The Framework is voluntary guidance, based on existing standards, guidelines, and practices for organizations to better manage and reduce cybersecurity risk. In addition to helping organizations manage and reduce risks, it was designed to foster risk and cybersecurity management communications amongst both internal and external organizational stakeholders.
No. Use of the Framework is voluntary.
The Framework is guidance. It should be customized by different sectors and individual organizations to best suit their risks, situations, and needs. Organizations will continue to have unique risks – different threats, different vulnerabilities, different risk tolerances – and how they implement the practices in the Framework to achieve positive outcomes will vary. The Framework should not be implemented as an un-customized checklist or a one-size-fits-all approach for all critical infrastructure organizations.
The Framework will help an organization to better understand, manage, and reduce its cybersecurity risks. It will assist in determining which activities are most important to assure critical operations and service delivery. In turn, that will help to prioritize investments and maximize the impact of each dollar spent on cybersecurity. By providing a common language to address cybersecurity risk management, it is especially helpful in communicating inside and outside the organization. That includes improving communications, awareness, and understanding between and among IT, planning, and operating units, as well as senior executives of organizations. Organizations also can readily use the Framework to communicate current or desired cybersecurity posture between a buyer or supplier.
Version 1.0 of the Framework was prepared by the National Institute of Standards and Technology (NIST) with extensive private sector input and issued in February 2014. The Framework was developed in response to Presidential Executive Order (EO) 13636, Improving Critical Infrastructure Cybersecurity, which was issued in 2013. Among other things, the EO directed NIST to work with industry leaders to develop the Framework. The Framework was developed in a year-long, collaborative process in which NIST served as a convener for industry, academia, and government stakeholders. That took place via workshops, extensive outreach and consultation, and a public comment process. NIST's future Framework role is reinforced by the Cybersecurity Enhancement Act of 2014 (Public Law 113-274), which calls on NIST to facilitate and support the development of voluntary, industry-led cybersecurity standards and best practices for critical infrastructure. This collaboration continues as NIST works with stakeholders from across the country and around the world to raise awareness and encourage use of the Framework. The most recent version, Framework V1.1 was released on April 16, 2018 following a 45-day public comment period on the second draft of Framework V1.1.
Executive Order 13636 outlines responsibilities for Federal Departments and Agencies to aid in Improving Critical Infrastructure Cybersecurity. In summary, it assigns these responsibilities and establishes the policy that, "It is the policy of the United States to enhance the security and resilience of the Nation's critical infrastructure and to maintain a cyber environment that encourages efficiency, innovation, and economic prosperity while promoting safety, security, business confidentiality, privacy, and civil liberties."
More than 3,000 people from diverse parts of industry, academia, and government participated in the initial five workshops around the country. NIST received hundreds of detailed suggestions and comments in response to the initial request for information (RFI) and feedback on a public draft version of the Framework. Those regular workshops and public comments have continued, including feedback to NIST on the draft updates of the Framework and a related Roadmap.
NIST is a federal agency within the United States Department of Commerce. NIST's mission is to develop and promote measurement, standards, and technology to enhance productivity, facilitate trade, and improve the quality of life. NIST is also responsible for establishing computer- and information technology-related standards and guidelines for federal agencies to use. Many private sector organizations have made widespread use of these standards and guidelines voluntarily for several decades, especially those related to information security.
Critical infrastructure (for the purposes of this Framework) is defined in Presidential Policy Directive (PPD) 21 as: "Systems and assets, whether physical or virtual, so vital to the United States that the incapacity or destruction of such systems and assets would have a debilitating impact on security, national economic security, national public health or safety, or any combination of those matters." Applicable infrastructure includes utilities providing energy and water as well as sectors covering transportation, financial services, communications, healthcare and public health, food and agriculture, chemical and other facilities, dams, key manufacturers, emergency services and several others.
No. Although it was designed specifically for companies that are part of the U.S. critical infrastructure, many other organizations in the private and public sectors (including federal agencies) are using the Framework. NIST encourages any organization or sector to review and consider the Framework as a helpful tool in managing cybersecurity risks.
The Framework can be used by organizations that already have extensive cybersecurity programs, as well as by those just beginning to think about putting cybersecurity management programs in place. The same general approach works for any organization, although the way in which they make use of the Framework will differ depending on their current state and priorities.
Organizations are using the Framework in a variety of ways. Many have found it helpful in raising awareness and communicating with stakeholders within their organization, including executive leadership. The Framework is also improving communications across organizations, allowing cybersecurity expectations to be shared with business partners, suppliers, and among sectors. By mapping the Framework to current cybersecurity management approaches, organizations are learning and showing how they match up with the Framework's standards, guidelines, and best practices. Some parties are using the Framework to reconcile and de-conflict internal policy with legislation, regulation, and industry best practice. The Framework also is being used as a strategic planning tool to assess risks and current practices. The Resources and Success Stories sections provides examples of how various organizations have used the Framework.
