For the first time, agencies were required to report only incidents that affected their operations, and to break those incidents down based on the attack vector used.