Final Version – 07 November 2018

1

This draft agenda is subject to change and will be updated as 

schedules and session titles are confirmed.

NIST Cybersecurity Risk Management Conference 2018

Renaissance Baltimore Harborplace Hotel, Baltimore, Maryland

November 7-9, 2018

Conference Purpose: The newly expanded conference format builds on the annual Cybersecurity 

Framework Workshops held for the past five years and adds other cybersecurity risk management 

topics: Risk Management Framework, Supply Chain Risk Management, and the Privacy Framework.

This conference will provide participants with:

1) An opportunity to learn about the current state of cybersecurity risk management and 

innovative approaches that are being deployed, and

2) A forum to voice their opinions on and discuss today’s most vital cybersecurity risk 

management issues and solutions.

Sharing will take place through presentations, panels, and working sessions, as well as ample forums for 

networking.

Agenda Overview

Wednesday, November 7, 2018

7:30am Registrant Check-In

8:30am Welcoming Remarks

8:40am Keynote: Mr. Leo Simonovich on Siemens and the Charter of Trust

9:10am Conference Overview

9:40am Break

10:00am Plenary Panels

• Cybersecurity in Large and Distributed Organizations

• Key NIST Cybersecurity and Privacy Program Overview

12:00pm Lunch – to include Lunch-and-Learn sessions

1:00pm Afternoon Sessions I

• Secure Software: Toward A Proposed Benchmark

(Maryland Ballroom ‘A’ - 1:00PM – 2:00PM)

• Friends Don’t Let Friends Tackle Cybersecurity Alone: Taking a Team Approach to 

Strengthening Cyber Resilience in the Marketplace

(Maryland Ballroom ‘B’ - 1:00PM – 2:00PM)

• Financial Services Sector Cybersecurity Profile: A NIST-based Approach to 

Harmonize Cybersecurity Risk Management and Compliance

(Maryland Ballroom ‘C’ - 1:00PM – 2:00PM)

• Cybersecurity Framework Profiles, Lessons from the Trenches

(Maryland Ballroom ‘D’ - 1:00PM – 2:00PM)

• Implementing the Cybersecurity Framework

(Maryland Ballroom ‘E’ - 1:00PM – 2:00PM)

2:00pm Break
Final Version – 07 November 2018

2

This draft agenda is subject to change and will be updated as 

schedules and session titles are confirmed.

2:30pm Afternoon Sessions II

• Empirical Measurement of Perceived Privacy Risk

(Maryland Ballroom ‘A’ - 2:30PM – 3:10PM)

• Are We Building “Maginot Lines” in Our Networks?

(Maryland Ballroom ‘B’ - 2:30PM – 3:10PM)

• Risk Management for Automotive Cybersecurity

(Maryland Ballroom ‘C’ - 2:30PM – 3:10PM)

• Israeli Secure Supply Chain Scheme

(Maryland Ballroom ‘D’ - 2:30PM – 3:10PM)

• Actuarial, Statistical and Other Analytical Approaches to Cyber Risk Measurement

(Maryland Ballroom ‘E’ - 2:30PM – 3:10PM)

• Cyber Strategy Optimization for Risk Management – A New Approach

(Maryland Ballroom ‘F’ - 2:30PM – 3:10PM)

• Understanding and Managing Cyber-Risk with a Dwell Time Base

(James - 2:30PM – 3:10PM)

• Framework for Improving Critical Infrastructure Cybersecurity: A Practical 

Implementation

(Maryland Ballroom ‘A’ - 3:15PM – 3:55PM)

• NIST Cybersecurity Framework and PCI DSS

(Maryland Ballroom ‘B’ - 3:15PM – 3:55PM)

• How Japanese Industry Uses the NIST Framework to Overcome Manpower Shortage

(Maryland Ballroom ‘C’ - 3:15PM – 3:55PM)

• Enabling Executive Level Decisions

(Maryland Ballroom ‘D’ - 3:15PM – 3:55PM)

• Simple, Consistent, Secure – Cybersecurity and Privacy in Small and Medium-sized 

Organizations

(Maryland Ballroom ‘E’ - 3:15PM – 3:55PM)

• Using a Controls Framework to Address NIST, HIPAA, and GDPR Security 

Requirements, and to Ensure Management of Cyber Threats

(Maryland Ballroom ‘F’ - 3:15PM – 3:55PM)

• Managing the Hidden Cybersecurity Risks

(Maryland Ballroom ‘A’ - 4:00PM – 4:45PM)

• Risk Data Sharing for Situational Awareness

(Maryland Ballroom ‘B’ - 3:15PM – 4:00PM)

• Using NIST Guidance to Implement and Information Systems Risk Management 

Program for a Small National Government

(Maryland Ballroom ‘C’ - 4:00PM – 4:45PM)

• Reducing the Burden of Cyber Security

(Maryland Ballroom ‘D’ - 4:00PM – 4:45PM)

• Is Our Critical Infrastructure Cyber Resilient?

