Framework for Improving 

Critical Infrastructure Cybersecurity

Version 1.1 Draft 2

National Institute of Standards and Technology

Revised December 5, 2017
Revised December 5, 2017 Cybersecurity Framework Version 1.1 Draft 2

ii DRAFT

1 Note	to	Reviewers	on	the	Update	and	Next	Steps

2 Version 1.1 Draft 2 of Cybersecurity Framework refines, clarifies, and enhances Version 1.0 

3 issued in February 2014. It incorporates comments received on Version 1.1 Draft 1.

4 Version 1.1 is intended to be implemented by first-time and current Framework users. Current 

5 users should be able to implement Version 1.1 with minimal or no disruption; compatibility with 

6 Version 1.0 has been an explicit objective.

7 As with Version 1.0, Version 1.1 users are encouraged to customize the Framework to maximize 

8 individual organizational value.

9 The impetus to change Version 1.0 and the proposed changes were based on:

10 • Feedback and frequently asked questions to NIST since release of Framework Version 

11 1.0;

12 • 105 responses to the December 2015 request for information (RFI), Views on the 

13 Framework for Improving Critical Infrastructure Cybersecurity; and

14 • Comments by approximately 800 attendees at a workshop on April 6-7, 2016.

15 In addition, NIST previously released Version 1.0 of the Cybersecurity Framework with a 

16 companion document, NIST Roadmap for Improving Critical Infrastructure Cybersecurity. This 

17 Roadmap highlighted key “areas of improvement” for further development, alignment, and 

18 collaboration. Through private and public-sector efforts, some areas of improvement have 

19 advanced enough to be included in this draft Framework Version 1.1.

20 This Version 1.1 Draft 2 was prompted and informed by:

21 • Over 120 comments on a January 10, 2017, proposed first draft Version 1.1; and

22 • Comments and discussion by approximately 500 attendees at a workshop held on May 

23 16-17, 2017.

24 Beyond key refinements, clarifications, and enhancements from the first draft, revisions in this 

25 draft include:

Update Description of Update

Clarifications and revisions 

to cybersecurity 

measurement language

Revised and retitled Section 4.0 to emphasize the correlation of 

business results to cybersecurity risk management. This section now 

highlights the multiple uses of measurement, with an emphasis on the 

role of measurements in self-assessment. The new title is SelfAssessing Cybersecurity Risk with the Framework.

Clarification of the use of 

the Framework to manage

cybersecurity within supply 

chains

Refined Section 3.3 Communicating Cybersecurity Requirements with 

Stakeholders to help users better understand managing cybersecurity 

within supply chains and to incorporate that information into the 

External Participation property of Implementation Tiers.

Refinements to better 

account for authorization,

authentication, and identity 

proofing

Added a Subcategory to address authentication and some language 

refinements were made within the Identity Management and Access 

Control Category.

Consideration of 

Coordinated Vulnerability 

Disclosure

A Subcategory related to the vulnerability disclosure lifecycle was 

added.
Revised December 5, 2017 Cybersecurity Framework Version 1.1 Draft 2

iii DRAFT

Removal of Federal 

Alignment Section

With publication of U.S. Federal policy, memorandum, and guidance 

(e.g., Executive Order 13800, OMB Memorandum M-17-25, and the 

draft NIST Interagency Report 8170) on Cybersecurity Framework 

use, federal applicability statements are no longer needed in the 

Framework publication.

26 A more detailed review of Version 1.1 refinements, clarifications, and enhancements can be 

27 found in Appendix D.

28 NIST is seeking public comment on this Framework Version 1.1 Draft 2, specifically regarding 

29 the following:

30 • Do the revisions in Version 1.1 Draft 2 reflect the changes in the current cybersecurity 

31 ecosystem (threats, vulnerabilities, risks, practices, technological approaches), including

32 those developments in the Roadmap items?

33 • For those using Version 1.0, would the proposed changes affect their current use of the 

34 Framework? If so, how?

35 • For those not currently using Version 1.0, would the proposed changes affect their 

36 decision about using the Framework? If so, how?

37 Feedback and comments should be directed to cyberframework@nist.gov. After reviewing 

38 public comments regarding the Version 1.1 Draft 2, NIST intends to publish a final Framework 

39 Version 1.1 in early calendar year 2018.

40

41

42

43
Revised December 5, 2017 Cybersecurity Framework Version 1.1 Draft 2

iv DRAFT

44 Table of Contents

45 Note to Reviewers on the Update and Next Steps.......................................................................... ii

46 Executive Summary.........................................................................................................................1

47 1.0 Framework Introduction .......................................................................................................3

48 2.0 Framework Basics.................................................................................................................7

49 3.0 How to Use the Framework ................................................................................................14

50 4.0 Self-Assessing Cybersecurity Risk with the Framework....................................................21

51 Appendix A: Framework Core.......................................................................................................23

52 Appendix B: Glossary....................................................................................................................46

53 Appendix C: Acronyms .................................................................................................................49

54 Appendix D: Revisions and Updates.............................................................................................50

55 List of Figures

56 Figure 1: Framework Core Structure .............................................................................................. 7

57 Figure 2: Notional Information and Decision Flows within an Organization .............................. 13

58 Figure 3: Cyber Supply Chain Relationships................................................................................ 17

59 List of Tables

60 Table 1: Function and Category Unique Identifiers ..................................................................... 24

61 Table 2: Framework Core ............................................................................................................. 25

62 Table 3: Framework Glossary....................................................................................................... 46

63 Table 4: Changes in Framework Version 1.1 ............................................................................... 50
Revised December 5, 2017 Cybersecurity Framework Version 1.1 Draft 2

1 DRAFT

64 Executive	Summary

65 The national and economic security of the United States depends on the reliable functioning of 

66 critical infrastructure. Cybersecurity threats exploit the increased complexity and connectivity of 

67 critical infrastructure systems, placing the Nation’s security, economy, and public safety and 

68 health at risk. Similar to financial and reputational risk, cybersecurity risk affects a company’s 

69 bottom line. It can drive up costs and affect revenue. It can harm an organization’s ability to 

70 innovate and to gain and maintain customers.

To better address these risks, the Cybersecurity Enhancement Act of 20141 71 (CEA) statutorily 

72 updated the role of the National Institute of Standards and Technology (NIST) to include 

73 identifying and developing cybersecurity risk frameworks for voluntary use by critical 

74 infrastructure owners and operators. Through CEA, NIST must identify “a prioritized, flexible, 

75 repeatable, performance-based, and cost-effective approach, including information security 

76 measures and controls that may be voluntarily adopted by owners and operators of critical 

77 infrastructure to help them identify, assess, and manage cyber risks.” This formalized NIST’s 

78 previous work developing Framework version 1.0 under Executive Order 13636, “Improving 

79 Critical Infrastructure Cybersecurity” (February 2013), and provided guidance for future 

80 Framework evolution. The Framework that was developed under EO 13636 and continues to 

81 evolve according to CEA uses a common language to address and manage cybersecurity risk in a 

82 cost-effective way based on business needs without placing additional regulatory requirements 

83 on businesses.

84 The Framework focuses on using business drivers to guide cybersecurity activities and 

85 considering cybersecurity risks as part of the organization’s risk management processes. The 

86 Framework consists of three parts: the Framework Core, the Framework Profile, and the 

87 Framework Implementation Tiers. The Framework Core is a set of cybersecurity activities, 

88 outcomes, and informative references that are common across sectors and critical infrastructure. 

89 Elements of the Core provide detailed guidance for developing individual organizational 

90 Profiles. Through use of Profiles, the Framework will help an organization to align and prioritize 

91 its cybersecurity activities with its business requirements, risk tolerances, and resources. The 

92 Tiers provide a mechanism for organizations to view and understand the characteristics of their 

93 approach to managing cybersecurity risk, which will help in prioritizing and achieving 

94 cybersecurity objectives.

95 While this document was developed to improve cybersecurity risk management in critical 

96 infrastructure, the Framework can be used by organizations in any sector or community. The 

97 Framework enables organizations – regardless of size, degree of cybersecurity risk, or 

98 cybersecurity sophistication – to apply the principles and best practices of risk management to 

99 improving security and resilience.

100 The Framework provides a common organization and structure to today’s multiple approaches to 

101 cybersecurity by assembling standards, guidelines, and practices that are working effectively 

 1

See 15 U.S.C. § 272(e)(1)(A)(i). The Cybersecurity Enhancement Act of 2014 (S.1353) became public law 113-

274 on December 18, 2014 and may be found at: https://www.congress.gov/bill/113th-congress/senatebill/1353/text.
Revised December 5, 2017 Cybersecurity Framework Version 1.1 Draft 2

2 DRAFT

102 today. Moreover, because it references globally recognized standards for cybersecurity, the 

103 Framework can serve as a model for international cooperation on strengthening critical 

104 infrastructure cybersecurity. The Framework offers a flexible way to address cybersecurity, 

105 including cybersecurity’s effect on physical, cyber, and people domains. It is applicable to 

106 organizations relying on technology, whether their cybersecurity focus is primarily on

107 information technology (IT), industrial control systems (ICS), cyber-physical systems (CPS), or 

108 connected devices more generally, including the Internet of Things (IoT). Applied to the people

109 domain, the Framework can assist organizations in addressing cybersecurity as it affects the 

110 privacy of customers, employees, and other parties.

111 The Framework is not a one-size-fits-all approach to managing cybersecurity risk for critical 

112 infrastructure. Organizations will continue to have unique risks – different threats, different 

113 vulnerabilities, different risk tolerances – and how they implement the practices in the 

114 Framework will vary. Organizations can determine activities that are important to critical service 

115 delivery and can prioritize investments to maximize the impact of each dollar spent. Ultimately, 

116 the Framework is aimed at reducing and better managing cybersecurity risks.

117 The Framework is a living document and will continue to be updated and improved as industry 

118 provides feedback on implementation. NIST will continue coordinating with the private sector 

119 and government agencies at all levels. As the Framework is put into greater practice, additional 

120 lessons learned will be integrated into future versions. This will ensure the Framework is 

121 meeting the needs of critical infrastructure owners and operators in a dynamic and challenging 

122 environment of new threats, risks, and solutions.

123 Expanded and more effective use and sharing of best practices of this voluntary Framework are 

124 the next steps to improve the cybersecurity of our Nation’s critical infrastructure – providing 

125 evolving guidance for individual organizations while increasing the cybersecurity posture of the 

126 Nation’s critical infrastructure and the broader economy and society.
Revised December 5, 2017 Cybersecurity Framework Version 1.1 Draft 2

3 DRAFT

127 1.0 Framework	Introduction

128 The national and economic security of the United States depends on the reliable functioning of 

129 its critical infrastructure. To strengthen the resilience of this infrastructure, the Cybersecurity 

Enhancement Act of 20142 130 (CEA) statutorily updated the role of the National Institute of 

131 Standards and Technology (NIST) to “facilitate and support the development of” cybersecurity 

132 risk frameworks. Through CEA, NIST must identify “a prioritized, flexible, repeatable, 

133 performance-based, and cost-effective approach, including information security measures and 

134 controls that may be voluntarily adopted by owners and operators of critical infrastructure to help 

135 them identify, assess, and manage cyber risks.” This formalized NIST’s previous work 

136 developing Framework version 1.0 under Executive Order 13636, “Improving Critical 

Infrastructure Cybersecurity,” issued in February 20133 137 , and provided guidance for future 

138 Framework evolution.

Critical infrastructure4 is defined in the U.S. Patriot Act of 20015 139 as “systems and assets, whether 

140 physical or virtual, so vital to the United States that the incapacity or destruction of such systems 

141 and assets would have a debilitating impact on security, national economic security, national 

142 public health or safety, or any combination of those matters.” Due to the increasing pressures 

143 from external and internal threats, organizations responsible for critical infrastructure need to 

144 have a consistent and iterative approach to identifying, assessing, and managing cybersecurity 

145 risk. This approach is necessary regardless of an organization’s size, threat exposure, or 

146 cybersecurity sophistication today.

147 The critical infrastructure community includes public and private owners and operators, and 

148 other entities with a role in securing the Nation’s infrastructure. Members of each critical 

149 infrastructure sector perform functions that are supported by the broad category of technology, 

150 including information technology (IT), industrial control systems (ICS), cyber-physical systems 

151 (CPS), and connected devices more generally, including the Internet of Things (IoT). This 

152 reliance on technology, communication, and interconnectivity has changed and expanded the 

153 potential vulnerabilities and increased potential risk to operations. For example, as technology

154 and the data it produces and processes is increasingly used to deliver critical services and support 

155 business decisions, the potential impacts of a cybersecurity incident on an organization, the 

156 health and safety of individuals, the environment, communities, and the broader economy and 

157 society should be considered. 

158 To manage cybersecurity risks, a clear understanding of the organization’s business drivers and 

159 security considerations specific to its use of technology is required. Because each organization’s 

160 risks, priorities, and systems are unique, the tools and methods used to achieve the outcomes 

161 described by the Framework will vary.

 2 See 15 U.S.C. § 272(e)(1)(A)(i). The Cybersecurity Enhancement Act of 2014 (S.1353) became public law 113-

274 on December 18, 2014 and may be found at: https://www.congress.gov/bill/113th-congress/senatebill/1353/text. 3 Executive Order no. 13636, Improving Critical Infrastructure Cybersecurity, DCPD-201300091, February 12, 

2013. https://www.gpo.gov/fdsys/pkg/CFR-2014-title3-vol1/pdf/CFR-2014-title3-vol1-eo13636.pdf 4 The DHS Critical Infrastructure program provides a listing of the sectors and their associated critical functions and 

value chains. http://www.dhs.gov/critical-infrastructure-sectors 5 See 42 U.S.C. § 5195c(e)). The U.S. Patriot Act of 2001 (H.R.3162) became public law 107-56 on October 26, 

2001 and may be found at: https://www.congress.gov/bill/107th-congress/house-bill/3162
Revised December 5, 2017 Cybersecurity Framework Version 1.1 Draft 2

4 DRAFT

162 Recognizing the role that the protection of privacy and civil liberties plays in creating greater 

163 public trust, the Framework includes a methodology to protect individual privacy and civil 

164 liberties when critical infrastructure organizations conduct cybersecurity activities. Many 

165 organizations already have processes for addressing privacy and civil liberties. The methodology 

166 is designed to complement such processes and provide guidance to facilitate privacy risk 

167 management consistent with an organization’s approach to cybersecurity risk management.

168 Integrating privacy and cybersecurity can benefit organizations by increasing customer 

169 confidence, enabling more standardized sharing of information, and simplifying operations 

170 across legal regimes.

171 The Framework remains effective and support technical innovation, because it is technology

172 neutral, while also referencing a variety of existing standards, guidelines, and practices that 

173 evolve with technology. By relying on those global standards, guidelines, and practices 

174 developed, managed, and updated by industry, the tools and methods available to achieve the 

175 Framework outcomes will scale across borders, acknowledge the global nature of cybersecurity 

176 risks, and evolve with technological advances and business requirements. The use of existing and 

177 emerging standards will enable economies of scale and drive the development of effective 

178 products, services, and practices that meet identified market needs. Market competition also 

179 promotes faster diffusion of these technologies and practices and realization of many benefits by 

180 the stakeholders in these sectors.

181 Building from those standards, guidelines, and practices, the Framework provides a common 

182 taxonomy and mechanism for organizations to:

183 1) Describe their current cybersecurity posture;

184 2) Describe their target state for cybersecurity;

185 3) Identify and prioritize opportunities for improvement within the context of a 

186 continuous and repeatable process;

187 4) Assess progress toward the target state;

188 5) Communicate among internal and external stakeholders about cybersecurity risk.

189 The Framework complements, and does not replace, an organization’s risk management process 

190 and cybersecurity program. The organization can use its current processes and leverage the 

191 Framework to identify opportunities to strengthen and communicate its management of 

192 cybersecurity risk while aligning with industry practices. Alternatively, an organization without 

193 an existing cybersecurity program can use the Framework as a reference to establish one.

194 While the Framework has been developed to improve cybersecurity risk management as it relates 

195 to critical infrastructure, it can be used by organizations in any sector of the economy or society.

196 It is intended to be useful to companies, government agencies, and not-for-profit organizations 

197 regardless of their focus or size. The common taxonomy of standards, guidelines, and practices 

198 that it provides also is not country-specific. Organizations outside the United States may also use 

199 the Framework to strengthen their own cybersecurity efforts, and the Framework can contribute 

200 to developing a common language for international cooperation on critical infrastructure 

201 cybersecurity.
Revised December 5, 2017 Cybersecurity Framework Version 1.1 Draft 2

5 DRAFT

202 1.1 Overview of the Framework

203 The Framework is a risk-based approach to managing cybersecurity risk, and is composed of 

204 three parts: the Framework Core, the Framework Implementation Tiers, and the Framework 

205 Profiles. Each Framework component reinforces the connection between business drivers and 

206 cybersecurity activities. These components are explained below.

