CISA Unveils Updated Cyber Incident Reporting Form

The enhanced web-based questionnaire on CISA's Incident Reporting Portal adds detailed questions on malware, social engineering, hacking techniques and insider threats.

Updated on Nov. 9, 2026 in Cybersecurity

CISA Unveils Updated Cyber Incident Reporting Form

The Cybersecurity and Infrastructure Security Agency unveiled an updated cyber incident reporting form on its Incident Reporting Portal. The enhanced questionnaire includes more comprehensive incident-type questions covering malware, social engineering, hacking techniques and insider threats.

Why it matters

The form is designed to improve data quality for rapid and thorough threat analysis across the United States. It allows CISA to correlate related cyber threat activity into larger trends rather than treating incidents as isolated events.

The form is an enhanced web-enabled questionnaire that incorporates the MITRE ATT&CK Framework into questions about observed activity. Its incident-type questions now cover malware, social engineering, hacking techniques and insider threats, though the extraction does not specify how many questions were added.

The players

Cybersecurity and Infrastructure Security Agency (CISA)

CISA is the federal agency responsible for coordinating national cybersecurity and critical infrastructure protection efforts.

The details

The updated form is accessed through CISA's Incident Reporting Portal and was guided by community feedback and CISA efforts to improve data quality. Only federal civilian agencies are required to report cyber incidents, while CISA encourages any organization that experiences a cyber incident to report voluntarily.

November 9, 2026: CISA unveiled the updated cyber incident reporting form.

Roadmap

The form builds on the MITRE ATT&CK Framework, a widely used catalog of adversary tactics and techniques, by embedding it in federal incident reporting. This places CISA's data collection in line with a shared analytic vocabulary used across the cybersecurity industry.

Organizations that experience a cyber incident can report voluntarily through the portal, and federal civilian agencies are required to report. The more detailed questions give reporters a structured way to describe malware, social engineering, hacking techniques and insider threats.

The takeaway

Reporting detailed incident information helps CISA connect separate attacks into broader threat patterns. Organizations that experience a cyber incident are encouraged to report it, even though reporting is voluntary outside federal civilian agencies.