Framework for Improving Critical 

Infrastructure Cybersecurity 

February 2016 

cyberframework@nist.gov 
Improving Critical Infrastructure Cybersecurity

“It is the policy of the United States to enhance the security and resilience of the Nation’s 

critical infrastructure and to maintain a cyber 

environment that encourages efficiency, 

innovation, and economic prosperity while 

promoting safety, security, business confidentiality, privacy, and civil liberties” 

President Barack Obama 

Executive Order 13636, 12 February 2013
4 

Development of the Framework 

Engage the 

Framework 

Stakeholders 

Collect, 

Categorize, and 

Post RFI 

Responses 

Analyze RFI 

Responses 

Identify 

Framework 

Elements 

Prepare and 

Publish 

Framework 

EO 13636 Issued – February 12, 2013 

NIST Issues RFI – February 26, 2013 

1st Framework Workshop – April 03, 2013 

Completed – April 08, 2013 

Identify Common Practices/Themes – May 15, 2013 

2nd Framework Workshop at CMU – May 2013 

Draft Outline of Preliminary Framework – June 2013 

3rd Workshop at UCSD – July 2013 

4th Workshop at UT Dallas – Sept 2013 

5th Workshop at NC State – Nov 2013 

Published Framework – Feb 2014 

Ongoing Engagement: 

Open public comment 

and review encouraged 

and promoted 

throughout the 

process... 

and to this day 
Cybersecurity Framework Components 

5 

Describes how cybersecurity 

risk is managed by an organization 

and degree the risk management 

practices exhibit key characteristics 

Aligns industry standards and 

best practices to the Framework 

Core in a particular 

implementation scenario 

Supports prioritization and 

measurement while 

factoring in business 

needs 

Cybersecurity activities and 

informative references, 

organized around particular 

outcomes 

Enables communication 

of cyber risk across an 

organization 

Framework 

Core 

Framework 

Implementation 

Tiers 

Framework 

Profile 
Implementation Tiers 

Cybersecurity Framework Component

6 

• Allow for flexibility in implementation and bring in concepts of 

maturity models 

• Reflect how an organization implements the Framework Core 

functions and manages its risk 

• Progressive, ranging from Partial (Tier 1) to Adaptive (Tier 4), 

with each Tier building on the previous Tier 

• Characteristics are defined at the organizational level and are 

applied to the Framework Core to determine how a category is 

implemented. 

None	

Par)al	 Repeatable	

Risk	

Informed	

Adap)ve	
Framework Core 

What	processes	and	

assets	need	protec)on?	

What	safeguards	are	

available?	

What	techniques	can	

iden)fy	incidents?	

What	techniques	can	

contain	impacts	of	

incidents?	

What	techniques	can	

restore	capabili)es?	
Core 

Cybersecurity Framework Component 

8 

Func%on Category ID	

Iden%fy	

Asset	Management	 ID.AM	

Business	Environment	 ID.BE	

Governance	 ID.GV	

Risk	Assessment	 ID.RA	

Risk	Management	

Strategy	 ID.RM	

Protect	

Access	Control	 PR.AC	

Awareness	and	Training	 PR.AT	

Data	Security	 PR.DS	

Informa)on	Protec)on	

Processes	&	Procedures	 PR.IP	

Maintenance	 PR.MA	

Protec)ve	Technology	 PR.PT	

Detect	

Anomalies	and	Events	 DE.AE	

Security	Con)nuous	

Monitoring	 DE.CM	

Detec)on	Processes	 DE.DP	

Respond	

Response	Planning	 RS.RP	

Communica)ons	 RS.CO	

Analysis	 RS.AN	

Mi)ga)on	 RS.MI	

Improvements	 RS.IM	

Recover	

Recovery	Planning	 RC.RP	

Improvements	 RC.IM	

Communica)ons	 RC.CO	

Subcategory Informative References

ID.BE-1:	The	

organiza)on’s	role	in	the	

supply	chain	is	iden)fied	

and	communicated

COBIT	5	APO01.02,	DSS06.03	

ISA	62443-2-1:2009	4.3.2.3.3		

ISO/IEC	27001:2013	A.6.1.1	

NIST	SP	800-53	Rev.	4	CP-2,	PS-7,	

PM-11		

ID.BE-2:	The	

organiza)on’s	place	in	

cri)cal	infrastructure	and	

its	industry	sector	is	

iden)fied	and	

communicated

COBIT	5	APO08.04,	APO08.05,	

APO10.03,	APO10.04,	APO10.05	

ISO/IEC	27001:2013	A.15.1.3,	A.

