[13262]
March 14, 2001
TO: ACCOUNTING/TREASURERS COMMITTEE No. 8-01
OPERATIONS COMMITTEE No. 9-01
SEC RULES COMMITTEE No. 24-01
SMALL FUNDS COMMITTEE No. 2-01
RE: FINANCIAL SERVICES INFORMATION SHARING AND ANALYSIS CENTER
In 1997, the President’s Commission on Critical Infrastructure Protection (PCCIP) began
to shape public policy to protect electronic systems across the country. The result was
Presidential Decision Directive-63, Critical Infrastructure Protection which, among other things,
called for the formation of information sharing and analysis centers to be established by the
providers of critical infrastructures in the private sector. The Financial Services Information
Sharing and Analysis Center (“FS/ISAC” or “Center”) addresses this directive for the banking
and finance sector.
The FS/ISAC is a private, member based limited liability company1 that collects
knowledge gained by members as they address information security problems on a daily basis.
The FS/ISAC allows members to benefit from the most up-to-date information available on
vulnerabilities, incidents, threats, resolutions and solutions. The Center is a secure facility
housing the information repository while providing authenticated, voluntary, and anonymous
sharing of information associated with information threats. FS/ISAC utilizes web based
Internet technologies that allow authorized members to share data.
Membership in FS/ISAC is limited to the financial services sector which includes banks,
savings and loans, insurance companies, brokerages, mutual funds, certain utilities (i.e. DTCC)
and stock exchanges. Certain U.S. Government agencies (e.g. FBI) may also submit information
on known threats, however, only industry members of the Center may access the repository.
There is no minimum size requirement for membership (either assets or employees) but it is
only offered to U.S. based corporations. The current fee structure is tiered and ranges from
$13,000 to $125,000 per year. The upper levels of membership provide for a greater number of
authorized users to access or submit information to the Center. The Center has established strict
procedures for initial and on-going user identification as well as various techniques for secure
information transmission. All physical and information security measures are audited by an
independent entity
1 The Financial Services Information Sharing and Analysis Center is a Limited Liability Company that has a service
level agreement with Global Integrity.
2Since the establishment of the FS/ISAC some of the Institute’s members have joined the
Center. As such, the Institute would like to provide you with the necessary contact information
for FS/ISAC, should you decide to evaluate the Center’s services. To learn more about FS/ISAC
and the services it provides you may contact Bill Marlow at (703) 749-8679 or Byron Yancey at
(704) 541-0806. The Institute will continue to monitor developments with the FS/ISAC. Please
contact me at (202) 326-5869 or salmon@ici.org if you have any questions.
Peter Salmon
Director - Operations/Technology