13024 Federal Register / Vol. 78, No. 38 / Tuesday, February 26, 2013 / Notices 

49See sections 772(c)(1)(C) and 777A(f) of the 

Act, respectively. Unlike in administrative reviews, 

the Department calculates the adjustment for export 

subsidies and estimated domestic subsidy passthrough in investigations not in the margin 

calculation program, but in the cash deposit 

instructions issued to CBP. See the Preliminary 

Determination, and accompanying Decision 

Memorandum, for treatment of estimated domestic 

subsidy pass-through; see Notice of Final 

Determination of Sales at Less Than Fair Value, 

and Negative Determination of Critical 

Circumstances: Certain Lined Paper Products from 

India, 71 FR 45012 (August 8, 2006), and 

accompanying Issues and Decision Memorandum at 

Comment 1 for discussion of our treatment of 

export subsidies in investigations. 

1For the purposes of this RFI the term ‘‘critical 

infrastructure’’ has the meaning given the term in 

42 U.S.C. 5195c(e), ‘‘systems and assets, whether 

physical or virtual, so vital to the United States that 

the incapacity or destruction of such systems and 

assets would have a debilitating impact on security, 

national economic security, national public health 

or safety, or any combination of those matters.’’ 

2012, the date of publication of the 

Preliminary Determination in the 

Federal Register. Further, the 

Department will instruct CBP to require 

a cash deposit equal to the weightedaverage amount by which the normal 

value exceeds U.S. price, adjusted 

where appropriate for export subsidies 

and estimated domestic subsidy passthrough,49 as follows: (1) The separate 

rate margin for the exporter/producer 

combinations listed in the table above 

will be the rate the Department has 

determined in this final determination; 

(2) for all combinations of PRC 

exporters/producers of merchandise 

under consideration which have not 

received their own separate rate AD 

margin above, the cash-deposit rate will 

be the cash-deposit rate established for 

the PRC-wide entity; and (3) for all nonPRC exporters of merchandise under 

consideration which have not received 

their own separate rate above, the cashdeposit rate will be the cash-deposit rate 

applicable to the PRC exporter/producer 

combination that supplied that non-PRC 

exporter. 

ITC Notification 

In accordance with section 735(d) of 

the Act, we have notified the 

International Trade Commission (‘‘ITC’’) 

of the final affirmative determination of 

sales at LTFV. As the Department’s final 

determination is affirmative, in 

accordance with section 735(b)(2) of the 

Act, the ITC will determine, within 45 

days, whether the domestic industry in 

the United States is materially injured, 

or threatened with material injury, by 

reason of imports of subject 

merchandise, or sales (or the likelihood 

of sales) for importation, of the subject 

merchandise. If the ITC determines that 

material injury or threat of material 

injury does not exist, the proceeding 

will be terminated and all securities 

posted will be refunded or canceled. If 

the ITC determines that such injury 

does exist, the Department will issue an 

antidumping duty order directing CBP 

to assess antidumping duties on all 

imports of the subject merchandise 

entered, or withdrawn from warehouse, 

for consumption on or after the effective 

date of the suspension of liquidation. 

Notification Regarding APO 

This notice also serves as a reminder 

to the parties subject to administrative 

protective order (‘‘APO’’) of their 

responsibility concerning the 

disposition of BPI disclosed under APO 

in accordance with 19 CFR 351.305. 

Timely notification of return or 

destruction of APO materials or 

conversion to judicial protective order is 

hereby requested. Failure to comply 

with the regulations and terms of an 

APO is a sanctionable violation. 

This determination is issued and 

published in accordance with sections 

735(d) and 777(i)(1) of the Act. 

Dated: February 19, 2013. 

Paul Piquado, 

Assistant Secretary for Import 

Administration. 

