CISA Announces Enhanced Reporting Form for Cyber Incidents
CISA launched an updated cyber incident reporting form to improve data quality and national threat detection, incorporating community feedback and MITRE ATT&CK® Framework guidance.
The Cybersecurity and Infrastructure Security Agency (CISA) introduced an enhanced cyber incident reporting form on its Incident Reporting Portal, designed to improve data quality and streamline national cyber defense efforts. The updated form replaces a previous version and includes more detailed questions to capture comprehensive incident information. By refining data collection, CISA aims to better correlate related cyber threats and identify broader trends that may otherwise appear as isolated events. The changes reflect feedback from the cybersecurity community and align with ongoing efforts to strengthen threat analysis capabilities.
The new form expands the scope of incident details requested, including specific categories such as malware, social engineering, hacking techniques, and insider threats. It also integrates the MITRE ATT&CK® Framework to standardize descriptions of adversary behavior, making reports more actionable for analysts. This structured approach enables CISA to detect patterns and respond more effectively to emerging cyber campaigns. The framework’s inclusion ensures consistency in how incidents are reported across organizations.
CISA emphasizes the form’s role in supporting a collective defense strategy, where shared reporting enhances protection for all organizations. While federal civilian agencies are legally required to report incidents, CISA encourages voluntary reporting from any affected entity to bolster national cybersecurity resilience. The agency highlights that broader participation improves its ability to warn potential targets and mitigate risks. The updated form is part of CISA’s broader mission to reduce risks to critical infrastructure.
Acting Executive Assistant Director for Cybersecurity Chris Butera framed the reporting form as a critical tool in the "team sport" of cybersecurity, where collaboration strengthens defenses. CISA’s role as the national coordinator for critical infrastructure cybersecurity allows it to leverage incident data to identify emerging threats and coordinate responses. Organizations are directed to the Frequently Asked Questions webpage for guidance on using the new form. Additional resources and updates are available on CISA.gov and its social media channels.