The Framework for Improving 

Critical Infrastructure 

Cybersecurity

April 2018

cyberframework@nist.gov
Objective: Convey Cybersecurity Framework use, 

while explaining features added in Version 1.1

Objective and Agenda

2

• Charter

• Users

• Attributes, Components, & 

Approaches

• Draft Roadmap Version 1.1

• Framework Focus Areas

• Web Site

• Update Process
About NIST

• Agency of U.S. Department of 

Commerce

• NIST’s mission is to develop 

and promote measurement, 

standards and technology to 

enhance productivity, facilitate 

trade, and improve the quality 

of life.

• Federal, non-regulatory agency 

around since 1901

NIST Cybersecurity

• Cybersecurity since the 1970s

• Computer Security Resource 

Center – csrc.nist.gov

NIST Priority Research Areas

National Institute of Standards and Technology

Advanced Manufacturing

IT and Cybersecurity

Healthcare

Forensic Science

Disaster Resilience

Cyber-physical Systems

Advanced 

Communications

3
Cybersecurity Framework Current Charter

Improving Critical Infrastructure Cybersecurity

February 12, 2013

“It is the policy of the United States to 

enhance the security and resilience of 

the Nation’s critical infrastructure and 

to maintain a cyber environment that 

encourages efficiency, innovation, and 

economic prosperity while promoting 

safety, security, business 

confidentiality, privacy, and civil 

liberties” 

Executive Order 13636

4

December 18, 2014

Amends the National Institute of Standards and 

Technology Act (15 U.S.C. 272(c)) to say:

“...on an ongoing basis, facilitate and 

support the development of a 

voluntary, consensus-based, 

industry-led set of standards, 

guidelines, best practices, 

methodologies, procedures, and 

processes to cost-effectively reduce 

cyber risks to critical infrastructure”

Cybersecurity Enhancement Act of 

2014 (P.L. 113-274)
Cybersecurity Framework Users

Framework for Improving Critical Infrastructure Cybersecurity

5
Version 1.0 and 1.1 Are Fully Compatible

Framework for Improving Critical Infrastructure Cybersecurity

Component Version 1.0 Version 1.1 Comments

Functions 5 5

Categories 22 23 • Added a new category in 

ID.SC – Supply Chain

Subcategories 98 108 • Added 5 subcategories 

in ID.SC

• Added 2 subcategories 

in PR.AC

• Added 1 subcategory 

each to PR.DS, PR.PT,

RS.AN

• Clarified language in 7 

others

Informative 

References

5 5

6

• Additions, including new categories and subcategories, do 

not invalidate existing V1.0 uses or work products
Key Framework Attributes

Principles of the Current and Future Versions of Framework

Common and accessible language

• Understandable by many professionals

It’s adaptable to many technologies1.1, lifecycle phases1.1, sectors and uses

• Meant to be customized

It’s risk-based

• A Catalog of cybersecurity outcomes

• Does not provide how or how much cybersecurity is appropriate

It’s meant to be paired

• Take advantage of great pre-existing things

It’s a living document

• Enable best practices to become standard practices for everyone

• Can be updated as technology and threats change

• Evolves faster than regulation and legislation

• Can be updated as stakeholders learn from implementation 7
Cybersecurity outcomes 

and informative 

references

Enables

communication

of cyber risk across

an organization 

Describes how 

cybersecurity risk is 

managed by an 

organization and

degree the risk 

management

practices

exhibit key 

characteristics

Cybersecurity Framework Components

Aligns industry standards and best practices to the 

Framework Core in an implementation scenario

Supports prioritization and measurement while factoring in 

business needs 8
Implementation Tiers

9

1

Partial

2

Risk Informed

3

Repeatable

4

Adaptive

Risk 

Management 

Process

The functionality and repeatability of cybersecurity risk 

management

Integrated Risk 

Management 

Program

The extent to which cybersecurity is considered in 

broader risk management decisions

External 

Participation

The degree to which the organization:

• monitors and manages supply chain risk1.1

• benefits my sharing or receiving information from 

outside parties

9
Core

A Catalog of Cybersecurity Outcomes

Function

What processes and 

assets need 

protection?

Identify • Understandable by 

everyone

• Applies to any type of 

risk management

• Defines the entire 

breadth of 

cybersecurity

• Spans both prevention 

and reaction

What safeguards are 

available? Protect

What techniques can 

identify incidents? Detect

What techniques can 

contain impacts of 

incidents?

