CISA updates incident form to spot linked attacks
November 10, 2026: Help Net Security adds that the form drops duplicates, accepts unsigned filings and Login.gov tracking, still takes email, estimates 30 minutes, and links later files by incident ID.
CISA’s updated incident form uses consistent attack terms so analysts can spot campaigns; federal civilian agencies must report.
CISA has updated the cyber incident reporting form on its Incident Reporting Portal so analysts can see when attacks on different organizations may belong to one campaign. The questionnaire asks more specific questions, drops duplicates, and uses consistent terms for malware, social engineering, hacking, and insider threats, plus MITRE ATT&CK language for observed activity. Reports can be filed without signing in; Login.gov lets users save drafts and track submissions, and email to Contact@cisa.dhs.gov remains available. Only federal civilian agencies must report, on their own deadlines; others, including critical infrastructure operators, are encouraged to report voluntarily. A paperwork notice estimates 30 minutes to complete a response, and malicious files should later be linked with the CISA incident ID.
- Incident types cover malware, social engineering, hacking, and insider threats.
- Observed-activity questions use MITRE ATT&CK language to correlate reports.
- Filing does not require sign-in; Login.gov saves drafts and tracks submissions.
- Paperwork estimate is 30 minutes to prepare and complete a response.
- Personal information is requested only when needed to understand the incident.
- Acting Executive Assistant Director Chris Butera called reporting collective defense.
What each outlet adds
beyond the shared facts- Dark ReadingButera called reporting collective defense; form maps activity to MITRE ATT&CK.
- Help Net SecurityNo-login filing, Login.gov tracking, email option, 30-minute estimate, later file linking.
- Organizations
- CISA
- Countries
- United States
Coverage
oldest first · one row per article · UTC- · 1d ago
Dark ReadingFirst report
CISA launches an enhanced cyber incident reporting form
The questionnaire asks about malware, social engineering, hacking, and insider threats, and maps activity to MITRE ATT&CK.
- · 1d ago
DataBreaches.net
CISA announces enhanced cyber incident reporting form
The fetched page showed only a Cloudflare check, so the form’s changes are not described.
- · 1d ago
Help Net Security
CISA revises incident form to link attacks across organizations
The form now uses malware, social-engineering, hacking, insider, and MITRE ATT&CK terms so analysts can compare reports.