207 • The Framework Core is a set of cybersecurity activities, desired outcomes, and 

208 applicable references that are common across critical infrastructure sectors. The Core 

209 presents industry standards, guidelines, and practices in a manner that allows for 

210 communication of cybersecurity activities and outcomes across the organization from the 

211 executive level to the implementation/operations level. The Framework Core consists of 

212 five concurrent and continuous Functions—Identify, Protect, Detect, Respond, Recover. 

213 When considered together, these Functions provide a high-level, strategic view of the 

214 lifecycle of an organization’s management of cybersecurity risk. The Framework Core 

215 then identifies underlying key Categories and Subcategories for each Function, and 

216 matches them with example Informative References such as existing standards, 

217 guidelines, and practices for each Subcategory.

218 • Framework Implementation Tiers (“Tiers”) provide context on how an organization

219 views cybersecurity risk and the processes in place to manage that risk. Tiers describe the 

220 degree to which an organization’s cybersecurity risk management practices exhibit the 

221 characteristics defined in the Framework (e.g., risk and threat aware, repeatable, and 

222 adaptive). The Tiers characterize an organization’s practices over a range, from Partial 

223 (Tier 1) to Adaptive (Tier 4). These Tiers reflect a progression from informal, reactive 

224 responses to approaches that are agile and risk-informed. During the Tier selection 

225 process, an organization should consider its current risk management practices, threat 

226 environment, legal and regulatory requirements, business/mission objectives, and 

227 organizational constraints.

228 • A Framework Profile (“Profile”) represents the outcomes based on business needs that an

229 organization has selected from the Framework Categories and Subcategories. The Profile 

230 can be characterized as the alignment of standards, guidelines, and practices to the 

231 Framework Core in a particular implementation scenario. Profiles can be used to identify 

232 opportunities for improving cybersecurity posture by comparing a “Current” Profile (the 

233 “as is” state) with a “Target” Profile (the “to be” state). To develop a Profile, an 

234 organization can review all of the Categories and Subcategories and, based on business 

235 drivers and a risk assessment, determine which are most important; it can add Categories 

236 and Subcategories as needed to address the organization’s risks. The Current Profile can 

237 then be used to support prioritization and measurement of progress toward the Target 

238 Profile, while factoring in other business needs including cost-effectiveness and 

239 innovation. Profiles can be used to conduct self-assessments and communicate within an 

240 organization or between organizations.

241 1.2 Risk Management and the Cybersecurity Framework

242 Risk management is the ongoing process of identifying, assessing, and responding to risk. To 

243 manage risk, organizations should understand the likelihood that an event will occur and the 
Revised December 5, 2017 Cybersecurity Framework Version 1.1 Draft 2

6 DRAFT

244 resulting impact. With this information, organizations can determine the acceptable level of risk 

245 for achieving its organizational objectives and can express this as their risk tolerance. 

246 With an understanding of risk tolerance, organizations can prioritize cybersecurity activities, 

247 enabling organizations to make informed decisions about cybersecurity expenditures.

248 Implementation of risk management programs offers organizations the ability to quantify and 

249 communicate adjustments to their cybersecurity programs. Organizations may choose to handle 

250 risk in different ways, including mitigating the risk, transferring the risk, avoiding the risk, or 

251 accepting the risk, depending on the potential impact to the delivery of critical services. The 

252 Framework uses risk management processes to enable organizations to inform and prioritize 

253 decisions regarding cybersecurity. It supports recurring risk assessments and validation of 

254 business drivers to help organizations select target states for cybersecurity activities that reflect 

255 desired outcomes. Thus, the Framework gives organizations the ability to dynamically select and 

256 direct improvement in cybersecurity risk management for the IT and ICS environments.

257 The Framework is adaptive to provide a flexible and risk-based implementation that can be used 

258 with a broad array of cybersecurity risk management processes. Examples of cybersecurity risk 

259 management processes include International Organization for Standardization (ISO) 

31000:20096, ISO/IEC 27005:20117 260 , National Institute of Standards and Technology (NIST)

Special Publication (SP) 800-398 261 , and the Electricity Subsector Cybersecurity Risk Management 

Process (RMP) guideline9 262 .

263 1.3 Document Overview

264 The remainder of this document contains the following sections and appendices:

265 • Section 2 describes the Framework components: the Framework Core, the Tiers, and the 

266 Profiles.

267 • Section 3 presents examples of how the Framework can be used.

268 • Section 4 describes how to use the Framework for self-assessing and demonstrating 

269 cybersecurity through measurements.

270 • Appendix A presents the Framework Core in a tabular format: the Functions, Categories, 

271 Subcategories, and Informative References.

272 • Appendix B contains a glossary of selected terms.

273 • Appendix C lists acronyms used in this document.

274 • Appendix D is a detailed listing of updates between the Framework Version 1.0 and the 

275 current draft of Version 1.1.

 6 International Organization for Standardization, Risk management – Principles and guidelines, ISO 31000:2009, 

2009. http://www.iso.org/iso/home/standards/iso31000.htm 7 International Organization for Standardization/International Electrotechnical Commission, Information 

technology – Security techniques – Information security risk management, ISO/IEC 27005:2011, 2011. 

http://www.iso.org/iso/catalogue_detail?csnumber=56742 8 Joint Task Force Transformation Initiative, Managing Information Security Risk: Organization, Mission, and 

Information System View, NIST Special Publication 800-39, March 2011. 

http://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-39.pdf 9 U.S. Department of Energy, Electricity Subsector Cybersecurity Risk Management Process, DOE/OE-0003, May 

2012. https://energy.gov/sites/prod/files/Cybersecurity Risk Management Process Guideline - Final - May 

2012.pdf
Revised December 5, 2017 Cybersecurity Framework Version 1.1 Draft 2

7 DRAFT

276 2.0 Framework	Basics

277 The Framework provides a common language for understanding, managing, and expressing

278 cybersecurity risk both internally and externally. It can be used to help identify and prioritize 

279 actions for reducing cybersecurity risk, and it is a tool for aligning policy, business, and 

280 technological approaches to managing that risk. It can be used to manage cybersecurity risk 

281 across entire organizations or it can be focused on the delivery of critical services within an 

282 organization. Different types of entities – including sector coordinating structures, associations, 

283 and organizations – can use the Framework for different purposes, including the creation of 

284 common Profiles.

285 2.1 Framework Core

286 The Framework Core provides a set of activities to achieve specific cybersecurity outcomes, and 

287 references examples of guidance to achieve those outcomes. The Core is not a checklist of 

288 actions to perform. It presents key cybersecurity outcomes identified by industry as helpful in 

289 managing cybersecurity risk. The Core comprises four elements: Functions, Categories, 

290 Subcategories, and Informative References, depicted in Figure 1:

291

292 Figure 1: Framework Core Structure

293 The Framework Core elements work together as follows:

294 • Functions organize basic cybersecurity activities at their highest level. These Functions 

295 are Identify, Protect, Detect, Respond, and Recover. They aid an organization in 

296 expressing its management of cybersecurity risk by organizing information, enabling risk 

297 management decisions, addressing threats, and improving by learning from previous 

298 activities. The Functions also align with existing methodologies for incident management

299 and help show the impact of investments in cybersecurity. For example, investments in 

300 planning and exercises support timely response and recovery actions, resulting in reduced 

301 impact to the delivery of services.
Revised December 5, 2017 Cybersecurity Framework Version 1.1 Draft 2

8 DRAFT

302 • Categories are the subdivisions of a Function into groups of cybersecurity outcomes

303 closely tied to programmatic needs and particular activities. Examples of Categories 

304 include “Asset Management,” “Identity Management and Access Control,” and 

305 “Detection Processes.” 

306 • Subcategories further divide a Category into specific outcomes of technical and/or 

307 management activities. They provide a set of results that, while not exhaustive, help 

308 support achievement of the outcomes in each Category. Examples of Subcategories 

309 include “External information systems are catalogued,” “Data-at-rest is protected,” and 

310 “Notifications from detection systems are investigated.” 

311 • Informative References are specific sections of standards, guidelines, and practices 

312 common among critical infrastructure sectors that illustrate a method to achieve the 

313 outcomes associated with each Subcategory. The Informative References presented in the 

314 Framework Core are illustrative and not exhaustive. They are based upon cross-sector 

guidance most frequently referenced during the Framework development process.10 315

316 The five Framework Core Functions are defined below. These Functions are not intended to 

317 form a serial path, or lead to a static desired end state. Rather, the Functions should be performed 

318 concurrently and continuously to form an operational culture that addresses the dynamic 

319 cybersecurity risk. See Appendix A for the complete Framework Core listing.

320 • Identify – Develop an organizational understanding to manage cybersecurity risk to 

321 systems, assets, data, and capabilities.

322 The activities in the Identify Function are foundational for effective use of the 

323 Framework. Understanding the business context, the resources that support critical 

324 functions, and the related cybersecurity risks enables an organization to focus and 

325 prioritize its efforts, consistent with its risk management strategy and business needs. 

326 Examples of outcome Categories within this Function include: Asset Management;

327 Business Environment; Governance; Risk Assessment; and Risk Management Strategy.

328 • Protect – Develop and implement appropriate safeguards to ensure delivery of critical 

329 infrastructure services.

330 The Protect Function supports the ability to limit or contain the impact of a potential

331 cybersecurity event. Examples of outcome Categories within this Function include:

332 Identity Management and Access Control; Awareness and Training; Data Security;

333 Information Protection Processes and Procedures; Maintenance; and Protective 

334 Technology.

 10 NIST developed a Compendium of informative references gathered from the Request for Information (RFI) 

input, Cybersecurity Framework workshops, and stakeholder engagement during the Framework development 

process. The Compendium includes standards, guidelines, and practices to assist with implementation. The 

Compendium is not intended to be an exhaustive list, but rather a starting point based on initial stakeholder 

input. The Compendium and other supporting material can be found at http://www.nist.gov/cyberframework/. 
Revised December 5, 2017 Cybersecurity Framework Version 1.1 Draft 2

9 DRAFT

335 • Detect – Develop and implement appropriate activities to identify the occurrence of a 

336 cybersecurity event.

337 The Detect Function enables timely discovery of cybersecurity events. Examples of 

338 outcome Categories within this Function include: Anomalies and Events; Security 

339 Continuous Monitoring; and Detection Processes.

340 • Respond – Develop and implement appropriate activities to take action regarding a 

341 detected cybersecurity incident.

342 The Respond Function supports the ability to contain the impact of a potential

343 cybersecurity incident. Examples of outcome Categories within this Function include:

344 Response Planning; Communications; Analysis; Mitigation; and Improvements.

345 • Recover – Develop and implement appropriate activities to maintain plans for resilience 

346 and to restore any capabilities or services that were impaired due to a cybersecurity

347 incident.

348 The Recover Function supports timely recovery to normal operations to reduce the 

349 impact from a cybersecurity incident. Examples of outcome Categories within this 

350 Function include: Recovery Planning; Improvements; and Communications.

351 2.2 Framework Implementation Tiers

352 The Framework Implementation Tiers (“Tiers”) provide context on how an organization views 

353 cybersecurity risk and the processes in place to manage that risk. Ranging from Partial (Tier 1) to 

354 Adaptive (Tier 4), Tiers describe an increasing degree of rigor and sophistication in 

355 cybersecurity risk management practices. They help determine the extent to which cybersecurity 

356 risk management is informed by business needs and is integrated into an organization’s overall 

357 risk management practices. Risk management considerations include many aspects of 

358 cybersecurity, including the degree to which privacy and civil liberties considerations are 

359 integrated into an organization’s management of cybersecurity risk and potential risk responses.

360 The Tier selection process considers an organization’s current risk management practices, threat 

361 environment, legal and regulatory requirements, information sharing practices, business/mission 

362 objectives, supply chain cybersecurity requirements, and organizational constraints. 

363 Organizations should determine the desired Tier, ensuring that the selected level meets the 

364 organizational goals, is feasible to implement, and reduces cybersecurity risk to critical assets 

365 and resources to levels acceptable to the organization. Organizations should consider leveraging 

366 external guidance obtained from Federal government departments and agencies, Information 

367 Sharing and Analysis Centers (ISACs), Information Sharing and Analysis Organizations 

368 (ISAOs), existing maturity models, or other sources to assist in determining their desired tier. 

369 While organizations identified as Tier 1 (Partial) are encouraged to consider moving toward Tier 

370 2 or greater, Tiers do not necessarily represent maturity levels. Tiers are meant to support 

371 organizational decision making about how to manage cybersecurity risk, as well as which 

372 dimensions of the organization are higher priority and should receive additional resources. 

373 Progression to higher Tiers is encouraged when a cost-benefit analysis indicates a feasible and 

374 cost-effective reduction of cybersecurity risk.
Revised December 5, 2017 Cybersecurity Framework Version 1.1 Draft 2

10 DRAFT

375 Successful implementation of the Framework is based upon achieving the outcomes described in 

376 the organization’s Target Profile(s) and not upon Tier determination. Still, Tier selection and 

377 designation naturally affect Framework Profiles. The Tier recommendation by Business/Process 

378 Level managers, as approved by the Senior Executive Level, will help set the overall tone for 

379 how cybersecurity risk will be managed within the organization, and should influence 

380 prioritization within a Target Profile and assessments of progress in addressing gaps.

381 The Tier definitions are as follows:

382 Tier 1: Partial

383 • Risk Management Process – Organizational cybersecurity risk management practices are 

384 not formalized, and risk is managed in an ad hoc and sometimes reactive manner. 

385 Prioritization of cybersecurity activities may not be directly informed by organizational 

386 risk objectives, the threat environment, or business/mission requirements. 

387 • Integrated Risk Management Program – There is limited awareness of cybersecurity risk 

388 at the organizational level. The organization implements cybersecurity risk management

389 on an irregular, case-by-case basis due to varied experience or information gained from 

390 outside sources. The organization may not have processes that enable cybersecurity 

391 information to be shared within the organization.

392 • External Participation – The organization does not understand its role in the larger 

393 ecosystem with respect to its dependencies and dependents. The organization does not 

394 collaborate with or receive information (e.g., threat intelligence, best practices, 

395 technologies) from other entities (e.g., buyers, suppliers, dependencies, dependents, 

396 ISAOs, researchers, governments), nor does it share information. The organization is 

397 generally unaware of the cyber supply chain risks of the products and services it provides 

398 and that it uses. 

399 Tier 2: Risk Informed

400 • Risk Management Process – Risk management practices are approved by management 

401 but may not be established as organizational-wide policy. Prioritization of cybersecurity 

402 activities and protection needs is directly informed by organizational risk objectives, the 

403 threat environment, or business/mission requirements.

404 • Integrated Risk Management Program – There is an awareness of cybersecurity risk at 

405 the organizational level, but an organization-wide approach to managing cybersecurity 

406 risk has not been established. Cybersecurity information is shared within the organization 

407 on an informal basis. Consideration of cybersecurity in organizational objectives and 

408 programs may occur at some but not all levels of the organization. Cyber risk assessment 

409 of organizational and external assets occurs, but is not typically repeatable or reoccurring.

410 • External Participation – Generally, the organization understands its role in the larger 

411 ecosystem with respect to its own dependencies or dependents, but not both. The 

412 organization collaborates with and receives some information from other entities and 

413 generates some of its own information, but may not share information with others. 

414 Additionally, the organization is aware of the cyber supply chain risks associated with 

415 the products and services it provides and that it uses, but does not act consistently or 

416 formally upon those risks. 
Revised December 5, 2017 Cybersecurity Framework Version 1.1 Draft 2

11 DRAFT

417 Tier 3: Repeatable 

418 • Risk Management Process – The organization’s risk management practices are formally 

419 approved and expressed as policy. Organizational cybersecurity practices are regularly 

420 updated based on the application of risk management processes to changes in 

421 business/mission requirements and a changing threat and technology landscape.

422 • Integrated Risk Management Program – There is an organization-wide approach to 

423 manage cybersecurity risk. Risk-informed policies, processes, and procedures are 

424 defined, implemented as intended, and reviewed. Consistent methods are in place to 

425 respond effectively to changes in risk. Personnel possess the knowledge and skills to 

426 perform their appointed roles and responsibilities. The organization consistently and 

427 accurately monitors cybersecurity risk of organizational assets. Senior cybersecurity and 

428 non-cybersecurity executives communicate regularly regarding cybersecurity risk. 

429 Senior executives ensure consideration of cybersecurity through all lines of operation in 

430 the organization.

431 • External Participation - The organization understands its role, dependencies, and 

432 dependents in the larger ecosystem and may contribute to the community’s broader 

433 understanding of risks. It collaborates with and receives information from other entities 

434 regularly that complements internally generated information, and shares information 

435 with other entities. The organization is aware of the cyber supply chain risks associated 

436 with the products and services it provides and that it uses. Additionally, it usually acts 

437 formally upon those risks, including mechanisms such as written agreements to 

438 communicate baseline requirements, governance structures (e.g., risk councils), and 

439 policy implementation and monitoring.

