Multi-State Information Sharing and Analysis Center

Multi-State Information Sharing and Analysis Center
Name	Multi-State Information Sharing and Analysis Center
Formation	2003
Type	Nonprofit organization
Headquarters	United States
Fields	Cybersecurity, Critical Infrastructure Protection

Multi-State Information Sharing and Analysis Center

The Multi-State Information Sharing and Analysis Center operates as a member-driven nonprofit organization focused on cybersecurity, critical infrastructure protection, and information sharing across multiple state government entities, regional emergency management agencies, and sector partners. It provides situational awareness, threat intelligence, and coordinated incident response support to state-level stakeholders and regularly interfaces with federal entities such as the Department of Homeland Security, Federal Bureau of Investigation, and Cybersecurity and Infrastructure Security Agency. The center emerged amid policy shifts after the September 11 attacks, aligning with initiatives like the Homeland Security Act of 2002 and collaborative models exemplified by the Financial Services Information Sharing and Analysis Center and National Cybersecurity and Communications Integration Center.

Overview

The organization functions as a focal point for exchanging cyber threat intelligence and best practices among state Chief Information Security Officers, state adjutants general, and officials from the National Governors Association, National Association of State Chief Information Officers, and National Association of State Election Directors. Its evolution parallels developments in information sharing after events including the 2003 Northeast blackout, the Target data breach, and high-profile compromises affecting state election infrastructure recognized during the 2016 United States elections. The center’s activities intersect with standards and frameworks from entities like the National Institute of Standards and Technology, the International Organization for Standardization, and the Center for Internet Security.

Mission and Functions

The stated mission emphasizes enhancing the resilience of state-level networks and critical infrastructure sectors through proactive threat intelligence dissemination, coordinated incident response, and workforce development initiatives involving organizations such as the Multi-State Information Sharing and Analysis Center affiliates, state fusion centers, and regional Fusion Centers. Core functions include producing advisories aligned with Indicators of Compromise, conducting tabletop exercises modeled after those promoted by the Federal Emergency Management Agency and offering technical assistance similar to programs run by the United States Secret Service and the National Guard Cyber Protection Teams.

Organizational Structure and Governance

Governance comprises an executive board populated by state chief information security leaders, representatives from the National Governors Association, and advisory members from federal partners including the Department of Homeland Security, Cybersecurity and Infrastructure Security Agency, and the Federal Bureau of Investigation. Operational units mirror structures found in organizations like the Mitre Corporation, the SANS Institute, and the Center for Internet Security, supporting analytic teams, incident response teams, and training divisions. Funding sources include state dues, grants from entities such as the Department of Homeland Security, cooperative agreements with the National Institute of Standards and Technology, and contributions from private-sector partners including information technology vendors and consultants.

Membership and Participation

Membership is primarily drawn from state chief information officers, state chief information security officers, secretaries of state, state election directors, and emergency managers, with participation by municipal IT leaders and representatives from associations like the National Association of Counties and the United States Conference of Mayors. Private-sector membership and liaison roles include partnerships with companies and associations such as the Information Technology Industry Council, Internet Association, and sector-specific ISACs including the Electricity Information Sharing and Analysis Center and the Financial Services Information Sharing and Analysis Center. Collaborative participation also involves academic centers like Carnegie Mellon University’s CERT Division, Georgia Institute of Technology research labs, and cybersecurity programs at Massachusetts Institute of Technology.

Programs and Services

Programs include threat intelligence feeds comparable to services from the National Cybersecurity Center, regular situational awareness reports resembling products by the FBI Cyber Division, and training exercises influenced by the Homeland Security Exercise and Evaluation Program. Service offerings encompass incident coordination during compromises similar to the Colonial Pipeline cyberattack, election security assistance during cycles involving the 2016 United States elections and 2020 United States elections, and guidance on adopting frameworks like the NIST Cybersecurity Framework and controls from the Center for Internet Security Critical Security Controls.

Partnerships and Collaboration

The center maintains formal and informal collaborations with federal partners such as the Department of Homeland Security, the Cybersecurity and Infrastructure Security Agency, and the Federal Bureau of Investigation, and coordinates with sector ISACs including the Information Sharing and Analysis Organization model used by the Financial Services Information Sharing and Analysis Center and the Health Information Sharing and Analysis Center. It engages academic partners like University of Maryland, Stanford University, and University of California, Berkeley for research, and interoperates with associations including the National Governors Association, National Association of State Chief Information Officers, and National Conference of State Legislatures for policy and training.

Criticism and Controversies

Critiques of the center mirror debates around other ISACs and include concerns raised by civil liberties groups such as the American Civil Liberties Union and watchdog organizations about information-sharing practices, data privacy implications under statutes like the Privacy Act of 1974, and oversight similar to controversies involving Fusion Centers after the 9/11 Commission Report. Other controversies echo disputes over public-private partnerships involving vendors, procurement scrutiny resembling matters reviewed by the Government Accountability Office, and debates over federal-state roles akin to discussions around the Homeland Security Act of 2002 and the balance of authorities between state executives and federal agencies.

Category:Cybersecurity organizations