Which not-for-profit entity is set up to share sector-specific threat intelligence and security best practices among its members?

Which not-for-profit entity is set up to share sector-specific threat intelligence and security best practices among its members?

• A. Security consortiums
• B. Bug bounty programs
• C. Certified risk managers
• D. Information Sharing and Analysis Centers (ISACs)

Answer: (D)

Sharing sector-specific threat intelligence and security practices among members is exactly what Information Sharing and Analysis Centers are built for. These nonprofit, member-driven organizations bring together entities within a defined sector to collect, analyze, and share information about threats, incidents, vulnerabilities, and defensive guidance. By pooling data, they help members detect patterns, coordinate responses, and implement consistent security measures across the sector, improving overall resilience. Examples include groups focused on financial services or healthcare, each serving its specific community with timely intel and best practices. The other options don’t fit this purpose: a security consortium is a broad collaborative group not specifically organized around ongoing sector-wide intel sharing; bug bounty programs focus on identifying vulnerabilities from external researchers rather than sharing operational threat intelligence among members; and certified risk managers refer to a credential or role rather than a not-for-profit entity that distributes threat information and defenses.

Sharing sector-specific threat intelligence and security practices among members is exactly what Information Sharing and Analysis Centers are built for. These nonprofit, member-driven organizations bring together entities within a defined sector to collect, analyze, and share information about threats, incidents, vulnerabilities, and defensive guidance. By pooling data, they help members detect patterns, coordinate responses, and implement consistent security measures across the sector, improving overall resilience. Examples include groups focused on financial services or healthcare, each serving its specific community with timely intel and best practices. The other options don’t fit this purpose: a security consortium is a broad collaborative group not specifically organized around ongoing sector-wide intel sharing; bug bounty programs focus on identifying vulnerabilities from external researchers rather than sharing operational threat intelligence among members; and certified risk managers refer to a credential or role rather than a not-for-profit entity that distributes threat information and defenses.