hello my name is Vivien Schiller I amthe vice president and executivedirector of Aspen digital we’re aprogram of the Aspen Institute thatfocuses on all things at theintersection of tech and media and theirimpact in society a big area of focusfor us is cyber security um it is a uhtopic or a range of topics uh very nearand dear to our heart so um which is whywe’re so excited about this event todayuh for the unveiling of the new nistcyber security framework so a bigwelcome to those of you in the room anda big welcome to those of you who arejoining us online um if you are in thecyber security space you know what a bigdeal the release of this framework isand uh so we’re really really pleased tobe talking about it from three differentperspectives today uh we’ll begin firstwith a fireside chat with Dr laorilassio the under Secretary of Commercefor standards and technology and ofcourse the niss director then we’ll havea discussion with leadership of nist onwhat this version 2.0 brings and finallywe’ll have a panel of Industry leadersuh for whom this framework is for and ifuh if it has the impact of the firstframework we know how Reliant um uheveryone is on that framework um sowe’re going to look at the impact thefirst framework had and what’s next umit’s a short we have a short timetogether and there’s a lot to cover umso uh I will uh introduce our firstsession and uh we’ll get on with it sothank you so much so um our firstsession is a fireside chat again with Drlassio and she will be in conversationwith Katie Brooks the director of theAspen globber cyber security programKatie over toyou all right good afternoon everyone weare so thrilled that you could join ustoday for this big release relase andthe celebration of the last 10 years ofthe N cyber security framework um awelcome not just to those in the roombut to those online thank you very muchfor joining us uh as Vivian mentionedI’m joined on stage by Dr lassio underSecretary of Commerce uh for standardsand technology and director of nist umover her career she’s had several uhdifferent appointments differentchallenges uh ranging from a 31-yeartenure at nist then going over to theUniversity of Maryland um and now backat Nest as as director um so a lot ofdifferent ground to cover there let’sget right to the framework I would loveto talk through how things have evolvedin the past 10 years and particularly uhget into some some words so initiallythis was very much geared at criticalinfrastructure and what we’ve seen todayis much more broad so tell us about thatyeah so thank you very much for forhaving me here today and I have to sayI’m so excited this is just such a greatmoment and um when I first came back ton you talked about 31 years then back atUniversity of Maryland some of my firstdays back at n was the first Workshopwhere 7,000 people signed up to talkabout the launch of of of the processfor 2.0 so really fun fun to be here umyeah so I was at nist when the first uhcyber security framework came out and sothat was a long time ago it was 10 yearsago now 2014um and yeah things have evolved rightand so one of the things that we’ve beenthinking about is um as the fra when thefirst framework was launched it was forcritical infrastructure that was in thetitle and then the title you know peoplestarted talking about the N cybersecurity framework more and more thatthat became the shorthand for theframework right everybody just startedreferring to it that way but really italso evolved um meaningfullyin that people started using it for theum various organizations and varioussectors started picking it up and reallyadopting it and adapting it to their ownneeds so even though uh it had a muchlonger title um and it seemed like itwas really for that specific purposevery quickly it became it was realizedthat this can be used for um really manysectors many types of organizationslarge and small and and so as as thatevolved so did the title and now it’sjust the NIS cyber security frameworkand now the N cyber security framework2.0 excellent so keeping on that themeof of language and of nov clature Ithink we’ve seen that this framework hashad a wide array of impacts um one thatI’ve seen firsthand is that it’s made ituh a little bit more translatable totalk to talk about cyber security tonon-technical uh business partnersthings like that um so running throughthe the framework work identify protectdetect respond recover um why do youthink this took hold so quickly whatwhat Gap was it filling yeah so so youknow people there were already someresources out there at that timeobviously people had been been talkingto each other about cyber security anddidn’t maybe have a common language totalk about it with each other acrosssectors and so when it was released I Ithink people were kind of hungry for theability to really talk about it to eachother and and have a better commonlanguage to talk about cyber security toeach other across sectors um and youknow I also think it’s our process theway that we we work is we have a processby which we engage so many people andand you’re all here and all the hundredsof people online as well you know thatwe reach out to you and that reallythat’s our our our goal is to hear youto invite you into our processand so by the time it was released Ithink a lot of people were alreadyengaged and had already talked about umyou know sort of this common languagearound cyber security and so when by thetime it was released I think people werereally ready for it and it got picked upreally quickly and that common languagereally started to infiltrate um acrossthe across the various sectors um youknow can I say one thing I didn’t thankmy team and so you know I’m standing uphere and I’m the NIS director and youknow I did not I I didn’t read the Ididn’t have to go through all thecomments I didn’t engage all thestakeholders please let me thank my teamall the NIS people who are in the roomand the NIS people who are onlinethey’re just amazing people and I justwant to express a lot of gratitude andum say thank you to them well thank youto you and to your excellent team forgetting us to this point um so the thenew framework was released East at 10:00a.m. this morning I trust that everyonehas read it several times by now wellrehearsed but I think the thing thatjumps out at everyone is this wordthat’s now in front of the identifyprotect detect respond recover and thatis govern um so let’s dive into thatwhat does that mean and what are some ofthe supply chain elements included inthat yeah so I think the most importantthing um one of the things that we heardthrough this whole process was you knowreally testing out whether or not weneeded this govern piece right as yousaid there were five before now there’sa sixth and that’s govern um governreally represents the fact that we haveto bring this into the boardroom fordiscussion right it’s recognized nowthat cyber security is such an importantum Enterprise risk and so it should hasto be managed at that level and I thinkum that’s really in recognition of thatbut that took a lot of discussion reallyacross uh all the stakeholders becauseit is a big change in the framework toadd you know to go from five to six andstart to change that language in thatdiscussion um although you know thatdiscussion