U.S. critical infrastructure is made of systems and assets, whether physical or virtual, so vital to the United States that the incapacity or destruction of such systems and assets would have a debilitating impact on national security, economic security, national public health or safety, or any combination of these matters. Critical infrastructure includes, among other things, banking and financing institutions, telecommunications networks, and energy production and transmission facilities, most of which are owned and operated by the private sector. Sector-specific agencies (SSA) are federal departments or agencies with responsibility for providing institutional knowledge and specialized expertise as well as leading, facilitating, or supporting the security and resilience programs and associated activities of their designated critical infrastructure sector in the all-hazards environment. Threats to systems supporting critical infrastructure and federal information systems are evolving and growing. Risks to cyber-based assets can originate from unintentional and intentional threats. Unintentional or non-adversarial threat sources include failures in equipment, software coding errors, or resource depletion, such as accidental actions of employees. They also include natural disasters and failures of critical infrastructure on which the organization depends but are outside of its control. Intentional threats include both targeted and untargeted attacks from a variety of sources, including criminal groups, hackers, disgruntled employees, foreign nations engaged in espionage and information warfare, and terrorists. These threat adversaries vary in terms of the capabilities of the actors, their willingness to act, and their motives, which can include seeking monetary gain or pursuing an economic, political, or military advantage. Table 1 describes the sources of cyber-based threats in more detail. Cyber threat adversaries make use of various techniques, tactics, and practices—or exploits—to adversely affect an organization’s computers, software, or networks, or to intercept or steal valuable or sensitive information. These exploits are carried out through various conduits, including websites, e-mail, wireless and cellular communications, Internet protocols, portable media, and social media. Further, adversaries can leverage common computer software programs, such as Adobe Acrobat and Microsoft Office, to deliver a threat by embedding exploits within software files that can be activated when a user opens a file within its corresponding program. Table 2 provides descriptions of common exploits or techniques, tactics, and practices used by cyber adversaries. Because the private sector owns the majority of the nation’s critical infrastructure—such as banking and financial institutions, commercial facilities, and energy production and transmission facilities—it is vital that the public and private sectors work together to protect these assets and systems. Toward this end, federal law and policy assign roles and responsibilities for agencies to assist the private sector in protecting critical infrastructure, including enhancing cybersecurity. Presidential Policy Directive 21 (PPD-21) assigns roles and responsibilities for the critical infrastructure sectors to the SSAs. The directive identified 16 critical infrastructure sectors and designated associated federal SSAs. Table 3 shows the 16 critical infrastructure sectors and the SSA for each sector. PPD-21 identified SSA roles and responsibilities to include collaborating with critical infrastructure owners and operators; independent regulatory agencies; and state, local, tribal, and territorial entities as appropriate, as well as providing, supporting, or facilitating technical assistance and consultations for their respective sectors to identify vulnerabilities and help mitigate incidents, as appropriate. Federal law and policy have also established roles and responsibilities for federal agencies to work with industry to enhance the cybersecurity of the nation’s critical infrastructures. These include Executive Order 13636, the Cybersecurity Enhancement Act of 2014, and the National Infrastructure Protection Plan (NIPP). Executive Order 13636, Improving Critical Infrastructure Cybersecurity, issued in February 2013, outlines an action plan for improving security for critical cyber infrastructure. This includes, among other things, requirements for NIST to develop a voluntary critical infrastructure cybersecurity framework and performance measures. In developing the cybersecurity framework, NIST is to engage in an open public review and comment process. The order also directs SSAs, in consultation with DHS and other interested agencies, to review the cybersecurity framework and if necessary, develop implementation guidance or supplemental materials to address sector-specific risks and operating environments. The Cybersecurity Enhancement Act of 2014, enacted in December 2014, established requirements that are consistent with the order regarding NIST’s development of a cybersecurity framework. NIST’s responsibilities in developing the cybersecurity framework under this law include, among other things, identifying an approach that is performance-based, and cost-effective. In response to Executive Order 13636, NIST issued the Framework for Critical Infrastructure Cybersecurity in February 2014, which is intended to help organizations apply the principles and best practices of risk management to improving the security and resilience of critical infrastructure. The framework proposes a risk-based approach to managing cybersecurity risk and is composed of three parts: the framework core, the framework profile, and the framework implementation tiers. The framework core is a set of cybersecurity activities, outcomes, and informative references that are common across