The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has introduced a significantly updated cyber incident reporting form designed to elicit more detailed information regarding the types of incidents reported. Notably, this new form employs terminologies drawn from the well-regarded MITRE ATT&CK framework, which is commonly understood among cybersecurity professionals.
On November 9, CISA highlighted these changes in an official announcement, revealing that the revised web-based questionnaire is now accessible via the Incident Reporting Portal. This initiative aims to enhance the quality of data collected, enabling CISA to connect disparate threat activities to identify broader security trends. The adjustments made to the reporting form reflect the feedback gathered from the cybersecurity community over an extended period.
The enhanced reporting form now presents a series of granular questions that address a wider variety of incident types. It specifically inquires whether the reported incident involved malware, social engineering techniques, traditional hacking methods, or insider threats. Furthermore, to align its terminology with industry standards, CISA’s updated form incorporates the use of MITRE ATT&CK. This established framework serves as a descriptive tool for outlining adversarial behavior, thus ensuring that the questions feel familiar to those within the cyber community and prompting relevant responses.
CISA emphasizes that these improvements are intended to facilitate more efficient and comprehensive threat analysis. Chris Butera, who serves as the acting executive assistant director for cybersecurity at CISA, underscored the importance of cooperation within the cybersecurity field by stating, “In the team sport of cybersecurity, one organization’s detection is another’s protection.” This cooperative spirit enables CISA to serve as the national coordinator responsible for the cybersecurity and resilience of critical infrastructure. By leveraging these enhanced incident-reporting capabilities, CISA aims to identify emerging cyber threats, offer warnings to potential targets, and bolster the collective defense of the nation against cyberattacks.
Currently, mandatory reporting to CISA is a requirement only for federal civilian agencies. However, CISA encourages other organizations that encounter a cybersecurity incident to report their experiences voluntarily. They can do so while being assured that any information shared may be protected from public disclosure under the Protected Critical Infrastructure Information (PCII) Program. Such protections create an environment where organizations can share vital information without fear of exposing sensitive operational details.
The roll-out of the new reporting form comes in the context of ongoing legislative measures, including the Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA), which is presently awaiting approval from the White House. The final rule implementing CIRCIA was submitted for review on October 1 and has yet to receive a verdict, remaining in a state of pending approval. The proposed rules outlined under CIRCIA stipulate that critical infrastructure organizations will be required to report qualifying cyber incidents within a strict timeline of 72 hours after they reasonably believe such incidents have occurred, while any ransom payments must be reported within 24 hours of execution.
CISA initially proposed the rules governing CIRCIA in April 2024 but faced challenges that resulted in missing an October 2025 statutory deadline for finalization. Feedback received during the public commentary period indicated a desire for a narrower scope and recommendations for reducing the burden on organizations, as well as calls for improved alignment with other existing federal reporting requirements.
Interestingly, CISA’s recent announcement concerning the updated reporting form did not mention the current status of the CIRCIA rule or specify whether the enhancements to the reporting form would be incorporated under the impending regulations. The lack of clarity regarding the connection between CISA’s enhancements and CIRCIA raises questions within the cybersecurity community.
As the landscape of cybersecurity continues to evolve, these new measures highlight CISA’s commitment to enhancing the resilience of the nation’s critical infrastructure while fostering collaboration among different organizations to create a more secure digital environment. Attention now turns to CISA’s next steps and the potential implications of the CIRCIA rule once it is officially integrated into the existing cybersecurity framework.