Survey respondents look to CII to provide guidelines and act as a conduit for aggregation and sharing of CFSI information in order to avoid legal concerns. (The aggregation and sharing could be managed by an organization other than CII, but it necessitates meeting provisions to assure no legal issues.)
Both the main and the follow up surveys showed that:
- Survey respondents viewed the risk associated with CFSI as important, but did not agree on the next steps needed to mitigate this risk.
- Survey respondents were reluctant to share CFSI data in a common database, but expressed interest in CFSI guidelines provided by CII.
This suggests that it may be important for CII to offer specific ways to share useful information, while avoiding associated legal concerns related to data-sharing. In line with this, the team identified existing data exchange initiatives (e.g., EPRI, iNEMI, GIDEP, and ERAI) that may serve as a model for such an effort.
Ultimately, the research concluded that any data-aggregation and -sharing effort must be managed in such a manner that it balances the need for privacy against the need for useful data.