Cybersecurity Framework 

Overview

Executive Order 13636 

“Improving Critical Infrastructure Cybersecurity” 
Executive Order 13636—Improving Critical Infrastructure 

Cybersecurity

“It is the policy of the United States to enhance the security and 

resilience of the Nation’s critical infrastructure and to maintain a cyber 

environment that encourages efficiency, innovation, and economic 

prosperity while promoting safety, security, business confidentiality, 

privacy, and civil liberties”

• NIST is directed to work with stakeholders to develop a voluntary 

framework for reducing cyber risks to critical infrastructure

• This Cybersecurity Framework is being developed in an open 

manner with input from stakeholders in industry, academia, and 

government, including a public review and comment process, 

workshops, and other means of engagement. 

2
The Cybersecurity Framework

For the Cybersecurity Framework to meet the requirements of the 

Executive Order, it must:

• include a set of standards, methodologies, procedures, and processes 

that align policy, business, and technological approaches to address 

cyber risks. 

• provide a prioritized, flexible, repeatable, performance-based, and costeffective approach, including information security measures and 

controls, to help owners and operators of critical infrastructure identify, 

assess, and manage cyber risk. 

• identify areas for improvement that should be addressed through future 

collaboration with particular sectors and standards-developing 

organizations able technical innovation and account for organizational 

differences include guidance for measuring the performance of an entity 

in implementing the Cybersecurity Framework.

3
4

Development of the Preliminary Framework

Engage the 

Framework 

Stakeholders

Collect, 

Categorize, 

and Post RFI 

Responses

Analyze RFI 

Responses

Identify 

Framework 

Elements

Prepare and 

Publish 

Preliminary 

Framework

EO 13636 Issued – February 12, 2013 

NIST Issues RFI – February 26, 2013

1st Framework Workshop – April 03, 2013

Completed – April 08, 2013

Identify Common Practices/Themes – May 15, 2013

2nd Framework Workshop at CMU – May 29-31, 2013

Draft Outline of Preliminary Framework – June 2013

3rd Framework Workshop at UCSD – July 10-12, 2013

4th Framework Workshop at UT Dallas –

September 11-13, 2013

Publish Preliminary Framework –

October 10, 2013

Ongoing 

Engagement:

Open public comment 

and review 

encouraged and 

promoted throughout 

the process
Stakeholder Engagement Shaped the Framework 

Content

• The Framework language and communication is critical to success

• The Framework must reflect characteristics of people, processes, 

and technologies

• The Framework must be inclusive of and not disruptive to those 

good practices in use today

• The Framework must include the fundamentals 

• Determination of risk tolerance for critical infrastructure must be 

informed by national interests 

• Threat information must inform Framework implementation

5
Preliminary Cybersecurity 

Framework

• Framework Introduction

• Framework Basics

• How to Use the Framework

• Areas for Improvement for the 

Cybersecurity Framework

• Appendix A: Framework Core

• Appendix B: Methodology to 

Protect Privacy and Civil Liberties

• Appendix C: Framework 

Development Methodology

• Appendix D: Glossary

• Appendix E: Acronyms

Executive Overview

• Message to Senior Executives on 

the Cybersecurity Framework

Illustrative Examples

• Threat Mitigation Examples: 

Cybersecurity Intrusion, Malware, 

Mitigating Insider Threats

• ICS Profile for the Electricity 

Subsector

6

Discussion Drafts Posted August 28, 2013
Message to Senior Executives on the Cybersecurity 

Framework

• Cybersecurity risk is a reality that organizations must understand and 

manage like other business risks that can have critical impacts.

• Organizations must manage cybersecurity risk in order to gain and maintain 

customers, reduce cost, increase revenue, and innovate. 

• The Framework is intended to help each organization manage cybersecurity 

risks while maintaining flexibility and the ability to meet business needs.

• Implementing the Framework will help organizations align and communicate 

their cybersecurity risk posture with their partners and help communicate 

expectations for managing cybersecurity risk consistent with their business 

needs. 

7
Risk Management and the Cybersecurity Framework

• While not a risk management process itself, the Framework enables 

the integration of cybersecurity risk management into the 

organization’s overall risk management process.

• The Framework fosters:

• Cybersecurity risk management approaches that take into account the 

interaction of multiple risks;

• Cybersecurity risk management approaches that address both 

traditional information technology and operational technology (industrial 

control systems);

• Cybersecurity risk management practices that encompass the entire 

organization, exposing dependencies that often exist within large, 

mature, and/or diverse entities, and with the interaction between the 

entities and their partners, vendors, suppliers, and others;

• Cybersecurity risk management practices that are internalized by the 

organization to ensure that decision making is conducted by a riskinformed process of continuous improvement; and

• Cybersecurity standards that can be used to support risk management 

activities

8
Framework Core: Functions

The five Framework Core Functions provide the highest level of structure:

• Identify – Develop the institutional understanding of which organizational 

systems, assets, data, and capabilities need to be protected, determine 

priority in light of organizational mission, and establish processes to achieve 

risk management goals. 