The Framework Core is a set of cybersecurity activities, desired outcomes, and applicable references that are common across critical infrastructure sectors. An example of Framework outcome language is, "physical devices and systems within the organization are inventoried."
The Core presents industry standards, guidelines, and practices in a manner that allows for communication of cybersecurity activities and outcomes across the organization from the executive level to the implementation/operations level. The Framework Core consists of five concurrent and continuous Functions—Identify, Protect, Detect, Respond, Recover. When considered together, these Functions provide a high-level, strategic view of the lifecycle of an organization's management of cybersecurity risk. The Framework Core then identifies underlying key Categories and Subcategories for each Function, and matches them with example Informative References, such as existing standards, guidelines, and practices for each Subcategory.
What are Framework Profiles and how are they used?
A Framework Profile ("Profile") represents the cybersecurity outcomes based on business needs that an organization has selected from the Framework Categories and Subcategories. The Profile can be characterized as the alignment of standards, guidelines, and practices to the Framework Core in a particular implementation scenario. Profiles can be used to identify opportunities for improving cybersecurity posture by comparing a "Current" Profile (the "as is" state) with a "Target" Profile (the "to be" state). To develop a Profile, an organization can review all of the Categories and Subcategories and, based on business drivers and a risk assessment, determine which are most important. They can also add Categories and Subcategories as needed to address the organization's risks. The Current Profile can then be used to support prioritization and measurement of progress toward the Target Profile, while factoring in other business needs including cost-effectiveness and innovation. Profiles can be used to conduct self-assessments and communicate within an organization or between organizations.
What are Framework Implementation Tiers and how are they used?
Framework Implementation Tiers ("Tiers") provide context on how an organization views cybersecurity risk and the processes in place to manage that risk. Tiers describe the degree to which an organization's cybersecurity risk management practices exhibit the characteristics defined in the Framework (e.g., risk and threat aware, repeatable, and adaptive). The Tiers characterize an organization's practices over a range, from Partial (Tier 1) to Adaptive (Tier 4). These Tiers reflect a progression from informal, reactive responses to approaches that are agile and risk-informed. During the Tier selection process, an organization should consider its current risk management practices, threat environment, legal and regulatory requirements, business/mission objectives, and organizational constraints.
Are the Tiers equivalent to maturity levels?
The Framework Implementation Tiers are not intended to be maturity levels. The Tiers are intended to provide guidance to organizations on the interactions and coordination between cybersecurity risk management and operational risk management. The key tenet of the Tiers is to allow organizations to take stock of their current activities from an organization wide point of view and determine if the current integration of cybersecurity risk management practices is sufficient given their mission, regulatory requirements, and risk appetite. Progression to higher Tiers is encouraged when such a change would reduce cybersecurity risk and would be cost-effective.
What is the relationship between the Framework and NIST Roadmap for the Framework for Improving Critical Infrastructure Cybersecurity?
The companion Roadmap was initially released in February 2014 in unison with publication of the Framework version 1.0. The Roadmap discusses NIST's next steps with the Framework and identifies key areas of development, alignment, and collaboration. These plans are based on input and feedback received from stakeholders through the Framework development process. This list of high-priority areas is not intended to be exhaustive, but these are important areas identified by NIST and stakeholders that should inform future versions of the Framework. For that reason, the Roadmap will be updated over time in alignment with the most impactful stakeholder cybersecurity activities and the Framework itself. The most recent version can be found here.
In a strict sense, these words are fairly interchangeable. They can mean an organization's use of the Framework as a part of its internal processes. NIST generally refers to "using" the Framework.
There are no "silver bullets" when it comes to cybersecurity and protecting an organization. For instance, "Zero-day" attacks exploiting previously unknown software vulnerabilities are especially problematic. However, using the Framework to assess and improve management of cybersecurity risks should put organizations in a much better position to identify, protect, detect, respond to, and recover from an attack, minimizing damage and impact.
Yes. An organization can use the Framework to determine activities that are most important to critical service delivery and prioritize expenditures to maximize the impact of the investment.
The Framework provides guidance on how awareness of real and potential threats and vulnerabilities can be used to enhance an organization's cybersecurity program.
Yes. The Functions, Categories, and Subcategories of the Framework Core are expressed as outcomes and are applicable whether you are operating your own assets, or another party is operating assets as a service for you. For customized external services such as outsourcing engagements, the Framework can be used as the basis for due diligence with the service provider. For packaged services, the Framework can be used as a set of evaluation criteria for selecting amongst multiple providers.
