(TLP:CLEAR) CISA Updates Cyber Incident Reporting Form to Improve Incident Analysis and Response

Summary: On Monday, CISA announced an updated cyber incident reporting form, an enhanced web-based questionnaire available through its Incident Reporting Portal. CISA states that the form reflects feedback from incident response partners and is designed to collect more consistent, detailed data so the agency can assess incidents faster, prioritize response actions, and connect related activity that might otherwise look like isolated events.

The new form asks more granular questions about incident type, including whether an incident involved malware, social engineering, hacking techniques, or an insider threat. Questions about observed activity now use the MITRE ATT&CK framework, and duplicative questions have been removed. The portal is CISA’s preferred reporting method, although the agency will continue to accept reports by email at Co*****@******hs.gov. Federal civilian agencies and certain entities regulated by the Transportation Security Administration or the U.S. Coast Guard are required to report to CISA, and the agency strongly encourages all other organizations to report voluntarily.

Analyst Note: CISA’s announcement does not list water and wastewater utilities among the entities required to report. But with the possibility such a requirement through the Cyber Incident Reporting for Critical Infrastructure Act of 2022 (CIRCIA), the practical takeaway for members is preparation. The time to learn a reporting form is before an incident, not during one. WaterISAC encourages members to review the updated form and CISA’s FAQ now, and to add the Incident Reporting Portal link to their incident response plans. Because the form uses MITRE ATT&CK terminology, utilities with limited security staff may find it helpful to decide in advance who would complete a report and what information they would need to gather.

Voluntary reporting benefits the whole sector. Reports from individual utilities help CISA identify campaigns targeting water systems and warn other potential victims. WaterISAC also encourages members to share incidents and suspicious activity with WaterISAC, so the information can inform sector-specific analysis and alerts.

Original Source: https://www.cisa.gov/news-events/news/cisa-announces-enhanced-reporting-form-cyber-incidents

Additional Reading:

• CISA: Cyber Incident Reporting Form: Frequently Asked Questions
• CISA: Incident Reporting Portal
• CISA: Eviction Strategies Tool
• WaterISAC: Confidential Incident Reporting Form

Related WateriSAC PIRs: 12