Information Sharing and Analysis Centers (ISACs) are sector-specific sharing communities that were created specifically to address threats to the United States’ critical infrastructure. The first ISACs were created following the 1998 Presidential Directive on Critical Infrastructure Protection that envisioned an ISAC as a mechanism for collecting, analyzing, “appropriately sanitizing and disseminating private sector information” about vulnerabilities, threats, intrusions, and anomalies to both industry and the government.
While ISACs are specific to an industry or sector and focused on cybersecurity collaboration for protecting critical infrastructure, ISAOs can be created for all kinds of cyber threat information sharing, with membership drawn from any sector or interest group. The purpose and membership requirements of an ISAO are determined by the ISAO itself, and its style of functioning can be more flexible than that of an ISAC. Furthermore, many large enterprise conglomerates, industry, and interest groups are forming their own ISAOs to foster security collaboration through bidirectional threat intelligence sharing.