(Maryland Ballroom ‘E’ - 4:00PM – 4:45PM)

• Use of NIST Guidance in Governmental Settings, Including the U.S. Federal 

Government: Department of Defense (DoD) Components Adopting the Risk 

Management Framework (RMF) Process. A Practical Implementation

(Maryland Ballroom ‘F’ - 4:00PM – 4:45PM)

4:45pm Adjourn
Final Version – 07 November 2018

3

This draft agenda is subject to change and will be updated as 

schedules and session titles are confirmed.

Thursday, November 8, 2018

7:30am Registrant Check-In

8:30am Plenary Panels

• U.S. National Critical Infrastructure Risk Management

• Government Use of NIST Cybersecurity Publications

10:30am Break

10:45am Morning Sessions III

• Connecting the Dots Between Threats & Mitigations in Federal Networks

(Maryland Ballroom ‘A’ - 10:45AM – 11:45AM)

• Vendor Management & NIST SP 800-171

(Maryland Ballroom ‘B’ - 10:45AM – 11:45AM)

• Supply Chain Initiatives: Global Strategy to Enterprise Risk Management

(Maryland Ballroom ‘C’ - 10:45AM – 11:45AM)

• Federating Framework Informative References

(Maryland Ballroom ‘D’ - 10:45AM – 11:45AM)

• Software Bill of Materials: Best Practices for Machine-Readable Assurance Data in 

Mission Operations

(Maryland Ballroom ‘E’ - 10:45AM – 11:45AM)

• Integrated Cyber Playbooks for Identity Threat Prevention (ITP) within the NIST 

Risk Management Framework

(Maryland Ballroom ‘F’ - 10:45AM – 11:45AM)

• A Tale of Two Frameworks: Optimizing Federal Agency Use of the RMF and CSF 

through Framework Profiles

(Kent - 10:45AM – 11:45AM)

11:45am Lunch – to include Lunch-and-Learn sessions

1:15pm Afternoon Sessions IV

• Health Sector Cybersecurity Risk Management

(Maryland Ballroom ‘A’ - 1:15PM – 2:15PM)

• Evaluating “Reasonable” Cyber Risk Using CIS RAM

(Maryland Ballroom ‘B’ - 1:15PM – 2:15PM)

• Cybersecurity Coalition Distributed Denial of Service Mitigation Profile

(Maryland Ballroom ‘C’ - 1:15PM – 2:15PM)

• Cybersecurity Measurement and Metrics

(Maryland Ballroom ‘D’ - 1:15PM – 2:15PM)

• Integrating Privacy into the Risk Management Framework

(Maryland Ballroom ‘E’ - 1:15PM – 2:15PM)

• Electrical Manufacturers’ Role in Cyber Supply Chain Risk Management

(Maryland Ballroom ‘F’ - 1:15PM – 2:15PM)

• Adding Rigor and Depth to RMF Step 2 (Select Security Controls)

(Kent - 1:15PM – 2:15PM)

2:15pm Break

2:45pm Afternoon Sessions V

• Cyber Threat Framework

(Maryland Ballroom ‘A’ - 2:45PM – 3:25PM)
Final Version – 07 November 2018

4

This draft agenda is subject to change and will be updated as 

schedules and session titles are confirmed.

• Connecting to the Business Mission: Why Context Matters for Security Teams

(Maryland Ballroom ‘B’ - 2:45PM – 3:25PM)

• Measuring an Organization’s Security Maturity using the NIST Cybersecurity 

Framework

(Maryland Ballroom ‘C’ - 2:45PM – 3:25PM)

• The Business and Regulatory Value of Third-Party Certification to the NIST 

Cybersecurity Framework

(Maryland Ballroom ‘D’ - 2:45PM – 3:25PM)

• Best Practices Learned from Mitigating Risks of Data Breaches to Build a Data 

Privacy Program

(Maryland Ballroom ‘E’ - 2:45PM – 3:25PM)

• Supply Chain Attacks and Resiliency Mitigations

(Maryland Ballroom ‘F’ - 2:45PM – 3:25PM)

• A Framework for Cyber Security Performance

(Maryland Ballroom ‘A’ - 3:30PM – 4:10PM)

• Implementing Secure Systems using the PMBOK and NIST Cybersecurity 

Framework and Baldrige Excellence Tool

(Maryland Ballroom ‘B’ - 3:30PM – 4:10PM)

• Enterprise Risk Mitigation Using the NIST CSF and Cyber Analytics

(Maryland Ballroom ‘C’ - 3:30PM – 4:10PM)

• The ISF Standard of Good Practice and the NIST Cybersecurity Framework

(Maryland Ballroom ‘D’ - 3:30PM – 4:10PM)

• Automated Cyber Hardening

(Maryland Ballroom ‘E’ - 3:30PM – 4:10PM)

• A Structured Approach for Privacy Risk Assessments for Federal Organizations

(Maryland Ballroom ‘F’ - 3:30PM – 4:10PM)

• How To: Develop a Cybersecurity Framework Profile

(Kent - 3:30PM – 4:10PM)

