CISA Seeks More Granular Information on Cyber Incidents
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has released an expanded form for reporting cyber incidents. The updated form, released on November 9, 2026, includes a new questionnaire that requires more granular information on cyber incidents to improve data quality. The additional information will improve CISA’s ability to conduct rapid and thorough threat analyses, more effectively correlate related cyber threat activity to identify larger trends, and prioritize its response actions.
The new form incorporates MITRE ATT&CK Framework language about adversary behavior that is familiar to the cyber community, and requires reporting entities to provide more granular information about the nature of the incident, such as whether the attack involved malware, if social engineering was used, if the incident was due to an insider threat, and the hacking techniques used (if known).
CISA currently only requires cyber incident reporting by federal civilian agencies and certain entities regulated by Transportation Security Administration or the U.S. Coast Guard; however, a final rule implementing the Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA) is due for release that extends the reporting requirements to critical infrastructure operators. CIRCIA was first proposed in April 2024, and a final rule was pencilled in for release in October 2025; however, it has faced delays. The final rule has been issued by CISA, and it is currently being reviewed by the White House.
When the final rule is issued, the reporting requirements will be extended to certain organizations in 16 critical infrastructure sectors, which will be required to report substantial cyber incidents to CISA within 72 hours, and any ransom payments within 24 hours. No timeline has been released on when the final rule will be issued. Mandatory reporting aside, CISA requests that all organizations voluntarily use the form to submit information about cyber incidents they experience, as the information will help the agency identify attack trends and take prompt action in response to emerging threats.
“In the team sport of cybersecurity, one organization’s detection is another’s protection,” said Acting Executive Assistant Director for Cybersecurity Chris Butera. “As the national coordinator for critical infrastructure cybersecurity and resilience, CISA is able to leverage such incident reporting to identify emerging cyber campaigns, warn potential targets, and strengthen the Nation’s collective defense.”
