The NIST Cybersecurity Framework: The Only Game In Town?

On Tuesday, the White House cybersecurity coordinator posted a blog on the White House website describing incentives that may be made available to private sector "owners and operators." The blog reviews the purpose of the Executive Order (information sharing, privacy and adoption of cybersecurity practices) that was issued earlier this year and the resulting NIST Cybersecurity Framework process, but it is also noteworthy for two reasons. It focuses on systems that run elements of the national infrastructure "...such as the electric grid, our drinking water, our trains, and other transportation." This underscores the shifting cybersecurity focus from telecommunications and financial services to other infrastructure sectors. The second interesting element is the list of incentives under consideration. Among the eight listed, the most promising and consequential include the engagement of the insurance industry to build underwriting practices (implicitly based on the