1

2

3

4

5

6

7

8

9

10

11

12

13

NIST CYBERSECURITY WHITE PAPER (DRAFT) CSRC.NIST.GOV 

Cybersecurity Profile for the 

Responsible Use of Positioning,

Navigation, and Timing (PNT) Services 

DRAFT Annotated Outline 

August 31, 2020 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

NIST CYBERSECURITY WHITE PAPER POSITIONING, NAVIGATION AND TIMING (PNT) PROFILE 

AUGUST 31, 2020 (DRAFT ANNOTATED OUTLINE) 

14 NOTES TO REVIEWERS: 

15 NIST’s objective is to deliver a PNT Cybersecurity Profile (hereafter, the Profile) that can be 

16 adapted to the needs of PNT service users in the public and private sectors. Furthermore, through 

17 the Profile, NIST seeks to increase organizational awareness of the extent to which they use and 

18 rely on PNT services. 

19 Through the Profile development process, NIST will engage the public and private sectors on 

20 multiple occasions to include a request for information, participation in workshops, solicitation of 

21 feedback on this annotated outline, and public review and comment on the draft Profile. The Profile 

22 development process is iterative and, in the end state, will identify and promote the responsible 

23 use of PNT services from a cybersecurity point of view. This Annotated Outline is designed to 

24 engage public and private sector stakeholders on preliminary NIST thinking before publishing a 

25 draft “Cybersecurity Profile for the Responsible Use of Positioning, Navigation, and Timing (PNT) 

26 Services” for public comment in October 2020. 

27 NIST seeks insight and feedback on this Annotated Outline to improve the PNT cybersecurity 

28 profile, which is scheduled for publication in February 2021. Areas needing more input include 

29 feedback on the description of systems that use PNT services and the set of standards, 

30 guidelines, and practices addressing systems that use PNT services. NIST welcomes suggestions 

31 in these areas in addition to comments on the content within this Annotated Outline. 

32 

Editor’s Note: Italicized text within a lift out box discusses the content to include within that 

section. In addition, some sections include preliminary, non-italicized text to provide the 

33 

stakeholder reviewers sample text of what the actual profile may contain. 

3 
 

 

 

NIST CYBERSECURITY WHITE PAPER POSITIONING, NAVIGATION AND TIMING (PNT) PROFILE 

AUGUST 31, 2020 (DRAFT ANNOTATED OUTLINE) 

34 

35 

36 

Editor’s Note: This section contains a concise summary of the Profile. 

Executive Summary 

4 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

40

45

50

55

60

NIST CYBERSECURITY WHITE PAPER POSITIONING, NAVIGATION AND TIMING (PNT) PROFILE 

AUGUST 31, 2020 (DRAFT ANNOTATED OUTLINE) 

37 Table of Contents 

Editor’s Note: NIST suggests the Profile have these major headings in its Table of Contents: 38 

39 

Executive Summary .......................................................................................................4 

41 1 PNT Cybersecurity Profile: Introduction...............................................................6 

42 1.1 Purpose and Objectives................................................................................... 6 

43 1.2 Scope............................................................................................................... 7 

44 1.3 Audience.......................................................................................................... 8 

2 How to Use the PNT Cybersecurity Profile...........................................................8 

46 3 PNT Cybersecurity Profile - Overview ................................................................10 

47 3.1 Risk Management Overview.......................................................................... 10 

48 3.2 Capabilities Overview .................................................................................... 11 

49 3.2.1 Policy/Procedural (Tools) ....................................................................11 

3.2.2 Security Technical Capabilities Overview ...........................................12 

51 3.3 The PNT Cybersecurity Profile ...................................................................... 12 

52 3.3.1 Protection of PNT Services: ................................................................13 

53 3.3.2 Detection of Disruptions to PNT Services: ..........................................14 

54 3.3.3 Resilience of PNT Services:................................................................14 

4 Conclusion.............................................................................................................15 

56 Appendix A— Acronyms and Abbreviations.............................................................16 

57 Appendix B— Glossary ...............................................................................................16 

58 Appendix C— References ...........................................................................................16 

59 Appendix D— NIST Cybersecurity Framework .........................................................16 

61 

62 

5 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

NIST CYBERSECURITY WHITE PAPER POSITIONING, NAVIGATION AND TIMING (PNT) PROFILE 

AUGUST 31, 2020 (DRAFT ANNOTATED OUTLINE) 

63 1 PNT Cybersecurity Profile – Introduction 

Editor’s Note: This section will summarize the purpose, objectives, and scope of the Profile for 

organizations that use PNT services. 

