Charta is on Google Play: practise on the go. Get the app
Charta

Account for and judge how different kinds of institutions currently share cybersecurity information with one another.

FRM® Part II · Operational Risk and Resilience · Cyber-resilience: Range of practices · FRM2.ORR.8.d

The idea

Information sharing lets institutions defend collectively, because a threat seen at one firm can be blocked at others before it spreads. In practice it happens through sector bodies such as information sharing and analysis centres, national computer emergency response teams, public-private channels with authorities, and bilateral exchanges between trusted peers. Content ranges from technical indicators, such as malicious addresses and file hashes, to strategic analysis of trends. Large institutions often run their own threat intelligence and contribute heavily. Smaller ones rely on sector bodies to gain intelligence they could not afford. Barriers include legal liability, confidentiality and data protection, reputational fear, competition concerns, cross-border differences and weak trust. Practice answers with anonymised or sanitised sharing, marking rules that limit redistribution, and legal clarity from authorities. Sharing works only with reciprocity. Pair each barrier with its practical mitigation.

A practice question

From the question bank, with the reason each wrong option is wrong.

What is the main purpose of institutions sharing threat indicators with one another?

  1. To transfer legal liability for an incident to the institutions that receive the informationWhy not: Sharing does not move liability; recipients do not assume responsibility for another firm's incident.
  2. To replace each institution's own monitoring and detection capabilityWhy not: Shared intelligence complements local monitoring and cannot substitute for it.
  3. To allow institutions to coordinate the prices they charge customersWhy not: Competition-sensitive coordination is outside cyber sharing and is something sharing arrangements are careful to avoid.
  4. To let others detect and block the same threat earlier - correct

Threat information seen by one firm can protect others before an attack spreads. It supplements, not replaces, each firm's controls and does not shift liability.

A harder one

A small community bank cannot afford its own threat-intelligence team. Which approach best fits current practice for such an institution?

  1. Join a sector sharing centre or use national response team services to receive actionable intelligence and alerts at modest cost - correct
  2. Rely on internal logs alone, since external intelligence matters only for systemically important banksWhy not: Attackers target firms of all sizes, so intelligence relevance does not depend on being systemically important.
  3. Commission a one-off penetration test as a substitute for ongoing intelligenceWhy not: A single test gives a snapshot and cannot replace continuing awareness of new threats.
  4. Wait until a supervisor shares all incident data and take no action before thenWhy not: Supervisors do not provide a complete, timely feed, and waiting leaves the bank exposed.

Sector bodies and national response teams let smaller firms benefit from intelligence pooled across the community. Their own logs and one-off tests cannot cover the same ground.

The hardest tier

A bank's legal team objects to sharing incident details with peers because customer data may be exposed. Which resolution best matches common practice?

  1. Share complete forensic images, including customer records, so peers have the maximum informationWhy not: Exposes customer data and breaches confidentiality and data protection, which is precisely the legal concern.
  2. Share nothing, because any exchange of incident information is prohibitedWhy not: Sharing without personal data is feasible and normal; a blanket refusal ignores the collective benefit.
  3. Share only after the supervisor has closed its investigation, which usually takes yearsWhy not: Delay removes the main value, since indicators help only while a campaign is active.
  4. Share sanitised indicators without customer data, under agreed redistribution limits - correct

Stripping out client information and limiting how recipients may pass material on keeps the legal risk low while preserving value. Full forensic data or no sharing are both poor trade-offs.

In the app: 6 practice questions on this outcome, spaced review that brings it back before you forget it.

Start free →

More in Cyber-resilience: Range of practices