initially did happen 10 yearsago we really weren’t ready yet to toincorporate it there weren’t bestpractices for how or what that meant andso it did take um this next evolution ofthe cyber security framework to reallyget here um and and the same is true forfor the other really major differencewhich is about the supply chain a lot ofthese you know discussions of supplychain risks had been going on there wasa lot of research that needed to be donea lot of that was at nist over the past10 years and within other organizationsand uh we just came to a place where wewere ready to really cement it in incyber security framework 2.0 but um butwhen we get to the next session I wouldlove you to ask the experts on thatbecause they’ve been there walking itthrough um the process all the way andthere’s a lot that goes into thosetwo seemingly small words so yeahabsolutely and and certainly we’ll coverthat um one quick followup though umwould you care to share a little bitmore about that process of buildingtrust with industry bringing them intothe conversation and in particular Imean I think for the the first versionof the framework uh governance andsupply chain were largely left off dueto that feedback and then I think forthis round we’re hearing that should bein there so what was that like you knowum I you I like I love that you justbrought up the word trust because atnist we think about everything that wedo in terms of building trust in newtechnologies and building trust in OldTechnologies right it’s all aboutbuilding trust in technology and um andso everything that we do every step ofthe way we do engage our stakeholdersit’s really kind of just part of our DNAis to make sure that we engage peoplepeople all along the way not only uhtalk at them right but really deeplylisten and engage and work through theprocess together um sometimes peopledon’t like the answer that we come upwith right because you’re not always wehad I don’t they’re going to tell youhow many comments we had we had a lot ofcomments toadjudicate um and so you know you don’taccept every single one you come toconsensus you have a lot of discussionbut every single convers ation I thinkled to a better place and and as long asand people knew that when we didn’taccept something of verbatim let’s saythat that was given to us there was areason and we talked through it togetherand I think that also engender trustbecause we were very transparent aboutthe process very open openly engaged anduh and and really valued your feedbackand hopefully this the the the wholeCommunity felt that um not only in thefirst CSF but also of course in thesecond CSF2.0 absolutely and you referenced a7,000 person Workshop that’s trulyincredible and I think speaks to thelevel of industry and ecosystem wideengagement on this topic um do you doesdo you or does your team reallyadjudicate every single comment what’s Ido not I already admitted that okay I donot but my team did yes um NIS didadjudicate every single comment everysingle comment um read through themreally looked atcommonalities um kind of brought thelanguage back around then um presentedthat in workshops and drafts got othercomments back on that so there was a lotof back and forth really refinement allalong the way each one of those steps Iwould say was refining it refining itrefining it but really taking your inputum but yeah that’s that’s a lot of um alot of feedback right and a and a lot ofcomments that were that were reallyhandled I would say with very very muchcare by my team um you know that firstWorkshop did had have7,000 um who signed up for it I think italso had 100 countries right 100different countries represented as welluh I think all that is really importantto to say that the this is verymeaningful not only for the UnitedStates but also for the entire entireworld yeah absolutely I think we’ve sseen this very much tied into to effortsaround regulatory harmonization some ofthose conversations happening at theinternational level um moving forward Ithink it’s become very hard to have anevent like this uh about anythingrelated to cyber security withouttalking about its intersection with AIum and certainly nist has been veryproductive in that Arena as well uh sohow does this new version interact withn AI risk management framework and umhow was the the CSF used if at all todevelop that AI framework yeah so welearned a lot from developing the CSF umand so all of that knowledge andunderstanding of how how to work withthe community how to get feedback how toengage how to iterate how to listen tothe comments you know all of thathonestly went into the AI riskmanagement framework all that all thatum same kind of energy beh and andorganization behind how you would howyou would develop a document that Notonly was important for the community butwas rapidly adopted because of the waythat you engage the community all alongthe way and so I would say they had thatum basic tenant you know they both sharethat in common um but we do have the AIrisk management framework and the AIriskmanagement framework refers to thecyber security framework it referencesit as it should in um how you treat uhcyber security and AI uh and AI um butwe have several other Frameworks ofcourse we have the Privacy framework umWorkforce Frameworks cyber securityWorkforce framework um all of those arereally structured so that they can beinteroperable we think about that aswe’re developing it um we don’t wantpeople to be confused as they’re usingour Frameworks right we want to them tofeel like this is something they theykind of get and so we think about thatinteroperability and we also think aboutwe need to make sure there arePointers uh when they’re necessary ineach one of our Frameworks to to um tothe other Frameworks yeah absolutely Ithink that interoperability is a a hugekey for all of this um so no doubt todayis a huge milestone a day of Celebrationum day to get the word out about thisnew version um so I hate to ask thisquestion right away but what is nextboth for nist and cyber but also fororganizations how do they operationalizethis yeah I think we’re finished nowe’re we’re just started every team theteam knows this is just the beginningright every time you do something likethis if we will take the day tocelebrate how about that um buttomorrow there’s a lot more work to bedone we have a lot to do in terms of ummaking sure there are resources thatpeople understand how to use it we canreach small small you know to largebusinesses and organizations of alltypes and in all sectors um it’s reallyimportant that we’re able to do thattranslation for people so theyunderstand how to access it how toaccess it um and find it accessible inthe implementation throughout thethroughout uh the various sectors arounddifferent organizations of various sizesand shapes um I’ll also say that youknow we do have a lot of resources forum uh use cases um and implementationplan so we we have a lot to do uh withCSF 2. show 2.0 to make sure that um youcan use it how about that um and so myteam is just getting to work but like Isaid maybe we’ll take a day off the therest of the day off you get an hour offafterthis great and I think along that themeum one of the great features of this newrelease is some of the organizationalprofiles