Respond

What techniques can 

restore capabilities? Recover

10
Core

A Catalog of Cybersecurity Outcomes

Function Category

What processes and 

assets need 

protection? Identify

Asset Management

Business Environment

Governance

Risk Assessment

Risk Management Strategy

Supply Chain Risk Management1.1

What safeguards are 

available? Protect

Identity Management, Authentication and 

Access Control1.1

Awareness and Training

Data Security

Information Protection Processes & Procedures

Maintenance

Protective Technology

What techniques can 

identify incidents? Detect

Anomalies and Events

Security Continuous Monitoring

Detection Processes

What techniques can 

contain impacts of 

incidents?

Respond

Response Planning

Communications

Analysis

Mitigation

Improvements

What techniques can 

restore capabilities? Recover

Recovery Planning

Improvements

Communications 11
12

Core – Example1.1

Cybersecurity Framework Component
13

Core – Example1.1

Cybersecurity Framework Component
14

Core – Example

Cybersecurity Framework Component

1.1
Profile

Customizing Cybersecurity Framework

15

Identify

Protect

Detect

Respond

Recover

Ways to think about a Profile:

• A customization of the Core for a 

given sector, subsector, or 

organization

• A fusion of business/mission logic 

and cybersecurity outcomes

• An alignment of cybersecurity requirements with 

operational methodologies

• A basis for assessment and expressing target state

• A decision support tool for cybersecurity risk 

management
Profile Foundational Information

A Profile Can be Created from Three Types of Information

16

Subcategory

1

2

...

108

Cybersecurity

Requirements

Legislation

Regulation

Internal & External Policy

Technical 

Environment

Threats

Vulnerabilities

1

2 3

Business 

Objectives

Objective 1

Objective 2

Objective 3

Operating

Methodologies

Controls Catalogs

Technical Guidance
• Step 1: Prioritize and Scope

• Implementation Tiers may be used to express varying risk 

tolerances1.1

• Step 2: Orient

• Step 3: Create a Current Profile

• Step 4: Conduct a Risk Assessment

• Step 5: Create a Target Profile

• When used in conjunction with an Implementation Tier, characteristics 

of the Tier level should be reflected in the desired cybersecurity 

outcomes1.1

• Step 6: Determine, Analyze, and Prioritize Gaps

• Step 7: Implementation Action Plan

17

Framework Seven Step Process

Gap Analysis Using Framework Profiles
Resource and Budget Decisioning

Framework supports operating decisions and improvement

18

Subcategory Priority Gaps Budget

Year 1 

Activities

Year 2 

Activities

1 moderate small $$$ X

2 high large $$ X

3 moderate medium $ X

... ... ... ...

108 moderate none $$ reassess

As-Is Year 1

To-Be

Year 2

To-Be
Resource and Budget Decisioning

Framework supports operating decisions and improvement

19

Subcategory Priority Gaps Budget

Year 1 

Activities

Year 2 

Activities

1 moderate small $$$ X

2 high large $$ X

3 moderate medium $ X

... ... ... ...

108 moderate none $$ reassess

As-Is Year 1

To-Be

Year 2

To-Be

Step 5

Target Profile

Step 6 Step 7
20

Supporting Risk Management with Framework

Framework for Improving Critical Infrastructure Cybersecurity Version 1.1

1.1

1.1

•Internal

•Supply 

Chain
Operate

Use Cybersecurity Framework Profiles to distribute and organize labor

21

Subcats Reqs Priorities Who What When Where How

1 A, B High

2 C, D, E, F High

3 G, H, I, J Low

... ... ...

108 XX, YY, ZZ Mod
22

Cyber SCRM Taxonomy1.1

Framework for Improving Critical Infrastructure Cybersecurity Version 1.1

• Simple Supplier-Buyer 

model

• Technology minimally 

includes IT, OT, CPS, 

IoT

• Applicable for public 

and private sector, 

including not-forprofits

• Aligns with Federal guidance 

Supply Chain Risk 

Management Practices for 

Federal Information Systems 

and Organizations (Special 

Publication 800-161)
Emphasizes the role of measurements in self-assessment

Stresses critical linkage of business results:

- Cost

- Benefit

...to cybersecurity risk management 

Continued discussion of this linkage will occur under 

Roadmap area – Measuring Cybersecurity

23

Self-Assessing Cybersecurity Risk1.1

Framework for Improving Critical Infrastructure Cybersecurity Version 1.1
Roadmap Concepts

Roadmap to Improving Critical Infrastructure Cybersecurity

The Roadmap:

• identifies key areas of development, alignment, and 

collaboration

• provides a description of activities related to the Framework 

Roadmap items are generally:

