How NIST’s Cybersecurity Framework Could Reduce Cybersecurity

In my first post about NIST's draft cybersecurity framework I explained its basic problem as a spur to better security: It doesn't actually require companies to do much to improve their network security.

My second post argued that the framework's privacy appendix, under the guise of protecting cybersecurity, actually creates a tough new privacy requirement for industry by smuggling the Fair Information Practice Principles into the law. In doing so, it clearly goes beyond the scope of the cybersecurity executive order, which is focused on protecting critical infrastructure. When was the last time lost PII caused "catastrophic regional or national effects on public health or safety, economic security, or national security?"