Historical Record

CIRCIA reporting rule proposed

CISA proposed the CIRCIA framework: 72-hour covered-incident and 24-hour ransom-payment reporting for critical infrastructure. It opened the long road that is still short of a final rule.

FISA Section 702 reauthorized (RISAA)

The Reforming Intelligence and Securing America Act reauthorized Section 702 for two years and expanded several provisions, setting the April 2026 sunset that drove this year’s reauthorization fight.

FAR 5949 semiconductor rulemaking opened

An advance notice opened the rulemaking to bar federal procurement of covered semiconductors from SMIC, CXMT, and YMTC, the first step toward the 2026 proposed rule.

NIST post-quantum standards finalized

FIPS 203 (ML-KEM), 204 (ML-DSA), and 205 (SLH-DSA) were finalized, starting the federal post-quantum migration clock for long-lived telecom equipment, PKI, and routing security.

FY2025 NDAA signed

Added Section 851 (lobbyist prohibition, later codified at 10 U.S.C. 4663), Section 853 (Huawei-linked semiconductor bar), and amendments to the 1260H regime. Section 851 takes effect June 30, 2026.

DoD 1260H list grows to 134 entities

The annual Chinese Military Companies list reached 134 entities across aerospace, semiconductors, AI, and UAVs, the baseline the FY2025 NDAA prohibitions would later attach to.

EO 14179: Removing Barriers to AI Leadership

Rescinded prior AI directives and ordered an AI Action Plan, framing AI dominance as economic and national-security policy and setting up the July data-center and export actions.

America First Investment Policy

A national-security memorandum reorienting CFIUS toward adversary capital while easing review for allied investment, the policy backdrop for the 2026 Known Investor pilot.

Section 232 semiconductor investigation opened

Commerce opened a Section 232 national-security investigation into semiconductor imports, the legal basis for the 25% advanced-chip tariff imposed in January 2026.

AI Action Plan + data-center permitting EO

“Winning the Race: America’s AI Action Plan,” paired with executive orders accelerating federal data-center permitting and promoting AI exports, the adjacency telecom members feel through transport, optical, and power.

Sean Cairncross confirmed National Cyber Director

The Senate confirmed Sean Cairncross to lead ONCD. His stated agenda centers on harmonizing duplicative federal cyber rules, the throughline of this whole tracker.

Salt Typhoon joint advisory (AA25-239A)

A joint advisory detailing PRC “Salt Typhoon” intrusions into U.S. and allied telecom networks, which drove hardening across carrier backbones, lawful-intercept systems, and routing infrastructure.

BIS Affiliates Rule issued (50% rule)

An interim final rule auto-applying Entity List, MEU, and SDN restrictions to any entity 50% or more owned by listed parties, aligning BIS with Treasury’s long-standing OFAC practice.

BIS Affiliates Rule suspended one year

BIS stayed the Affiliates Rule for a year as part of a U.S.-China understanding. The rule is written to snap back automatically on November 10, 2026 absent a further extension.

FCC equipment-authorization integrity FNPRM

A further notice on Trusted Test Labs, TCB accreditation, and post-market surveillance for the equipment authorization program, tightening the device and test-data gate.

FCC Covered List adds foreign UAS

PSHSB added all foreign-produced uncrewed aircraft systems and critical components to the Covered List, opening the conditional-approval process that followed in early 2026.

Covered List: Blue UAS exemptions

The first conditional approvals: DCMA “Blue UAS” cleared systems and Buy-American domestic UAS were exempted from the Covered List through January 2027.

Section 232 chip tariff (Proclamation 11002)

A 25% tariff on a narrow set of advanced semiconductors, effective January 15, alongside a critical-minerals proclamation. A data-center chip market report was set for July 1, 2026.

FCC Foreign Adversary Control R&O adopted

The FACS Report and Order: nearly every FCC licensee must attest whether it is under foreign-adversary control (10% ownership threshold), with 5% disclosure for affirmative filers.

DoD posts, then withdraws, 1260H update

An expanded 1260H list briefly appeared in the Federal Register, then was pulled within hours without explanation, a sign of the churn that preceded the June re-issue.

CFIUS Known Investor pilot RFI

Treasury sought input on a Known Investor program to streamline review for trusted investors while sharpening screening of adversary capital in data centers, fiber, towers, and subsea.

FAR 5949 proposed rule

The proposed rule to bar federal procurement of covered semiconductors (SMIC, CXMT, YMTC), with a reasonable-inquiry certification and a December 23, 2027 effective date.

USTR excess-capacity Section 301 probes

USTR opened structural excess-capacity investigations into major trading partners, a conditional watch item for duties that could reach telecom-equipment inputs.

FCC Covered List adds foreign routers

Foreign-produced consumer routers were added to the Covered List, except those granted DoW or DHS conditional approval, extending the device gate beyond UAS.

