CISA expands incident reporting form while CIRCIA rule waits
Original title: CISA Expands Incident Reporting Form While CIRCIA Mandate Waits
Only federal civilian agencies must report now; a final rule would add 72-hour incident and 24-hour ransom deadlines.
CISA published a revised web incident-reporting questionnaire on November 9 that asks more specific questions about malware, social engineering, hacking, and insider threats, and frames observed activity in MITRE ATT&CK terms. The agency says richer reports should help it link separate incidents into campaigns. Voluntary reports from non-federal organizations can receive Protected Critical Infrastructure Information protections. The final CIRCIA rule, sent to the White House on October 1, remains pending after CISA missed an October 2025 deadline.
Unconfirmed: CISA did not say whether the enhanced form will be used under the pending CIRCIA rule.
- The updated form is available through CISA’s Incident Reporting Portal.
- Covered entities would report qualifying incidents within 72 hours once the rule takes effect.
- Ransom payments would have to be reported within 24 hours of payment.
- CISA published the proposed CIRCIA rule in April 2024.
- The announcement did not say whether the new form would be used under CIRCIA.
- 1.Non-federal organizations can voluntarily report incidents through CISA’s Incident Reporting Portal.
- Organizations
- CISA
- Countries
- United States
From the original article
2 min read at infosecurity-magazine.com
CISA adds MITRE ATT&CK detail to incident reports as CIRCIA rule awaits White House review
By Alessandro Mascellino · infosecurity-magazine.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.