One Size Will Not Fit All – The Cybersecurity Framework Recently Released Can Be A Two-Edged Sword

On February 12, 2014, the National Institute of Standards and Technology released the Framework for Improving Critical Infrastructure Cybersecurity. The Framework is intended to act as a set of industry standards and best practices for managing cybersecurity risks and was envisioned in the Executive Order issued by the President in February of 2013.  By its terms, the Framework is to apply to businesses which are part of the country's critical infrastructure sector.  However, it is not completely clear what types of businesses make up the "critical infrastructure" sector.  Mentioned among these critical infrastructure sectors are communications, critical manufacturing, energy, finance health care and information technology, although the Framework arguably provides best practices standards for all.  Compliance with the Framework is voluntary.