CSF 1.1 Critical Infrastructure Resources

Resources related to the 16 U.S. Critical Infrastructure sectors.

CHEMICAL SECTOR

• Department of Homeland Security's Chemical Sector Cybersecurity Framework Implementation Guidance

COMMERCIAL FACILITIES SECTOR

• Department of Homeland Security's Commercial Facilities Sector Cybersecurity Framework Implementation Guidance

COMMUNICATIONS SECTOR

• Federal Communications Commission (FCC) Communications, Security, Reliability and Interoperability Council's (CSRIC) Cybersecurity Risk Management and Best Practices Working Group 4: Final Report
• NTCA’s Sector-Specific Guide for Small Network Service Providers

CRITICAL MANUFACTURING SECTOR

• Department of Homeland Security's Critical Manufacturing Sector Cybersecurity Framework Implementation Guidance
• An Intel Use Case for the Cybersecurity Framework in Action
• NIST’s Manufacturing Profile (a tailored approach for the manufacturing sector to protect against cyber risk); available  for multiple versions of the Cybersecurity Framework:
  • Version 1.1 Manufacturing Profile
  • Version 1.0: Manufacturing Profile
    • The profile also has a Low Impact Level Example Implementations Guide:
      • Vol. 1: General Implementation Guidance
      • Vol. 2: Process-based Manufacturing System Use Case
      • Vol. 3: Discrete-based Manufacturing System Use Case

DAMS SECTOR

• Department of Homeland Security's Dams Sector Cybersecurity Framework Implementation Guidance

DEFENSE INDUSTRIAL SECTOR

• NIST Special Publication (SP) 800-171

EMERGENCY SERVICES SECTOR

• Department of Homeland Security's Emergency Services Sector Cybersecurity Framework Implementation Guidance
• IFSEC Global's Cyber Security Assessment 

ENERGY SECTOR

• Department of Energy's Energy Sector Cybersecurity Framework Implementation Guidance
• Federal Energy Regulatory Commission’s Cybersecurity Incentives Policy White Paper (DRAFT)
  (A white paper on potential incentives to encourage utilities to go above and beyond mandated cybersecurity measures.)
• National Association of Regulatory Utility Commissioners’ Cybersecurity Preparedness Evaluation Tool
  (A tool to help Public Utility Commissions examine a utility’s cybersecurity risk management programs and their capability improvements over time.)
• National Association of Regulatory Utility Commissioners’ Understanding Cybersecurity Preparedness: Questions for Utilities
  (A tool to help Public Utility Commissions ask questions to utilities to help them better understand their current cybersecurity risk management programs and practices.)
• NIST's Cybersecurity Framework Smart Grid Profile
  (This profile helps a broad audience understand smart grid-specific considerations for the outcomes described in the NIST Cybersecurity Framework)
• North American Electric Reliability Corporation’s Mapping of CIP Standards to NIST Cybersecurity Framework (CSF) v1.1
• (NEW!) NIST Cybersecurity White Paper, Benefits of an Updated Mapping Between the NIST Cybersecurity Framework and the NERC Critical Infrastructure Protection Standards
  (The paper explains how the mapping can help organizations to mature and align their compliance and security programs and better manage risks.)
• Ontario Energy Board (OEB) – Ontario Cyber Security Framework and Tools
  (The Ontario Energy Board (OEB) initiated a policy consultation to engage with key industry stakeholders to continue its review of the non-bulk electrical grid and associated business systems in Ontario that could impact the protection of personal information and smart grid reliability. The goal of this policy consultation will be to identify industry standards and best practices in order to establish a sector wide consistent framework for continuing to protect personal information and the reliable operation of the smart grid.)
• The Transportation Security Administration's (TSA) Pipeline Security Guidelines