featured there I assume wasthat the result of some of the industryor Community feedback yeah absolutelyabsolutely and um and I think it’s veryessential for making sure people knowand understand how to use it yeahabsolutely I think it’s it’s critical tobe able to see yourself and yourorganization in the framework and thenuse that mapping to uh mature yoursecurity operations from there um so nowa question of reflection what was thehardest part about getting to this daywhat what hurdles did you overcome howwas inter agency process and what didyou learn from that yeah you know theinter agency process has been has beenfantastic I think all along the way Imean a lot of adoption last week we sawI think it was last week or this weekthe Coast Guard announced how they weregoing to be uh incorporating some of theCSF um um framework into the the portoperations I mean really good um goodwork across the agency and honestlywe’re really grateful for that I thinkall um having their you know knowledgeand their understanding of their variousuh uses and use cases has been veryhelpful um what other hurdles you know Ithink one of the big hurdles is havingso much interest to be honest with youbecause it did it was a heavy lifttrying to get this to the right um placeright to get it to The Sweet Spot afteryou have so many so much input um but Ithink it ended in in a great place andum the community has been uh feedback sofar I’ve heard from a few people hasbeen good so um so I’m really lookingforward to see how how we further engagewith you and how you would how it getsadopted clearly that’s that’s the that’sthe big signal right how and where andwhen it gets adopted um so we’re lookingforward to that next step excellent sowe’ll hear from a panel of Industryexperts shortly later in the program umbefore we move along though I would loveto ask you a question uh just about theinterplay of this framework and itsapplicability to some of the smallermedium-sized businesses and um if yougot any feedback from the stakeholdersyeah you know it’s interesting I thinkas I said one of the first things thathappened to me when I when I came backto n’s director was uh was being able toparticipate in the workshop um with7,000 people um I think one of thesecond things that happened was thesecretary called me up and she said nowdo is this uh accessible for smallbusinesses because she really had heardum that that’s very important and thepeople that she had been talking to andthe Stak holders she had been talking toum and of course I went back to the teamand I said so what’s going on with smallbusinesses and they said oh we’ve got alot going on we’re developing the smallbusiness Corner um on the website we’rereally developing uh resources to getthem engaged and and as they engaged umin the past many years with smallbusinesses yeah all of that was reallyum built into the feedback and thedevelopment of the CSF 2.0 we definitelywant to make it something that smallbusinesses not just large business ofcourse we want large large businesseslarge organizations to adopt it ofcourse we do um but we also need to makesure that small business you know theentrepreneur the people who are justdon’t have a really big Cadre of peoplearound them that they can use it to yeahabsolutely I think that applicability tothose entities makes this a tide thathopefully lifts all boats um so withthat I think I’m due to hand it over toVivien Dr Casio thank you so much forjoining us today um and for sharing yourthoughts on this great releaseabsolutely thank you and thanks for myteam[Applause]again okay thankyou okay thank you thank you um uhdirector lassio thank you so much Katieuh so now we’re gonna have a discussionum about getting version 1.0 to version2.0 and moving it into the field and weare going to be joined by two people whomade that happened Sher Pasco and Adamuh Sedwick and we are fortunate to havemoderating that panel Venable AR Schwarzhe will lead the conversation he wasworking on cyber security at theNational Security Council when nist wasdeveloping the first framework and soyou saw that effort up close which madeyou the perfect person to lead theconversation so over to you[Applause]Ari thank you so uh yes it’s my pleasureto introduce Sher Pasco who’s now thedirector of the national uh cybersecurity Center of Excellence at whichis at nist and Adam Cedric who is Ithink still senior it policy an analystum and both of them have uh played Majorroles in both CSF 1.0 andCFS 2.0 which we will get into uhdifferent roles they played along theway in both of them uh but let’s startuh By Me handing things to Adam to kindof go over uh give us the quickrefresher on how we got here uh you knowwhy does the CSF exist at all and howdid we get uh to 2.0 and why is everyoneusing it now sure and um thanks forhaving me thanks for putting me on thispanel um I promised I wouldn’t go toancient ancient history so um we’ll justgo back as far as the executive orderwhich um as we heard was uh 11 years agothis month um and it was you knowPresident Obama announced that the Stateof the Union which was really the firsttime that cyber security was evendiscussed at the State of the Union umnow it’s a little more common place umand you know one of the things that thatwe were looking at at the time was umone of the challenges the policy makershad was um there are a lot of goodexisting standards and and bestpractices out there but um why aren’tthey being used and and how do we makeit more usable and so the the structureof the framework really came out of thatum how do we catalog those practices andstandards um how do we uh find out whatwhat what’s common across differentsectors and different types oforganizations and then um how do we workcollectively to figure out what the gapsare and how do we begin filling in thosegaps um the process that we undertook umwhich you know we heard a little aboutwas um largely through workshops andopenconsultation um so you know n brought alot to the table we always do but um itwas very clear to us that um we had alot to do to engender trust with thiscommunity there were a lot of folks thatwe knew extremely well from our ourprevious work but there were there werenew people in the audience that we werekind of meeting for the first time umand I think one of the things that’sreally benefited us is a lot of thosepeople are friends and part Partners toto this day and work with us at thecenter of excellence and on the airf andthe range of projects that we have atnist so the um the process that we tookwas to um have open rfis have thesequestions present multiple drafts and umhave workshops around the country um andreally have that traceability todemonstrate that um every word in theCSF was traced back to a comment or adiscussion um and I was you know some ofus were thinking about this quite a bitrecently because you know we heard somesad news that a guy named Dr Jr Reaganpassed away um and Jr was one of thesepeople that came and worked with us atthe workshops he was a afacilitator and um at the time we wouldkind of split off in different rooms andum there was a little jockeying going onto be in JR’s room because we knew hewas going to run a really interestingthoughtful discussion session um and Ireached out to a guy named