Fort Walton Beach Resolution — 2024-16 Adopting the National Institute of Standards Cybersecurity Framework — reading text

RESOLUTION 2024- 16 A RESOLUTION OF THE CITY COUNCIL OF THE CITY OF FORT WALTON BEACH, FLORIDA, ADOPTING THE NATIONAL INSTITUTE OF STANDARDS AND TECHNOLOGY' S CYBERSECURITY FRAMEWORK AS THE CYBERSECURITY STANDARD FOR THE CITY OF FORT WALTON BEACH, FLORIDA; PROVIDING AN EFFECTIVE DATE. WHEREAS, Florida Statute 282. 3185, the " Local Government Cybersecurity Act," establishes cybersecurity requirements for county and municipal governments; and WHEREAS, Florida Statute 282. 3185 ( 4) states, " Each local government shall adopt cybersecurity standards that safeguard its data, information technology, and information technology resources to ensure availability, confidentiality, and integrity. The cybersecurity standards must be consistent with generally accepted best practices for cybersecurity, including the National Institute of Standards and Technology Cybersecurity Framework;" and WHEREAS, Florida Statute 282. 3185 ( 4) requires municipalities with a population of less than 25, 000 to adopt a cybersecurity standard by January 1, 2025; and WHEREAS, the Information Technology Department of the City of Fort Walton Beach, Florida, has selected the National Institute of Standards and Technology' s Cybersecurity Framework as a baseline cybersecurity standard to which all cybersecurity policies of the City of Fort Walton Beach, Florida, will adhere. NOW, THEREFORE, BE IT RESOLVED THAT THE CITY COUNCIL OF THE CITY OF FORT WALTON BEACH, FLORIDA: SECTION 1. Adoption of Nationally Recognized Cybersecurity Framework That the National Institute of Standards and Technology' s Cybersecurity Framework shall be the guiding cybersecurity standard for all cybersecurity policies adopted by the City of Fort Walton Beach, Florida and the Information Technology Department. SECTION 2. Minimal Limitations That the City of Fort Walton Beach, Florida and the Information Technology Department may further use any standards, guidelines, and best practices from within any generally accepted cybersecurity standard to establish cybersecurity policies for the City of Fort Walton Beach, providing all such policies are as stringent or more stringent than those provided by the National Institute of Standards and Technology' s Cybersecurity Framework. SECTION 2. Effective Date This Resolution shall become effective upon adoption by City Council and signature of the Mayor.  RESOLUTION 4- 16 Adopted: Alo me i Nic Allegrettyor Pro T Attest: Approved as to legal form and sufficiency for the City of Fort Walton Beach, only. Kim . Barnes, City Clerk Kimberly Romano Kopp, City Attorney  J 0 The NIST Cybersecurity Framework ( CSF) 2, 0 NIST CSWP 29 The NIST Cybersecurity Framework ( CSF) 2. 0 February 26, 2024 Abstract The NIST Cybersecurity Framework (CSF) 2. 0 provides guidance to industry, government agencies, and other organizations to manage cybersecurity risks. It offers a taxonomy of high- level cybersecurity outcomes that can be used by any organization — regardless of its size, sector, or maturity — to better understand, assess, prioritize, and communicate its cybersecurity efforts. The CSF does not prescribe how outcomes should be achieved. Rather, it links to online resources that provide additional guidance on practices and controls that could be used to achieve those outcomes. This document describes CSF 2. 0, its components, and some of the many ways that it can be used. Keywords cybersecurity; Cybersecurity Framework (CSF); cybersecurity risk governance; cybersecurity risk management; enterprise risk management; Profiles; Tiers. Audience Individuals responsible for developing and leading cybersecurity programs are the primary audience for the CSF. The CSF can also be used by others involved in managing risk — including executives, boards of directors, acquisition professionals, technology professionals, risk managers, lawyers, human resources specialists, and cybersecurity and risk management auditors — to guide their cybersecurity- related decisions. Additionally, the CSF can be useful to those making and influencing policy (e. g., associations, professional organizations, regulators) who set and communicate priorities for cybersecurity risk management. Supplemental Content NIST will continue to build and host additional resources to help organizations implement the CSF, including Quick Start Guides and Community Profiles. All resources are made publicly available on the NIST CSF website. Suggestions for additional resources to reference on the NIST CSF website can always be shared with NIST at cyberframework@nist. gov. Note to Readers Unless otherwise noted, documents cited, referenced, or excerpted in this publication are not wholly incorporated into this publication. Before version 2. 0, the Cybersecurity Framework was called the " Framework for Improving Critical Infrastructure Cybersecurity." This title is not used for CSF 2. 0. NIST CSWP 29 The NIST Cybersecurity Framework ( CSF) 2. 0 February 26, 2024 Acknowledgments The CSF is the result of a multi- year collaborative effort across industry, academia, and government in the United States and around the world. NIST acknowledges and thanks all of those who have contributed to this revised CSF. Information on the CSF development process can be found on the NIST CSF website. Lessons learned about the use of the CSF can always be shared with NIST at cyberframework@nist. gov. NIST CSWP 29 The NIST Cybersecurity Framework ( CSF) 2. 