Resolution criteria: - "Yes": Wins if, on or before December 31, 2026 (UTC), a U.S. federal law or enforceable federal regulation requiring companies (or a defined class of companies) to report major/covered cyber incidents within 72 hours has been enacted AND its legally operative effective date (i.e., the date on which covered entities are affirmatively required to comply with the reporting obligation) has passed on or before December 31, 2026 (UTC). This includes CIRCIA (6 U.S.C. §681b) and its implementing regulations, but only if the final rule's compliance effective date — not merely the publication or signing date — falls on or before December 31, 2026 (UTC). - "No": Wins if, as of December 31, 2026 (UTC), no U.S. federal law or enforceable federal regulation meeting the above condition is in effect. Clarifications: - "In effect" means the statutory or regulatory text establishing the 72-hour reporting obligation has both been signed/finalized and its compliance effective date has become legally operative on or before December 31, 2026 (UTC). A final rule that has been published but whose compliance effective date falls after December 31, 2026 (UTC) does not satisfy this condition. - "Companies" is interpreted broadly to include any private-sector entities subject to a federal mandate; a law covering only a defined critical-infrastructure subset of companies still satisfies the condition.