The Framework for Improving 

Critical Infrastructure 

Cybersecurity

December 2017

cyberframework@nist.gov
About NIST

• Agency of U.S. Department of 

Commerce

• NIST’s mission is to develop 

and promote measurement, 

standards and technology to 

enhance productivity, facilitate 

trade, and improve the quality 

of life.

• Federal, non-regulatory 

agency around since 1901

NIST Cybersecurity

• Cybersecurity since the 1970s

• Computer Security Resource 

Center – csrc.nist.gov

NIST Priority Research Areas

National Institute of Standards and Technology

Advanced Manufacturing

IT and Cybersecurity

Healthcare

Forensic Science

Disaster Resilience

Cyber-physical Systems

Advanced 

Communications

2
Cybersecurity Framework Initial Charter

Improving Critical Infrastructure Cybersecurity

February 12, 2013

“It is the policy of the United States to 

enhance the security and resilience of 

the Nation’s critical infrastructure and 

to maintain a cyber environment that 

encourages efficiency, innovation, and 

economic prosperity while promoting 

safety, security, business 

confidentiality, privacy, and civil 

liberties” 

Executive Order 13636

3

December 18, 2014

Amends the National Institute of Standards and 

Technology Act (15 U.S.C. 272(c)) to say:

“...on an ongoing basis, facilitate and 

support the development of a 

voluntary, consensus-based, 

industry-led set of standards, 

guidelines, best practices, 

methodologies, procedures, and 

processes to cost-effectively reduce 

cyber risks to critical infrastructure”

Cybersecurity Enhancement Act of 

2014 (P.L. 113-274)
Requirements from the Executive Order

• Include a set of standards, methodologies, procedures, 

and processes that align policy, business, and 

technological approaches to address cyber risks

• Provide a prioritized, flexible, repeatable, performancebased, and cost-effective approach, including 

information security measures and controls, to help 

owners and operators of critical infrastructure identify, 

assess, and manage cyber risk 

• Identify areas for improvement to be addressed through 

future collaboration with particular sectors and 

standards-developing organizations 

• Be consistent with voluntary international standards

4
5

Multistakeholder Development Process

Engage the 

Framework 

Stakeholders

Collect, 

Categorize, 

and Post RFI 

Responses

Analyze RFI 

Responses

Identify 

Framework 

Elements

Prepare and 

Publish 

Framework

EO 13636 Issued – February 12, 2013 

NIST Issues RFI – February 26, 2013

1st Framework Workshop – April 03, 2013

Completed – April 08, 2013

Identify Common Practices/Themes – May 15, 2013

2nd Framework Workshop at CMU – May 2013

Draft Outline of Preliminary Framework – June 2013

3rd Workshop at UCSD – July 2013

4th Workshop at UT Dallas – Sept 2013

5th Workshop at NC State – Nov 2013

Published Framework – Feb 2014

Ongoing Engagement:

Open public comment 

and review encouraged 

and promoted 

throughout the 

process...

and to this day
Key Attributes

It’s flexible to many sectors

• Meant to be customized.

It’s a catalog of cybersecurity outcomes

• Provides a common language and systematic methodology for 

managing cyber risk. 

• Does not tell an organization how much cyber risk is tolerable, nor 

provide “the one and only” formula for cybersecurity.

It’s meant to be paired

• Take advantage of great pre-existing things

It’s a living document

• Enable best practices to become standard practices for everyone

• Can be updated as technology and threats changes.

• Evolves faster than regulation and legislation

• Can be updated as stakeholders learn from implementation 6
Cybersecurity Framework Current Charter

Improving Critical Infrastructure Cybersecurity

February 12, 2013

“It is the policy of the United States to 

enhance the security and resilience of 

the Nation’s critical infrastructure and 

to maintain a cyber environment that 

encourages efficiency, innovation, and 

economic prosperity while promoting 

safety, security, business 

confidentiality, privacy, and civil 

liberties” 

Executive Order 13636

7

December 18, 2014

Amends the National Institute of Standards and 

Technology Act (15 U.S.C. 272(c)) to say:

“...on an ongoing basis, facilitate and 

support the development of a 

voluntary, consensus-based, 

industry-led set of standards, 

guidelines, best practices, 

methodologies, procedures, and 

processes to cost-effectively reduce 

cyber risks to critical infrastructure”

