CISA Expands Cyber Incident Reporting Form With New Granular Questionnaire

The U.S. Cybersecurity and Infrastructure Security Agency released an expanded cyber incident reporting form on November 9, 2026, adding a questionnaire that demands substantially more granular incident data from reporting entities.

CISA said the additional detail will improve data quality. The agency listed three specific operational benefits in its announcement:

• Faster and more thorough threat analysis
• Better correlation of related cyber threat activity to identify larger trends
• Sharper prioritization of response actions

What does the new form require?

The updated form incorporates MITRE ATT&CK Framework language (a widely used knowledge base of adversary tactics and techniques) that CISA describes as familiar to the cyber community. Reporting entities must now characterize the nature of the incident in detail.

The questionnaire asks whether the attack involved malware, whether social engineering was used, whether the incident stemmed from an insider threat, and which hacking techniques were employed, if known. The form is available through CISA's reporting portal at myservices.cisa.gov/report.

Who must report today?

Mandatory reporting currently applies only to federal civilian agencies and certain entities regulated by the Transportation Security Administration or the U.S. Coast Guard. That scope is set to widen under the Cyber Incident Reporting for Critical Infrastructure Act, known as CIRCIA, the 2022 statute mandating incident reporting by critical infrastructure operators.

The CIRCIA rulemaking has slipped repeatedly. CISA first proposed the rule in April 2024 and pencilled in a final version for October 2025, but the deadline passed. CISA has now issued the final rule, and it is currently under review by the White House. No timeline has been released for its publication.

Once the final rule takes effect, covered organizations in 16 critical infrastructure sectors must report substantial cyber incidents to CISA within 72 hours. Ransom payments carry a tighter 24-hour reporting window.

Should organizations outside the mandate file reports?

CISA is encouraging voluntary use of the form by all organizations, not only those under a legal obligation. The agency said voluntary submissions help it identify attack trends and take prompt action against emerging threats.

Acting Executive Assistant Director for Cybersecurity Chris Butera framed the request in collective-defense terms. "In the team sport of cybersecurity, one organization's detection is another's protection," Butura said. "As the national coordinator for critical infrastructure cybersecurity and resilience, CISA is able to leverage such incident reporting to identify emerging cyber campaigns, warn potential targets, and strengthen the Nation's collective defense."

What should security teams do now?

Security operations teams in the 16 designated sectors face compressed reporting deadlines once the CIRCIA rule clears White House review. The 72-hour and 24-hour clocks start at incident discovery, so teams benefit from mapping internal incident documentation to the new questionnaire fields before obligations become binding.

The form's adoption of MITRE ATT&CK terminology aligns federal reporting with the classification scheme most enterprise security teams already use in detection engineering and threat intelligence, which should reduce translation effort during mandatory filings.