Framework for Improving Critical Infrastructure Cybersecurity, Version 1.1

National Institute of Standards and Technology

doi:https://doi.org/10.6028/NIST.CSWP.6

NIST CSWP 6

Framework for Improving Critical Infrastructure Cybersecurity, Version 1.1

Documentation Topics

Date Published: April 16, 2018

Author(s)

National Institute of Standards and Technology

Abstract

This publication describes a voluntary risk management framework (“the Framework”) that consists of standards, guidelines, and best practices to manage cybersecurity-related risk. The Framework’s prioritized, flexible, and cost-effective approach helps to promote the protection and resilience of critical infrastructure and other sectors important to the economy and national security.

This release, Version 1.1, includes a number of updates from the original Version 1.0 (from February 2014), including: a new section on self-assessment; expanded explanation of using the Framework for cyber supply chain risk management purposes; refinements to better account for authentication, authorization, and identity proofing; explanation of the relationship between implementation tiers and profiles; and consideration of coordinated vulnerability disclosure. Complete information about the Framework is available at https://www.nist.gov/cyberframework.

Keywords

critical infrastructure; cybersecurity; Cybersecurity Enhancement Act of 2014; framework; risk management; security

Control Families

None selected

Documentation

Publication:
https://doi.org/10.6028/NIST.CSWP.6

Supplemental Material:
Cybersecurity Framework v1.1 (pdf)
Press Release (04-16-2018)
Cybersecurity Framework homepage
Translations of the CSF 1.1

Related NIST Publications:
IR 8286
CSWP 21
SP 1271
IR 8170
IR 8183 Rev. 1
IR 8278A
TN 2051
IR 8204
IR 8204 (Draft)
IR 8204
IR 8204

Document History:
01/10/17: Other (Draft)
12/05/17: Other (Draft)
04/16/18: CSWP 6 (Final)

Topics

Security and Privacy

audit & accountability, awareness training & education, contingency planning, maintenance, risk assessment, system authorization

Applications

cybersecurity framework

Laws and Regulations

Comprehensive National Cybersecurity Initiative, Cybersecurity Enhancement Act, Executive Order 13636, Homeland Security Presidential Directive 7