Colin sudderwho works at Dee with him and said thatum you know Jr was Del’s firstInnovation officer back when thereweren’t many looking how to safelyintegrate emerging Technologies withoutintroducing risk and um he thought asupport for the CSF was a great matchand he was someone that we came up withthat really we continued with thatreally introduced the CSF to hisnetworks he talked to scios about it andwe would stay consistent and and I bringup Jr just to honor him because he was amentor to so many of us but also just toreally reflect that we had thisincredible degree of expertise in theroom that it wasn’t just n that it wasthis thoughtful feedback that we werereceiving at the time that we uhcontinue receive to thisday thanks Adam um so just to at thispoint uh Sherry maybe you can take us towhat’s different about 2.0 uh Dr lassiotalked a little bit about it but uhtaking that to the next level of detailyeah of course so it’s it’s really greatto be here there’s a lot to celebratetoday um over the past two years youknow working um to update the frameworkto get to today to CSF 2.0 there was agreat number of folks across thecommunity that worked with us right alot of folks out there that are usingthe CSF that really like the CSF someeven really love the CSF um and it’s souh was really touching how much theywere willing to share their expertiseand their time with us over the past twoyears um there’s also a number of nstaff that worked really hard every dayto get to this point um even though Adamand I are up here um know that there’slots behind us that supported thiseffort um I especially want to thankSteve Quinn who um became uh the CSF 2.0leader um and really got the frameworkacross the Finish Line um once I movedinto a new role atnccoe um and so as Adam mentioned youknow the CSF has really endured for thepast decade and when you think about howmuch the technology landscape haschanged um how much standards havechanged over the past 10 years it’sreally incredible um that the frameworkhas becomes such a powerful tool for somany organizations with CSF 2.0 wereally wanted to make sure that this newversion of the framework you know is notjust effective for today’s cybersecurity risks but remains effective forthe next decade um as we look towardsthe risks that organizations might facein the future um and so you knowobviously the technologies have changedover the past 10 years there’s also beensignificant changes in the cybersecurity regulatory landscape um that isone thing that we heard quite a bit fromthose that submitted comments is theneed to kind of harmonize this growingSuite of cyber security regulationsaround the CSF um and even today we’reyou know we talk about the CSF beingvoluntary um but we’re continuallyseeing it increasingly seeing itmentioned in regulations um in federalgrants in different incentive programsand state legislation so the landscapearound the CSF is changing as well umand just in terms of kind of specificchanges to the CSF that you’ll see inCSF 2.0 there’s really two um areas thatI want to highlight one um of course isgovernance um and as was mentioned we’rereally excited about the new governfunction it was a very difficultdecision for us to add a new functionjust given how much the currentfunctions of the CSF have become knownas the definition for cyber security umbut the CSF has always been kind ofintended to be used you know from theserver room to the boardroom and asserver rooms are now no longer on Premthe boardroom becomes even moreimportant um so the new governancefunction will really provide um a needand tools to organizations to betterunderstand you know the cyber securityrisk tolerances and appetites of theirsenior leadership of their customers oftheir Regulators um so that they canunderstand kind of what strategy and andand steps they should take to addresstheir risks um we also think that thisnew function you know will not justprioritize the issue of cyber securitygovernance but we’ll make sure thatorganizations are tracking it and aremeasuring their their work in cybersecurity governance um the second bigchange is um kind of this this call forum cyber security guidance to helporganizations implement the frameworkand the framework has to mean a lot ofdifferent things to differentorganizations just given um um you knowlarge companies small compan companiesum different sectors um different uh uhstakeholders within an organization areall using the framework to talk aboutcyber security um so with this newversion we developed kind of a suite ofresources around the framework thatincludes things like new implementationexamples to help understand each of thenew CSF subcategories it includes um anew online mapping tool the cybersecurity and privacy reference tool theCSF 2.0 mapping tool which I think isgoing to be really helpful to understandhow this new framework relates to kindof existing standards and regulationsthat you may be using um we alsopublished a suite today of quick whatwe’re calling quick start guides um thatwill help provide even more guidance toorganizations on how to implement theframework so for example if you’re asmall business there’s a quick startguide for small business if you are anEnterprise risk manager there’s a quickstart guide for you if you’re a tradeAssociation or a government regulatorand you want to develop a communityprofile to show your expectations onwhat it means to address cyber securityrisk we just published a new guide onhow to develop Community profiles um sothere’s a you know CSF 2o came out todayalong with a dozen other Publications umreally a huge release from nist allintended to make it even more easier tokind of implement the CSF and put itinto into practice us thanks Sherry Iwas you were listing all the places thatdemonstrate success I was thinking thatI was just talking to some undergradsand where they were learning about theCSF and the the functions in in uh inschool and I was thinking and I said tothem you’re going to have to learnanother the sixth function so you newpneumonics we need for kids to learn ofthese things and people taking thiscertification certification do peoplecan get more use out their left thumb Ideci identify protect we do have the newone of the biggest one of perhaps one ofthe hardest things was the creation ofthe new wheel right you know everyoneloves the the CSF wheel of fivefunctions well how do you make the sixfit in it um so we love our new our newwheel to add in govern excellent well uhso Adam one of the things that uh cameup that uh Dr lacazio talked about washow 100 PE 100 people from 100 countriesuh were involved in the workshop I meanit shows the worldwide interest in thein the topic and that that was an effortthat you know was taken on prettystrongly uh um and I think NIS was verysuccessful in working with InternationalPartners to show that this really tiedin that this was really a uh you knowwas that a stone for cyber security sothe the question is how does how are wenow going to take this new CSF 2.0 anduh get that all those update all thestandards update all the internationalwork that’s already been done to tie inand match up what’s going on in 2.0well um there’s going to be a lot umwe’re very lucky that we have Amy manwho who Who’s probably the most