. | Yes: a reporting business entity must report a ransomware or cyber-extortion payment within 72 hours under section 27 of the Cyber Security Act 2024. | The short SOCI clocks and the 2024 payment-reporting duty are in force. |
New Zealand | National Cyber Security Centre; Department of the Prime Minister and Cabinet (DPMC) for the critical-infrastructure policy program. | No economy-wide mandatory cyber-incident clock for critical infrastructure was located in official sources. A 2026 consultation proposed new measures; advice to ministers is intended in 2027. | No generally applicable official duty identified in the sources used here. | DPMC consulted from February to April 2026 and says it is refining options. |
Table 1: Mandatory cyber-incident reporting clocks for critical infrastructure and related regimes, as stated in official documents. Sources linked in each row. Data cut-off: November 13, 2026.
Australia shows that a short clock can already exist in a close partner of the October advisory, which makes the unfinished American and British rules harder to treat as a technical inevitability. The 12-hour and 72-hour SOCI notices, and the 72-hour ransom-payment reports under the Cyber Security Act 2024, are the current instructions on the Australian government's own reporting pages, not proposals. The same Australian centre co-signed the October advisory while already receiving mandatory notices of the kind CISA is still waiting for the federal rulemaking process to activate.
Europe's lag is of a different kind, because the 24-hour, 72-hour and one-month duties were written into Union law in December 2022 and then stalled in national parliaments. Member States had until October 17, 2024, to transpose the NIS 2 Directive. Most, the Commission said, did so. On July 8, 2026, it referred Ireland, Spain, France and the Netherlands to the Court of Justice for failing to notify full transposition, and asked for financial sanctions. The Commission's public transposition page, as fetched for this article, had not been updated to show later enactments, so subsequent unofficial tallies are not treated as official here. Nearly four years after the directive was adopted, and more than two years after the transposition deadline, the Commission was still taking four Member States, including three of the Union's largest economies, to court over legislation meant to accelerate reporting and strengthen cross-border coordination.
The British and New Zealand cases show the same delay in a different legal form, one still in a legislature and one still in a consultation file. The UK government says the present 72-hour duty is too narrow, because it applies only once a service has been disrupted and reaches the NCSC only after the regulator has been told. The bill would add a 24-hour initial notice to the regulator and the NCSC, widen the incidents covered, and be brought into force by secondary legislation after Royal Assent. Those are the government's reasons for the bill. The bill is not law. The House of Commons is scheduled to consider Lords amendments on November 24, 2026. In Wellington, DPMC's consultation closed in April 2026, and the department intends to advise ministers in 2027. New Zealand co-signed the October advisory. It has not yet decided, in statute, what operators must report and when.
Budgets and published staff figures, compared below, are patchier than the legal texts, which is itself revealing. Several of these agencies sit inside intelligence organizations whose spending is not fully broken out. The figures are not directly comparable: CERT-In's allocation is a specific budget line, while CISA's request covers a much wider mandate. But the gaps in disclosure leave another question unanswered: how much of the capacity expected to protect critical infrastructure can actually be assessed from the public record?
Jurisdiction | Latest official budget figure located | Published staff or positions | Notes |
|---|---|---|---|
India (CERT-In line in MeitY) | ₹269 crore (about US$28.6 million) in Budget 2026–27, Demand No. 27, "Cyber Security (CERT-In)"; Revised 2025–26 was ₹277 crore. | No official CERT-In or NCIIPC headcount was located in the budget document or the parliamentary replies used here. | NCIIPC funding is not separately identified in Demand No. 27. |
United States (CISA) | FY2027 President's request: $2.5 billion total; Operations and Support $2.02 billion, down $360.5 million from the FY2026 annualized CR. | Request: 2,865 positions and 2,528 full-time equivalents, down 867 positions from the 3,732 in the FY2026 annualized CR. | Request, not enacted law or current onboard staff. No new CIRCIA funding in the request. The total includes $325.2 million in transferred counter-WMD functions. |
European Union (ENISA) | A 2026 ENISA programming-document figure was not independently verified from a file opened for this article and is therefore omitted. | Not established from a primary page opened for this article. | ENISA supports Member States and receives aggregated reporting; national CSIRTs remain the intake bodies under NIS 2. |
United Kingdom (NCSC) | No standalone public budget line was located; the centre is part of Government Communications Headquarters. | No separate official headcount located. | Reporting today goes first to sector regulators. |
Australia (ASD's ACSC) | No standalone ACSC budget line was separated from the Australian Signals Directorate in the official pages used here. | No separate official headcount located. | Mandatory SOCI reporting is already directed to ASD's ACSC. |
New Zealand (NCSC) | No standalone public budget line was located; the centre sits within the Government Communications Security Bureau. | No separate official headcount located. | Policy work on a new critical-infrastructure cyber regime sits with DPMC. |
Table 2: Official budgets and staff figures where they could be verified from primary documents. Sources: MeitY Demand No. 27, 2026-27; CISA FY2027 Congressional Justification; Federal Reserve H.10 rate of ₹93.91 per US dollar on November 6, 2026. Data cut-off: November 13, 2026.
