Our Mission:
To improve the nation’s cybersecurity posture by identifying standards and guidelines for robust and effective information sharing and analysis related to cybersecurity risks, incidents and best practices.
Our Vision:
A more secure and resilient nation that is connected, informed and empowered.
What is the ISAO Standards Organization (ISAO SO)?
In October 2015, the U.S. Department of Homeland Security selected a team led by the UTSA Center for Infrastructure Assurance and Security as its Information Sharing and Analysis Organization Standards Organization (ISAO SO) to facilitate the implementation of Presidential Executive Order 13691. The ISAO SO is a non-governmental organization.
What does the ISAO Standards Organization do?
We work with existing information sharing organizations, owners and operators of critical infrastructure, relevant agencies, and other public- and private-sector stakeholders through a voluntary consensus standards development process to identify a common set of voluntary standards for the creation and functioning of ISAOs. These standards address, but are not be limited to, contractual agreements, business processes, operating procedures, technical specifications and privacy protections.
We are building best practices and lessons learned from existing Information Sharing and Analysis Centers and other information sharing organizations. We are developing a voluntary consensus standards development process that leverages industry, government, and academic expertise through working groups. We are also advising organizations on the creation and operation of ISAOs. In addition, the Standards Organization will collect and publish metrics reflecting the effectiveness of cybersecurity information sharing.
Why are ISAOs needed?
The establishment of ISAOs allows communities of interest to share cyber threat information with each other on a voluntary basis. ISAOs may also, if they choose, participate in existing federal cybersecurity information sharing programs, providing access to near-real-time cyber threat indicators. The goal is to create deeper and broader networks of information sharing nationally that foster the development and adoption of automated mechanisms for the sharing of information to elevate the security of the nation.