CISA expands incident reporting form as CIRCIA rule waits

The US Cybersecurity and Infrastructure Security Agency (CISA) has released a revamped cyber incident reporting form that seeks more granular data on incident types and frames observed activity in MITRE ATT&CK terms. The revised questionnaire, announced on 9 November 2026, is available via CISA’s Incident Reporting Portal and is designed to improve data quality so the agency can connect related threat activity into broader trends rather than treating incidents in isolation.

CISA said the changes draw on feedback from the cyber community over the years and aim to support rapid but thorough threat analysis. Chris Butera, CISA’s acting executive assistant director for cybersecurity, framed the update as part of a “team sport” approach to national defence, emphasising that shared detections can enhance protection for others.

The piece also notes that, at present, only federal civilian agencies are required to report incidents to CISA, with other organisations’ reports voluntary and potentially eligible for protection under the Protected Critical Infrastructure Information (PCII) Programme. The article situates the update against the backdrop of the Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA), whose final rule awaits White House review after being submitted to the office on 1 October.

CIRCIA would require covered critical infrastructure entities to report qualifying cyber incidents within 72 hours of reasonably believing they occurred and ransom payments within 24 hours of payment, subject to later regulatory changes and industry feedback.

The article observes that CIRCIA’s rule was proposed in April 2024 and missed a statutory deadline for finalisation in October 2025, with ongoing debate about scope and burden; the enhanced form’s deployment is not described as contingent on CIRCIA’s final rule.