0 February 26, 2024 Table of Contents 1. Cybersecurity Framework (CSF) Overview....................................................................................... 1 2. Introduction to the CSF Core........................................................................................................... 3 3. Introduction to CSF Profiles and Tiers............................................................................................. 6 3. 1. CSF Profiles......................................................................................................................................... 6 3. 2. CSF Tiers............................................................................................................................................. 7 4. Introduction to Online Resources That Supplement the CSF............................................................ 9 5. Improving Cybersecurity Risk Communication and Integration...................................................... 10 5. 1. Improving Risk Management Communication................................................................................ 10 5. 2. Improving Integration with Other Risk Management Programs..................................................... 11 AppendixA. CSF Core....................................................................................................................... 15 AppendixB. CSF Tiers....................................................................................................................... 24 AppendixC. Glossary....................................................................................................................... 26 List of Figures Fig. 1. CSF Core structure.................................................................................................................... 3 Fig. 2. CSF Functions........................................................................................................................... 5 Fig. 3. Steps for creating and using a CSF Organizational Profile........................................................... 6 Fig. 4. CSF Tiers for cybersecurity risk governance and management................................................... 8 Fig. S. Using the CSF to improve risk management communication.................................................... 10 Fig. 6. Cybersecurity and privacy risk relationship............................................................................. 13 NIST CSWP 29 The NIST Cybersecurity Framework ( CSF) 2. 0 February 26, 2024 Preface The Cybersecurity Framework (CSF) 2. 0 is designed to help organizations of all sizes and sectors including industry, government, academia, and nonprofit — to manage and reduce their cybersecurity risks. It is useful regardless of the maturity level and technical sophistication of an organization' s cybersecurity programs. Nevertheless, the CSF does not embrace a one -size -fits - all approach. Each organization has both common and unique risks, as well as varying risk appetites and tolerances, specific missions, and objectives to achieve those missions. By necessity, the way organizations implement the CSF will vary. Ideally, the CSF will be used to address cybersecurity risks alongside other risks of the enterprise, including those that are financial, privacy, supply chain, reputational, technological, or physical in nature. The CSF describes desired outcomes that are intended to be understood by a broad audience, including executives, managers, and practitioners, regardless of their cybersecurity expertise. Because these outcomes are sector-, country-, and technology -neutral, they provide an organization with the flexibility needed to address their unique risks, technologies, and mission considerations. Outcomes are mapped directly to a list of potential security controls for immediate consideration to mitigate cybersecurity risks. Although not prescriptive, the CSF assists its users in learning about and selecting specific outcomes. Suggestions for how specific outcomes may be achieved are provided in an expanding suite of online resources that complement the CSF, including a series of Quick Start Guides ( QSGs). Also, various tools offer downloadable formats to help organizations that choose to automate some of their processes. The QSGs suggest initial ways to use the CSF and invite the reader to explore the CSF and related resources in greater depth. Available through the NIST CSF website, the CSF and these supplementary resources from NIST and others should be viewed as a " CSF portfolio" to help manage and reduce risks. Regardless of how it is applied, the CSF prompts its users to consider their cybersecurity posture in context and then adapt the CSF to their specific needs. Building on previous versions, CSF 2. 0 contains new features that highlight the importance of governance and supply chains. Special attention is paid to the QSGs to ensure that the CSF is relevant and readily accessible by smaller organizations as well as their larger counterparts. NIST now provides Implementation Examples and Informative References, which are available online and updated regularly. Creating current and target state Organizational Profiles helps organizations to compare where they are versus where they want or need to be and allows them to implement and assess security controls more