• Role-Based Risk Management Framework – RMF and NICE Framework 

Convergence

(Maryland Ballroom ‘A’ - 4:15PM – 5:00PM)

• How Tradeoffs Increase Cyber Supply Chain Risk

(Maryland Ballroom ‘B’ - 4:15PM – 5:00PM)

• Using the NIST Framework to Design and Implement Risk-based Cybersecurity 

Management in a Global Conglomerate

(Maryland Ballroom ‘C’ - 4:15PM – 5:00PM)

• Measuring the Cybersecurity Risk of Software-Intensive Systems

(Maryland Ballroom ‘D’ - 4:15PM – 5:00PM)

• NIST Cybersecurity Guidance as Systems Engineering Construct and not DIACAP 

by Another Name

(Maryland Ballroom ‘E’ - 4:15PM – 5:00PM)

• Achieve Cybersecurity Excellence

(Maryland Ballroom ‘F’ - 4:15PM – 5:00PM)

• The Transformation of Global Value Chains: Hardening the Weakest Link

(Kent - 4:15PM – 5:00PM)

5:00pm Adjourn
Final Version – 07 November 2018

5

This draft agenda is subject to change and will be updated as 

schedules and session titles are confirmed.

Friday, November 9, 2018 

7:30am Registrant Check-In

8:30am Keynote: Mr. Bruce Potter on Making Risk Management Real

9:30am Break

10:00am Morning Sessions VI

• Reducing Cybersecurity Risk Exposure in Medical Devices

(Maryland Ballroom ‘A’ - 10:00AM – 10:55AM)

• Enhancing Cybersecurity Risk Management Across the Federal Enterprise

(Maryland Ballroom ‘B’ - 10:00AM – 10:55AM)

• Lock Down Your Login

(Maryland Ballroom ‘C’ - 10:00AM – 10:55AM)

• University of Kansas Medical Center – Cybersecurity Framework Implementation 

Success Story

(Maryland Ballroom ‘D’ - 10:00AM – 10:55AM)

• Tips & Tricks for Small Business Cybersecurity Framework Implementation

(Maryland Ballroom ‘E’ - 10:00AM – 10:55AM)

• Towards Autonomic Security Management

(Maryland Ballroom ‘F’ - 10:00AM – 10:55AM)

• Building Security In: How the RMF Impacts Legacy Practices and System 

Modernizations

(Kent - 10:00AM – 10:55AM)

• Proactive Cybersecurity Through Cross-domain Intelligence

(Maryland Ballroom ‘A’ - 11:00AM – 11:40AM)

• Deriving Business Insight from CSF Findings

(Maryland Ballroom ‘B’ - 11:00AM – 11:40AM)

• The Digital Fast Lane – Helping NonProfits Keep Up

(Maryland Ballroom ‘C’ - 11:00AM – 11:40AM)

• State Supporting in Cybersecurity for SMB Organizations

(Maryland Ballroom ‘D’ - 11:00AM – 11:40AM)

• Helping Communities Utilize the NIST Cybersecurity Framework ISAOs as a 

Catalyst for Developing Community Cybersecurity Programs

(Maryland Ballroom ‘E’ - 11:00AM – 11:40AM)

• Cyber Risk – Through the Shareholder Lens

(Maryland Ballroom ‘F’ - 11:00AM – 11:40AM)

• Cybersecurity in Small and Medium-sized Businesses

(Maryland Ballroom ‘A’ - 11:45AM – 12:30PM)

• Cybervets: Leveraging Veterans to Build the Cybersecurity Workforce

(Maryland Ballroom ‘B’ - 11:45AM – 12:30PM)

• Demystifying ICS Cyber Risk

(Maryland Ballroom ‘C’ - 11:45AM – 12:30PM)

• Implementing Cybersecurity Framework

(Maryland Ballroom ‘D’ - 11:45AM – 12:30PM)

• Risk is Money

(Maryland Ballroom ‘F’ - 11:45AM – 12:30PM)

12:30pm Lunch – to include Lunch-and-Learn sessions
Final Version – 07 November 2018

6

This draft agenda is subject to change and will be updated as 

schedules and session titles are confirmed.

1:45pm Afternoon Sessions VII

• IoT Security – Past, Present and Future

(Maryland Ballroom ‘A’ - 1:45PM – 2:45PM)

• A Practical Approach to IT Security for Small and Medium-sized Businesses Based 

on the NIST Cybersecurity Framework

(Maryland Ballroom ‘B’ - 1:45PM – 2:45PM)

• Using the Framework as an Umbrella for Your Cloud

(Maryland Ballroom ‘C’ - 1:45PM – 2:45PM)

• Data Driven Breach Response Planning

(Maryland Ballroom ‘D’ - 1:45PM – 2:45PM)

• Spanning the Org Chart from Metrics to Risk

(Maryland Ballroom ‘E’ - 1:45PM – 2:45PM)

• Data-Driven Risk-based Decision Making

(Maryland Ballroom ‘F’ - 1:45PM – 2:45PM)

2:45pm Adjourn