The Information Sharing and Analysis Organization Standards Organization (ISAO SO) today announced a request for comment period for a new document titled ISAO 700-1: Introduction to Analysis. Members of the public have until midnight on May 3, 2018 to provide comments on this draft publication released by the ISAO SO on April 3, 2018. To provide comments, click here.
The purpose of analysis is to produce intelligence that decreases uncertainty in decision-making and therefore reduces risk. This document provides an introduction to the information analysis process and how an Information Sharing and Analysis Organization (ISAO) can use it to identify, define, and mitigate cybersecurity threats. It is the authors’ intent to provide organizations a general understanding of the tools and processes needed for an analysis team to create cybersecurity information and intelligence within their ISAOs.
This document establishes a conceptual framework for an analytical process including establishing information and intelligence requirements; and collecting, processing, analyzing and exploiting relevant data to generate products that provide ISAO members cybersecurity situational awareness. The objective of sharing cybersecurity analysis is to provide ISAOs actionable information, re-duce uncertainty and thereby reduce risk to enable decision makers. As a technical overview, this document is meant to foster discussion on both a managerial and operational level.
The ISAO SO has published seven voluntary guideline documents since September 2016 on isao.org, with several other documents currently in development to be published this year. These publications were developed with the support of industry experts across all sectors in response to Presidential Executive Order 13691 to provide guidelines for effective information sharing an analysis related to cybersecurity risks, incidents, and best practices.
