Cybersecurity Policy Report, CISA Advised on Ways to Grow Cyber Defense Collaborative, (Jun 5, 2024)
The Cybersecurity and Infrastructure Security Agency should offer more “clarity and transparency” regarding the requirements for government and private-sector participation in CISA’s Joint Cyber Defense Collaborative (JCDC), according to a report adopted today by CISA’s Cybersecurity Advisory Committee (CSAC).
CISA asked CSAC to develop “strategic recommendations to support the continued maturation, investment, and focus” of the JCDC, according to the report.
“Specifically, the Committee was tasked with providing recommendations on an optimal state for operational cyber defense collaboration, incorporating all aspects of JCDC’s mission. Specific focus areas include collaboration, planning, and product development,” it says.
“Over the past three years, JCDC has achieved significant milestones, but CISA knows that the collaboration model remains in an early stage. CSAC is asked to consider and provide recommendations on an optimal state for operational cyber defense collaboration, incorporating all aspects of JCDC’s mission, in the interest of informing continued maturation, investment, and focus,” the report adds.
“Clarity and transparency around membership requirements and joining process would help to deepen JCDC’s impact and value. JCDC should include elements of the federal agencies that engage in collaboration with the private sector to foster deeper coordination within the federal government,” it recommends.
“Further, there would be benefit in formalizing the structure and on-going participation requirements for physical collaboration spaces. By bringing together the right entities for in-person collaboration, JCDC can deepen trust amongst participants and streamline the bi-directional sharing of actionable intelligence that is key for operational response,” it advises.
The JCDC should “develop clear criteria for participation” in JCDC’s cyber threat information-sharing activities within 60 days, the report says. “If this is successful, JCDC’s purpose, what it does, and the criteria for membership will be clear to not only current participants in JCDC—but also to others interested in potentially becoming a member.”
The report also recommends that CISA and the JCDC develop a “smart rolodex” of public and private entities that would provide “a roster of the public and private sector members and their core competencies designed to make identifying potential partners simpler.”
“CISA should connect these partners both proactively and reactively to improve the nation’s collective defense capabilities. JCDC is uniquely positioned to deepen these key connections,” according to the report.
“If this is successful, JCDC will have a clear process for continuing to identify the appropriate partners for given situations and requests. Further, JCDC will have an enhanced ability to respond to active issues while proactively preparing for future issues,” it adds.
CISA created the JCDC in 2021 to deepen its operational collaboration with other government agencies and private-sector entities with expertise in cybersecurity and visibility into emerging cyber threats (CPR, Aug. 5, 2021). The group includes 321 organizations representing cyber defenders from 12 critical infrastructure sectors.
During today’s CSAC meeting at the United States Military Academy in West Point, New York, CISA Director Jen Easterly said she welcomed the report’s recommendations.
“The Joint Cyber Defense Collaborative is one of our most important initiatives,” Ms. Easterly said.
“The model is very different from the public-private partnership that we’ve been talking about for decades. We’re asking companies, some of whom are natural competitors, to come together to share information. We’re asking companies who are used to working with the government just through government affairs [divisions] or just through lawyers to bring their technical and operational folks to the table,” she noted.
“This is a very ambitious undertaking, and I really did want to make sure that we could figure out how to continue to do it in a way that would allow us to understand the threats and then materially drive down the risk to the nation,” she added. “I’m really grateful for these recommendations as we look to optimize things going forward.”
News: FederalLegislation DataSecurity