The Cybersecurity and Infrastructure Security Agency (CISA) announced it had released an enhanced web-enabled questionnaire for reporting cyber incidents.
According to officials the new form captures critical data and information that will help the agency assess incidents, identify trends and prioritize response actions. Located on the agency’s Incident Reporting Portal, the form is more robust, officials said, which strengthens the effectiveness and efficiency of national cyber defense. The new form officials gave as an example will help CISA correlate related cyber threat activity to identify a larger trend from what would otherwise appear as independent incidents.
“In the team sport of cybersecurity, one organization’s detection is another’s protection,” Acting Executive Assistant Director for Cybersecurity Chris Butera said. “As the national coordinator for critical infrastructure cybersecurity and resilience, CISA is able to leverage such incident reporting to identify emerging cyber campaigns, warn potential targets, and strengthen the Nation’s collective defense.”
The new form is guided by community feedback to CISA over the years, and includes the agency’s efforts to improve data quality that enables it to rapidly respond through threat analysis. For example, questions about the type of incident are more comprehensive and ask about granular information, such as whether the incident involved malware, social engineering, hacking techniques, or an insider threat. Questions about observed activity also now incorporate MITRE ATT&CK Framework language about adversary behavior familiar to the cyber community.
CISA said it strongly encourages any organization that experiences a cyber incident to report it.