80_FR_77172 80 FR 76934 - Views on the Framework for Improving Critical Infrastructure Cybersecurity

80 FR 76934 - Views on the Framework for Improving Critical Infrastructure Cybersecurity

DEPARTMENT OF COMMERCE
National Institute of Standards and Technology

Federal Register Volume 80, Issue 238 (December 11, 2015)

Page Range76934-76936
FR Document2015-31217

The National Institute of Standards and Technology (NIST) is seeking information on the ``Framework for Improving Critical Infrastructure Cybersecurity'' (the ``Framework''). As directed by Executive Order 13636, ``Improving Critical Infrastructure Cybersecurity'' (the ``Executive Order''), the Framework consists of standards, methodologies, procedures, and processes that align policy, business, and technological approaches to address cyber risks. The Framework was released on February 12, 2014, after a year- long open process involving private and public sector organizations, including extensive industry input and public comments. In order to fulfill its responsibilities under the Cyber Security Enhancement Act of 2014, NIST is committed to maintaining an inclusive approach, informed by the views of a wide array of individuals, organizations, and sectors. In this RFI, NIST requests information about the variety of ways in which the Framework is being used to improve cybersecurity risk management, how best practices for using the Framework are being shared, the relative value of different parts of the Framework, the possible need for an update of the Framework, and options for the long- term governance of the Framework. This information is needed in order to carry out NIST's responsibilities under the Cybersecurity Enhancement Act of 2014 and the Executive Order. Responses to this RFI--which will be posted at http://www.nist.gov/ cyberframework/cybersecurity-framework-rfi.cfm--will inform NIST's planning and decision-making about how to further advance the Framework so that the Nation's critical infrastructure is more secure by enhancing its cybersecurity and risk management. All information provided will also assist in developing the agenda for a workshop on the Framework being planned by NIST for April 6 and 7, 2016, in Gaithersburg, Maryland. Specifics about the workshop will be announced at a later date.

Federal Register, Volume 80 Issue 238 (Friday, December 11, 2015)
[Federal Register Volume 80, Number 238 (Friday, December 11, 2015)]
[Notices]
[Pages 76934-76936]
From the Federal Register Online  [www.thefederalregister.org]
[FR Doc No: 2015-31217]


-----------------------------------------------------------------------

DEPARTMENT OF COMMERCE

National Institute of Standards and Technology

[Docket Number: 151103999-5999-01]


Views on the Framework for Improving Critical Infrastructure 
Cybersecurity

ACTION: Notice; Request for Information (RFI).

-----------------------------------------------------------------------

SUMMARY: The National Institute of Standards and Technology (NIST) is 
seeking information on the ``Framework for Improving Critical 
Infrastructure Cybersecurity'' (the ``Framework'').
    As directed by Executive Order 13636, ``Improving Critical 
Infrastructure Cybersecurity'' (the ``Executive Order''), the Framework 
consists of standards, methodologies, procedures, and processes that 
align policy, business, and technological approaches to address cyber 
risks. The Framework was released on February 12, 2014, after a year-
long open process involving private and public sector organizations, 
including extensive industry input and public comments. In order to 
fulfill its responsibilities under the Cyber Security Enhancement Act 
of 2014, NIST is committed to maintaining an inclusive approach, 
informed by the views of a wide array of individuals, organizations, 
and sectors.
    In this RFI, NIST requests information about the variety of ways in 
which the Framework is being used to improve cybersecurity risk 
management, how best practices for using the Framework are being 
shared, the relative value of different parts of the Framework, the 
possible need for an update of the Framework, and options for the long-
term governance of the Framework. This information is needed in order 
to carry out NIST's responsibilities under the Cybersecurity 
Enhancement Act of 2014 and the Executive Order.
    Responses to this RFI--which will be posted at http://www.nist.gov/cyberframework/cybersecurity-framework-rfi.cfm--will inform NIST's 
planning and decision-making about how to further advance the Framework 
so that the Nation's critical infrastructure is more secure by 
enhancing its cybersecurity and risk management.
    All information provided will also assist in developing the agenda 
for a workshop on the Framework being planned by NIST for April 6 and 
7, 2016, in Gaithersburg, Maryland. Specifics about the workshop will 
be announced at a later date.

DATES: Comments must be received by 5:00 p.m. Eastern time on February 
9, 2016.

ADDRESSES: Written comments may be submitted by mail to Diane 
Honeycutt, National Institute of Standards and Technology, 100 Bureau 
Drive, Stop 8930, Gaithersburg, MD 20899. Online submissions in 
electronic form may be sent to cyberframework@nist.gov in any of the 
following formats: HTML; ASCII; Word; RTF; or PDF. Please include your 
name and your organization's name (if any), and cite ``Views on the 
Framework for Improving Critical Infrastructure Cybersecurity'' in all 
correspondence. Comments containing references, studies, research, and 
other empirical data that are not widely published should include 
copies of the referenced materials. Please do not submit additional 
materials.
    All comments received in response to this RFI will be posted at 
http://www.nist.gov/cyberframework/cybersecurity-framework-rfi.cfm 
without change or redaction, so commenters should not include 
information they do not wish to be posted (e.g., personal or 
confidential business information).

