The Cybersecurity Information Sharing Act of 2015: An Overview

On December 18, 2015, President Barack Obama signed into law the Cybersecurity Information Sharing Act of 2015 (CISA), which establishes a voluntary system for sharing cyber threat indicators¹ and defensive measures² for a cybersecurity purpose³ between federal entities⁴ and nonfederal entities.⁵ Examples of cyber threat indicators include web server logs showing that a particular IP address is testing a company's vulnerabilities on its website; techniques that permit unauthorized access to a control system; malware found on the company's network; domain names or IP addresses associated with botnet command and control servers; discovered vulnerabilities; and IP addresses sending malicious traffic in connection with a distributed denial of service attack. Examples of defensive measures include information about security devices that protects a company's network, such as the configuration of a firewall mechanism, and techniques to protect against phishing campaigns.