440 Tier 4: Adaptive

441 • Risk Management Process – The organization adapts its cybersecurity practices based on 

442 previous and current cybersecurity activities, including lessons learned and predictive 

443 indicators. Through a process of continuous improvement incorporating advanced 

444 cybersecurity technologies and practices, the organization actively adapts to a changing 

445 threat and technology landscapes and responds in a timely and effective manner to 

446 evolving, sophisticated threats.

447 • Integrated Risk Management Program – There is an organization-wide approach to 

448 managing cybersecurity risk that uses risk-informed policies, processes, and procedures 

449 to address potential cybersecurity events. The relationship between cybersecurity risk and 

450 organizational objectives is clearly understood and considered when making decisions. 

451 Senior executives monitor cybersecurity risk in the same context as financial risk and 

452 other organizational risks. The organizational budget is based on an understanding of the 

453 current and predicted risk environment and risk tolerance. Business units implement 

454 executive vision and analyze system-level risks in the context of the organizational risk 

455 tolerances. Cybersecurity risk management is part of the organizational culture and 

456 evolves from an awareness of previous activities and continuous awareness of activities 

457 on their systems and networks. The organization can quickly and efficiently account for 

458 changes to business/mission objectives in how risk is approached and communicated.
Revised December 5, 2017 Cybersecurity Framework Version 1.1 Draft 2

12 DRAFT

459 • External Participation - The organization understands its role, dependencies, and 

460 dependents in the larger ecosystem and contributes to the community’s broader 

461 understanding of risks. It receives, generates, and reviews prioritized information that 

462 informs continuous analysis of its risks as the threat and technology landscape evolves. 

463 The organization shares that information internally and externally with other 

464 collaborators. The organization uses real-time or near real-time information to understand 

465 and consistently act upon cyber supply chain risks associated with the products and 

466 services it provides and that it uses. Additionally, it communicates proactively, using 

467 formal (e.g. agreements) and informal mechanisms to develop and maintain strong supply 

468 chain relationships.

469 2.3 Framework Profile

470 The Framework Profile (“Profile”) is the alignment of the Functions, Categories, and 

471 Subcategories with the business requirements, risk tolerance, and resources of the organization.

472 A Profile enables organizations to establish a roadmap for reducing cybersecurity risk that is well 

473 aligned with organizational and sector goals, considers legal/regulatory requirements and

474 industry best practices, and reflects risk management priorities. Given the complexity of many 

475 organizations, they may choose to have multiple profiles, aligned with particular components and 

476 recognizing their individual needs.

477 Framework Profiles can be used to describe the current state or the desired target state of specific 

478 cybersecurity activities. The Current Profile indicates the cybersecurity outcomes that are 

479 currently being achieved. The Target Profile indicates the outcomes needed to achieve the 

480 desired cybersecurity risk management goals. Profiles support business/mission requirements 

481 and aid in the communication of risk within and between organizations. This Framework 

482 document does not prescribe Profile templates, allowing for flexibility in implementation.

483 Comparison of Profiles (e.g., the Current Profile and Target Profile) may reveal gaps to be 

484 addressed to meet cybersecurity risk management objectives. An action plan to address these 

485 gaps can contribute to the roadmap described above. Prioritization of gap mitigation is driven by 

486 the organization’s business needs and risk management processes. This risk-based approach 

487 enables an organization to gauge resource estimates (e.g., staffing, funding) to achieve 

488 cybersecurity goals in a cost-effective, prioritized manner.
Revised December 5, 2017 Cybersecurity Framework Version 1.1 Draft 2

13 DRAFT

489 2.4 Coordination of Framework Implementation

490 Figure 2 describes a common flow of information and decisions at the following levels within an 

491 organization:

492 • Executive

493 • Business/Process

494 • Implementation/Operations

495 The executive level communicates the mission priorities, available resources, and overall risk 

496 tolerance to the business/process level. The business/process level uses the information as inputs 

497 into the risk management process, and then collaborates with the implementation/operations 

498 level to communicate business needs and create a Profile. The implementation/operations level 

499 communicates the Profile implementation progress to the business/process level. The 

500 business/process level uses this information to perform an impact assessment. Business/process 

501 level management reports the outcomes of that impact assessment to the executive level to 

502 inform the organization’s overall risk management process and to the implementation/operations 

503 level for awareness of business impact.

Figure 2: Notional Information and Decision Flows within an Organization
Revised December 5, 2017 Cybersecurity Framework Version 1.1 Draft 2

14 DRAFT

504 3.0 How	to	Use	the	Framework

505 An organization can use the Framework as a key part of its systematic process for identifying, 

506 assessing, and managing cybersecurity risk. The Framework is not designed to replace existing 

507 processes; an organization can use its current process and overlay it onto the Framework to 

508 determine gaps in its current cybersecurity risk approach and develop a roadmap to 

509 improvement. Using the Framework as a cybersecurity risk management tool, an organization 

510 can determine activities that are most important to critical service delivery and prioritize 

511 expenditures to maximize the impact of the investment.

512 The Framework is designed to complement existing business and cybersecurity operations. It can 

513 serve as the foundation for a new cybersecurity program or a mechanism for improving an 

514 existing program. The Framework provides a means of expressing cybersecurity requirements to 

515 business partners and customers and can help identify gaps in an organization’s cybersecurity 

516 practices. It also provides a general set of considerations and processes for considering privacy 

517 and civil liberties implications in the context of a cybersecurity program.

518 The Framework can be applied throughout the life cycle phases of design, build/buy, deploy, 

519 operate, and decommission. The design phase should account for cybersecurity requirements as a 

part of a larger multi-disciplinary systems engineering process.

11 520 A key milestone of the design 

521 phase is validation that the system cybersecurity specifications match the needs and risk 

522 disposition of the organization as captured in a Framework Profile. The desired cybersecurity 

523 outcomes prioritized in a Target Profile should be incorporated when a) developing the system 

524 during the build phase and b) purchasing or outsourcing the system during the buy phase. That 

525 same Target Profile serves as a list of system cybersecurity features that should be assessed when 

526 deploying the system to verify all features are implemented. The cybersecurity outcomes 

527 determined by using the Framework then should serve as a basis for ongoing operation of the 

528 system. This includes occasional reassessment, capturing results in a Current Profile, to verify 

529 that cybersecurity requirements are still fulfilled. Typically, a complex web of dependencies

530 (e.g., compensating and common controls) among systems means the outcomes documented in 

531 Target Profiles of related systems should be carefully considered as systems are 

532 decommissioned.

533 The following sections present different ways in which organizations can use the Framework.

534 3.1 Basic Review of Cybersecurity Practices

535 The Framework can be used to compare an organization’s current cybersecurity activities with 

536 those outlined in the Framework Core. Through the creation of a Current Profile, organizations 

537 can examine the extent to which they are achieving the outcomes described in the Core 

538 Categories and Subcategories, aligned with the five high-level Functions: Identify, Protect, 

539 Detect, Respond, and Recover. An organization may find that it is already achieving the desired 

540 outcomes, thus managing cybersecurity commensurate with the known risk. Alternatively, an 

541 organization may determine that it has opportunities to (or needs to) improve. The organization 

542 can use that information to develop an action plan to strengthen existing cybersecurity practices 

 11 NIST Special Publication 800-160 - System Security Engineering, Considerations for a Multidisciplinary 

Approach in the Engineering of Trustworthy Secure Systems, Ross et al, November 2016,

http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-160.pdf
Revised December 5, 2017 Cybersecurity Framework Version 1.1 Draft 2

15 DRAFT

543 and reduce cybersecurity risk. An organization may also find that it is overinvesting to achieve 

544 certain outcomes. The organization can use this information to reprioritize resources.

545 While they do not replace a risk management process, these five high-level Functions will 

546 provide a concise way for senior executives and others to distill the fundamental concepts of 

547 cybersecurity risk so that they can assess how identified risks are managed, and how their 

548 organization stacks up at a high level against existing cybersecurity standards, guidelines, and 

549 practices. The Framework can also help an organization answer fundamental questions, 

550 including “How are we doing?” Then they can move in a more informed way to strengthen their 

551 cybersecurity practices where and when deemed necessary.

552 3.2 Establishing or Improving a Cybersecurity Program

553 The following steps illustrate how an organization could use the Framework to create a new 

554 cybersecurity program or improve an existing program. These steps should be repeated as 

555 necessary to continuously improve cybersecurity.

556 Step 1: Prioritize and Scope. The organization identifies its business/mission objectives and 

557 high-level organizational priorities. With this information, the organization makes strategic 

558 decisions regarding cybersecurity implementations and determines the scope of systems and 

559 assets that support the selected business line or process. The Framework can be adapted to 

560 support the different business lines or processes within an organization, which may have 

561 different business needs and associated risk tolerance. Risk tolerances may be reflected in a 

562 target Implementation Tier.

563 Step 2: Orient. Once the scope of the cybersecurity program has been determined for the 

564 business line or process, the organization identifies related systems and assets, regulatory 

565 requirements, and overall risk approach. The organization then consults sources to identify 

566 threats and vulnerabilities applicable to those systems and assets. 

567 Step 3: Create a Current Profile. The organization develops a Current Profile by indicating 

568 which Category and Subcategory outcomes from the Framework Core are currently being 

569 achieved. If an outcome is partially achieved, noting this fact will help support subsequent steps.

570 Step 4: Conduct a Risk Assessment. This assessment could be guided by the organization’s 

571 overall risk management process or previous risk assessment activities. The organization 

572 analyzes the operational environment in order to discern the likelihood of a cybersecurity event 

573 and the impact that the event could have on the organization. It is important that organizations 

574 identify emerging risks and use cyber threat information from internal and external sources to 

575 gain a better understanding of the likelihood and impact of cybersecurity events.

576 Step 5: Create a Target Profile. The organization creates a Target Profile that focuses on the 

577 assessment of the Framework Categories and Subcategories describing the organization’s desired 

578 cybersecurity outcomes. Organizations also may develop their own additional Categories and 

579 Subcategories to account for unique organizational risks. The organization may also consider 

580 influences and requirements of external stakeholders such as sector entities, customers, and 

581 business partners when creating a Target Profile. The Profile should appropriately reflect criteria 

582 within the target Implementation Tier.
Revised December 5, 2017 Cybersecurity Framework Version 1.1 Draft 2

16 DRAFT

583 Step 6: Determine, Analyze, and Prioritize Gaps. The organization compares the Current 

584 Profile and the Target Profile to determine gaps. Next, it creates a prioritized action plan to 

585 address gaps – reflecting mission drivers, costs and benefits, and risks – to achieve the outcomes 

586 in the Target Profile. The organization then determines resources, including funding and 

587 workforce, necessary to address the gaps. Using Profiles in this manner encourages the 

588 organization to make informed decisions about cybersecurity activities, supports risk 

589 management, and enables the organization to perform cost-effective, targeted improvements.

590 Step 7: Implement Action Plan. The organization determines which actions to take to address 

591 the gaps, if any, identified in the previous step. It then adjusts its current cybersecurity practices

592 in order to achieve the Target Profile. For further guidance, the Framework identifies example 

593 Informative References regarding the Categories and Subcategories, but organizations should 

594 determine which standards, guidelines, and practices, including those that are sector specific,

595 work best for their needs.

596 An organization may repeat the steps as needed to continuously assess and improve its

597 cybersecurity. For instance, organizations may find that more frequent repetition of the orient

598 step improves the quality of risk assessments. Furthermore, organizations may monitor progress 

599 through iterative updates to the Current Profile, subsequently comparing the Current Profile to 

600 the Target Profile. Organizations may also use this process to align their cybersecurity program 

601 with their desired Framework Implementation Tier.

602 3.3 Communicating Cybersecurity Requirements with Stakeholders

603 The Framework provides a common language to communicate requirements among 

604 interdependent stakeholders responsible for the delivery of essential critical infrastructure 

605 products and services. Examples include:

606 • An organization may use a Target Profile to express cybersecurity risk management 

607 requirements to an external service provider (e.g., a cloud provider to which it is 

608 exporting data).

609 • An organization may express its cybersecurity state through a Current Profile to report 

610 results or to compare with acquisition requirements.

611 • A critical infrastructure owner/operator, having identified an external partner on whom 

612 that infrastructure depends, may use a Target Profile to convey required Categories and 

613 Subcategories.

614 • A critical infrastructure sector may establish a Target Profile that can be used among its 

615 constituents as an initial baseline Profile to build their tailored Target Profiles.

616 • An organization can better manage cybersecurity risk among stakeholders by assessing 

617 their position in the critical infrastructure and the broader digital economy using 

618 Implementation Tiers.

619 Communication is especially important among stakeholders up and down supply chains. Supply 

620 chains are a complex, globally distributed, and interconnected set of resources and processes 

621 between multiple levels of organizations. Supply chains begin with the sourcing of products and 

622 services and extend from the design, development, manufacturing, processing, handling, and 

623 delivery of products and services to the end user. Given these complex and interconnected 

624 relationships, supply chain risk management (SCRM) is a critical organizational function.
Revised December 5, 2017 Cybersecurity Framework Version 1.1 Draft 2

17 DRAFT

625 Cyber SCRM is the set of activities necessary to manage cybersecurity risk associated with 

626 external parties. More specifically, cyber SCRM addresses both the cybersecurity effect an 

627 organization has on external parties and the cybersecurity effect external parties have on an 

628 organization.

629 A primary objective of cyber SCRM is to identify, assess, and mitigate “products and services 

630 that may contain potentially malicious functionality, are counterfeit, or are vulnerable due to 

poor manufacturing and development practices within the cyber supply chain12 631 .” Cyber SCRM 

632 activities may include:

633 • Determining cybersecurity requirements for suppliers,

634 • Enacting cybersecurity requirements through formal agreement (e.g., contracts),

635 • Communicating to suppliers how those cybersecurity requirements will be verified

636 and validated,

637 • Verifying that cybersecurity requirements are met through a variety of assessment 

638 methodologies, and

639 • Governing and managing the above activities.

640 As depicted in Figure 3, cyber SCRM encompasses technology suppliers and buyers, as well as

641 non-technology suppliers and buyers, where technology is minimally composed of information 

642 technology (IT), industrial control systems (ICS), cyber-physical systems (CPS), and connected 

643 devices more generally, including the Internet of Things (IoT).

Figure 3: Cyber Supply Chain Relationships

 12 NIST Special Publication 800-161: Supply Chain Risk Management Practices for Federal Information Systems 

and Organizations, Boyens et al, April 2015, http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-

161.pdfhttp://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-161.pdf
Revised December 5, 2017 Cybersecurity Framework Version 1.1 Draft 2

18 DRAFT

644 The parties described in Figure 3 comprise an organization’s cybersecurity ecosystem. These 

645 relationships highlight the crucial role of cyber SCRM in addressing cybersecurity risk in critical 

646 infrastructure and the broader digital economy. These relationships, the products and services 

647 they provide, and the risks they present should be identified and factored into the protective and 

648 detective capabilities of organizations, as well as their response and recovery protocols.

649 In the figure above, “Buyer” refers to the people or organizations that consume a given product 

650 or service from an organization, including both for-profit and not-for-profit organizations. 

651 “Supplier” encompasses product and service providers that are used for an organization’s 

652 internal purposes (e.g., IT infrastructure) or integrated into the products or services provided to 

653 the Buyer. These terms are applicable for both technology-based and non-technology-based 

654 relationships.

655 Whether considering individual Subcategories of the Core or the comprehensive considerations 

656 of a Profile, the Framework offers organizations and their partners a method to help ensure the 

657 new product or service meets critical security outcomes. By first selecting outcomes that are 

658 relevant to the context (e.g., transmission of Personally Identifiable Information (PII), mission 

659 critical service delivery, data verification services, product or service integrity) the organization 

660 then can evaluate partners against those criteria. For example, if a system is being purchased that 

661 will monitor OT for anomalous network communication, availability may be a particularly 

662 important cybersecurity objective to achieve and should drive a Technology Supplier evaluation 

663 against applicable Subcategories (e.g., ID.BE-4, ID.SC-3, ID.SC-4, ID.SC-5, PR.DS-4, PR.DS-6, 

664 PR.DS-7, PR.DS-8, PR.IP-1, DE.AE-5).

665 3.4 Buying Decisions

666 Since a Framework Target Profile is a prioritized list of organizational cybersecurity 

667 requirements, Target Profiles can be used to inform decisions about buying products and 

668 services. This transaction varies from cyber SCRM (Section 3.3) in that it may not be possible to 

669 impose a set of cybersecurity requirements on the supplier. Instead, the objective should be to 

670 make the best buying decision among multiple suppliers, given a carefully determined list of 

671 cybersecurity requirements. Often, this means some degree of trade-off analysis, so a product or 

672 service with known gaps to the Target Profile may be evaluated.

673 Once a product or service is purchased, the Profile also can be used to track and address residual 

674 cybersecurity risk. For example, if the service or product purchased did not meet all the 

675 objectives described in the Target Profile, the organization can address the residual risk through 

676 other management actions. The Profile also provides the organization a method for assessing if

677 the product meets cybersecurity outcomes through periodic review and testing mechanisms.

