On February 12, 2013, President Obama issued Executive Order 13636, which directed federal agencies to undertake a broad range of tasks aimed at enhancing the security and resilience of the nation’s critical infrastructure.  One task directed the National Institute of Standards and Technology (“NIST”) to establish a technology-neutral, voluntary, risk-based cybersecurity framework. A year later, on February 12, 2014, NIST released its Framework for Improving Critical Infrastructure Cybersecurity, Version 1.0.  The Framework includes standards and processes that are intended to align policy, business, and technological approaches to addressing cybersecurity risks.

Since issuing the Framework, NIST has focused on raising awareness of the Framework and how it can be used to manage cyber risks.  Now, NIST is seeking a better understanding of how companies and organizations are using the Framework and what aspects of the Framework have been “helpful or challenging.”  Consequently, NIST has issued an RFI seeking information in three areas: (1) current awareness of the Framework; (2) early implementation experiences for those organizations utilizing the Framework; and (3) input on the utility of the Roadmap included within the Framework.  A series of suggested questions is included within each category; however, respondents are free to comment beyond the questions.

NIST intends to use the responses it receives to:

  • inform its approach to possible tools and resources that could be used to assist organizations in the efficient and effective use of the Framework;
  • inform subsequent versions of the Framework;
  • develop the agenda for an October 2014 workshop on the Framework; and
  • shape the Department of Homeland Security Critical Infrastructure Cyber Community C³ Voluntary Program.

Comments to NIST are due October 10, 2014.

 

 

Tags: Comments, Cyber Risk, Cybersecurity, Cybersecurity Framework, EO 13636, Framework, National Institute of Standards and Technology, NIST, Request for Information, RFI
Print:
Email this postTweet this postLike this postShare this post on LinkedIn
Photo of Susan B. Cassidy Susan B. Cassidy

Susan Cassidy co-chairs Covington’s Aerospace and Defense Industry Group, and has been advising government contractors for more than 35 years on the requirements imposed on companies contracting with the U.S. Government.

Susan’s practice focuses on the intersection of cybersecurity, national security, and supply…

Susan Cassidy co-chairs Covington’s Aerospace and Defense Industry Group, and has been advising government contractors for more than 35 years on the requirements imposed on companies contracting with the U.S. Government.

Susan’s practice focuses on the intersection of cybersecurity, national security, and supply chain risk management for companies that sell products and services to the U.S. Government. Susan advises contractors at all phases of the procurement cycle, and regularly:

advises clients on compliance obligations imposed by the FAR, DFARS, and other agency regulatory requirements;
leads internal and government False Claims Act (FCA) investigations addressing allegations of violations of government cybersecurity, national security, supply chain, quality, and MIL-SPEC requirements; and
advises clients who have suffered a cyber breach where U.S. government information may have been impacted.

In her work with global, national, and start-up contractors, Susan advises companies on all aspects of government supply chain issues including:

Government cybersecurity requirements, including the Cybersecurity Maturity Model Certification (CMMC), DFARS 252.204-7012, FedRAMP, controlled unclassified information (CUI), and NIST SP 800-171 requirements;
Evolving sourcing issues such as Section 889, counterfeit part requirements, Section 5949 semiconductor product and service restrictions, and limitations on sourcing a variety of products from China; and
Federal Acquisition Security Council (FASC) regulations and product exclusions.

 

Susan previously served as senior in-house counsel for two major defense contractors (Northrop Grumman Corporation and Motorola Incorporated) and is Chambers rated in both Government Contracts and Government Contracts Cybersecurity. Chambers USA has quoted sources stating that “Susan’s in-house experience coupled with her deep understanding of the regulatory requirements is the perfect balance to navigate legal and commercial matters.”

Susan is a former Public Contract Law Procurement Division Co-Chair, former Co-Chair and current Vice-Chair of the ABA PCL Cybersecurity, Privacy and Emerging Technology Committee.

Susan’s pro-bono work extends to assisting veterans in a variety of matters, as well as providing advice to elderly clients on their wills and other end-of-life planning documents.

Read more about Susan B. CassidyEmail
Show more Show less