NIST Unveils Preliminary Cybersecurity Framework

by K&L Gates LLP

On October 22, the National Institute of Standards and Technology (NIST) released its long-anticipated Preliminary Cybersecurity Framework[1] for public review and comment. The Cybersecurity Framework was issued in accordance with President Obama’s February 19 Executive Order 13636, Improving Critical Infrastructure Cybersecurity,[2] which tasked NIST with developing a Cybersecurity Framework “to reduce cyber risks to critical infrastructure.”[3] The Executive Order states that the Cybersecurity Framework must “provide a prioritized, flexible, repeatable, performance-based, and cost-effective approach, including information security measures and controls, to help owners and operators of critical infrastructure identify, assess, and manage cyber risk.”[4] “Critical infrastructure” organizations include those in the chemical, communications, critical manufacturing, defense, financial services, energy, healthcare, and information technology sectors, among others.[5] As stated in the Executive Order, “[t]he cyber threat to critical infrastructure continues to grow and represents one of the most serious national security challenges we must confront.”[6]

NIST developed the Cybersecurity Framework based on information gathered over the past six months, including a Request for Information published in the Federal Register[7] and a series of four open public workshops held at various locations throughout the United States. A “key objective” of the Cybersecurity Framework “is to encourage organizations to consider cybersecurity risk as a priority similar to financial, safety, and operational risk….”[8]

At a very high level, as its name indicates, the Cybersecurity Framework provides a framework for critical infrastructure organizations to achieve a grasp on their current cybersecurity risk profile and risk management practices, to identify gaps that should be addressed in order to progress towards a desired “target” state of cybersecurity risk management, and to internally and externally communicate efficiently about cybersecurity and risk management. In releasing the Cybersecurity Framework, NIST explained that it “offers a common language and mechanism for organizations to determine and describe their current cybersecurity posture, as well as their target state for cybersecurity” and “will help them to identify and prioritize opportunities for improvement within the context of risk management and to assess progress toward their goals.”[9] Although applying to organizations in critical infrastructure, the Cybersecurity Framework may be used by any organization as part of its effort to assess cybersecurity practices and manage cybersecurity risk.

Three-Part Approach
The Cybersecurity Framework adopts a risk-based approach composed of three parts: the Framework Core, Framework Profile, and Framework Implementation Tiers.[10]

The Framework Core
The Framework Core is a set of cybersecurity activities that are common across critical infrastructure sectors.  It consists of five high-level “Functions,” which, as stated by NIST, “organize basic cybersecurity activities at their highest level.”[11] The five Functions are: (1) Identify,[12] (2) Protect,[13] (3) Detect,[14] (4) Respond,[15] and (5) Recover.[16] NIST explains that “these Functions will provide a concise way for senior executives and others to distill the fundamental concepts of cybersecurity risk so that they can assess how identified risks are managed, and how their organization stacks up at a high level against existing cybersecurity standards, guidelines, and practices.”[17]

For each of the five Functions, the Framework Core identifies underlying key “Categories” and “Subcategories,” and then matches them with “Informative References,” such as existing cybersecurity standards, guidelines, and practices. By way of example, Categories within the “Protect” Function include “Access Control, Awareness and Training, Data Security, Information Protection Processes and Procedures, and Protective Technology.”[18] Subcategories under the “Access Control” Category within the Protect Function include (but are not limited to) “[i]dentities and credentials are managed for authorized devices and users” and “[n]etwork integrity is protected.”[19] “Informative References” for [i]dentities and credentials are managed for authorized devices and users” include the following:

  • ISA 99.02.01
  • COBIT DSS05.04, DSS06.03
  • SO/IEC 27001 A.11
  • NIST SP 800-53 Rev. 4 AC-2, AC-5, AC-6, IA Family
  • CCS CSC 16[20]

The Cybersecurity Framework relies upon existing private sector and governmental cybersecurity standards, guidelines, and practices as a basis to build or augment an organization’s cybersecurity risk management practices.

