2015-03714
## Metadata
- Author: [[govinfo.gov]]
- Full Title: 2015-03714
- Category: #articles
- Document Note: ---
tags:
- #cybersecurity
- #informationSharing
- #policy
- #executiveOrder
- #ISAO
- #privacy
- #civilLiberties
- #criticalInfrastructure
- #DHS
- #NCCIC
Author: President Barack Obama
Source: Federal Register (The President)
Reference: https://www.govinfo.gov/content/pkg/FR-2015-02-20/pdf/2015-03714.pdf
date created: {{date:YYYY-MM-DD}} {{time:HH:mm}}
---
# Title: Executive Order 13691 — Promoting Private Sector Cybersecurity Information Sharing (2015-03714)
## Table of Contents:
- [📝 Summary](#-summary)
- [📖 Main Content](#-main-content)
- [🗒️ Notes](#-notes)
- [📖 References](#-references-1)
- [🗣️ Paraphrase](#-paraphrase)
- [📰 Newsletter](#-newsletter)
- [✅ Action Items](#-action-items)
- [🧪 Hypotheses](#-hypotheses)
- [📊 Methodology](#-methodology)
- [❓ Questions](#-questions)
- [🔮 Future Research](#-future-research)
- [💡 Implications](#-implications)
- [🧠 Learning Styles Assessment](#-learning-styles-assessment)
- [📊 Accessibility Assessment](#-accessibility-assessment)
- [🌍 DEIB (Diversity, Equity, Inclusion, and Belonging) Assessment](#-deib-diversity-equity-inclusion-and-belonging-assessment)
- [✅ Logical validity](#-logical-validity)
- [🔍 DARVO Analysis](#-darvo-analysis)
- [🔍 SEO Evaluation](#-seo-evaluation)
- [🎯 Conclusion](#-conclusion)
### References:
- Federal Register publication of EO 13691: https://www.govinfo.gov/content/pkg/FR-2015-02-20/pdf/2015-03714.pdf
- Related: Executive Order 13636 (Improving Critical Infrastructure Cybersecurity)
- Related: PPD-21 (Critical Infrastructure Security and Resilience)
## 📝 Summary:
Executive Order 13691 (Feb 13, 2015; published Feb 20, 2015) promotes voluntary, privacy-conscious sharing of cybersecurity risk and incident information between the private sector and the Federal Government. It encourages the formation of Information Sharing and Analysis Organizations (ISAOs); designates DHS’s National Cybersecurity and Communications Integration Center (NCCIC) to coordinate with ISAOs; calls for a nongovernmental ISAO Standards Organization to create voluntary standards; extends critical infrastructure protection programs to support secure classified information sharing; and mandates explicit privacy and civil liberties protections aligned with the Fair Information Practice Principles. It also amends the National Industrial Security Program framework to facilitate appropriate classified sharing related to critical infrastructure.
Key sections:
- Policy and purpose [Sec. 1] (see PDF pages ~1–2)
- ISAOs and DHS coordination [Sec. 2] (pages ~2–3)
- ISAO Standards Organization and voluntary standards [Sec. 3] (pages ~3–4)
- Critical infrastructure protection program designation [Sec. 4] (pages ~4–5)
- Privacy and civil liberties protections [Sec. 5] (page ~5)
- Amendments to Executive Order 12829 (National Industrial Security Program) [Sec. 6] (pages ~5–7)
- Definitions [Sec. 7] (page ~7)
- General provisions and limitations [Sec. 8] (page ~7)
Direct links:
- Policy (Sec. 1): https://www.govinfo.gov/content/pkg/FR-2015-02-20/pdf/2015-03714.pdf#page=2
- ISAOs (Sec. 2): https://www.govinfo.gov/content/pkg/FR-2015-02-20/pdf/2015-03714.pdf#page=2
- ISAO Standards Org (Sec. 3): https://www.govinfo.gov/content/pkg/FR-2015-02-20/pdf/2015-03714.pdf#page=3
- Critical Infrastructure Program (Sec. 4): https://www.govinfo.gov/content/pkg/FR-2015-02-20/pdf/2015-03714.pdf#page=4
- Privacy and Civil Liberties (Sec. 5): https://www.govinfo.gov/content/pkg/FR-2015-02-20/pdf/2015-03714.pdf#page=5
- National Industrial Security Program amendments (Sec. 6): https://www.govinfo.gov/content/pkg/FR-2015-02-20/pdf/2015-03714.pdf#page=5
- Definitions (Sec. 7): https://www.govinfo.gov/content/pkg/FR-2015-02-20/pdf/2015-03714.pdf#page=7
- General Provisions (Sec. 8): https://www.govinfo.gov/content/pkg/FR-2015-02-20/pdf/2015-03714.pdf#page=7
## 📖 Main Content:
EO 13691 addresses a core challenge in U.S. cybersecurity: enabling rapid, trusted sharing of threat indicators, vulnerabilities, and incidents among diverse stakeholders while protecting privacy, civil liberties, and business confidentiality.
