NIST presents cybersecurity standard.

• Position: CYBERSECURITY

In February the U.S. Commerce Department's National Institute of Standards and Technology (NIST) released the first version of the "Framework for Improving Critical Infrastructure Cybersecurity." It was presented exactly one year after President Obama issued an executive order directing the agency to collaborate with industry to create a voluntary framework for managing cybersecurity-related risk.

According to NIST, the framework uses a common language to manage cybersecurity risk in a cost-effective way based on business needs without placing regulations on businesses. It focuses on using business drivers to guide cybersecurity activities and on considering cybersecurity risks as part of the risk-management process.

Per the executive order, the framework also provides guidance on how organizations can incorporate the protection of individual privacy and civil liberties into the program.

NIST has stressed that the framework is not a one-size-fits-all approach to managing cybersecurity risk. "Organizations will continue to have unique risks--different threats, different vulnerabilities, different risk tolerances--and how they implement the practices in the framework will vary."

The framework is generally regarded as a good first step, but some don't think it goes far enough. Ann M. Beauchesne, vice president of national security and emergency preparedness for the U.S...