Framework for Improving Critical 

Infrastructure Cybersecurity 

Where We Are & Where We Are Going 

29 October 2015 

cyberframework@nist.gov 
Improving Critical Infrastructure Cybersecurity

“It is the policy of the United States to enhance the security and resilience of the Nation’s 

critical infrastructure and to maintain a cyber 

environment that encourages efficiency, 

innovation, and economic prosperity while 

promoting safety, security, business confidentiality, privacy, and civil liberties” 

President Barack Obama 

Executive Order 13636, 12 February 2013
Cybersecurity Framework Components 

4 

Describes how cybersecurity 

risk is managed by an organization 

and degree the risk management 

practices exhibit key characteristics 

Aligns industry standards and 

best practices to the Framework 

Core in a particular 

implementation scenario 

Supports prioritization and 

measurement while 

factoring in business 

needs 

Cybersecurity activities and 

informative references, 

organized around particular 

outcomes 

Enables communication 

of cyber risk across an 

organization 

Framework 

Core 

Framework 

Implementation 

Tiers 

Framework 

Profile 
Framework Core 

What	processes	and	

assets	need	protec.on?	

What	safeguards	are	

available?	

What	techniques	can	

iden.fy	incidents?	

What	techniques	can	

contain	impacts	of	

incidents?	

What	techniques	can	

restore	capabili.es?	
Core 

Cybersecurity Framework Component 

6 

Func%on Category ID	

Iden%fy	

Asset	Management	 ID.AM	

Business	Environment	 ID.BE	

Governance	 ID.GV	

Risk	Assessment	 ID.RA	

Risk	Management	

Strategy	 ID.RM	

Protect	

Access	Control	 PR.AC	

Awareness	and	Training	 PR.AT	

Data	Security	 PR.DS	

Informa.on	Protec.on	

Processes	&	Procedures	 PR.IP	

Maintenance	 PR.MA	

Protec.ve	Technology	 PR.PT	

Detect	

Anomalies	and	Events	 DE.AE	

Security	Con.nuous	

Monitoring	 DE.CM	

Detec.on	Processes	 DE.DP	

Respond	

Response	Planning	 RS.RP	

Communica.ons	 RS.CO	

Analysis	 RS.AN	

Mi.ga.on	 RS.MI	

Improvements	 RS.IM	

Recover	

Recovery	Planning	 RC.RP	

Improvements	 RC.IM	

Communica.ons	 RC.CO	

Subcategory Informative References

ID.BE-1:	The	

organiza.on’s	role	in	the	

supply	chain	is	iden.fied	

and	communicated

COBIT	5	APO01.02,	DSS06.03	

ISA	62443-2-1:2009	4.3.2.3.3		

ISO/IEC	27001:2013	A.6.1.1	

NIST	SP	800-53	Rev.	4	CP-2,	PS-7,	

PM-11		

ID.BE-2:	The	

organiza.on’s	place	in	

cri.cal	infrastructure	and	

its	industry	sector	is	

iden.fied	and	

communicated

COBIT	5	APO08.04,	APO08.05,	

APO10.03,	APO10.04,	APO10.05	

ISO/IEC	27001:2013	A.15.1.3,	A.

15.2.1,	A.15.2.2		

NIST	SP	800-53	Rev.	4	CP-2,	SA-12	

ID.BE-3:	Priori.es	for	

organiza.onal	mission,	

objec.ves,	and	ac.vi.es	

are	established	and	

communicated	

COBIT	5	APO02.06,	APO03.01	

NIST	SP	800-53	Rev.	4	PM-8	

ID.BE-4:	Dependencies	

and	cri.cal	func.ons	for	

delivery	of	cri.cal	

services	are	established	

COBIT	5	APO02.01,	APO02.06,	

APO03.01	

ISA	62443-2-1:2009	4.2.2.1,	4.2.3.6	

NIST	SP	800-53	Rev.	4	PM-11,	SA-14	

ID.BE-5:	Resilience	

requirements	to	support	

delivery	of	cri.cal	

services	are	established	

ISO/IEC	27001:2013	A.11.2.2,	A.

