Frequently Asked Questions

Framework Basics

1. What is the Framework, and what is it designed to accomplish?
2. Is my organization required to use the Framework?
3. Does it provide a recommended checklist of what all organizations should do?
4. Why should an organization use the Framework?
5. When and how was the Framework developed?
6. What is the purpose of Executive Order 13636?
7. Who from the private sector helped to develop the Framework?
8. Why is NIST involved? What is NIST's role in setting cybersecurity standards?

Framework Users

9. What critical infrastructure does the Framework address?

10. Does the Framework apply only to critical infrastructure companies?

11. Does the Framework benefit organizations that view their cybersecurity programs as already mature?

12. How is the Framework being used today?

Framework Components

13. What is the Framework Core and how is it used?
14. What are Framework Profiles and how are they used?
15. What are Framework Implementation Tiers and how are they used?
16. Are the Tiers equivalent to maturity levels?
17. What is the relationship between the Framework and NIST Roadmap for Improving Critical Infrastructure Cybersecurity, which was released on the same day?

Using the Framework

18. What is the difference between 'using', 'adopting', and 'implementing' the Framework?
19. Would the Framework have prevented recent highly publicized attacks?
20. Does the Framework address the cost and cost-effectiveness of cybersecurity risk management?
21. How does the Framework relate to information sharing?
22. Can the Framework help managing risk for assets that are not under my direct management?
23. Should the Framework be applied to and by the entire organization or just to the IT department? 
24. How can the Framework help an organization with external stakeholder communication?
25. What is the role of senior executives and Board members?
26. How can organizations measure the effectiveness of the Framework?
27. How long does it take to implement the Framework?
28. Does the Framework require using any specific technologies or products?
29. Is a conformity assessment program being planned?
30. Will my organization be regulated against gaps between my current regulation and Framework?
31. Is there a way to find out how organizations have used the Framework, and is there a place to get guidance that would help others?
32. What if Framework guidance or tools do not seem to exist for my sector or community?
33. Why did NIST create the Perspectives web page?
34. Are there any case studies for Framework?
35. What are Success Stories?

Small Business Use

36. Does it apply to small businesses?

37. Will NIST provide guidance for specific sectors or small/medium-sized businesses? Is there a starter kit or guide for organizations, which are just getting started with cybersecurity?

U.S. Federal Agency Use

38. Are U.S. Federal agencies required to apply the Framework to Federal information systems?

39. Can U.S. Federal agencies apply the Framework to Federal information systems?

40. How is NIST integrating Cybersecurity Framework into the cybersecurity risk management practices of federal agencies?

41. Why did NIST author Interagency Publication 8170?

42. What is the relationship between the Framework and NIST's Managing Information Security Risk: Organization, Mission, and Information System View (Special Publication 800-39)?

43. What is the relationship between the Framework and NIST's Guide for Applying the Risk Management Framework to Federal Information Systems (SP 800-37)?

44. What type of NIST publication is The Framework for Improving Critical Infrastructure Cybersecurity?

Relationship Between the Framework and Other Approaches and Initiatives

45. What is the relationship between the Framework and the DHS Critical Infrastructure Cyber Community (C³) Voluntary Program?
46. What is the relationship between the Framework and the DHS Cyber Resilience Review?
47. Is the Framework being aligned with international cybersecurity initiatives and standards?
48. What is the relationship between the Framework and NIST's Cyber-Physical Systems (CPS) Framework?
49. What is the relationships between Internet of Things (IoT) and Framework? Do we need an ‘IoT Framework
50. What is the relationship between the Framework and the Baldrige Cybersecurity Excellence Builder?

Proposed Updated to Cybersecurity Framework

51. Will the Framework be updated?
52. How did NIST process the V1.1 update?
53. How did NIST determine features for this update?
54. What changes are included in the proposed revision?
55. Were there changes proposed to the Framework in light of progress made in areas identified in the 2014 Roadmap? 
56. What does this mean for organizations that already have incorporated the current Framework?
57. Should I use V1.0 or V1.1?
58. Will comments provided to NIST be made public, and when will the changes become final? Will there be a public forum for discussion of these proposed changes?
59. What assistance will NIST provide to organizations that choose to incorporate the additional content and functionality of the new version of the Framework?
60. How often will NIST update the Framework?

Informative References

61. What are Informative References?
62. What are online Informative References (OLIR)?
63. Why were online Informative References necessary?
64. Where can I comment and provide feedback about the Online Informative Reference Program?
65. What is the difference between a Reference and a Reference Document?
66. What is an element?
67. What general types of relationships might be defined in a Reference?
68. What are the five options in the Relationships column of the Reference spreadsheet
69. Are References publicly available?
70. Who can author and submit References?
71. If more than one Reference is submitted for a single Reference Document, which one should I use?
72. What if I disagree with an Reference assertion, can I provide feedback?
73. Are Federal agencies and government contractors required to use the Framework References?
74. How should federal agencies use the Framework References?

Communicating with NIST

75. How can I ensure resources or case studies my organization has released publicly are visible for others to use?
76. Who can answer additional questions regarding Framework?
77. How do I sign up for the mailing list to receive updates on the NIST Cybersecurity Framework?
78. How can I share my thoughts or suggestions for improvements to the Cybersecurity Framework with NIST?