Framework for Improving Critical 

Infrastructure Cybersecurity

Implementation of Executive Order 13636

19 February 2015

cyberframework@nist.gov
The National Institute of Standards and Technology Web site is 

available at http://www.nist.gov

NIST Computer Security Division Computer Security Resource 

Center is available at http://csrc.nist.gov/

The Framework for Improving Critical Infrastructure Cybersecurity

and related news and information are available at 

www.nist.gov/cyberframework

For additional Framework info and help cyberframework@nist.gov

Resources

Where to Learn More and Stay Current
About NIST

• Part of the U.S. Department of 

Commerce

• NIST’s mission is to develop 

and promote measurement, 

standards, and technology to 

enhance productivity, facilitate 

trade, and improve the quality 

of life.

• 3,000 employees

• 2,700 guest researchers

• 1,300 field staff in partner 

organizations 

• Two main locations: 

Gaithersburg, MD and 

Boulder, CO

NIST Priority Research Areas

National Institute of Standards and Technology (NIST)

Advanced Manufacturing

IT and Cybersecurity

Healthcare

Forensic Science

Disaster Resilience

Cyber-physical Systems

Advanced 

Communications

4
• Role in cybersecurity began in 1972 with the development of the Data Encryption 

Standard – began when commercial sector also has a legitimate need for 

cryptography, including in ATMs. 

• Charter for both public and private sectors

• Non-regulatory

• Using widely-accepted standards helps create competitive markets around market 

need through combinations of price, quality, performance, and value to consumers. It 

then promotes faster diffusion of these technologies throughout industry.

• Ensure timely availability of standards, and associated testing, that address 

identified NIST IT Laboratory priorities, including national priorities established in 

statute or administration policy;

• Achieve cost-efficient, timely and effective solutions to legitimate regulatory, 

procurement and policy objectives;

• Promote standards and standardization systems that enable innovation and foster 

US competitiveness; and

• Facilitate international trade and avoid the creation of unnecessary obstacles to 

trade.

5

The Role of NIST
Executive Order: 

Improving Critical Infrastructure Cybersecurity

“It is the policy of the United States to enhance the security and resilience of 

the Nation’s critical infrastructure and to maintain a cyber environment that 

encourages efficiency, innovation, and economic prosperity while promoting 

safety, security, business confidentiality, privacy, and civil liberties” 

President Barack Obama 

Executive Order 13636, Feb. 12, 2013

• The National Institute of Standards and Technology (NIST) was directed to 

work with stakeholders to develop a voluntary framework for reducing cyber 

risks to critical infrastructure

• Version 1.0 of the framework was released on Feb. 12, 2014, along with a 

roadmap for future work

6
Based on the Executive Order, the Cybersecurity 

Framework Must

• Include a set of standards, methodologies, procedures, and 

processes that align policy, business, and technological approaches 

to address cyber risks

• Provide a prioritized, flexible, repeatable, performance-based, and 

cost-effective approach, including information security measures 

and controls, to help owners and operators of critical infrastructure

identify, assess, and manage cyber risk 

• Identify areas for improvement to be addressed through future 

collaboration with particular sectors and standards-developing 

organizations 

• Be consistent with voluntary international standards

7
Development of the Framework

8

Engage the 

Framework 

Stakeholders

Collect, 

Categorize, 

and Post RFI 

Responses

Analyze RFI 

Responses

Identify 

Framework 

Elements

Prepare and 

Publish 

Framework

EO 13636 Issued – February 12, 2013 

NIST Issues RFI – February 26, 2013

1

st Framework Workshop – April 03, 2013

Completed – April 08, 2013

Identify Common Practices/Themes – May 15, 2013

2

nd Framework Workshop at CMU – May 2013

Draft Outline of Preliminary Framework – June 2013

3

rd Workshop at UCSD – July 2013

4

th Workshop at UT Dallas – September 2013

5

th Workshop at NC State – November 2013

Published Framework – February 2014

Ongoing Engagement:

Open public comment 

and review encouraged 

and promoted throughout 

the process

cyberframework@nist.gov
Framework Components

9

Describes how cybersecurity 

risk is managed by an organization 

and degree the risk management 

practices exhibit key characteristics

Aligns industry standards and 

best practices to the Framework 

Core in a particular 

implementation scenario

Supports prioritization and 

measurement while 

factoring in business 

needs

Cybersecurity activities and 

informative references, 

organized around particular 

outcomes 

Enables 

communication of cyber 

risk across an 

organization 

Framework 

Core

Framework 

Implementation 

Tiers

Framework 

Profile
Framework Core

10

What assets need protection?

What safeguards are 

available?

What techniques can identify 

incidents?

What techniques can contain 

impacts of incidents?

What techniques can restore 

capabilities?
Framework Core Excerpt

11
Framework Profile

12

• Alignment of Functions, Categories, and Subcategories 

with business requirements, risk tolerance, and resources 

of the organization

• Enables organizations to establish a roadmap for reducing 

cybersecurity risk that is well aligned with organizational 

and sector goals, considers legal/regulatory requirements 

and industry best practices, and reflects risk management 

priorities

• Can be used to describe current state or desired target 

state of cybersecurity activities
Framework from Executives to Operations

13
Framework Implementation Tiers

14

• Feedback indicated the need for the Framework to allow for 

flexibility in implementation and bring in concepts of maturity 

models.