11.2.3,	A.12.1.3	

NIST	SP	800-53	Rev.	4	CP-8,	PE-9,	

PE-11,	PM-8,	SA-14	
Implementation Tiers 

Cybersecurity Framework Component

7 

• Allow for flexibility in implementation and bring in concepts of 

maturity models 

• Reflect how an organization implements the Framework Core 

functions and manages its risk 

• Progressive, ranging from Partial (Tier 1) to Adaptive (Tier 4), 

with each Tier building on the previous Tier 

• Characteristics are defined at the organizational level and are 

applied to the Framework Core to determine how a category is 

implemented. 

None	

Par.al	 Repeatable	

Risk	

Informed	

Adap.ve	
Profile 

Cybersecurity Framework Component

8 

Iden.fy	

Protect	

Detect	

Respond	

Recover	

Ways	to	think	about	a	Profile:	

• A	customiza.on	of	the	Core	for	a	

given	sector,	subsector,	or	

organiza.on	

• A	fusion	of	business/mission	logic	

and	cybersecurity	outcomes	

• An	alignment	of	cybersecurity	requirements	with	

opera.onal	methodologies	

• A	basis	for	assessment	and	expressing	target	state	

• A	decision	support	tool	for	cybersecurity	risk	

management	
Using Profiles to Communicate Priorities

9	
Building a Profile 

A Profile Can be Created in Three Steps 

10 

Subcategory 

1	

2	

3	

...	

98	

Mission 

Priority Objective 

1	 A	

2	 B	

3	 C	

Cybersecurity	

Requirements	

Legisla.on	

Regula.on	

Internal	&	External	Policy	

Best	Prac.ce	

Opera%ng	

Methodologies	

Guidance	and	methodology	

on	implemen.ng,	

managing,	and	

monitoring	

1	

2	 3	
Conceptual Profile 

Value Proposition 

11 

Cybersecurity 

Requirements Subcategory Priority 

Operating 

Methodologies 

A	 1	 moderate	 I	

II	

B	

C	 2	 high	 III	

D	

E	 3	 moderate	 IV	V	

F	 ...	 ...	 VI	

VII	

G	 98	 moderate	 VIII	

2	 1	 3	

When	you	organize	yourself	in	this	way:	

• Compliance	repor.ng	becomes	a	byproduct	of	

running	your	security	opera.on	

• Adding	new	security	requirements	is	straighcorward	

• Adding	or	changing	opera.onal	methodology	is	nonintrusive	to	on-going	opera.on	
Resource and Budget Decisioning

What Can You Do with a CSF Profile 

12 

Subcategory Priority Gaps 

Year 1 

Activities 

Year 2 

Activities 

1	 moderate	 small	 X	

2	 high	 large	 X	

3	 moderate	 medium	 X	

...	 ...	 ...	

98	 moderate	 none	 reassess	

As-Is	 Year	1	

To-Be	

Year	2	

To-Be	

...and	supports	on-going	opera.onal	decisions	too	
Key Attributes 

• It’s a framework, not a prescription 

• It provides a common language and systematic methodology for 

managing cyber risk 

• It is meant to be adapted 

• It does not tell a company how much cyber risk is tolerable, nor 

does it claim to provide “the one and only” formula for cybersecurity 

• Having a common lexicon to enable action across a very diverse set 

of stakeholders will enable the best practices of elite companies to 

become standard practices for everyone 

• The framework is a living document

• It is intended to be updated over time as stakeholders learn from 

implementation, and as technology and risks change 

• That’s one reason why the framework focuses on questions an 

organization needs to ask itself to manage its risk. While practices, 

technology, and standards will change over time—principals will not 

13 
Where Should I Start? 

14 

Framework Version 1.0, Section 3.2, Step 1: 

Prioritize and Scope. The organization identifies its 

business/mission objectives and high-level 

organizational priorities. With this information, the 

organization makes strategic decisions regarding 

cybersecurity implementations and determines the 

scope of systems and assets that support the selected 

business line or process. The Framework can be 

adapted to support the different business lines or 

processes within an organization, which may have 

different business needs and associated risk tolerance. 

