NIST Releases Preliminary Cybersecurity Framework for Public Comment

The National Institute of Standards and Technology (NIST) has released the Preliminary Cybersecurity Framework, a set of standards and practices designed to assist organizations that are responsible for critical infrastructure as they address and manage cybersecurity risk.  The government shutdown delayed the Preliminary Framework from its scheduled October 10, 2013, release.  Comments on the Preliminary Framework are due by December 13 (78 Fed. Reg. 64478, October 29, 2013).

The Preliminary Framework is one of many deliverables put in motion by Executive Order (EO) 13636, which directs NIST to develop “a prioritized, flexible, repeatable, performance-based, and cost-effective approach” that will “align policy, business, and technological approaches to address cyber risks.”

The Preliminary Framework was the subject of public participation over the Spring and Summer, including at several workshops held by NIST around the country.  The Preliminary Framework precedes NIST's adoption of a Final Cybersecurity Framework.  The Final Framework, due in February 2014, will be shaped by comments received by NIST.

The adoption of the cyber standards and practices that will be included in the Final Framework is intended to be voluntary, though the EO mandates that the Department of Homeland Security (DHS) create a voluntary program with incentives to encourage companies to adopt the Final Framework.  The federal government hopes that its Final Framework will spur improvements to cybersecurity practices throughout industry and not just in critical infrastructure sectors. 

A great deal of uncertainty surrounds the content and structure of both the Final Framework and the voluntary program.  Industry groups are concerned that the standards recommended by NIST could become de facto obligations or be made mandatory by regulatory agencies that have been instructed in the EO to evaluate the adequacy of existing regulations and consider new obligations to mitigate cyber risks to critical infrastructure.