Cybersecurity framework v1-1_presentation

Cybersecurity framework v1-1_presentation

• 1.
  The Cybersecurity Framework Version1.1 October 2019
• 2.
  Cybersecurity Framework History •February 2013 - Executive Order 13636: Improving Critical Infrastructure Cybersecurity • December 2014 - Cybersecurity Enhancement Act of 2014 (P.L. 113-274) • May 2017 - Executive Order 13800: Strengthening the Cybersecurity of Federal Networks and Critical Infrastructure
• 3.
  The Cybersecurity Framework ThreePrimary Components Core Desired cybersecurity outcomes organized in a hierarchy and aligned to more detailed guidance and controls Profiles Alignment of an organization’s requirements and objectives, risk appetite and resources using the desired outcomes of the Framework Core Implementation Tiers A qualitative measure of organizational cybersecurity risk management practices
• 4.
  • Common andaccessible language • Adaptable to many technologies, lifecycle phases, sectors and uses • Risk-based • Based on international standards • Living document • Guided by many perspectives – private sector, academia, public sector Key Framework Attributes Principles of Current and Future Versions of the Framework
• 5.
  The Framework Core Establishesa Common Language • Describes desired outcomes • Understandable by everyone • Applies to any type of risk management • Defines the entire breadth of cybersecurity • Spans both prevention and reaction Function Identify Protect Detect Respond Recover
• 6.
  An Excerpt fromthe Framework Core The Connected Path of Framework Outcomes 5 Functions 23 Categories 108 Subcategories 6 Informative References
• 7.
  Implementation Tiers The CybersecurityFramework Version 1.1 1 2 3 4 Partial Risk Informed Repeatable Adaptive Risk Management Process The functionality and repeatability of cybersecurity risk management Integrated Risk Management Program The extent to which cybersecurity is considered in broader risk management decisions External Participation The degree to which the organization: • monitors and manages supply chain risk1.1 • benefits my sharing or receiving information from outside parties
• 8.
  Framework Update The CybersecurityFramework Version 1.1 • Applicability for all system lifecycle phases • Enhanced guidance for managing cybersecurity within supply chains and for buying decisions • New guidance for self-assessment • Better accounts for Authorization, Authentication, and Identity Proofing • Incorporates emerging vulnerability information (a.k.a., Coordinated Vulnerability Disclosure) • Administratively updates the Informative References
• 9.
  International Use Translations, Adaptations,and Other References World-Wide
• 10.
  Sample Resources www.nist.gov/cyberframework/framework-resources Financial ServicesProfile Financial Services Sector Specific Cybersecurity “Profile” Manufacturing Profile NIST Discrete Manufacturing Cybersecurity Framework Profile Maritime Profile Bulk Liquid Transport Profile
• 11.
  Success Stories https://www.nist.gov/cyberframework/success-stories University ofChicago Biological Sciences Division Japan’s Cross-Sector Forum ISACA University of Pittsburgh University of Kansas Medical Center Multi-State Information Sharing & Analysis Center
• 12.
  STAYING IN TOUCH [email protected] NIST.gov/cyberframework @ @NISTcyber NIST.gov/topics/cybersecurity NCCoE.NIST.gov CSRC.NIST.gov