CISA and JCDC publish the AI Cybersecurity Collaboration Playbook

The JCDC AI Cybersecurity Collaboration Playbook is a voluntary information-sharing guide that the Cybersecurity and Infrastructure Security Agency published through its Joint Cyber Defense Collaborative. CISA released the playbook and an accompanying fact sheet on January 14, 2025.

What it is

The playbook provides guidance to organizations across the AI community, including AI providers, developers, and adopters, for sharing AI-related cybersecurity information voluntarily with CISA and other partners through JCDC.

It was developed alongside federal, international, and private-sector partners through JCDC and was shaped by the insights of approximately 150 AI specialists from government, industry, and international partners who took part in two tabletop exercises.

The document is explicitly voluntary and does not create policies, impose requirements, or override existing legal or regulatory obligations.

CISA describes it as a living document that will undergo periodic updates.

What it requires

The playbook guides JCDC partners on how to voluntarily share information related to cybersecurity incidents and vulnerabilities associated with AI systems and delineates information-sharing protections and mechanisms.

It also outlines the actions CISA may take after receiving shared information, such as identifying and notifying victim organizations and distributing relevant threat intelligence products.

Separately, coverage notes that shared information may qualify for legal protections under the Cybersecurity Information Sharing Act of 2015, including protection of proprietary information and exemption from disclosure under the Freedom of Information Act.

AI safety topics such as risks to human life, health, property, or the environment, along with AI fairness and ethics, are stated as outside the intended scope of the playbook.

What security leaders should do

Security leaders can use the playbook's categories of shareable information to structure internal processes for reporting AI incidents and vulnerabilities to CISA. Since participation is voluntary, teams should weigh the stated legal protections for shared information against their own incident-response and disclosure policies before integrating the playbook's practices. Because CISA frames the document as a living resource subject to periodic updates, security leaders should monitor for revisions and align any internal AI incident playbooks with future versions.