CISA's new incident form asks for more detail on hacks, and a coming rule could force some firms in 16 key sectors to report attacks within 72 hours.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) released an expanded form on November 9, 2026 for reporting cyber incidents. It asks for much more detail about what happened, including whether malware, trickery or an insider was involved.
The new form adds a questionnaire. It asks if the attack used malware (harmful software), social engineering (tricking people into giving access), or an insider threat, plus the hacking techniques used, if known. CISA says the detail will help it analyze threats faster, connect related attacks and decide where to respond first.
Today, only federal civilian agencies and certain entities regulated by the Transportation Security Administration or the U.S. Coast Guard must report. CISA asks every organization to use the form voluntarily. As acting official Chris Butera put it, "one organization's detection is another's protection."
A final rule under a law called CIRCIA would extend mandatory reporting to certain organizations in 16 critical infrastructure sectors. They would report substantial incidents within 72 hours and ransom payments within 24 hours. The rule was proposed in April 2024 and was expected in October 2025, but it has been delayed. It is reportedly being reviewed by the White House.
No release date has been given. The material does not say which organizations will be covered or what counts as a substantial incident.
If your business may fall under the 16 key sectors, decide now who would report an attack and how, since the 72-hour clock would be short.
Alibaba's chip design unit T-Head has filed for a Hong Kong IPO, a step that matters for anyone who relies on cloud and AI services.
Read more: Alibaba's chip design arm T-Head files to go public in Hong KongUS officials say attackers are using a flaw in Cisco BroadWorks, software behind many business phone services, and a patch has been out since August.
Read more: Hackers are exploiting a flaw in Cisco's business phone softwareAutomattic's Spacefast hosts what ChatGPT, Claude and Cursor build, free or $5 a month, but one tester flagged a setup link that needs guarding.
Read more: Automattic Opens Spacefast, a Place for AI Apps to Go Live