famousperson in the room who spearheads all ofthis for us yes give a round of applauseum really some of you know if if therewas a single answer as to why we’re sosuccessful internationally it’s it’s Amyum but we did make it a focus so um wehad International panels at all of ourworkshops um and over the last you know11 years we’ve made we’ve treated themas peers um and so um we have abackground in there because of the thework in standards um and the work ininternational standards and the valuethat we know that Internationalstandards provides in in allowing umwork to happen across across boundariesacross um different types of countriesif you refer to International standardthen it allow it enables trade and foran organization it really Ena people’sInnovation so um we um since the verybeginning we had International interestand we have worked closely with statedepartment and with ITA to um bringInternational communities to us um andwe’ve also worked um in sdos themselvesso um this was actually a discussionpoint for a 1.1 we had a lot of thoughtsaround is this something that n shouldeven maintain or should this besomething that should move out to astandards body and the model that wefound was that you know we we could wecould figure out a way to do both whereum we’re maintaining it we’re workingwith you with with stakeholders but italso can be mer mirrored and leveragedum in ISO IEC and it can also have abroader influence in internationalstandards um it very much is I think aninternational standards project and Ithink some of the changes that Shertalked talk about will enable it evenfurther because one of the mostfrustrating things in the CSF process isthat with the PDF mappings to fivestandards the minute one of thosestandards changed and we only controlledone of them not the other four the CSFwas out of date um and that’s not aproblem anymore because now everything’sonline and so it can be updated U muchlike the other things that we’re doingat nist with our cyber security andprivacy ref refences to sort of move tosomething that can really uh move withthe threat and move with the risks so wecan make these changes and it can be umimplemented I don’t think I’ve answeredyour question yet or am getting to itum so moving forward um we have a goodSuite of trans of translations um wehave a good Suite of use cases um wewill be working to update thosetranslations and we will certainly beworking um with countries with the withthe folks that came to our workshops ontheir adaptations and how they canleverage this um a lot of them are veryexcited and are just waiting for thisupdate so that we can have thoseconversations and so um I think it willcontinue to be a really a really bigFocus for us movingforward so Sherry what’s next for youtaking the uh CSF 2.0 using it at thecenter um how how do you how is thatgoing to work and what are you focusingon next yeah so just taking off my myCSF hat and putting on my nccoe hat umyou know we really want to hear from youon how you’re using the CSF 2.0 whatwhat your successes have been what yourchallenges have been you know we have athing called success stories and umwhere we’ll do little write ups on youknow where um how the CSF has beenuseful for you I’m looking at you knowthe way that the nist nccoe the nationalcyber security center of excellenceum can play a role in helping to youknow really implement the CSF reallymaking it real you know at the nccoe weare a um applied cyber security ResearchCenter um we also run the nation’s cybersecurity ffrdc we build consortia ofexperts um that work together to addressyou know specific cyber securitychallenge um using commerciallyavailable Technologies um and existingstandards the CSF um there’s been a lotof work that’s been done at the centerover the past decade on kind of CSF 1.1and helping organizations to implementthat um so like to give you an exampleof of one of the projects at the centerand we have a very large project on zerotrust architecture we’re working with 24technology vendors to build kind ofexamples Zas in our lab um as part ofthat work we’re mapping um the ZTAprinciples as well as the securitycharacteristics of each of thoseproducts back to the CSF um so you cansee how kind of the higher leveloutcomes that are found in CSFsubcategories can be mapped back to kindof security capabilities that are foundin products and services that you mayacquire um I think that’s reallypowerful to show really in real life howan organization might use the CSF um wealso at NCC have developed about a dozenCommunity profiles um where we’vetailored the CSF to specific sectors umas well as specific Technologies sowe’ve got profiles on kind of SpaceSystems and electric vehicles and and umum liquid liquefied natural gas we’vedone um a lot of these in kind ofcoordination with relevant federalagencies that oversee a particularsector um these Community profiles Ithink can be really helpful to ororganizations to bring the framework alittle bit closer to them to understandkind of how they can address theirspecific risks how it relates how theframework relates to kind of theirsector specific standards theirregulatory environment um so we justtoday published a guide um kind oftaking our expertise over the past 10years on community profiles that we’vedeveloped at nist um and we put togetherthis guide to show how um you know tradeassociations how government agencies candevelop Community profiles and we’veseen a couple of examples um you knowthe financial sector profile hasdeveloped outside of nist thecommunication sector profile wasdeveloped outside of nist by the FCCadvisory committee we want to see moreof that um we want to see you know tradeassociations and and sector riskmanagement agencies kind of Step Up anddevelop their own Community profiles sowe developed this guide to really helpthem kind of think through what theprocess might be and what’s beeneffective for us as we develop our ownCommunity profiles so overall everythingthat we do um you know just to repeatwhat’s been said before everything we doas a community process at dist we reallywant to hear from you on what will bekind of the most helpful to really helpaddress um kind of this transition tothis new version of of CSF2.0 great thanks so we have like one ortwo minutes left uh so I’m just going toask a quick question follow up to thecomments Adam was making about the kindof moving forward and and how it’s goingto be updated from this point and youtalked about the informative referencesautomated automatically being done butjust in terms of like you know how do wemove to a 2.1 or a 3.0 um right whenwhen the first uh I remember I went tothree of the first five workshops I wastransitioning between going working atnist and commerce and and and NC at thetimeand um came back to the fifth workshopand at the first one there wasdiscussion well this is clearly we’regoing to run have a nonprofit we’regoing to spin this off to a nonprofitthe nonprofit’s goingon to run this bythe fifth one it was like no nist isrunning this thing and I mean it’s aprivate sector saying nist is runningthis thing um and so and and N has takenthat on since then and um so thequestion is well how is that going towork moving forward what did you learnin the two going from 1.0 to 