Overview
On November 9, 2026, CISA unveiled an updated cyber incident reporting form, a web-enabled questionnaire on its Incident Reporting Portal. The agency says the form will improve its ability to assess incidents, identify trends, and prioritize response.
What Changed
- More comprehensive, granular questions on incident type, covering malware, social engineering, hacking techniques, and insider threats
- Incorporation of the MITRE ATT&CK framework
- Removal of duplicate questions
- Changes based on feedback from incident response partners
CISA says the richer data will help it correlate related activity so that incidents that look independent can be recognized as part of larger campaigns.
Who Should Use It
Only federal civilian agencies are required to report. CISA encourages any organization with an incident to report voluntarily, and calls the form its preferred reporting method. It urges people who previously reported by phone or email to switch. CISA has also published an FAQ for the form.
CIRCIA Context
The broader CIRCIA rule, which would impose mandatory incident reporting on critical infrastructure, is still awaiting approval, according to Nextgov. CISA proposed it in April 2024, missed the October 2025 statutory deadline, and later targeted September 2026. CISA has not published figures on how much the new form will improve analysis or detection.
Recommendations
- Add the portal and the new form to your incident response playbooks.
- Prepare ATT&CK-mapped details (techniques, indicators, timelines) in advance so reports are fast and accurate.
- Decide who owns external reporting decisions in your organization before an incident occurs.