# Cybersecurity Vulnerabilities in Off-Site Construction
## 5 Cybersecurity Frameworks and Management
### National Institute of Standards and Technology Framework  
The enactment of this framework is under the United States-based Cybersecurity Enhancement Act of 2014. Its focus is to provide good performance and cost-effective tactics to aid cyber-physical system stakeholders [56]. This ensures the reliable operation of critical infrastructure to minimize monetary and reputational risks.  
The architecture of this framework is divided into three branches, namely: (1) The framework core--The core's key responsibility is to improve the communication of cybersecurity-related activities and outputs amongst different organizational levels covering management to implementation. (2) Tier implementation--the risks are assessed and managed based on the organization's code of conduct and workflow. (3) The framework profile--areas of improvement are identified, and the mismatch between the current modus operandi and the expected mode of operation is addressed [56]. An array of activities is defined to accomplish specific cybersecurity targets. The core can be divided into the following action points: Identify, Protect, Detect, and Respond.  
**Identify--**The target is to bring an understanding of risk to a system that is vulnerable to cybersecurity breaches. Understanding the business context, resource allocation, and cybersecurity risks helps to focus and prioritize an organization's efforts in management and strategies and operational needs. The expected outcome categories include: Asset supervision; Business setting; Governance; Risk evaluation; and Risk management policy.  
**Protect--**This branch aims to create and apply suitable safeguards to guarantee the delivery of essential services and offers measures to support and mitigate the impacts of a potential cyber breach. The expected outcome categories include: Identity supervision and access management; Awareness and instruction; Information security; Data protection processes and procedures; Maintenance; and Defensive Technology.  
**Detect--**Cybersecurity incidences are identified based on the implemented strategies. This allows for the timely discovery of security breaches. The expected outcome categories include Irregularities and incidents; Security constant monitoring; and Detection procedures.  
**Respond--**The action response and containment of a cyber threat are the primary objectives. The expected outcome categories include Response Scheduling; Communications; Assessment; Mitigation; and Enhancements.  
**Recover--**Appropriate activities are executed to restore any disrupted capabilities and services because of a breach. The expected outcome categories include Recovery planning; Improvements; and Communications. An overlap exists between the Response and Recover operations, thus, making it challenging to implement these measures.  
The successful implementation of this framework helps to identify the existing and target cybersecurity conditions of a system, thereby, paving access to improvement and transparent communication between the stakeholders involved. This framework, as presented, has some limitations in that its implementation is biased toward critical infrastructure negating infrastructure, such as residential properties.  
Furthermore, it lacks efficiency in cybersecurity risks in certain cyber-physical systems, such as BIM and MITBIMP involved in combined design, planning, and construction. One of the primary reasons for the sluggish adoption of IR4 in OSC is the lack of existing and fitting cybersecurity solutions. This proves problematic for the NIST framework to be implemented because its successful implementation is a preexisting system. Its primary focus is to reduce and improve management, which might not fully meet the significant concerns for OSC regarding identifying threats.