The following Figure 1 from the Cybersecurity Framework depicts the Framework Core:

NIST explains that “[t]his structure ties the high level strategic view, outcomes and standards based actions together for a cross-organization view of cybersecurity activities.”[21] The Framework Core is intended to facilitate cybersecurity and risk management communications within an organization, including among senior management, middle management and operational staff. In releasing the Cybersecurity Framework, NIST explained that it “will foster communications among internal and external stakeholders and help organizations hold each other accountable for strong cyber protections.”[22]

The Framework Profile
In essence, the Framework Profile describes an organization’s current state of cybersecurity risk management and can be used to track progress towards a target state of cybersecurity risk management. As described by NIST, the Framework Profile “can be used to describe both the current state and the desired target state of specific cybersecurity activities, thus revealing gaps that should be addressed to meet cybersecurity risk management objectives.”[23] Framework Profiles are used to “identify opportunities for improving cybersecurity by comparing a ‘Current’ Profile with a ‘Target’ Profile.” [24]

The Framework Implementation Tiers
The Framework Implementation Tiers, which range from Partial (Tier 1) to Adaptive (Tier 4), describe the degree to which an organization’s cybersecurity practices exhibit desirable characteristics. The Tiers consider cybersecurity risk management practices, the level of awareness of cybersecurity risk at the organizational level, and the processes, or lack thereof, in place to coordinate or collaborate with other entities. By way of example, considering the risk management aspect, at Tier 1 “[o]rganizational cybersecurity risk management practices are not formalized and risk is managed in an ad hoc and sometimes reactive manner.”[25] At Tier 2, “[r]isk management practices are approved by management but may not be established as organizational-wide policy.”[26] At Tier 3, “[t]he organization’s risk management practices are formally approved and expressed as policy.”[27] At Tier 4, “[t]hrough a process of continuous improvement, the organization actively adapts to a changing cybersecurity landscape and responds to emerging/evolving threats in a timely manner.”[28]

The Cybersecurity Framework is voluntary--at least for now. NIST has explained that the Framework “complements, and does not replace, an organization’s existing business or cybersecurity risk management process and cybersecurity program.”[29] The Cybersecurity Framework “can serve as the foundation for a new cybersecurity program or a mechanism for improving an existing program.”[30] Although the Cybersecurity Framework is voluntary, organizations are advised to keep in mind that creative class action plaintiffs (and even some regulators) may nevertheless assert that the Cybersecurity Framework provides a “de facto” standard for cybersecurity and risk management.

Importantly, the Cybersecurity Framework can be used as a means to communicate an organization’s required cybersecurity standards to business partners. As stated by NIST, “[t]he Framework provides a common language to communicate requirements among interdependent partners responsible for the delivery of essential critical infrastructure services,” such as, for example, the utilization of a “Target” Profile “to express requirements to an external service provider (e.g., a cloud provider) to which it is exporting data.”[31] This is significant because the cybersecurity shortcomings of “cloud” and other providers can have a profound impact on supply chains. As explained by NIST:

All organizations are part of, and dependent upon, product and service supply chains. Supply chains consist of organizations that design, make, source, and deliver products and services. Disruptions in one part of the supply chain may have a cascading and adverse impact on organizations throughout the supply chain, both up and downstream, and across multiple sectors and subsectors. Although many organizations have robust internal risk management processes, there remain challenges related to criticality and dependency analysis, collaboration, information sharing, and trust mechanisms throughout the supply chain. As a result, organizations continue to struggle to identify their risks and prioritize their actions due to these operational dependencies and the weakest links are susceptible to penetration and disruption. Supply chain risk management, particularly in terms of product and service integrity, is an emerging discipline characterized by diverse perspectives, disparate bodies of knowledge, and fragmented standards and best practices.[32]

Incentives -- And Insurance
As of yet unspecified governmental incentives will be offered to organizations that adopt the framework. The Executive Order directs the Secretary of Homeland Security, in coordination with sector-specific agencies, to “establish a voluntary program to support the adoption of the Cybersecurity Framework by owners and operators of critical infrastructure and any other interested entities,” called the “Program,” and to “coordinate establishment of a set of incentives designed to promote participation in the Program.”[33]

On August 6, the White House previewed a list of possible incentives, including “Cybersecurity Insurance” at the top of the list.[34] If Cybersecurity Insurance is adopted as an incentive, organizations that participate in the Program may, for example, enjoy more streamlined underwriting and reduced cyber insurance premiums. As stated by Michael Daniel, Special Assistant to the President and Cybersecurity Coordinator, agencies have “suggested that the insurance industry be engaged when developing the standards, procedures, and other measures that comprise the Framework and the Program” and that “[t]he goal of this collaboration would be to build underwriting practices that promote the adoption of cyber risk-reducing measures and risk-based pricing and foster a competitive cyber insurance market.”[35] Mr. Daniel states that NIST “is taking steps to engage the insurance industry in further discussion on the Framework.”[36]

The placement of “Cybersecurity Insurance” at the top of a list of possible incentives underscores the important role that insurance can play in an organization’s overall strategy to manage and mitigate cybersecurity risk, including supply chain disruption.[37] Adam Sedgewick, Senior Information Technology Policy Advisor at NIST, stated in a recent interview that NIST views “the insurance industry as a major stakeholder [in] helping organizations manage their cyber risk.”[38] All of this is consistent with the SEC’s guidance on cybersecurity disclosures under the federal securities laws, which advises that “appropriate disclosures may include,” among other things, a “[d]escription of relevant insurance coverage” for cybersecurity risks.[39]

Request For Comment
NIST is seeking comments on the Cybersecurity Framework[40] and organizations have a unique opportunity to potentially shape the final Cybersecurity Framework. Both written and electronic comments should be submitted using the comment template form available electronically from the NIST website[41] and are due by December 13, 2013. The final version of the Cybersecurity Framework is due to be released in February 2014.

