11/13/2026
📢We’ve updated our cyber incident reporting form! The new form improves our ability to compare and identify related cyber threat activity and shared risk that may not be visible from a single incident.
As the nation’s cyber defense agency, we rely on timely, accurate and detailed cyber incident information from our entire reporting community to triage and analyze incidents, coordinate response activities and enable more effective responses.
Notable changes to the form:
👉“Incident Type” replaces “Activity Type” and now includes malware, social engineering, hacking techniques and insider threats.
👉 “Tactics, Techniques and Procedures” based on MITRE ATT&CK Framework 13 replaces “Observed Activity” and now includes reconnaissance, initial access, privilege escalation, credential access, lateral movement and exfiltration.
Reporting remains mandatory for federal agencies, but we strongly encourage any organization or entity experiencing a cyber incident to voluntarily report. The information you share deepens our understanding of the cyber threat environment and can make a real difference for our nation’s cyber defenders.
See the new form and learn more about reporting a cyber incident in the comments below.