678 3.5 Identifying Opportunities for New or Revised Informative 

679 References

680 The Framework can be used to identify opportunities for new or revised standards, guidelines, or 

681 practices where additional Informative References would help organizations address emerging 

682 needs. An organization implementing a given Subcategory, or developing a new Subcategory,

683 might discover that there are few Informative References, if any, for a related activity. To 

684 address that need, the organization might collaborate with technology leaders and/or standards 

685 bodies to draft, develop, and coordinate standards, guidelines, or practices.
Revised December 5, 2017 Cybersecurity Framework Version 1.1 Draft 2

19 DRAFT

686 3.6 Methodology to Protect Privacy and Civil Liberties

687 This section describes a methodology to address individual privacy and civil liberties 

688 implications that may result from cybersecurity operations. This methodology is intended to be a 

689 general set of considerations and processes since privacy and civil liberties implications may

690 differ by sector or over time and organizations may address these considerations and processes

691 with a range of technical implementations. Nonetheless, not all activities in a cybersecurity 

692 program engender privacy and civil liberties considerations. Technical privacy standards, 

693 guidelines, and additional best practices may need to be developed to support improved technical 

694 implementations.

695 Privacy and cybersecurity have a strong connection. An organization’s cybersecurity activities 

696 also can create risks to privacy and civil liberties when personal information is used, collected, 

697 processed, maintained, or disclosed. Some examples include: cybersecurity activities that result 

698 in the over-collection or over-retention of personal information; disclosure or use of personal 

699 information unrelated to cybersecurity activities; and cybersecurity mitigation activities that 

700 result in denial of service or other similar potentially adverse impacts, including some types of 

701 incident detection or monitoring that may inhibit freedom of expression or association.

702 The government and its agents have a responsibility to protect civil liberties arising from 

703 cybersecurity activities. As referenced in the methodology below, government or its agents that 

704 own or operate critical infrastructure should have a process in place to support compliance of 

705 cybersecurity activities with applicable privacy laws, regulations, and Constitutional 

706 requirements. 

707 To address privacy implications, organizations may consider how their cybersecurity program 

708 might incorporate privacy principles such as: data minimization in the collection, disclosure, and 

709 retention of personal information material related to the cybersecurity incident; use limitations 

710 outside of cybersecurity activities on any information collected specifically for cybersecurity 

711 activities; transparency for certain cybersecurity activities; individual consent and redress for 

712 adverse impacts arising from use of personal information in cybersecurity activities; data quality,

713 integrity, and security; and accountability and auditing.

714 As organizations assess the Framework Core in Appendix A, the following processes and 

715 activities may be considered as a means to address the above-referenced privacy and civil 

716 liberties implications:

717 Governance of cybersecurity risk

718 • An organization’s assessment of cybersecurity risk and potential risk responses considers 

719 the privacy implications of its cybersecurity program

720 • Individuals with cybersecurity-related privacy responsibilities report to appropriate 

721 management and are appropriately trained

722 • Process is in place to support compliance of cybersecurity activities with applicable 

723 privacy laws, regulations, and Constitutional requirements

724 • Process is in place to assess implementation of the above organizational measures and 

725 controls
Revised December 5, 2017 Cybersecurity Framework Version 1.1 Draft 2

20 DRAFT

726 Approaches to identifying, authenticating, and authorizing individuals to access 

727 organizational assets and systems

728 • Steps are taken to identify and address the privacy implications of identity management 

729 and access control measures to the extent that they involve collection, disclosure, or use 

730 of personal information.

731 Awareness and training measures

732 • Applicable information from organizational privacy policies is included in cybersecurity 

733 workforce training and awareness activities

734 • Service providers that provide cybersecurity-related services for the organization are 

735 informed about the organization’s applicable privacy policies

736 Anomalous activity detection and system and assets monitoring

737 • Process is in place to conduct a privacy review of an organization’s anomalous activity 

738 detection and cybersecurity monitoring 

739 Response activities, including information sharing or other mitigation efforts

740 • Process is in place to assess and address whether, when, how, and the extent to which 

741 personal information is shared outside the organization as part of cybersecurity 

742 information sharing activities

743 • Process is in place to conduct a privacy review of an organization’s cybersecurity 

744 mitigation efforts
Revised December 5, 2017 Cybersecurity Framework Version 1.1 Draft 2

21 DRAFT

745 4.0 Self-Assessing	Cybersecurity Risk with the Framework

746 The Cybersecurity Framework is designed to reduce risk by improving the management of 

747 cybersecurity risk to organizational objectives. Ideally, organizations using the Framework will 

748 be able to measure and assign values to their risk along with the cost and benefits of steps taken 

749 to reduce risk to acceptable levels. The better an organization is able to measure its risk, costs, 

750 and benefits of cybersecurity strategies and steps, the more rational, effective, and valuable its 

751 cybersecurity approach and investments will be.

752 Self-assessment and measurement should improve decision making about investment priorities. 

753 For example, measuring – or at least robustly characterizing – aspects of an organization’s 

754 cybersecurity state and trends over time can enable that organization to understand and convey 

755 meaningful risk information to dependents, Suppliers, Buyers, and other parties. An organization 

756 can accomplish this internally or by seeking a third-party assessment. If done properly and with 

757 an appreciation of limitations, these measurements can provide a basis for strong trusted 

758 relationships, both inside and outside of an organization.

759 To examine the effectiveness of investments, an organization must first have a clear 

760 understanding of its organizational objectives, the relationship between those objectives and 

761 supportive cybersecurity outcomes, and how those discrete cybersecurity outcomes are 

762 implemented and managed. While measurements of all those items is beyond the scope of the 

763 Framework, the cybersecurity outcomes of the Framework Core support self-assessment of 

764 investment effectiveness and cybersecurity activities in the following ways:

765 • Making choices about how different portions of the cybersecurity operation should 

766 operate setting Target Implementation Tiers,

767 • Evaluating the organization’s approach to cybersecurity risk management by determining

768 Current Implementation Tiers,

769 • Prioritizing cybersecurity outcomes by developing Target Profiles,

770 • Determining the degree to which specific cybersecurity steps achieve desired 

771 cybersecurity outcomes by assessing Current Profiles, and

772 • Measuring the degree of implementation for controls catalogs or technical guidance listed 

773 as Informative References.

774 Organizations should be thoughtful, creative, and careful about the ways in which they employ 

775 measurements to optimize use, while avoiding reliance on artificial indicators of current state and 

776 progress in improving cybersecurity risk management. Any time measurements are employed as 

777 part of the Framework process, organizations are encouraged to clearly identify and know why 

778 these measurements are important and how they will contribute to the overall management of 

779 cybersecurity risk. They also should be clear about the limitations of measurements that are used.

780 For example, tracking both security measures and business outcomes may provide meaningful 

781 insight as to how changes in granular security controls affect the completion of organizational

782 objectives. While it is sometimes important to determine whether or not an organizational 

783 objective was achieved through lagging measurement, leading measurements of whether a 

784 cybersecurity risk may occur, and the impact it might have, are typically more important to 

785 determining likelihood of accomplishing an organizational objective.
Revised December 5, 2017 Cybersecurity Framework Version 1.1 Draft 2

22 DRAFT

786 Organizations are encouraged to innovate and customize how they incorporate measurements 

787 into their application of the Framework with a full appreciation of their usefulness and 

788 limitations.
Revised December 5, 2017 Cybersecurity Framework Version 1.1 Draft 2

23 DRAFT

789 Appendix	A:	Framework	Core

790 This appendix presents the Framework Core: a listing of Functions, Categories, Subcategories, 

791 and Informative References that describe specific cybersecurity activities that are common 

792 across all critical infrastructure sectors. The chosen presentation format for the Framework Core 

793 does not suggest a specific implementation order or imply a degree of importance of the 

794 Categories, Subcategories, and Informative References. The Framework Core presented in this 

795 appendix represents a common set of activities for managing cybersecurity risk. While the 

796 Framework is not exhaustive, it is extensible, allowing organizations, sectors, and other entities 

797 to use Subcategories and Informative References that are cost-effective and efficient and that 

798 enable them to manage their cybersecurity risk. Activities can be selected from the Framework 

799 Core during the Profile creation process and additional Categories, Subcategories, and 

800 Informative References may be added to the Profile. An organization’s risk management 

801 processes, legal/regulatory requirements, business/mission objectives, and organizational 

802 constraints guide the selection of these activities during Profile creation. Personal information is 

803 considered a component of data or assets referenced in the Categories when assessing security 

804 risks and protections.

805 While the intended outcomes identified in the Functions, Categories, and Subcategories are the 

806 same for IT and ICS, the operational environments and considerations for IT and ICS differ. ICS 

807 have a direct effect on the physical world, including potential risks to the health and safety of 

808 individuals, and impact on the environment. Additionally, ICS have unique performance and 

809 reliability requirements compared with IT, and the goals of safety and efficiency must be 

810 considered when implementing cybersecurity measures.

811 For ease of use, each component of the Framework Core is given a unique identifier. Functions 

812 and Categories each have a unique alphabetic identifier, as shown in Table 1. Subcategories 

813 within each Category are referenced numerically; the unique identifier for each Subcategory is 

814 included in Table 2.

815 Additional supporting material relating to the Framework can be found on the NIST website at

816 http://www.nist.gov/cyberframework/.
Revised December 5, 2017 Cybersecurity Framework Version 1.1 Draft 2

24 DRAFT

817 Table 1: Function and Category Unique Identifiers

818

Function 

Unique 

Identifier

Function

Category 

Unique 

Identifier

Category

ID Identify

ID.AM Asset Management

ID.BE Business Environment

ID.GV Governance

ID.RA Risk Assessment

ID.RM Risk Management Strategy

ID.SC Supply Chain Risk Management

PR Protect

PR.AC Identity Management and Access Control

PR.AT Awareness and Training

PR.DS Data Security

PR.IP Information Protection Processes and Procedures

PR.MA Maintenance

PR.PT Protective Technology

DE Detect

DE.AE Anomalies and Events

DE.CM Security Continuous Monitoring

DE.DP Detection Processes

RS Respond

RS.RP Response Planning

RS.CO Communications

RS.AN Analysis

RS.MI Mitigation

RS.IM Improvements

RC Recover

RC.RP Recovery Planning

RC.IM Improvements

RC.CO Communications
Revised December 5, 2017 Cybersecurity Framework Version 1.1 Draft 2

25 DRAFT

Table 2: Framework Core

Function Category Subcategory Informative References

IDENTIFY

(ID)

Asset Management (ID.AM): 

The data, personnel, devices, 

systems, and facilities that enable 

the organization to achieve 

business purposes are identified 

and managed consistent with their 

relative importance to 

organizational objectives and the 

organization’s risk strategy.

ID.AM-1: Physical devices and systems 

within the organization are inventoried

CIS CSC 1

COBIT 5 BAI09.01, BAI09.02

ISA 62443-2-1:2009 4.2.3.4

ISA 62443-3-3:2013 SR 7.8

ISO/IEC 27001:2013 A.8.1.1, A.8.1.2

NIST SP 800-53 Rev. 4 CM-8, PM-5

ID.AM-2: Software platforms and 

applications within the organization are 

inventoried

CIS CSC 2

COBIT 5 BAI09.01, BAI09.02, BAI09.05

ISA 62443-2-1:2009 4.2.3.4

ISA 62443-3-3:2013 SR 7.8

ISO/IEC 27001:2013 A.8.1.1, A.8.1.2, A.12.5.1

NIST SP 800-53 Rev. 4 CM-8, PM-5

ID.AM-3: Organizational communication 

and data flows are mapped

CIS CSC 12

COBIT 5 DSS05.02

ISA 62443-2-1:2009 4.2.3.4

ISO/IEC 27001:2013 A.13.2.1, A.13.2.2

NIST SP 800-53 Rev. 4 AC-4, CA-3, CA-9, PL-8

ID.AM-4: External information systems 

are catalogued

CIS CSC 12

1. COBIT 5 APO02.02, APO10.04, DSS01.02

2. ISO/IEC 27001:2013 A.11.2.6

3. NIST SP 800-53 Rev. 4 AC-20, SA-9

ID.AM-5: Resources (e.g., hardware, 

devices, data, time, and software) are 

prioritized based on their classification, 

criticality, and business value

CIS CSC 13, 14

COBIT 5 APO03.03, APO03.04, APO12.01, 

BAI04.02, BAI09.02

ISA 62443-2-1:2009 4.2.3.6

ISO/IEC 27001:2013 A.8.2.1

NIST SP 800-53 Rev. 4 CP-2, RA-2, SA-14, SC-6

ID.AM-6: Cybersecurity roles and 

responsibilities for the entire workforce and 

CIS CSC 17, 19

COBIT 5 APO01.02, APO07.06, APO13.01, 

DSS06.03
Revised December 5, 2017 Cybersecurity Framework Version 1.1 Draft 2

26 DRAFT

Function Category Subcategory Informative References

third-party stakeholders (e.g., suppliers, 

customers, partners) are established

ISA 62443-2-1:2009 4.3.2.3.3

ISO/IEC 27001:2013 A.6.1.1

NIST SP 800-53 Rev. 4 CP-2, PS-7, PM-11

Business Environment (ID.BE): 

The organization’s mission, 

objectives, stakeholders, and 

activities are understood and 

prioritized; this information is 

used to inform cybersecurity 

roles, responsibilities, and risk 

management decisions.

ID.BE-1: The organization’s role in the 

supply chain is identified and 

communicated

COBIT 5 APO08.01, APO08.04, APO08.05, 

APO10.03, APO10.04, APO10.05

ISO/IEC 27001:2013 A.15.1.1, A.15.1.2, 

A.15.1.3, A.15.2.1, A.15.2.2

NIST SP 800-53 Rev. 4 CP-2, SA-12

ID.BE-2: The organization’s place in 

critical infrastructure and its industry sector 

is identified and communicated

COBIT 5 APO02.06, APO03.01

ISO/IEC 27001:2013 Clause 4.1

NIST SP 800-53 Rev. 4 PM-8

ID.BE-3: Priorities for organizational 

mission, objectives, and activities are 

established and communicated

COBIT 5 APO02.01, APO02.06, APO03.01

ISA 62443-2-1:2009 4.2.2.1, 4.2.3.6

NIST SP 800-53 Rev. 4 PM-11, SA-14

ID.BE-4: Dependencies and critical 

functions for delivery of critical services 

are established

COBIT 5 APO10.01, BAI04.02, BAI09.02

ISO/IEC 27001:2013 A.11.2.2, A.11.2.3, A.12.1.3

NIST SP 800-53 Rev. 4 CP-8, PE-9, PE-11, PM-8, 

SA-14

ID.BE-5: Resilience requirements to 

support delivery of critical services are 

established for all operating states (e.g. 

under duress/attack, during recovery, 

normal operations)

COBIT 5 BAI03.02, DSS04.02

ISO/IEC 27001:2013 A.11.1.4, A.17.1.1,

A.17.1.2, A.17.2.1

NIST SP 800-53 Rev. 4 CP-2, CP-11, SA-13, SA14

Governance (ID.GV): The 

policies, procedures, and 

processes to manage and monitor 

the organization’s regulatory, 

legal, risk, environmental, and 

operational requirements are 

understood and inform the 

ID.GV-1: Organizational information 

security policy is established

CIS CSC 19

COBIT 5 APO01.03, APO13.01, EDM01.01, 

EDM01.02

ISA 62443-2-1:2009 4.3.2.6

ISO/IEC 27001:2013 A.5.1.1

NIST SP 800-53 Rev. 4 -1 controls from all 

families 
Revised December 5, 2017 Cybersecurity Framework Version 1.1 Draft 2

27 DRAFT

Function Category Subcategory Informative References

management of cybersecurity 

risk.

ID.GV-2: Information security roles & 

responsibilities are coordinated and aligned 

with internal roles and external partners

CIS CSC 19

COBIT 5 APO01.02, APO10.03, APO13.02, 

DSS05.04

ISA 62443-2-1:2009 4.3.2.3.3

ISO/IEC 27001:2013 A.6.1.1, A.7.2.1, A.15.1.1

NIST SP 800-53 Rev. 4 PS-7, PM-1, PM-2

ID.GV-3: Legal and regulatory 

requirements regarding cybersecurity, 

including privacy and civil liberties 

obligations, are understood and managed

CIS CSC 19

COBIT 5 BAI02.01, MEA03.01, MEA03.04

ISA 62443-2-1:2009 4.4.3.7

ISO/IEC 27001:2013 A.18.1.1, A.18.1.2, 

A.18.1.3, A.18.1.4, A.18.1.5

NIST SP 800-53 Rev. 4 -1 controls from all 

families (except PM-1)

ID.GV-4: Governance and risk 

management processes address 

cybersecurity risks

COBIT 5 EDM03.02, APO12.02, APO12.05,

DSS04.02

ISA 62443-2-1:2009 4.2.3.1, 4.2.3.3, 4.2.3.8, 

4.2.3.9, 4.2.3.11, 4.3.2.4.3, 4.3.2.6.3

ISO/IEC 27001:2013 Clause 6

NIST SP 800-53 Rev. 4 SA-2, PM-3, PM-7, PM9, PM-10, PM-11

Risk Assessment (ID.RA): The 

organization understands the 

cybersecurity risk to 

organizational operations 

(including mission, functions, 

image, or reputation), 

organizational assets, and 

individuals.

