The document discusses improving information sharing between government agencies and private industry facilities regarding cybersecurity threats and compliance. It notes there are over 12,800 private facilities and 30+ government agencies involved but information often flows sporadically without coordination between the Industrial Security Representatives and Cybersecurity and Infrastructure Security Agency. The process also lacks understanding of what specific assets need protection at each facility and the potential consequences of losing those assets.

1. DoD Policy
(Threat Driven)
NISPOM
(Compliance Driven)
Sporadic
information
flow is
based
on ISR/CISA
relationship
Industry
frequently gets
contacted without
ISR knowledge 12,800 facilities & 30+ government agencies
Policy &
Analytic
Products
Threat
Products
Compliance
Byproducts
IP typically
integrates with IO
but will
occasionally work
directly with
industry
Unused IP Products
Some CI products
go unused
Unused IO Products
AS IS Process lacks
understanding on what
Assets must be
protected, and lacks
understanding on
Consequence of Loss of
assets.
CI
IO
IP