Joint Process Needed for Security Framework

Friday, March 25, 2016 @ 01:03 PM gHale


Whenever the federally led Cybersecurity Framework gets updated, the consensus is there needs to be a collaborative update process, similar to the initial development process, and minimal disruption to current industry use.

That was one of the conclusions critical-infrastructure leaders provided in feedback on the Framework.

RELATED STORIES
Security Framework Grows in Usage
Securing Teleworker Attack Vector
ICS-CERT Releases CSET 7.1
Coalition for Cyber Security Policy

The National Institute of Standards and Technology (NIST) sent out notice to leaders in security for the critical infrastructure for their thoughts on where the Framework stood and if it needed updating.

NIST published an analysis of the comments, which affirm the frameworks’ current uses, recommend refinements, and suggest future directions.

In February 2014, NIST published the Cybersecurity Framework as called for by Executive Order 13636. The goal of the framework was to minimize risks to the nation’s critical infrastructure, such as the transportation, banking, water and energy sectors. The executive order directed NIST to work with stakeholders across the country to develop the voluntary framework based on existing cyber security standards, guidelines and best practices.  

“We received 105 comments from a diverse group that included local, state national and international governments, a cross section of the critical-infrastructure community, and a number of other types of organizations,” said Matthew Barrett, NIST’s program manager for the Cybersecurity Framework. “The responses actually represent thousands of organizations because a large number of industry organizations submitted comments on behalf of all of their member companies.”

NIST’s December 2015 Request for Information on the Cybersecurity Framework called for comments on using the framework to improve cyber security risk management, sharing best practices, and long-term governance of the framework.

In the Analysis of Cybersecurity Framework RFI Responses, NIST identified 10 recurring themes among the responses and provided an explanation of each, along with associated key terms and example responses.

While perspectives varied on whether it would soon be time for a framework update, respondents agreed on the need for a collaborative update process, similar to the initial development process, and with minimal disruption to current industry use, as explained in the document. Some commenters said the focus should be on clarifying use of the framework, in particular for supply chain risk management and when using Implementation Tiers.

Respondents discussed the relationship between the framework and regulatory requirements. For example, respondents discussed the possibility that it could enable multiple regulatory agencies to align diverse requirements in the regulatory process. But respondents also called for “caution against the potential for regulation to add burdens on their organizations,” according to the analysis.

Other themes focused on sharing additional information about framework use and best practices. Respondents requested more guidance on framework implementation, particularly for small- and medium-sized businesses. Another theme covered the need for continued international alignment and harmonization of cyber security standards.

Commenters were comfortable with NIST’s current leadership but wanted to consider transition in the future. The consensus was the future steward of the framework should be a respected, internationally recognized, neutral third-party organization.

“These comments provide strong input for the framework’s future and revealed that the number of organizations using the framework is growing,” Barrett said.