FOR FURTHER INFORMATION CONTACT: For questions about this RFI contact: 
Diane Honeycutt, National Institute of Standards and Technology, 100 
Bureau Drive, Stop 8930, Gaithersburg, MD 20899 or 
cyberframework@nist.gov. Please direct media inquiries to NIST's Office 
of Public Affairs at (301) 975-2762.

SUPPLEMENTARY INFORMATION: NIST is authorized by the Cybersecurity 
Enhancement Act of 2014 \1\ to ``facilitate and support the development 
of a voluntary, consensus-based, industry-led set of standards, 
guidelines, best practices, methodologies, procedures, and processes to 
cost-effectively reduce cyber risks to critical infrastructure.'' \2\ 
In carrying out this function, NIST is directed to ``coordinate closely 
and regularly with relevant private sector personnel and entities, 
critical infrastructure owners and operators, and other relevant 
industry organizations.'' \3\ NIST has taken this approach since 
February 2013 when Executive Order 13636, ``Improving Critical 
Infrastructure Cybersecurity'' \4\ tasked the Secretary of Commerce to 
direct the Director of NIST to lead the development of the Framework.
---------------------------------------------------------------------------

    \1\ Public Law 113-274 (2014): http://www.thefederalregister.org/fdsys/pkg/PLAW-113publ274/pdf/PLAW-113publ274.pdf.
    \2\ Id., codified in relevant part at 15 U.S.C. 272(c)(15). 
Congress's intent was to codify NIST's role in Executive Order No. 
13636: ``Title I would codify certain elements of Executive Order 
13636 by directing the National Institute of Standards and 
Technology (NIST) to develop a framework of voluntary standards 
designed to reduce risks arising from cyberattacks on critical 
infrastructure that is privately owned and operated.'' S. Rep. No. 
113-270, at 9 (2014).
    \3\ Id., codified in relevant part at 15 U.S.C. 272(e)(A)(i).
    \4\ Exec. Order No. 13636, Improving Critical Infrastructure 
Cybersecurity, 78 FR 11739 (Feb. 19, 2013).
---------------------------------------------------------------------------

    NIST developed the Framework by using information collected through 
a Request for Information (RFI) that was published in the Federal 
Register (78 FR 13024) on February 26, 2013; a series of five open 
public workshops; \5\ and a 45-day public comment period in response to 
a draft version of the Framework announced in the Federal Register (78 
FR 64478) on October 29, 2013. A final version of Framework 1.0 was 
published on February 12, 2014, after a year-long, open process 
involving private and public sector organizations, including extensive 
industry input and public comments, and announced in the Federal 
Register (79 FR 9167) on February 18, 2014. NIST subsequently solicited 
information on Framework users' experiences through an RFI published in 
the Federal Register (79 FR 50891) on August 26, 2014 as well as 
another workshop held on October 29 and 30, 2014, at the University of 
South Florida.
---------------------------------------------------------------------------

    \5\ NIST, Gaithersburg April 3, 2013; Carnegie Mellon University 
May 29-31, 2013; University of California San Diego July 10-12, 
2013; University of Texas Dallas September 11-13, 2013; North 
Carolina State November 14-15, 2013.
---------------------------------------------------------------------------

    In addition to extensive outreach and providing responses to 
inquiries, NIST has made information about the Cybersecurity Framework 
available on its Web site at http://www.nist.gov/cyberframework/ to 
assist organizations in learning more about using the Framework. This 
includes an Industry Resources page (available at http://www.nist.gov/cyberframework/cybersecurity-framework-industry-resources.cfm), listing 
publicly available materials developed by organizations other than NIST 
that support use of the Framework. NIST does not necessarily

[[Page 76935]]

endorse, approve, or recommend any of the commercial entities, 
equipment, or materials listed on the Industry Resources page, nor does 
it imply that the entities, materials, or equipment are necessarily the 
best available for the purpose.
    Since the Framework's release as version 1.0, NIST has continued to 
work on topics raised during the Framework's development but not 
integrated into version 1.0 of the Framework. These are listed in the 
NIST Roadmap for Improving Critical Infrastructure Cybersecurity. 
Significant progress has been made in several of these areas, through 
programs like the National Initiative for Cybersecurity Education and 
the National Strategy for Trusted Identities in Cyberspace.

