Fort Walton Beach Resolution — 2024-16 Adopting the National Institute of Standards Cybersecurity Framework — reading text

r. Acula 9LI21U,2 JLOw qgfg iuci.qeuja9LI21ud ILow A bt[ASCA bLlAgCA GAGUI8 I CNPGL26cnLj; A LGISISq, Veocisloq: milp onociuji8q mitp ecnkiiA- CAPGL U! 2lC2 H! 2K2 CVsL" cnLiSA bLIA91CA NIST CSWP 29 The NIST Cybersecurity Framework ( CSF) 2. 0 February 26, 2024 on C- SCRM. SP 800- 161r1 ( Revision 1), Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations, provides in- depth information on C- SCRM. Risks from emerging technologies: As new technologies and new applications of technology become available, new risks become clear. A contemporary example is artificial intelligence ( Al), which has cybersecurity and privacy risks, as well as many other types of risk. The NIST Artificial Intelligence Risk Management Framework (Al RMF) was developed to help address these risks. Treating Al risks alongside other enterprise risks ( e. g., financial, cybersecurity, reputational, and privacy) will yield a more integrated outcome and organizational efficiencies. Cybersecurity and privacy risk management considerations and approaches are applicable to the design, development, deployment, evaluation, and use of Al systems. The Al RMF Core uses Functions, Categories, and Subcategories to describe Al outcomes and help manage risks related to Al. 14 NIST CSWP 29 The NIST Cybersecurity Framework ( CSF) 2. 0 February 26, 2024 Appendix A. CSF Core This appendix describes the Functions, Categories, and Subcategories of the CSF Core. Table 1 lists the CSF 2. 0 Core Function and Category names and unique alphabetic identifiers. Each Function name in the table is linked to its portion of the appendix. The order of Functions, Categories, and Subcategories of the Core is not alphabetical; it is intended to resonate most with those charged with operationalizing risk management within an organization. The numbering of the Subcategories is intentionally not sequential; gaps in numbering indicate CSF 1. 1 Subcategories that were relocated in CSF 2. 0. Table 1. CSF 2. 0 Core Function and Category names and identifiers Function Category Category Identifier Govern ( GV) Organizational Context GV. 00 Risk Management Strategy GV. RM Roles, Responsibilities, and Authorities GV. RR Policy GV. PO Oversight GV. OV Cybersecurity Supply Chain Risk Management GV. SC Identify (ID) Asset Management ID. AM Risk Assessment ID. RA Improvement ID. IM Protect ( PR) Identity Management, Authentication, and Access Control PR. AA Awareness and Training PRAT Data Security PR. DS Platform Security PR. PS Technology Infrastructure Resilience PR. IR Detect (DE) Continuous Monitoring DE. CM Adverse Event Analysis DE. AE Respond ( RS) Incident Management RS. MA Incident Analysis RS. AN Incident Response Reporting and Communication RS. CO Incident Mitigation RS. MI Recover ( RC) Incident Recovery Plan Execution RC. RP Incident Recovery Communication RC. CO The CSF Core, Informative References, and Implementation Examples are available on the CSF 2. 0 website and through the CSF 2. 0 Reference Tool, which allows users to explore them and export them in human- and machine- readable formats. The CSF 2. 0 Core is also available in a legacy format similar to that of CSF 1. 1. 15 NIST CSWP 29 The NIST Cybersecurity Framework ( CSF) 2. 0 February 26, 2024 GOVERN ( GV): The organization' s cybersecurity risk management strategy, expectations, and policy are established, communicated, and monitored Organizational Context (GV. 00): The circumstances — mission, stakeholder expectations, dependencies, and legal, regulatory, and contractual requirements — surrounding the organization' s cybersecurity risk management decisions are understood o GV. 00-01: The organizational mission is understood and informs cybersecurity risk management o GV. 00-02: Internal and external stakeholders are understood, and their needs and expectations regarding cybersecurity risk management are understood and considered o GV. 00-03: Legal, regulatory, and contractual requirements regarding cybersecurity — including privacy and civil liberties obligations — are understood and managed o GV. 00-04: Critical objectives, capabilities, and services that external stakeholders depend on or expect from the organization are understood and communicated o GV. 00-05: Outcomes, capabilities, and services that the organization depends on are understood and communicated Risk Management Strategy (GV. RM): The organization' s priorities, constraints, risk tolerance and appetite statements, and assumptions are established, communicated, and