critical infrastructure sectors, which is to provide guidance for developing individual organization profiles. Through the use of profiles, the framework is intended to help organizations align their cybersecurity activities with business requirements, risk tolerances, and resources. The tiers provide a mechanism for organizations to view and understand the characteristics of their approach to managing cybersecurity risk. (Further information on the framework core is provided in app. II.) The NIPP defines the overarching approach for integrating the nation’s critical infrastructure protection and resilience activities into a single national effort. DHS developed the NIPP in collaboration with public- and private-sector owners and operators and federal and nonfederal government representatives, including SSAs, from the critical infrastructure community. It details DHS’s roles and responsibilities in protecting the nation’s critical infrastructures and how sector stakeholders should use risk management principles to prioritize protection activities within and across sectors. It emphasizes the importance of collaboration, partnering, and voluntary information sharing among DHS and industry owners and operators, and state, local, and tribal governments. According to the NIPP, SSAs are to work with their private-sector counterparts to understand cyber risk and develop sector-specific plans that address the security of the sector’s cyber and other assets and functions. The SSAs and their private-sector partners are to update their sector-specific plans based on DHS sector-specific plan guidance issued in 2014. NIST used several methods to obtain and incorporate stakeholder views when developing its cybersecurity framework. Respondents to our survey were generally satisfied with NIST’s efforts and methods to develop the framework. Also, NIST met the requirements under Executive Order 13636 and the Cybersecurity Enhancement Act to develop an approach that can help critical infrastructure organizations manage cyber risk. Executive Order 13636, released in February 2013 required NIST to create a flexible performance-based cybersecurity framework that includes a set of standards, procedures, and processes that align policy, business, and technological approaches to address cyber risks. In addition, under the Cybersecurity Enhancement Act, enacted into law in December 2014, NIST is required to facilitate and support the development of a voluntary set of standards, guidelines, methodologies, and procedures to cost-effectively reduce cyber risks to critical infrastructure. In February 2014, NIST issued the Framework for Critical Infrastructure Cybersecurity. In developing the framework, NIST used several methods to obtain and incorporate the views of experts from government, industry, and academia. Specifically, it solicited public comments through formal “requests for information,” held workshops with stakeholders to identify and develop elements of the framework, and published a draft version of the framework for further review and comment. Figure 1 summarizes the development of the framework. NIST began the collaboration process for developing the framework on February 26, 2013, when it issued a formal request for information in the Federal Register to seek comments regarding risk management practices, frameworks, standards, guidelines, and best practices. NIST received 246 unique comments in response to the request from organizations and individuals representing, among others, large companies, associations, sector coordinating councils, federal agencies, universities, and international companies. NIST analyzed the comments received to, among other things, identify common cybersecurity practices and methods to facilitate discussions on the development of the framework. After the initial request for information, NIST hosted six workshops at various locations across the country to drive the development of the framework. Workshop participants and attendees included critical infrastructure owners and operators, industry associations, individual companies, and government agencies. Table 4 summarizes the NIST workshops. At each workshop, NIST facilitated discussions with attendees and accepted industry input to collaboratively identify and develop standards and guidelines for the framework. Based on the input from the first four workshops, NIST prepared and published a preliminary draft of the framework for public review and comment following its fourth workshop. NIST analyzed responses to its request for information, conclusions from workshops, and stakeholder analysis to select components for the framework, such as identifying security common practices, principles, and approaches that supported the objectives of Executive Order 13636. To identify the framework components that reflected the comments received, NIST used input from volunteer industry stakeholders. These stakeholders helped to, among other things, evaluate common themes identified by NIST as well as cybersecurity areas that needed additional exploration to encourage industry engagement in the framework development process. After the initial draft was issued for comment, NIST held the fifth workshop to obtain further stakeholder input. Subsequently, NIST published its final draft of the framework in February 2014. Following issuance of the framework, on August 26, 2014, NIST issued a second request for information to seek comments on users’ experience with the framework, as part of its efforts to promote use of the framework, and held an additional workshop to obtain information on how organizations learned about and used the framework. NIST received 57 unique comments in response to the second request for information from organizations and individuals that represented, among others, large companies, associations, and sector coordinating councils.