Appendix—Issues for Final 

Determination 

Issue 1: Adjustment Under Section 777A(f) of 

the Act 

Issue 2: Valuation of Stainless Steel 

Issue 3: Surrogate Value for Labor 

Issue 4: Whether the Department Applied the 

Correct Treatment to Labor Line items in 

Its Financial Ratio Calculations 

Issue 5: Valuation of Brokerage and Handling 

Issue 6: Financial Statements 

Issue 7: Surrogate Value for Sound 

Deadening Pad Input 

Issue 8: Whether the Department Correctly 

Applied Targeted Dumping Methodology 

Issue 9: Whether Superte/Zhaoshun’s Scrap 

Offset Should be Rejected 

Issue 10: Whether Superte/Zhaoshun 

Reported Accurate Electricity 

Consumption 

Issue 11: Whether Superte/Zhaoshun 

Reported Accurate Consumption for 

Wooden Boxes and Polystyrene Foam 

Issue 12: Whether an Invoicing Company 

Fees Superte Paid to Zhaoshun is an 

Adjustment to its U.S. Price 

Issue 13: Whether Dongyuan’s Reported Paint 

Input is Soluble in Water 

Issue 14: Whether the Department Properly 

Rejected Kehuaxing’s Quantity and Value 

Questionnaire and Separate Rate 

Application 

[FR Doc. 2013–04379 Filed 2–25–13; 8:45 am] 

BILLING CODE 3510–DS–P 

DEPARTMENT OF COMMERCE 

National Institute of Standards and 

Technology 

[Docket Number 130208119–3119–01] 

Developing a Framework To Improve 

Critical Infrastructure Cybersecurity 

AGENCY: National Institute of Standards 

and Technology, U.S. Department of 

Commerce. 

ACTION: Notice; Request for Information 

(RFI). 

SUMMARY: The National Institute of 

Standards and Technology (NIST) is 

conducting a comprehensive review to 

develop a framework to reduce cyber 

risks to critical infrastructure 1 (the 

‘‘Cybersecurity Framework’’ or 

‘‘Framework’’). The Framework will 

consist of standards, methodologies, 

procedures, and processes that align 

policy, business, and technological 

approaches to address cyber risks. 

This RFI requests information to help 

identify, refine, and guide the many 

interrelated considerations, challenges, 

and efforts needed to develop the 

Framework. In developing the 

Cybersecurity Framework, NIST will 

consult with the Secretary of Homeland 

Security, the National Security Agency, 

Sector-Specific Agencies and other 

interested agencies including the Office 

of Management and Budget, owners and 

operators of critical infrastructure, and 

other stakeholders including other 

relevant agencies, independent 

regulatory agencies, State, local, 

territorial and tribal governments. The 

Framework will be developed through 

an open public review and comment 

process that will include workshops and 

other opportunities to provide input. 

DATES: Comments must be received by 

5:00 p.m. Eastern time on Monday, 

April 8, 2013. 

ADDRESSES: Written comments may be 

submitted by mail to Diane Honeycutt, 

National Institute of Standards and 

Technology, 100 Bureau Drive, Stop 

8930, Gaithersburg, MD 20899. 

Submissions may be in any of the 

following formats: HTML, ASCII, Word, 

RTF, or PDF. Online submissions in 

electronic form may be sent to 

cyberframework@nist.gov. Please submit 

comments only and include your name, 

company name (if any), and cite 


tkelley on DSK3SPTVN1PROD with NOTICES
Federal Register / Vol. 78, No. 38 / Tuesday, February 26, 2013 / Notices 13025 

2 ‘‘Executive Order 13636—Improving Critical 

Infrastructure Cybersecurity’’ 78 FR 11739 

(February 19, 2013). 

3Public Law 104–113 (1996), codified in relevant 

part at 15 U.S.C. 272(b). 

4http://standards.gov/a119.cfm. 

5http://www.whitehouse.gov/sites/default/files/ 

omb/memoranda/2012/m-12-08_1.pdf. 

6http://www.gao.gov/assets/590/587529.pdf. 

‘‘Developing a Framework to Improve 

Critical Infrastructure Cybersecurity’’ in 

all correspondence. All comments 

received by the deadline will be posted 

at http://csrc.nist.gov without change or 

redaction, so commenters should not 

include information they do not wish to 

be posted (e.g., personal or confidential 

business information). 

FOR FURTHER INFORMATION CONTACT: For 

questions about this RFI contact: Adam 

Sedgewick, U.S. Department of 

Commerce, 1401 Constitution Avenue 

NW., Washington, DC 20230, telephone 

(202) 482–0788, email 

Adam.Sedgewick@nist.gov. Please direct 

media inquiries to NIST’s Office of 

Public Affairs at (301) 975–NIST. 