Cybersecurity Enhancement Act of 

2014 (P.L. 113-274)
Cybersecurity Framework Components

Describes how cybersecurity 

risk is managed by an organization 

and degree the risk management practices 

exhibit key characteristics

Aligns industry standards 

and best practices to the 

Framework Core in an 

implementation

scenario

Supports prioritization

and measurement

while factoring in

business needs

Cybersecurity activities 

and informative 

references, organized 

around particular 

outcomes 

Enables 

communication of 

cyber risk across 

an organization 

Framework 

Core

Framework 

Implementation 

Tiers

Framework 

Profile

8
Key Properties of Cyber Risk Management

9

Risk Management 

Process

Integrated Risk Management Program

External

Participation
Implementation Tiers

10

1 2 3 4

Partial Risk 

Informed

Repeatable Adaptive

Risk 

Management 

Process

The functionality and repeatability of cybersecurity risk 

management

Integrated Risk 

Management 

Program

The extent to which cybersecurity is considered in broader 

risk management decisions

External 

Participation

The degree to which the organization benefits my sharing or 

receiving information from outside parties

10
Intel Adaptation of Implementation Tiers

11

1 2 3 4

Partial Risk 

Informed

Repeatable Adaptive

People Whether people have assigned roles, regular training, take 

initiative by becoming champions, etc.

Process Risk Management Process +

Integrated Risk Management Program

Technology Whether tools are implemented, maintained, evolved, 

provide effectiveness metrics, etc.

Ecosystem External Participation +

Whether the organization understands its role in the 

ecosystem, including external dependencies with partners

11

Case Study Available At:

https://www.nist.gov/cybersecuri

ty-framework/cybersecurityframework-industry-resources
Core

A Catalog of Cybersecurity Outcomes

Function

What processes and 

assets need 

protection?

Identify • Understandable by 

everyone

• Applies to any type of 

risk management

• Defines the entire 

breadth of 

cybersecurity

• Spans both prevention 

and reaction

What safeguards are 

available? Protect

What techniques can 

identify incidents? Detect

What techniques can 

contain impacts of 

incidents?

Respond

What techniques can 

restore capabilities? Recover

12
Core

A Catalog of Cybersecurity Outcomes

Function Category

What processes and 

assets need 

protection?

Identify

Asset Management

Business Environment

Governance

Risk Assessment

Risk Management Strategy

What safeguards are 

available? Protect

Access Control

Awareness and Training

Data Security

Information Protection Processes & 

Procedures

Maintenance

Protective Technology

What techniques can 

identify incidents? Detect

Anomalies and Events

Security Continuous Monitoring

Detection Processes

What techniques can 

contain impacts of 

incidents?

Respond

Response Planning

Communications

Analysis

Mitigation

Improvements

What techniques can 

restore capabilities? Recover

Recovery Planning

Improvements

Communications 13
Core – Example

Cybersecurity Framework Component

14

Function Category Subcategory Informative Reference

Identify Business 

Environment

ID.BE-3: Priorities 

for organizational 

mission, objectives, 

and activities are 

established and 

communicated

COBIT 5 APO02.01, 

APO02.06, APO03.01

ISA 62443-2-1:2009 

4.2.2.1, 4.2.3.6

NIST SP 800-53 Rev. 4 

PM-11, SA-14

14
15

Core – Example

Cybersecurity Framework Component

Function Category Subcategory Informative Reference
A Common Language

Foundational for Integrated Teams

ID PR DE RS RC

16

ID

PR

DE

RS

RC

Cybersecurity

Professionals

Highly technical and 

specialized language

Senior

Executives

IT, OT, 

Contracts, 

Marketing, 

Business

Professionals
Core for Greater Cybersecurity Participation

A Catalog of Cybersecurity Outcomes

5

22

98

287

17

Functions

Informative 

References

Subcategories

Categories

Reporting

“Organizational 

Inputs”
Profile

Customizing Cybersecurity Framework

18

Identify

Protect

Detect

Respond

Recover

Ways to think about a Profile:

• A customization of the Core for a 

given sector, subsector, or 

organization

• A fusion of business/mission logic 

and cybersecurity outcomes

• An alignment of cybersecurity requirements with 

operational methodologies

• A basis for assessment and expressing target state

• A decision support tool for cybersecurity risk 

management
Cybersecurity Program Objectives

Three Things All Cybersecurity Programs Must Do

• Support Mission/Business Objectives

• Fulfill Cybersecurity Requirements

• Manage Vulnerability and Threat Associated 

with the Technical Environment

19
Cybersecurity Program Objectives

Three Things All Cybersecurity Programs Must Do

• Support Mission/Business Objectives

• Fulfill Cybersecurity Requirements

• Manage Vulnerability and Threat Associated 

with the Technical Environment

...accomplished through the processes of:

• Dependency Analysis

• Requirements/Compliance Management

• Threat and Vulnerability Management

20
Profile Foundational Information

A Profile Can be Created from Three Types of Information

21

Subcategory

1

2

...