(2b) Risk Management Strategy 

(ID.RM): The organization’s priorities, 

constraints, risk tolerances, and 

assumptions are established and used to 

support operational risk decisions.

(1) Business Environment (ID.BE): The 

organization’s mission, objectives, 

stakeholders, and activities are understood 

and prioritized; this information is used to 

inform cybersecurity roles, responsibilities, 

and risk management decisions.

(2a) Governance (ID.GV): The policies, 

procedures, and processes to manage and 

monitor the organization’s regulatory, legal, 

risk, environmental, and operational 

requirements are understood and inform the 

management of cybersecurity risk

Operate	&	Maintain	
Key Questions for New Technologies 

15 

Overarching	

Ques%on	 Ques%on	 Who	

Decision	

Materials	

Proceed?	

Will	implemen.ng	the	technology	help	me	fulfill	mission	

priori.es?	 Mission	 ID.BE-3	

Will	implemen.ng	the	technology	adversely	affect	the	

mission	func.on	of	my	current	systems?	 Technology	 ID.AM-5	

Will	implemen.ng	the	technology	introduce	untenable	risk?	

Cyber	

Security	

ID.RM-2/

Profile	

Inherent	

risks	

Proceed	now?	

Is	it	possible	to	implement	this	technology	given	my	current	

infrastructure?	 Technology	 ID.AM-1,	2,	

&	3	

How	can	I	minimize	risk	associated	with	this	new	

technology:	

• in	a	way	that	supports	my	organiza.on’s	

requirements,	and	

• within	my	finite	budget?	

Cyber	

Security	

ID.RM-2/

Profile	

Inherent	

risks	

How	much	security	is	‘enough’	to	implement	this	new	

technology?	

Cyber	

Security	

ID.RM-2/

Profile	

Hand-off	to	

opera:ons	

What	do	I	need	to	do	to	ensure	on-going	risk	management	

of	this	new	technology?	

Cyber	

Security	

Remaining	

Categories	
Industry Use 

The Framework is designed to complement existing business and 

cybersecurity operations, and has been used to: 

• Self-Assessment, Gap Analysis, Budget & Resourcing Decisions 

• Standardizing Communication Between Business Units 

• Harmonize Security Operations with Audit 

• Communicate Requirements with Partners and Suppliers 

• Describe Applicability of Products and Services 

• Identify Opportunities for New or Revised Standards 

• Categorize College Course Catalogs 

• As a Part of Cybersecurity Certifications 

• Categorize and Organize Requests for Proposal Responses 

• Consistent dialog, both within and amongst countries 

• Common platform on which to innovate, by identifying market 

opportunities where tools and capabilities may not exist today 

16 
Current & Near-Term Framework Activities 

Collect, Reflect, and Connect – understand where 

industry is having success, help others understand those 

successes, and facilitate relationships that support use and 

implementation 

• Continue education efforts, including creation of self-help 

and re-use materials for those who are new to the 

Framework 

• Continue awareness and outreach with an eye toward 

industry communities who are still working toward basal 

Framework knowledge and implementation 

• Educate on the relationship between Framework and the 

larger risk management process, including how 

organizations can use Tiers 
Since the Release of the Cybersecurity Framework... 

