A new federal cyber incident reporting law broadly applicable to critical infrastructure organizations is nearing completion, and companies should consider preparing now for these new regulatory requirements. Experience with other federal cybersecurity reporting obligations demonstrates that reporting requirements are most effective—and least disruptive—when they are incorporated into existing governance, incident response, and crisis-management processes well before a cyber incident makes them legal and operational obligations.