IEEE Technology and Society Magazine - December 2021 - 79

articulation of the consensus for developing the
Cybersecurity Framework, NIST's efforts are highly
regarded and this, in turn, has fueled the Cybersecurity
Framework's broad adoption, including well
beyond its specified critical infrastructure domain.
The Cybersecurity Framework constitutes soft
law that, because it was adopted into the formal
legal
system,
has
achieved
direct government
enforceability. For example, the U.S. Federal Trade
Commission (FTC), the nation's leading consumer
protection agency, has dusted off and evolved its
unfairness doctrine to bring cybersecurity within
the scope of its jurisdiction under Section 5 of
the Federal Trade Commission Act (Section 5).
Adherence to reasonable security practices is the
legal requirement [27]. The FTC's approach to the
interpretation of, compliance with, and enforcement
of reasonable security practices is tied to the
Cybersecurity Framework [27]. The comprehensiveness
and general applicability of the Cybersecurity
Framework align well with the economywide
span of consumer protection under the FTC's legal
authority. Furthermore, the FTC's jurisprudence is
widely adopted and extended into state consumer
protection laws across the country. That jurisprudence
carries with it the principles and practices
established through the Cybersecurity Framework.
The Cybersecurity Framework is a meaningful
exemplar of soft law dealing with a highly complex
and rapidly evolving technology and market ecosystem
and how it establishes an essential and validated
subject matter foundation by which to inform and
be engaged by the formal legal system. Importantly,
this soft-to-positive law process unfolded within a
relatively short period of time. President Obama
issued Executive Order 13636 calling for NIST to
develop the Cybersecurity Framework in February
2013 [28]. NIST did so, publishing its first version on
the anniversary of that Executive Order in February
2014 [29]. Within fewer than three years, the FTC
expressly tied its reasonable security practices compliance
and enforcement work under Section 5 to
the Cybersecurity Framework [30]. By comparison
with other urgently needed consumer legal protections
[31], this soft-to-positive law incorporation process
was rapid and efficient.
Furthermore, the Cybersecurity Framework
serves as good guidance for corporations and other
organizations as to their management of cyber risk,
as indeed it should, given the extensive involvement
December 2021
of industry in its creation. Thus, by managing their
enterprise risks through the framework, organizations
simultaneously manage their cyber-associated
legal risks. This suggests that soft law, in this
instance, is highly efficient and helps minimize, if
not eliminate, any regulatory compliance burden
related to the FTC's reasonable security practices
requirements.
Thus, the Cybersecurity Framework as soft law
and basis for compliance and enforcement under
the positive law is an example of a credible, rapid,
efficient, and effective governance process. It is not
complete in itself as a governance system. Its rapid
and apparently easy incorporation into the positive
law, here the Federal Trade Commission Act and its
regulatory framework, however, established compliance
standards that overlay organizations' own
reasonable enterprise risk management approaches
that do not substantially increase their regulatory
burden. These standards provide an effective basis
for enforcement and thus give backbone otherwise
missing from a soft law only approach.
NIST AI framework
There are differences in the cybersecurity and AI
spheres of technology and their markets. For example,
although cybersecurity is governed, to varying
degrees of effectiveness, under an overlay of
domestic, foreign, and international legal regimes,
AI is not. Both technologies may be implicated in
causing harm to people, but AI is arguably more
extensively and directly implicated. Both technologies
operate along a steep innovation curve, but
the potential applications and further innovation
seem vastly more extensive in the case of AI. These
and other distinctions in the technologies demonstrate
the need to expedite the creation of soft AI
governance by involving NIST in the development
of an AI framework.
Despite its apolitical commitment to scientific
fact and its excellent track record in convening the
Cybersecurity Framework, the Big Data Interoperability
Framework [32], the Privacy Framework [33],
and similar efforts, NIST has not yet been tapped to
carry out an AI framework process.
In early 2019, NIST was directed by executive
order to develop a federal engagement plan regarding
technical standards and tools applicable to the
use of AI or AI-incorporating systems [34]. In its corresponding
press release, the White House Office of
79
IEEE Technology and Society Magazine - December 2021

Table of Contents for the Digital Edition of IEEE Technology and Society Magazine - December 2021