• Protect – Develop and implement the appropriate safeguards, prioritized 

through the organization’s risk management process, to ensure delivery of 

critical infrastructure services.

• Detect – Develop and implement the appropriate activities to identify the 

occurrence of a cybersecurity event.

• Respond – Develop and implement the appropriate activities, prioritized 

through the organization’s risk management process (including effective 

planning), to take action regarding a detected cybersecurity event. 

• Recover - Develop and implement the appropriate activities, prioritized 

through the organization’s risk management process, to restore the 

appropriate capabilities that were impaired through a cybersecurity event.

9
Framework Core: Categories

• Categories are the subdivisions of a Function into groups of 

cybersecurity activities, more closely tied to programmatic needs

10
• Subcategories further 

subdivide a Category into highlevel tactical activities to 

support technical 

implementation. 

• Informative References are 

specific sections of standards 

and practices common among 

critical infrastructure sectors 

and illustrate a method to 

accomplish the activities within 

each Subcategory. 

• The Informative References 

presented in the Framework 

Core are not exhaustive, and 

organizations are free to 

implement other standards, 

guidelines, and practices.

11

Framework Core: Subcategories and Informative 

References
The Framework Core

12
Framework Implementation Tiers

• Feedback indicated the need for the Framework to allow for 

flexibility in implementation

• Responding to feedback, Framework Implementation Tiers were 

proposed to reflect how an organization implements the Framework 

Core functions and manages its risk.

• The characteristics expressed in the Tiers are progressive, ranging 

from Partial (Tier 0) to Adaptive (Tier 3), with each Tier building on 

the previous Tier.

• The Tier characteristics are defined at the organizational level and 

are applied to the Framework Core to determine how a category is 

implemented.

13
Tier 0: Partial – The organization: 

• Has not yet implemented a formal, threat-aware risk 

management process to determine a prioritized list 

of cybersecurity activities. 

• May implement some portions of the Framework on 

an irregular, case-by-case basis due to varied 

experience or information gained from outside 

sources. 

• May not have the processes in place to share 

cybersecurity information internally between its 

organizational layers and may not have the 

processes in place to participate in coordination or 

collaboration with other entities.

Tier 1: Risk Informed – The organization: 

• Uses a formal, threat-aware risk management 

process to develop a Profile of the Framework. 

• Uses risk-informed, management-approved 

processes and procedures that are defined and 

implemented 

• Has staff with adequate resources to perform their 

cybersecurity duties.

• Knows its role in the larger ecosystem, but has not 

formalized its capabilities to interact and share 

information externally.

Tier 2: Repeatable – The organization: 

• Updates its Profile based on regular application of 

its risk management process to respond to a 

changing cybersecurity landscape. 

• Has defined risk-informed policies, processes, and 

procedures that are implemented as intended, and 

validated. 

• Will also have consistent methods in place to 

provide updates when a risk change occurs.

• Has personnel have adequate knowledge and skills 

to perform their defined roles and responsibilities. 

• Understands its dependencies and partners and 

can consume information from these partners to 

help prevent and improve its reaction to events.

Tier 3: Adaptive – The organization:

• Updates its Profile based on predictive indicators 

derived from previous and anticipated cybersecurity 

activities. 

• Has risk-informed policies, processes, and 

procedures are part of the organizational culture 

and evolve from previous activities (and from 

information shared by other sources) to predict and 

address potential cybersecurity events. 

• Manages risk and actively shares information with 

partners to ensure that accurate, current information 

is being distributed and consumed to improve 

Cybersecurity before an event occurs. 14

Framework Implementation Tiers
Framework Profile

• Enables organizations to establish a roadmap to reducing cybersecurity risk

• Can be used to describe 

current state and desired 

target state of specific 

cybersecurity activities

• Created by determining

which Categories are

relevant to a particular

organization, sector, or 

other entity

• An organization’s risk

management processes, 

legal / regulatory requirements,

business / mission objectives,

and organizational constraints

guide the selection of activities 

during Profile development

15
Framework Profile Implementation

• The method by which the Functions, Categories, and Subcategories 

described in the Core are aligned with business requirements, risk 

tolerance, and resources for the organization.

• The Framework provides a mechanism for organizations, sectors, and other 

entities to create their own Target Profiles.

• It does not provide Target Profile templates, nor identify Tier requirements 

that an organization should meet.

16
Notional Information and Decision Flows within an 

Organization

17
How to Use the Framework

The Framework can be leveraged by organizations looking to:

• Establish or Improve a Cybersecurity Program

Step 1: Make Organization Wide Decisions

Step 2: Establish a Target Profile

Step 3: Establish a Current Profile

Step 4: Compare Target and Current Profiles

Step 5: Implement Target Profile

• Communicate Cybersecurity Requirements with Stakeholders

• Identify Gaps

18
Methodology to Protect Privacy and Civil Liberties

• The EO directs NIST to include a methodology to identify and mitigate 

impacts of the Framework and associated security measures to protect 

individual privacy and civil liberties.

