Does the Applicant participate in information sharing programs (ISAC, CISA, peer)?
This question is a maturity indicator rather than a control. A yes costs nothing and signals a programme that looks outward.
What the carrier is actually asking
The carrier is asking whether you participate in sector information sharing organisations, government advisory programmes, or peer groups that exchange threat information.
Why it is underwritten
Organisations that receive sector-specific threat information act on relevant advisories faster. It also indicates a security function with capacity to look beyond its own environment, which correlates with programme maturity generally.
Where the answer lives in Microsoft 365, Entra ID, and Azure
Membership and subscriptions are attested, and most of the useful options are free.
| Platform | Where the setting lives | What has to be true |
|---|---|---|
| Membership | Sector information sharing organisation membership | Active membership with someone receiving and acting on the feed. Attested |
| Government | National cyber agency advisory subscriptions and alert services | Subscribed, since these are free and carry the highest-priority advisories |
| Vendor | Advisory subscriptions for the products you run | Direct advisories for your edge devices and critical software, which is the most actionable feed |
| Process | What happens when an advisory arrives | A route from advisory to action, since receiving is not the control |
| Peer groups | Local or industry peer forums | Informal channels, which carry practical information faster than formal ones |
National cyber agency alert services and most sector sharing organisations cost nothing. If you answer no to this question, it is one of the cheapest answers on the entire form to change before your next renewal.
What a defensible yes requires
- Membership or subscription exists with a named recipient.
- Vendor advisories for critical products are subscribed to directly.
- A defined route exists from advisory to assessment to action.
- Someone reads the feeds, which is the part that makes membership meaningful.
- Advisory-driven action has actually happened, which is the evidence.
How this answer goes wrong
Membership exists and the feed goes to a mailbox nobody reads, so the advisory about the product in your perimeter arrived and was not seen. Receiving intelligence you do not act on is indistinguishable from not receiving it.
Frequently asked
Which programme should we join?
The sector organisation for your industry, plus your national cyber agency alert service. Both are usually free and take minutes to arrange.
Does this affect pricing?
Minimally on its own. It contributes to the maturity picture and costs almost nothing to answer yes.
What if our sector has no organisation?
National agency advisories and vendor feeds still apply, and a peer group is a reasonable substitute. Answer with what you actually have.
Is a paid threat intelligence service the same?
Different, and complementary. This question is about community and sector sharing rather than commercial feeds.
Related questions
Stop answering this from memory
Connect Microsoft 365, Entra ID, and Azure read-only. Insurance Posture reads the live configuration behind each application answer and shows you which ones you can prove before you sign.
Assess your posture