64 

65 Executive Order 13905 (EO 13905), “Strengthening National Resilience through Responsible 

66 Use of Positioning, Navigation, and Timing Services,” was issued on February 12, 2020 [EO 

67 13905]. It seeks to help organizations protect themselves from the disruption or manipulation of 

68 PNT services, particularly those organizations whose PNT services are vital to the functioning 

69 of U.S. critical infrastructure1 and related technology-based industries. The Executive Order 

70 (EO) directs the Department of Commerce to develop a PNT Profile for users of PNT services. 

71 The PNT cybersecurity profile (hereafter, the Profile) is intended for a general audience and is 

72 broadly applicable. The Profile applies to: 

73 • Organizations that have already adopted the NIST Cybersecurity Framework (CSF)2 to 

74 help identify, assess, and manage cybersecurity risks [NIST CSF]; 

75 • Organizations that are familiar with the CSF and want to improve their cybersecurity 

76 postures; and 

77 • Organizations that are unfamiliar with the CSF but need to implement cybersecurity risk 

78 management frameworks for the responsible use of their PNT services. 

79 1.1 Purpose and Objectives 

Editor’s Note: This section will provide a concise purpose statement and a subset of the 

activities required to achieve the purpose. 

80 

81 The purpose of the Profile, when used as part of a risk management program, is to help 

82 organizations manage cybersecurity risks to systems, networks, and assets that use PNT 

83 services. The Profile provides guidance for establishing risk management approaches for desired 

84 outcomes as driven by an organization’s business and operational needs. The Profile is not 

85 intended to serve as a solution or compliance checklist that would guarantee the responsible use 

86 of PNT services. 

1 Critical infrastructure, as defined in the Executive order, means “systems and assets, whether physical or virtual, so vital to the 

United States that the incapacity or destruction of such systems and assets would have a debilitating impact on national 

security, national economic security, national public health or safety, or on any combination of those matters” [EO 13905]. 2 Efforts under the PNT EO build on a previous EO, issued on February 12, 2013, that called for the strengthening of national 

critical and economic infrastructure against cybersecurity threats. In that EO, the President directed NIST to lead the 

coordination of a Cybersecurity Framework (CSF) that would reduce cybersecurity risks to critical infrastructures that rely 

on private sector input and existing standards, guidelines, and practices [EO 13636]. 

6 
 

 

 

 

 

 

 

 

 

90

95

100

105

110

115

NIST CYBERSECURITY WHITE PAPER POSITIONING, NAVIGATION AND TIMING (PNT) PROFILE 

AUGUST 31, 2020 (DRAFT ANNOTATED OUTLINE) 

87 Use of the PNT Profile will help organizations to: 

88 • Identify systems that use PNT services; 

89 • Identify sources of PNT data; 

• Protect PNT services by adhering to basic principles of responsible use; 

91 • Detect cybersecurity-related disturbances and/or manipulation of PNT services and data; 

92 • Address cybersecurity risk in their management and use of PNT services and data; 

93 • Identify common threats to PNT services, [user] equipment, and data; and 

94 • Respond to PNT service or data anomalies in a timely, effective, and resilient manner. 

1.2 Scope 

Editor’s Note: This section will highlight that the scope is for recipients of PNT services, not 

the service providers. 

96 

97 The Profile’s scope includes systems that use PNT services, including those systems that 

98 consume and then rebroadcast PNT data for consumption by other organizational entities where 

99 a PNT Service is defined as “any system, network, or capability that provides a reference to 

calculate or augment the calculation of longitude, latitude, altitude, or transmission of time or 

101 frequency data, or any combination thereof” [EO 13905]. The Profile’s scope does not include 

102 source PNT signal generators and providers (e.g., a GNSS control segment or space segment as 

103 shown in Figure 1). PNT Service providers outside of an organization’s control or boundary are 

104 not in the scope of this effort. 

PNT Services interface with user equipment (UE) to produce PNT data, which can take the form 

106 of position, velocity, or timing information. The responsible use of PNT data requires the 

107 stakeholder to identify the dependencies of PNT data (within their components, sub-systems, 

108 and systems), evaluate the impact should the loss of PNT data be realized, and manage the 

109 residual risk. 

