"In the team sport of cybersecurity, one organization's detection is another's protection," said Chris Butera, CISA's acting executive assistant director for cybersecurity, as the agency unveiled a new, more detailed incident-reporting questionnaire on November 9.
CISA launches revamped web-based Incident Reporting Portal form
The Cybersecurity and Infrastructure Security Agency (CISA) published an announcement on November 9 and rolled out an updated web-based questionnaire through its Incident Reporting Portal. The agency said the revision draws on community feedback received over the years and is intended to improve the quality of data collected from reports.
More granular questions, framed in MITRE ATT&CK terms
The revised form asks reporters to indicate whether an incident involved malware, social engineering, hacking techniques or an insider threat. Questions about observed activity now use MITRE ATT&CK, a framework CISA said is familiar to the cyber community. CISA framed the change as a means to support "rapid but thorough threat analysis" and to help the agency connect related threat activity into broader trends that might otherwise appear as separate incidents.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildWho must report now — and how voluntary reports are protected
At present, only federal civilian agencies are required to report incidents to CISA. The agency encouraged other organizations to report voluntarily; information they submit can be protected from disclosure under the Protected Critical Infrastructure Information (PCII) Program, CISA said. The agency positioned the updated form as a way to leverage incident reporting to identify emerging campaigns, warn potential targets, and "strengthen the Nation's collective defense," quoting Chris Butera.
CIRCIA final rule remains pending at the White House
The announcement came while the final rule implementing the Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA) remains under review at the White House. CISA said the rule went to the White House for review on October 1 and is still listed as pending. According to CISA, once the rule takes effect, covered critical infrastructure organizations would have to report qualifying cyber incidents within 72 hours of reasonably believing they occurred and would have to report ransom payments within 24 hours of making them.
CISA published its proposed CIRCIA rule in April 2024 but missed an October 2025 statutory deadline to finalize it. The agency's regulatory agenda notes that many public comments on the proposal asked for a narrower scope, less burden and closer alignment with other federal reporting rules. CISA's recent announcement did not mention CIRCIA or say whether the enhanced reporting form will be used under the pending rule.
What this means for federal civilian agencies, covered critical infrastructure organizations, and security teams
- Federal civilian agencies: The revised, web-based questionnaire is immediately relevant because these agencies are currently required to report incidents to CISA; the form's greater granularity and ATT&CK-aligned fields aim to improve the agency's ability to correlate and analyze reports.
- Covered critical infrastructure organizations: If the CIRCIA final rule is adopted as proposed, these organizations would face explicit deadlines—72 hours for incidents and 24 hours for ransom payments—once the rule takes effect; however, the rule remains pending at the White House and the announcement did not state whether the new form will apply under CIRCIA.
- Security teams and incident responders: The move to ATT&CK-framed questions and clearer incident-type choices (malware, social engineering, hacking techniques, insider threats) is meant to support faster, more thorough analysis and to help link otherwise disparate reports into broader threat trends, according to CISA.
CISA framed the updated form as a practical step to improve collective detection and protection, while the legal mandate that would widen mandatory reporting to covered critical infrastructure organizations waits at the White House. The agency's announcement explicitly left open whether the new questionnaire will become the vehicle for CIRCIA-required reporting, even as the final rule—sent for review on October 1 and delayed past an October 2025 statutory deadline—remains pending.
Original story: https://www.infosecurity-magazine.com/news/cisa-incident-reporting-form-circia/
