NIST Cybersecurity Framework

DRAFT Outline - Preliminary Cybersecurity Framework, July 1, 2013

The purpose of this document is to define the overall Framework and provide guidance on its usage. The primary audiences for the document and intended users of the Framework are critical infrastructure owners and operators and their partners. However, it is expected that many organizations facing cybersecurity challenges may benefit from adopting the Framework. The Framework is being designed to be relevant for organizations of nearly every size and composition. It is also expected that many organizations that already are productively and successfully using appropriate cybersecurity standards, guidelines, and practices – including those who contributed suggestions for inclusion in this document – will continue to benefit by using those tools.

DRAFT - Framework Core
The Framework Core offers a way to take a high-level, overarching view of an organization’s management of cybersecurity risk by focusing on key functions of an organization’s approach to this security. These are then broken down further into categories. The Framework’s core structure consists of:

• Five major cybersecurity functions and their categories and subcategories
• Three Framework Implementation Levels associated with an organization’s cybersecurity functions and how well that organization implements the framework.

DRAFT - CompendiumThe Framework’s core also includes the compendium of informative references, existing standards, guidelines, and practices to assist with specific implementation.

The compendium of informative references that included standards, guidelines and best practices is provided as an initial data set to map specifics to sub-categories, categories and functions. The Framework’s compendium points to many standards – including performance and process-based standards. These are intended to be illustrative and to assist organizations in identifying and selecting standards for their own use and for use to map into the core Framework. The compendium also offers practices and guidelines, including practical implementation guides.

Biometric Specifications for Personal Identity Verification - NIST 800-76-2

This document contains technical specifications for biometric data mandated or allowed in [FIPS]. These specifications reflect the design goals of interoperability, performance and security of the PIV Card and PIV processes. 

This specification addresses iris, face and fingerprint image acquisition to variously support background checks, fingerprint template creation, retention, and authentication. These goals are addressed by normatively citing and mandating conformance tobiometric standards and by enumerating requirements where the standards include options and branches. In such cases, a biometric profile can be used to declare what content is required and what is 
optional. This document goes further by constraining implementers' interpretation of the standards. Such restrictions are designed to ease implementation, assure conformity, facilitate interoperability, and ensure performance, in a manner tailored for PIV applications.

The biometric data specifications herein are mandatory for biometric data carried in the PIV Data Model (Appendix A 
of [800-73, Part 1]). Biometric data used outside the PIV Data Model is not within the scope of this standard. 

This document does however specify that most biometric data in the PIV Data Model shall be embedded in the CommonBiometric Exchange Formats Framework [CBEFF] structure of Section 9. 

This supports record integrity (using digital signatures) and multimodal encapsulation. 

This document provides an overview of the strategy that can be used for testing conformance to the standard. It is not meant to be a comprehensive set of test requirements that can be used for certification or demonstration of compliance to the specifications in this document. NIST Special Publications 800-85A and 800-85-B [800-85] implements those objectives.

http://csrc.nist.gov/publications/nistpubs/800-76-2/sp800_76_2.pdf