This Profile defines the responsible use of PNT services as it relates to cybersecurity. In this 

111 case, responsible use by organizations includes the incorporation of: 

112 • Cybersecurity risk-informed management of PNT services, 

113 • Cybersecurity risk-based approaches that minimize the potential effects of cybersecurity 

114 disruption or manipulation of PNT services and data, and 

• Deliberate planning and action regarding the secure management of PNT services. 

7 
 

 

 

 

 

 

NIST CYBERSECURITY WHITE PAPER POSITIONING, NAVIGATION AND TIMING (PNT) PROFILE 

AUGUST 31, 2020 (DRAFT ANNOTATED OUTLINE) 

116 

117 Figure 1. The Scope for the PNT Cybersecurity Profile is limited to the user segment only. The provider (in 

118 this example, the GPS space and ground segments) is not part of this Profile. 

119 1.3 Audience 

Editor’s Note: This section will identify parties that will benefit from the Profile. 120 

121 This document should be used by those involved in overseeing, developing, implementing, and 

122 managing the cybersecurity of systems using PNT services. This document’s intended audience 

123 includes: 

124 • Public and private organizations that use PNT services; 

125 • Managers responsible for the use of PNT services; 

126 • Risk managers, cybersecurity professionals, and others with a role in cybersecurity risk 

127 management for systems that use PNT services; 

128 • Procurement officials responsible for the acquisition of PNT services; 

129 • Mission and business process owners responsible for achieving operational outcomes 

130 dependent on PNT services; and 

131 • Researchers and analysts who study the unique cybersecurity needs of PNT services. 

132 2 How to Use the PNT Cybersecurity Profile 

Editor’s Note: This section provides guidance on what can be accomplished via the profile. 133 

8 
 

 

 

 

 

 

NIST CYBERSECURITY WHITE PAPER POSITIONING, NAVIGATION AND TIMING (PNT) PROFILE 

AUGUST 31, 2020 (DRAFT ANNOTATED OUTLINE) 

134 The Profile will help organizations develop cybersecurity PNT profiles that are appropriate for 

135 their respective sectors. The Profile will help organizations determine cybersecurity risks based 

136 on their assessments of the potential impacts of manipulation or the disruption of PNT services 

137 to business and operational objectives. The Profile is intended to help users of PNT services 

138 prioritize necessary cybersecurity activities based on business objectives. The Profile may be a 

139 tool to help organizations identify areas where standards, practices, and other guidance could 

140 help manage the risk of cybersecurity threats to systems that use PNT services. 

141 This Profile is intended to assist an organization’s risk management effort. The Profile does not 

142 prescribe regulations or mandatory practices, nor does it carry any statutory authority. 

143 The development of a Profile by an organization is a multi‐step process, including a risk 

144 assessment in which organizations consider the following: 

145 • What processes and assets require PNT data (direct recipient of PNT services)? 

146 • What processes and assets are dependent recipients of PNT data (i.e., identify secondary 

147 effects)? 

148 • What is the impact to the organization should a process or asset be lost or degraded? 

149 • What processes and assets are vulnerable? 

150 • What safeguards are available? 

151 • What techniques can be used to identify threats of concern? 

152 • What techniques can be used to respond to threats of concern? 

153 • What techniques can be used to recover pre-event capabilities? 

9 
 

 

 

 

 

 

 

 

 

 

 

 

 

NIST CYBERSECURITY WHITE PAPER POSITIONING, NAVIGATION AND TIMING (PNT) PROFILE 

AUGUST 31, 2020 (DRAFT ANNOTATED OUTLINE) 

154 3 PNT Cybersecurity Profile – Overview 

Editor’s Note: This section contains an overview of envisioned Profile content, a short 

description of the kinds of PNT data users that are covered by the Profile, and an overview of 

PNT services. The Profile provides information on risk management, capabilities, and mapping 

to the NIST Cybersecurity Framework to assist with specific implementation of PNT 

cybersecurity. The Profile will include informative references (including existing standards, 

guidelines, and practices) and a glossary of terms. 

155 

156 3.1 Risk Management Overview 

Editor’s Note: This section reviews the risk management process. 157 

158 Risk management is the ongoing process of identifying, assessing, and responding to risk as 

159 related to an organization’s mission objectives. To manage risk, organizations should understand 

160 the likelihood that an event will occur as well as its potential impacts. With this information, 

161 organizations can determine the acceptable level of risk to the PNT data and services they use to 

162 achieve their mission objectives. 