- It fosters voluntary ISAOs, which can be sectoral, regional, or affinity-based, and may be for-profit or nonprofit. DHS’s NCCIC is tasked to coordinate “continuous, collaborative, and inclusive” information sharing with ISAOs.
- A nongovernmental ISAO Standards Organization will develop open, voluntary standards for ISAO capabilities (governance, technical means, automation, privacy protections).
- DHS can enter voluntary agreements under a designated critical infrastructure protection program to facilitate secure sharing, including classified information when needed, with clear authorities for eligibility and clearances.
- Agencies must integrate privacy and civil liberties protections based on the Fair Information Practice Principles and provide assessments to DHS privacy leadership.
- Amendments to the National Industrial Security Program clarify roles for DHS, DoD, DOE, NRC, and the DNI in issuing manuals and overseeing classified information in critical infrastructure contexts.
- The order is explicitly non-regulatory and non-justiciable; it preserves existing authorities and does not create new rights.
“Such information sharing must be conducted in a manner that protects the privacy and civil liberties of individuals, that preserves business confidentiality, [and] safeguards the information being shared.”
### 🗒️ Notes
- Purpose and Policy (Sec. 1) [link]
- Encourage real-time, voluntary cyber risk/incident sharing to improve national cybersecurity.
- Build on EO 13636 and PPD-21; ensure privacy, civil liberties, and business confidentiality protections.
- Interagency coordination through National Security Council system (PPD-1).
- ISAOs (Sec. 2) [link]
- Voluntary organizations for cyber info sharing; flexible formation (sector, region, threat-focused).
- Membership can be public, private, or mixed; for-profit or nonprofit.
- NCCIC mandated to coordinate continuously with ISAOs to share risks, incidents, and strengthen security.
- DHS to consult sector-specific agencies, independent regulators, law enforcement, and national security.
- ISAO Standards Organization (Sec. 3) [link]
- DHS selects a nongovernmental SO via open competition.
- SO develops voluntary standards/guidelines for ISAO creation and functioning.
- Scope: contracts, business processes, operating procedures, technical means, automation, privacy minimization.
- Open public review process; draw input from critical infrastructure owners/operators and stakeholders.
- Align with voluntary international standards and meet NTTAA and OMB A-119 requirements.
- Critical Infrastructure Protection Program (Sec. 4) [link]
- NCCIC designated as a critical infrastructure protection program (per CI Information Act).
- DHS may enter voluntary agreements with ISAOs to promote security.
- Security clearances for ISAOs and members per EO 13549 and EO 12829; DHS determines eligibility.
- Privacy and Civil Liberties (Sec. 5) [link]
- Agencies must coordinate with senior privacy/civil liberties officials.
- Protections grounded in Fair Information Practice Principles.
- Assessments provided to DHS Chief Privacy Officer and Office for Civil Rights & Civil Liberties.
- National Industrial Security Program Amendments (Sec. 6) [link]
- Update authorities and references (EO 13526, Intelligence Reform Act, etc.).
- Define roles for DHS in manuals and classified sharing within critical infrastructure programs.
- DNI retains authority over intelligence sources and methods; inspection/monitoring provisions set.
- Definitions (Sec. 7) [link]
- Key terms: critical infrastructure information, critical infrastructure protection program, cybersecurity risk, incident, ISAO, sector-specific agency, FIPPs.
- General Provisions (Sec. 8) [link]
- Preserves existing agency authorities; non-regulatory intent; subject to appropriations.
- Protects intelligence/law enforcement sources and methods.
- No private right or benefit created.
## 📖 References:
- Executive Order 13691 (Federal Register): https://www.govinfo.go
- Summary: The content below is missing, please provide the content so I can summarize it for you.
- URL: https://www.govinfo.gov/content/pkg/FR-2015-02-20/pdf/2015-03714.pdf
Full text of this document omitted because this document is a PDF
[Download original file →](https://readwise.io/reader/document_raw_content/77858736), 2015-03714, govinfo.gov, 01h76nx3h3hn2nvmm54tss77ga.