Frequently Asked Questions

Sector-specific ISACs are trusted entities established by critical infrastructure owners and operators to foster information sharing and best practices about physical and cyber threats. Typically, as global, private, non-profit organizations, ISACs work directly within their sectors, communicating critical information far and wide and maintaining sector-wide situational awareness. ISACs are trusted entities that collect, analyze and disseminate actionable threat information to their members and provide members with tools to mitigate risks and enhance resiliency. Besides sharing threat information with members, ISACs also share information with government and other critical infrastructure ISACs as applicable.

ISACs were created in response to Presidential Decision Directive-63 (PDD-63), signed in 1998, which called for each of the 16 critical infrastructure sectors to voluntarily establish sector-specific organizations to share information about cyber threats and vulnerabilities. After 9/11, the mission of ISACs was expanded to include the sharing of physical threats and vulnerabilities.

ISACs were created in 1998 in response to PDD-63 to advance the security of critical infrastructure/key resources (CIKR) sectors – those sectors deemed vital to the well- being of a nation – through the sharing of information within and among the sectors and with the government. Information Sharing and Analysis Organizations (ISAOs), formed in 2013 in response to Executive Order 13691, are information sharing organizations for any sector or community. ISAO’s do not need to be part of the 16 critical infrastructures like ISACs. Instead, ISAOs may be organized on the basis of sector, sub-sector, region, or any other affinity, including in response to particular emerging threats or vulnerabilities.

ISACs are the original ISAOs for the critical infrastructure sectors. However, ISACs play a much bigger role in critical infrastructure protection and resilience than just sharing information. ISACs are a vital operational component in the national partnership framework. ISACs work through the National Infrastructure Protection Plan (NIPP-13) and collaborate with sector-specific agencies and coordinating councils to perform structured collaboration within an established role in incident response across the CIKR. They are recognized as the designated arms for dissemination of information, manage and set the threat levels, and have strong reach and subject matter expertise within their respective sectors. ISACs are all-hazards and look at both cyber and physical threats. They provide a sector perspective and allow for anonymization and aggregation of data.

ISACs help critical infrastructure owners and operators protect their facilities, personnel and customers from cyber and physical security threats and other hazards. ISACs collect, analyze and disseminate actionable threat information to their members and provide members with tools to mitigate risks and enhance resiliency.

ISACs share information, collaborate and discuss threat, vulnerability and risk information about cyber and physical security risks through secure forums. ISACs also provide operational services – such as risk mitigation, incident response and information sharing – that protect critical infrastructures. Other ISAC services include annual meetings, technical exchanges, workshops, webinars, 24/7 threat warning, incident reporting capabilities, setting the threat level for their sectors, and sharing actionable and relevant information more quickly than government partners.

Being a member of an ISAC can extend the scope and capabilities of your organization’s security and risk management activities, help bolster threat and risk awareness and preparedness capabilities and connect you to organizations and insights that may not be readily available to individual organizations, particularly smaller organizations with limited staff. Our adversaries – extremists of all stripes, cyber criminals, nation states, and others – share their tactics, techniques and procedures to outsmart and out-maneuver us individually. Together, as we share information and cyber threat intelligence across the community, we decrease attackers’ chances of success.

Joining your sector’s ISAC is one of the best ways organizations can protect themselves and their employees against cyber and physical threats and vulnerabilities while taking an active stance in safeguarding our nation’s critical infrastructure. ISACs provide trusted sector-specific forums for active information sharing and collaborative analysis around cyber and physical threats, vulnerabilities, and incidents. ISACs bring together analysts from companies of all sizes to share information on how to identify and defend against active attacks. In this way, companies with more robust capabilities assist each other and those with less robust programs.

The ability to have a single point of outreach to each critical infrastructure community is an important tool for national cyber incident response. ISACs can quickly and effectively share information from the government to their members and can provide an important source of company-neutral analysis as to how a threat or incident affects their particular sector. ISACs may also provide members with tools to mitigate risks and enhance resiliency.

Members can share on a real-time basis and then take that information, intelligence and analysis and use it in their environments to prevent, protect against, mitigate, respond to, and recover from the cyber, physical, health, and natural threats and hazards that pose the greatest risk.

Information may be shared from ISACs with government partners and organizations but only with the submitting organization’s explicit approval, under the agreed to Traffic Light Protocol designation and with or without member attribution, as desired by the member.

ISACs work through the National Infrastructure Protection Plan (NIPP-13) and collaborate with sector-specific agencies and coordinating councils to perform structured collaboration within an established role in incident response across the critical infrastructure sectors.