The Cybersecurity and Infrastructure Security Agency (CISA) on Nov. 9 unveiled an updated cyber incident reporting form to improve the agency’s ability to identify and respond to cyber threats, while its long-awaited mandatory reporting rule for critical infrastructure organizations remains under White House review.
The enhanced questionnaire, available through CISA’s Incident Reporting Portal, collects more detailed information about cyber incidents to help the agency identify related attacks and emerging cyber campaigns.
The update does not change existing reporting requirements or implement the Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA) of 2022.
CISA submitted its final CIRCIA rule to the White House Office of Information and Regulatory Affairs (OIRA) on Oct. 1, 2026, after missing its September target for completing the regulation. The rule remained pending review as of Nov. 11, according to federal regulatory records.
New reporting form incorporates the MITRE ATT&CK framework
The updated reporting form includes more detailed questions about the nature of cyber incidents, including whether they involve malware, social engineering, hacking techniques, or insider threats.
CISA also incorporated the MITRE ATT&CK framework into questions about observed adversary activity. The framework provides standardized terminology for describing cyberattack tactics and techniques, allowing CISA to compare reports more easily and identify connections among incidents that might otherwise appear unrelated.
The agency said the changes reflect feedback from the cybersecurity community and are intended to improve incident data quality and support more efficient threat analysis.
“In the team sport of cybersecurity, one organization’s detection is another’s protection,” said Chris Butera, CISA’s acting executive assistant director for cybersecurity.
“As the national coordinator for critical infrastructure cybersecurity and resilience, CISA is able to leverage such incident reporting to identify emerging cyber campaigns, warn potential targets, and strengthen the Nation’s collective defense,” Butera said.
Federal civilian agencies are required to report cyber incidents under existing federal requirements, while CISA encourages other organizations to submit reports voluntarily.
CIRCIA rule moves closer to finalization with OIRA submission
The enhanced form is separate from CISA’s pending CIRCIA rule, which would establish mandatory cyber incident and ransomware payment reporting requirements for covered critical infrastructure organizations.
Under CIRCIA, enacted in 2022, covered entities would generally be required to report substantial cyber incidents within 72 hours of reasonably believing an incident occurred and ransomware payments within 24 hours of making them.
CISA published its proposed CIRCIA rule in April 2024, but the regulation has faced delays amid industry concerns about the scope of the proposed requirements, compliance costs, and overlap with existing federal reporting obligations.
CISA had targeted September 2026 to finalize the rule, according to the federal government’s regulatory agenda.
The agency acknowledged in that agenda that it received significant public comments calling for reduced reporting burdens, clearer definitions, and better alignment with other federal cyber incident reporting requirements.
CISA said it was considering those comments and examining options for the final rule.
The regulation’s submission to OIRA on Oct. 1 marked another step toward finalization, but the rule has not yet been published in the Federal Register. Its final provisions and effective date remain unknown.
For critical infrastructure organizations, the distinction means CISA has improved its existing incident reporting process, but the broader mandatory reporting requirements established under CIRCIA are not yet in effect.
The final rule will determine which organizations are covered and how they must comply with the reporting requirements.