used to support operational risk decisions o GV. RM- 01: Risk management objectives are established and agreed to by organizational stakeholders o GV. RM- 02: Risk appetite and risk tolerance statements are established, communicated, and maintained o GV. RM- 03: Cybersecurity risk management activities and outcomes are included in enterprise risk management processes o GV. RM- 04: Strategic direction that describes appropriate risk response options is established and communicated o GV. RM- 05: Lines of communication across the organization are established for cybersecurity risks, including risks from suppliers and other third parties o GV. RM- 06: A standardized method for calculating, documenting, categorizing, and prioritizing cybersecurity risks is established and communicated o GV. RM- 07: Strategic opportunities ( i. e., positive risks) are characterized and are included in organizational cybersecurity risk discussions 16 NIST CSWP 29 The NIST Cybersecurity Framework ( CSF) 2. 0 February 26, 2024 Roles, Responsibilities, and Authorities (GV. RR):Cybersecurity roles, responsibilities, and authorities to foster accountability, performance assessment, and continuous improvement are established and communicated o GV. RR- 01: Organizational leadership is responsible and accountable for cybersecurity risk and fosters a culture that is risk -aware, ethical, and continually improving o GV. RR- 02: Roles, responsibilities, and authorities related to cybersecurity risk management are established, communicated, understood, and enforced o GV. RR- 03: Adequate resources are allocated commensurate with the cybersecurity risk strategy, roles, responsibilities, and policies o GV. RR- 04: Cybersecurity is included in human resources practices Policy ( GV. PO): Organizational cybersecurity policy is established, communicated, and enforced o GV. PO- 01: Policy for managing cybersecurity risks is established based on organizational context, Cybersecurity strategy, and priorities and is communicated and enforced o GV. PO- 02: Policy for managing cybersecurity risks is reviewed, updated, communicated, and enforced to reflect changes in requirements, threats, technology, and organizational mission Oversight ( GV. OV): Results of organization -wide cybersecurity risk management activities and performance are used to inform, improve, and adjust the risk management strategy o GV. OV- 01: Cybersecurity risk management strategy outcomes are reviewed to inform and adjust strategy and direction o GV. OV- 02: The cybersecurity risk management strategy is reviewed and adjusted to ensure coverage of organizational requirements and risks o GV. OV- 03: Organizational cybersecurity risk management performance is evaluated and reviewed for adjustments needed Cybersecurity Supply Chain Risk Management ( GV. SC): Cyber supply chain risk management processes are identified, established, managed, monitored, and improved by organizational stakeholders o GV. SC- 01: A cybersecurity supply chain risk management program, strategy, objectives, policies, and processes are established and agreed to by organizational stakeholders o GV. SC- 02: Cybersecurity roles and responsibilities for suppliers, customers, and partners are established, communicated, and coordinated internally and externally o GV. SC- 03: Cybersecurity supply chain risk management is integrated into cybersecurity and enterprise risk management, risk assessment, and improvement processes o GV. SC- 04: Suppliers are known and prioritized by criticality 17 NIST CSWP 29 The NIST Cybersecurity Framework ( CSF) 2. 0 February 26, 2024 o GV. SC- 05: Requirements to address cybersecurity risks in supply chains are established, prioritized, and integrated into contracts and other types of agreements with suppliers and other relevant third parties o GV. SC- 06: Planning and due diligence are performed to reduce risks before entering into formal supplier or other third -party relationships o GV. SC- 07: The risks posed by a supplier, their products and services, and other third parties are understood, recorded, prioritized, assessed, responded to, and monitored over the course of the relationship o GV. SC- 08: Relevant suppliers and other third parties are included in incident planning, response, and recovery activities o GV. SC- 09: Supply chain security practices are integrated into cybersecurity and enterprise risk management programs, and their performance is monitored throughout the technology product and service life cycle o GV. SC- 10: Cybersecurity supply chain risk management plans include provisions for activities that occur