Request for Information

    Continuing its inclusive approach, in advance of any decision 
regarding possible updates of the Framework and Framework stewardship, 
NIST is interested in hearing from all stakeholders.\6\
---------------------------------------------------------------------------

    \6\ The Cybersecurity Enhancement Act of 2014, Public Law 113-
274 (2014), codified in relevant part at 15 U.S.C. 272(e)(A)(i) and 
272(e)(A)(ii) specifically calls for NIST to ``coordinate closely 
and regularly with relevant private sector personnel and entities, 
critical infrastructure owners and operators, and other relevant 
industry organizations, including Sector Coordinating Councils and 
Information Sharing and Analysis Centers, and incorporate industry 
expertise'' and to ``consult with the heads of agencies with 
national security responsibilities, sector-specific agencies and 
other appropriate agencies, State and local governments, the 
governments of other nations, and international organizations.''
---------------------------------------------------------------------------

    In this RFI, NIST seeks specific information about the variety of 
ways in which the Framework is being used and the relative value of 
different parts of the Framework, the possible need for an update of 
the Framework, how best practices for using the Framework are being 
shared and might be enhanced, and the long-term governance of 
Framework. This information is needed to carry out NIST's statutory 
responsibilities with the ultimate goal of assisting organizations as 
they seek to improve their cybersecurity risk management practices.
    Comments containing references, studies, research, and other 
empirical data that are not widely published should include copies of 
the referenced materials. Do not include in comments or otherwise 
submit proprietary or confidential information, as all comments 
received in response to this RFI will be made available publicly at 
http://www.nist.gov/cyberframework/cybersecurity-framework-rfi.cfm.
    Respondents may organize their submissions in response to this RFI 
using the template available at http://www.nist.gov/cyberframework/cybersecurity-framework-rfi.cfm. Use of this template is not required 
and all responses that comply with the requirements listed in the 
ADDRESSES and DATES section of this notice will be considered whether 
or not the template is used.
    While the Framework and associated outreach activities by NIST have 
focused on critical infrastructure, this RFI generally uses the broader 
term ``organizations'' in seeking information.
    The following questions cover the major areas about which NIST 
seeks comment. They are not intended to limit the topics that may be 
addressed. Responses may include any topic believed to have 
implications for the voluntary use and subsequent improvement of the 
Framework, regardless of whether the topic is included in this 
document.
Use of the Framework
    1. Describe your organization and its interest in the Framework.
    2. Indicate whether you are responding as a Framework user/non-
user, subject matter expert, or whether you represent multiple 
organizations that are or are not using the Framework.
    3. If your organization uses the Framework, how do you use it? 
(e.g., internal management and communications, vendor management, C-
suite communication).
    4. What has been your organization's experience utilizing specific 
portions of the Framework (e.g., Core, Profile, Implementation Tiers, 
Privacy Methodology)?
    5. What portions of the Framework are most useful?
    6. What portions of the Framework are least useful?
    7. Has your organization's use of the Framework been limited in any 
way? If so, what is limiting your use of the Framework (e.g., sector 
circumstance, organizational factors, Framework features, lack of 
awareness)?
    8. To what extent do you believe the Framework has helped reduce 
your cybersecurity risk? Please cite the metrics you use to track such 
reductions, if any.
    9. What steps should be taken to ``prevent duplication of 
regulatory processes and prevent conflict with or superseding of 
regulatory requirements, mandatory standards, and related processes'' 
as required by the Cybersecurity Enhancement Act of 2014? \7\
---------------------------------------------------------------------------

    \7\ Id., codified in relevant part at 15 U.S.C. 
272(e)(1)(A)(vii).
---------------------------------------------------------------------------

Possible Framework Updates
    10. Should the Framework be updated? Why or why not?
    11. What portions of the Framework (if any) should be changed or 
removed? What elements (if any) should be added to the Framework? 
Please be as specific as possible.
    12. Are there additions, updates or changes to the Framework's 
references to cybersecurity standards, guidelines, and practices that 
should be considered for the update to the Framework?
    13. Are there approaches undertaken by organizations--including 
those documented in sector-wide implementation guides--that could help 
other sectors or organizations if they were incorporated into the 
Framework?
    14. Should developments made in the nine areas identified by NIST 
in its Framework-related ``Roadmap'' \8\ be used to inform any updates 
to the Framework? If so, how?
---------------------------------------------------------------------------

    \8\ NIST Roadmap for Improving Critical Infrastructure 
Cybersecurity (February 12, 2014), Roadmap areas for Development, 
Alignment, and Collaboration include: Authentication; automated 
indicator sharing; conformity assessment; cybersecurity workforce; 
data analytics; federal agency cybersecurity alignment; 
international aspects, impacts, and alignment; supply chain risk 
management; and technical privacy standards. http://www.nist.gov/cyberframework/upload/roadmap-021214.pdf.
---------------------------------------------------------------------------

    15. What is the best way to update the Framework while minimizing 
disruption for those currently using the Framework?
Sharing Information on Using the Framework
    16. Has information that has been shared by NIST or others affected 
your use the Framework? If so, please describe briefly what those 
resources are and what the effect has been on your use of the 
Framework. What resources, if any, have been most useful?
    17. What, if anything, is inhibiting the sharing of best practices?
    18. What steps could the U.S. government take to increase sharing 
of best practices?
    19. What kind of program would help increase the likelihood that 
organizations would share information about their experiences, or the 
depth and breadth of information sharing (e.g., peer-recognition, trade 
association, consortia, federal agency)?
Private Sector Involvement in the Future Governance of the Framework
    20. What should be the private sector's involvement in the future 
governance of the Framework?
    21. Should NIST consider transitioning some or even all of the

[[Page 76936]]

Framework's coordination to another organization?
    22. If so, what might be transitioned (e.g., all, Core, Profile, 
Implementation Tiers, Informative References, methodologies)?
    23. If so, to what kind of organization (e.g., not-for-profit, for-
profit; U.S. organization, multinational organization) could it be 
transitioned, and could it be self-sustaining?
    24. How might any potential transition affect those currently using 
the Framework? In the event of a transition, what steps might be taken 
to minimize or prevent disruption for those currently using the 
Framework?
    25. What factors should be used to evaluate whether the transition 
partner (or partners) has the capacity to work closely and effectively 
with domestic and international organizations and governments, in light 
of the importance of aligning cybersecurity standards, guidelines, and 
practices within the United States and globally?