2.0 processthat you would see for the for 2.1 or3.0 yeah so I thinkum I think some of the changes as Ihighlight we’ll hopefully make it so wecan we we don’t have to do those updatesor it doesn’t it doesn’t pain us that wehave this document that we know is outof date because the standards haveupdated so um it gives us additionalflexibility in terms of when will achange need to be made for a 2.1 or or a3.0 um um and it allows us to continuethe work that we’ve been talking abouttoday you know another project that weannounced was um a profile for datagovernance that will pull together thePrivacy framework and the cyber securityframework and I think that’s a a big onefor this year and then and then anupdate of the the Privacy framework aswell um so I think we’ll largely followthe a similar model where um in a fewyears from now we’ll take the Pulse ofindustry and we even did that rightafter 1.1 and people said it’s way tooearly um so it it gives us a chance tocome back and say okay what has workedwhat needs to evolve uh at a certainpoint but I I I I’m optimistic that someof these changes allow us to get to astate where we can um we don’t have tohave that conversation in the near termlet me put it that way um and then wehave all that great work going on at ISOand IC and other places um and we canengage in the International Communityand have those discussions as as well atthe same timewell thank you guys for doing thisthanks to Aspen for hosting this and uhplease give them a hand and help methankthem okay thank you team so um AR youthrew out a challenge there which was tocome up with apneumonic uh for the new framework withthe addition of of govern so I turned tochat GPT for a little bit of help itgave me a lot of very strange optionsbut my favorite is you can use this foryour student students delightful puppiesinvestigate rolling grassy Hills itworks look it up okay thank you for ourfinal uh panel we’re going to now turnto the industry perspective uh to talkabout The Once and Future versions ofthe CSF obviously without the privatesector the CSF would just be anotherdocument it’s the the use of thedocument particularly by the privatesector uh that brings it to life andmakes it so important so we are thrilledto have moderating this p panel KembaWaltonum You probably all know who she is longcareer in government industry and cybersecurity most recently the actingNational cyber director uh and led thedevelopment of the administration’sNational Security strategy now presidentof Paladin Global Institute and mostimportantly Kemba has just joined our usAspen cyber group as a co-chair we’rethrilled to have you with us and we’rethrilled to have you lead this panelover to you[Applause]Kembathank you hopefully this is on good canyou hear me okay I’m just going to allowthe panelists to come join me here onstage great sokaygood uh thank you Aspen for hosting thislaunch thank you Dr L lacazio Sher Adamand the Hess team Amy I’ve seen inalmost every country but here umI really appreciate the work that I knowthat you and the nist organization hasput into this process so so thank youfor that uh and so now I get to talkwith uh some of my industry friends hereas you as as Vivian introduced me I amuh the president of Paladin GlobalInstitute uh and you have a range ofIndustry professionals here who’ve had arange of experiences with cyber securityrisk uh with the cyber securityframework and I’m going to let them eachintroduce themselves starting with youJen cool Jen Buckner I’m a uh formerArmy intelligence and general officerwith us cyber command I transition fromthe government to lead mastercard’stechnology risk function inclusive ofsecurity and resilience of courseMasterCard a trusted technology companysupporting payments for consumers Banksbusinesses uh and now governments aswell I would add that I also representMasterCard on the Cyber risk Instituteboard which kind of doubles down on thatpotential for a Common Language acrossuh Financial Services uh as well asRegulatoryharmonization and and I told Jen that ifshe didn’t mention it I would she’s alsoa brigadiergeneral that’s that’s a really easy actto follow after thatrundown my name is Danielle Gillmore I’mthe director of global public policy forSalesforce we are a a CRM company custouh customer relationship managementcompany founded in1999 um we basically help companiesconnect and sell to their customers in awhole new way it’s what our tagline isright now um in my role as a globalpublic policy director basically what Ido is help ensure that Salesforce has aset of globally clear and consistentpolicy recommendations on issues likecyber security a lot of AI work thesedays um as well as as privacy um so no Iam not necessarily A secur securityprofessional definitely more in thepolicy space um but nevertheless happyto be here thankyou greetings Christine Pelon I’m theStrategic manager at um General Motorsuh Global Automotive OEM um I helpedlead the I don’t I don’t know how to saythis but um I help lead the the umgovernance and the reporting and thekind of Storytelling of of how we managecyber security across um three differentcompanies across it across our productsand connected services and then also ourmanufacturing environments so I get thegreat pleasure to work with a a diverseset of um Talent um a very eager uh setof Business Leaders um and all gettingthem to understand our diverse risk umand then manage our thirdparty ecosystemaswell hi Angelica dorch I am seniordirector and head of cyber securityGlobal policy at a little 50-year-oldTech startup I like to call sapum love love saying that um you know weare actually globally headquartered inGermany we have about 20,000 employeesin the United States and 110,000employees globally um I like to say thatyou know we are the biggest tech companyyou haven’t heard of because oursoftware is so pervasive it touchesevery sector across every industry umwhether it’s helping people getvaccinated all the way to having 87% ofthe world’s Global transactions touchour software every day so we are a bigplayer in this space and in terms of myrole working across multiple regionswith my colleagues to monitor providefeedback to governments um including thegreat engagement we’ve had with nist inuh the roll out of CSF2.0 great so welcome so you we’ve got anarray of Industry professionals here I’mgoing to Pivot off of uh something thatAdam said earlier and and sort of gotake us back a little bit uh the 2013when executive order 13636 was signed byPresident Obama I was focused on on it Ithe time I was a cfus lawyer at theDepartment of Homeland Security lookingat National Security risks for man formerges and Acquisitions and transactionsthat involve foreign investment in USbusinesses the most complicated caseswere those that involved cyber securityand mitigating those risks and so in2013 when section 7 came out and in 2014when the framework came out we finallyhad a taxonomy so that we can actuallyexplain what we’re mitigating uh and sothat was my first use of the cybersecurityframework I’m just curious and that’sfrom a government perspective a totallydifferent perspective but I’m curiouswhat your experiences were as we hadnist 1.0 nist 1.1 in 2018 how did yourEnterprises use and ingest it and we canstart