POWER February 2014 - 50

CyberseCurity
industry sectors. NIST then arranged a series
of five workshops from May through November
last year at various locations around
the country. At these workshops, typically
350 to 400 attendees representing asset owners,
product vendors, and consultants debated
various aspects of the Framework; between
the workshops, NIST reworked the gathered
information into new drafts.
The initial meetings focused heavily on
information technology (IT) systems and
the protection of data and information.
Many attendees were unaware of the specific
issues associated with ICS or operational
technology (OT) systems where protection
is required:
■ Loss of system availability
■ Process upsets leading to compromised
process functionality, inferior product quality,
lost production capacity, compromised
process safety, or environmental releases
■ Equipment damage
■ Personal injury
■ Violation of legal and regulatory requirements
■
Risk to public health and confidence
The Automation Federation, along with
a number of asset owners with OT dependencies,
worked throughout the workshop
process, raising awareness of these issues
to ensure the Framework properly addresses
them.
A draft of the Cybersecurity Framework
was issued at the end of October 2013 for
public comment. After a 45-day comment
period, NIST will take the comments and
produce a final version for issue in February
2014 (after this issue goes to press).
Once issued, the Cybersecurity Framework
enters an ongoing maintenance and upkeep
cycle to reflect changing circumstances
and feedback from users.
How the Framework Can Help
Your Organization
The Cybersecurity Framework consists of
three key parts:
■ The Framework Core
■ The Framework Profile
■ The Framework Implementation Tiers
The Framework Core (Figure 2) helps provide
an overview of the set of cybersecurity
management activities that an organization is
performing (or should be performing). Starting
with five functions-identify, protect,
detect, respond, and recover-the Core is
divided into categories (such as asset management,
risk management, awareness, and
training) and subcategories (such as investi50
Gap
Identification
Category/Subcategory
Category/Subcategory
Category/Subcategory
.
.
.
Category/Subcategory
www.powermag.com
POWER | February 2014
2. The Cybersecurity Framework Core. Source: NIST
Framework Core
Asset management,
risk management,
awareness and
training, etc.
IdentIFy
Categories Subcategories Information references
IeC62443/IsA99,
Iso027001,
nIstsP 800-53,
etc.
ProteCt
deteCt
resPond
Investigate anomalies,
perform forensics, etc.
reCover
gate anomalies and perform forensics). References
(to sector, national, or international
standard requirements or clauses) are then
listed with these subcategories.
The Framework Profile (Figure 3) helps
organizations quantify their desired outcomes
when implementing the Framework Core. A
" Target Profile " will show what the organization
aims to achieve in terms of industry
standards and common industry practices.
The organization can then compare its " Current
Profile " (what it is currently implementing
and following) against the Target Profile
to produce a gap analysis.
The Framework Implementation Tiers
(Figure 4) help define how cybersecurity is
managed within an organization. There are
currently four tiers-partial, risk-informed,
risk-informed and repeatable, and adaptive-
which require increasing levels of rigor and
3. Gap analysis. Using the Framework Profile helps to identify gaps in an organization's
cybersecurity implementation plan. Source: NIST
Current Profile
Category/Subcategory
Category/Subcategory
Category/Subcategory
.
.
.
Category/Subcategory
Category/Subcategory
Category/Subcategory
Category/Subcategory
.
.
.
Category/Subcategory
target Profile
http://www.powermag.com
POWER February 2014

Table of Contents for the Digital Edition of POWER February 2014
