Key Performance Indicators in Information Sharing and Analysis Centers (ISAC)

The Information Sharing and Analysis Center (ISAC) were established to gather, analyze and share of received alerts from SOC’s or other threat gathering tools. What is shared in the ISAC is the result of knowledge derived from the analysis of incoming alerts. This knowledge helps other subscribers of the information-sharing ecosystem to improve their incident handling and network security status. These systems enhance the organization’s network security and reduce the response time to incidents. Today, they have become one of the most important foundations of security, playing a vital and important role in managing threats and updating strategies. To ensure the effective performance of ISAC centers, it is essential to evaluate various aspects of their methods for collecting, analyzing, and sharing information. In this context, key performance indicators (KPIs) serve as valuable metrics for assessing the performance of Information Sharing and Analysis Centers (ISACs) across various dimensions. This research identifies essential KPIs within three core modules: information collection, analysis and sharing. The study is grounded in established standards, relevant literature and expert interviews. It also takes into account the five dimensions of Global Cybersecurity Index (GCI) in ITU. This approach ensures that the all final 77 identified KPIs are both relevant and significant. Finally, the contribution of each of the modules and dimensions of GCI in the key performance indicators of ISAC centers will be determined. Ultimately, this study will connect the contribution of each ISAC architecture module and dimension of GCI to the KPIs. The results of this classification are significant for the management levels of ISAC centers, as they enable a proper evaluation of the performance of various modules, prioritize resource allocation and refine evaluation methods.