98

Cybersecurity

Requirements

Legislation

Regulation

Internal & External Policy

Technical 

Environment

Threats

Vulnerabilities

1

2 3

Business 

Objectives

Objective 1

Objective 2

Objective 3

Operating

Methodologies

Controls Catalogs

Technical Guidance
Framework Seven Step Process

Gap Analysis Using Framework Profiles

• Step 1: Prioritize and Scope

• Step 2: Orient

• Step 3: Create a Current Profile

• Step 4: Conduct a Risk Assessment

• Step 5: Create a Target Profile

• Step 6: Determine, Analyze, and Prioritize Gaps

• Step 7: Implementation Action Plan

22
Resource and Budget Decisioning

What Can You Do with a CSF Profile

23

Subcategory Priority Gaps Budget

Year 1 

Activities

Year 2 

Activities

1 moderate small $$$ X

2 high large $$ X

3 moderate medium $ X

... ... ... ...

98 moderate none $$ reassess

As-Is Year 1

To-Be

Year 2

To-Be

Framework supports operating decisions and improvement
Supporting Risk Management with Framework

24
Operate

Use Cybersecurity Framework Profiles to distribute and organize labor

25

Subcats Reqs Priorities Who What When Where How

1 A, B High

2 C, D, E, F High

3 G, H, I, J Low

... ... ...

98 XX, YY, ZZ Mod

Reqs Priorities
Common Patterns of Use

• Integrate the Functions into Your Leadership Vocabulary and 

Management Tool Sets

• Determine Optimal and Measure Current Risk Management 

Using Implementation Tiers

• Reflect on Business Environment, Governance, and Risk 

Management Strategy Categories

• Develop a Profile of Cybersecurity Priorities, Leveraging 

(Sub)Sector Profiles When Available

26
Small Business Use

If your organization has a cybersecurity risk executive:

• Integrate the Functions into Your Leadership Vocabulary and Management 

Tool Sets

• Determine Optimal and Measure Current Risk Management Using 

Implementation Tiers

• Reflect on Business Environment, Governance, and Risk Management 

Strategy Categories

• Develop a Profile of Cybersecurity Priorities, Leveraging (Sub)Sector Profiles

When Available

If your organization does not have a cybersecurity risk executive, 

but does have technologist(s):

• Consider the recommendations in Small Business Information Security: 

The Fundamentals (NIST Interagency Report 7621 revision 1)

If your organization does not have those people:

• Use the National Initiative for Cybersecurity Education (NICE) 

Cybersecurity Workforce Framework (NIST Special Publication 800-181) to 

determine relevant knowledge, skills, and abilities for a consultant or employee

27
Industry Resources

www.nist.gov/cyberframework/industry-resources

28

Over 70 Unique Resources for Your Understanding and Use!
Examples of Framework Industry Resources

www.nist.gov/cyberframework/industry-resources

The Cybersecurity Framework

in Action: An Intel Use Case

Financial Services Sector Specific 

Cybersecurity “Profile” 

American Water Works Association’s 

Process Control System Security 

Guidance for the Water Sector

Cybersecurity Risk Management and Best Practices 

Working Group 4: Final Report

29

Italy’s National Framework for 

Cybersecurity
Examples of U.S. State & Local Use

www.nist.gov/cyberframework/industry-resources

30

Texas, Department of Information Resources

• Aligned Agency Security Plans with Framework

• Aligned Product and Service Vendor Requirements with Framework

Houston, Greater Houston Partnership

• Integrated Framework into their Cybersecurity Guide

• Offer On-Line Framework Self-Assessment

North Dakota, Information Technology Department

• Allocated Roles & Responsibilities using Framework

• Adopted the Framework into their Security Operation Strategy

National Association of State CIOs

• 2 out of 3 CIOs from the 2015 NASCIO Awards cited 

Framework as a part of their award-winning strategy 

New Jersey

• Developed a cybersecurity framework that aligns controls and 

procedures with Framework
Recent NIST Work Products

www.nist.gov/cyberframework/industry-resources

Maritime Profile

U.S. Coast Guard Bulk Liquid 

Transport Profile

Self-Assessment Criteria

Baldrige Cybersecurity 

Excellence Builder

31

Manufacturing Profile

NIST Discrete Manufacturing 

Cybersecurity Framework Profile 
Roadmap Concepts

Roadmap to Improving Critical Infrastructure Cybersecurity

The Roadmap:

