NIST Releases Preliminary Cybersecurity Framework for Public Comment

The National Institute of Standards and Technology (NIST) has released the Preliminary Cybersecurity Framework, a set of standards and practices designed to assist organizations that are responsible for critical infrastructure as they address and manage cybersecurity risk.  The government shutdown delayed the Preliminary Framework from its scheduled October 10, 2013, release.  Comments on the Preliminary Framework are due by December 13 (78 Fed. Reg. 64478, October 29, 2013).

The Preliminary Framework is one of many deliverables put in motion by Executive Order (EO) 13636, which directs NIST to develop “a prioritized, flexible, repeatable, performance-based, and cost-effective approach” that will “align policy, business, and technological approaches to address cyber risks.”

The Preliminary Framework was the subject of public participation over the Spring and Summer, including at several workshops held by NIST around the country.  The Preliminary Framework precedes NIST's adoption of a Final Cybersecurity Framework.  The Final Framework, due in February 2014, will be shaped by comments received by NIST.

The adoption of the cyber standards and practices that will be included in the Final Framework is intended to be voluntary, though the EO mandates that the Department of Homeland Security (DHS) create a voluntary program with incentives to encourage companies to adopt the Final Framework.  The federal government hopes that its Final Framework will spur improvements to cybersecurity practices throughout industry and not just in critical infrastructure sectors. 

A great deal of uncertainty surrounds the content and structure of both the Final Framework and the voluntary program.  Industry groups are concerned that the standards recommended by NIST could become de facto obligations or be made mandatory by regulatory agencies that have been instructed in the EO to evaluate the adequacy of existing regulations and consider new obligations to mitigate cyber risks to critical infrastructure. 

Tags

Wiley Connect

Sign up for updates

Wiley Rein LLP Cookie Preference Center

Your Privacy

When you visit our website, we use cookies on your browser to collect information. The information collected might relate to you, your preferences, or your device, and is mostly used to make the site work as you expect it to and to provide a more personalized web experience. For more information about how we use Cookies, please see our Privacy Policy.

Strictly Necessary Cookies

Always Active

Necessary cookies enable core functionality such as security, network management, and accessibility. These cookies may only be disabled by changing your browser settings, but this may affect how the website functions.

Functional Cookies

Always Active

Some functions of the site require remembering user choices, for example your cookie preference, or keyword search highlighting. These do not store any personal information.

Form Submissions

Always Active

When submitting your data, for example on a contact form or event registration, a cookie might be used to monitor the state of your submission across pages.

Performance Cookies

Performance cookies help us improve our website by collecting and reporting information on its usage. We access and process information from these cookies at an aggregate level.

Powered by Firmseek