The Cybersecurity and Infrastructure Security Agency has launched a revamped cyber incident reporting form designed to capture more detailed information regarding security breaches, as first reported by Infosecurity Magazine.
The updated web-based questionnaire, announced November 9, incorporates granular questions about specific incident types, including malware, social engineering, and insider threats. A key feature of the revision is the integration of the MITRE Adversarial Tactics, Techniques and Common Knowledge framework, which allows organizations to describe adversary behavior using standardized terminology familiar to the cybersecurity community. The agency stated that this improved data quality will enable it to correlate related threat activity into broader trends, facilitating faster and more thorough threat analysis.
While currently mandatory only for federal civilian agencies, the Cybersecurity and Infrastructure Security Agency encourages voluntary reporting from other sectors, offering protections under the Protected Critical Infrastructure Information Program. This development occurs as the industry awaits the final rule for the Cyber Incident Reporting for Critical Infrastructure Act, which remains under review at the White House.
Once implemented, that act will mandate that critical infrastructure entities report qualifying incidents within 72 hours and ransom payments within 24 hours. The agency aims to leverage these reports to identify emerging campaigns and strengthen national collective defense efforts.
Source: Infosecurity Magazine
