CISA Revises Incident Reporting Form While CIRCIA Final Rule Sits Pending at White House

CISA updated its voluntary cyber incident reporting form on November 9 to collect more granular data on malware, hacking techniques, and social engineering, and incorporated the MITRE ATT&CK framework to help analysts link incidents across organizations. The mandatory CIRCIA final rule, which would require critical infrastructure operators to report significant incidents within 72 hours, reached White House review on October 1 and remains pending after missing an October 2025 statutory deadline.

If CIRCIA continues to slip past its own revised targets, Congress will face pressure to revisit the 2022 statute's enforcement mechanism — or attach a deadline rider to the next DHS appropriations bill.

The form update is useful operational housekeeping, but CISA's ability to warn potential targets ahead of a campaign, the stated purpose of the whole framework, scales with mandatory coverage, not voluntary participation. Sectors that have not opted into voluntary reporting remain invisible to CISA's pattern-matching regardless of how well the ATT&CK taxonomy is integrated.

WHY IT MATTERS

Critical infrastructure operators — utilities, pipelines, financial institutions — face two overlapping reporting regimes: a voluntary form that just got more demanding, and a mandatory rule that has been in White House review for six weeks with no finalization date.

CISA missed the October 2025 statutory deadline and later targeted September 2026, a date it has now also passed, which means the 72-hour mandatory reporting clock has not started for any sector. Until CIRCIA clears White House review, CISA's visibility into coordinated campaigns depends entirely on voluntary submissions through the updated portal.

WHAT THIS DOESN’T TELL US

Has the White House Office of Information and Regulatory Affairs set an internal deadline for completing CIRCIA review, or is the rule effectively stalled pending a policy decision on scope or cost?

Fault Lines

Strategic intelligence, synthesized daily — with a public track record. Every call graded against what actually happened.

Front page → Get the weekly brief →