15.2.1,	A.15.2.2		

NIST	SP	800-53	Rev.	4	CP-2,	SA-12	

ID.BE-3:	Priori)es	for	

organiza)onal	mission,	

objec)ves,	and	ac)vi)es	

are	established	and	

communicated	

COBIT	5	APO02.06,	APO03.01	

NIST	SP	800-53	Rev.	4	PM-8	

ID.BE-4:	Dependencies	

and	cri)cal	func)ons	for	

delivery	of	cri)cal	

services	are	established	

COBIT	5	APO02.01,	APO02.06,	

APO03.01	

ISA	62443-2-1:2009	4.2.2.1,	4.2.3.6	

NIST	SP	800-53	Rev.	4	PM-11,	SA-14	

ID.BE-5:	Resilience	

requirements	to	support	

delivery	of	cri)cal	

services	are	established	

ISO/IEC	27001:2013	A.11.2.2,	A.

11.2.3,	A.12.1.3	

NIST	SP	800-53	Rev.	4	CP-8,	PE-9,	

PE-11,	PM-8,	SA-14	
Profile 

Cybersecurity Framework Component

9 

Iden)fy	

Protect	

Detect	

Respond	

Recover	

Ways	to	think	about	a	Profile:	

• A	customiza)on	of	the	Core	for	a	

given	sector,	subsector,	or	

organiza)on	

• A	fusion	of	business/mission	logic	

and	cybersecurity	outcomes	

• An	alignment	of	cybersecurity	requirements	with	

opera)onal	methodologies	

• A	basis	for	assessment	and	expressing	target	state	

• A	decision	support	tool	for	cybersecurity	risk	

management	
Using Profiles to Communicate Priorities

10	
Building a Profile 

A Profile Can be Created in Three Steps 

11 

Subcategory 

1	

2	

3	

...	

98	

Mission 

Priority Objective 

1	 A	

2	 B	

3	 C	

Cybersecurity	

Requirements	

Legisla)on	

Regula)on	

Internal	&	External	Policy	

Best	Prac)ce	

Opera%ng	

Methodologies	

Guidance	and	methodology	

on	implemen)ng,	

managing,	and	

monitoring	

1	

2	 3	
Examples of Industry Resources 

12 

The Cybersecurity Framework 

 in Action: An Intel Use Case

Energy Sector Cybersecurity Framework 

Implementation Guidance

Cybersecurity Guidance 

for Small Firms

Cybersecurity	Risk	Management	and	Best	Prac)ces	

Working	Group	4:	Final	Report
Examples of State & Local Use 

13 

Texas, Department of Information Resources

• Aligned Agency Security Plans with Framework 

• Aligned Product and Service Vendor Requirements with Framework 

Houston, Greater Houston Partnership

• Integrated Framework into their Cybersecurity Guide 

• Offer On-Line Framework Self-Assessment 

North Dakota, Information Technology Department • Allocated Roles & Responsibilities using Framework 

• Adopted the Framework into their Security Operation Strategy 

National Association of State CIOs

• 2 out of 3 CIOs from the 2015 NASCIO Awards cited 

Framework as a part of their award-winning strategy 

New Jersey 

• Developed a cybersecurity framework that aligns controls and 

procedures with Framework 
Recent Framework-Relevant Policy and 

Legislation 

14 

Cybersecurity Enhancement Act of 2014 

• Codified NIST’s on-going role facilitating Framework evolution 

• Asked NIST to facilitate less redundancies in regulation 

Maritime Transportation Security Act of 2002 

• Originally authored with physical security in mind 

• Recently clarified to apply to cybersecurity 

OMB Memorandum M-16-03 & 04 

• M-16-03: Fiscal Year 2015-2016 Guidance on Federal Information Security and Privacy 

Management Requirements & M-16-04: Cybersecurity Strategy and Implementation Plan 

• Both organized in the language of the Cybersecurity Framework 

Circular A-130 Update 

• Provides generalized guidance for use of pre-existing FISMA-based guidance like 

Risk Management Framework with Cybersecurity Framework 
Industry Dialog 

Will it soon be time for a Framework update? 

What governance models do you believe will work 

for future Framework maintenance and evolution? 

If you have an opinion on these questions (and more), consider 

responding to our Request for Information - 

https://www.federalregister.gov/articles/2015/12/11/2015-31217/

views-on-the-framework-for-improving-critical-infrastructurecybersecurity

Responses due by 9 February at 5PM ET 
The National Institute of Standards and Technology Web 

site is available at http://www.nist.gov

NIST Computer Security Division Computer Security 

Resource Center is available at http://csrc.nist.gov/

The Framework for Improving Critical Infrastructure 

Cybersecurity and related news and information are 

available at www.nist.gov/cyberframework 

For additional Framework info and help 

cyberframework@nist.gov 

Resources 

Where to Learn More and Stay Current