Policy & enforcement · Briefing
CISA updates incident reporting form with more detailed questions and ATT&CK terminology
The reporting change gives response teams a reason to review how they turn incident evidence into an approved submission. The two supplied reports carry the same agency announcement, so performance claims remain unverified.
Kinwilder research desk · · AI-assisted analysis
What is established
On November 9, 2026, CISA announced an updated cyber incident reporting questionnaire on its Incident Reporting Portal. For defenders, the immediate task is to review whether their reporting process can produce useful, supportable answers. CISA’s release describes more detailed incident categories and MITRE ATT&CK terminology for observed behavior. The agency says these changes should help connect related incidents.
Dark Reading published the announcement on November 9, 2026, identifying it as a press release. It repeats the agency’s account rather than providing independent verification.
CISA’s announcement says federal civilian agencies must report and encourages other organizations to report voluntarily. That statement should not substitute for an organization’s assessment of its applicable obligations.
Who is behind it
CISA is the announcing agency. Neither supplied report attributes an intrusion to an actor, affiliate, malware family or state. Operator and victim geography are not established. The announcement concerns reporting infrastructure, not an attributed attack.
Our analysis
Analysis: The practical opportunity is better evidence handling. A detailed questionnaire can prompt useful questions, but additional fields cannot make an uncertain observation reliable. Teams should preserve the distinction between what a sensor recorded, what an analyst inferred and what remains unknown.
No attack path or failed trust boundary is established here. The relevant boundary for preparedness is the transfer of internal incident information into an external report. The authorization invariant is straightforward: a designated person should submit approved information to the intended recipient, with uncertainty and provenance preserved.
From an attacker’s perspective, confusing evidence could delay recognition of related activity. From a defender’s perspective, consistent descriptions could make comparison easier. Those are analytical possibilities, not findings about an attack on this form. A shared vocabulary helps only when the underlying observations support the labels.
Teams whose incident facts are scattered across tickets, messages and individual recollections should examine their readiness. Watch for whether the revised process produces actionable feedback and whether reporters can distinguish missing evidence from a negative finding.
Possible AI applications, as analysis: Defenders could use an approved assistant to suggest behavior labels or flag contradictions for analyst review. Attackers could use AI to make deceptive narratives more convincing. Neither report establishes AI use. Generated classifications should retain links to evidence and require review before submission.
Defensive actions
The following are Kinwilder’s recommended practices, not additional CISA requirements:
-
Check reporting readiness now. Identify the incident lead, submission authority and backup. Review applicable reporting duties separately from the announcement. Define who approves disclosure and how urgent submissions proceed when some facts remain unresolved.
-
Prepare a traceable evidence summary. For each observation, retain its timestamp, time zone, originating system and confidence level. Keep analyst interpretations separate. Before submission, check for unnecessary personal information, credentials or unrelated sensitive material.
-
Review the evidence behind behavior labels. Use relevant identity, endpoint, email, application and network logs to support the incident description. Ask whether each proposed behavior is observed directly or inferred. These are general investigation recommendations; the packet provides no incident-specific indicators to hunt.
-
Run a practical verification exercise. Take a synthetic incident and have one responder prepare a report while another traces every material assertion to its evidence. Check that an authorized reviewer can approve the intended disclosure, that unsupported conclusions remain marked uncertain and that corrections have an owner. Measure where the process stalls.
-
Improve the handoff. Preserve the submitted version, approval record and subsequent amendments. Feed gaps discovered during the exercise into logging, retention and responder training priorities.
Key concepts
- Incident report: A structured account of an event, including known facts and unresolved questions.
- MITRE ATT&CK: A framework for describing adversary behavior. A behavior label alone does not identify an attacker.
- Provenance: The record of where information came from and how someone reached a conclusion.
- Authorization boundary: The point where permission determines who may disclose information, to whom and for what purpose.
Limits
The two publications share one underlying agency account. The supplied material does not establish improved response outcomes, describe a particular compromise or provide the complete questionnaire for assessment. CISA’s expected benefits remain agency claims. No patch or exploitation status follows from this announcement. Kinwilder did not reproduce or test the form’s behavior.
Kinwilder briefing: AI-written analysis of public reporting, checked in a separate AI review against the linked sources. No human expert review or independent reproduction is implied.