SUPPLEMENTARY INFORMATION: The 

national and economic security of the 

United States depends on the reliable 

functioning of critical infrastructure, 

which has become increasingly 

dependent on information technology. 

Recent trends demonstrate the need for 

improved capabilities for defending 

against malicious cyber activity. Such 

activity is increasing and its 

consequences can range from theft 

through disruption to destruction. Steps 

must be taken to enhance existing 

efforts to increase the protection and 

resilience of this infrastructure, while 

maintaining a cyber environment that 

encourages efficiency, innovation, and 

economic prosperity, while protecting 

privacy and civil liberties. 

Under Executive Order 13636 2

(‘‘Executive Order’’), the Secretary of 

Commerce is tasked to direct the 

Director of NIST to develop a framework 

for reducing cyber risks to critical 

infrastructure (the ‘‘Cybersecurity 

Framework’’ or ‘‘Framework’’). The 

Framework will consist of standards, 

methodologies, procedures and 

processes that align policy, business, 

and technological approaches to address 

cyber risks. The Department of 

Homeland Security, in coordination 

with sector-specific agencies, will then 

establish a voluntary program to support 

the adoption of the Cybersecurity 

Framework by owners and operators of 

critical infrastructure and any other 

interested entities. 

Given the diversity of sectors in 

critical infrastructure, the Framework 

development process is designed to 

initially identify cross-sector security 

standards and guidelines that are 

immediately applicable or likely to be 

applicable to critical infrastructure, to 

increase visibility and adoption of those 

standards and guidelines, and to find 

potential gaps (i.e., where standards/ 

guidelines are nonexistent or where 

existing standards/guidelines are 

inadequate) that need to be addressed 

through collaboration with industry and 

industry-led standards bodies. The 

Framework will incorporate voluntary 

consensus standards and industry best 

practices to the fullest extent possible 

and will be consistent with voluntary 

international consensus-based standards 

when such international standards will 

advance the objectives of the Executive 

Order. The Framework would be 

designed to be compatible with existing 

regulatory authorities and regulations. 

The Cybersecurity Framework will 

provide a prioritized, flexible, 

repeatable, performance-based, and 

cost-effective approach, including 

information security measures and 

controls to help owners and operators of 

critical infrastructure and other 

interested entities to identify, assess, 

and manage cybersecurity-related risk 

while protecting business 

confidentiality, individual privacy and 

civil liberties. To enable technical 

innovation and account for 

organizational differences, the 

Cybersecurity Framework will not 

prescribe particular technological 

solutions or specifications. It will 

include guidance for measuring the 

performance of an entity in 

implementing the Cybersecurity 

Framework and will include 

methodologies to identify and mitigate 

impacts of the Framework and 

associated information security 

measures and controls on business 

confidentiality and to protect individual 

privacy and civil liberties. 

As a non-regulatory Federal agency, 

NIST will develop the Framework in a 

manner that is consistent with its 

mission to promote U.S. innovation and 

industrial competitiveness through the 

development of standards and 

guidelines in consultation with 

stakeholders in both government and 

industry. While the focus will be on the 

Nation’s critical infrastructure, the 

Framework will be developed in a 

manner to promote wide adoption of 

practices to increase cybersecurity 

across all sectors and industry types. In 

its first year, the emphasis will be on 

finding commonality within and across 

the affected sectors. It will seek to 

provide owners and operators the ability 

to implement security practices in the 

most effective manner while allowing 

organizations to express requirements to 

multiple authorities and regulators. 

Issues relating to harmonization of 

existing relevant standards and 

integration with existing frameworks 

will also be considered in this initial 

stage. 

In accordance with the Executive 

Order, the Secretary of Commerce has 

directed the Director of the National 

Institute of Standards and Technology 

(the Director) to coordinate the 

development of a Framework to reduce 

the cyber risks to critical infrastructure. 