FINANCIAL SERVICES SECTOR

• Conference of State Bank Supervisors' Cybersecurity 101: A Resource Guide for Bank Executives 
  (A non- technical, easy-to-read resource on cybersecurity that community bank CEOs, senior executives and board members can use to help mitigate cybersecurity threats at their banks.)
• Federal Financial Institutions Examination Council's Cybersecurity Assessment Tool
  (An Assessment is based on the cybersecurity assessment that the FFIEC members piloted in 2014, which was designed to evaluate community institutions’ preparedness to mitigate cyber risks. NIST defines cybersecurity as “the process of protecting information by preventing, detecting, and responding to attacks.”)
• Federal Financial Institutions Examination Council's Mapping Cybersecurity Assessment Tool to NIST Cybersecurity Framework
• The Financial Industry Regulatory Authority Report on Cybersecurity Practices
  (A report which details practices that firms can tailor to their business model as they strengthen their cybersecurity efforts.)
• The Cyber Risk Institute’s The Profile 
  (A customization of the NIST Cybersecurity Framework that financial institutions can use for internal and external cyber risk management assessment and as a mechanism to evidence compliance with various regulatory frameworks)

FOOD AND AGRICULTURAL SECTOR

• National Restaurant Association's Cybersecurity 201 - A Toolkit for Restaurant Operators

GOVERNMENT FACILITIES SECTOR

• No known available resources. We encourage submissions!

HEALTHCARE AND PUBLIC HEALTH SECTOR

• Department of Health and Human Services' (HHS) HPH Sector Cybersecurity Framework Implementation Guide 
• Department of Health and Human Services' HIPAA Security Rule Crosswalk to NIST Cybersecurity Framework
• Food and Drug Administration's Content of Premarket Submissions for Management of Cybersecurity in Medical Devices
  (A guide developed by the FDA to assist industry by identifying issues related to cybersecurity that manufacturers should consider in the design and development of their medical devices as well as in preparing premarket submissions for those devices.)
• HITRUST's Common Security Framework mappings to NIST Cybersecurity Framework
• HITRUST's Healthcare's Model Approach to Critical Infrastructure Cybersecurity White Paper
• Symantec’s Implementing the NIST Cybersecurity Framework in Healthcare
• The Healthcare and Public Health Sector Coordinating Council’s (HSCC) Health Industry Cybersecurity Supply Chain Risk Management Guide (HIC-SCRiM)
  (A toolkit for providing actionable guidance and practical tools for organizations to manage cybersecurity risks.)
• The Office of the National Coordinator for Health Information Technology (ONC), in collaboration with the HHS Office for Civil Rights (OCR)’s SRA Tool
  (A tool designed to help healthcare providers conduct a security risk assessment as required by the HIPAA Security Rule and the Centers for Medicare and Medicaid Service (CMS) Electronic Health Record (EHR) Incentive Program.)
• The White House's Precision Medicine Initiative: Data Security Policy Principles and Framework
  (This document offers security policy principles and a framework to guide decision-making by organizations conducting or a participating in precision medicine activities.)

INFORMATION TECHNOLOGY SECTOR

• No known available resources. We encourage submissions!

NUCLEAR REACTORS, MATERIALS, AND WASTE SECTOR

• Department of Homeland Security's Nuclear Sector Cybersecurity Framework Implementation Guidance

TRANSPORTATION SYSTEMS SECTOR

• BIMCO Ship Guidelines - The Guidelines on Cyber Security Onboard Ships
• Transportation Systems Sector Cybersecurity Framework Implementation Guide
• United States Coast Guard’s DRAFT NAVIGATION AND VESSEL INSPECTION CIRCULAR NO. 05-17
  (Guidelines for addressing cyber risks at Maritime Transportation Security Act (MTSA) regulated facilities)
• United States Coast Guard's Maritime Bulk Liquids Transfer Cybersecurity Framework Profile
  (This MBLT CFP serves to assist in cybersecurity risk assessments for those entities involved in MBLT operations as overseen by the USCG.)

WATER AND WASTEWATER SYSTEMS SECTOR

• American Water Works Association's Process Control System Security Guidance for the Water Sector and Cybersecurity Guidance Tool
• Water Environment Association of Texas' Cyber Security: A Practical Application of NIST Cybersecurity Framework