163 As an organization analyzes its mission objectives as they relate to reliance on or use of PNT 

164 data, there are a series of guiding questions that inform the process. They include: 

165 • What are the threats to achieving mission objectives? 

166 • What damages can result when those mission objectives are disrupted? 

167 • What are the most important assets for a given mission objective? 

168 • Where does physical infrastructure affect cybersecurity infrastructure and vice versa? 

169 An organization should also be aware of statutory and policy requirements that may have a security 

170 or safety dimension. These can be affected by cybersecurity risk or create risks downstream. 

171 The PNT Profile supports and is informed by cybersecurity risk management processes. Using 

172 the Profile, organizations can make more informed decisions to select and prioritize 

173 cybersecurity activities and expenditures that help identify systems dependent on PNT, identify 

174 appropriate PNT sources, detect disturbances and manipulation of PNT services, manage the risk 

175 to these systems, and ensure resiliency through diversity. For critical infrastructures, PNT 

176 sources and distribution networks should be architected with multiple, independent sources; 

177 communication paths; and communication mediums. The Profile provides a starting point from 

178 which organizations can customize—based on business need and risk assessment—to develop 

179 the most appropriate processes to manage cybersecurity risk to their PNT services and data 

180 essential for the correct behavior of critical infrastructure applications. 

10 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

NIST CYBERSECURITY WHITE PAPER POSITIONING, NAVIGATION AND TIMING (PNT) PROFILE 

AUGUST 31, 2020 (DRAFT ANNOTATED OUTLINE) 

181 Organizations can use the PNT Profile in conjunction with existing cybersecurity risk management 

182 processes. Examples of cybersecurity risk management processes include International 

183 Organization for Standardization (ISO) 31000:2018, ISO/International Electrotechnical 

184 Commission (IEC) 27005:2018, and NIST Special Publication 800-39. A full list of helpful 

185 resources will be listed in an Annex of the Cybersecurity PNT Profile. 

186 3.2 Capabilities Overview 

Editor’s Note: The section describes some of the capabilities and controls that impact the 

organization’s ability to manage residual risk (in the context of PNT degradation or outage). 

187 

188 3.2.1 Policies and Procedures 

Editor’s Note: This section will discuss policies and procedures that organizations should 

consider when managing cybersecurity risks to systems, networks, and assets that use PNT 

services. 189 

190 Historically, the perceived risk to PNT services has been low while the reliance on PNT services 

191 has increased. Responsible use of PNT should include policies and procedures that map to threats 

192 to PNT services and the impacts should the threats be realized. Threat modeling may need to 

193 consider alternative PNT services (other than GNSS.) The impact to the organization may include 

194 secondary effects, such as a severe PNT data disruption that impacts a sector that provides services 

195 required by other enterprises. 

196 Cybersecurity policies and procedures will vary in accordance with each organization’s tolerance 

197 of a PNT data loss and their required PNT data precision. Though it does not add value to burden 

198 an organization with excessive requirements, there should be a level of consistency within a 

199 sector to enable collaborative efforts, such as the sharing of PNT interference events. 

200 Consistency also facilitates the acceptance or rejection of inherited risk and compatible tools; 

201 techniques and processes enable coordinated responses. 

202 Multiple professional organizations and sector-specific stakeholders have defined PNT data 

203 security requirements and practices (references available in Appendix C) to inform PNT 

204 cybersecurity policies and procedures. In some cases, accepting degraded PNT service within a 

205 bounded uncertainty can be tolerated. Other organizations may choose to secure PNT data, provide 

206 alternative PNT services as a backup, or provide integrated PNT data from truly independent PNT 

207 service providers. 

208 PNT policies and procedures should be reflected in an organization’s continuity of operations plan 

209 (COOP). If the COOP identifies the use of legacy (or alternative) PNT, then the legacy procedures 

210 need to be exercised and updated in accordance with normal COOP procedures. 

11 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

NIST CYBERSECURITY WHITE PAPER POSITIONING, NAVIGATION AND TIMING (PNT) PROFILE 

AUGUST 31, 2020 (DRAFT ANNOTATED OUTLINE) 

211 3.2.2 Security Technical Capabilities Overview 

Editor’s Note: This section will discuss the capabilities of PNT services upon which an 

organization’s systems rely, a discussion of potential threats that impact those systems, and a 

212 

list of security controls that could potentially mitigate the risks. 