ID.RA-1: Asset vulnerabilities are 

identified and documented

CIS CSC 4

COBIT 5 APO12.01, APO12.02, APO12.03, 

APO12.04, DSS05.01, DSS05.02

ISA 62443-2-1:2009 4.2.3, 4.2.3.7, 4.2.3.9, 

4.2.3.12

ISO/IEC 27001:2013 A.12.6.1, A.18.2.3

NIST SP 800-53 Rev. 4 CA-2, CA-7, CA-8, RA3, RA-5, SA-5, SA-11, SI-2, SI-4, SI-5

ID.RA-2: Cyber threat intelligence is 

received from information sharing forums 

and sources

CIS CSC 4

COBIT 5 BAI08.01

ISA 62443-2-1:2009 4.2.3, 4.2.3.9, 4.2.3.12

ISO/IEC 27001:2013 A.6.1.4

NIST SP 800-53 Rev. 4 SI-5, PM-15, PM-16
Revised December 5, 2017 Cybersecurity Framework Version 1.1 Draft 2

28 DRAFT

Function Category Subcategory Informative References

ID.RA-3: Threats, both internal and 

external, are identified and documented

CIS CSC 4

COBIT 5 APO12.01, APO12.02, APO12.03, 

APO12.04

ISA 62443-2-1:2009 4.2.3, 4.2.3.9, 4.2.3.12

ISO/IEC 27001:2013 Clause 6.1.2

NIST SP 800-53 Rev. 4 RA-3, SI-5, PM-12, PM16

ID.RA-4: Potential business impacts and 

likelihoods are identified

CIS CSC 4

COBIT 5 DSS04.02

ISA 62443-2-1:2009 4.2.3, 4.2.3.9, 4.2.3.12

ISO/IEC 27001:2013 A.16.1.6, Clause 6.1.2

NIST SP 800-53 Rev. 4 RA-2, RA-3, SA-14, PM9, PM-11

ID.RA-5: Threats, vulnerabilities, 

likelihoods, and impacts are used to 

determine risk

CIS CSC 4

COBIT 5 APO12.02

ISO/IEC 27001:2013 A.12.6.1

NIST SP 800-53 Rev. 4 RA-2, RA-3, PM-16

ID.RA-6: Risk responses are identified and 

prioritized

CIS CSC 4

COBIT 5 APO12.05, APO13.02

ISO/IEC 27001:2013 Clause 6.1.3

NIST SP 800-53 Rev. 4 PM-4, PM-9

Risk Management Strategy

(ID.RM): The organization’s 

priorities, constraints, risk 

tolerances, and assumptions are 

established and used to support 

operational risk decisions.

ID.RM-1: Risk management processes are 

established, managed, and agreed to by 

organizational stakeholders

CIS CSC 4

COBIT 5 APO12.04, APO12.05, APO13.02, 

BAI02.03, BAI04.02

ISA 62443-2-1:2009 4.3.4.2

ISO/IEC 27001:2013 Clause 6.1.3, Clause 8.3, 

Clause 9.3

NIST SP 800-53 Rev. 4 PM-9

ID.RM-2: Organizational risk tolerance is 

determined and clearly expressed

COBIT 5 APO12.06

ISA 62443-2-1:2009 4.3.2.6.5

ISO/IEC 27001:2013 Clause 6.1.3, Clause 8.3

NIST SP 800-53 Rev. 4 PM-9
Revised December 5, 2017 Cybersecurity Framework Version 1.1 Draft 2

29 DRAFT

Function Category Subcategory Informative References

ID.RM-3: The organization’s 

determination of risk tolerance is informed 

by its role in critical infrastructure and 

sector specific risk analysis

COBIT 5 APO12.02

ISO/IEC 27001:2013 Clause 6.1.3, Clause 8.3

NIST SP 800-53 Rev. 4 SA-14, PM-8, PM-9, PM11

Supply Chain Risk 

Management (ID.SC):

The organization’s priorities, 

constraints, risk tolerances, and 

assumptions are established and 

used to support risk decisions 

associated with managing supply 

chain risk. The organization has 

established and implemented the 

processes to identify, assess and 

manage supply chain risks.

ID.SC-1: Cyber supply chain risk 

management processes are identified, 

established, assessed, managed, and agreed 

to by organizational stakeholders

CIS CSC 4

COBIT 5 APO10.01, APO10.04, APO12.04, 

APO12.05, APO13.02, BAI01.03, BAI02.03, 

BAI04.02

ISA 62443-2-1:2009 4.3.4.2

ISO/IEC 27001:2013 A.15.1.1, A.15.1.2, 

A.15.1.3, A.15.2.1, A.15.2.2

NIST SP 800-53 Rev. 4 SA-9, SA-12, PM-9

ID.SC-2: Identify, prioritize and assess 

suppliers and third-party partners of

information systems, components and 

services using a cyber supply chain risk 

assessment process

COBIT 5 APO10.01, APO10.02, APO10.04, 

APO10.05, APO12.01, APO12.02, APO12.03, 

APO12.04, APO12.05, APO12.06, APO13.02, 

BAI02.03

ISA 62443-2-1:2009 4.2.3.1, 4.2.3.2, 4.2.3.3, 

4.2.3.4, 4.2.3.6, 4.2.3.8, 4.2.3.9, 4.2.3.10, 4.2.3.12, 

4.2.3.13, 4.2.3.14

ISO/IEC 27001:2013 A.15.2.1, A.15.2.2

NIST SP 800-53 Rev. 4 RA-2, RA-3, SA-12, SA14, SA-15, PM-9

ID.SC-3: Suppliers and third-party partners

are required by contract to implement 

appropriate measures designed to meet the 

objectives of the Information Security 

program or Cyber Supply Chain Risk 

Management Plan.

COBIT 5 APO10.01, APO10.02, APO10.03, 

APO10.04, APO10.05

ISA 62443-2-1:2009 4.3.2.6.4, 4.3.2.6.7

ISO/IEC 27001:2013 A.15.1.1, A.15.1.2, A.15.1.3

NIST SP 800-53 Rev. 4 SA-9, SA-11, SA-12, PM9

ID.SC-4: Suppliers and third-party partners

are routinely assessed to confirm that they 

are meeting their contractual obligations.

Reviews of audits, summaries of test 

results, or other equivalent evaluations of 

suppliers/providers are conducted

COBIT 5 APO10.01, APO10.03, APO10.04, 

APO10.05, MEA01.01, MEA01.02, MEA01.03, 

MEA01.04, MEA01.05 

ISA 62443-2-1:2009 4.3.2.6.7

ISA 62443-3-3:2013 SR 6.1

ISO/IEC 27001:2013 A.15.2.1, A.15.2.2
Revised December 5, 2017 Cybersecurity Framework Version 1.1 Draft 2

30 DRAFT

Function Category Subcategory Informative References

NIST SP 800-53 Rev. 4 AU-2, AU-6, AU-12, AU16, PS-7, SA-9, SA-12

ID.SC-5: Response and recovery planning 

and testing are conducted with suppliers

and third-party providers

CIS CSC 19, 20

COBIT 5 DSS04.04

ISA 62443-2-1:2009 4.3.2.5.7, 4.3.4.5.11 

ISA 62443-3-3:2013 SR 2.8, SR 3.3, SR.6.1, SR 

7.3, SR 7.4

ISO/IEC 27001:2013 A.17.1.3 

NIST SP 800-53 Rev. 4 CP-2, CP-4, IR-3, IR-4, 

IR-6, IR-8, IR-9

PROTECT (PR)

Identity Management, 

Authentication and Access 

Control (PR.AC): Access to 

physical and logical assets and 

associated facilities is limited to 

authorized users, processes, and 

devices, and is managed 

consistent with the assessed risk 

of unauthorized access to 

authorized activities and 

transactions.

PR.AC-1: Identities and credentials are 

issued, managed, verified, revoked, and 

audited for authorized devices, users and 

processes

CIS CSC 1, 5, 15, 16

COBIT 5 DSS05.04, DSS06.03

ISA 62443-2-1:2009 4.3.3.5.1

ISA 62443-3-3:2013 SR 1.1, SR 1.2, SR 1.3, SR 

1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9

e3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.2, A.9.4.3

NIST SP 800-53 Rev. 4 AC-1, AC-2, IA-1, IA-2, 

IA-3, IA-4, IA-5, IA-6, IA-7, IA-8, IA-9, IA-10, 

IA-11

PR.AC-2: Physical access to assets is 

managed and protected

COBIT 5 DSS01.04, DSS05.05

ISA 62443-2-1:2009 4.3.3.3.2, 4.3.3.3.8

ISO/IEC 27001:2013 A.11.1.1, A.11.1.2, 

A.11.1.3, A.11.1.4, A.11.1.5, A.11.1.6, A.11.2.1,

A.11.2.3, A.11.2.5, A.11.2.6, A.11.2.7, A.11.2.8

NIST SP 800-53 Rev. 4 PE-2, PE-3, PE-4, PE-5, 

PE-6, PE-8

PR.AC-3: Remote access is managed

CIS CSC 12

COBIT 5 APO13.01, DSS01.04, DSS05.03

ISA 62443-2-1:2009 4.3.3.6.6

ISA 62443-3-3:2013 SR 1.13, SR 2.6

ISO/IEC 27001:2013 A.6.2.1, A.6.2.2, A.11.2.6, 

A.13.1.1, A.13.2.1
Revised December 5, 2017 Cybersecurity Framework Version 1.1 Draft 2

31 DRAFT

Function Category Subcategory Informative References

NIST SP 800-53 Rev. 4 AC-1, AC17, AC-19, AC20, SC-15

PR.AC-4: Access permissions and 

authorizations are managed, incorporating 

the principles of least privilege and 

separation of duties

CIS CSC 3, 5, 12, 14, 15, 16, 18

COBIT 5 DSS05.04

ISA 62443-2-1:2009 4.3.3.7.3

ISA 62443-3-3:2013 SR 2.1

ISO/IEC 27001:2013 A.6.1.2, A.9.1.2, A.9.2.3, 

A.9.4.1, A.9.4.4, A.9.4.5

NIST SP 800-53 Rev. 4 AC-1, AC-2, AC-3, AC5, AC-6, AC-14, AC-16, AC-24

PR.AC-5: Network integrity is protected, 

incorporating network segregation where 

appropriate

CIS CSC 9, 14, 15, 18

COBIT 5 DSS01.05, DSS05.02

ISA 62443-2-1:2009 4.3.3.4

ISA 62443-3-3:2013 SR 3.1, SR 3.8

ISO/IEC 27001:2013 A.13.1.1, A.13.1.3, 

A.13.2.1, A.14.1.2, A.14.1.3

NIST SP 800-53 Rev. 4 AC-4, AC-10, SC-7

PR.AC-6: Identities are proofed and bound 

to credentials and asserted in interactions

when appropriate

CIS CSC, 16

COBIT 5 DSS05.04, DSS05.05, DSS05.07, 

DSS06.03

ISA 62443-2-1:2009 4.3.3.2.2, 4.3.3.5.2, 4.3.3.7.2, 

4.3.3.7.4

ISA 62443-3-3:2013 SR 1.1, SR 1.2, SR 1.4, SR 

1.5, SR 1.9, SR 2.1

ISO/IEC 27001:2013, A.7.1.1, A.9.2.1 

NIST SP 800-53 Rev. 4 AC-1, AC-2, AC-3, AC16, AC-19, AC-24, IA-1, IA-2, IA-4, IA-5, IA-8, 

PE-2, PS-3

PR.AC-7: Users, devices, and other assets

are authenticated (e.g., single-factor, multifactor) commensurate with the risk of the 

transaction (e.g., individuals’ security and 

privacy risks and other organizational 

risks)

CIS CSC 1, 12, 15, 16

COBIT 5 DSS05.04, DSS05.10, DSS06.10

ISA 62443-2-1:2009 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 

4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 

4.3.3.6.9
Revised December 5, 2017 Cybersecurity Framework Version 1.1 Draft 2

32 DRAFT

Function Category Subcategory Informative References

ISA 62443-3-3:2013 SR 1.1, SR 1.2, SR 1.5, SR 

1.7, SR 1.8, SR 1.9, SR 1.10

ISO/IEC 27001:2013 A.9.2.1, A.9.2.4, A.9.3.1, 

A.9.4.2, A.9.4.3, A.18.1.4

NIST SP 800-53 Rev. 4 AC-7, AC-8, AC-9, AC11, AC-12, AC-14, IA-1, IA-2, IA-3, IA-4, IA-5, 

IA-8, IA-9, IA-10, IA-11

Awareness and Training

(PR.AT): The organization’s 

personnel and partners are 

provided cybersecurity awareness 

education and are adequately 

trained to perform their 

information security-related 

duties and responsibilities 

consistent with related policies, 

procedures, and agreements.

PR.AT-1: All users are informed and 

trained 

CIS CSC 17, 18

COBIT 5 APO07.03, BAI05.07

ISA 62443-2-1:2009 4.3.2.4.2

ISO/IEC 27001:2013 A.7.2.2, A.12.2.1

NIST SP 800-53 Rev. 4 AT-2, PM-13

PR.AT-2: Privileged users understand 

roles and responsibilities 

CIS CSC 5, 17, 18

COBIT 5 APO07.02, DSS05.04, DSS06.03

ISA 62443-2-1:2009 4.3.2.4.2, 4.3.2.4.3

ISO/IEC 27001:2013 A.6.1.1, A.7.2.2 

NIST SP 800-53 Rev. 4 AT-3, PM-13

PR.AT-3: Third-party stakeholders (e.g., 

suppliers, customers, partners) understand 

roles and responsibilities 

CIS CSC 17

COBIT 5 APO07.03, APO07.06, APO10.04, 

APO10.05

ISA 62443-2-1:2009 4.3.2.4.2

ISO/IEC 27001:2013 A.6.1.1, A.7.2.1, A.7.2.2

NIST SP 800-53 Rev. 4 PS-7, SA-9, SA-16

PR.AT-4: Senior executives understand 

roles and responsibilities 

CIS CSC 17, 19

COBIT 5 EDM01.01, APO01.02, APO07.03

ISA 62443-2-1:2009 4.3.2.4.2

ISO/IEC 27001:2013 A.6.1.1, A.7.2.2 

NIST SP 800-53 Rev. 4 AT-3, PM-13

PR.AT-5: Physical and information 

security personnel understand roles and

responsibilities 

CIS CSC 17

COBIT 5 APO07.03

ISA 62443-2-1:2009 4.3.2.4.2

ISO/IEC 27001:2013 A.6.1.1, A.7.2.2 
Revised December 5, 2017 Cybersecurity Framework Version 1.1 Draft 2

33 DRAFT

Function Category Subcategory Informative References

NIST SP 800-53 Rev. 4 AT-3, IR-2, PM-13

Data Security (PR.DS): 

Information and records (data) are 

managed consistent with the 

organization’s risk strategy to 

protect the confidentiality, 

integrity, and availability of 

information.