• Topics that are meaningful to critical infrastructure 

cybersecurity risk management

• Focus areas of both private sector and the federal 

government

• Related to Framework, but managed as separate efforts

11
Proposed Roadmap Topics

Draft Roadmap for Improving Critical Infrastructure Cybersecurity Version 1.1

Original Roadmap 9 topics Proposed Roadmap 12 topics

Conformity Assessment Confidence Mechanisms

Automated Indicator Sharing Cyber-Attack Lifecycle

Includes Coordinated Vulnerability Disclosure

Data Analytics

Cybersecurity Workforce Cybersecurity Workforce

Supply Chain Risk Management Cyber Supply Chain Risk Management

Federal Agency Cybersecurity Alignment Federal Agency Cybersecurity Alignment

Governance and Enterprise Risk 

Management

Authentication Identity Management

International Aspects, Impacts, and 

Alignment

International Aspects, Impacts, and 

Alignment

Measuring Cybersecurity

Technical Privacy Standards Privacy Engineering

Referencing Techniques

Small Business Awareness and Resources

Focus

Focus

Focus
Small Business Guidance and Initiatives

Framework for Improving Critical Infrastructure Cybersecurity

Small Business Information 

Security: the Fundamentals

NIST Computer Security 

Resource Center

26

Small Business Center

NIST Computer Security 

Resource Center

CyberSecure My 

Business

National Cyber Security 

Alliance

Small Business 

Starter Profiles

NIST Framework 

Team
International Use

Framework for Improving Critical Infrastructure Cybersecurity

• Japanese translation by Information-technology 

Promotion Agency

• Italian adaptation within Italy’s National 

Framework for Cybersecurity

• Hebrew adaptation by Government of Israel

• Bermuda uses it within government and 

recommends it to industry

• Uruguay government is currently on Version 3.1 

of their adaptation

• Focus of International Organization for 

Standardization & International Electrotechnical

Commission

27
1. Integrate enterprise and cybersecurity risk management

2. Manage cybersecurity requirements

3. Integrate and align cybersecurity and acquisition 

processes

4. Evaluate organizational cybersecurity

5. Manage the cybersecurity program

6. Maintain a comprehensive understanding of cybersecurity 

risk (supports RMF Authorize)

7. Report cybersecurity risks (supports RMF Monitor)

8. Inform the tailoring process (supports RMF Select)

28

Proposed U.S. Federal Usage

NIST IR 8170 The Cybersecurity Framework: Implementation Guidance for Federal Agencies

Strengthening the Cybersecurity of Federal 

Networks and Critical Infrastructure

Executive Order 13800
NIST Special Publication 800-37, 

Revision 2: Risk Management 

Framework for Security and 

Privacy

Initial Public Draft: May 2018

Final Public Draft: July 2018

Final Publication: October 2018

NIST Special Publication 800-53, 

Revision 5: Security and Privacy 

Controls

Final Public Draft: October 2018

Final Publication: December 2018

NIST Special Publication 800-53A, 

Revision 5: Assessment 

Procedures for Security and 

Privacy Controls

Initial Public Draft: March 2019

Final Public Draft: June 2019

Final Publication: September 2019

FIPS Publication 200, Revision 1: 

Minimum Security Requirements

Initial Public Draft: October 2018

Final Public Draft: April 2019

Final Publication: July 2019

FIPS Publication 199, Revision 1: 

Security Categorization

Initial Public Draft: December 2018

Final Public Draft: May 2019

Final Publication: August 2019

Updates - https://csrc.nist.gov/Projects/RiskManagement/Schedule

Questions or comments - sec-cert@nist.gov

FISMA Implementation Pub Schedule

As of 8 February 2018, Subject to Change

29
Supporting Healthy Regulatory Environments

Framework for Improving Critical Infrastructure Cybersecurity

Bulk Liquid 

Transport Profile

U.S. Coast Guard

30

Financial Services Framework 

Customization and Profile

Financial Services Sector 

Coordinating Council

Connected Vehicle Profile

U.S. Department of Transportation 

Smart City Pilot

Cybersecurity Risk Management and Best 

Practices Working Group 4: Final Report

Communications Security, Reliability, and 

Interoperability Council
Eras of Cybersecurity Framework

31
The Framework Web Site

www.nist.gov/cyberframework

32
Self-Help Web Materials

www.nist.gov/cyberframework

33
Self-Help Web Materials

www.nist.gov/cyberframework

34
Resources

https://www.nist.gov/cyberframework/framework-resources-0

35

Over 150 Unique 

Resources for Your 

Understanding and Use!

