Browse Definitions :
Definition

Cybersecurity Information Sharing Act (CISA)

Cybersecurity Information Sharing Act (CISA) is proposed legislation that will allow United States government agencies and non-government entities to share information with each other as they investigate cyberattacks. Sharing is voluntary for participating organizations outside the government.

Currently, a number of U.S. regulatory frameworks impede sharing. For example, should a hospital in the United States came under attack, hospital administrators could be prevented from sharing information with government agencies because of privacy restrictions in the Health Insurance Portability and Accountability Act (HIPAA).

Under CISA, the Director of National Intelligence and the federal departments of Homeland Security, Defense and Justice are required to work together and develop procedures for sharing cybersecurity threat information. Non-federal entities will be required to remove personal information before sharing cyber-threat indicators, and the Department of Homeland Security (DHS) will be required to conduct a privacy review of received information.

Opponents of the legislation worry that the federal government will abuse how uses the information it gathers. As of this writing, the government may only use shared information to:

  • Identify a cybersecurity purpose.
  • Identify the source of a cybersecurity threat or security vulnerability.
  • Identify cybersecurity threats involving the use of an information system by a foreign adversary or terrorist.
  • Prevent or mitigate an imminent threat of death, serious bodily harm or serious economic harm, including a terrorist act or a use of a weapon of mass destruction.
  • Prevent or mitigate a serious threat to a minor, including sexual exploitation and threats to physical safety.
  • Prevent, investigate, disrupt or prosecute an offense arising out of a threat such as serious violent felonies or relating to fraud and identity theft.

This was last updated in February 2016

Continue Reading About Cybersecurity Information Sharing Act (CISA)

SearchCompliance
  • ISO 31000 Risk Management

    The ISO 31000 Risk Management framework is an international standard that provides businesses with guidelines and principles for ...

  • pure risk

    Pure risk refers to risks that are beyond human control and result in a loss or no loss with no possibility of financial gain.

  • risk reporting

    Risk reporting is a method of identifying risks tied to or potentially impacting an organization's business processes.

SearchSecurity
SearchHealthIT
SearchDisasterRecovery
  • What is risk mitigation?

    Risk mitigation is a strategy to prepare for and lessen the effects of threats faced by a business.

  • fault-tolerant

    Fault-tolerant technology is a capability of a computer system, electronic system or network to deliver uninterrupted service, ...

  • synchronous replication

    Synchronous replication is the process of copying data over a storage area network, local area network or wide area network so ...

SearchStorage
Close