2

2. NEMA CPSP 2-2018: Cyber Hygiene Best Practices

(https://www.nema.org/Standards/Pages/Cyber-Hygiene-Best-Practices.aspx). 

This document identifies a set of industry best practices and guidelines for electrical 

equipment and medical imaging manufacturers to help raise their level of cybersecurity 

sophistication in their manufacturing facilities and engineering processes.

3. NEMA CPSP 3-2019: Cyber Hygiene Best Practices-Part 2

(https://www.nema.org/Standards/Pages/Cyber-Hygiene-Best-Practices-Part-2.aspx).

This document identifies industry best practices and guidelines that electrical 

equipment and medical imaging manufacturers may consider when providing 

cybersecurity information to their customers. These practices and guidelines are meant 

to help customers effectively manage their cybersecurity expectations as they use the 

equipment within the context of their respective markets (e.g., commercial, and 

residential buildings, industrial equipment, the electrical grid, hospitals, and surface 

transportation). The document also provides suggestions for how customers can work 

with their respective manufacturers to improve the customer’s level of cybersecurity 

through industry best practices and guidelines.

NEMA provides the following general comments on the CSF 2.0 Final Draft:

1. NEMA supports the change of the title to the more commonly used name ‘Cybersecurity

Framework’ name and accompanying ‘CSF’ acronym when referring to the framework. 

Such nomenclature allows NIST to appropriately scope the framework to broader 

audiences, thereby allowing its benefits to be more widely experienced by 

organizations and operations.

2. NEMA supports the relation of the CSF to other NIST frameworks and other relevant 

NIST publications.

3. NEMA supports the increased guidance on CSF implementation with action-oriented 

processes, framework profiles, and notional templates.

4. NEMA supports the inclusion of the crosscutting “Govern Function” as a core function in 

CSF 2.0 and strengthening its relationship to risk management and mitigation. NEMA 

has long supported the need for, and understood the importance of, a strong, welldefined, and clear governance role in cybersecurity and data risk management.

5. NEMA supports the direction to emphasize the importance of supply chain risk 

management (“C-SCRM”) in the CSF 2.0, how it is integrated in the framework’s Govern 

Function, and how well it is integrated across the other five functions. The integration of

the Govern Function will allow organizations to establish appropriate supply chain risk 
3

management regimes, with roles and responsibilities, and risk mitigation processes 

which are consistent with an organization’s related capabilities. Its integration across 

the other five functions will provide a basis for supplier cybersecurity requirements that

can be passed down to third party material suppliers and vendors. A supplier can then

utilize existing techniques and best practices for managing and mitigating third party

cybersecurity risks, including classifying supplier types/categories, vetting 

questionnaires; continuous risk monitoring through tools such as security ratings; and 

Service Level Agreements.

6. NEMA supports the direction of the CSF 2.0 to clarify the understanding and focus of 

cybersecurity measurement and assessment through tiers on cybersecurity 

governance, risk management, and third-party considerations.

NEMA provides the following general comments and recommendations on the 

Implementation Examples Draft:

1. NEMA supports the action-oriented implementation examples listed throughout each 

category and subcategory.

2. In subcategory GV.SC-05, there are several implementation examples that use the term 

contractually with respect to cybersecurity requirements of a supplier. NEMA agrees 

that, depending on the environment and risk assessment, a contract is an appropriate 

way to specify these types of requirements. It should also be noted that there are other 

methods suppliers utilize to address cybersecurity requirements, including the

documentation of a product’s examination or evaluation to a certain cybersecurity 

standard, and the documentation of a product stating utilization of a Secure 

Development Life Cycle which places security front and center during the product 

development.

The electroindustry will continue to be an active participant in this process. If you have any 

questions on these comments, please contact Steve Griffith, Executive Director, 

Respectfully,

Spencer Pederson

Senior Vice President, Public Affairs