PR.DS-1: Data-at-rest is protected

CIS CSC 13, 14

COBIT 5 APO01.06, BAI02.01, BAI06.01, 

DSS04.07, DSS05.03, DSS06.06

ISA 62443-3-3:2013 SR 3.4, SR 4.1

ISO/IEC 27001:2013 A.8.2.3

NIST SP 800-53 Rev. 4 MP-8, SC-12, SC-28

PR.DS-2: Data-in-transit is protected

CIS CSC 13, 14

COBIT 5 APO01.06, DSS05.02, DSS06.06

ISA 62443-3-3:2013 SR 3.1, SR 3.8, SR 4.1, SR 

4.2

ISO/IEC 27001:2013 A.8.2.3, A.13.1.1, A.13.2.1, 

A.13.2.3, A.14.1.2, A.14.1.3

NIST SP 800-53 Rev. 4 SC-8, SC-11, SC-12

PR.DS-3: Assets are formally managed 

throughout removal, transfers, and 

disposition

CIS CSC 1

COBIT 5 BAI09.03

ISA 62443-2-1:2009 4.3.3.3.9, 4.3.4.4.1

ISA 62443-3-3:2013 SR 4.2

ISO/IEC 27001:2013 A.8.2.3, A.8.3.1, A.8.3.2, 

A.8.3.3, A.11.2.5, A.11.2.7

NIST SP 800-53 Rev. 4 CM-8, MP-6, PE-16

PR.DS-4: Adequate capacity to ensure 

availability is maintained

CIS CSC 1, 2, 13

COBIT 5 APO13.01, BAI04.04

ISA 62443-3-3:2013 SR 7.1, SR 7.2

ISO/IEC 27001:2013 A.12.1.3, A.17.2.1

NIST SP 800-53 Rev. 4 AU-4, CP-2, SC-5

PR.DS-5: Protections against data leaks 

are implemented

CIS CSC 13

COBIT 5 APO01.06, DSS05.04, DSS05.07, 

DSS06.02

ISA 62443-3-3:2013 SR 5.2

ISO/IEC 27001:2013 A.6.1.2, A.7.1.1, A.7.1.2, 

A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, 

A.9.4.1, A.9.4.4, A.9.4.5, A.10.1.1, A.11.1.4, 
Revised December 5, 2017 Cybersecurity Framework Version 1.1 Draft 2

34 DRAFT

Function Category Subcategory Informative References

A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, 

A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3

NIST SP 800-53 Rev. 4 AC-4, AC-5, AC-6, PE19, PS-3, PS-6, SC-7, SC-8, SC-13, SC-31, SI-4

PR.DS-6: Integrity checking mechanisms 

are used to verify software, firmware, and 

information integrity

CIS CSC 2, 3

COBIT 5 APO01.06, BAI06.01, DSS06.02

ISA 62443-3-3:2013 SR 3.1, SR 3.3, SR 3.4, SR 

3.8

ISO/IEC 27001:2013 A.12.2.1, A.12.5.1, 

A.14.1.2, A.14.1.3, A.14.2.4

NIST SP 800-53 Rev. 4 SC-16, SI-7

PR.DS-7: The development and testing 

environment(s) are separate from the 

production environment

CIS CSC 18, 20

COBIT 5 BAI03.08, BAI07.04

ISO/IEC 27001:2013 A.12.1.4

NIST SP 800-53 Rev. 4 CM-2

PR.DS-8: Integrity checking mechanisms 

are used to verify hardware integrity

COBIT 5 BAI03.05

ISA 62443-2-1:2009 4.3.4.4.4

ISO/IEC 27001:2013 A.11.2.4

NIST SP 800-53 Rev. 4 SA-10, SI-7

Information Protection 

Processes and Procedures

(PR.IP): Security policies (that 

address purpose, scope, roles, 

responsibilities, management 

commitment, and coordination 

among organizational entities), 

processes, and procedures are 

maintained and used to manage 

protection of information systems 

and assets.

PR.IP-1: A baseline configuration of 

information technology/industrial control

systems is created and maintained 

incorporating appropriate security 

principles (e.g. concept of least 

functionality)

CIS CSC 3, 9, 11

COBIT 5 BAI10.01, BAI10.02, BAI10.03, 

BAI10.05

ISA 62443-2-1:2009 4.3.4.3.2, 4.3.4.3.3

ISA 62443-3-3:2013 SR 7.6

ISO/IEC 27001:2013 A.12.1.2, A.12.5.1, 

A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4

NIST SP 800-53 Rev. 4 CM-2, CM-3, CM-4, CM5, CM-6, CM-7, CM-9, SA-10

PR.IP-2: A System Development Life 

Cycle to manage systems is implemented

CIS CSC 18

COBIT 5 APO13.01, BAI03.01, BAI03.02, 

BAI03.03

ISA 62443-2-1:2009 4.3.4.3.3
Revised December 5, 2017 Cybersecurity Framework Version 1.1 Draft 2

35 DRAFT

Function Category Subcategory Informative References

ISO/IEC 27001:2013 A.6.1.5, A.14.1.1, A.14.2.1, 

A.14.2.5

NIST SP 800-53 Rev. 4 PL-8, SA-3, SA-4, SA-8, 

SA-10, SA-11, SA-12, SA-15, SA-17, SI-12, SI13, SI-14, SI-16, SI-17

PR.IP-3: Configuration change control 

processes are in place

CIS CSC 3, 11

COBIT 5 BAI01.06, BAI06.01

ISA 62443-2-1:2009 4.3.4.3.2, 4.3.4.3.3

ISA 62443-3-3:2013 SR 7.6

ISO/IEC 27001:2013 A.12.1.2, A.12.5.1, 

A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4

NIST SP 800-53 Rev. 4 CM-3, CM-4, SA-10

PR.IP-4: Backups of information are 

conducted, maintained, and tested 

periodically

CIS CSC 10

COBIT 5 APO13.01, DSS01.01, DSS04.07

ISA 62443-2-1:2009 4.3.4.3.9

ISA 62443-3-3:2013 SR 7.3, SR 7.4

ISO/IEC 27001:2013 A.12.3.1, A.17.1.2, 

A.17.1.3, A.18.1.3

NIST SP 800-53 Rev. 4 CP-4, CP-6, CP-9

PR.IP-5: Policy and regulations regarding 

the physical operating environment for 

organizational assets are met

COBIT 5 DSS01.04, DSS05.05

ISA 62443-2-1:2009 4.3.3.3.1 4.3.3.3.2, 4.3.3.3.3, 

4.3.3.3.5, 4.3.3.3.6

ISO/IEC 27001:2013 A.11.1.4, A.11.2.1, 

A.11.2.2, A.11.2.3

NIST SP 800-53 Rev. 4 PE-10, PE-12, PE-13, PE14, PE-15, PE-18

PR.IP-6: Data is destroyed according to 

policy

COBIT 5 BAI09.03, DSS05.06

ISA 62443-2-1:2009 4.3.4.4.4

ISA 62443-3-3:2013 SR 4.2

ISO/IEC 27001:2013 A.8.2.3, A.8.3.1, A.8.3.2, 

A.11.2.7

NIST SP 800-53 Rev. 4 MP-6
Revised December 5, 2017 Cybersecurity Framework Version 1.1 Draft 2

36 DRAFT

Function Category Subcategory Informative References

PR.IP-7: Protection processes are 

continuously improved

COBIT 5 APO11.06, APO12.06, DSS04.05

ISA 62443-2-1:2009 4.4.3.1, 4.4.3.2, 4.4.3.3, 

4.4.3.4, 4.4.3.5, 4.4.3.6, 4.4.3.7, 4.4.3.8

ISO/IEC 27001:2013 A.16.1.6, Clause 9, Clause 

10

NIST SP 800-53 Rev. 4 CA-2, CA-7, CP-2, IR-8, 

PL-2, PM-6

PR.IP-8: Effectiveness of protection 

technologies is shared with appropriate 

parties

COBIT 5 BAI08.04, DSS03.04

ISO/IEC 27001:2013 A.16.1.6 

NIST SP 800-53 Rev. 4 AC-21, CA-7, SI-4

PR.IP-9: Response plans (Incident 

Response and Business Continuity) and 

recovery plans (Incident Recovery and 

Disaster Recovery) are in place and 

managed

CIS CSC 19

COBIT 5 APO12.06, DSS04.03

ISA 62443-2-1:2009 4.3.2.5.3, 4.3.4.5.1 

ISO/IEC 27001:2013 A.16.1.1, A.17.1.1, 

A.17.1.2, A.17.1.3

NIST SP 800-53 Rev. 4 CP-2, CP-7, CP-12, CP13, IR-7, IR-8, IR-9, PE-17

PR.IP-10: Response and recovery plans 

are tested

CIS CSC 19, 20

COBIT 5 DSS04.04

ISA 62443-2-1:2009 4.3.2.5.7, 4.3.4.5.11

ISA 62443-3-3:2013 SR 3.3

ISO/IEC 27001:2013 A.17.1.3

NIST SP 800-53 Rev. 4 CP-4, IR-3, PM-14

PR.IP-11: Cybersecurity is included in 

human resources practices (e.g., 

deprovisioning, personnel screening)

CIS CSC 5, 16

COBIT 5 APO07.01, APO07.02, APO07.03, 

APO07.04, APO07.05

ISA 62443-2-1:2009 4.3.3.2.1, 4.3.3.2.2, 4.3.3.2.3

ISO/IEC 27001:2013 A.7.1.1, A.7.1.2, A.7.2.1, 

A.7.2.2, A.7.2.3, A.7.3.1, A.8.1.4 

NIST SP 800-53 Rev. 4 PS-1, PS-2, PS-3, PS-4, 

PS-5, PS-6, PS-7, PS-8, SA-21
Revised December 5, 2017 Cybersecurity Framework Version 1.1 Draft 2

37 DRAFT

Function Category Subcategory Informative References

PR.IP-12: A vulnerability management

plan is developed and implemented

CIS CSC 4, 18, 20

COBIT 5 BAI03.10, DSS05.01, DSS05.02

ISO/IEC 27001:2013 A.12.6.1, A.14.2.3, 

A.16.1.3, A.18.2.2, A.18.2.3

NIST SP 800-53 Rev. 4 RA-3, RA-5, SI-2

Maintenance (PR.MA):

Maintenance and repairs of 

industrial control and information 

system components are performed 

consistent with policies and 

procedures.

PR.MA-1: Maintenance and repair of 

organizational assets are performed and 

logged in a timely manner, with approved 

and controlled tools

COBIT 5 BAI03.10, BAI09.02, BAI09.03, 

DSS01.05

ISA 62443-2-1:2009 4.3.3.3.7

ISO/IEC 27001:2013 A.11.1.2, A.11.2.4, 

A.11.2.5, A.11.2.6

NIST SP 800-53 Rev. 4 MA-2, MA-3, MA-5, 

MA-6

PR.MA-2: Remote maintenance of 

organizational assets is approved, logged, 

and performed in a manner that prevents 

unauthorized access

CIS CSC 3, 5

COBIT 5 DSS05.04

ISA 62443-2-1:2009 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 

4.3.3.6.8

ISO/IEC 27001:2013 A.11.2.4, A.15.1.1, A.15.2.1

NIST SP 800-53 Rev. 4 MA-4

Protective Technology (PR.PT): 

Technical security solutions are 

managed to ensure the security 

and resilience of systems and 

assets, consistent with related 

policies, procedures, and 

agreements.

PR.PT-1: Audit/log records are 

determined, documented, implemented, 

and reviewed in accordance with policy

CIS CSC 1, 3, 5, 6, 14, 15, 16

COBIT 5 APO11.04, BAI03.05, DSS05.04, 

DSS05.07, MEA02.01

ISA 62443-2-1:2009 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 

4.4.2.1, 4.4.2.2, 4.4.2.4

ISA 62443-3-3:2013 SR 2.8, SR 2.9, SR 2.10, SR 

2.11, SR 2.12

ISO/IEC 27001:2013 A.12.4.1, A.12.4.2, 

A.12.4.3, A.12.4.4, A.12.7.1

NIST SP 800-53 Rev. 4 AU Family

PR.PT-2: Removable media is protected 

and its use restricted according to policy

CIS CSC 8, 13

COBIT 5 APO13.01, DSS05.02, DSS05.06

ISA 62443-3-3:2013 SR 2.3

ISO/IEC 27001:2013 A.8.2.1, A.8.2.2, A.8.2.3, 

A.8.3.1, A.8.3.3, A.11.2.9
Revised December 5, 2017 Cybersecurity Framework Version 1.1 Draft 2

38 DRAFT

Function Category Subcategory Informative References

NIST SP 800-53 Rev. 4 MP-2, MP-3, MP-4, MP5, MP-7, MP-8

PR.PT-3: The principle of least 

functionality is incorporated by configuring 

systems to provide only essential 

capabilities

CIS CSC 3, 11, 14

COBIT 5 DSS05.02, DSS05.05, DSS06.06

ISA 62443-2-1:2009 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 

4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 

4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 

4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 

4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4

ISA 62443-3-3:2013 SR 1.1, SR 1.2, SR 1.3, SR 

1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 

1.10, SR 1.11, SR 1.12, SR 1.13, SR 2.1, SR 2.2, 

SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7

ISO/IEC 27001:2013 A.9.1.2

NIST SP 800-53 Rev. 4 AC-3, CM-7

PR.PT-4: Communications and control 

networks are protected

CIS CSC 8, 12, 15

COBIT 5 DSS05.02, APO13.01

ISA 62443-3-3:2013 SR 3.1, SR 3.5, SR 3.8, SR 

4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 7.1, SR 7.6

ISO/IEC 27001:2013 A.13.1.1, A.13.2.1, A.14.1.3

NIST SP 800-53 Rev. 4 AC-4, AC-17, AC-18, 

CP-8, SC-7, SC-19, SC-20, SC-21, SC-22, SC-23, 

SC-24, SC-25, SC-29, SC-32, SC-36, SC-37, SC38, SC-39, SC-40, SC-41, SC-43

PR.PT-5: Systems operate in pre-defined 

functional states to achieve availability 

(e.g. under duress, under attack, during 

recovery, normal operations)

COBIT 5 BAI04.01, BAI04.02, BAI04.03, 

BAI04.04, BAI04.05, DSS01.05

ISA 62443-2-1:2009 4.3.2.5.2

ISA 62443-3-3:2013 SR 7.1, SR 7.2

ISO/IEC 27001:2013 A.17.1.2, A.17.2.1 

NIST SP 800-53 Rev. 4 CP-7, CP-8, CP-11, CP13, PL-8, SA-14, SC-6

DETECT (DE) Anomalies and Events (DE.AE): 

Anomalous activity is detected in 

DE.AE-1: A baseline of network 

operations and expected data flows for 

CIS CSC 1, 4, 6, 12, 13, 15, 16

COBIT 5 DSS03.01

ISA 62443-2-1:2009 4.4.3.3
Revised December 5, 2017 Cybersecurity Framework Version 1.1 Draft 2

39 DRAFT

Function Category Subcategory Informative References

a timely manner and the potential 

impact of events is understood.

users and systems is established and 

managed

ISO/IEC 27001:2013 A.12.1.1, A.12.1.2, 

A.13.1.1, A.13.1.2

NIST SP 800-53 Rev. 4 AC-4, CA-3, CM-2, SI-4

DE.AE-2: Detected events are analyzed to 

understand attack targets and methods

CIS CSC 3, 6, 13, 15

COBIT 5 DSS05.07

ISA 62443-2-1:2009 4.3.4.5.6, 4.3.4.5.7, 4.3.4.5.8

ISA 62443-3-3:2013 SR 2.8, SR 2.9, SR 2.10, SR 

2.11, SR 2.12, SR 3.9, SR 6.1, SR 6.2

ISO/IEC 27001:2013 A.12.4.1, A.16.1.1, A.16.1.4

NIST SP 800-53 Rev. 4 AU-6, CA-7, IR-4, SI-4

DE.AE-3: Event data are collected and 

correlated from multiple sources and 

sensors

CIS CSC 1, 3, 4, 5, 6, 7, 8, 11, 12, 13, 14, 15, 16

COBIT 5 BAI08.02

ISA 62443-3-3:2013 SR 6.1

ISO/IEC 27001:2013 A.12.4.1, A.16.1.7

NIST SP 800-53 Rev. 4 AU-6, CA-7, IR-4, IR-5, 

IR-8, SI-4

DE.AE-4: Impact of events is determined

CIS CSC 4, 6

COBIT 5 APO12.06, DSS03.01

ISO/IEC 27001:2013 A.16.1.4

NIST SP 800-53 Rev. 4 CP-2, IR-4, RA-3, SI-4

DE.AE-5: Incident alert thresholds are 

established

CIS CSC 6, 19

COBIT 5 APO12.06, DSS03.01

ISA 62443-2-1:2009 4.2.3.10

ISO/IEC 27001:2013 A.16.1.4

NIST SP 800-53 Rev. 4 IR-4, IR-5, IR-8

Security Continuous 

Monitoring (DE.CM): The 

information system and assets are 

monitored at discrete intervals to 

identify cybersecurity events and 

DE.CM-1: The network is monitored to 

detect potential cybersecurity events

CIS CSC 1, 7, 8, 12, 13, 15, 16

COBIT 5 DSS01.03, DSS03.05, DSS05.07

ISA 62443-3-3:2013 SR 6.2

NIST SP 800-53 Rev. 4 AC-2, AU-12, CA-7, CM3, SC-5, SC-7, SI-4
Revised December 5, 2017 Cybersecurity Framework Version 1.1 Draft 2

40 DRAFT

Function Category Subcategory Informative References

verify the effectiveness of 

protective measures. DE.CM-2: The physical environment is 

monitored to detect potential cybersecurity 

events

COBIT 5 DSS01.04, DSS01.05

ISA 62443-2-1:2009 4.3.3.3.8

ISO/IEC 27001:2013 A.11.1.1, A.11.1.2

NIST SP 800-53 Rev. 4 CA-7, PE-3, PE-6, PE-20

DE.CM-3: Personnel activity is monitored 

to detect potential cybersecurity events

CIS CSC 5, 7, 14, 16

COBIT 5 DSS05.07

ISA 62443-3-3:2013 SR 6.2

ISO/IEC 27001:2013 A.12.4.1, A.12.4.3

NIST SP 800-53 Rev. 4 AC-2, AU-12, AU-13, 

CA-7, CM-10, CM-11

DE.CM-4: Malicious code is detected

CIS CSC 4, 7, 8, 12

COBIT 5 DSS05.01

ISA 62443-2-1:2009 4.3.4.3.8

ISA 62443-3-3:2013 SR 3.2

ISO/IEC 27001:2013 A.12.2.1

NIST SP 800-53 Rev. 4 SI-3, SI-8

DE.CM-5: Unauthorized mobile code is 

detected

CIS CSC 7, 8

COBIT 5 DSS05.01

ISA 62443-3-3:2013 SR 2.4

ISO/IEC 27001:2013 A.12.5.1, A.12.6.2

NIST SP 800-53 Rev. 4 SC-18, SI-4, SC-44

DE.CM-6: External service provider 

activity is monitored to detect potential 

cybersecurity events

COBIT 5 APO07.06, APO10.05

ISO/IEC 27001:2013 A.14.2.7, A.15.2.1

NIST SP 800-53 Rev. 4 CA-7, PS-7, SA-4, SA-9, 

SI-4

DE.CM-7: Monitoring for unauthorized 

personnel, connections, devices, and 

software is performed

CIS CSC 1, 2, 3, 5, 9, 12, 13, 15, 16

COBIT 5 DSS05.02, DSS05.05

ISO/IEC 27001:2013 A.12.4.1, A.14.2.7, A.15.2.1

NIST SP 800-53 Rev. 4 AU-12, CA-7, CM-3,

CM-8, PE-3, PE-6, PE-20, SI-4

DE.CM-8: Vulnerability scans are 

performed CIS CSC 4, 20
Revised December 5, 2017 Cybersecurity Framework Version 1.1 Draft 2

41 DRAFT

Function Category Subcategory Informative References

COBIT 5 BAI03.10, DSS05.01

ISA 62443-2-1:2009 4.2.3.1, 4.2.3.7

ISO/IEC 27001:2013 A.12.6.1

NIST SP 800-53 Rev. 4 RA-5

Detection Processes (DE.DP):

Detection processes and 

procedures are maintained and 

tested to ensure timely and 

adequate awareness of anomalous 

events.

