In the US, CISA's guide lists reporting to CISA, your local FBI field office, the FBI's IC3, or your local US Secret Service field office. In the UK, the NCSC points organisations to gov.uk/report-cyber. Reporting is also a mitigating factor in OFAC's view if a payment is considered.
United States
CISA's guide says to report to CISA, a local FBI field office, the FBI's Internet Crime Complaint Center (IC3), or a local US Secret Service field office, and to consider requesting their assistance. You can also report to CISA at cisa.gov/report, report@cisa.gov or 1-844-Say-CISA, according to CISA's CIRCIA page.
United Kingdom
The NCSC page says UK organisations can report incidents at gov.uk/report-cyber. It also recommends that all UK organisations use an NCSC-assured Cyber Incident Response provider when handling incidents.
Why report
- Possible decryptors. CISA says to consult federal law enforcement about them.
- Sanctions position. OFAC treats a self-initiated, complete report made as soon as possible after discovery as a significant mitigating factor, and also weighs full cooperation.
- Shared defence. CISA suggests sharing lessons and indicators with CISA or your sector ISAC after recovery.
Is reporting mandatory?
Sometimes, depending on who you are. This is not a single rule.
- CIRCIA. The 2022 US law will require covered entities to report covered incidents within 72 hours and ransom payments within 24 hours once a final rule takes effect. CISA's page says the rule is still being worked on, gives no date, and says organisations are not required to submit reports until the effective date. It encourages voluntary reporting meanwhile.
- Securities rules. Public companies have separate disclosure duties, covered in another post.
- Sector and contract rules. Health, finance and customer contracts may add duties. Check yours.
Build the contact sheet now
Put these in your incident response plan, on paper:
- Internal incident lead and deputy.
- Legal counsel and cyber insurer hotline.
- Incident response provider.
- Law enforcement reporting links for your country.
- Regulator contacts for your sector.
What to have ready when you report
A report is quicker if you have the basics to hand: the time you first noticed the problem, affected systems, the ransom note text, any contact details or wallet addresses it names, and what you have already done. Keep it factual and note what you do not yet know. OFAC describes a complete report made as soon as possible as helpful, so speed matters, but accuracy matters more than guessing.
Quick check
Do we have to report to CISA today?
CIRCIA reporting is not yet required, according to CISA's page, which encourages voluntary reports. Other laws or contracts may still require notice.
Does reporting mean we lose control of the response?
Nothing in the sources says so. CISA's wording is to consider requesting their assistance, so you decide how much help to ask for.
Sources
Last reviewed: 19 October 2026.
