CISA Updates Cyber Incident Reporting Form to Better Identify Emerging Threats

Key Takeaways

• Updated Reporting Form: CISA introduced a revised cyber incident reporting questionnaire on November 9 to improve the quality of information collected about cyberattacks.
• More Detailed Incident Data: The form seeks additional information about malware, social engineering, hacking techniques and insider threats.
• MITRE ATT&CK Framework: Questions about observed activity now incorporate standardized terminology for describing adversary behavior.
• Threat Identification: CISA aims to identify connections between seemingly unrelated incidents, recognize broader cyber campaigns and prioritize response actions.
• Reporting Requirements: Federal civilian agencies remain required to report incidents, while CISA encourages voluntary reporting from other organizations.

Deep Dive

The Cybersecurity and Infrastructure Security Agency (CISA) unveiled an updated cyber incident reporting form Monday, November 9, designed to help federal analysts identify connections between attacks that might otherwise appear unrelated.

The revised questionnaire, available through CISA's Incident Reporting Portal, asks organizations to provide more detailed information about the incidents they experience, including the methods attackers used and the activity observed during an attack. CISA said the changes will improve the quality of the information it receives, allowing analysts to identify emerging threats and better prioritize response efforts.

One of the agency's principal concerns is that separate incident reports may contain evidence of the same cyber campaign without making that connection immediately apparent. An attack against one organization could share characteristics with an incident reported elsewhere, but recognizing the relationship depends on the information available to investigators. CISA expects the revised form to make those connections easier to establish.

The questionnaire now includes more comprehensive questions about the type of incident being reported, seeking specific information about malware, social engineering, hacking techniques and insider threats. Questions about observed activity also incorporate the MITRE ATT&CK Framework, which provides a common vocabulary for describing the tactics and techniques used by cyber adversaries.

Using that terminology should help analysts compare reports submitted by different organizations, particularly when similar activity might otherwise be described in different ways. The agency said the changes are intended to support faster, more thorough threat analysis and improve its ability to recognize patterns across reported incidents.

The revisions reflect feedback CISA has received from the cybersecurity community over several years, along with the agency's efforts to improve the quality of the data it collects.

“In the team sport of cybersecurity, one organization’s detection is another’s protection,” said Chris Butera, CISA's acting executive assistant director for cybersecurity.

“As the national coordinator for critical infrastructure cybersecurity and resilience, CISA is able to leverage such incident reporting to identify emerging cyber campaigns, warn potential targets, and strengthen the Nation’s collective defense,” Butera said.

The updated form does not change who is required to report incidents under the reporting arrangements described in CISA's announcement. Federal civilian agencies are required to report, while other organizations are encouraged to submit reports voluntarily.

CISA has long sought broader participation in incident reporting, arguing that information shared by individual organizations can help federal officials understand threats extending beyond any single victim. The agency introduced its CISA Services Portal in August 2024, providing a centralized platform for submitting and managing cyber incident reports. The latest changes focus on the information collected through that reporting process rather than the portal itself.

For organizations reporting an incident, the revised questionnaire calls for a more detailed account of what occurred. For CISA, the objective is to make those accounts useful beyond the individual cases they describe, particularly when multiple reports contain evidence of a coordinated campaign.

The agency has not provided figures showing how much the revised questionnaire will improve incident analysis or detection. Its effectiveness will depend on the information organizations submit and what analysts can establish from it.

The GRC Report is your premier destination for the latest in governance, risk, and compliance news. As your reliable source for comprehensive coverage, we ensure you stay informed and ready to navigate the dynamic landscape of GRC. Beyond being a news source, the GRC Report represents a thriving community of professionals who, like you, are dedicated to GRC excellence. Explore our insightful articles and breaking news, and actively participate in the conversation to enhance your GRC journey