213 Responsible use of PNT services requires organizational planning that includes an adequate 

214 understanding of the technical capabilities needed to ensure appropriate levels of PNT data 

215 precision, availability, and integrity. 

216 When considering the technical capabilities as they pertain to PNT resilience, users must consider 

217 certain technical challenges that a PNT service may encounter. PNT data may need to transfer time 

218 and frequency over long distances (for a global enterprise) while retaining accuracy (within a 

219 bounded uncertainty, 100 ns range for some applications) to Coordinated Universal Time (UTC) 

220 and availability. Should alternative PNT service providers be deemed necessary, the compatibility 

221 of implementation must be considered when investigating alternative PNT service providers. For 

222 example, while GPS notifies receivers of impending leap seconds via an announcement six weeks 

223 in advance, other PNT services only have a 12-hour advance notice. Other implementations adjust 

224 for leap seconds by introducing a frequency adjustment over an extended time interval in order to 

225 ensure that the clock continues monotonically increasing through a leap second event. However, 

226 such a frequency adjustment introduces both a time and frequency error relative to the legal UTC 

227 time [https://www.nist.gov/pml/time-and-frequency-division/services/internet-time-service-its]. 

228 GPS signals travel by line of sight, and receivers typically require at least four satellites to be in 

229 view to provide accurate position, velocity, and time (PVT) solutions. Urban canyons, mountains, 

230 trees, and atmospheric variabilities can contribute to errors in PVT solutions. 

231 It is beneficial to consider that the analysis of potential integration of multiple and independent 

232 technologies can facilitate the detection of anomalies, provide additional precision of PNT data, 

233 and ultimately contribute to a more resilient system in the event of a disruption. 

234 3.3 The PNT Cybersecurity Profile 

Editor’s Note: This section will contain the PNT Cybersecurity Profile, which maps the 

functions, categories, and sub-categories of the CSF with informative references. This section 

contains information on how users of the profile can mitigate risks that they have deemed 

necessary to address based on their assessment of the PNT services they are using. This is not 

an exhaustive list, and the actual selection of controls (if any) must be based on a cost-benefit 

analysis that is consistent with the risk. NIST welcomes input on available standards, 

guidelines, and practices that can be considered for inclusion as informative references in the 

Profile. 

235 

236 

12 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

NIST CYBERSECURITY WHITE PAPER POSITIONING, NAVIGATION AND TIMING (PNT) PROFILE 

AUGUST 31, 2020 (DRAFT ANNOTATED OUTLINE) 

237 3.3.1 Protection of PNT Services 

Editor’s Note: This section contains examples of various means to protect PNT services. This 

is not an exhaustive list and will not necessarily provide the appropriate level of assurance for 

a particular cyber ecosystem. The actual selection of mitigation techniques and controls (if 

any) must be based on a cost-benefit analysis that is consistent with the risk. The following 

sections identify, at a high level, the elements to consider in order to ensure the responsible use 

of PNT services. The PNT profile will incorporate these elements into actionable guidance (risk 

and threat mitigation techniques and controls) that organizations can implement to protect the 

PNT components under their purview. 

238 

239 The following list contains cybersecurity considerations that are applicable to GPS-based devices, 

240 signals, data, hardware and software: 

241 • Encrypted GPS signals for civilian use and GPS firewall technology should be 

242 considered. 

243 • Assured mechanisms (e.g., signed, verified code) for GPS software and firmware 

244 upgrades on trusted platforms need to be in place to ensure the integrity of PNT data 

245 processing. 

246 • Modeling and simulation—including simulated disruptions, variations in leap second 

247 implementations, and other implementation details—should be performed to exercise, 

248 test, and update these technical protections. If at all practical, open test plans and inter249 sector collaboration should be encouraged so that sectors are aware of and accommodate 

250 potential cross-sector impacts. 

251 • GPS signals may be hardened using directional antennas in conjunction with accurate 

252 tracking of individual satellites or shielded antennas that block terrestrial signals. 

253 Characteristics. Organizations should identify the characteristics of the user’s PNT system 

254 infrastructure and individual devices that provide, communicate, or consume PNT data. 

255 Characteristics of interest can include calibration to a traceable reference, PNT data stability over 

256 time, communication latency and jitter, and device response behavior at start-up under steady 

257 state conditions, with environmental stressors or disruptions, and typical observed PNT data 

258 characteristics. 

