1 Governance and Policy

Governance and policy are used to drive the ISE toward coordinated and integrated resources and successfully implementing of the objectives of the National Strategy. Success depends upon all ISE partners participating in ISE governance processes and adopting or aligning policies that will ensure that we are working together in our implementation efforts, at all levels of government and in the private sector.

1.1 Governance

Governance facilitates sharing and safeguarding of information by providing structure for the development and implementation of policy. The two primary senior governance bodies for ISE Stakeholders are the Information Sharing and Access Interagency Policy Committee (ISA IPC) and the Senior Information Sharing and Safeguarding Steering Committee (Steering Committee). These forums facilitate governance for responsible information sharing and safeguarding for all ISE partners at the level of the Executive Office of the President, in accordance with Presidential Policy Directive (PPD) 1, Organization of the National Security Council System and Executive Order 13587.

1.1.1 Information Sharing and Access Interagency Policy Committee

The ISA IPC is co-chaired by the National Security Staff’s Senior Director for Information Sharing Policy and the Program Manager for the Information Sharing Environment. While membership of the ISA IPC is restricted by law to federal departments and agencies, the ISA IPC scope includes all levels of government. ISA IPC subcommittees and working groups include federal, state, local, tribal and territorial mission owners as well as private sector partners. To ensure the candid and timely discussion of information sharing challenges that require policy action, the ISA IPC and its subsidiary groups are exempt from the Federal Advisory Committee Act.

The ISA IPC is guiding the implementation of each of the National Strategy’s 16 priority objectives. Each priority objective is assigned a steward, or governance body responsible for directing, managing and monitoring implementation of the priority objective. The subcommittees of the ISA IPC are working to implement the objectives of the National Strategy, and in so doing develop goals that are approved and monitored by the ISA IPC. Representatives from ISE agencies, our ISE mission partners, chair these governance bodies and help to formulate implementation plans for their assigned objective(s). These plans are vetted with ISE stakeholders through the ISA IPC and include control milestones and performance measures that allow the ISA IPC to monitor National Strategy implementation. Subcommittees of the ISA IPC may formally charter working groups or create Tiger Teams to focus on narrower issues within a portfolio.

For more information on how to participate in National Strategy implementation, or for information on the current structure and activities of the ISA IPC, contact your agency’s representative or PM-ISE’s Management and Oversight Division at ISE.gov/contact.

1.1.2 Senior Information Sharing and Safeguarding Steering Committee

The President established the Steering Committee in Executive Order 13587 to exercise overall responsibility and ensure senior-level accountability for interagency development and implementation of policies and standards regarding the sharing and safeguarding of classified information on computer networks.

The Steering Committee is co-chaired by senior representatives from NSS and the OMB E-Gov office. Membership includes representatives from Departments of State, Defense, Justice, Energy, and Homeland Security, the Office of the Director of National Intelligence, the Central Intelligence Agency, and the Information Security Oversight Office within the National Archives and Records Administration.

The Classified Information Sharing and Safeguarding Office (CISSO), which is a component of the office of the PM-ISE, provide executive secretariat functions for the Steering Committee and collects data from agencies on the progress and performance of their safeguarding efforts. This data informs the Steering Committee’s Annual Report to the President, which provides the White House an account of information sharing and safeguarding successes and challenges.

The current priorities of the Steering Committee are outlined in Priority Objective 5 of the National Strategy: "Implement removable media policies, processes and controls; provide timely audit capabilities of assets, vulnerabilities and threats; establish programs, processes and techniques to deter, detect and disrupt insider threats; and share the management of risks, to enhance unclassified and classified information safeguarding efforts." If you would like more information, please contact the CISSO at ISE.gov/contact.

1.1.3 Convening/Liaison

Because the office of the PM-ISE is in a unique position to facilitate responsible information sharing across the whole of government, we play a neutral role when negotiating between mission interests of ISE stakeholders. The capability to convene stakeholders provides opportunities for constructive exchanges in a shared setting, as well as active listening among organizations with different missions, authorities, and resources. PM-ISE fills the role of honest broker to help non-federal players develop their requirements and inject them into national policy deliberations. When there are asymmetries between stakeholders, PM‑ISE’s ability to aggregate the concerns of less influential stakeholders is critical to the ultimate success of shared solutions. For example, PM-ISE’s facilitation of interactions between and among individual fusion centers and their federal partners has increased the collective voice of the network of fusion centers. Additionally, a key role for PM-ISE and governance bodies is to identify technologies, capabilities, and services that can be shared across the ISE with the intent to leverage individual agency initiatives for the greater good.

ISE Stakeholders and priorities are often discussed in the Federal CIO Council, the Committee on National Security Systems, the Domestic Security Alliance Council, and other interagency forums. The office of the PM-ISE often works on behalf of agencies to clarify governance relationships, share ideas and deconflict tasks across these forums. For information on how to appropriately interface with these bodies, contact the PM-ISE Management and Oversight Division at DNI-PM-ISE-EXECSEC@dni.gov.