The Framework provides guidance relevant for the entire organization. The full benefits of the Framework will not be realized if only the IT department uses it. The Framework balances comprehensive risk management, with a language that is adaptable to the audience at hand. More specifically, the Function, Category, and Subcategory levels of the Framework correspond well to organizational, mission/business, and IT and operational technology (OT)/industrial control system (ICS) systems level professionals. This enables accurate and meaningful communication, from the C-Suite to individual operating units and with supply chain partners. It can be especially helpful in improving communications and understanding between IT specialists, OT/ICS operators, and senior managers of the organization.
The Framework can be used to communicate with external stakeholders such as suppliers, services providers, and system integrators. More specifically, the Framework Core is a language in which to communicate, while Framework Profiles can be used to express security requirements.
The Framework can be used as an effective communication tool for senior stakeholders (CIO, CEO, Executive Board, etc.), especially as the importance of cybersecurity risk management receives elevated attention in C-suites and Board rooms. The Functions inside the Framework Core offer a high level view of cybersecurity activities and outcomes that could be used to provide context to senior stakeholders beyond current headlines in the cybersecurity community.
Framework effectiveness depends upon each organization's goal and approach in its use. Is the organization seeking an overall assessment of cybersecurity-related risks, policies, and processes? Is it seeking a specific outcome such as better management of cybersecurity with its suppliers or greater confidence in its assurances to customers? Effectiveness measures vary per use case and circumstance. Accordingly, the Framework leaves specific measurements to the user's discretion. Individual entities may develop quantitative metrics for use within that organization or its business partners, but there is no specific model recommended for measuring effectiveness of use.
Each organization's cybersecurity resources, capabilities, and needs are different. So the time to implement the Framework will vary among organizations, ranging from as short as a few weeks to several years. The Framework Core's hierarchical design enables organizations to apportion steps between current state and desired state in a way that is appropriate to their resources, capabilities, and needs. This allows organizations to develop a realistic action plan to achieve Framework outcomes in a reasonable time frame, and then build upon that success in subsequent activities.
No. It has been designed to be flexible enough so that users can make choices among products and services available in the marketplace. It encourages technological innovation by aiming for strong cybersecurity protection without being tied to specific offerings or current technology.
NIST has no plans to develop a conformity assessment program. NIST encourages the private sector to determine its conformity needs, and then develop appropriate conformity assessment programs. NIST is able to discuss conformity assessment-related topics with interested parties.
The Framework was created with the current regulatory environment in mind, and does not replace or augment any existing laws or regulations. The Framework leverages industry best practices and methods for cybersecurity risk management, which are often used in regulation.
Early users of the Framework are beginning to produce case studies, implementation guides, and other resources. These resources are starting to be available through trade and professional associations. NIST is also listing those items at the Framework website on the Framework Resources and Success Stories pages.
The Framework is designed to be applicable to any organization in any part of the critical infrastructure or broader economy. Applications from one sector may work equally well in others. It is expected that many organizations face the same kinds of challenges. There are published case studies and guidance that can be leveraged, even if they are from different sectors or communities. Organizations can encourage associations to produce sector-specific Framework mappings and guidance and organize communities of interest. You may also find value in coordinating within your organization or with others in your sector or community.
The Perspectives web pages are meant to inform people’s decision to use the Framework. The pages contain meaningful quotes that describe why the Framework is important or recommend its use. Survey information that indicates usage is also provided.
NIST is publishing brief Success Stories explaining how diverse organizations use the Framework to improve their cybersecurity risk management. Success stories are prepared by organizations using the Framework following a template and guidance provided by NIST.
NIST Special Publication (SP) 800-160, Volume 2, Systems Security Engineering: Cyber Resiliency Considerations for the Engineering of Trustworthy secure systems, defines cyber resiliency as the ability to anticipate, withstand, recover from, and adapt to adverse conditions, stresses, attacks, or compromises on systems that use or are enabled by cyber resources regardless of the source. Cyber resiliency has a strong relationship to cybersecurity but, like privacy, represents a distinct problem domain and solution space. Cyber resiliency supports mission assurance, for missions which depend on IT and OT systems, in a contested environment. The Cybersecurity Framework specifically addresses cyber resiliency through the ID.BE-5 and PR.PT-5 subcategories, and through those within the Recovery function. Other Cybersecurity Framework subcategories may help organizations determine whether their current state adequately supports cyber resiliency, whether additional elements are necessary, and how to close gaps, if any. Many organizations find that they need to ensure that the target state includes an effective combination of fault-tolerance, adversity-tolerance, and graceful degradation in relation to the mission goals. The Cybersecurity Framework supports high-level organizational discussions; additional and more detailed recommendations for cyber resiliency may be found in various cyber resiliency models/frameworks and in guidance such as in SP 800-160 Vol. 2.
Yes. The approach was developed for use by organizations that span the largest to the smallest organizations.
