CISA’s AI cyber collaboration playbook aims to spur information-sharing
The Cybersecurity and Infrastructure Security Agency is making one last push before the change in administration for increased information sharing between the public and private sectors, releasing an artificial intelligence-focused playbook Tuesday that aims to foster “a unified approach” to handling AI-related cyber threats.
The agency’s AI Cybersecurity Collaboration Playbook was developed with the FBI, the NSA’s Artificial Intelligence Security Center and a host of industry partners, including Anthropic, AWS, Google, IBM, Microsoft, NVIDIA, OpenAI, Palo Alto Networks, Scale AI and others.
The publication of the playbook, which was facilitated through the public-private Joint Cyber Defense Collaborative, comes less than a week before President-elect Donald Trump retakes the White House and as the Biden administration nears the release of a final cybersecurity executive order.
The overarching goal of the new playbook, CISA said, is to facilitate collaboration among federal agencies, industry, international partners and other stakeholders on AI-fueled risks to cybersecurity, while also bolstering the resilience of AI systems.
“The playbook also identifies actionable information sharing categories applicable to broader critical infrastructure stakeholders and other sharing mechanisms,” the agency said in a statement. “CISA encourages organizations to adopt the playbook’s guidance to enhance their own information-sharing practices, contributing to a unified approach to AI-related cybersecurity threats across critical infrastructure.”
Some of those “actionable” information-sharing items detailed in the playbook include instructions for reporting newly identified cybersecurity vulnerabilities in products and services and a checklist for “proactive” sharing regarding an incident or vulnerability.
JCDC partners are provided in the playbook with CISA’s methods for information collection via its central hub. For information submitted to that hub, CISA said it aggregates and validates the intel, analyzes and enriches the data, and then ultimately decides whether defensive action should be taken.
For AI security specialists specifically, CISA asks industry partners to flag opportunities for technical exchanges, identify priority issues for the AI community, promote after-the-fact analyses and knowledge-sharing, and join the JCDC.
CISA said several AI safety topics — such as risks to human life, health, property or the environment — are outside the purview of the playbook, as are issues tied to AI fairness and ethics. No policies or requirements are being instituted as part of the playbook’s rollout; the agency noted that “all actions” called out in the periodically updated document are voluntary.
In addition to the White House’s impending cybersecurity executive order, President Joe Biden has used the last few days of his time in office to release two other AI-centered documents: an EO intended to advance AI infrastructure in the United States, and a so-called AI diffusion rule via the Commerce Department that places export controls on AI models and chips.