The Cybersecurity Framework will 

incorporate existing consensus-based 

standards to the fullest extent possible, 

consistent with requirements of the 

National Technology Transfer and 

Advancement Act of 1995,3 and 

guidance provided by Office of 

Management and Budget Circular A– 

119, ‘‘Federal Participation in the 

Development and Use of Voluntary 

Consensus Standards and in Conformity 

Assessment Activities.’’ 4 Principles 

articulated in the Executive Office of the 

President memorandum M–12–08 

‘‘Principles for Federal Engagement in 

Standards Activities to Address 

National Priorities’’ 5 will be followed. 

The Framework should also be 

consistent with, and support the broad 

policy goals of, the Administration’s 

2010 ‘‘National Security Strategy,’’ 2011 

‘‘Cyberspace Policy Review,’’ 

‘‘International Strategy for Cyberspace’’ 

of May 2010 and HSPD–7 ‘‘Critical 

Infrastructure Identification, 

Prioritization, and Protection.’’ 

The goals of the Framework 

development process will be: (i) To 

identify existing cybersecurity 

standards, guidelines, frameworks, and 

best practices that are applicable to 

increase the security of critical 

infrastructure sectors and other 

interested entities; (ii) to specify highpriority gaps for which new or revised 

standards are needed; and (iii) to 

collaboratively develop action plans by 

which these gaps can be addressed. It is 

contemplated that the development 

process will have requisite stages to 

allow for continuing engagement with 

the owners and operators of critical 

infrastructure, and other industry, 

academic, and government stakeholders. 

In December 2011, the United States 

Government Accountability Office 

(GAO) issued a report titled ‘‘CRITICAL 

INFRASTRUCTURE PROTECTION: 

Cybersecurity Guidance Is Available, 

but More Can Be Done to Promote Its 

Use.’’ 6 In its report, GAO found 

similarities in cybersecurity guidance 

across sectors, and recommended 


tkelley on DSK3SPTVN1PROD with NOTICES
13026 Federal Register / Vol. 78, No. 38 / Tuesday, February 26, 2013 / Notices 

7 Id., at page 46. 

8Organizational risk responses can include, for 

example, risk acceptance, risk rejection, risk 

mitigation, risk sharing, or risk transfer. 

9Assessments determine whether the security 

controls selected by an organization are 

implemented correctly, operating as intended, and 

producing the desired results in order to enforce 

organizational security policies. 

10As used herein, ‘‘standard-setting 

organizations’’ refers to the wide cross section of 

organizations that are involved in the development 

of standards and specifications, both domestically 

and abroad. 

promoting existing guidance to assist 

individual entities within a sector in 

‘‘identifying the guidance that is most 

applicable and effective in improving 

their security posture.’’ 7

NIST believes the diversity of 

business and mission needs 

notwithstanding, there are core 

cybersecurity practices that can be 

identified and that will be applicable to 

a diversity of sectors and a spectrum of 

quickly evolving threats. Identifying 

such core practices will be a focus of the 

Framework development process. 

In order to be effective in protecting 

the information and information 

systems that are a part of the U.S. 

critical infrastructure, NIST believes the 

Framework should have a number of 

general properties or characteristics. 

The Framework should include flexible, 

extensible, scalable, and technologyindependent standards, guidelines, and 

best practices, that provide: 

• A consultative process to assess the 

cybersecurity-related risks to 

organizational missions and business 

functions; 

• A menu of management, 

operational, and technical security 

controls, including policies and 

processes, available to address a range 

of threats and protect privacy and civil 

liberties; 

• A consultative process to identify 

the security controls that would 

adequately address risks 8 that have 

been assessed and to protect data and 

information being processed, stored, 

and transmitted by organizational 

information systems; 

• Metrics, methods, and procedures 

that can be used to assess and monitor, 

on an ongoing or continuous basis, the 

effectiveness of security controls that 

are selected and deployed in 

organizational information systems and 

environments in which those systems 

operate and available processes that can 

be used to facilitate continuous 

improvement in such controls; 9

• A comprehensive risk management 

approach that provides the ability to 

assess, respond to, and monitor 

information security-related risks and 

provide senior leaders/executives with 

the kinds of necessary information sets 

that help them to make ongoing riskbased decisions; 

• A menu of privacy controls 

necessary to protect privacy and civil 

liberties. 