DE.DP-1: Roles and responsibilities for 

detection are well defined to ensure 

accountability

CIS CSC 19

COBIT 5 APO01.02, DSS05.01, DSS06.03

ISA 62443-2-1:2009 4.4.3.1

ISO/IEC 27001:2013 A.6.1.1, A.7.2.2

NIST SP 800-53 Rev. 4 CA-2, CA-7, PM-14

DE.DP-2: Detection activities comply with 

all applicable requirements

COBIT 5 DSS06.01, MEA03.03, MEA03.04

ISA 62443-2-1:2009 4.4.3.2

ISO/IEC 27001:2013 A.18.1.4, A.18.2.2, A.18.2.3

NIST SP 800-53 Rev. 4 AC-25, CA-2, CA-7, SA18, SI-4, PM-14

DE.DP-3: Detection processes are tested

COBIT 5 APO13.02, DSS05.02

ISA 62443-2-1:2009 4.4.3.2

ISA 62443-3-3:2013 SR 3.3

ISO/IEC 27001:2013 A.14.2.8

NIST SP 800-53 Rev. 4 CA-2, CA-7, PE-3, SI-3,

SI-4, PM-14

DE.DP-4: Event detection information is 

communicated to appropriate parties

CIS CSC 19

COBIT 5 APO08.04, APO12.06, DSS02.05

ISA 62443-2-1:2009 4.3.4.5.9

ISA 62443-3-3:2013 SR 6.1

ISO/IEC 27001:2013 A.16.1.2, A.16.1.3

NIST SP 800-53 Rev. 4 AU-6, CA-2, CA-7, RA5, SI-4

DE.DP-5: Detection processes are 

continuously improved

COBIT 5 APO11.06, APO12.06, DSS04.05

ISA 62443-2-1:2009 4.4.3.4

ISO/IEC 27001:2013 A.16.1.6

NIST SP 800-53 Rev. 4, CA-2, CA-7, PL-2, RA5, SI-4, PM-14
Revised December 5, 2017 Cybersecurity Framework Version 1.1 Draft 2

42 DRAFT

Function Category Subcategory Informative References

RESPOND (RS)

Response Planning (RS.RP):

Response processes and 

procedures are executed and 

maintained, to ensure timely 

response to detected cybersecurity 

incidents.

RS.RP-1: Response plan is executed 

during or after an incident

CIS CSC 19

COBIT 5 APO12.06, BAI01.10

ISA 62443-2-1:2009 4.3.4.5.1

ISO/IEC 27001:2013 A.16.1.5

NIST SP 800-53 Rev. 4 CP-2, CP-10, IR-4, IR-8 

Communications (RS.CO): 

Response activities are 

coordinated with internal and 

external stakeholders, as 

appropriate, to include external 

support from law enforcement 

agencies.

RS.CO-1: Personnel know their roles and 

order of operations when a response is 

needed

CIS CSC 19

COBIT 5 EDM03.02, APO01.02, APO12.03

ISA 62443-2-1:2009 4.3.4.5.2, 4.3.4.5.3, 4.3.4.5.4

ISO/IEC 27001:2013 A.6.1.1, A.7.2.2, A.16.1.1 

NIST SP 800-53 Rev. 4 CP-2, CP-3, IR-3, IR-8

RS.CO-2: Incidents are reported consistent 

with established criteria

CIS CSC 19

COBIT 5 DSS01.03

ISA 62443-2-1:2009 4.3.4.5.5

ISO/IEC 27001:2013 A.6.1.3, A.16.1.2

NIST SP 800-53 Rev. 4 AU-6, IR-6, IR-8

RS.CO-3: Information is shared consistent 

with response plans

CIS CSC 19

COBIT 5 DSS03.04

ISA 62443-2-1:2009 4.3.4.5.2

ISO/IEC 27001:2013 A.16.1.2, Clause 7.4, Clause 

16.1.2

NIST SP 800-53 Rev. 4 CA-2, CA-7, CP-2, IR-4, 

IR-8, PE-6, RA-5, SI-4

RS.CO-4: Coordination with stakeholders 

occurs consistent with response plans

CIS CSC 19

COBIT 5 DSS03.04

ISA 62443-2-1:2009 4.3.4.5.5

ISO/IEC 27001:2013 Clause 7.4

NIST SP 800-53 Rev. 4 CP-2, IR-4, IR-8

RS.CO-5: Voluntary information sharing 

occurs with external stakeholders to 

achieve broader cybersecurity situational 

awareness

CIS CSC 19

COBIT 5 BAI08.04

ISO/IEC 27001:2013 A.6.1.4

NIST SP 800-53 Rev. 4 SI-5, PM-15
Revised December 5, 2017 Cybersecurity Framework Version 1.1 Draft 2

43 DRAFT

Function Category Subcategory Informative References

Analysis (RS.AN): Analysis is 

conducted to ensure adequate 

response and support recovery 

activities.

RS.AN-1: Notifications from detection 

systems are investigated

CIS CSC 4, 6, 8, 19

COBIT 5 DSS02.04, DSS02.07

ISA 62443-2-1:2009 4.3.4.5.6, 4.3.4.5.7, 4.3.4.5.8

ISA 62443-3-3:2013 SR 6.1

ISO/IEC 27001:2013 A.12.4.1, A.12.4.3, A.16.1.5

NIST SP 800-53 Rev. 4 AU-6, CA-7, IR-4, IR-5, 

PE-6, SI-4 

RS.AN-2: The impact of the incident is 

understood

COBIT 5 DSS02.02

ISA 62443-2-1:2009 4.3.4.5.6, 4.3.4.5.7, 4.3.4.5.8

ISO/IEC 27001:2013 A.16.1.4, A.16.1.6

NIST SP 800-53 Rev. 4 CP-2, IR-4

RS.AN-3: Forensics are performed

COBIT 5 APO12.06, DSS03.02, DSS05.07

ISA 62443-3-3:2013 SR 2.8, SR 2.9, SR 2.10, SR 

2.11, SR 2.12, SR 3.9, SR 6.1

ISO/IEC 27001:2013 A.16.1.7 

NIST SP 800-53 Rev. 4 AU-7, IR-4

RS.AN-4: Incidents are categorized 

consistent with response plans

CIS CSC 19

COBIT 5 DSS02.02

ISA 62443-2-1:2009 4.3.4.5.6

ISO/IEC 27001:2013 A.16.1.4

NIST SP 800-53 Rev. 4 CP-2, IR-4, IR-5, IR-8

RS.AN-5: Processes are established to 

receive, analyze and respond to 

vulnerabilities disclosed to the organization 

from internal and external sources (e.g. 

internal testing, security bulletins, or 

security researchers)

CIS CSC 4, 19

COBIT 5 EDM03.02, DSS05.07

NIST SP 800-53 Rev. 4 SI-5, PM-15

Mitigation (RS.MI): Activities 

are performed to prevent 

expansion of an event, mitigate its 

effects, and resolve the incident.

RS.MI-1: Incidents are contained

CIS CSC 19

COBIT 5 APO12.06

ISA 62443-2-1:2009 4.3.4.5.6

ISA 62443-3-3:2013 SR 5.1, SR 5.2, SR 5.4

ISO/IEC 27001:2013 A.12.2.1, A.16.1.5
Revised December 5, 2017 Cybersecurity Framework Version 1.1 Draft 2

44 DRAFT

Function Category Subcategory Informative References

NIST SP 800-53 Rev. 4 IR-4

RS.MI-2: Incidents are mitigated

CIS CSC 4, 19

COBIT 5 APO12.06

ISA 62443-2-1:2009 4.3.4.5.6, 4.3.4.5.10

ISO/IEC 27001:2013 A.12.2.1, A.16.1.5

NIST SP 800-53 Rev. 4 IR-4

RS.MI-3: Newly identified vulnerabilities 

are mitigated or documented as accepted 

risks

CIS CSC 4

COBIT 5 APO12.06

ISO/IEC 27001:2013 A.12.6.1

NIST SP 800-53 Rev. 4 CA-7, RA-3, RA-5

Improvements (RS.IM): 

Organizational response activities 

are improved by incorporating 

lessons learned from current and 

previous detection/response 

activities.

RS.IM-1: Response plans incorporate 

lessons learned

COBIT 5 BAI01.13

ISA 62443-2-1:2009 4.3.4.5.10, 4.4.3.4

ISO/IEC 27001:2013 A.16.1.6, Clause 10

NIST SP 800-53 Rev. 4 CP-2, IR-4, IR-8

RS.IM-2: Response strategies are updated

COBIT 5 BAI01.13, DSS04.08

ISO/IEC 27001:2013 A.16.1.6, Clause 10

NIST SP 800-53 Rev. 4 CP-2, IR-4, IR-8

RECOVER (RC)

Recovery Planning (RC.RP): 

Recovery processes and 

procedures are executed and 

maintained to ensure timely 

restoration of systems or assets 

affected by cybersecurity 

incidents.

RC.RP-1: Recovery plan is executed 

during or after a cybersecurity incident

CIS CSC 10

COBIT 5 APO12.06, DSS02.05, DSS03.04

ISO/IEC 27001:2013 A.16.1.5

NIST SP 800-53 Rev. 4 CP-10, IR-4, IR-8

Improvements (RC.IM): 

Recovery planning and processes 

are improved by incorporating 

lessons learned into future 

activities.

RC.IM-1: Recovery plans incorporate 

lessons learned

COBIT 5 APO12.06, BAI05.07, DSS04.08

ISA 62443-2-1:2009 4.4.3.4

ISO/IEC 27001:2013 A.16.1.6, Clause 10

NIST SP 800-53 Rev. 4 CP-2, IR-4, IR-8

RC.IM-2: Recovery strategies are updated

COBIT 5 APO12.06, BAI07.08

ISO/IEC 27001:2013 A.16.1.6, Clause 10

NIST SP 800-53 Rev. 4 CP-2, IR-4, IR-8
Revised December 5, 2017 Cybersecurity Framework Version 1.1 Draft 2

45 DRAFT

Function Category Subcategory Informative References

Communications (RC.CO): 

Restoration activities are 

coordinated with internal and 

external parties, such as 

coordinating centers, Internet 

Service Providers, owners of 

attacking systems, victims, other 

CSIRTs, and vendors.

RC.CO-1: Public relations are managed COBIT 5 EDM03.02

ISO/IEC 27001:2013 A.6.1.4, Clause 7.4

RC.CO-2: Reputation after an event is 

repaired

COBIT 5 MEA03.02

ISO/IEC 27001:2013 Clause 7.4

RC.CO-3: Recovery activities are 

communicated to internal stakeholders and 

executive and management teams

COBIT 5 APO12.06

ISO/IEC 27001:2013 Clause 7.4

NIST SP 800-53 Rev. 4 CP-2, IR-4 

Information regarding Informative References described in Appendix A may be found at the following locations:

• Control Objectives for Information and Related Technology (COBIT): http://www.isaca.org/COBIT/Pages/default.aspx

• CIS Critical Security Controls for Effective Cyber Defense (CIS Controls): https://www.cisecurity.org 

• ANSI/ISA-62443-2-1 (99.02.01)-2009, Security for Industrial Automation and Control Systems: Establishing an Industrial 

Automation and Control Systems Security Program: https://www.isa.org/templates/onecolumn.aspx?pageid=111294&productId=116731

• ANSI/ISA-62443-3-3 (99.03.03)-2013, Security for Industrial Automation and Control Systems: System Security Requirements 

and Security Levels: https://www.isa.org/templates/one-column.aspx?pageid=111294&productId=116785

• ISO/IEC 27001, Information technology -- Security techniques -- Information security management systems -- Requirements: 

http://www.iso.org/iso/home/store/catalogue_ics/catalogue_detail_ics.htm?csnumber=54534

• NIST SP 800-53 Rev. 4 - NIST Special Publication 800-53 Revision 4, Security and Privacy Controls for Federal Information 

Systems and Organizations, April 2013 (including updates as of January 22, 2015). http://dx.doi.org/10.6028/NIST.SP.800-

53r4. Informative References are only mapped to the control level, though any control enhancement might be found useful in 

achieving a subcategory outcome.

Mappings between the Framework Core Subcategories and the specified sections in the Informative References are not intended to 

definitively determine whether the specified sections in the Informative References provide the desired Subcategory outcome.

Informative References are not exhaustive, in that not every element (e.g., control, requirement) of a given Informative Reference is 

mapped to Framework Core Subcategories.
Revised December 5, 2017 Cybersecurity Framework Version 1.1 Draft 2

46 DRAFT

1 Appendix	B:	Glossary

2 This appendix defines selected terms used in the publication.

3 Table 3: Framework Glossary

Buyer The people or organizations that consume a given product or service.

Category The subdivision of a Function into groups of cybersecurity outcomes, 

closely tied to programmatic needs and particular activities. Examples 

of Categories include “Asset Management,” “Identity Management 

and Access Control,” and “Detection Processes.”

Critical 

Infrastructure

Systems and assets, whether physical or virtual, so vital to the United 

States that the incapacity or destruction of such systems and assets 

would have a debilitating impact on cybersecurity, national economic 

security, national public health or safety, or any combination of those 

matters.

Cybersecurity The process of protecting information by preventing, detecting, and 

responding to attacks.

Cybersecurity 

Event

A cybersecurity change that may have an impact on organizational 

operations (including mission, capabilities, or reputation).

Cybersecurity 

Incident

A cybersecurity event that has been determined to have an impact on 

the organization prompting the need for response and recovery.

Detect (function) Develop and implement the appropriate activities to identify the 

occurrence of a cybersecurity event.

Framework A risk-based approach to reducing cybersecurity risk composed of 

three parts: the Framework Core, the Framework Profile, and the 

Framework Implementation Tiers. Also known as the “Cybersecurity 

Framework.”

Framework Core A set of cybersecurity activities and references that are common 

across critical infrastructure sectors and are organized around 

particular outcomes. The Framework Core comprises four types of 

elements: Functions, Categories, Subcategories, and Informative 

References.

Framework 

Implementation 

Tier

A lens through which to view the characteristics of an organization’s 

approach to risk—how an organization views cybersecurity risk and 

the processes in place to manage that risk.
Revised December 5, 2017 Cybersecurity Framework Version 1.1 Draft 2

47 DRAFT

Framework 

Profile

A representation of the outcomes that a particular system or 

organization has selected from the Framework Categories and 

Subcategories.

Function One of the main components of the Framework. Functions provide the 

highest level of structure for organizing basic cybersecurity activities 

into Categories and Subcategories. The five functions are Identify, 

Protect, Detect, Respond, and Recover.

Identify (function) Develop the organizational understanding to manage cybersecurity 

risk to systems, assets, data, and capabilities.

Informative 

Reference

A specific section of standards, guidelines, and practices common 

among critical infrastructure sectors that illustrates a method to 

achieve the outcomes associated with each Subcategory. An example 

of an Informative Reference is ISO/IEC 27001 Control A.10.8.3, 

which supports the “Data-in-transit is protected” Subcategory of the 

“Data Security” Category in the “Protect” function.

Mobile Code A program (e.g., script, macro, or other portable instruction) that can 

be shipped unchanged to a heterogeneous collection of platforms and 

executed with identical semantics.

Protect (function) Develop and implement the appropriate safeguards to ensure delivery 

of critical infrastructure services.

Privileged User A user that is authorized (and, therefore, trusted) to perform securityrelevant functions that ordinary users are not authorized to perform.

