Why the OIG Did This Audit
The Cybersecurity Information Sharing Act of 2015 requires the Department of Homeland Security to establish a capability and process for Federal entities to receive cyber threat information from non-Federal entities. Section 107 of the Act requires Inspectors General from the Intelligence Community and select agencies to submit a joint report to Congress every 2 years on actions to share cyber threat information.
The OIG conducted this review to determine the extent of DHS’ progress to meet the Act’s cybersecurity information-sharing requirements for calendar years 2023 and 2024.
What the OIG Found
The Cybersecurity and Infrastructure Security Agency (CISA) met requirements of the Cybersecurity Information Sharing Act of 2015. However, CISA has not finalized its plans for the continued use of Automated Indicator Sharing (AIS). Without finalizing this plan, CISA could be hindered in how it shares information on cyber threats, which would reduce its ability to protect the Nation’s critical infrastructure from cyber threats.
Since the OIG’s 2024 review, CISA made progress to meet the requirements of the Act by maintaining its guidance for information sharing, properly classifying cyber threat indicators and defensive measures, and accounting for security clearances of private-sector individuals.
Although AIS resulted in increased sharing of cyber threat indicators from approximately 1 million in 2023 to more than 10 million in 2024, this increase was primarily from one private-sector participant’s contributions, which accounted for 89 percent of the public collection and 83 percent of the Federal collection. This unevenness in reporting indicates potential overreliance on one partner. Moreover, CISA did not conduct adequate outreach to add AIS participants and reduce reliance on certain partners. The number of Federal and non-Federal AIS users decreased by 65 percent since peaking in 2020. To address this challenge, CISA continues to implement OIG’s previous recommendation to develop and implement a new strategy to recruit and retain AIS participants.
What the OIG Recommend
The OIG made one recommendation for CISA to determine whether to maintain AIS beyond September 30, 2025.
Read the full OIG report here.