Within eight months, the Executive 

Order requires NIST to publish for 

additional comment a draft Framework 

that clearly outlines areas of focus and 

provides preliminary lists of standards, 

guidelines and best practices that fall 

within that outline. The draft will also 

include initial conclusions for 

additional public comment. The draft 

Framework will build on NIST’s 

ongoing work with cybersecurity 

standards and guidelines for the Smart 

Grid, Identity Management, Federal 

Information Security Management Act 

(FISMA) implementation, the Electricity 

Subsector Cybersecurity Capability 

Maturity Model, and related projects. 

NIST intends to engage with critical 

infrastructure stakeholders, through a 

voluntary consensus-based process, to 

develop the standards, guidelines and 

best practices that will comprise the 

Framework. This will include 

interactive workshops with industry 

and academia, along with other forms of 

outreach. NIST believes that the 

Framework cannot be static, but must be 

a living document that allows for 

ongoing consultation in order to address 

constantly evolving risks to critical 

infrastructure cybersecurity. A 

voluntary consensus standards-based 

approach will facilitate the ability of 

critical infrastructure owners and 

operators to manage such risks, and to 

implement alternate solutions from the 

bottom up with interoperability, 

scalability, and reliability as key 

attributes. 

A standards-based Framework will 

also help provide some of the measures 

necessary to understand the 

effectiveness of critical infrastructure 

protection, and track changes over time. 

DHS and Sector Specific Agencies will 

provide input in this area based on their 

engagement with sector stakeholders. 

This standards-based approach is 

necessary in order to be able to provide 

and analyze data from different sources 

that can directly support risk-based 

decision-making. A Framework without 

sufficient standards and associated 

conformity assessment programs could 

impede future innovation in security 

efforts for critical infrastructure by 

potentially creating a false sense of 

security. 

The use of widely-accepted standards 

is also necessary to enable economies of 

scale and scope to help create 

competitive markets in which 

competition is driven by market need 

and products that meet that market need 

through combinations of price, quality, 

performance, and value to consumers. 

Market competition then promotes 

faster diffusion of these technologies 

and realization of many benefits 

throughout these sectors. 

It is anticipated that the Framework 

will: (i) Include consideration of 

sustainable approaches for assessing 

conformity to identified standards and 

guidelines; (ii) assist in the selection 

and development of an optimal 

conformity assessment approach; and 

(iii) facilitate the implementation of 

selected approach(es) that could cover 

technology varying in scope from 

individual devices or components to 

large-scale organizational operations. 

The decisions on the type, 

independence and technical rigor of 

these conformity assessment approaches 

should be risk-based. The need for 

confidence in conformity must be 

balanced with cost to the public and 

private sectors, including their 

international operations and legal 

obligations. Successful conformity 

assessment programs provide the 

needed level of confidence, are efficient 

and have a sustainable and scalable 

business case. 

This RFI is looking for current 

adoption rates and related information 

for particular standards, guidelines, best 

practices, and frameworks to determine 

applicability throughout the critical 

infrastructure sectors. The RFI asks for 

stakeholders to submit ideas, based on 

their experience and mission/business 

needs, to assist in prioritizing the work 

of the Framework, as well as 

highlighting relevant performance needs 

of their respective sectors. 

For the purposes of this notice and 

the Framework, the term ‘‘standards’’ 

and the phrase ‘‘standards setting’’ are 

used in a generic manner to include 

both standards development and 

conformity assessment development. In 

addition to critical infrastructure 

owners and operators, NIST invites 

Federal agencies, state, local, territorial 

and tribal governments, standard-setting 

organizations,10 other members of 

industry, consumers, solution providers, 

and other stakeholders to respond. 

Request for Comment 

The following questions cover the 

major areas about which NIST seeks 

comment. The questions are not 

intended to limit the topics that may be 

addressed. Responses may include any 

topic believed to have implications for 

the development of the Framework 


tkelley on DSK3SPTVN1PROD with NOTICES
Federal Register / Vol. 78, No. 38 / Tuesday, February 26, 2013 / Notices 13027 

regardless of whether the topic is 

included in this document. 

