The US Cybersecurity and Infrastructure Security Agency (CISA) has rolled out a revamped cyber incident reporting form that asks more granular questions about incident types and frames observed activity in MITRE ATT&CK terms.
CISA outlined the changes in an announcement published November 9 and the updated web-based questionnaire is available through its Incident Reporting Portal.
The agency said better data quality will help it connect related threat activity into broader trends that would otherwise look like separate incidents. The update draws on community feedback CISA has received over the years.
More Granular Questions Add ATT&CK Terms
The revised form asks whether an incident involved malware, social engineering, hacking techniques or an insider threat. Questions about observed activity now use MITRE ATT&CK, a framework for describing adversary behavior that CISA said is familiar to the cyber community.
The changes are meant to support rapid but thorough threat analysis, according to CISA.
"In the team sport of cybersecurity, one organization's detection is another's protection," said Chris Butera, CISA's acting executive assistant director for cybersecurity. "As the national coordinator for critical infrastructure cybersecurity and resilience, CISA is able to leverage such incident reporting to identify emerging cyber campaigns, warn potential targets, and strengthen the Nation's collective defense."
For now, only federal civilian agencies are required to report incidents to CISA. The agency encouraged other organizations that experience an incident to report voluntarily, and information they submit can be protected from disclosure under the Protected Critical Infrastructure Information (PCII) Program.
CIRCIA Rule Remains at White House
The update comes as the final rule implementing the Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA) awaits approval. The rule went to the White House for review on October 1 and remains listed as pending.
Read more on CIRCIA: US Critical Infrastructure Braces for Sweeping New Cyber Reporting Rules
Once the rule takes effect, covered critical infrastructure organizations would have to report qualifying cyber incidents within 72 hours of reasonably believing they occurred and ransom payments within 24 hours of making them, according to CISA.
CISA published its proposed CIRCIA rule in April 2024 but missed an October 2025 statutory deadline to finalize it. Many comments on the proposal asked for a narrower scope, less burden and closer alignment with other federal reporting rules, according to CISA's regulatory agenda.
CISA's announcement did not mention CIRCIA or whether the enhanced reporting form would be used under the pending rule.