Richard Cavanagh,
Acting Associate Director for Laboratory Programs.
[FR Doc. 2015-31217 Filed 12-10-15; 8:45 am]
BILLING CODE 3510-13-P



                                                  76934                       Federal Register / Vol. 80, No. 238 / Friday, December 11, 2015 / Notices

                                                  than 5:00 p.m. EST on January 12, 2016.                 framework-rfi.cfm—will inform NIST’s                  In carrying out this function, NIST is
                                                  Comments received after January 12,                     planning and decision-making about                    directed to ‘‘coordinate closely and
                                                  2016, will be distributed to the                        how to further advance the Framework                  regularly with relevant private sector
                                                  Committee, but may not be considered                    so that the Nation’s critical                         personnel and entities, critical
                                                  at the meetings. The minutes of the                     infrastructure is more secure by                      infrastructure owners and operators,
                                                  meetings will be posted on the                          enhancing its cybersecurity and risk                  and other relevant industry
                                                  Committee Web site within 60 days of                    management.                                           organizations.’’ 3 NIST has taken this
                                                  the meeting.                                              All information provided will also                  approach since February 2013 when
                                                    Dated: December 7, 2015.                              assist in developing the agenda for a                 Executive Order 13636, ‘‘Improving
                                                  David Long,                                             workshop on the Framework being                       Critical Infrastructure Cybersecurity’’ 4
                                                                                                          planned by NIST for April 6 and 7,                    tasked the Secretary of Commerce to
                                                  Director, Office of Supply Chain and
                                                  Professional & Business Services.                       2016, in Gaithersburg, Maryland.                      direct the Director of NIST to lead the
                                                                                                          Specifics about the workshop will be                  development of the Framework.
                                                  [FR Doc. 2015–31195 Filed 12–10–15; 8:45 am]
                                                                                                          announced at a later date.                               NIST developed the Framework by
                                                  BILLING CODE 3510–DR–P
                                                                                                          DATES: Comments must be received by                   using information collected through a
                                                                                                          5:00 p.m. Eastern time on February 9,                 Request for Information (RFI) that was
                                                                                                          2016.                                                 published in the Federal Register (78
                                                  DEPARTMENT OF COMMERCE
                                                                                                                                                                FR 13024) on February 26, 2013; a series
                                                                                                          ADDRESSES:   Written comments may be                  of five open public workshops; 5 and a
                                                  National Institute of Standards and
                                                                                                          submitted by mail to Diane Honeycutt,                 45-day public comment period in
                                                  Technology
                                                                                                          National Institute of Standards and                   response to a draft version of the
                                                  [Docket Number: 151103999–5999–01]                      Technology, 100 Bureau Drive, Stop                    Framework announced in the Federal
                                                                                                          8930, Gaithersburg, MD 20899. Online                  Register (78 FR 64478) on October 29,
                                                  Views on the Framework for Improving                    submissions in electronic form may be                 2013. A final version of Framework 1.0
                                                  Critical Infrastructure Cybersecurity                   sent to cyberframework@nist.gov in any                was published on February 12, 2014,
                                                                                                          of the following formats: HTML; ASCII;                after a year-long, open process involving
                                                  ACTION:   Notice; Request for Information
                                                                                                          Word; RTF; or PDF. Please include your                private and public sector organizations,
                                                  (RFI).
                                                                                                          name and your organization’s name (if                 including extensive industry input and
                                                  SUMMARY:    The National Institute of                   any), and cite ‘‘Views on the Framework               public comments, and announced in the
                                                  Standards and Technology (NIST) is                      for Improving Critical Infrastructure                 Federal Register (79 FR 9167) on
                                                  seeking information on the ‘‘Framework                  Cybersecurity’’ in all correspondence.                February 18, 2014. NIST subsequently
                                                  for Improving Critical Infrastructure                   Comments containing references,                       solicited information on Framework
                                                  Cybersecurity’’ (the ‘‘Framework’’).                    studies, research, and other empirical                users’ experiences through an RFI
                                                     As directed by Executive Order                       data that are not widely published                    published in the Federal Register (79
                                                  13636, ‘‘Improving Critical                             should include copies of the referenced               FR 50891) on August 26, 2014 as well
                                                  Infrastructure Cybersecurity’’ (the                     materials. Please do not submit                       as another workshop held on October 29
                                                  ‘‘Executive Order’’), the Framework                     additional materials.                                 and 30, 2014, at the University of South
                                                  consists of standards, methodologies,                     All comments received in response to                Florida.
                                                  procedures, and processes that align                    this RFI will be posted at http://                       In addition to extensive outreach and
                                                  policy, business, and technological                     www.nist.gov/cyberframework/                          providing responses to inquiries, NIST
                                                  approaches to address cyber risks. The                  cybersecurity-framework-rfi.cfm without               has made information about the
                                                  Framework was released on February                      change or redaction, so commenters                    Cybersecurity Framework available on
                                                  12, 2014, after a year-long open process                should not include information they do                its Web site at http://www.nist.gov/
                                                  involving private and public sector                     not wish to be posted (e.g., personal or              cyberframework/ to assist organizations
                                                  organizations, including extensive                      confidential business information).                   in learning more about using the
                                                  industry input and public comments. In                  FOR FURTHER INFORMATION CONTACT: For                  Framework. This includes an Industry
                                                  order to fulfill its responsibilities under             questions about this RFI contact: Diane               Resources page (available at http://
                                                  the Cyber Security Enhancement Act of                   Honeycutt, National Institute of                      www.nist.gov/cyberframework/
                                                  2014, NIST is committed to maintaining                  Standards and Technology, 100 Bureau                  cybersecurity-framework-industry-
                                                  an inclusive approach, informed by the                  Drive, Stop 8930, Gaithersburg, MD                    resources.cfm), listing publicly available
                                                  views of a wide array of individuals,                   20899 or cyberframework@nist.gov.                     materials developed by organizations
                                                  organizations, and sectors.                             Please direct media inquiries to NIST’s               other than NIST that support use of the
                                                     In this RFI, NIST requests information               Office of Public Affairs at (301) 975–                Framework. NIST does not necessarily
                                                  about the variety of ways in which the                  2762.
                                                  Framework is being used to improve                                                                            role in Executive Order No. 13636: ‘‘Title I would
                                                  cybersecurity risk management, how                      SUPPLEMENTARY INFORMATION:       NIST is              codify certain elements of Executive Order 13636
                                                  best practices for using the Framework                  authorized by the Cybersecurity                       by directing the National Institute of Standards and
                                                                                                          Enhancement Act of 2014 1 to ‘‘facilitate             Technology (NIST) to develop a framework of
                                                  are being shared, the relative value of                                                                       voluntary standards designed to reduce risks arising
                                                  different parts of the Framework, the                   and support the development of a                      from cyberattacks on critical infrastructure that is
                                                  possible need for an update of the                      voluntary, consensus-based, industry-                 privately owned and operated.’’ S. Rep. No. 113–
                                                  Framework, and options for the long-                    led set of standards, guidelines, best                270, at 9 (2014).
                                                                                                                                                                   3 Id., codified in relevant part at 15 U.S.C.
                                                                                                          practices, methodologies, procedures,
jstallworth on DSK7TPTVN1PROD with NOTICES




