CISA's New Incident Reporting Form: What Changed on November 9, 2026

The questions got more granular, and observed activity is now described in ATT&CK terms. CISA's November 9 announcement says incident type questions now ask "whether the incident involved malware, social engineering, hacking techniques or an insider threat," and that questions about observed activity "now incorporate the MITRE ATT&CK® Framework."

CISA's stated aim is correlation: better data lets it connect reports that "otherwise would appear as independent incidents." Nextgov/FCW also reported that CISA removed duplicate questions and folded in feedback from incident response partners. The announcement doesn't list the new fields one by one or say which are mandatory, so expect to learn the detail by opening the form.

The form lives on CISA's Incident Reporting System page. You can submit without signing in, or sign in with a Login.gov account tied to your organizational email to save a draft, resume it and track the report after submission. The page asks filers not to paste malicious code into the form. Instead, you put the CISA Incident ID from your report into the separate Malware Analysis Submission Form and upload the file there.

Federal Executive Branch civilian agencies must report; most others may. The announcement names federal civilian agencies and "certain entities regulated by Transportation Security Administration or the U.S. Coast Guard" as required reporters and encourages everyone else to report voluntarily. Some contracts carry their own reporting clause, which may point somewhere other than CISA.

The guidelines say FISMA reporting covers incidents involving agency information and systems "whether managed by a federal agency, contractor, or other source." Whether a given clause sends a contractor's report to the agency, to CISA or to DoD is a question for the contract itself and the contracting officer.

Seven elements, under the Federal Incident Notification Guidelines: functional impact, information impact, estimated recoverability, when the activity was first detected, the number of systems, records and users affected, the network location of the activity, and a point of contact. Attack vectors, indicators of compromise and mitigation steps are asked for "if known."

The guidelines don't expect a finished investigation. They tell agencies to give "their best estimate at the time of notification" and update as facts arrive, and they move cause analysis to the closing phase so it doesn't hold up the first notice. Within an hour of receiving the report, CISA returns a tracking number and a risk rating from its National Cyber Incident Scoring System.

CISA's guidelines page now says the 2017 document is "currently being updated to support the new cyber incident reporting form" and will be renamed the Federal Incident Reporting Requirements (FIRR). It gives no date beyond "expected to be released shortly."

One mismatch is visible in the 2017 text. It says observed activity is "not currently required" and maps to the Office of the Director of National Intelligence's Cyber Threat Framework, while the new form describes observed activity in ATT&CK. Whether FIRR changes the one-hour window or the required elements is unknown until CISA publishes it. Plan on today's rules, and read FIRR against your incident response plan the week it comes out.

Not in effect. The Cyber Incident Reporting for Critical Infrastructure Act of 2022 (CIRCIA) requires covered entities to report covered incidents within 72 hours and ransom payments within 24 hours, but only once CISA's final rule takes effect. The proposed rule was published April 4, 2024. CISA's CIRCIA page says it "continues to work on the final rule" after funding lapses slowed the work, and Nextgov/FCW reported the rule reached White House review on October 1. The statute set an 18-month window after the proposed rule for the final rule, which Nextgov/FCW reports CISA missed in October 2025. The new form is a separate change to how CISA collects reports.

A complete report within the hour depends on intake that already matches what CISA asks:

1. Add ATT&CK technique IDs to your incident tickets and detection rules, so observed activity can be copied rather than reconstructed mid-incident.
2. Make sure your intake record captures the seven required elements as fields, with the impact categories CISA uses.
3. Register the people who file with Login.gov using organizational email, so drafts can be saved and tracked.
4. Write down which contracts carry their own reporting clause (DFARS 252.204-7012 or an agency clause) and where each one sends the report.
5. Know which logs answer "when was this first detected" and "how many systems." OMB M-26-14 makes that a logging question; our post on the M-26-14 logging plan covers its deadlines.

If an incident starts with a flaw on CISA's Known Exploited Vulnerabilities list, note the CVE in the report as well. Our KEV catalog explainer covers how those due dates work.