While the Framework will be focused 

on critical infrastructure, given the 

broad diversity of sectors that may 

include parts of critical infrastructure, 

the evolving nature of the classification 

of critical infrastructure based on risk, 

and the intention to involve a broad set 

of stakeholders in development of the 

Framework, the RFI will generally use 

the broader term ‘‘organizations’’ when 

seeking information. 

Comments containing references, 

studies, research, and other empirical 

data that are not widely published 

should include copies of the referenced 

materials. Do not include in comments 

or otherwise submit proprietary or 

confidential information, as all 

comments received by the deadline will 

be made available publically at http:// 

csrc.nist.gov/. 

Current Risk Management Practices 

NIST solicits information about how 

organizations assess risk; how 

cybersecurity factors into that risk 

assessment; the current usage of existing 

cybersecurity frameworks, standards, 

and guidelines; and other management 

practices related to cybersecurity. In 

addition, NIST is interested in 

understanding whether particular 

frameworks, standards, guidelines, and/ 

or best practices are mandated by legal 

or regulatory requirements and the 

challenges organizations perceive in 

meeting such requirements. This will 

assist in NIST’s goal of developing a 

Framework that includes and identifies 

common practices across sectors. 

1. What do organizations see as the 

greatest challenges in improving 

cybersecurity practices across critical 

infrastructure? 

2. What do organizations see as the 

greatest challenges in developing a 

cross-sector standards-based Framework 

for critical infrastructure? 

3. Describe your organization’s 

policies and procedures governing risk 

generally and cybersecurity risk 

specifically. How does senior 

management communicate and oversee 

these policies and procedures? 

4. Where do organizations locate their 

cybersecurity risk management 

program/office? 

5. How do organizations define and 

assess risk generally and cybersecurity 

risk specifically? 

6. To what extent is cybersecurity risk 

incorporated into organizations’ 

overarching enterprise risk 

management? 

7. What standards, guidelines, best 

practices, and tools are organizations 

using to understand, measure, and 

manage risk at the management, 

operational, and technical levels? 

8. What are the current regulatory and 

regulatory reporting requirements in the 

United States (e.g. local, state, national, 

and other) for organizations relating to 

cybersecurity? 

9. What organizational critical assets 

are interdependent upon other critical 

physical and information 

infrastructures, including 

telecommunications, energy, financial 

services, water, and transportation 

sectors? 

10. What performance goals do 

organizations adopt to ensure their 

ability to provide essential services 

while managing cybersecurity risk? 

11. If your organization is required to 

report to more than one regulatory body, 

what information does your 

organization report and what has been 

your organization’s reporting 

experience? 

12. What role(s) do or should 

national/international standards and 

organizations that develop national/ 

international standards play in critical 

infrastructure cybersecurity conformity 

assessment? 

Use of Frameworks, Standards, 

Guidelines, and Best Practices 

As set forth in the Executive Order, 

the Framework will consist of 

standards, guidelines, and/or best 

practices that promote the protection of 

information and information systems 

supporting organizational missions and 

business functions. 

NIST seeks comments on the 

applicability of existing publications to 

address cybersecurity needs, including, 

but not limited to the documents 

developed by: international standards 

organizations; U.S. Government 

Agencies and organizations; State 

regulators or Public Utility 

Commissions; Industry and industry 

associations; other Governments, and 

non-profits and other non-government 

organizations. 

NIST is seeking information on the 

current usage of these existing 

approaches throughout industry, the 

robustness and applicability of these 

frameworks and standards, and what 

would encourage their increased usage. 

Please provide information related to 

the following: 

1. What additional approaches 

already exist? 

2. Which of these approaches apply 

across sectors? 

3. Which organizations use these 

approaches? 

4. What, if any, are the limitations of 

using such approaches? 

5. What, if any, modifications could 

make these approaches more useful? 

6. How do these approaches take into 

account sector-specific needs? 

7. When using an existing framework, 

should there be a related sector-specific 

standards development process or 

voluntary program? 

8. What can the role of sector-specific 

agencies and related sector coordinating 

councils be in developing and 

promoting the use of these approaches? 

9. What other outreach efforts would 

be helpful? 