1.1.4 Implementing Responsible Information Sharing and Safeguarding Governance in Your Organization

Effective and responsible information sharing and safeguarding requires strong commitment and participation from ISE partners. Developing effective internal governance structures, designating a senior information sharing and safeguarding executive in your organization, and developing information sharing goals aligned with the National Strategy are all practical measures to ensure that information sharing and risk management goals are fully integrated in your day-to-day operations.

Mature governance structures also adhere to a performance management cycle that is results-oriented, enforces accountability, and allows data-driven decisions on technology investments and other initiatives. Agencies should have a means to apply the goals and activities of the National Strategy to support their internal efforts and establish means to track and document the benefits of those activities. Effective agency governance structures also enable agencies to offer and reuse capabilities and services for sharing across the environment, consistent with an interoperable architecture approach.

To get started, make contact with the governance bodies that serve your community. See ISE Building Blocks or for more information please contact the PM-ISE Management and Oversight Division at ISE.gov/contact.

Benefits of Participation in ISE Governance Processes

Your involvement in ISE governance bodies provides opportunities to advise the NSS and the PM‑ISE and to coordinate with other departments and agencies as we develop and implement guidelines, policies, processes, practices, standards, and tools. Your involvement will help identify gaps in policies, technologies, programs and systems used by federal departments and agencies to share and safeguard information and will ensure that any initiatives developed to address these gaps include your equities. Through this involvement, the ISE’s annual planning process (described later in Figure 2) will be informed by your needs, challenges, and opportunities and you can share and reuse best practices from other ISE partners. As the ISE is implemented and expands to new missions and new categories of information, based on White House direction, your involvement will guide and support that growth, and ensure good stewardship of resources by sharing and reusing ISE solutions.

1.2 Policy

Policy provides direction on mission, budget, and strategic priorities. It serves to standardize processes and coordinate activities; to promote the use of innovative solutions and best practices; and to communicate guidance between leadership and operational components.

The ISE is built upon two levels of policy: ISE-wide policy frameworks and agency-specific policies developed to address ISE requirements.

1.2.1 ISE-wide Policy

ISE-wide policy frameworks are important because ISE initiatives regularly span some or all of our partner communities—from federal agencies, to state and local law enforcement, to private sector owners and operators of critical infrastructures—requiring partners to develop policies that comply with the broader requirements of ISE participation within their own authorities and missions.

The ISE Policy Lifecycle, as depicted in Figure 1, outlines the steps for developing, implementing, and evaluating policies, and lays out best practices for ISE partners to use for their agency-specific policy development and implementation.

Figure 1: The ISE Policy Lifecycle

Proposals to share data across entities often encounter a familiar refrain: “There’s a legal problem – we can’t share the information.” The ISE policy framework cannot address specific scenarios, but does provide an approach for addressing information sharing legal challenges, and more importantly a forum to discuss these challenges. The ISA IPC is working on best practices and tool kits for data aggregation and related information sharing agreements to define common approaches for these challenges. The conversation begins with the mission and authorities that already exist within departments and agencies at all levels of government. The ISE relies on the expertise and advice from counsel within each department or agency to ensure that ISE policy meets the letter and intent of legal requirements. Additional detail on this legal and policy approach for responsible information sharing can be found on ise.gov.

1.2.2 Implementing ISE Policy in Your Organization

The success of the ISE depends upon ISE Stakeholders implementing policies for responsible information sharing that support their missions and are compliant with ISE-wide frameworks. For example, general ISE guidance has been provided to agencies to integrate information sharing responsibilities into employee performance assessments Performance Evaluation Element in Employee Performance Appraisals (ISE-G-105) and to mandate the use of Core Awareness Training (ISE-G-104) across ISE mission partners. It is incumbent upon ISE Agency leadership to issue and implement internal policies that comply with this guidance.

Below is an example of how an ISE-wide policy requirement has been implemented by ISE mission partners through agency-specific policies.

Benefits of Participation in the ISE Policy Process

Participation in the ISE policy process enables mission partners across communities to uniformly understand and apply ISE requirements while retaining flexibility to address their own mission requirements and authorities. A uniform approach also contributes to trusted partnerships, where one agency can be confident sharing information with another, if they are confident in that agency’s adoption of ISE requirements. This facilitates more efficient sharing of information and awareness of protected information.

The following example illustrates the benefits of ISE-wide policy frameworks.

For more information on how to work with PM-ISE to develop your own responsible information sharing policies, or to discuss how to ensure your policies comply with broader ISE frameworks, please contact the PM-ISE Management and Oversight Division at ISE.gov/contact.

Go to the next section: 2 Budget and Performance