*          *          *          *          *


[1] The Cybersecurity Framework is available at

[2] 78 Fed. Reg. 11737 (2013). The Executive Order is available at

[3] Executive Order, Section 7(a).

[4] Id., Section 7(b). “Critical infrastructure” as used in the Executive Order “means systems and assets, whether physical or virtual, so vital to the United States that the incapacity or destruction of such systems and assets would have a debilitating impact on security, national economic security, national public health or safety, or any combination of those matters.”  Id. Section 2.  This is the meaning given to the term in the Critical Infrastructures Protection Act of 2001, 42 U.S.C. § 5195c(e).

[5] Presidential Policy Directive/PPD 21, Critical Infrastructure Security and Resilience, (Feb. 12, 2013), available at (reference “PPD 21”), identifies 16 critical infrastructure sectors.  See id. at 10-11.

[6] Executive Order, Section 1.

[7] 78 Fed. Reg. 13024 (2013). The Request for Information is available at

[8] Cybersecurity Framework, at 1.

[9] NIST Releases Preliminary Cybersecurity Framework, Will Seek Comments (Oct. 22, 2013), available at

[10] Cybersecurity Framework, at 2.

[11] Id. at 5.

[12] This is to “[d]evelop the institutional understanding to manage cybersecurity risk to 243 organizational systems, assets, data, and capabilities.”  Id. at 6. 

[13] This is to “[d]evelop and implement the appropriate safeguards, prioritized through the organization’s risk management process, to ensure delivery of critical infrastructure services.” Id.

[14] This is to “[d]evelop and implement the appropriate activities to identify the occurrence of a cybersecurity event.”  Id. at 7. 

[15] This is to “[d]evelop and implement the appropriate activities, prioritized through the organization’s risk management process (including effective planning), to take action regarding a detected cybersecurity event.” Id.

[16] This is to “[d]evelop and implement the appropriate activities, prioritized through the organization’s risk management process, to restore the capabilities or critical infrastructure services that were impaired through a cybersecurity event.” Id.

[17] Id. at 11.

[18] Cybersecurity Framework, at 7.

[19] 16-17 (Appendix A).

[20] 16 (Appendix A).

[21] Id. at 2.

[22] NIST Releases Preliminary Cybersecurity Framework, Will Seek Comments (Oct. 22, 2013), available at

[23] Cybersecurity Framework, at 7.  NIST further describes the Framework Profile as “a tool to enable organizations to establish a roadmap for reducing cybersecurity risk that is well aligned with organization and sector goals, considers legal/regulatory requirements and industry best practices, and reflects risk management priorities.”  Id

[24] Id. at 3.

[25] Id. at 9.

[26] Id. at 10

[27] Id.

[28] Id.

[29] Id. at 2.

[30] Id. at 11.

[31] Id. at 12.

[32] Id. at 39.

[33] Executive Order, Section 8(a, d).

[34] Michael Daniel, Incentives to Support Adoption of the Cybersecurity Framework, The White House Blog (Aug. 6, 2013), available at

[35] Id. Other potentially significant incentives include leveraging federal grant programs, limitations on liability, including “reduced tort liability, limited indemnity, higher burdens of proof, or the creation of a Federal legal privilege that preempts State disclosure requirements,” and optional public recognition for participants in the Program and their vendors.  Id.

[36] Id.

[37] See Roberta D. Anderson, Insurance Coverage for Cyber Attacks, The Insurance Coverage Law Bulletin, Vol. 12, Nos. 4 & 5 (May-June 2013).

[38] See Janet Aschkenasy, NIST to engage insurance as tool to manage cyber risk, Advisen (Oct 28, 2013 ) (quoting Mr. Sedgewick).

[39] SEC Division of Corporation Finance, Cybersecurity, CF Disclosure Guidance: Topic No. 2 (Oct. 13, 2011), available at

[40] 78 Fed. Reg. 64478 (2013).



DISCLAIMER: Because of the generality of this update, the information provided herein may not be applicable in all situations and should not be acted upon without specific legal advice based on particular situations.