Specific Industry Practices 

In addition to the approaches above, 

NIST is interested in identifying core 

practices that are broadly applicable 

across sectors and throughout industry. 

NIST is interested in information on 

the adoption of the following practices 

as they pertain to critical infrastructure 

components: 

• Separation of business from 

operational systems; 

• Use of encryption and key 

management; 

• Identification and authorization of 

users accessing systems; 

• Asset identification and 

management; 

• Monitoring and incident detection 

tools and capabilities; 

• Incident handling policies and 

procedures; 

• Mission/system resiliency practices; 

• Security engineering practices; 

• Privacy and civil liberties 

protection. 

1. Are these practices widely used 

throughout critical infrastructure and 

industry? 

2. How do these practices relate to 

existing international standards and 

practices? 

3. Which of these practices do 

commenters see as being the most 

critical for the secure operation of 

critical infrastructure? 

4. Are some of these practices not 

applicable for business or mission needs 

within particular sectors? 

5. Which of these practices pose the 

most significant implementation 

challenge? 

6. How are standards or guidelines 

utilized by organizations in the 

implementation of these practices? 

7. Do organizations have a 

methodology in place for the proper 

allocation of business resources to 

invest in, create, and maintain IT 

standards? 

8. Do organizations have a formal 

escalation process to address 

cybersecurity risks that suddenly 

increase in severity? 


tkelley on DSK3SPTVN1PROD with NOTICES
13028 Federal Register / Vol. 78, No. 38 / Tuesday, February 26, 2013 / Notices 

9. What risks to privacy and civil 

liberties do commenters perceive in the 

application of these practices? 

10. What are the international 

implications of this Framework on your 

global business or in policymaking in 

other countries? 

11. How should any risks to privacy 

and civil liberties be managed? 

12. In addition to the practices noted 

above, are there other core practices that 

should be considered for inclusion in 

the Framework? 

Dated: February 21, 2013. 

Patrick Gallagher, 

Under Secretary of Commerce for Standards 

and Technology. 

[FR Doc. 2013–04413 Filed 2–25–13; 8:45 am] 

BILLING CODE 3510–13–P 

DEPARTMENT OF COMMERCE 

National Oceanic and Atmospheric 

Administration 

RIN 0648–XC460 

Whaling Provisions; Aboriginal 

Subsistence Whaling Quotas 

AGENCY: National Marine Fisheries 

Service (NMFS), National Oceanic and 

Atmospheric Administration (NOAA), 

Commerce. 

ACTION: Notice; notification of quota for 

bowhead whales. 

SUMMARY: NMFS notifies the public of 

the aboriginal subsistence whaling 

quota for bowhead whales that it has 

assigned to the Alaska Eskimo Whaling 

Commission (AEWC), and of limitations 

on the use of the quota deriving from 

regulations of the International Whaling 

Commission (IWC). For 2013, the quota 

is 75 bowhead whales struck. This quota 

and other applicable limitations govern 

the harvest of bowhead whales by 

members of the AEWC. 

DATES: Effective February 26, 2013. 

ADDRESSES: Office of International 

Affairs, National Marine Fisheries 

Service, 1315 East-West Highway, Silver 

Spring, MD 20910. 

FOR FURTHER INFORMATION CONTACT: 

Melissa Andersen, (301) 427–8385. 

SUPPLEMENTARY INFORMATION: Aboriginal 

subsistence whaling in the United States 

is governed by the Whaling Convention 

Act (WCA) (16 U.S.C. 916 et seq.). 

Regulations that implement the Act, 

found at 50 CFR 230.6, require the 

Secretary of Commerce (Secretary) to 

publish, at least annually, aboriginal 

subsistence whaling quotas and any 

other limitations on aboriginal 

subsistence whaling deriving from 

regulations of the IWC. 

At the 64th Annual Meeting of the 

IWC, the Commission set catch limits 

for aboriginal subsistence use of 

bowhead whales from the BeringChukchi-Beaufort Seas stock. The 

bowhead catch limits were based on a 

joint request by the United States and 

the Russian Federation, accompanied by 

documentation concerning the needs of 

two Native groups: Alaska Eskimos and 

Chukotka Natives in the Russian Far 

East. 

