NIST is the National Institute of Standards and Technology.
Founded in 1901, NIST is one of the oldest physical science laboratories in the United
States.
Originally formed to establish a system of measurement that would make America competitive
in the global, industrial marketplace, NIST now oversees measures supporting a vast array
of scientific and technological projects, products, and services.
The national and economic security of the United States depends on the reliable functioning
of critical infrastructure.
Recognizing this, President Barack Obama issued Executive Order 13636 in February 2013.
This order called for NIST, with the support of industry, to develop a voluntary framework
that would establish guidelines and best practices for creating and maintaining reliable cybersecurity
protocols in critical infrastructure.
This would lead to the creation of the NIST Cybersecurity Framework.
The NIST Cybersecurity Framework provides a common language for understanding, managing,
and expressing cybersecurity risk both internally and externally.
It creates a way to enable industry to recognize and prioritize potential cybersecurity risk
in their critical infrastructure and can be used to establish a system to align businesses
across organizations to manage said risk.
The core of the Framework consists of five, primary functions:
IDENTIFY > PROTECT > DETECT > RESPOND > RECOVER
IDENTIFY: Being able to locate places in critical infrastructure where cybersecurity protocols
are necessary
PROTECT: Taking proactive steps to insure the infrastructure is secure
DETECT: Being able to identify potential intrusions or other occurrences of a potential cybersecurity
event
RESPOND: Taking the proper course of action to respond to detecting a cybersecurity event
RECOVER: Being able to restore any functionality or services that were lost as a result of
the cybersecurity event.
From the functions, the Framework Core is broken down in to categories, sub-categories,
and informative references.
These elements are more specific and are based on programmatic needs and specific activities
of the implementing organization.
Having a plan is essential to implementing a quality cybersecurity protocol and protecting
critical infrastructure that is essential to the American economy.
Through the NIST Cybersecurity Framework, business and industry can create such a plan.
For more information, visit NIST.gov/cyberframework