© K&L Gates LLP | Attorney Advertising

Written by:

K&L Gates LLP

K&L Gates LLP on:

Readers' Choice 2017
Reporters on Deadline

"My best business intelligence, in one easy email…"

Your first step to building a free, personalized, morning email brief covering pertinent authors and topics on JD Supra:
Sign up using*

Already signed up? Log in here

*By using the service, you signify your acceptance of JD Supra's Privacy Policy.
Custom Email Digest
Privacy Policy (Updated: October 8, 2015):

JD Supra provides users with access to its legal industry publishing services (the "Service") through its website (the "Website") as well as through other sources. Our policies with regard to data collection and use of personal information of users of the Service, regardless of the manner in which users access the Service, and visitors to the Website are set forth in this statement ("Policy"). By using the Service, you signify your acceptance of this Policy.

Information Collection and Use by JD Supra

JD Supra collects users' names, companies, titles, e-mail address and industry. JD Supra also tracks the pages that users visit, logs IP addresses and aggregates non-personally identifiable user data and browser type. This data is gathered using cookies and other technologies.

The information and data collected is used to authenticate users and to send notifications relating to the Service, including email alerts to which users have subscribed; to manage the Service and Website, to improve the Service and to customize the user's experience. This information is also provided to the authors of the content to give them insight into their readership and help them to improve their content, so that it is most useful for our users.

JD Supra does not sell, rent or otherwise provide your details to third parties, other than to the authors of the content on JD Supra.

If you prefer not to enable cookies, you may change your browser settings to disable cookies; however, please note that rejecting cookies while visiting the Website may result in certain parts of the Website not operating correctly or as efficiently as if cookies were allowed.

Email Choice/Opt-out

Users who opt in to receive emails may choose to no longer receive e-mail updates and newsletters by selecting the "opt-out of future email" option in the email they receive from JD Supra or in their JD Supra account management screen.


JD Supra takes reasonable precautions to insure that user information is kept private. We restrict access to user information to those individuals who reasonably need access to perform their job functions, such as our third party email service, customer service personnel and technical staff. However, please note that no method of transmitting or storing data is completely secure and we cannot guarantee the security of user information. Unauthorized entry or use, hardware or software failure, and other factors may compromise the security of user information at any time.

If you have reason to believe that your interaction with us is no longer secure, you must immediately notify us of the problem by contacting us at In the unlikely event that we believe that the security of your user information in our possession or control may have been compromised, we may seek to notify you of that development and, if so, will endeavor to do so as promptly as practicable under the circumstances.

Sharing and Disclosure of Information JD Supra Collects

Except as otherwise described in this privacy statement, JD Supra will not disclose personal information to any third party unless we believe that disclosure is necessary to: (1) comply with applicable laws; (2) respond to governmental inquiries or requests; (3) comply with valid legal process; (4) protect the rights, privacy, safety or property of JD Supra, users of the Service, Website visitors or the public; (5) permit us to pursue available remedies or limit the damages that we may sustain; and (6) enforce our Terms & Conditions of Use.

In the event there is a change in the corporate structure of JD Supra such as, but not limited to, merger, consolidation, sale, liquidation or transfer of substantial assets, JD Supra may, in its sole discretion, transfer, sell or assign information collected on and through the Service to one or more affiliated or unaffiliated third parties.

Links to Other Websites

This Website and the Service may contain links to other websites. The operator of such other websites may collect information about you, including through cookies or other technologies. If you are using the Service through the Website and link to another site, you will leave the Website and this Policy will not apply to your use of and activity on those other sites. We encourage you to read the legal notices posted on those sites, including their privacy policies. We shall have no responsibility or liability for your visitation to, and the data collection and use practices of, such other sites. This Policy applies solely to the information collected in connection with your use of this Website and does not apply to any practices conducted offline or in connection with any other websites.

Changes in Our Privacy Policy

We reserve the right to change this Policy at any time. Please refer to the date at the top of this page to determine when this Policy was last revised. Any changes to our privacy policy will become effective upon posting of the revised policy on the Website. By continuing to use the Service or Website following such changes, you will be deemed to have agreed to such changes. If you do not agree with the terms of this Policy, as it may be amended from time to time, in whole or part, please do not continue using the Service or the Website.

Contacting JD Supra

If you have any questions about this privacy statement, the practices of this site, your dealings with this Web site, or if you would like to change any of the information you have provided to us, please contact us at:

- hide
*With LinkedIn, you don't need to create a separate login to manage your free JD Supra account, and we can make suggestions based on your needs and interests. We will not post anything on LinkedIn in your name. Or, sign up using your email address.