RS.CO-05
Does your organization voluntarily share cybersecurity incident information with external stakeholders to enhance broader cybersecurity situational awareness?
Explanation
Voluntary information sharing with external stakeholders (such as industry peers, ISACs/ISAOs, government agencies, or supply chain partners) helps create a collective defense posture against cyber threats. By sharing threat intelligence, incident details, and mitigation strategies, organizations contribute to and benefit from improved threat visibility across their ecosystem.
Evidence of fulfillment could include membership documentation in information sharing communities (like FS-ISAC or MS-ISAC), logs or records of information shared through platforms like MISP or STIX/TAXII implementations, formal information sharing agreements with partners, or documentation of participation in industry-specific threat intelligence sharing programs.
Context
- Function
- RS: RESPOND
- Category
- RS.CO: Incident Response Reporting and Communication
- Sub-Category
- Voluntary information sharing occurs with external stakeholders to achieve broader cybersecurity situational awareness
Related questions
- Do personnel understand their specific roles, responsibilities, and the order of operations during a security incident response?
- Does your organization have documented breach notification procedures that include a process for notifying affected customers in the event of a data breach?
- Does your organization have documented procedures for notifying business partners and customers of security incidents in accordance with contractual obligations?
- Does your organization have documented procedures for notifying law enforcement and regulatory bodies of security incidents that include specific notification criteria and required management approvals?
- Does your organization have documented processes for securely sharing information during incident response that align with established information sharing agreements?
- Does your organization voluntarily share information about observed threat actor tactics, techniques, and procedures (TTPs) with an Information Sharing and Analysis Center (ISAC) or similar industry group after removing sensitive data?