The IWC set a 6-year block catch limit 

of 336 bowhead whales landed. For 

each of the years 2013 through 2018, the 

number of bowhead whales struck may 

not exceed 67, except that any unused 

portion of a strike quota from any prior 

year, including 15 unused strikes from 

the 2008 through 2012 quota, may be 

carried forward. No more than 15 strikes 

may be added to the strike quota for any 

one year. At the end of the 2012 harvest, 

there were 15 unused strikes available 

for carry-forward, so the combined 

strike quota set by the IWC for 2013 is 

82 (67 + 15). 

An arrangement between the United 

States and the Russian Federation 

ensures that the total quota of bowhead 

whales landed and struck in 2013 will 

not exceed the limits set by the IWC. 

Under this arrangement, the Russian 

natives may use no more than seven 

strikes, and the Alaska Eskimos may use 

no more than 75 strikes. 

Through its cooperative agreement 

with the AEWC, NOAA has assigned 75 

strikes to the Alaska Eskimos. The 

AEWC will in turn allocate these strikes 

among the 11 villages whose cultural 

and subsistence needs have been 

documented, and will ensure that its 

hunters use no more than 75 strikes. 

Other Limitations 

The IWC regulations, as well as the 

NOAA regulation at 50 CFR 230.4(c), 

forbid the taking of calves or any whale 

accompanied by a calf. 

NOAA regulations (at 50 CFR 230.4) 

contain a number of other prohibitions 

relating to aboriginal subsistence 

whaling, some of which are summarized 

here: 

• Only licensed whaling captains or 

crew under the control of those captains 

may engage in whaling. 

• Captains and crew must follow the 

provisions of the relevant cooperative 

agreement between NOAA and a Native 

American whaling organization. 

• The aboriginal hunters must have 

adequate crew, supplies, and equipment 

to engage in an efficient operation. 

• Crew may not receive money for 

participating in the hunt. 

• No person may sell or offer for sale 

whale products from whales taken in 

the hunt, except for authentic articles of 

Native American handicrafts. 

• Captains may not continue to whale 

after the relevant quota is taken, after 

the season has been closed, or if their 

licenses have been suspended. They 

may not engage in whaling in a wasteful 

manner. 

Dated: February 21, 2013. 

Jean-Pierre Ple, 

Deputy Director, Office of International 

Affairs, National Marine Fisheries Service. 

[FR Doc. 2013–04408 Filed 2–25–13; 8:45 am] 

BILLING CODE 3510–22–P 

COMMODITY FUTURES TRADING 

COMMISSION 

Sunshine Act Meeting 

AGENCY HOLDING THE MEETING: 

Commodity Futures Trading 

Commission. 

TIME AND DATE: 10:00 a.m., Friday, 

March 15, 2013. 

PLACE : 1155 21st St. NW., Washington, 

DC, 9th Floor Commission Conference 

Room. 

STATUS: Closed. 

MATTERS TO BE CONSIDERED: Surveillance 

and Enforcement Matters. In the event 

that the times or dates of this or any 

future meetings change, an 

announcement of the change, along with 

the new time and place of the meeting 

will be posted on the Commission’s 

Web site at http://www.cftc.gov. 

CONTACT PERSON FOR MORE INFORMATION: 

Melissa D. Jurgens, 202–418–5516. 

Natise Stowe, 

Executive Assistant. 

[FR Doc. 2013–04566 Filed 2–22–13; 4:15 pm] 

BILLING CODE 6351–01–P 

COMMODITY FUTURES TRADING 

COMMISSION 

Sunshine Act Meeting 

AGENCY HOLDING THE MEETING: 

Commodity Futures Trading 

Commission. 

TIME AND DATE: 10:00 a.m., Friday, 

March 1, 2013. 

PLACE: 1155 21st St. NW., Washington, 

DC, 9th Floor Commission Conference 

Room. 

STATUS: Closed. 

MATTERS TO BE CONSIDERED: Surveillance 

and Enforcement Matters. In the event 

that the times or dates of this or any 

future meetings change, an 

announcement of the change, along with 

the new time and place of the meeting 


tkelley on DSK3SPTVN1PROD with NOTICES