Legal implications of information sharing

The sharing of information can help the operators of critical infrastructures increase security and identify threats and attacks more effectively. Shared information helps governments to gain an overview of risks at a national level and evaluate potential threat scenarios. Such insights are therefore necessary for developing and adjusting strategies, policies, legislation, and the allocation of resources (ENISA, 2016a, p. 33). Information can be shared between entities. For instance, critical infrastructure (CI) operators can share information with each other or indeed with national competent authorities [computer emergency response teams/computer security incident response teams (CERTs/CSIRTs), law enforcement, etc.]. Such information can also be exchanged between similar authorities in other Member States, with the EU Commission, and with international organizations such as Interpol.