• identifies key areas of development, alignment, and 

collaboration

• provides a description of activities related to the Framework 

Roadmap items are generally:

• Topics that are meaningful to critical infrastructure 

cybersecurity risk management

• Focus areas of both private sector and the federal 

government

• Related to Framework, but managed as separate efforts

11
Work in Progress: Framework Roadmap

Authentication 

Automated Indicator Sharing

Conformity Assessment 

Cybersecurity Workforce

Data Analytics

Federal Agency Cybersecurity Alignment

International Aspects, Impacts, and Alignment

Supply Chain Risk Management

Technical Privacy Standards

33
Cybersecurity Executive Order 13800

Strengthening the Cybersecurity of Federal Networks and Critical Infrastructure

Risk Management:

(ii) “...agency head shall use The Framework” and

“...provide a risk management report within 90 days 

containing a description of the “...agency's action plan 

to implement the Framework.”

11
1. Integrate enterprise and cybersecurity risk 

management

2. Manage cybersecurity requirements

3. Integrate and align cybersecurity and 

acquisition processes

4. Evaluate organizational cybersecurity

5. Manage the cybersecurity program

6. Maintain a comprehensive understanding of 

cybersecurity risk (supports RMF Authorize)

7. Report cybersecurity risks (supports RMF Monitor)

8. Inform the tailoring process (supports RMF Select)

35

Proposed U.S. Federal Usage

NIST IR 8170 The Cybersecurity Framework: Implementation Guidance for Federal Agencies
Special Publication 800

-39

Level 1

Org

Level 2

Mission/ 

Business 

Processes

Level 3

System

36

Proposed Federal Usage

NIST IR 8170 The Cybersecurity Framework: Implementation Guidance for Federal Agencies
Special Publication 800

-39

Level 1

Org

1. Integrate enterprise and cybersecurity risk 

management

Level 2

Mission/ 

Business 

Processes

2. Manage cybersecurity requirements

3. Integrate and align cybersecurity and acquisition 

processes

4. Evaluate organizational cybersecurity

5. Manage the cybersecurity program

6. Maintain a comprehensive understanding of 

cybersecurity risk

supports RMF Authorize

7. Report cybersecurity risks

supports RMF Monitor

Level 3

System

8. Inform the tailoring process 

supports RMF Select

37

Proposed Federal Usage

NIST IR 8170 The Cybersecurity Framework: Implementation Guidance for Federal Agencies
Framework Roadmap Items

Authentication 

Automated Indicator Sharing

Conformity Assessment 

Cybersecurity Workforce

Data Analytics

Federal Agency Cybersecurity Alignment

International Aspects, Impacts, and Alignment

Supply Chain Risk Management

Technical Privacy Standards

38
Cybersecurity Framework Use

• Used by over 30% of U.S. organizations, trending to 

50% (Gartner, 2015, https://www.gartner.com/webinar/3163821)

• Required within the United States federal 

government

• Japanese translation by Information-technology 

Promotion Agency

• Italian translation and adaptation within Italy’s 

National Framework for Cybersecurity

• Hebrew translation and adaptation by Government 

of Israel

• Bermuda uses it within government and 

recommends it to industry

• Focus of International Organization for 

Standardization & International Electrotechnical

Commission 39
Ways to Help

Stakeholder Recommended Actions

Stakeholders should consider activities to:

• Customize Framework for your sector or community

• Publish a sector or community Profile or relevant 

“crosswalk” 

• Advocate for the Framework throughout your sector 

or community, with related sectors and communities. 

• Publish “summaries of use” or case studies of your 

Framework implementation.

• Submit a paper during the NIST call for abstracts

• Share your Framework resources with NIST at 

cyberframework@nist.gov. 

40
Resources

Where to Learn More and Stay Current

Framework for Improving Critical Infrastructure 

Cybersecurity and related news and 

information: 

www.nist.gov/cyberframework

Additional cybersecurity resources: 

http://csrc.nist.gov/

Questions, comments, ideas: 

cyberframework@nist.gov

19