CISA has rewritten its cyber incident reporting form to demand detail on attacker behavior, not just the fact of an intrusion.
The expanded form went live on November 9, 2026. It pushes reporting entities past the basic disclosure and into MITRE ATT&CK language, asking whether malware was involved, whether social engineering or an insider was the vector, and which hacking techniques were used.
The stated purpose is pattern recognition. CISA argues that incident reports let it correlate campaigns across sectors, and a form that cannot distinguish a phishing-led intrusion from a zero-day exploitation tells it very little.
What this means for hospital incident response
Reporting is currently mandatory only for federal civilian agencies and certain Transportation Security Administration or Coast Guard regulated entities. That changes when the CIRCIA final rule takes effect, extending duties to 16 critical infrastructure sectors, healthcare included, with a 72-hour incident clock and a 24-hour deadline for ransom payments.
The rule has cleared CISA and is now under White House review, with no release date announced.
The practical implication is that the technical narrative prepared for legal counsel may not satisfy the form. Hospitals should assume they will need ATT&CK-mapped detail: initial access vector, privilege escalation path, and whether exfiltration occurred before encryption.
Absent any mandate, CISA asks organizations to submit voluntarily. Acting Executive Assistant Director for Cybersecurity Chris Butera framed it as collective defense, saying one organization’s detection becomes another’s protection.