NIST has a long-standing and on-going effort supporting small business cybersecurity. This is accomplished by providing guidance through publications, meetings, and events. Materials and an associated program description are available at the Computer Security Resource Center. NIST coordinates these activities with the Small Business Administration and the Federal Bureau of Investigation’s InfraGuard program.
Small businesses may find Small Business Information Security: The Fundamentals (NISTIR 7621 Rev. 1) a valuable publication for understanding important cybersecurity activities. It is recommended as a starter kit for small businesses. The publication works in coordination with the Framework, because it is organized according to Framework Functions.
NIST has a long-standing and on-going effort supporting small business cybersecurity. This is accomplished by providing guidance through websites, publications, meetings, and events. This includes a Small Business Cybersecurity Corner website that puts a variety of government and other cybersecurity resources for small businesses in one site. That includes the Federal Trade Commission’s information about how small businesses can make use of the Cybersecurity Framework.
NIST coordinates its small business activities with the Small Business Administration, the National Initiative For Cybersecurity Education (NICE), National Cyber Security Alliance, the Department of Homeland Security, the FTC, and others.
Small businesses also may find Small Business Information Security: The Fundamentals (NISTIR 7621 Rev. 1) a valuable publication for understanding important cybersecurity activities. It is recommended as a starter kit for small businesses. The publication works in coordination with the Framework, because it is organized according to Framework Functions.
Yes. On May 11, 2017, the President issued an Executive Order on Strengthening the Cybersecurity of Federal Networks and Critical Infrastructure. In part, the order states that “Each agency head shall provide a risk management report to the Secretary of Homeland Security and the Director of the Office of Management and Budget (OMB) within 90 days of the date of this order” and “describe the agency's action plan to implement the Framework.”
Yes. The Framework can help agencies to integrate existing risk management and compliance efforts and structure consistent communication, both across teams and with leadership. It can be valuable in managing federal information and information systems according to the Risk Management Framework (RMF), implementing security controls detailed in SP 800-53 revision 4, and using the methodology outlined in SP 800-39.
NIST is updating its suite of cybersecurity and privacy risk management publications (e.g. SP 800-37 – Guide for Applying the Risk Management Framework to Federal Information Systems) to provide additional guidance on how to integrate implementation of the Framework. Similarly, the larger suite of NIST security and privacy risk management publications will be updated in consideration of NIST IR 8170 feedback and general Framework value.
Federal agencies are now required by a May 2017, Executive Order to apply the Framework to federal information systems. (See Section 1(c)(ii) of the Order.) The Framework can help agencies to integrate existing risk management and compliance efforts and to structure consistent communication, both across teams and with leadership. NIST is revising a draft NIST Interagency Report 8170: The Cybersecurity Framework: Implementation Guidance for Federal Agencies to provide federal agencies with guidance on how the Cybersecurity Framework can help agencies to complement those existing risk management practices and improve their cybersecurity risk management programs. The draft report summarizes eight private sector uses of the Framework, which may also be useful for federal agencies.
The Framework uses risk management processes to enable organizations to inform and prioritize cybersecurity decisions. It can be adapted to provide a flexible, risk-based implementation that can be used with a broad array of risk management processes, including, for example, SP 800-39. SP 800-39 describes the risk management process employed by federal organizations, and optionally employed by private sector organizations. The process is composed of four distinct steps: Frame, Assess, Respond, and Monitor. SP 800-39 further enumerates three distinct organizational Tiers at the Organizational, Mission/Business, and System level, and risk management roles and responsibilities within those Tiers. Organizations using the Framework may leverage SP 800-39 to implement the high-level risk management concepts outlined in the Framework. Within the SP 800-39 process, the Cybersecurity Framework provides a language for communicating and organizing. Further, Framework Profiles can be used to express risk disposition, capture risk assessment information, analyze gaps, and organize remediation.
Federal agencies manage information and information systems according to the Federal Information Security Management Act of 2002 (FISMA) and a suite of related standards and guidelines. Perhaps the most central FISMA guideline is NIST Special Publication (SP) 800-37 – Guide for Applying the Risk Management Framework to Federal Information Systems: A Security Life Cycle Approach, which details the Risk Management Framework (RMF). The RMF six-step process provides a method of coordinating the interrelated FISMA standards and guidelines to ensure systems are provisioned, assessed, and managed with appropriate security.
To further assist federal agencies with integrating the Cybersecurity Framework and the Risk Management Framework, Special Publication 800-37, Revision 2 – Risk Management Framework for Information Systems and Organizations, includes incorporation of key Cybersecurity Framework, privacy risk management, and systems security engineering concepts. NIST held an open workshop for additional stakeholder engagement and feedback on the discussion draft of the Risk Management Framework, including its consideration of the Cybersecurity Framework.
