# CISA Expands Cyber Incident Reporting Form

On November 9, 2026, CISA launched a revised web-based cyber incident reporting form with more detailed incident fields and MITRE ATT&CK-aligned questions to improve threat correlation and response prioritization. The update does not create new reporting obligations: federal civilian agencies must report incidents, while other organizations are encouraged to submit voluntarily. Separately, CISA’s proposed final CIRCIA rule remained under White House review as of November 11, leaving covered-entity definitions, reporting details, and an effective date unresolved. A planned **$100 million Cyber Technology Services competition** supporting CISA incident response and threat hunting is expected to reach award in Q4 FY2027.

- Federal cybersecurity and incident-response contractors should assess whether their reporting workflows capture the form’s expanded incident classifications and MITRE ATT&CK-aligned activity details.
- Contractors supporting critical-infrastructure organizations can use the pending CIRCIA rule’s review status to frame customer planning, while treating any future reporting duties as unresolved until the rule is finalized.
- The planned Cyber Technology Services competition presents a potential opportunity for firms with incident-response and threat-hunting capabilities; the signals provide no solicitation or contract number.

**Jurisdictions:** federal
**Industries:** Information Technology
**Topics:** Cybersecurity, Regulatory Compliance
**Published:** November 11, 2026

### Government Entities
- Cybersecurity and Infrastructure Security Agency (CISA)
- Office of Information and Regulatory Affairs (OIRA)
- The White House

### Key Quotes
> As the national coordinator for critical infrastructure cybersecurity and resilience, CISA is able to leverage such incident reporting to identify emerging cyber campaigns, warn potential targets, and strengthen the Nation’s collective defense.
> — Chris Butera, Acting Executive Assistant Director for Cybersecurity

### Sources
- [CISA updates cyber incident reporting form with detailed data rules | brief | MSSP Alert](https://www.msspalert.com/brief/cisa-updates-cyber-incident-reporting-form-with-granular-data-requirements) - MSSP Alert
- [CISA Announces Enhanced Reporting Form for Cyber Incidents | CISA](https://www.cisa.gov/news-events/news/cisa-announces-enhanced-reporting-form-cyber-incidents) - CISA
- [Cybersecurity and Infrastructure Security Agency updates incident reporting portal | brief | SC Media](https://www.scworld.com/brief/cybersecurity-and-infrastructure-security-agency-updates-incident-reporting-portal) - SC Media