An information sharing and analysis center, or ISAC, is a sector group that shares alerts and analysis among its members. The electricity ISAC (E-ISAC) and WaterISAC are two examples. In January 2019 they launched a partnership because power and water depend on each other.
What each one does
From WaterISAC's announcement of the partnership:
- E-ISAC is part of NERC. It monitors and analyzes physical and cyber threats to the electricity industry and uses a secure portal to alert and advise members.
- WaterISAC helps water and wastewater utilities protect against and recover from physical and cyber threats through alerts, analysis and mitigation resources. At the time it had about 2,600 members across several hundred utilities and other organizations in the US, Canada, Australia and New Zealand.
That membership number is from 2019, so treat it as a snapshot.
Why they partnered
Power plants and water plants need each other. Water treatment needs electricity, and many power plants need water. The announced goals included sharing threat information and incident response, joint analysis, aligning information sharing processes and improving sharing among all ISACs. WaterISAC staff were to work at the E-ISAC in Washington, DC.
What an ISAC is good for
- Early warnings about campaigns that hit your sector first.
- Peers who have faced the same device or vendor.
- Context: is this alert noise, or is everyone seeing it?
An ISAC is not a replacement for your own monitoring. It tells you what to look for.
How to get value from membership
- Name one person to read the alerts and route them.
- Add the ISAC portal to your incident contact sheet.
- Share what you can, even small things. Sharing is the point.
- After an incident, ask whether the ISAC saw the same thing.
Finding yours
CISA's sector pages list sector coordinating councils and plans, which is a good starting point. Search for your sector's ISAC and check membership terms directly, since this post only covers the two examples.
Safeguard is not an ISAC. For software exposure, zero-day discovery and reachability analysis help decide which alerts matter to the code you run.
What to share and what to keep
Sharing does not mean publishing everything. Most groups use handling labels so members can say how widely a report may travel. Our post on the traffic light protocol explains one common scheme. Agree internally who may share, what may be shared and in what form before an incident, so a busy analyst does not have to decide alone.
Quick check
Is an ISAC a government agency?
The E-ISAC is part of NERC and WaterISAC is a member organization. They are sector groups, not federal agencies.
Why did E-ISAC and WaterISAC partner?
Because of interdependence: water plants need power and some power plants need water.
Sources
Last reviewed: 19 October 2026.
