Editor’s Note: As CRE has long noted, federal agencies, including the SEC, will regulate cybersecurity in the absence of effective industry protection of their intellectual property.
From: ComputerWorld
Once passed, the standard will become the benchmark to measure critical infrastructure security programs
Jaikumar Vijayan
Critical infrastructure companies could face new liability risks if they fail to meet voluntary cybersecurity standards being developed by the National Institute of Standards and Technology.
The slated release of a draft of the standard on Thursday was delayed, apparently due to the federal government shutdown. NIST’s main website was shuttered on Thursday.
The standards effort was launched after an Executive Order by President Barack Obama earlier this year.
A preliminary version of the draft standard has been floating around for several weeks, however.
The formal draft version, when released, will be available for public review until February 2014, according to the original schedule. Once the review is complete, will release a final version of the standards that incorporates changes recommended by stakeholders.
The NIST cybersecurity framework is designed to serve as a security best practices guide for organizations in critical infrastructure sectors, like power, telecommunications, financial services and energy.
The framework was developed with input from industry stakeholders.
It is not designed to mandate specific security controls. Rather, it offers broad standards for identifying and protecting critical data, services and assets against cyber threats. It offers a set of best practices for detecting and responding to an attack, mitigating the fallout from cyber incidents and for managing risks overall.
Obama issued the Executive Order in February to address, what he said was an immediate need to protect critical infrastructure targets against cyberattacks. Administration officials said the order came only after repeated failures by Congress to pass meaningful cybersecurity legislation.
Participation in the standards program is voluntary. The Executive Order leaves it up to the federal agencies in charge of each critical sector to push adoption of the standards through a combination of incentives and other market driven means.
In practice though, critical infrastructure owners and operators will likely be left with little choice but to follow the standards, or at least show they have comparable security measures in place, said Jason Wool, an attorney with Venable LLP, a Washington D.C-based law firm.
Companies that ignore the standards and are breached will open themselves up to negligence, shareholder and breach of contract lawsuits along with other liability claims. The standards will likely be viewed as the minimum level of care and integrity within critical infrastructure sectors, Wool noted.
Leave a Reply