Originally published by American Banker
Ten years ago, Congress enacted the Cybersecurity Information Sharing Act to help fortify our collective cyber defenses by enabling and incentivizing cyber threat information sharing between the government and critical infrastructure companies, including banks. Because these protections were not renewed before they expired on Sept. 30, cyber defenders are missing a critical weapon from their arsenal. These front-line responders must now confront sophisticated cyber adversaries without a key resource to better understand the tactics and techniques used to attack critical infrastructure and the sensitive data maintained by those entities. We know from recent incidents like the Salt Typhoon campaign that nation-state actors are embedding themselves in our critical infrastructure to serve broader geopolitical aims.
The voluntary and confidential information-sharing framework that this law established removes legal barriers to safe threat communications and provides vital protections and privacy guardrails preventing the use of data for other purposes. For instance, it preserves attorney-client privilege, bars cyber threat information shared under the law from use in regulatory enforcement actions and exempts the same information from public disclosure under the Freedom of Information Act. Importantly, the law also facilitates company-to-company information sharing through its antitrust exemption, which has fostered the ability of firms to share sensitive information that is useful in preventing attacks.
The authorities codified by this law have become essential to the underlying fabric of public-private collaboration to combat emerging cyber and national security threats. The private sector and government have enjoyed previously unavailable lines of communication that increase the speed and capacity by which they can respond to significant cyber incidents. The demonstrated value of these structures led lawmakers to incorporate these statutory provisions by reference in other key cybersecurity laws, including the Cyber Incident Reporting for Critical Infrastructure Act.