• Responding to feedback, Framework Implementation Tiers 

were proposed to reflect how an organization implements 

the Framework Core functions and manages its risk.

• The Tiers are progressive, ranging from Partial (Tier 1) to 

Adaptive (Tier 4), with each Tier building on the previous 

Tier.

• The Tier characteristics are defined at the organizational 

level and are applied to the Framework Core to determine 

how a category is implemented.
Uses of the Cybersecurity Framework

The Framework is designed to complement existing business and 

cybersecurity operations, and can be used to:

• Understand security status

• Establish / Improve a cybersecurity program

• Communicate cybersecurity requirements with stakeholders, 

including partners and suppliers

• Identify opportunities for new or revised standards 

• Identify tools and technologies to help organizations use the 

Framework

• Integrate privacy and civil liberties considerations into a 

cybersecurity program

15
Why You Should Consider Adopting the Framework

16

Benefits Features

• Reduces time and expense 

of starting an information 

security program

• Reduces risk within current 

information security 

programs by identifying 

areas for improvement

• Increases efficiencies and 

reduce the possibility of 

miscommunication within 

your information security 

program and with other 

organizations such as 

partners, suppliers, 

regulators, and auditors

• Organizes reconciliation and deconfliction of legislation, regulation, 

policy, and industry best practice (Core)

• Guides organization and management of 

and information security program (Core)

• Measures current state and expresses 

desired state (Profile)

• Enables investment decisions to address 

gaps in current state (Profile)

• Communicates cybersecurity

requirements with stakeholders, 

including partners and suppliers (Profile)

• Enables informed trade-off analysis of 

expenditure versus risk (Tiers)
Key Points about the Cybersecurity Framework

• It’s a framework, not a prescription

• It provides a common language and systematic methodology for 

managing cyber risk 

• It does not tell a company how much cyber risk is tolerable, nor 

does it claim to provide “the one and only” formula for 

cybersecurity

• Having a common lexicon to enable action across a very diverse 

set of stakeholders will enable the best practices of elite 

companies to become standard practices for everyone

• The framework is a living document

• It is intended to be updated over time as stakeholders learn from 

implementation, and as technology and risks change

• That’s one reason why the framework focuses on questions an 

organization needs to ask itself to manage its risk. While 

practices, technology, and standards will change over time—

principals will not

17
Framework Roadmap Items

• The Executive Order calls for the framework to “identify areas for 

improvement that should be addressed through future collaboration 

with particular sectors and standards-developing organizations” 

• High-priority areas for development, alignment, and collaboration 

were identified based on stakeholder input:

• Authentication 

• Automated Indicator Sharing

• Conformity Assessment 

• Cybersecurity Workforce

• Data Analytics

• Federal Agency Cybersecurity Alignment

• International Aspects, Impacts, and Alignment

• Supply Chain Risk Management

• Technical Privacy Standards

18
Since the 12 February 2014 Release of Framework 1.0

19

6

th Cybersecurity Framework 

Workshop

Goal: Raise awareness, encourage use as a 

tool, highlight examples of sector-specific efforts, 

implementation efforts, gather feedback

Update on the Cybersecurity Framework

Summary posted that includes analysis of RFI 

responses, feedback from the 6th workshop, an 

update on Roadmap areas, and next steps

Request for Information: Experience with 

the Cybersecurity Framework

Questions focused on: awareness, experiences, and 

roadmap areas

1 Year Anniversary of the Release

NIST Cybersecurity Framework site update to 

include: FAQs, Upcoming Events, and Industry 

Resources. Ongoing, targeted outreach continues

February 13, 2015

White House Releases Fact 

Sheet on Cybersecurity and 

Consumer Protection
Examples of Framework Industry Resources

20

The Cybersecurity Framework

in Action: An Intel Use Case

Energy Sector Cybersecurity Framework 

Implementation Guidance

Cybersecurity Guidance 

for Small Firms

Process Control System 

Security Guidance for 

the Water Sector

Other online communities of interest
Near Term Framework Activities

21

In summary, “Collect, Reflect, and Connect” – understand where 

industry is having success, help others understand those 

successes, and facilitate relationships that support understanding 

and use

• Continue education efforts, including creation of self-help and 

re-use materials for those who are new to the Framework

• Continue awareness and outreach with an eye toward industry 

communities who are still working toward basal Framework 

knowledge and implementation

• Educate on the relationship between Framework and the larger 

risk management process, including how organizations can 

use Tiers

• To allow for adoption, Framework version 2.0 is not planned for 

the near term
The National Institute of Standards and Technology Web site is 

available at http://www.nist.gov

NIST Computer Security Division Computer Security Resource 

Center is available at http://csrc.nist.gov/

The Framework for Improving Critical Infrastructure Cybersecurity

and related news and information are available at 

www.nist.gov/cyberframework

For additional Framework info and help cyberframework@nist.gov

Your presenter today was Matt Barrett, Cybersecurity Framework 

Program Manager (matthew.barrett@nist.gov)

Resources

Where to Learn More and Stay Current