General Resources 

sorted by User Group:

• Critical Infrastructure

• Small and Medium 

Business

• International

• Federal

• State Local Tribal 

Territorial Governments

• Academia

• Assessments & Auditing

• General
Resources - State & Local 

https://www.nist.gov/cyberframework/state-local-tribal-and-territorial-resources

36

Texas, Department of Information Resources

• Aligned Agency Security Plans with Framework

• Aligned Product and Service Vendor Requirements with Framework

Houston, Greater Houston Partnership

• Integrated Framework into their Cybersecurity Guide

• Offer On-Line Framework Self-Assessment

North Dakota, Information Technology Department

• Allocated Roles & Responsibilities using Framework

• Adopted the Framework into their Security Operation Strategy

National Association of State CIOs

• 2 out of 3 CIOs from the 2015 NASCIO Awards cited 

Framework as a part of their award-winning strategy 

New Jersey

• Developed a cybersecurity framework that aligns controls and 

procedures with Framework
Recent NIST Work Products

https://www.nist.gov/cyberframework/framework-resources-0

Maritime Profile

U.S. Coast Guard Bulk Liquid 

Transport Profile

Self-Assessment Criteria

Baldrige Cybersecurity 

Excellence Builder

37

Manufacturing Profile

NIST Discrete Manufacturing 

Cybersecurity Framework Profile 
Resources

https://www.nist.gov/cyberframework/framework-resources-0

38

Over 150 Unique 

Resources for Your 

Understanding and Use!

NIST Special 

Publications

Computer Security 

Resource Center

800 Series @ csrc.nist.gov

National Cybersecurity 

Center of Excellence

1800 Series @ nccoe.nist.gov
NIST Special Publications by Category

https://www.nist.gov/cyberframework/protect

39
Online Informative References

https://www.nist.gov/cyberframework/informative-references

40
41

Core – Example1.1

Cybersecurity Framework Component
Relationship Types

Online Informative References

42

Key

Framework – blue

Reference Document - red

Case 1 Case 2 Case 3 Case 4 Case 5

Subset of Intersects with Equivalent to Superset of Not related to

F

R

F R F R F & R F R
Update Activities Engagement

Request for Information – Views on the Framework for 

Improving Critical Infrastructure Cybersecurity – Dec 2015

105 Responses

7th Workshop – Apr 2016 653 Physical Attendees, 140 

Online Attendees

Draft 1 – Framework Version 1.1 – Released Jan 2017 Approx. 42,000+ downloads

As of 4/27/18

Request for Comment – Proposed update to the 

Framework for Improving Critical Infrastructure 

Cybersecurity – Jan 2017

129 Responses

8th Workshop – May 2017 517 Physical Attendees, 1528 

Online Attendees

Draft 2 – Framework Version 1.1 – Released Dec 2017 Approx. 32,000+ downloads

As of 4/27/18

Request for Comment – Cybersecurity Framework Version 

1.1 – Draft 2 – Dec 2017

89 Responses

Framework Version 1.1 – Release April 2018 Approx. 27,000+ downloads 

thus far

Continued Improvement of Critical 

Infrastructure Cybersecurity

43
Continued Improvement

Living Document Process

https://www.nist.gov/cyberframework/online-learning/update-process

44
Milestones

Three Year Minimum Update Cycle

https://www.nist.gov/cyberframework/online-learning/update-process

Features List

(Version A)

Major

Minor

Administrative

Annual 

Conference

New Version?

3 years from last 

Final Update

Features List

(Version B)

Major

Minor

Administrative

Features List

(Version C)

Major

Minor

Administrative

Annual 

Conference

Annual 

Conference

Annual 

Conference

Publish Framework 

Update

Draft Framework 

Update

X

45
Ways to Help

Stakeholder Recommended Actions

• Create and share your Resources with others in 

coordination with NIST

• Customize Framework for your sector or community

• Publish a sector or community Profile or relevant Online Informative 

Reference

• Publish Success Stories of your Framework 

implementation in coordination with NIST

• Advocate for the Framework throughout your sector or 

community, with related sectors and communities. 

• Submit an idea for the NIST Call for Speakers

cyberframework@nist.gov for all NIST

coordination and communication

46
Upcoming

15-16 May 

2018 

Federal Computer Security Managers 

Forum

https://csrc.nist.gov/Events/2018/Federal-Computer-Security-Managers-Forum-2-day

Spring 2018 Publication of Roadmap for Improving 

Critical Infrastructure Cybersecurity

Spring 2018 Publication of NIST Interagency Report 

8170

Summer 2018 Spanish Language Framework Version 1.1

6-8 November 

2018 

NIST Cybersecurity Risk Management 

Conference - Call for Speakers

Winter 2018-19 Small Business Starter Profiles

47
Resources

• Framework for Improving Critical Infrastructure 

Cybersecurity and related news and information: 

• www.nist.gov/cyberframework

• Additional cybersecurity 

resources: 

• http://csrc.nist.gov/

• Questions, comments, ideas: 

• cyberframework@nist.gov

48
Questions?

49