Promoting Private Sector Cybersecurity Information Sharing

Impact dates

1. Date TBD

   Open competitive process to select ISAO Standards Organization

2. Date TBD

   Standards development with open public review and comment process

Key directives

• DHS Secretary shall strongly encourage development and formation of ISAOs
• DHS shall enter into agreement with nongovernmental ISAO Standards Organization through open and competitive process
• ISAO Standards Organization shall identify common voluntary standards for ISAO creation and functioning
• Standards must address contractual agreements, business processes, operating procedures, technical means, and privacy protections including minimization
• NCCIC shall engage in continuous collaborative coordination with ISAOs
• NCCIC delegated authority to enter into voluntary agreements with ISAOs
• Secretary shall determine eligibility of ISAOs for security clearances
• Agencies shall coordinate activities with senior privacy and civil liberties officials
• Senior privacy officials shall conduct assessments and provide to DHS Chief Privacy Officer and Office for Civil Rights and Civil Liberties
• EO 12829 amended to add Intelligence Reform and Terrorism Prevention Act of 2004 references
• DHS Secretary given authority to prescribe National Industrial Security Program Manual portion for classified information shared under critical infrastructure protection program
• DHS Secretary may determine eligibility for access to Classified National Security Information under designated critical infrastructure protection program

Who is ordered

• Secretary of Homeland Security · Department of Homeland Security
• DHS Chief Privacy Officer · Department of Homeland Security
• DHS Office for Civil Rights and Civil Liberties · Department of Homeland Security
• Secretary of Defense · Department of Defense
• Secretary of Energy · Department of Energy
• Director of National Intelligence · ODNI
• Director of the Central Intelligence Agency · CIA
• Director of the Information Security Oversight Office · National Archives and Records Administration
• National Security Advisor · Executive Office of the President
• Nuclear Regulatory Commission · NRC
• Attorney General · Department of Justice
• Director of the Office of Management and Budget · Office of Management and Budget
• Director of the National Institute of Standards and Technology · Department of Commerce
• senior agency officials for privacy and civil liberties · agencies

Timeline

Risks & tensions

• No explicit calendar deadlines or day-counts in text; timeline for SO selection and standards development is vague
• Voluntary nature of ISAO participation may limit adoption and effectiveness
• Privacy protections described as 'based upon' Fair Information Practice Principles but not mandated as binding requirements
• Multiple agency coordination required (DHS, DOD, DOJ, DNI, DOE, NRC) creates potential for jurisdictional friction
• Classified information sharing with private sector raises security clearance backlogs and insider threat concerns
• EO explicitly disclaims creating enforceable rights, limiting accountability mechanisms