  In recent years the cybersecurity policy debate in Washington has been
dominated by calls for greater information sharing within the private sector,
and between the private sector and the federal government. The passage of the
Cybersecurity Information Sharing Act (CISA) (signed into law under the
Cybersecurity Act of 2015) underscored federal efforts to collect information
from the private sector, and assuaged some concerns regarding private sector
liability in sharing activities. However, the law lacked specificity on how
continued federal efforts would work with existing information sharing
networks, and failed to address other challenges associated with sharing
including trust building, privacy and propriety interests, reciprocation, and
quality control. This paper aims to bring granularity to implementations of
information sharing initiatives by creating a taxonomy of the governance and
policy models within each of these organizations. The research shows how this
diverse ecosystem of sharing models work together and separately, and the
impact governance and policy have on key components critical to sharing
infrastructure.