                                                  term governance of the Framework. This                                                                        272(e)(A)(i).
                                                  information is needed in order to carry                 and processes to cost-effectively reduce                 4 Exec. Order No. 13636, Improving Critical

                                                  out NIST’s responsibilities under the                   cyber risks to critical infrastructure.’’ 2           Infrastructure Cybersecurity, 78 FR 11739 (Feb. 19,
                                                  Cybersecurity Enhancement Act of 2014                                                                         2013).
                                                                                                            1 Public Law 113–274 (2014): http://                   5 NIST, Gaithersburg April 3, 2013; Carnegie
                                                  and the Executive Order.                                www.gpo.gov/fdsys/pkg/PLAW-113publ274/pdf/            Mellon University May 29–31, 2013; University of
                                                     Responses to this RFI—which will be                  PLAW-113publ274.pdf.                                  California San Diego July 10–12, 2013; University
                                                  posted at http://www.nist.gov/                            2 Id., codified in relevant part at 15 U.S.C.       of Texas Dallas September 11–13, 2013; North
                                                  cyberframework/cybersecurity-                           272(c)(15). Congress’s intent was to codify NIST’s    Carolina State November 14–15, 2013.



                                             VerDate Sep<11>2014   14:55 Dec 10, 2015   Jkt 238001   PO 00000   Frm 00009   Fmt 4703   Sfmt 4703   E:\FR\FM\11DEN1.SGM   11DEN1


                                                                              Federal Register / Vol. 80, No. 238 / Friday, December 11, 2015 / Notices                                                    76935