anywhere um yeah Daniel I canstart quickly um so technically in 2013I think I was still on the hill workingat his gak with you cwickum so can’t say that I was at Salesforceuh working on the cybercity framework uhand and how we were going to deal withit all but looking back on it andtalking to my cyber security team um Icould tell you how the SecurityProfessionals implemented like how ithas helped us grow maturity our ourprogram maturity how it’s been um abenchmarking a to us um how we’ve beenimplementing it for six years I couldreally say all of the those securityprofessional talking points right um andthey’re important but I’m here as apolicy person so I have to say um one1.0 has really helped provide a level uhpoint of conversation between me and mySecurity Professionals um as well as alegal function um cyber security isincredibly complicated if you’re notsteeped in it every day so having a kindof equal and um a a way to talk about itit’s uniform makes convers policyconversations a lot more easy so when wetalk about you know Market access issuesor if we talk about um new regulationswhich you know we’ve seen so many ofhaving that same point of language hasbeen incredibly helpful and I’m reallyum grateful honestly to this team forcreating such a a flexible frameworkthat has allowed us to kind of explorethe different dimensions of cybersecurity um whether it being theEnterprise space or some of the otheruse cases Financial Services it’s beenan incredible point of origin to havethose um emerging and really pressingpolicy uh conversations around cybersecurity thanks anybody else wish tocontribute sure I can I can take youalong the journey so I would say uh in2013 I was almost um in my cybersecurity uh infancy um I had joinedGeneral Motors uh um product cybersecurity group which was just newlyfounded and you know although GM hadbeen using the nist framework within theit environments and the OT environmentsum the product space was completely newum and the the framework was it basedwhere this was a whole new Beast ofembedded umtechnology and so helping to bring thatteam together and then finding our placeum in and among the it World um you knowwe we got to a place where we took thenist frameworkand kind of tailored it for thatembedded space took a lot of work um butwe got there and then come 2018 um wethen had a uh Chief cyber securityofficer announced where all thefunctions and domains of General Motorsum GM Financial and then also Crews werebrought together so you’ve got FinanceCompany you’ve got a global OEM and thenyou’ve got a startup right and how do wehow do we talk about risk and how do wevisualize that tell that story to theboard um regardless of environmentregardless of maturity technologywhatever it might be so that’s where wethought hey let’s leverage what we haveexisting and then tailor that and bringin the story to the board quarterly andhave that conversation of the risks thateither um you know are indigenous toevery space or you know singular to aspecific technology um we’ve really seenour board mature and and and theirunderstanding um of that and I I basethat all on the N framework and beingable to have that kind of you knowskeleton of here’s the laundry list ofthings we we need to look at I love thatbecause you’re you Danielle you and andChristine have are from two verydifferent companies and you’re able totailor it uh version one and 1.1 uh toyour very specific needs uh which iskind of cool let’s let’s move to nistCSF 2.0 which is of course why we’rehere the launch of it today um one ofthe things things I noticed at theoutset when I got a early copy of it wasthat it’s much morestreamlined um with some quick startguides and some implementation plansthat that Sher had mentioned yes I seeyou clapping so my my question is whatdo you what do you think about that justover whole structure the new structureof theCSF I really appreciate the emphasis onthe operationalization of it theimplementation of it cuz I think as aswe noted in 1.0 and 1.1 the 2.0 reallyjust Builds on that potential it didstart as the or it served as afoundation that common language but nowit’s really about fostering trust um andthat is trust uh I like that analogyfrom the data center to the boardroombut likewise um internally acrossbusiness units with our customers andcertainly with our Regulators too sothat whole trust um multiplier with allof those implementation tools and um andguides I think is um makes it easy to dothe right thing which is really what weall want to we’re all interested incyber security for yeah just to add onto Jen I think for sap we’re superexcited to see the Govern function um Iknow that was it’s a tough decision toadd that six function as Sher mentionedbut you know for us to start thisjourney it started at the top it startedin the boardroom so imagine also being agerman-based companywhich this framework is somewhat viewedas us Centric how do you sell that to aGerman board and the taxonomy thelanguage it’s Universal but it also theframework it’s agile and adoptableacross 150 countries where we dobusiness so it was pretty over time ineducating our board it was very quicklythey saw that like okay this is a visiondriven business driven initiative thatwe can push down to uh all areas of ourbusiness we can use this to show trustwith our customers um we can also engagea government agency and provide feedbackwhich is sometimes rare so we appreciatenist being so open and having all thoseworkshops and adjudicating our commentsto understand just how this frameworkapplies across different sectorsdifferent businesses which is againpivotal for saap which is a largeEnterprise driven company that supportsso many different businesses acrossdifferent Industries so for us again thethe governance uh govern uh function ishuge also seeing the realignment of thecategories um so it’s more streamlinedbetter aligned um and then the tooling Ithink is is definitely a game Cher aswell so I think a lot more agility umyou know flexibility and you can applythis globally I think that’s the realkey for us is that it has a Glo it’s aframework with a Global Perspective eventhough it was produced by a USgovernmentagency wow you should get that on ontape that’s that’s wonderful I and and Iknow something about governmentdocuments and the private sector doesn’tusually take to government documentsthis this uh this well um but I hear thewords trust quite a bit I I I assumethere was a lot of collaboration andlike I guess I’m answering my ownquestion which is why has this beenadopted so easily so anybody I andI keep REM renaming you Angelica uhyou’d mentioned communication with yourboard and I think Christina you alsomention that and I I think the newframework helps us uh with communicationintegration and Enterprise riskmanagement just curious if you had anyother additional thoughts about theability to help with communication upand andsideways just very quickly um you knowfor us tactically again the theframework is built in such a way whereit’s using common uh languageterminology I mean to date we’ve doneover 400 internal engagements across 23lines of business um we’ve done at leastover a hundred webinars internally soit’s really easy to take a lot of thelanguage build presentations and startto