A year ago, U.S. President Barack Obama directed the development of a voluntary, risk-based cybersecurity framework in his executive order a year ago. On Feb. 12, 2014, the U.S. Department of Commerce’s National Institute of Standards and Technology issued a “Framework for Improving Critical Infrastructure Cybersecurity (version 1.0).”
The framework seeks to enable organizations—“regardless of size, degree of cybersecurity risk, or cybersecurity sophistication—to apply the principles and best practices of risk management to improving the security and resilience of critical infrastructure.” At its core, it is a cybersecurity risk management tool designed to create a shared vocabulary about cybersecurity and help decision-makers from board rooms to the government better manage cybersecurity risks.
