Information Sharing and Analysis Centers (ISACs) help critical infrastructure owners and operators protect their facilities, personnel and customers from cyber and physical security threats and other hazards. ISACs collect, analyze and disseminate actionable threat information to their members and provide members with tools to mitigate risks and enhance resiliency.

The concept of ISACs was introduced and promulgated pursuant to Presidential Decision Directive-63 (PDD-63), signed May 22, 1998, after which the federal government asked each critical infrastructure sector to establish sector-specific organizations to share information about threats and vulnerabilities. Some ISACs formed as early as 1999, and most have been in existence for at least ten years.

ISACs are trusted entities established by critical infrastructure owners and operators to foster information sharing and best practices about physical and cyber threats and mitigation. Typically non-profit organizations, ISACs reach deep into their sectors, communicating critical information far and wide and maintaining sector-wide situational awareness. ISACs are in the business to facilitate information, not sell it.

Most ISACs have 24/7 threat warning and incident reporting capabilities, and may also set the threat level for their sectors. And many ISACs have a track record of responding to and sharing actionable and relevant information more quickly than government partners.

ISACs have demonstrated success in providing operational services – such as risk mitigation, incident response, and information sharing – that protect critical infrastructures. Other ISAC services include annual meetings, technical exchanges, workshops, and webinars.

To maintain situational awareness across the various critical infrastructure sectors, ISACs collaborate and share threat and mitigation information with each other and other partners through the National Council of ISACs.

Health-ISAC is a trusted community of critical infrastructure owners and operators within the Health and Public Health sector (HPH). The community is primarily focused on sharing timely, actionable and relevant information with each other including intelligence on threats, incidents and vulnerabilities that can include data such as indicators of compromise, tactics, techniques and procedures (TTPs) of threat actors, advice and best practices, mitigation strategies and other valuable material. Sharing occurs both via machine to machine and human to human. Health-ISAC also fosters the building of relationships and networking through a number of educational events in order to facilitate trust. Working groups and committees focus on topics and activities of importance to the sector and produce white papers for public sharing. Offerings such as Shared Services provide enhanced services to leverage the extensive Health-ISAC community for the benefit of all.

Health-ISAC is constantly engaged with external partners such as government, law enforcement, the vendor community, other ISACs and HPH associations such as HIMSS, MDISS, EHNAC and CHIME to facilitate situational awareness and inform risk based decision making to protect the HPH and other critical infrastructure sectors.

The mission of Health-ISAC is to empower trusted relationships in the healthcare industry to prevent, detect and respond to cybersecurity and physical security events so that members can focus on improving health and saving lives.

Health-ISAC is recognized as the official ISAC for the nation’s healthcare and public health critical infrastructure by:

• The U.S. Department of Health and Human Services (HHS)
• The Health Sector Coordinating Council (SCC)
• The National Council of ISACs
• Intelligence Agencies (US Department of Homeland Security, NSA)
• Law Enforcement

Information Sharing and Analysis Centers (ISACs) were created in 1998 under Presidential Decision Directive-63 (PDD-63) to advance the security of critical infrastructure/Key Resources (CIKR) sectors – those sectors deemed vital to the well being of a nation – through the sharing of information within and among the sectors and with government. Information Sharing and Analysis Organizations (ISAOs), first defined in the Homeland Security Act of 2002 are entities or organizations, public or private, formal or informal, non-profit or for-profit that voluntarily form to share information with each other and are not necessarily tied to critical infrastructure sectors.

ISACs are the original ISAOs for the critical infrastructure sectors. However, ISACs play a much bigger role in critical infrastructure protection and resilience than just sharing information. ISACs are a vital operational component in the national partnership framework. ISACs work through the National Infrastructure Protection Plan (NIPP-13) and collaborate with sector specific agencies and coordinating councils to perform structured collaboration within an established role in incident response across the CIKR. They are recognized as the designated arms for dissemination of information, manage and set the threat levels, and have strong reach and subject matter expertise within their respective sectors. ISACs are all-hazards and look at both cyber and physical. They provide a sector perspective and allow for anonymization and aggregation of data.