The draft NIST Interagency Report 8170: The Cybersecurity Framework: Implementation Guidance for Federal Agencies identifies three possible uses of the Cybersecurity Framework in support of the RMF processes: “Maintain a Comprehensive Understanding of Cybersecurity Risk,” “Report Cybersecurity Risks,” and “Inform the Tailoring Process.” The CSF Core can help agencies to better-organize the risks they have accepted and the risk they are working to remediate across all systems, use the reporting structure that aligns to SP 800-53, and enables agencies to reconcile mission objectives with the structure of the Core.
What type of NIST publication is The Framework for Improving Critical Infrastructure Cybersecurity?
Given the broad applicability of the Cybersecurity Framework and the requirement for neutral authorities for what is primarily a voluntary guidance, the document was published as, and remains, a white paper. It is not an Interagency Report, Special Publication, or Federal Information Processing Standard.
NIST is updating its suite of cybersecurity and privacy risk management publications (e.g. SP 800-37 Rev. 2 – Risk Management Framework for Information Systems and Organizations) to provide additional guidance on how to integrate implementation of the Framework. Similarly, the larger suite of NIST security and privacy risk management publications will be updated based on Executive Order 13800 and feedback to the draft version of NIST IR 8170.
While the Cybersecurity Framework and the NICE Framework were developed separately, each complements the other by describing a hierarchical approach to achieving cybersecurity goals.
The Cybersecurity Workforce Framework was developed and is maintained by the National Initiative for Cybersecurity Education (NICE), a partnership among government, academia, and the private sector with a mission to energize and promote a robust network and an ecosystem of cybersecurity education, training, and workforce development. Where the Cybersecurity Framework provides a model to help identify and prioritize cybersecurity actions, the NICE Framework (NIST Special Publication 800-181) describes a detailed set of work roles, tasks, and knowledge, skills, and abilities (KSAs) for performing those actions.
The NIST Roadmap for Improving Critical Infrastructure Cybersecurity, a companion document to the Cybersecurity Framework, reinforces the need for a skilled cybersecurity workforce. It recognizes that, as cybersecurity threat and technology environments evolve, the workforce must adapt in turn. The NICE program supports this vision and includes a strategic goal of helping employers recruit, hire, develop, and retain cybersecurity talent. One objective within this strategic goal is to publish and raise awareness of the NICE Framework and encourage adoption. Adoption, in this case, means that the NICE Framework is used as a reference resource for actions related to cybersecurity workforce, training, and education.
Workforce plays a critical role in managing cybersecurity, and many of the Cybersecurity Framework outcomes are focused on people and the processes those people perform. While some outcomes speak directly about the workforce itself (e.g., roles, communications, training), each of the Core subcategory outcomes is accomplished as a task (or set of tasks) by someone in one or more work roles. One could easily append the phrase “by skilled, knowledgeable, and trained personnel” to any one of the 108 subcategory outcomes. From this perspective, the Cybersecurity Framework provides the “what” and the NICE Framework provides the “by whom.”
In Appendix D.1, the NICE Framework describes an example of integration between the two Frameworks. By using the Cybersecurity Framework and the NICE Framework together in this way, an organization can effectively relate cybersecurity objectives to their current and target workforce needs. Both the Cybersecurity Framework and the NICE Workforce Framework work in harmony with other NIST frameworks to help determine how and what activities will help an organization to manage cybersecurity risk to an acceptable level, and by whom. The Fall 2018 edition of the NICE e-newsletter includes an article further explaining the connection between NIST models. One benefit of using these frameworks together is in support of Executive Order 13870, America’s Cybersecurity Workforce, which directs U.S. Federal Agencies to incorporate the NICE Framework lexicon and taxonomy into workforce knowledge and skill requirements used in information technology and cybersecurity services contracts.
NIST is modeling the development of the Privacy Framework on the successful, open, transparent, and collaborative approach used to develop the Cybersecurity Framework. While good cybersecurity practices help manage privacy risk by protecting information, those cybersecurity measures alone are not sufficient to address the full scope of privacy risks that also can arise from how organizations collect, store, use, and share this information to meet their mission or business objective, as well as how individuals interact with products and services.
In response to initial public input, NIST has released for discussion an outline of the Privacy Framework that provides a high-level, structural alignment to the Cybersecurity Framework—proposing inclusion of a Core (consisting of functions, categories, subcategories, and informative references), Profile, and Implementation Tiers. This structure would enable a risk- and outcome-based approach and has contributed to the success of the Cybersecurity Framework as an accessible communication tool. In addition, the alignment aims to reduce complexity for organizations that already use the Cybersecurity Framework.
EO 13636 directed the National Institute of Standards and Technology to work with industry to develop a framework for reducing cybersecurity risks. The EO also charged the Department of Homeland Security with developing a voluntary program to promote use of the Framework and help critical infrastructure organizations improve their cybersecurity. In February 2014, DHS launched the Critical Infrastructure Cyber Community (C3, pronounced "C-Cubed") Voluntary Program. The C3 Voluntary Program helps align critical infrastructure owners and operators with existing resources to assist in their efforts to use the Framework and manage their cybersecurity risks. More information about the C3 Voluntary Program may be found on the DHS Web site.
