Applying Framework to Mobile & BYOD

Framework for Improving Critical Infrastructure 

Cybersecurity

National Association of Attorneys General

Southern Region Meeting

13 March 2015

cyberframework@nist.gov
As directed by Executive Order 13636, NIST convened industry to create the Cybersecurity Framework 

(Framework) for Improving Critical Infrastructure Cybersecurity. Use of the Framework is voluntary.

The Framework has 3 main components

International Federal State Gov’t Industry

Translations Sector Guidance State Guidance White Papers

Framework Version 1.0

Related Roadmap Items

Industry Resources

NIST Speaking Engagements

RFI Responses

Frequently Asked Questions

Framework components are used to align

Learn more and contribute at http://www.nist.gov/cyberframework/

Workshops & Stakeholder Engagement

Request for Information, Feedback on the Draft & 

5 Industry Workshops in 5 Different Cities

Framework

12 February 2014

EO 13636

13 February 2013

10110

Mission Technology Cybersecurity

The Framework is used broadly

C y b e r s e c u r i t y F r a m e w o r k
Framework Core

4

What assets need 

protection?

What safeguards 

are available?

What techniques 

can identify 

incidents?

What techniques 

can contain impacts 

of incidents?

What techniques 

can restore 

capabilities?

5 Functions 22 Categories 98 Subcategories
Framework Core Excerpt

5
Where Should I Start?

6

Framework Version 1.0, Section 3.2, Step 1: 

Prioritize and Scope. The organization identifies its 

business/mission objectives and high-level 

organizational priorities. With this information, the 

organization makes strategic decisions regarding 

cybersecurity implementations and determines the 

scope of systems and assets that support the selected 

business line or process. The Framework can be 

adapted to support the different business lines or 

processes within an organization, which may have 

different business needs and associated risk tolerance.

(2b) Risk Management Strategy 

(ID.RM): The organization’s priorities, 

constraints, risk tolerances, and 

assumptions are established and used to 

support operational risk decisions.

(1) Business Environment (ID.BE): The 

organization’s mission, objectives, 

stakeholders, and activities are understood 

and prioritized; this information is used to 

inform cybersecurity roles, responsibilities, 

and risk management decisions.

(2a) Governance (ID.GV): The policies, 

procedures, and processes to manage and 

monitor the organization’s regulatory, legal, 

risk, environmental, and operational 

requirements are understood and inform the 

management of cybersecurity risk

Operate & Maintain
Key Questions for New Technologies

7

Overarching

Question Question Who

Decision 

Materials

Proceed?

Will implementing the technology help me fulfill mission 

priorities? Mission ID.BE-3

Will implementing the technology adversely affect the mission 

function of my current systems? Technology ID.AM-5

Will implementing the technology introduce untenable risk?

Cyber 

Security

ID.RM2/Profile

Inherent

risks

Proceed now?

Is it possible to implement this technology given my current 

infrastructure? Technology ID.AM-1, 2, 

& 3

How can I minimize risk associated with this new technology:

• in a way that supports my organization’s 

requirements, and

• within my finite budget?

Cyber 

Security

ID.RM2/Profile

Inherent 

risks

How much security is ‘enough’ to implement this new 

technology?

Cyber 

Security

ID.RM2/Profile

Hand-off to 

operations

What do I need to do to ensure on-going risk management of 

this new technology?

Cyber 

Security

Remaining 

Categories
Inherent Risks of Mobile Devices & Bring 

Your Own Device

8

• Inventory is difficult

• Organization-supplied, personnel-supplied, hybrid

• Administrative diligence may be unknown or minimal

• Patching, software baseline, security configuration management

• Mobile technologies bring increased possibility of malicious code to 

the enterprise due to increased attack surface and networks

• Devices tend to connect to a large number of networks, the 

majority of which are not managed by the organization

• Lots of spectrum per device (e.g., LTE, WiFi, GPS, Near Field 

Communication, Blue Tooth)

• Possibility of loosing control of organizational information as it is 

transported via mobile device

• Risk assessment before ‘go live’ is impossible and impractical

• Strong potential for personal data to traverse organizational 

networks
Assessing and Minimizing Inherent Risks

9

Inventory is difficult
Assessing and Minimizing Inherent Risks

10

Personal and 

organizational data is 

co-mingled

ID.GV-3

ID.GV-1
Privacy Considerations

11

Framework Version 1.0, Section 3.5, Methodology to Protect Privacy and 

Civil Liberties

Governance of cybersecurity risk 

• An organization’s assessment of cybersecurity risk and potential risk responses considers the privacy 

implications of its cybersecurity program 

• Individuals with cybersecurity-related privacy responsibilities report to appropriate management and 

are appropriately trained 

• Process is in place to support compliance of cybersecurity activities with applicable privacy laws, 

regulations, and Constitutional requirements 

• Process is in place to assess implementation of the foregoing organizational measures and controls 

Approaches to identifying and authorizing individuals to access organizational assets and systems 

• Steps are taken to identify and address the privacy implications of access control measures to the 

extent that they involve collection, disclosure, or use of personal information 

Awareness and training measures 

• Applicable information from organizational privacy policies is included in cybersecurity workforce 

training and awareness activities 

• Service providers that provide cybersecurity-related services for the organization are informed about 

the organization’s applicable privacy policies

Anomalous activity detection and system and assets monitoring 

• Process is in place to conduct a privacy review of an organization’s anomalous activity detection and 

cybersecurity monitoring 

Response activities, including information sharing or other mitigation efforts 

• Process is in place to assess and address whether, when, how, and the extent to which personal 

information is shared outside the organization as part of cybersecurity information sharing activities 

• Process is in place to conduct a privacy review of an organization’s cybersecurity mitigation efforts 
The National Institute of Standards and Technology Web site is 

available at http://www.nist.gov

NIST Computer Security Division Computer Security Resource 

Center is available at http://csrc.nist.gov/

The Framework for Improving Critical Infrastructure Cybersecurity

and related news and information are available at 

www.nist.gov/cyberframework

For additional Framework info and help cyberframework@nist.gov

Resources

Where to Learn More and Stay Current