---
title: "Does the Applicant participate in information sharing programs (ISAC, CISA, peer)?"
url: https://insuranceposture.com/questions/governance-and-workforce/applicant-participate-information-sharing-programs
category: "Governance and workforce"
canonical_key: q_gov_007
evidence_state: attested
updated: 2026-08-24
---

# Does the Applicant participate in information sharing programs (ISAC, CISA, peer)?

URL: https://insuranceposture.com/questions/governance-and-workforce/applicant-participate-information-sharing-programs
Section: Governance and workforce
Evidence state: Attested, not tenant-verifiable

This question is a maturity indicator rather than a control. A yes costs nothing and signals a programme that looks outward.

## What the carrier is actually asking

The carrier is asking whether you participate in sector information sharing organisations, government advisory programmes, or peer groups that exchange threat information.

## Why it is underwritten

Organisations that receive sector-specific threat information act on relevant advisories faster. It also indicates a security function with capacity to look beyond its own environment, which correlates with programme maturity generally.

## Where the answer lives in Microsoft 365, Entra ID, and Azure

Membership and subscriptions are attested, and most of the useful options are free.

| Platform | Where the setting lives | What has to be true |
| --- | --- | --- |
| Membership | Sector information sharing organisation membership | Active membership with someone receiving and acting on the feed. Attested |
| Government | National cyber agency advisory subscriptions and alert services | Subscribed, since these are free and carry the highest-priority advisories |
| Vendor | Advisory subscriptions for the products you run | Direct advisories for your edge devices and critical software, which is the most actionable feed |
| Process | What happens when an advisory arrives | A route from advisory to action, since receiving is not the control |
| Peer groups | Local or industry peer forums | Informal channels, which carry practical information faster than formal ones |

**Free and worth doing**

National cyber agency alert services and most sector sharing organisations cost nothing. If you answer no to this question, it is one of the cheapest answers on the entire form to change before your next renewal.

## What a defensible yes requires

- Membership or subscription exists with a named recipient.
- Vendor advisories for critical products are subscribed to directly.
- A defined route exists from advisory to assessment to action.
- Someone reads the feeds, which is the part that makes membership meaningful.
- Advisory-driven action has actually happened, which is the evidence.

## How this answer goes wrong

Membership exists and the feed goes to a mailbox nobody reads, so the advisory about the product in your perimeter arrived and was not seen. Receiving intelligence you do not act on is indistinguishable from not receiving it.

## If this answer turns out to be wrong

The attestation clause you sign lives in this block, and its wording decides whether your answers are treated as representations or as something stricter. Whether anything follows from an inaccuracy depends on materiality, on the policy wording, and on the law of the governing state: [whether an answer is a warranty or a representation](https://insuranceposture.com/glossary/warranty). The other consequence terms are collected in the [glossary](https://insuranceposture.com/glossary).

## Frequently asked

### Which programme should we join?

The sector organisation for your industry, plus your national cyber agency alert service. Both are usually free and take minutes to arrange.

### Does this affect pricing?

Minimally on its own. It contributes to the maturity picture and costs almost nothing to answer yes.

### What if our sector has no organisation?

National agency advisories and vendor feeds still apply, and a peer group is a reasonable substitute. Answer with what you actually have.

### Is a paid threat intelligence service the same?

Different, and complementary. This question is about community and sector sharing rather than commercial feeds.

## Related questions

- [What is the critical patching target (24h / 72h / 7d / >7d)?](https://insuranceposture.com/questions/endpoint-and-patching/critical-patching-target)
- [Which VPN provider/product does the Applicant use for remote connectivity?](https://insuranceposture.com/questions/network-and-logging/vpn-provider-product-applicant-remote-connectivity)
- [Does the Applicant have a Security Operations Center (SOC) monitored 24/7?](https://insuranceposture.com/questions/network-and-logging/applicant-security-operations-center-monitored-24-7)
- [How frequently is firewall configuration reviewed and firmware updated?](https://insuranceposture.com/questions/network-and-logging/frequently-firewall-configuration-reviewed-firmware-updated)

---

Insurance Posture by SecValley. https://insuranceposture.com
The question library is written in our own wording to reflect the control topics that recur across US cyber application and ransomware supplemental forms. No carrier form is republished.
SecValley is not a law firm, an insurance broker, an agent, or a carrier, and holds no producer licence. Nothing here is insurance advice, legal advice, or a coverage determination, and no attorney-client relationship arises from reading it. Statements about what a party to a cited case did, knew, or intended are allegations drawn from court filings and contemporaneous reporting, not findings of fact.
Your organization's authorized signer remains responsible for the accuracy of any application. Consult a licensed broker and qualified counsel before binding.