A description of the relationship between the DHS Cyber Resilience Review (CRR) and the Cybersecurity Framework can be found at the DHS Web site.
While the Framework was born through U.S. policy, it is not a "U.S. only" Framework. Private sector stakeholders made it clear from the outset that global alignment is important to avoid confusion and duplication of effort, or even conflicting expectations in the global business environment. These needs have been reiterated by multi-national organizations. The importance of international standards organizations and trade associations for acceptance of the Framework's approach has been widely recognized. Some countries and international entities are adopting approaches that are compatible with the framework established by NIST, and others are considering doing the same. The Framework has been translated into several other languages. NIST has been holding regular discussions with many nations and regions, and making noteworthy internationalization progress. NIST is actively engaged with international standards-developing organizations to promote adoption of approaches consistent with the Framework.
The Cybersecurity Framework provides the underlying cybersecurity risk management principles that support the new Cyber-Physical Systems (CPS) Framework. The CPS Framework document is intended to help manufacturers create new CPS that can work seamlessly with other smart systems that bridge the physical and computational worlds.
The CPS Framework includes a structure and analysis methodology for CPS. The goal of the CPS Framework is to develop a shared understanding of CPS, its foundational concepts and unique dimensions, promoting progress through the exchange of ideas and integration of research across sectors and to support development of CPS with new functionalities.
The Cybersecurity Framework is applicable to many different technologies, including Internet of Things (IoT) technologies. Developing separate frameworks of cybersecurity outcomes specific to IoT might risk losing a critical mass of users aligning their cybersecurity outcomes to the Cybersecurity Framework. To retain that alignment, NIST recommends continued evaluation and evolution of the Cybersecurity Framework to make it even more meaningful to IoT technologies. NIST welcomes observations from all parties regarding the Cybersecurity Framework’s relevance to IoT, and will vet those observations with the NIST Cybersecurity for IoT Program.
The Baldrige Cybersecurity Excellence Builder blends the systems perspective and business practices of the Baldrige Excellence Framework with the concepts of the Cybersecurity Framework. More specifically, the Cybersecurity Framework aligns organizational objectives, strategy, and policy landscapes into a cohesive cybersecurity program that easily integrates with organizational enterprise risk governance. These Cybersecurity Framework objectives are significantly advanced by the addition of the time-tested and trusted systems perspective and business practices of the Baldrige Excellence Framework. The builder responds to requests from many organizations to provide a way for them to measure how effectively they are managing cybersecurity risk.
Threat frameworks are particularly helpful understanding current or potential attack lifecycle stages of an adversary against a given system, infrastructure, service, or organization. They characterize malicious cyber activity, and possibly related factors such as motive or intent, in varying degrees of detail. Threat frameworks stand in contrast to the controls of cybersecurity frameworks that provide safeguards against many risks, including the risk that adversaries may attack a given system, infrastructure, service, or organization. While NIST has not promulgated or adopted a specific threat framework, we advocate the use of both types of frameworks as tools to make risk decisions and evaluate the safeguards thereof. In particular, threat frameworks may provide insights into which safeguards are more important at this instance in time, given a specific threat circumstance. As circumstances change and evolve, threat frameworks provide the basis for re-evaluating and refining risk decisions and safeguards using a cybersecurity framework. A threat framework can standardize or normalize data collected within an organization or shared between them by providing a common ontology and lexicon.
Example threat frameworks include the U.S. Office of the Director of National Intelligence (ODNI) Cyber Threat Framework (CTF), Lockheed Martin’s Cyber Kill Chain®, and the Mitre Adversarial Tactics, Techniques & Common Knowledge (ATT&CK) model. Each threat framework depicts a progression of attack steps where successive steps build on the last step. At the highest level of the model, the ODNI CTF relays this information using four Stages – Preparation, Engagement, Presence, and Consequence. These Stages are de-composed into a hierarchy of Objectives, Actions, and Indicators at three increasingly-detailed levels of the CTF, empowering professionals of varying levels of understanding to participate in identifying, assessing, managing threats. This property of CTF, enabled by the de-composition and re-composition of the CTF structure, is very similar to the Functions, Categories, and Subcategories of the Cybersecurity Framework. In its simplest form, the five Functions of Cybersecurity Framework – Identify, Protect, Detect, Respond, and Recover – empower professionals of many disciplines to participate in identifying, assessing, and managing security controls. It is recommended that organizations use a combination of cyber threat frameworks, such as the ODNI Cyber Threat Framework, and cybersecurity frameworks, such as the Cybersecurity Framework, to make risk decisions.
