Framework for Improving Critical Infrastructure Cybersecurity, Version 1.0
2014
Cybersecurity FrameworkVersion 1.0 used by organizations located outside the United States and can serve as a model for international cooperation on strengthening critical infrastructure cybersecurity.The Framework is not a one-size-fits-all approach to managing cybersecurity risk for critical infrastructure.Organizations will continue to have unique risks -different threats, different vulnerabilities, different risk tolerances -and how they implement the practices in the Framework will vary.Organizations can determine activities that are important to critical service delivery and can prioritize investments to maximize the impact of each dollar spent.Ultimately, the Framework is aimed at reducing and better managing cybersecurity risks.The Framework is a living document and will continue to be updated and improved as industry provides feedback on implementation.As the Framework is put into practice, lessons learned will be integrated into future versions.This will ensure it is meeting the needs of critical infrastructure owners and operators in a dynamic and challenging environment of new threats, risks, and solutions.Use of this voluntary Framework is the next step to improve the cybersecurity of our Nation's critical infrastructure -providing guidance for individual organizations, while increasing the cybersecurity posture of the Nation's critical infrastructure as a whole.