Recover (function) Develop and implement the appropriate activities to maintain plans for 

resilience and to restore any capabilities or services that were impaired 

due to a cybersecurity event.

Respond 

(function)

Develop and implement the appropriate activities to take action 

regarding a detected cybersecurity event.

Risk A measure of the extent to which an entity is threatened by a potential 

circumstance or event, and typically a function of: (i) the adverse 

impacts that would arise if the circumstance or event occurs; and (ii) 

the likelihood of occurrence.

Risk Management The process of identifying, assessing, and responding to risk.

Subcategory The subdivision of a Category into specific outcomes of technical 

and/or management activities. Examples of Subcategories include 

“External information systems are catalogued,” “Data-at-rest is 

protected,” and “Notifications from detection systems are 

investigated.”
Revised December 5, 2017 Cybersecurity Framework Version 1.1 Draft 2

48 DRAFT

Supplier Product and service providers used for an organization’s internal 

purposes (e.g., IT infrastructure) or integrated into the products of 

services provided to that organization’s Buyers.

Taxonomy A scheme of classification.

4
Revised December 5, 2017 Cybersecurity Framework Version 1.1 Draft 2

49 DRAFT

1 Appendix	C:	Acronyms

2

3 This appendix defines selected acronyms used in the publication.

4

5 CEA Cybersecurity Enhancement Act of 2014

6 COBIT Control Objectives for Information and Related Technology

7 CPS Cyber-Physical Systems

8 DHS Department of Homeland Security

9 EO Executive Order

10 ICS Industrial Control Systems

11 IEC International Electrotechnical Commission

12 IoT Internet of Things

13 IR Interagency Report

14 ISA International Society of Automation

15 ISAC Information Sharing and Analysis Center

16 ISAO Information Sharing and Analysis Organization

17 ISO International Organization for Standardization

18 IT Information Technology

19 NIST National Institute of Standards and Technology

20 OT Operational Technology

21 PII Personally Identifiable Information

22 RFI Request for Information

23 RMP Risk Management Process

24 SCADA Supervisory Control and Data Acquisition

25 SCRM Supply Chain Risk Management

26 SP Special Publication
Revised December 5, 2017 Cybersecurity Framework Version 1.1 Draft 2

50 DRAFT

27 Appendix	D: Revisions	and	Updates

28 Changes incorporated into the Framework Version 1.1 Draft 2 are displayed in Table 4.

29

30 Table 4: Changes in Framework Version 1.1

PAGE(S) CHANGE

p. ii A ‘Note to Reviewers on the Update and Next Steps’ was added to give readers a quick 

glance to the updates made and to request comments.

p. iv The ‘Table of Contents’ was modified to reflect all changes relative to the current draft of 

Version 1.1 update.

pp. 5-6 The ‘Executive Summary’ was modified to more clearly present the Framework, the 

development process, and next steps.

p. 7 Section 1.0 ‘Framework Introduction’ was updated to include the current chartering 

documents for Framework.

p. 7

Section 1.0 ‘Framework Introduction’ was updated to reflect security implications of a 

broadening use of technology (e.g. ICS/CPS/IoT) and to more clearly define Framework 

uses.

p. 10 Section 1.3 ‘Document Overview’ was modified to reflect the additional section and 

appendix added with this update.

p. 11 Figure 1: ‘Framework Core Structure’ was visually updated.

sic 

passim

The term “cybersecurity event” has been categorized into two separate concepts: 

cybersecurity event and cybersecurity incident. The difference is an incident may require a 

response and recovery, whereas an event may not have a response or recovery associated 

with it. An organization is expected to have many more events than incidents. 

p. 13 Section 2.2 ‘Framework Implementation Tiers’ - Paragraph 3 was modified to clarify the 

relationship between Tiers and Profiles during Tier selection. 

pp. 14-16

Section 2.2 ‘Framework Implementation Tiers’ - Cyber Supply Chain Risk Management 

(C-SCRM) was incorporated into the “External Participation” portion of the Tiers 

definitions. The updated “External Participation” portions of the Tiers reflect both CSCRM and elements of information sharing.

p. 14

Section 2.2 ‘Framework Implementation Tiers’ - Tier 2 ‘Risk Informed’ - Paragraph 2 was 

modified for clarification to include: 

“Consideration of cybersecurity in organizational objectives and programs may 

occur at some but not all levels of the organization. Cyber risk assessment of 

organizational and external assets occurs, but is not typically repeatable or reoccurring.”
Revised December 5, 2017 Cybersecurity Framework Version 1.1 Draft 2

51 DRAFT

PAGE(S) CHANGE

p. 15

Section 2.2 ‘Framework Implementation Tiers’ - Tier 3 ‘Repeatable’ - Paragraph 2 was 

modified for clarification to include:

“The organization consistently and accurately monitors cybersecurity risk of 

organizational assets. Senior cybersecurity and non-cybersecurity executives communicate 

regularly regarding cybersecurity risk. Senior executives ensure consideration of 

cybersecurity through all lines of operation in the organization.”

p. 15

Section 2.2 ‘Framework Implementation Tiers’ - Tier 4 ‘Adaptive’ - Paragraph 2 was 

modified for clarification to include: 

“The relationship between cybersecurity risk and organizational objectives is 

clearly understood and considered when making decisions. Senior executives monitor 

cybersecurity risk in the same context as financial risk and other organizational risks. The 

organizational budget is based on an understanding of the current and predicted risk 

environment and risk tolerance. Business units implement executive vision and analyze 

system-level risks in the context of the organizational risk tolerances.”

p. 15

Section 2.2 ‘Framework Implementation Tiers’ - Tier 4 ‘Adaptive’ - Paragraph 2 was 

modified for clarification to include: 

“The organization can quickly and efficiently account for changes to 

business/mission objectives in how risk is approached and communicated.”

p. 17 Figure 2 - The actions outlined for the ‘Senior Executive Level’ and the ‘Business/Process 

Level’ were modified.

p. 18

Section 3.0 ‘How to Use the Framework’ was modified to include the following phrase to 

show the connection between the Framework and the product development life cycle:

“The Framework can be applied throughout the life cycle phases of design, 

build/buy, deploy, operate, or decommission. The design phase should account for 

cybersecurity requirements as a part of a larger multi-disciplinary systems engineering 

process. A key milestone of the design phase is validation that the system cybersecurity 

specifications match the needs and risk disposition of the organization as captured in a 

Framework Profile. The desired cybersecurity outcomes prioritized in a Target Profile 

should be incorporated when a) developing the system during the build phase and b) 

purchasing or outsourcing the system during the buy phase. That same Target Profile 

serves as a list of system cybersecurity features that should be assessed when deploying the 

system to verify all features are implemented. The cybersecurity outcomes determined by 

using the Framework then should serve as a basis for on-going operation of the system. 

This includes occasional reassessment, capturing results in a Current Profile, to verify that 

cybersecurity requirements are still fulfilled. Typically, a complex web of dependencies 

(e.g., compensating and common controls) among systems means the outcomes 

documented in Target Profiles of related systems should be carefully considered as one or 

more systems are decommissioned.”

p. 19

Section 3.2 ‘Establishing or Improving a Cybersecurity Program’ - Step 1: ‘Prioritize and 

Scope’ was modified to clarify Tier usage with the following:

“Risk tolerances may be reflected in a target Implementation Tier.”

p. 19 Section 3.2 ‘Establishing or Improving a Cybersecurity Program’ - Step 2: ‘Orient’ was 

modified to now read as follows:
Revised December 5, 2017 Cybersecurity Framework Version 1.1 Draft 2

52 DRAFT

PAGE(S) CHANGE

“Once the scope of the cybersecurity program has been determined for the 

business line or process, the organization identifies related systems and assets, regulatory 

requirements, and overall risk approach. The organization then consults sources to identify 

threats and vulnerabilities applicable to those systems and assets.” 

p. 19

Section 3.2 ‘Establishing or Improving a Cybersecurity Program’ - Step 3: ‘Create a 

Current Profile’ was modified to include:

“If an outcome is partially achieved, noting this fact will help support subsequent 

steps.”

p. 19

Section 3.2 ‘Establishing or Improving a Cybersecurity Program’ - Step 4: ‘Conduct a Risk 

Assessment’ was modified to now read as follows:

“This assessment could be guided by the organization’s overall risk management 

process or previous risk assessment activities. The organization analyzes the operational 

environment in order to discern the likelihood of a cybersecurity event and the impact that 

the event could have on the organization. It is important that organizations identify 

emerging risks and use cyber threat information from both internal and external 

sources to gain a better understanding of the likelihood and impact of cybersecurity 

events.”

p. 20

Section 3.2 ‘Establishing or Improving a Cybersecurity Program’ - Step 5: ‘Create a Target 

Profile’ was modified to include:

“The Profile should appropriately reflect criteria within the target Implementation 

Tier.”

p. 20

Section 3.2 ‘Establishing or Improving a Cybersecurity Program’ - Step 6: ‘Determine, 

Analyze, and Prioritize Gaps’ was modified to now read as follows:

“The organization compares the Current Profile and the Target Profile to 

determine gaps. Next, it creates a prioritized action plan to address gaps - reflecting 

mission drivers, costs and benefits, and risks - to achieve the outcomes in the Target 

Profile. The organization then determines resources, including funding and workforce, 

necessary to address the gaps. Using Profiles in this manner enables the organization to 

make informed decisions about cybersecurity activities, supports risk management, and 

enables the organization to perform cost-effective, targeted improvements.”

p. 20

Section 3.3 ‘Communication Cybersecurity Requirements with Stakeholders’ - an 

additional bullet was added which reads:

“An organization can better manage cybersecurity risk among stakeholders by 

assessing their position in the critical infrastructure and the broader digital economy using 

Implementation Tiers.”

pp. 20-22 Section 3.3 ‘Communicating Cybersecurity Requirement with Stakeholders’ was modified 

to include Cyber SCRM.

p. 22 Figure 3: ‘Cyber Supply Chain Relationships’ was added to depict concepts in 3.3.

p. 23 Section 3.4 ‘Buying Decisions’ was added to demonstrate an example of using the 

Framework.
Revised December 5, 2017 Cybersecurity Framework Version 1.1 Draft 2

53 DRAFT

PAGE(S) CHANGE

p. 23 Section 3.5 ‘Identifying Opportunities for New or Revised Informative References’ 

(previously Section 3.4) was moved to accommodate an additional section.

p. 23 Section 3.6 ‘Methodology to Protect Privacy and Civil Liberties’ (previously Section 3.5) 

was moved to accommodate an additional section.

p. 23

Section 3.6 ‘Methodology to Protect Privacy and Civil Liberties’ - a portion of this section 

was modified to now read as follows:

“Privacy and cybersecurity have a strong connection. An organization’s 

cybersecurity activities also can create risks to privacy and civil liberties when personal 

information is used, collected, processed, maintained, or disclosed. Some examples 

include: cybersecurity activities that result in the over-collection or over-retention of 

personal information; disclosure or use of personal information unrelated to cybersecurity 

activities; and cybersecurity mitigation activities that result in denial of service or other 

similar potentially adverse impacts, including some types of incident detection or 

monitoring that may impact freedom of expression or association.”

p. 24

Section 3.6 ‘Methodology to Protect Privacy and Civil Liberties’ - Authentication was 

added to “Approaches to identifying, authenticating, and authorizing individuals to access 

organizational assets and systems”. Also, the subsequent bullet now includes reference to 

Identity Management.

pp. 25-26 Section 4.0 ‘Self-Assessing Cybersecurity Risk with the Framework’ was added to clarify 

the relationship between measurements and the Framework.

p. 28 Table 1: ‘Function and Category Unique Identifiers’ was updated to include an additional 

Category (ID.SC) Supply Chain Risk Management.

pp. 29-49 Table 2: ‘Framework Core’ - The Informative References have been updated pursuant to 

the most recent version of each reference document.

p. 29

Table 2: ‘Framework Core’ - Subcategory ID.AM-5 was modified to now read as follows: 

"Resources (e.g., hardware, devices, data, time, and software) are prioritized based 

on their classification, criticality, and business value".

p. 30

Table 2: ‘Framework Core’ - Subcategory ID.BE-5 was modified to now read as follows: 

“Resilience requirements to support delivery of critical services are established for 

all operating states (e.g. under duress/attack, during recovery, normal operations)”.

p. 31

Table 2: ‘Framework Core’ - Subcategory ID.RA-2 was modified to clarify the specific 

type of data received and now reads as follows:

“Cyber threat intelligence is received from information sharing forums and 

sources”.

pp. 33-34

Table 2: ‘Framework Core’ - Category ID.SC: ‘Supply Chain Risk Management’ and 

subsequent Subcategories (ID.SC-1, ID.SC-2, ID.SC-3, ID.SC-4, ID.SC-5) and 

Informative References were added.
Revised December 5, 2017 Cybersecurity Framework Version 1.1 Draft 2

54 DRAFT

PAGE(S) CHANGE

p. 34

Table 2: ‘Framework Core’ - Category PR.AC: ‘Access Control’ was retitled to “Identity 

Management, Authentication and Access Control” and now reads:

“Access to physical and logical assets and associated facilities is limited to 

authorized users, processes, or and devices, and is managed consistent with the assessed 

risk of unauthorized access to authorized activities and transactions.”

p. 34

Table 2: ‘Framework Core’ - Subcategory PR.AC-1 was modified to now read as follows:

“Identities and credentials are issued, managed, verified, revoked, and audited for 

authorized devices, and users, and processes”.

p. 35

Table 2: ‘Framework Core’ - Subcategory PR.AC-4 was modified to now read as follows:

“Access permissions and authorizations are managed, incorporating the principles 

of least privilege and separation of duties”.

pp. 35-36 Table 2: ‘Framework Core’ - Subcategories PR.AC-6 and PR.AC-7 and their subsequent 

Informative References were added.

p. 38 Table 2: ‘Framework Core’ - Subcategory PR.DS-8 and the subsequent Informative 

References were added.

p. 38

Table 2: ‘Framework Core’ - Subcategory PR.IP-1 was modified to now read as follows:

“A baseline configuration of information technology/industrial control systems is 

created and maintained incorporating appropriate security principles (e.g. concept of 

least functionality)”.

p. 42

Table 2: ‘Framework Core’ - Subcategory PR.PT-3 was modified to now read as follows:

“The principle of least functionality is incorporated by configuring systems to 

provide only essential capabilities”.

p. 42 Table 2: ‘Framework Core’ - Subcategory PR.PT-5 and the subsequent Informative 

References were added.

p. 43 Table 2: ‘Framework Core’ - Subcategory DE.AE-3 was modified to now read as follows:

“Event data are collected and correlated from multiple sources and sensors”.

p. 46 Table 2: ‘Framework Core’ - Subcategory RS.CO-2 was modified to now read as follows:

“Incidents are reported consistent with established criteria”.

p. 47 Table 2: ‘Framework Core’ - Subcategory RS.AN-5 and the subsequent Informative 

References were added.

p. 48 Table 2: ‘Framework Core’ - Subcategory RC.RP-1 was modified to now read as follows:

“Recovery plan is executed during or after a cybersecurity incident”.

p. 49 Appendix A: “Framework Core” - The following sentence was added to clarify the nature 

of Informative References: 
Revised December 5, 2017 Cybersecurity Framework Version 1.1 Draft 2

55 DRAFT

PAGE(S) CHANGE

“Informative References are not exhaustive, in that not every element (e.g., 

control, requirement) of a given Informative Reference is mapped to Framework Core 

Subcategories.

p. 50 Appendix B: ‘Glossary’ - was modified to include the term ‘Buyer’ with the definition:

“The people or organizations that consume a given product of service”.

p. 50

Appendix B: ‘Glossary’ - was modified to include the term ‘Cybersecurity Incident’ with 

the definition:

“A cybersecurity event that has been determined to have an impact on the 

organization prompting the need for response and recovery.”

p. 52

Appendix B: ‘Glossary’ - was modified to include the term ‘Supplier’ with the definition:

“Product and service providers used for an organization’s internal purposes (e.g., 

IT infrastructure) or integrated into the products of services provided to that organization’s 

Buyers.”

p. 52

Appendix B: ‘Glossary’ - was modified to include the term ‘Taxonomy’ with the 

definition:

“A scheme of classification.”

p. 53 Appendix C: ‘Acronyms’ - was modified to include CEA - Cybersecurity Enhancement 

Act of 2014.

p. 53 Appendix C: ‘Acronyms’ - was modified to include CPS - Cyber-Physical Systems.

p. 53 Appendix C: ‘Acronyms’ – was modified to include IoT - Internet of things.

p. 53 Appendix C: ‘Acronyms’ - was modified to include ISAO - Information Sharing and 

Analysis Organization.

p. 53 Appendix C: ‘Acronyms’ - was modified to include OT - Operational Technology.

p. 53 Appendix C: ‘Acronyms’ - was modified to include PII - Personally Identifiable 

Information.

p. 53 Appendix C: ‘Acronyms’ - was modified to include SCRM - Supply Chain Risk 

Management.

31