Executive Order 13691: Promoting Private Sector Cybersecurity Information Sharing
President: Barack Obama
Promoted private-sector information sharing through industry-led organizations and common voluntary standards.
Status: In effect. Is Executive Order 13691 still in effect? Yes. EO 13691 remains an operative information-sharing framework identified by CISA; later cybersecurity legislation and rules complement its voluntary-sharing model.
What does Executive Order 13691 do?
EO 13691 promoted voluntary networks for sharing cybersecurity threats and incidents in near real time. Obama sought participation by companies, nonprofits, government bodies and communities that might not fit neatly inside an existing industry-sector information-sharing center. Information Sharing and Analysis Organizations could form around a sector, region, emerging threat or another common interest, and could be for-profit or nonprofit. Signed order.
Homeland Security had to encourage those organizations, work with them through the National Cybersecurity and Communications Integration Center and select a nongovernmental standards organization through an open competitive process. The resulting standards were to cover operating capabilities, technical exchange, business arrangements and privacy safeguards, including minimization. The signed order also amended industrial-security arrangements so eligible private partners could securely receive classified information through a designated critical-infrastructure protection program; this did not mean all shared information became classified or all members automatically received clearances. Signed order.
Before and after
Before the order
EO 13636 and Presidential Policy Directive 21 already framed critical-infrastructure cybersecurity cooperation. Sector-based sharing organizations existed, but EO 13691 encouraged a wider variety of communities and an agreed baseline for voluntary organizations. It designated NCCIC as a critical-infrastructure protection program able to enter voluntary agreements, rather than ordering every business to join a government network. Signed order.
After the order
Organizations could develop common sharing procedures while DHS coordinated eligibility for any needed security clearance. Agencies had to integrate privacy and civil-liberties assessments into the existing EO 13636 reporting process. Congress's Cybersecurity Information Sharing Act of 2015 later supplied distinct statutory rules and protections; those should not be attributed to EO 13691 alone. Defense's February 24, 2021 industrial-security rule identified EO 13691 among the executive authorities governing its program, and current CISA information-sharing guidance continues to describe the order's assignments. Signed order. Sources: CISA current information-sharing description of EO 13691; Cybersecurity Information Sharing Act of 2015; National Industrial Security Program Operating Manual rule.
Who had to do what
| Agency / office | Action | Timing / position |
|---|---|---|
| Homeland Security Secretary / DHS | Encourage ISAOs, select nongovernmental standards organization competitively, support voluntary standards and determine needed clearance eligibility. | Continuing work; no fixed date in signed order. |
| NCCIC | Coordinate continuously with ISAOs and enter voluntary critical-infrastructure protection agreements. | Continuous coordination. |
| Nongovernmental ISAO Standards Organization | Develop common voluntary guidelines through open public review covering capabilities, operations and privacy. | According to agreement; no fixed executive-order deadline. |
| OMB | Consult with DHS on standards development and apply relevant circular requirements. | During standards development. |
| Commerce Department / NIST | Consult on voluntary standards and technical approaches. | During standards development. |
| Justice Department | Consult on standards development and relevant law-enforcement concerns. | During standards development. |
| NARA Information Security Oversight Office Director | Consult on standards and implement and monitor industrial-security program in consultation with National Security Adviser. | Continuing oversight. |
| Director of National Intelligence | Consult on standards; prescribe intelligence-source portions of industrial-security manual and exercise retained clearance oversight. | During manual maintenance and ongoing program operation. |
| Defense Secretary | Issue and maintain industrial-security manual with required concurrence and provide monitoring through permitted interagency arrangements. | Continuing manual maintenance; no fixed date. |
| Energy Secretary | Concur on manual and prescribe its Atomic Energy Act classified-information portion. | During manual issuance and maintenance. |
| Nuclear Regulatory Commission | Concur on manual and prescribe Atomic Energy Act portion with Energy. | During manual issuance and maintenance. |
| National Security Adviser | Consult with ISOO Director on industrial-security implementation and monitoring. | During program oversight. |
| Agency privacy and civil-liberties officials | Assess sharing activities and supply assessments to DHS privacy and civil-rights officials. | For EO 13636 privacy/civil-liberties reporting. |
| DHS Chief Privacy Officer and Office for Civil Rights and Civil Liberties | Consider agency assessments in combined privacy and civil-liberties report. | Within existing EO 13636 reporting process. |
| Other cybersecurity agencies and sector-specific agencies | Consult on formation and standards; participate in agreements within authority. | As activities develop; independent regulators participate at their discretion. |
What happened next
Obama signed the voluntary-sharing and industrial-security changes. Official source
Congress enacted the Cybersecurity Information Sharing Act as a separate statutory framework. Official source
Defense's National Industrial Security Program rule became effective, citing EO 13691 among its authorities. Official source
Legal and source detail
How it works legally
The signed text relies on the Homeland Security Act and Critical Infrastructure Information Act for the specific cooperation mechanisms. Its voluntary-standard development must respect the National Technology Transfer and Advancement Act and OMB Circular A-119. Section 8 expressly says the order gives agencies no additional authority to regulate critical-infrastructure security beyond existing law, and activities must protect intelligence and law-enforcement sources and methods. Business confidentiality, privacy and civil liberties remain constraints rather than optional policy aspirations. Sharing information under an agreement does not automatically confer immunity, override a disclosure statute or permit unrestricted transmission of classified material. Those questions require the applicable statute, agreement and classification rules. Completion of a standards-development project also does not revoke the order's industrial-security amendments or continuing coordination provisions. Signed order. Sources: CISA current information-sharing description of EO 13691; Cybersecurity Information Sharing Act of 2015; National Industrial Security Program Operating Manual rule.
Sources by type
If a source is unavailable, first check the cited publisher or another official repository. The cited publisher remains the authority.
Primary and official sources
Orders, laws, court records and official implementation material.
How we checked this
Last checked against the sources above on September 15, 2026. How we research →