CISA updates cyber incident form to improve threat analysis

CISA has released an updated cyber incident reporting form, described as an enhanced web-enabled questionnaire on the agency’s Incident Reporting Portal. The agency says the redesigned form will improve data quality, enabling more effective threat analysis and quicker identification of trends to inform national cyber defence actions.

The updated questions are more comprehensive about incident type and expected activity, asking for detail on whether malware, social engineering, hacking techniques, or insider threats were involved, and incorporating references to observed activity through the MITRE ATT&CK framework.

The press release notes that the enhanced form was informed by community feedback and aims to support rapid but thorough threat analysis by correlating related cyber threat activity to reveal broader campaigns. Acting Executive Assistant Director for Cybersecurity Chris Butera is quoted saying the form helps in sharing detections and shaping protection.

CISA emphasises that, while reporting is mandatory only for federal civilian agencies, voluntary reporting is encouraged for all organisations that experience a cyber incident. More information is available via the agency’s Frequently Asked Questions page.