The timeline below shows that the October advisory arrived in the middle of a longer legislative slog, not at the end of one.
Measure | First legal step | Intended operational date | Status on November 13, 2026 |
|---|---|---|---|
CIRCIA (United States) | Enacted March 2022; proposed rule April 4, 2024. | Final rule due 18 months after the proposed rule (October 2025). | Final rule at OIRA since October 1, 2026; duties not in force. |
NIS 2 Directive (EU) | Adopted December 14, 2022. | Transpose by October 17, 2024. | In force where transposed; four members referred to the Court of Justice on July 8, 2026, for not notifying full transposition. |
DPDP breach-reporting rules (India) | Act enacted August 11, 2023; Rules gazetted November 13, 2025. | Rules 3, 5–16, 22 and 23, including Rule 7, take effect in May 2027. | Board-related rules in force; Consent Manager rule in force from November 13, 2026; breach-reporting rule not yet in force. CERT-In's six-hour direction already applies. |
UK Cyber Security and Resilience Bill | Introduced in the 2024–26 session and carried over. | Commencement by secondary legislation after Royal Assent. | Lords stages completed; Commons consideration of Lords amendments scheduled for November 24, 2026. |
New Zealand critical-infrastructure cyber measures | All-hazards work narrowed to cyber security in December 2024; consultation February–April 2026. | Advice to ministers intended in 2027. | No economy-wide mandatory clock enacted. |
Australia SOCI reporting and 2024 payment reports | SOCI Act 2018, later amended; Cyber Security Act 2024. | In force (12-hour and 72-hour incident notices; 72-hour payment notices). | In force. |
Table 3: The lag between enactment, or proposal, and an in-force reporting duty. Sources as in Tables 1 and 2. Data cut-off: November 13, 2026.
The strongest objection to this comparison is that the binding constraint is not the missing rule but the capacity to use one, and that India's experience already illustrates the point. A six-hour duty that produces millions of recorded incidents, the objection runs, may give a government noise rather than a picture of critical systems. A 72-hour CIRCIA rule imposed on an agency whose own budget request would cut 867 positions, and that adds no new money for the reporting program, could do the same. The UK factsheet is candid that the first notice under the bill is meant to be light, so that operators are not pulled off incident response. Voluntary sharing, joint investigations and public advisories, of which the October text is an example, may already deliver the warning function that statute writers want. On that view, finishing CIRCIA, transposing NIS 2, or commencing the British bill would matter less than keeping skilled people in the agencies that already write the advisories.
That objection is serious, and part of it is clearly right: a clock without an intake staff, or a staff without a way to separate a critical outage from a routine infection, will not produce the picture governments say they need. It does not follow that the unfinished rules are beside the point. CISA has already said that mandatory reports are what would let it spot trends across sectors and warn the next victim in time, a different job from publishing an advisory after a multi-country investigation. The administration's own budget request would ask that job of an agency facing a proposed reduction of 867 positions, with no new CIRCIA funding. India's six-hour direction shows that a short clock can be written; the 2.94 million total, and the government-only series that still does not isolate critical systems, show that a clock is not the same thing as a usable public account. Australia already has a 12-hour availability notice and a 72-hour payment notice in force, and it co-authored the same advisory. The unfinished American, British, European and New Zealand files are choices about whether operators must report on a timetable the state can use, not a natural stage of intelligence work.
Those choices are now concrete. In Washington, the test is whether a final CIRCIA rule is published with a realistic effective date, and whether the agency that must read the reports is funded to do so. In New Delhi, it is whether CERT-In and NCIIPC will publish a critical-infrastructure incident series that can be compared from year to year, so that Parliament is not asked to treat 2.94 million mixed events as a measure of risk to notified systems, and whether the May 2027 DPDP duties are treated as an addition to the six-hour direction rather than a delayed beginning. In Brussels and the four capitals named in the July referral, it is whether transposition is completed so that the directive's 24- and 72-hour duties actually apply. In London, the November 24 Commons date will show whether the bill's reporting clauses survive and, later, whether ministers commence them. In Wellington, the 2027 advice to ministers will show whether a co-author of the October advisory is prepared to legislate a clock of its own.
The October text will be remembered as a clear public warning about a named company and about activity the authoring agencies link to the Chinese government. The more demanding test is narrower. It is whether, a year from now, a significant incident in a critical system in these same jurisdictions would have to be reported on a clock that is already in force, and whether the resulting official picture would be sharp enough to use. An advisory can describe a threat. Only a reporting rule, staffed and in force, can require the next account in time.
Apple News, Google News, Feedly, Flipboard, and WhatsApp Channel