                                                  endorse, approve, or recommend any of                   using the template available at http://                Possible Framework Updates
                                                  the commercial entities, equipment, or                  www.nist.gov/cyberframework/                              10. Should the Framework be
                                                  materials listed on the Industry                        cybersecurity-framework-rfi.cfm. Use of                updated? Why or why not?
                                                  Resources page, nor does it imply that                  this template is not required and all                     11. What portions of the Framework
                                                  the entities, materials, or equipment are               responses that comply with the                         (if any) should be changed or removed?
                                                  necessarily the best available for the                  requirements listed in the ADDRESSES                   What elements (if any) should be added
                                                  purpose.                                                and DATES section of this notice will be               to the Framework? Please be as specific
                                                     Since the Framework’s release as                     considered whether or not the template
                                                  version 1.0, NIST has continued to work                                                                        as possible.
                                                                                                          is used.                                                  12. Are there additions, updates or
                                                  on topics raised during the Framework’s                    While the Framework and associated
                                                  development but not integrated into                                                                            changes to the Framework’s references
                                                                                                          outreach activities by NIST have                       to cybersecurity standards, guidelines,
                                                  version 1.0 of the Framework. These are                 focused on critical infrastructure, this
                                                  listed in the NIST Roadmap for                                                                                 and practices that should be considered
                                                                                                          RFI generally uses the broader term                    for the update to the Framework?
                                                  Improving Critical Infrastructure                       ‘‘organizations’’ in seeking information.
                                                  Cybersecurity. Significant progress has                                                                           13. Are there approaches undertaken
                                                                                                             The following questions cover the
                                                  been made in several of these areas,                                                                           by organizations—including those
                                                                                                          major areas about which NIST seeks
                                                  through programs like the National                                                                             documented in sector-wide
                                                                                                          comment. They are not intended to limit
                                                  Initiative for Cybersecurity Education                                                                         implementation guides—that could help
                                                                                                          the topics that may be addressed.
                                                  and the National Strategy for Trusted                                                                          other sectors or organizations if they
                                                                                                          Responses may include any topic
                                                  Identities in Cyberspace.                                                                                      were incorporated into the Framework?
                                                                                                          believed to have implications for the
                                                                                                                                                                    14. Should developments made in the
                                                  Request for Information                                 voluntary use and subsequent
                                                                                                                                                                 nine areas identified by NIST in its
                                                                                                          improvement of the Framework,
                                                    Continuing its inclusive approach, in                                                                        Framework-related ‘‘Roadmap’’ 8 be
                                                                                                          regardless of whether the topic is
                                                  advance of any decision regarding                                                                              used to inform any updates to the
                                                                                                          included in this document.
                                                  possible updates of the Framework and                                                                          Framework? If so, how?
                                                  Framework stewardship, NIST is                          Use of the Framework                                      15. What is the best way to update the
                                                  interested in hearing from all                             1. Describe your organization and its               Framework while minimizing
                                                  stakeholders.6                                          interest in the Framework.                             disruption for those currently using the
                                                    In this RFI, NIST seeks specific                         2. Indicate whether you are                         Framework?
                                                  information about the variety of ways in                responding as a Framework user/non-                    Sharing Information on Using the
                                                  which the Framework is being used and                   user, subject matter expert, or whether                Framework
                                                  the relative value of different parts of                you represent multiple organizations
                                                  the Framework, the possible need for an                 that are or are not using the Framework.                  16. Has information that has been
                                                  update of the Framework, how best                          3. If your organization uses the                    shared by NIST or others affected your
                                                  practices for using the Framework are                   Framework, how do you use it? (e.g.,                   use the Framework? If so, please
                                                  being shared and might be enhanced,                     internal management and                                describe briefly what those resources are
                                                  and the long-term governance of                         communications, vendor management,                     and what the effect has been on your
                                                  Framework. This information is needed                   C-suite communication).                                use of the Framework. What resources,
                                                  to carry out NIST’s statutory                              4. What has been your organization’s                if any, have been most useful?
                                                  responsibilities with the ultimate goal of              experience utilizing specific portions of                 17. What, if anything, is inhibiting the
                                                  assisting organizations as they seek to                 the Framework (e.g., Core, Profile,                    sharing of best practices?
                                                  improve their cybersecurity risk                        Implementation Tiers, Privacy                             18. What steps could the U.S.
                                                  management practices.                                   Methodology)?                                          government take to increase sharing of
                                                    Comments containing references,                          5. What portions of the Framework                   best practices?
                                                  studies, research, and other empirical                  are most useful?                                          19. What kind of program would help
                                                  data that are not widely published                         6. What portions of the Framework                   increase the likelihood that
                                                  should include copies of the referenced                 are least useful?                                      organizations would share information
                                                  materials. Do not include in comments                      7. Has your organization’s use of the               about their experiences, or the depth
                                                  or otherwise submit proprietary or                      Framework been limited in any way? If                  and breadth of information sharing (e.g.,
                                                  confidential information, as all                        so, what is limiting your use of the                   peer-recognition, trade association,
                                                  comments received in response to this                   Framework (e.g., sector circumstance,                  consortia, federal agency)?
                                                  RFI will be made available publicly at                  organizational factors, Framework
                                                  http://www.nist.gov/cyberframework/                                                                            Private Sector Involvement in the
                                                                                                          features, lack of awareness)?                          Future Governance of the Framework
                                                  cybersecurity-framework-rfi.cfm.                           8. To what extent do you believe the
                                                    Respondents may organize their                        Framework has helped reduce your                          20. What should be the private
                                                  submissions in response to this RFI                     cybersecurity risk? Please cite the                    sector’s involvement in the future
                                                                                                          metrics you use to track such                          governance of the Framework?
                                                     6 The Cybersecurity Enhancement Act of 2014,
                                                                                                          reductions, if any.                                       21. Should NIST consider
                                                  Public Law 113–274 (2014), codified in relevant
                                                  part at 15 U.S.C. 272(e)(A)(i) and 272(e)(A)(ii)           9. What steps should be taken to                    transitioning some or even all of the
                                                  specifically calls for NIST to ‘‘coordinate closely     ‘‘prevent duplication of regulatory
                                                  and regularly with relevant private sector personnel    processes and prevent conflict with or                   8 NIST Roadmap for Improving Critical