259 Organizations should identify the environmental surroundings and conditions that the PNT 

260 system will be exposed to while maintaining the specified requirements. For example: 

261 • Will there be sources of RF, multi-path interference? 

262 • Will there be large temperature variations or extreme temperatures? 

263 • Will there be sources of vibrations (e.g., along a busy road or in earthquake prone area)? 

264 

13 
 

 

 

 

 

 

 

 

 

 

 

 

 

265

270

275

280

285

290

NIST CYBERSECURITY WHITE PAPER POSITIONING, NAVIGATION AND TIMING (PNT) PROFILE 

AUGUST 31, 2020 (DRAFT ANNOTATED OUTLINE) 

3.3.2 Detection of Disruptions to PNT Services 

Editor’s Note: This section contains ways to detect disruptions to PNT services. 266 

267 System verification and validation policy and procedures. Organizations should identify steady 

268 state and transient test cases, test plans, and test schedules as an end user, applicable to the 

269 industry supply chain, to serve as a basis for verifying and validating PNT data users in order to 

manage assessed risks associated with PNT disruptions. 

271 Spatial diversity and shielded antennas can be used to detect anomalies and possible spoofing. 

272 Other approaches include the use of diverse algorithms, cross-checking GPS solutions, verifying 

273 GPS data with other GNSS for consistency, and examining alternative constellations (low-earth 

274 orbit satellites, such as iridium) for sources of PNT. 

It is beneficial to consider that the analysis and potential fusion of multiple and independent 

276 technologies can facilitate the detection of anomalies, improve the precision of PNT data, and 

277 ultimately contribute to a more resilient system in the event of a disruption. 

278 There are numerous vendor products that detect anomalies using techniques such as analyzing the 

279 signal-to-noise ratio (SNR) or the doppler shift (on a per space vehicle basis). 

3.3.3 Resilience of PNT Services 

Editor’s Note: This section contains ways to operate through periods of PNT service outages 

or degradations. 

281 

282 The ability to provide useable PNT data despite a compromise can be accomplished with 

283 technologies such as: 

284 • Atomic clocks (with a known holdover) 

• PNT diversity and segmentation 

286 • Alternative signals, such as other satellite constellations 

287 • Network-based solutions 

288 • Terrestrial RF sources 

289 • Signals of opportunity (such as cellular) 

14 
 

 

 

291 

292 

NIST CYBERSECURITY WHITE PAPER POSITIONING, NAVIGATION AND TIMING (PNT) PROFILE 

AUGUST 31, 2020 (DRAFT ANNOTATED OUTLINE) 

4 Conclusion 

Editor’s Note: This section provides a brief conclusion to summarize the major points of the 

publication as well as discuss potential next steps and future work plans (e.g., communicating 

that this is a living document that will evolve over time). 

15 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

295

300

305

310

315

NIST CYBERSECURITY WHITE PAPER 

AUGUST 31, 2020 

POSITIONING, NAVIGATION AND TIMING (PNT) PROFILE 

(DRAFT ANNOTATED OUTLINE) 

293 

294 

Appendix A—Acronyms and Abbreviations 

Appendix B—Glossary 

296 

297 

298 ... 

299 [EO 13636] Executive Order 13636 (2013) Improving Critical Infrastructure Cybersecurity. 

(The White House, Washington, DC), DCPD-201300091, February 12, 2013. 

301 https://www.govinfo.gov/app/details/DCPD-201300091 

302 [EO 13905] Executive Order 13905 (2020) Strengthening National Resilience Through 

303 Responsible Use of Positioning, Navigation, and Timing Services. (The White 

304 House, Washington, DC), February 12, 2020. 

https://www.govinfo.gov/app/details/FR-2020-02-18/2020-03337 

306 [NIST CSF] National Institute of Standards and Technology (2018) Framework for Improving 

307 Critical Infrastructure Cybersecurity, Version 1.1. (National Institute of Standards 

308 and Technology, Gaithersburg, MD). 

309 https://doi.org/10.6028/NIST.CSWP.04162018 

... 

311 

Editor’s Note: Appendix D summarizes the NIST Cybersecurity Framework (CSF), which 

provides guidance based on existing standards, guidelines, and practices for organizations to 

better manage and reduce cybersecurity risk. 