• Appendix B presents a Privacy methodology that is coordinated with the 

Framework Core. This methodology provides organizations with flexibility in 

determining how to manage privacy risk.

• This methodology is based on the Fair Information Practice Principles 

(FIPPs) referenced in the EO, and is designed to complement existing 

processes organizations may have in place.

19
Areas for Improvement for the Cybersecurity 

Framework

Executive Order 13636 states that the Cybersecurity Framework will “identify 

areas for improvement that should be addressed through future collaboration 

with particular sectors and standards-developing organizations”. 

Based on stakeholder input, several high-priority Areas for Improvement have 

been identified. Collaboration and cooperation must increase for these areas to 

further understanding and/or the development of new or revised standards. 

• Authentication

• Automated Indicator Sharing

• Conformity Assessment

• Data Analytics

• International Aspects, Impacts, and Alignment

• Privacy

• Supply Chains and Interdependencies

20
Threat Mitigation Profile Examples

• While organizations and sectors 

may develop overall Profiles, 

these Threat Mitigation Profile 

examples illustrate how 

organizations may apply the 

Framework to mitigate specific 

threats. 

• Discussion of 3 scenarios: 

Cybersecurity intrusion, malware, 

and insider threat scenarios 

Industrial Control Systems Profile 

for the Electricity Subsector

• Includes an introduction that 

describes the application of the 

framework under a specific 

scenario.

• The scenarios will include 

adapting the framework to 

address the nuances of the 

particular risks that are relevant to 

a particular organization’s 

business operations or mission. 

• Includes ISO/ISA 27001, CCS 

CSC, NISTIR 7628, NIST SP 800-

53, NERC CIP, and DOE ESC2M2 as Informative References.

21

Draft Illustrative Framework Profile Examples
Draft Illustrative Framework Profile Example: 

Threat Mitigation

22
Draft Illustrative Framework Profile Example: 

ICS Profile for the Electricity Subsector

• Includes an introduction that describes the application of the framework 

under a specific scenario – an electric utility.

• The electricity subsector has created several guidelines, standards, and 

programs based on cybersecurity practices and controls. 

• This illustrative Framework example makes some assumptions regarding 

the electric utility, including that it:

• Complies with the North American Electric Reliability Corporation 

(NERC) Critical Infrastructure Protection (CIP) Version 3 standards and 

has identified Critical Cyber Assets (CCAs);

• Is aware of other security standards and relies on the informative 

references used in the Framework Core;

• Has performed a Department of Energy (DOE) Electricity Subsector 

Cybersecurity Capability Maturity Model (ES-C2M2) self-evaluation and 

is knowledgeable in the relevant domains and practices; and

• Is familiar with risk management processes, such as those contained in 

both the NERC CIP standards and DOE Risk Management Process.

23
24

Draft Illustrative Framework Profile Example: 

ICS Profile for the Electricity Subsector
How can the Preliminary Framework:

• adequately define and address 

outcomes that strengthen 

cybersecurity and support business 

objectives?

• enable cost-effective implementation?

• appropriately integrate cybersecurity 

risk into business risk?

• provide the tools for senior executives 

and boards of directors to understand 

risks and mitigations at the appropriate 

level of detail?

• enable senior executive awareness of 

potential consequences of successful 

cyber attacks?

• provide sufficient guidance and 

resources to aid businesses of all 

sizes while maintaining flexibility?

Will the Discussion Draft, as presented:

• be inclusive of, and not disruptive to, 

effective cybersecurity practices in use 

today? 

• enable organizations to incorporate 

threat information?

Is the Discussion Draft:

• presented at the right level of 

specificity?

• sufficiently addressing unique privacy 

and civil liberties needs for critical 

infrastructure?

25

Questions for Reviewers to Consider
Getting from the Preliminary Framework to the Final 

Framework and Beyond

26

Framework 

Governance

Additional 

Ongoing 

Public 

Engagement

Public 

Comment 

Period

Final 

Cybersecurity 

Framework

Prepare and 

Publish 

Preliminary 

Framework

Publish Preliminary Framework – October 10, 2013

Begin 45 day Public Comment Period

Stakeholder outreach discussion continue 

Public comment period closes – November 25, 2013 

Complete comment resolution and disposition 

Publish Final Cybersecurity Framework – February 

2014

Framework maintenance and updates

Ongoing 

Engagement:

Open public comment 

and review 

encouraged and 

promoted throughout 

the process
Q & A

The Discussion Draft of the Preliminary Cybersecurity Framework, 

Executive Overview, Illustrative Examples, and other material is 

available at http://www.nist.gov/itl/cyberframework.cfm

Please send us your continued observations and further suggestions at 

cyberframework@nist.gov

27