                                                  and entities, critical infrastructure owners and                                                               Infrastructure Cybersecurity (February 12, 2014),
jstallworth on DSK7TPTVN1PROD with NOTICES




                                                  operators, and other relevant industry                  superseding of regulatory requirements,                Roadmap areas for Development, Alignment, and
                                                  organizations, including Sector Coordinating            mandatory standards, and related                       Collaboration include: Authentication; automated
                                                  Councils and Information Sharing and Analysis           processes’’ as required by the                         indicator sharing; conformity assessment;
                                                  Centers, and incorporate industry expertise’’ and to    Cybersecurity Enhancement Act of                       cybersecurity workforce; data analytics; federal
                                                  ‘‘consult with the heads of agencies with national                                                             agency cybersecurity alignment; international
                                                  security responsibilities, sector-specific agencies     2014? 7                                                aspects, impacts, and alignment; supply chain risk
                                                  and other appropriate agencies, State and local                                                                management; and technical privacy standards.
                                                  governments, the governments of other nations, and        7 Id., codified in relevant part at 15 U.S.C.        http://www.nist.gov/cyberframework/upload/
                                                  international organizations.’’                          272(e)(1)(A)(vii).                                     roadmap-021214.pdf.



                                             VerDate Sep<11>2014   14:55 Dec 10, 2015   Jkt 238001   PO 00000   Frm 00010   Fmt 4703    Sfmt 4703   E:\FR\FM\11DEN1.SGM   11DEN1


