NEWS BRIEF

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has released a new playbook providing detailed guidance for AI developers, providers, and adopters on how to voluntarily share cybersecurity information with federal agencies, private industry partners, and international stakeholders.

JCDC AI Cybersecurity Collaboration Playbook

The "JCDC AI Cybersecurity Collaboration Playbook" encourages sharing information about cybersecurity incidents and vulnerabilities linked to AI systems. The playbook outlines specific protections and mechanisms for information exchange, such as the use of Traffic Light Protocol (TLP), which ensures controlled dissemination of sensitive information. Organizations should use the playbook to define their incident response activities, strengthen information sharing processes, and fortify defenses, CISA said. Participation is voluntary and there are no regulatory requirements for taking part.

Key Categories of Information Encouraged for Sharing

CISA has identified the following key categories of information encouraged for sharing:

• Observed malicious activity targeting AI systems: This includes information about observed malicious activity targeting AI systems, such as malware, phishing attacks, and other types of cyber threats.
• Suspicious behavior and threat assessments: This includes information about suspicious behavior and threat assessments related to AI systems, such as unusual network activity or system crashes.
• Incident reporting and vulnerability disclosures: This includes information about incident reporting and vulnerability disclosures related to AI systems, such as security breaches or vulnerabilities in AI systems.

Playbook Development and Updates

The playbook was developed based on the results of two tabletop exercises in 2024 involving over 150 participants. CISA plans to periodically update the playbook with new recommendations.

Benefits of Participating in the Playbook

By participating in the playbook, organizations can enhance their own information-sharing practices, contributing to a unified approach to AI-related cybersecurity threats across critical infrastructure.