Organizations that report a cyberattack to the Cybersecurity and Infrastructure Security Agency now face a more pointed set of questions about how the intruders got in and what they did once inside. CISA updated the cyber incident reporting form in its Incident Reporting Portal on Monday, Nov. 9, aiming to collect richer detail and to link incidents that might otherwise look unrelated. The change lands while the much larger mandate behind it, the final rule implementing the Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA), sits at the White House, where it arrived on Oct. 1 and remains listed as pending.
For now, the form is mandatory for a narrow group. Industrial Cyber's account of the release notes that "only federal civilian agencies are required to report," while CISA encourages any organization that suffers an incident to report voluntarily. Once CIRCIA's implementing regulations take effect, covered critical infrastructure organizations will face a legal reporting obligation of their own, and the questions on this form may hint at the level of detail CISA values in incident reports.
What the Revised Questionnaire Asks Reporters
The new questionnaire goes deeper on the type of incident. It now asks more specific questions about malicious software, hacking techniques, social engineering and insider threats. CISA also said it removed duplicate questions and implemented feedback from its incident response partners, a cleanup that may spare reporters from supplying the same information twice.
The bigger structural change sits in the section on observed activity. Those questions now incorporate MITRE's ATT&CK framework, a widely used catalog of attacker behavior. When every reporter describes intrusions in the same shared vocabulary, analysts can compare incidents across organizations and work toward identifying who may be responsible. Industrial Cyber reports that the new form will help CISA "correlate related cyber threat activity to identify a larger trend from what otherwise would appear as independent incidents."
Chris Butera, CISA's acting executive assistant director for cybersecurity, framed the change as a collective-defense measure. "In the team sport of cybersecurity, one organization’s detection is another’s protection," he said in a statement. He added: "As the national coordinator for critical infrastructure cybersecurity and resilience, CISA is able to leverage such incident reporting to identify emerging cyber campaigns, warn potential targets, and strengthen the Nation’s collective defense."
Why the CIRCIA Final Rule Is Still at the White House
Congress passed CIRCIA in 2022 following major attacks, including the SolarWinds espionage campaign and the Colonial Pipeline ransomware incident, that exposed gaps in the government's knowledge of breaches affecting critical services. The statute directs CISA to write the implementing regulations, and that process has run years behind schedule.
CISA published its proposed rule in April 2024 and then missed the October 2025 statutory deadline to finalize it. The agency later targeted September 2026, after a DHS funding lapse delayed additional industry meetings until June. The final rule reached White House review on Oct. 1, 2026, and Nextgov/FCW reports it remains listed as pending.
Industry has spent much of that period contesting how far the mandate should reach. Companies have mostly pushed back on its scope, citing the additional incident reporting requirements set by other federal agencies that oversee sectors such as banking and telecommunications. Every additional regime means another set of definitions, another deadline and potentially another channel for the same event.
The 72-Hour and 24-Hour Clocks Waiting in the Rule
Once the implementing regulations take effect, organizations will have to report substantial cyber incidents within 72 hours of reasonably believing they occurred. Ransom payments carry a tighter clock: organizations must report them within 24 hours of making them. The reports are intended to help CISA assist victims and warn others before hackers can repeat the same methods elsewhere.
The revised form shows how incident reports may be consumed. A submission that maps observed behavior to ATT&CK techniques is likely easier to cluster with other submissions than a free-text narrative. CISA's own stated aim is to connect incidents that might otherwise appear unrelated, and the agency is building that capability into its current intake form while the final rule is still under review.
What It Means for Contractors
Federal contractors that operate in covered critical infrastructure sectors, such as energy, communications or transportation, should plan for overlapping obligations. CIRCIA's clocks would sit alongside whatever incident reporting requirements a contractor's sector regulators and contracting agencies already impose, and a single intrusion could trigger several reports on several tracks.
That stacking is exactly the scope concern industry has raised throughout the rulemaking, and the final text now under White House review will determine how much relief, if any, CISA offers for duplicative reporting. Until the rule publishes, contractors should treat the following as practical steps:
- Review the new form now. The questions on malware, hacking techniques, social engineering and insider threats show the level of detail CISA is asking for today. Incident response playbooks should capture that information during an investigation, not reconstruct it afterward.
- Adopt ATT&CK terminology internally. Security teams that already log observed activity using MITRE ATT&CK techniques should be able to fill out the form faster and more accurately.
- Map every reporting obligation. List each clock that could start from a single incident, including contract and sector regulator requirements and, once final, CIRCIA's 72-hour incident and 24-hour ransom payment deadlines.
- Consider voluntary reporting. CISA encourages any organization that experiences a cyber incident to report it voluntarily. Doing so gives a company practice with the form before any mandate reaches it.
Companies supporting federal civilian agencies, which are required to report, may also see those agency customers ask for more granular incident details so they can complete the expanded questionnaire.
The timing of the final rule now rests with White House reviewers. Until it clears, the updated form is the clearest sign of the detail CISA wants from incident reports.