                                                  76936                       Federal Register / Vol. 80, No. 238 / Friday, December 11, 2015 / Notices

                                                  Framework’s coordination to another                     FOR FURTHER INFORMATION CONTACT:                        Estimated Time per Response: 15
                                                  organization?                                           Direct requests for additional                        minutes per permit application; 20
                                                     22. If so, what might be transitioned                information or copies of the information              minutes per logsheet form.
                                                  (e.g., all, Core, Profile, Implementation               collection instrument and instructions                  Estimated Total Annual Burden
                                                  Tiers, Informative References,                          to Walter Ikehara, (808) 725–5175 or                  Hours: 40.
                                                  methodologies)?                                         Walter.Ikehara@noaa.gov.                                Estimated Total Annual Cost to
                                                     23. If so, to what kind of organization              SUPPLEMENTARY INFORMATION:
                                                                                                                                                                Public: $100 in recordkeeping/reporting
                                                  (e.g., not-for-profit, for-profit; U.S.                                                                       costs.
                                                  organization, multinational                             I. Abstract
                                                                                                                                                                IV. Request for Comments
                                                  organization) could it be transitioned,                   This request is for extension of a                     Comments are invited on: (a) Whether
                                                  and could it be self-sustaining?                        current information collection.                       the proposed collection of information
                                                     24. How might any potential                            The National Marine Fisheries Service               is necessary for the proper performance
                                                  transition affect those currently using                 (NMFS) manages fishing activities in the              of the functions of the agency, including
                                                  the Framework? In the event of a                        Rose Atoll Marine, Marianas Trench,                   whether the information shall have
                                                  transition, what steps might be taken to                and Pacific Remote Islands Marine                     practical utility; (b) the accuracy of the
                                                  minimize or prevent disruption for                      National Monuments. Regulations at 50                 agency’s estimate of the burden
                                                  those currently using the Framework?                    CFR part 665 require the owner and                    (including hours and cost) of the
                                                     25. What factors should be used to                   operator of a vessel used to non-                     proposed collection of information; (c)
                                                  evaluate whether the transition partner                 commercially fish for, take, retain, or               ways to enhance the quality, utility, and
                                                  (or partners) has the capacity to work                  possess any management unit species in                clarity of the information to be
                                                  closely and effectively with domestic                   these monuments to hold a valid permit.               collected; and (d) ways to minimize the
                                                  and international organizations and                       Regulations also require the owner                  burden of the collection of information
                                                  governments, in light of the importance                 and operator of a vessel that is chartered            on respondents, including through the
                                                  of aligning cybersecurity standards,                    to fish recreationally for, take, retain, or          use of automated collection techniques
                                                  guidelines, and practices within the                    possess, any management unit species                  or other forms of information
                                                  United States and globally?                             in these monuments to hold a valid                    technology.
                                                  Richard Cavanagh,                                       permit. The fishing vessel must be                       Comments submitted in response to
                                                                                                          registered to the permit. The charter                 this notice will be summarized and/or
                                                  Acting Associate Director for Laboratory
                                                  Programs.                                               business must be established legally in               included in the request for OMB
                                                                                                          the permit area where it will operate.                approval of this information collection;
                                                  [FR Doc. 2015–31217 Filed 12–10–15; 8:45 am]
                                                                                                          Charter vessel clients are not required to            they also will become a matter of public
                                                  BILLING CODE 3510–13–P
                                                                                                          have a permit.                                        record.
                                                                                                            The permit application collects basic
                                                                                                                                                                  Dated: December 7, 2015.
                                                  DEPARTMENT OF COMMERCE                                  information about the permit applicant,
                                                                                                          type of operation, vessel, and permit                 Sarah Brabson,
                                                                                                          area. NMFS uses this information to                   NOAA PRA Clearance Officer.
                                                  National Oceanic and Atmospheric
                                                                                                          determine permit eligibility. The                     [FR Doc. 2015–31164 Filed 12–10–15; 8:45 am]
                                                  Administration
                                                                                                          information is important for                          BILLING CODE 3510–22–P
                                                  Proposed Information Collection;                        understanding the nature of the fishery
                                                  Comment Request; Permit and                             and provides a link to participants. It
                                                  Reporting Requirements for Non-                         also aids in the enforcement of Fishery               DEPARTMENT OF COMMERCE
                                                  Commercial Fishing in the Rose Atoll,                   Ecosystem Plan measures.
                                                                                                                                                                National Oceanic and Atmospheric
                                                  Marianas Trench, and Pacific Remote                       Regulations also require the vessel                 Administration
                                                  Islands Marine National Monuments                       operator to report a complete record of
                                                                                                          catch, effort, and other data on a NMFS               RIN 0648–XD065
                                                  AGENCY: National Oceanic and                            logsheet. The vessel operator must
                                                  Atmospheric Administration (NOAA),                      record all requested information on the               Takes of Marine Mammals Incidental to
                                                  Commerce.                                               logsheet within 24 hours of the                       Specified Activities; Taking Marine
                                                  ACTION: Notice.                                         completion of each fishing day. The                   Mammals Incidental to Murray Street
                                                                                                          vessel operator also must sign, date, and             Bridge Seismic Retrofit Project by the
                                                  SUMMARY:    The Department of                                                                                 California State Department of
                                                                                                          submit the form to NMFS within 30
                                                  Commerce, as part of its continuing                                                                           Transportation
                                                                                                          days of the end of each fishing trip.
                                                  effort to reduce paperwork and
                                                  respondent burden, invites the general                  II. Method of Collection                              AGENCY:  National Marine Fisheries
                                                  public and other Federal agencies to                                                                          Service (NMFS), National Oceanic and
                                                                                                            NMFS collects information on paper                  Atmospheric Administration (NOAA),
                                                  take this opportunity to comment on                     permit applications and logsheets.
                                                  proposed and/or continuing information                                                                        Commerce.
                                                  collections, as required by the                         III. Data                                             ACTION: Notice; proposed incidental
                                                  Paperwork Reduction Act of 1995.                                                                              harassment authorization; request for
                                                                                                            OMB Control Number: 0648–0664.
                                                  DATES: Written comments must be
                                                                                                                                                                comments and information.
                                                                                                            Form Number(s): None.
                                                  submitted on or before February 9, 2016.                  Type of Review: Regular (extension of               SUMMARY:   NMFS has received an
jstallworth on DSK7TPTVN1PROD with NOTICES




                                                  ADDRESSES: Direct all written comments                  a currently approved information                      application from California State
                                                  to Jennifer Jessup, Departmental                        collection).                                          Department of Transportation (Caltrans)
                                                  Paperwork Clearance Officer,                              Affected Public: Business or other for-             for an Incidental Harassment
                                                  Department of Commerce, Room 6616,                      profit organizations, individuals or                  Authorization (IHA) to take marine
                                                  14th and Constitution Avenue NW.,                       households.                                           mammals, by harassment, incidental to
                                                  Washington, DC 20230 (or via the                          Estimated Number of Respondents:                    Murray Street Bridge seismic retrofit
                                                  Internet at JJessup@doc.gov).                           25.                                                   project in Santa Cruz, California.


                                             VerDate Sep<11>2014   14:55 Dec 10, 2015   Jkt 238001   PO 00000   Frm 00011   Fmt 4703   Sfmt 4703   E:\FR\FM\11DEN1.SGM   11DEN1



Document Created: 2018-03-02 09:12:52
Document Modified: 2018-03-02 09:12:52
CategoryRegulatory Information
CollectionFederal Register
sudoc ClassAE 2.7:
GS 4.107:
AE 2.106:
PublisherOffice of the Federal Register, National Archives and Records Administration
SectionNotices
ActionNotice; Request for Information (RFI).
DatesComments must be received by 5:00 p.m. Eastern time on February 9, 2016.
ContactFor questions about this RFI contact: Diane Honeycutt, National Institute of Standards and Technology, 100 Bureau Drive, Stop 8930, Gaithersburg, MD 20899 or [email protected] Please direct media inquiries to NIST's Office of Public Affairs at (301) 975-2762.
FR Citation80 FR 76934 

2024 Federal Register | Disclaimer | Privacy Policy
USC | CFR | eCFR