US to offer companies broad standards to improve cybersecurity
Thursday, 13 February 2014 00:00
-
- {{hitsCtrl.values.hits}}
REUTERS: The US Government is expected on Wednesday to release the final version of voluntary standards meant to help US companies in nationally critical industries better protect themselves against cyber attacks.
Criticised in earlier drafts for being too vague and toothless, the so-called cybersecurity framework attempts to turn a vast amount of industry input into guidelines designed for 16 different sectors whose disruption could be devastating to the country.
Exactly one year after President Barack Obama issued an executive order directing a Commerce Department agency to compile voluntary minimum standards, the National Institute of Standards and Technology, or NIST, is due to issue guidelines, which companies have no obligation to adopt.
Drafters of the framework had to allay concerns by many in the private sector that their voluntary standards could someday become regulations. The threat of restrictive rules has helped stall progress on passing a cybersecurity law in Congress.
The framework, drafted by the non-regulatory NIST in consultation with thousands of industry experts, offers broad benchmarks for companies to measure the effectiveness of their cyber defences.
“The Federal Government has an overriding interest to protect critical infrastructure,” said Norma Krayem, a former official at the Transportation, State and Commerce departments who now works with infrastructure companies as a Senior Policy Adviser at law firm Patton Boggs.
“But they don’t own or control it, and at the moment, the cyber framework is the means to work collaboratively with critical infrastructure to address (cybersecurity) concerns.”
