CISA Expands Cyber Incident Reporting Details for Federal Agencies

On November 9, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) announced an enhanced web-based form for reporting cyber incidents. The updated form collects more detailed incident information to help CISA identify related threat activity and prioritize its response. The change is relevant to federal civilian agencies with incident-reporting responsibilities and to contractors that support their cybersecurity, incident-response, and reporting operations.

The announcement distinguishes between federal agency requirements and reporting by other organizations. Federal civilian agencies are required to report incidents, and their reporting processes must capture the information requested through CISA’s incident-reporting process. CISA did not establish a new reporting mandate for other organizations: submissions from those entities remain voluntary. That distinction matters for contractors advising clients on compliance, since an updated form does not, by itself, extend the federal reporting requirement to every organization.

For federal contractors, the practical procurement implication is operational readiness rather than a newly announced solicitation or contract award. Companies supporting federal cyber operations can review incident-response support workflows to determine whether teams can capture the form’s expanded incident classifications and answer its MITRE ATT&CK-aligned activity questions. Contractors may also need to consider how relevant incident details are gathered, documented, and conveyed to agency customers during response support. The source announcement does not specify new contract clauses, funding, or deadlines, so vendors should avoid treating the update as a standalone contractual requirement unless an agency or contract directs them to do so.

CISA’s stated purpose is to use incident submissions to improve shared awareness of threats. Chris Butera, Acting Executive Assistant Director for Cybersecurity, said: “As the national coordinator for critical infrastructure cybersecurity and resilience, CISA is able to leverage such incident reporting to identify emerging cyber campaigns, warn potential targets, and strengthen the Nation’s collective defense.” For contractors, this underscores the value of accurate and sufficiently detailed incident information: reporting support can contribute to agency response and to broader threat identification, while voluntary submissions may help CISA warn potential targets. The announcement presents the form as an information-collection and response-prioritization enhancement, not as a change to the reporting status of non-federal organizations.

• CISA announced the enhanced web-based cyber incident reporting form on November 9, 2026.
• The form collects more detailed incident information to help identify related threat activity and prioritize response.
• Federal civilian agencies must report incidents through applicable incident-reporting processes that capture the requested information.
• Reporting remains voluntary for other organizations; CISA announced no new mandate for them.
• The updated form includes expanded incident classifications and MITRE ATT&CK-aligned activity questions.
• Contractors supporting federal cybersecurity or incident-response operations can review workflows for their ability to assist agency customers with the expanded information.
• CISA says incident reporting can help identify emerging cyber campaigns, warn potential targets, and strengthen collective defense.
• The announcement specifies no new funding, contract award, solicitation, or deadline; contractors should confirm any additional obligations with agency customers and applicable contract terms.