Welcome

Framework for Improving Critical 

Infrastructure Cybersecurity

May 2017

cyberframework@nist.gov
Conference Resources and Media

nist.gov/cyberframework

#CyberFramework

NIST welcomes press and bloggers
High-Level Agenda

Day 1 Day 2

Panels and Presentations

8:30AM – 12:30PM

Red Auditorium

Break – 10:30-10:45AM

Working Session III

9AM-12:30PM

multiple rooms

Break – 10:30-11AM

Lunch

12:30 – 1:45PM

Lunch

12:30-1:30PM

Working Session I

1:45-3:15PM

multiple rooms

Readout Panels

1:30-3:30PM

Red Auditorium

Break

3:15-3:30PM 

Working Session II

3:30-5PM

multiple rooms

More detailed agenda available 

at registration desk and 

nist.gov/cyberframework

Rooms for Working Sessions are 

marked with signs
Charter

Improving Critical Infrastructure Cybersecurity

February 12, 2013

“It is the policy of the United States to 

enhance the security and resilience of 

the Nation’s critical infrastructure and 

to maintain a cyber environment that 

encourages efficiency, innovation, and 

economic prosperity while promoting 

safety, security, business 

confidentiality, privacy, and civil 

liberties” 

Executive Order 13636

4

December 18, 2014

Amends the National Institute of Standards and 

Technology Act (15 U.S.C. 272(c)) to say:

“...on an ongoing basis, facilitate and 

support the development of a 

voluntary, consensus-based, 

industry-led set of standards, 

guidelines, best practices, 

methodologies, procedures, and 

processes to cost-effectively reduce 

cyber risks to critical infrastructure”

Cybersecurity Enhancement Act of 

2014 (P.L. 113-274)
A Common Language

Foundational for Integrated Teams

5

(v) “Effective risk management 

requires agency heads to lead 

integrated teams of senior executives 

with expertise in IT, security, 

budgeting, acquisition, law, privacy, 

and human resources.”

Strengthening the Cybersecurity of Federal 

Networks and Critical Infrastructure
A Common Language

Foundational for Integrated Teams

ID PR DE RS RC

6

ID

PR

DE

RS

RC

Cybersecurity

Professionals

Highly technical and 

specialized language

Senior

Executives

IT, Contracts, 

Marketing, 

Business

Professionals

(v) “Effective risk management 

requires agency heads to lead 

integrated teams of senior executives 

with expertise in IT, security, 

budgeting, acquisition, law, privacy, 

and human resources.”

Strengthening the Cybersecurity of Federal 

Networks and Critical Infrastructure
Cybersecurity Executive Order

Strengthening the Cybersecurity of Federal Networks and Critical Infrastructure

Risk Management:

(ii) “...agency head shall use The Framework” and

“...provide a risk management report within 90 days 

containing a description of the “...agency's action plan 

to implement the Framework.”

11
Cybersecurity Executive Order

Strengthening the Cybersecurity of Federal Networks and Critical Infrastructure

Risk Management:

(iii) Secretary of DHS and the Director of OMB will “determine 

whether the risk mitigation and acceptance choices set 

forth in the reports are appropriate and sufficient to 

manage the cybersecurity risk to the executive branch 

enterprise in the aggregate”

(iv) a plan to: (B.1) “adequately protect the executive branch 

enterprise, should the determination identify insufficiencies”

(B.5) “align these policies, standards, and 

guidelines with the Framework.”

12
Special Publication 800

-39

Level 1

Org

1. Integrate enterprise and cybersecurity 

risk management

Core

Level 2

Mission/ 

Business 

Processes

2. Manage cybersecurity requirements Profile(s)

3. Integrate and align cybersecurity and 

acquisition processes

Profile(s)

4. Evaluate organizational cybersecurity Imp. Tiers

5. Manage the cybersecurity program Profile(s)

6. Maintain a comprehensive 

understanding of cybersecurity risk

supports RMF Authorize

Core

7. Report cybersecurity risks Core

Level 3

System

8. Inform the tailoring process 

supports RMF Implement

Profile(s)

9

Proposed Federal Usage

NIST IR 8170 The Cybersecurity Framework: Implementation Guidance for Federal Agencies
Key Framework Resources

Framework Home Page - nist.gov/cyberframework

12
Key Framework Resources

Framework Home Page - nist.gov/cyberframework

12
Key Framework Resources

Framework Home Page - nist.gov/cyberframework

12
Key Framework Resources

Framework Home Page - nist.gov/cyberframework

12
Huge Cyber Attack Hits 150 Countries

Wanna Cry Ransomware Affects Over 20 UK Hospitals

14