FACS rule published in Federal Register

The Foreign Adversary Control rule published, fixing a June 9 effective date while leaving the attestation filing clocks to start only after a later launch public notice.

FISA 702 short-term extensions

After the April 20 sunset approached, Congress passed short bridges, a 10-day then a 45-day extension to June 12, while reform talks over warrant requirements stalled.

WC Docket 26-82 NPRM published

The domestic Section 214 and Covered List proposal (adopted April 30) published. It also covers the data-center, gateway, and PoP interconnection restrictions, one docket, not two.

Section 232 metals proclamation

A separate Section 232 action on metals, distinct from the January chip tariff, relevant to hardware input and enclosure costs across the telecom supply chain.

USTR forced-labor Section 301 findings

USTR proposed duties across 60 forced-labor investigations, 14 economies at 10% and 46 at 12.5%, with written comments and hearings set for early July.

WC 26-82 initial comments closed

The first comment record closed on the domestic Section 214 and foreign-adversary proposal. Reply and Paperwork Reduction Act comments are set for July 7.

FACS rule effective

The Foreign Adversary Control rule took effect. Attestation clocks (60 days standard, 120 for small entities) still wait on a public notice launching the filing system.

DoD 1260H list jumps to 188 entities

The re-issued list added roughly 65 firms, including Alibaba, Baidu, and BYD, reaching 188. The direct-contracting prohibition lands June 30, 2026; produced-or-developed-by follows in 2027.

FISA Section 702 statute lapsed

The House failed a short-term extension (198-218) and the statute lapsed. Operations continue under FISA Court certifications approved in March that remain valid through March 2027.

FCC equipment-authorization rules effective

The Trusted Test Labs and equipment-authorization integrity order took effect, with the FNPRM track on accreditation and post-market surveillance continuing.

CIRCIA communications-sector town hall

CISA held its communications-sector town hall on cyber incident reporting, part of the engagement run before a final rule that harmonization concerns have repeatedly delayed.

CIRCIA written input closed

Written input on CIRCIA closed. The final 72-hour incident and 24-hour ransom-payment reporting rule remains expected late 2026.

FCC submarine cable Second R&O adopted

A unanimous 3-0 adoption: SLTE licensing, foreign-adversary equipment bars, and a presumptive Team Telecom exemption for trusted, incident-free filers. An open Second FNPRM follows.

Rolled the August 10 baseline forward to the August 12 verified state. It recorded the first completed national-security equipment-authorization revocation (Odyssey Robot LLC, August 11), the submarine cable First R&O Route Position List filing instructions (August 10), the Cyber Trust Mark CLA announcement and new filing window (August 11), and an erratum in the Section 1709 / covered UAS import-and-marketing proceeding leaving comment dates unchanged. Superseded by the August 18 update, which caught two items missed in this state — the August 7 Federal Register publication of FCC 26-50 setting the September 8 / September 21 clocks, and the August 6 Section 232 polysilicon proclamation — added the August 12 NSPM private-sector cyber-operations program as a third adjacent clock, and flipped the CMMC Reform RFI to closed.

June 25 FCC submarine cable vote

Adopted June 25 by 3 to 0

Replace all forward-looking vote language with adopted / implementation language; add the open Second FNPRM cycle.

FACS "filing due ≤120 days"

Correct trigger, but 60 days standard / 120 days small entities, and no clock runs until the FCC launch notice

Keep trigger-based; do not show a calendar deadline until the notice issues.

WC 26-82 "comments due"

Initial comments closed June 8; reply and PRA comments due July 7

Change to "reply / PRA comments due July 7."

Separate "data-center / PoP ban NPRM" row

Same proceeding as WC 26-82

Merge into the WC 26-82 workstream; do not count twice.

CIRCIA input due June 23

Passed; final rule pending

Move June 16 and June 23 to passed milestones; keep late-2026 final-rule watch.

USTR 301 hearing requests due June 22

Passed; comments July 6, hearings July 7

Use the official USTR docket and date line.

1260H "effective June 30"

Direct prohibition June 30, 2026; produced/developed-by June 30, 2027; list at 188 entities

Split into two dates; update the count to 188.

Section 851 lobbyist prohibition

Effective June 30, 2026; codified at 10 U.S.C. 4663

Retain; cross-link to the 1260H list.

TINA "$2M to $10M"

10 U.S.C. 3702 threshold rises for contracts entered after June 30, 2026

Use the statutory citation; add the FAR inflation-adjustment note ($2.5M).

BIS Affiliates snapback

Confirmed; suspended through November 9, reimposed November 10, 2026

Retain as a screening planning date.

FISA 702 as adjacent clock

Lapsed June 12, 2026; certifications valid through March 2027

Keep adjacent; do not count; add the March 2027 bridge.

UFLPA named-entity language

Framework is sound; specific named expansions need a DHS, CBP, or Federal Register source attached

Do not name specific entities in the ONCD version without an official citation.