The U.S. Department of Commerce’s National Institute of Standards and Technology (NIST) today released its Preliminary Cybersecurity Framework to help critical infrastructure owners and operators reduce cybersecurity risks in industries such as power generation, transportation and telecommunications. In the coming days, NIST will open a 45-day public comment period on the Preliminary Framework and plans to release the official framework in February 2014, as called for in Executive Order 13636—Improving Critical Infrastructure Cybersecurity.
In February 2013, President Obama directed NIST to work with stakeholders to develop a voluntary framework for reducing cyber risks, recognizing that U.S. national and economic security depends on the reliable functioning of critical infrastructure. Through a request for information and a series of workshops held throughout 2013, NIST engaged with more than 3,000 individuals and organizations on standards, best practices and guidelines that can provide businesses, their suppliers, their customers and government agencies with a shared set of expected protections for critical information and IT infrastructure.
The Preliminary Framework outlines a set of steps that can be customized to various sectors and adapted by both large and small organizations while providing a consistent approach to cybersecurity. It offers a common language and mechanism for organizations to determine and describe their current cybersecurity posture, as well as their target state for cybersecurity. The framework will help them to identify and prioritize opportunities for improvement within the context of risk management and to assess progress toward their goals.
The framework will foster communications among internal and external stakeholders and help organizations hold each other accountable for strong cyber protections while allowing flexibility for specific approaches tailored to each business’ market and regulatory environment. Its integrated approach focuses on outcomes, rather than any particular technology, to encourage innovation.
While this framework is developed explicitly to respond to the February 2013 Executive Order and the importance of reducing risks to the critical infrastructure, it can be applied by other organizations to improve their readiness to deal with increasing cybersecurity risks in all industries.
NIST will hold a workshop to discuss the Preliminary Framework—including implementation and further governance—Nov. 14 and15, 2013, at North Carolina State University. Visit http://www.nist.gov/itl/csd/5th-cybersecurity-framework-workshop-november-14-15-2013.cfm for more information and to register. The Preliminary Framework can be found at http://www.nist.gov/itl/cyberframework.cfm and an announcement of the opening of the official comment period will run in the Federal Register.