What changes at intake
The Cybersecurity and Infrastructure Security Agency updated its incident reporting portal on November 9 with a questionnaire that asks organizations to describe the nature of an incident in greater detail. Responders can characterize activity such as social engineering or an insider threat. Questions about behavior incorporate MITRE ATT&CK terminology. CISA says it wants analysts to recognize connections among reports that would otherwise appear to concern separate events.
What two reports can tell an analyst
Consider two organizations that both describe a service disruption. The shared label says little about a possible connection. If responders also report the same unusual sequence of observed activity, an analyst has a narrower basis for comparing the cases. Even then, matching behavior is a lead. Attributing the two events to a common operator takes more evidence. The value of a common vocabulary depends in part on preserving the difference between what a responder saw and what the responder suspects.
Who is reporting
CISA encourages voluntary reports and identifies federal civilian agencies and certain entities regulated by the Transportation Security Administration or the Coast Guard as examples of organizations with existing reporting duties. For a transportation operator coordinating with outside responders, those are separate pieces of work. A contractor may hold the observations needed to describe an incident, while the operator holds the facts about its own regulatory status. The November 9 announcement describes changes to how incident details are collected. It announces no new deadline or industry-wide reporting mandate.
Sources & further reading
Our practical suggestions are editorial guidance. Verify applicability against current source and vendor instructions.
