Protecting Consumer Privacy in Cybersecurity Information Sharing

The work of the ISAO SO is dependent on the vast knowledge and experience of the volunteers who make up the Working Groups. Each group is tasked to develop specific standards and guidelines for the creation and functioning of ISAOs. Active working group member, Megan Stifel, is an attorney and the founder of Silicon Harbor Consultants, a firm that provides strategic cybersecurity operations and policy counsel. She was an integral part of the development of ISAO SP-4000: Protecting Consumer Privacy in Cybersecurity Information Sharing.

The ISAO SO recently published a new document titled, ISAO SP-4000: Protecting Consumer Privacy in Cybersecurity Information Sharing, available for download on the ISAO.org website. The document supplements the high-level guidance set forth in Section 9 “Information Privacy” of ISAO 300-1: Introduction to Information Sharing, published in September 2016 to further assist entities as they assess the potential privacy implications of cybersecurity information sharing. It builds upon the previously published basic principles by outlining actions to promote efficient and effective information sharing while minimizing the impact on privacy interests. Importantly, this document reflects the contributions of industry, civil society, and the government.

The primary audience for this document is risk managers and those involved within an entity on a cross-disciplinary basis in making decisions about how to approach privacy when sharing cybersecurity information. Nevertheless, this document is maturity agnostic, and reflects actions an organization should consider regardless of its information sharing capabilities.

The practices identified in the document are consistent with the Cybersecurity Information Sharing Act of 2015 (CISA) and draw upon Guidance to Assist Non-Federal Entities to Share Cyber Threat Indicators and Defensive Measures with Federal Entities from the Departments of Homeland Security and Justice; the identified practices make additional suggestions to advance privacy and facilitate robust information sharing.

ISAO SO Special Publications are documents authored by the ISAO SO working groups using an open and transparent consensus-driven development process. These documents are designed to be shorter than the ISAO SO General Publications while addressing specific topics to meet the needs of information sharing organizations.

Megan Stifel

About author

Megan Stifel is an attorney and the founder of Silicon Harbor Consultants, a firm that provides strategic cybersecurity operations and policy counsel. She currently serves as Director for Cybersecurity Policy at Public Knowledge and is also a Nonresident Senior Fellow in the Atlantic Council’s Cyber Statecraft Initiative. She previously served as a Director for International Cyber Policy at the National Security Council (NSC), where she was responsible for expanding the Obama Administration’s cybersecurity policy abroad, including in connection with internet governance, bilateral and multilateral engagement, and capacity building. Prior to the NSC, Ms. Stifel served in the U.S. Department of Justice (DOJ) as Director for Cyber Policy in the National Security Division and as counsel in the Criminal Division’s Computer Crime and Intellectual Property Section. Prior to law school, Ms. Stifel worked for the U.S. House of Representatives Permanent Select Committee on Intelligence. She received a juris doctorate from the Maurer School of Law at Indiana University, and her B.A. in international studies and German, magna cum laude, from the University of Notre Dame. She is a Partner in Social Venture Partners Charleston.