What is the difference between a translation and adaptation of the Framework?
A translation is considered a direct, literal translation of the language of Version 1.0 or 1.1 of the Framework. No content or language is altered in a translation. Current translations can be found on the International Resources page.
An adaptation is considered a version of the Framework that substantially references language and content from Version 1.0 or 1.1 but incorporates new, original content. An adaptation can be in any language. Current adaptations can be found on the International Resources page.
The Framework will be refined, improved, and evolved over time to keep pace with technology and threat trends, integrate lessons learned, and establish best practice as common practice. Decisions about the timing of updates will be made based on user experiences, technological advances, and standards innovations. The Framework update process integrates the NIST Cybersecurity Risk Management Conference into a public-private dialog that asks stakeholders every three years:
For more information, see:
Is it an appropriate time for an update, and if so
What would you like to see in that update?
Framework stakeholders provided initial feedback to NIST through: a December 2015 Request for Information, lessons learned from Framework use, shared resources from industry partners, and an April 2016 Cybersecurity Framework workshop. When Version 1.1 Draft 1 was issued on January 10, 2017, NIST solicited comments and held a workshop in May 2017 to review and discuss those and other comments. NIST also considered feedback received through meetings and events since the release of Framework Version 1.0, as well as advances made in areas identified in the Roadmap issued in February 2014 when the Framework was initially published. Incorporating feedback received from the May 2017 workshop in addition to the previous workshops and January 10, 2017 Request for Comments, NIST updated the Framework V1.1 Draft. On December 5, 2017 NIST released Framework V1.1 Draft 2 and an additional round of comments were received through a 45-day Request for Comment period. NIST then released Framework V1.1 on April 16, 2018.
Framework stakeholders provided initial feedback to NIST through: a December 2015 Request for Information, lessons learned from Framework use, shared resources from industry partners, and an April 2016 Cybersecurity Framework workshop. When Version 1.1 Draft 1 was issued on January 10, 2017, NIST solicited comments and held a workshop in May 2017 to review and discuss those and other comments. NIST also considered feedback received through meetings and events since the release of Framework Version 1.0, as well as advances made in areas identified in the Roadmap issued in February 2014 when the Framework was initially published.
The changes made for Framework V1.1 include:
Declares applicability of the Framework for "technology," which is minimally composed of information technology, operational technology, cyber-physical systems, and Internet of Things,
Enhances guidance for applying the Framework to supply chain risk management,
Summarizes the relevance and utility of Framework measurement for organizational self-assessment,
Better accounts for authorization, authentication, and identity proofing, and
Administratively updates the Informative References.
Yes. The most notable changes are related to Supply Chain Risk Management, where multiple provisions have been added, including a new category in the Framework Core and a new property within Implementation Tiers. Additional provisions related to identity management and access control have been included in V1.1. Also, statements about federal agencies and the Framework are included in V1.1. Informative References also have been updated, reflecting the advancement of standards and guidelines by private and public-sector organizations.
Framework V1.1 is intended to be fully compatible with V1.0. NIST recommends that organizations incorporate the additional content and functionality of V1.1 based on the needs of the individual organization.
Framework V1.1 is intended to be implemented by first-time and current Framework users. Current users should be able to implement Version 1.1 with minimal or no disruption; compatibility with Version 1.0 has been an explicit objective. As with Version 1.0, users are encouraged to customize the Framework to maximize individual organizational value.
NIST will continue to educate organizations through both NIST-hosted and other events. NIST will regularly update its web-based FAQs, Presentations, Resources, Online Learning, and Success Stories pages which offer information about how organizations are using or citing the Framework. NIST also will continue to respond to questions it receives at: firstname.lastname@example.org.
Informative References show relationships between Framework Functions, Categories, and Subcategories and specific sections of standards, guidelines, and best practices common among Framework stakeholders. Informative References illustrate ways to achieve Framework outcomes. For instance, it may be possible to achieve the outcome “data-at-rest is protected” from the Protect Function, Data Security, Subcategory 1 (PR.DS-1) of the Cybersecurity Framework using Media Protection Policy and Procedures Control 8 (MP-8) and System as well as Communications Protection Policy and Procedures Controls 12 and 28 (SC-12 and SC-28) from NIST Special Publication 800-53 Revision 4.
OLIR is a NIST program serving two functions: a) provide a process for stakeholders to create, submit, and publish (online) Informative References to the Cybersecurity Framework and b) to enable consumers of these Informative References to use, apply, and comment on the published cross references. Additional information, including participation in the NIST OLIR program are described in NISTIR 8204, Cybersecurity Framework Online Informative References (OLIR): Specification for Completing the OLIR Template.