312 

313 The NIST Cybersecurity Framework (CSF) provides guidance based on existing standards, 

314 guidelines, and practices to help organizations better manage and reduce cybersecurity risk. One 

component of the CSF – the Framework Core – describes a set of cybersecurity activities and 

316 desired outcomes determined to be essential across critical infrastructure sectors. The Framework 

317 Core consists of five concurrent and continuous Functions: Identify, Protect, Detect, Respond, and 

318 Recover. When considered together, these Functions provide a high-level, strategic view of the 

319 organization’s management of cybersecurity risk. The Framework Core then identifies underlying 

320 key Categories and Subcategories for each Function and matches them with example Informative 

321 References, such as existing standards, guidelines, and practices for each Subcategory. The five 

322 Framework Functions can be performed concurrently and continuously to form an operational 

323 culture that addresses dynamic cybersecurity risk. 

Appendix C—References 

Appendix D—NIST Cybersecurity Framework 

16 
 

 

 

 

 

 

 

 

 

 

 

 

NIST CYBERSECURITY WHITE PAPER POSITIONING, NAVIGATION AND TIMING (PNT) PROFILE 

AUGUST 31, 2020 (DRAFT ANNOTATED OUTLINE) 

324 

325 

326 

Table 1: Function and Category Unique Identifiers from NIST Cybersecurity Framework 

Version 1.1 [NIST CSF] 

Function 

Unique 

Identifier 

Function Category 

Unique 

Identifier 

Category 

ID Identify ID.AM Asset Management 

ID.BE Business Environment 

ID.GV Governance 

ID.RA Risk Assessment 

ID.RM Risk Management Strategy 

ID.SC Supply Chain Risk Management 

PR Protect PR.AC Identity Management and Access Control 

PR.AT Awareness and Training 

PR.DS Data Security 

PR.IP Information Protection Processes and Procedures 

PR.MA Maintenance 

PR.PT Protective Technology 

DE Detect DE.AE Anomalies and Events 

DE.CM Security Continuous Monitoring 

DE.DP Detection Processes 

RS Respond RS.RP Response Planning 

RS.CO Communications 

RS.AN Analysis 

RS.MI Mitigation 

RS.IM Improvements 

RC Recover RC.RP Recovery Planning 

RC.IM Improvements 

RC.CO Communications 

327 

328 The five functions of the Framework Core are: 

329 1. Identify – Develop organizational understanding to manage cybersecurity risks to systems, 

330 assets, data, and capabilities. The activities in the Identify Function are foundational to the 

331 effective use of the Framework. Understanding the business context, the resources that 

332 support critical functions, and the related cybersecurity risks enables an organization to 

17 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

335

340

345

350

355

NIST CYBERSECURITY WHITE PAPER POSITIONING, NAVIGATION AND TIMING (PNT) PROFILE 

AUGUST 31, 2020 (DRAFT ANNOTATED OUTLINE) 

333 focus and prioritize its efforts consistent with its risk management strategy and business 

334 needs. Examples of outcome Categories within this Function include Asset Management, 

Business Environment, Governance, Risk Assessment, and Risk Management Strategy. 

336 2. Protect – Develop and implement the appropriate safeguards to ensure the delivery of 

337 critical infrastructure services. The activities in the Protect Function support the ability to 

338 limit or contain the impacts of a potential cybersecurity event. Examples of outcome 

339 Categories within this Function include Access Control, Awareness and Training, Data 

Security, Information Protection Processes and Procedures, Maintenance, and Protective 

341 Technology. 

342 3. Detect – Develop and implement the appropriate activities to identify the occurrence of a 

343 cybersecurity event. The activities in the Detect Function enable the timely discovery of 

344 cybersecurity events. Examples of outcome Categories within this Function include 

Anomalies and Events, Security Continuous Monitoring, and Detection Processes. 

346 4. Respond – Develop and implement the appropriate activities to respond to a detected 

347 cybersecurity event. The activities in the Respond Function support the ability to contain 

348 the impacts of a potential cybersecurity event. Examples of outcome Categories within this 

349 Function include Response Planning, Communications, Analysis, Mitigation, and 

Improvements. 

351 5. Recover – Develop and implement the appropriate activities to maintain plans for 

352 resilience and restore any capabilities or services that were impaired due to a cybersecurity 

353 event. The activities in the Recover Function support timely recovery to normal operations 

354 to reduce the impacts of a cybersecurity event. Examples of outcome Categories within 

this Function include Recovery Planning, Improvements, and Communications. 

356 

357 

18