6th Cybersecurity Framework Workshop 

Goal: Raise awareness, encourage use as a 

tool, highlight examples of sector-specific efforts, 

implementation efforts, gather feedback Florida Center for 

Oct. 29-30, 2014 

Cybersecurity 

Update on the Cybersecurity Framework 

Summary posted that includes analysis of RFI 

responses, feedback from the 6th workshop, an 

update on Roadmap areas, and next steps December 5, 2014 

Request for Information: Experience with 

the Cybersecurity Framework 

Questions focused on: awareness, experiences, and 

roadmap areas August 26, 2014 

1 Year Anniversary of the Release 

NIST Cybersecurity Framework site update to 

include: FAQs, Upcoming Events, and Industry 

Resources. Ongoing, targeted outreach continues February 12, 2015 

February 13, 2015 

White House Releases 

Fact Sheet on Cybersecurity 

and Consumer Protection
Examples of Industry Resources 

19 

The Cybersecurity Framework 

 in Action: An Intel Use Case

Energy Sector Cybersecurity Framework 

Implementation Guidance

Cybersecurity Guidance 

for Small Firms

Cybersecurity	Risk	Management	and	Best	Prac.ces	

Working	Group	4:	Final	Report

CFORUM and other online communities of interest 
On-Going NIST Community Dialogs 

• Standards Organizations 

• British Standards Institute, Cloud Security Alliance, 

AXELOS, etc. 

• Domestic Industry 

• Not only Critical Infrastructure, but also Non-CI 

• Product and Services 

• Regulator 

• Every Federal Financial Services regulator 

• Auditor 

• Information Systems Audit and Control Association 

• “The Big 4” Audit Firms 

• Insurance 

• Legal 20 
Framework Roadmap Items 

Authentication 

Automated Indicator Sharing 

Conformity Assessment 

Cybersecurity Workforce 

Data Analytics 

Federal Agency Cybersecurity Alignment 

International Aspects, Impacts, and Alignment 

Supply Chain Risk Management 

Technical Privacy Standards 21 
FIPS - Federal Information Processing Standards 

§ FIPS 199 – Standards for Security Categorization 

§ FIPS 200 – Minimum Security Requirements 

SPs – Special Publications 

§ SP 800-18 – Guide for System Security Plan development 

§ SP 800-30 – Guide for Conducting Risk Assessments 

§ SP 800-34 – Guide for Contingency Plan development 

§ SP 800-37 – Guide for Applying the Risk Management Framework 

§ SP 800-39 – Managing Information Security Risk 

§ SP 800-53/53A – Security controls catalog/assessment procedures 

§ SP 800-60 – Mapping Information Types to Security Categories 

§ SP 800-128 – Security-focused Configuration Management 

§ SP 800-137 – Information Security Continuous Monitoring 

§ Many others for operational and technical implementations 

Standards/Guidelines for FISMA & RM 
SP	800-53	security	controls	

CobIT	controls	

ISO	27002	controls	

Etc...	

Organizing and Communicating SP 800-53 

Security Controls 

Use Case for FISMA-Cybersecurity Framework Combined Use 
Supporting the RMF Categorize Step 

Use Case for FISMA-Cybersecurity Framework Combined Use 

FIPS 199/SP 800-60 

FIPS 200/SP 800-53 

Many SPs 

SP 800-53A 

SP 800-37 

SP 800-137/SP 800-53A 

Profile 

A sector, subsector, or organization’s customization 

of the Core for their purposes. Aligns, identifies 

conflicts in organizational inputs, and prioritizes 

cyber objectives commensurate with mission 

objectives

Category 

Business Environment (ID.BE) 

The organization’s mission, objectives, stakeholders, 

and activities are understood and prioritized; this 

information is used to inform cybersecurity roles, 

responsibilities, and risk management decisions.
25 

CSF	Core	 tailoring	 CSF	Profile	

Tailoring SP 800-53 Security Controls 

Use Case for FISMA-Cybersecurity Framework Combined Use 
Industry Dialog 

Will it soon be time for a Framework 

update? 

What governance models do you 

believe will work for future 

Framework maintenance and 

evolution? 
The National Institute of Standards and Technology Web 

site is available at http://www.nist.gov

NIST Computer Security Division Computer Security 

Resource Center is available at http://csrc.nist.gov/

The Framework for Improving Critical Infrastructure 

Cybersecurity and related news and information are 

available at www.nist.gov/cyberframework 

For additional Framework info and help 

cyberframework@nist.gov 

Resources 

Where to Learn More and Stay Current