From: Inside Cybersecurity
The draft cybersecurity framework due out this week will offer industry representatives a chance to evaluate whether the federal government is crafting the type of cost-effective, technology-neutral voluntary program they say is necessary to win buy-in from the private sector.
The Obama administration has stressed its commitment to a voluntary cybersecurity program, but the possibility of mandatory standards continues to worry many industry representatives. Administration officials acknowledge that other steps will be needed if they build what they consider to be a voluntary, market-driven cybersecurity program and industry declines to participate.
“If we can’t make it work, Congress will have to consider what to do because there are national consequences,” Patrick Gallagher, director of the National Institute of Standards and Technology, said at a July Senate Commerce Committee hearing. More troubling to industry is the prospect that the Department of Homeland Security and other agencies could use existing authorities to set mandatory standards for industries in critical infrastructures.
Well aware of the stakes, NIST will release the draft framework on Aug. 28 to an anxious audience of industry security experts, attorneys and others. The framework was mandated by President Obama’s Executive Order 13636, and has been the subject of three public workshops conducted by NIST. The fourth and final workshop will be held Sept. 11-13 in Dallas.
A preliminary version of the framework will be issued for public comment in October, but private-sector participants in the NIST process say this week’s release likely will be a good indicator of what the final version of the framework will look like. NIST has been on a breakneck pace to meet the deadlines spelled out in the February executive order and is expected to produce a robust draft version this week, just over six weeks after the most recent workshop in San Diego.
Leave a Reply