4: Cybersecurity Framework

Develop a framework to reduce cyber risks to critical infrastructure.

Other Information:

Sec. 7. Baseline Framework to Reduce Cyber Risk to Critical Infrastructure. (a) The Secretary of Commerce shall direct the Director of the National Institute of Standards and Technology (the ‘‘Director'') to lead the development of a framework to reduce cyber risks to critical infrastructure (the ‘‘Cybersecurity Framework''). The Cybersecurity Framework shall include a set of standards, methodologies, procedures, and processes that align policy, business, and technological approaches to address cyber risks. The Cybersecurity Framework shall incorporate voluntary consensus standards and industry best practices to the fullest extent possible. The Cybersecurity Framework shall be consistent with voluntary international standards when such international standards will advance the objectives of this order, and shall meet the requirements of the National Institute of Standards and Technology Act, as amended (15 U.S.C. 271 et seq.), the National Technology Transfer and Advancement Act of 1995 (Public Law 104-113), and OMB Circular A-119, as revised.

Stakeholder(s):

• Secretary of Commerce


• Director of the National Institute of Standards and Technology

Objective(s):

4.1: Cyber Risk Management

4.1.1: Business Confidentiality & Individual Privacy & Civil Liberties

4.1.2: Public Review & Comment

4.1.3: Performance Goals

4.1.4: Publication

4.1.5: Review & Updates

Content