Historically, a smaller subset of Informative References was published in the Cybersecurity Framework document. The OLIR program scales to accommodate a greater number of Informative References and provides a more agile support model to account for the varying update cycles of all Reference documents. The OLIR program allows for the Cybersecurity Framework community to keep information current on relationship assertions from Informative References to the Cybersecurity Framework. The OLIR program also provides a more robust method for clearly defining those relationship assertions.
NIST welcomes feedback to email@example.com.
A Reference Document is the cybersecurity document that is being related to the Cybersecurity Framework (e.g., ISO 27001, SP800-54 Revision 4, etc.). An Informative Reference is a separate work product that shows multiple relationship assertions between specific Reference document elements and Cybersecurity Framework elements.
Yes. Once the submitting organization has refined the Informative Reference to NIST’s specifications and submitted it for public review, it becomes publicly available through a link on the OLIR Informative Reference Catalog and is hosted on the Internet by the submitting organization.
Anyone can author and submit Informative References. The NIST process for accepting, vetting, and linking to these stakeholder submissions is described in NISTIR 8204, Cybersecurity Framework Online Informative References (OLIR): Specification for Completing the OLIR Template. Questions and draft Informative Reference documents may be directed to firstname.lastname@example.org.
The OLIR site is meant to be a community catalog. However, the Informative References themselves come with no guarantees or endorsements from NIST. Therefore, it is incumbent on the consumer of Informative References to do their due diligence when making business/security decisions for Cybersecurity Framework implementation. The implementing party may give preference to a particular Informative Reference that is authored by the same organization that authored the Reference Document (a.k.a. an “authoritative” Reference).
Please provide feedback regarding anything related to an Informative Reference to email@example.com.
While Federal agencies are required to use the Cybersecurity Framework through Executive Order 13800, use of Informative References is at the discretion of each agency according to their unique risk and resourcing contexts.
The mapping and pending Informative References of NIST SP 800-53 controls to the Cybersecurity Framework provide a basis for two important dimensions of FISMA fulfillment. First, the NIST SP 800-53 Framework Informative Reference provides a means to “roll up” reporting from the control level to a less granular reporting structure. This may be helpful in providing executive views of risk and in any representations of risk to parties outside of a given Federal agency. Second, the NIST SP 800-53 Framework structure may enable additional and more seamless “Organizational Inputs” into control selection, implementation, and management. Both of these proposed uses of the Framework for Federal agencies are detailed in the draft NISTIR 8170, The Cybersecurity Framework: Implementation Guidance for Federal Agencies.
Share them with NIST via email (firstname.lastname@example.org(link sends e-mail)), sector organizations (where applicable), trade and professional associations, and post information on your organization's website.
NIST's policy is to encourage translations of the Framework. After an independent check on translations, NIST typically will post links to an external website with the translation. These links appear on the Cybersecurity Framework’s International Resources page.
Those wishing to prepare translations are encouraged to use the Cybersecurity Framework Version 1.1.
Review the NIST Cybersecurity Framework web page for more information, contact NIST via email at email@example.com, and check with sector or relevant trade and professional associations.
To receive updates on the NIST Cybersecurity Framework, you will need to sign up for NIST E-mail alerts. The sign-up box is located at the bottom-right hand side on each Cybersecurity Framework-based web page, or on the left-hand side of other NIST pages. Once you enter your email address and select a password, you can then select "Cybersecurity Framework" under the "Subscription Topics" to begin receiving updates on the Framework. If you see any other topics or organizations that interest you, please feel free to select those as well. You may change your subscription settings or unsubscribe at anytime.
There are many ways to participate in Cybersecurity Framework.
Participation in NIST Workshops, RFI responses, and public comment periods for work products are excellent ways to inform NIST Cybersecurity Framework documents. Less formal but just as meaningful, as you have observations and thoughts for improvement, please send those to firstname.lastname@example.org. We value all contributions through these processes, and our work products are stronger as a result.
Participation in the larger Cybersecurity Framework ecosystem is also very important. NIST's vision is that various sectors, industries, and communities customize Cybersecurity Framework for their use. Customization efforts include:
- Financial Services Sector Cybersecurity Profile
- cross-walking key legislation and regulation to the Cybersecurity Framework (e.g., Health and Human Services' HIPAA Security Rule Crosswalk to NIST Cybersecurity Framework),
- developing Profiles that reflect business/mission priorities of a given stakeholder group (e.g., Federal Communications Commission (FCC) Communications, Security, Reliability and Interoperability Council's (CSRIC) Cybersecurity Risk Management and Best Practices Working Group 4: Final Report),
- publishing case studies on Cybersecurity Framework implementation (e.g., An Intel Use Case for the Cybersecurity Framework in Action)
- sharing guidance and successful implementation through Success Stories (e.g. The University of Chicago’s Biological Sciences Division implementation)
If you develop similar resources, NIST is happy to consider them for inclusion in the Industry Resources page.
Thank you very much for your offer to help. Please keep us posted on your ideas and work products.