educate your Enterprise on why thismatters what part you play in thisadoption and where are we going as acompany um I’ll also add that at sap theN adoption of the this framework is apart of our corporate strategy it hasbeen for the last four years so andthere is a quote from our CEO about theadoption so again this goes back to atop- down business-driven initiativethat’s important for us to make surethat we’re building trust with ourcustomers and engaging our customers tounderstand especially with our suppliersthat there is an understanding that evento do business with us you need to havea basic understanding of our cybersecurity risk appetite which includesadoption of the cyber security frameworkif I could just build on that as thatpoint as well I mean the supply chainpoint is so critical and we soappreciate the addition of that umbecause I think we’ve all see howcritical the supply chain is and how attimes it has been the point of attacksmost recently so for us I mean we weservice across the different Industriesbut we also are being serviced by youknow different Industries as well I meanour supply chain includes software aswell as Hardware so having uh the CSFthere to ensure that they’re you knowRising Tides FL All Ships I forgot whatthe saying is but um it’s something thatwe definitely depend upon and then Ithink also in the policy space um when Ihave to go crawling to my teams aboutthese consultations and asking themplease please provide input please um weknow we actually create we includedsupply chain note in our consultation ummany years back and hey Presto look atthat supply chain is in the new CSF sonow my life um has been uh validated bythe fact this the consultation that Ibegged for um and wrote you know it’sactually something that we that’slistened to so I can go back to myinternal teams and say Hey you know NISlooks at our comments please provideinput to these comments so sincerelyfrom the bottom of my heart as someonehas to draft all of these comments thankyou I would add in the in the spirit ofbe careful what you wish for it alsoholds us accountable now for thegovernance piece which we have all beendoing but in that communication toboards customers business units thatgovernance becomes measurable I think isreally important as well but now you atleast get a column to turn greenright I’m I’m just saying yes thedashboard so you know I’ll talk a littlebit more about the use and how we’veused it to communicate over manydifferent levels so I mentioned that westarted um leveraging the N framework in2018 for our maturity scorecard to theboard of directors and our seniorleaders um what that looks like um isfive columns um that gives us quarterlystatus and we we leveraged at the timethe ffic maturity model because of GMFinancial was already using that we’venow uh migrated to the cmmi maturitymodel um and so you can you can visualizfive columns um of all of those thoserows um columns it it kind of looks likeokay just a field of colors um but youknow to the board they over time see seethat change and we’re we’re able to pickout certain points maybe there’sintersections maybe there are you knowuniquenesses one’s green and one’s redright and so what’s the contrast andcompare um what’s the difference um youknow not just at that level um once oncethe board loved it and and we use thatum to communicate our risk that wasimportant but when we’d show that to ourorganization and people would just gookay what’s that right um even thoughthey were using the nist framework forthem to see that I thought man we reallyhave to take the opportunity to haveconversation at the operational level sowhat we could do is take a category asubcategory and have each of our cyberexperts in those separate domains kindof talk about the projectthe challenges the best practices thatthey’ve learned um while maturing thatprogram so we try to use it everywherewe go and then even out to our our thirdparty ecosystem aswell that’s wonderful I I noticed thatthe the new cyber securityframework really emphasizescommunication and integration not justup meaning to the board but acrossbusiness units sideways and the vendorsand and so I think that is aextraordinary value ad and helps us tothink the other thing um from myperspective there’s they draw a clearconnection between privacy and cybersecurity in this framework does anybodyMastercard or anybody want to talk abouthow how they treat privacy in this spaceor how you might think about privacy inthisspace or anyone and I didn’t mean topick on you Jen I just right next tome but I we every privacy conversationstarts with security and it ends withsecurityand so and the fact that you know comingnext is that interoperability with um aprivacy and data framework and that theywould be mutually supporting isaddressing kind of what we allexperience and live every day uh and soI don’t think you can have aconversation about either with you knowyou need both in that in that sentenceand the equation I agree um I I sit inthe Cyber organization so I always saymy two best friends are legal andCommunications so I never go anywherewithout them yeah and just to add I meanI think with the rise of kind of allthese uh sea Suite professionals rightwe have the chief AI officer we have aChief privacy officer we have the chiefsecurity officer how do we make surethat they’re playing together thatthey’re coordinating together um becauseat sap we believe in Building Bridgesnot silos so I I believe theseFrameworks while they’re distinctthey’re somewhat individualized I thinkit’s great that n the next chapter isshowing the interoperability becausethat’s huge to show why these this seaSuite of professionals need to beworking hand inand not in silos likeworking together all the time instead ofbuilding little thief Dums with theirown Frameworks it’s all and again I Ialways go back to CSF because I think umto jy’s point I mean it all goes back tosecurity so I would put CSF at thecenter with everything else branchingout fromthat good so okay let’s talk about itDanielle is technically the first personthat said AI on this panel so I won’tit’s it’s so on brand for me honestly atthis point but it’s hard to have a panelwithout saying AI um these days and Inoticed that the the version 2.0 makesreference to emerging Technologies andthe use of emerging Technologies andmaking sure that it is technologyneutral but it did mention the AI riskmanagement framework um and itsintersection and one of the things and Iknow this is not a panel about AI butI’m very excited about AI um the AI riskmanagement framework cross referencesISO and Anissa and other standards umwhich got us to talking about you knowthe the framework for Frameworks how dowe how do we harmonize Frameworks how dowe talk about it in an integrated wayand you want to share any thoughts aboutthat I have so many thoughts hereseriously um so you know I’ve been forthe last couple of months really on theroad going around the world talking togovernments about how do we like how dowe tackle AIum and I think when you look at theconversation the more things change themore they stay the same so I thinkpeople thought that this conversationwas going to be whole new AI was be it’sit’s so different it’s emergingtechnology but really if you look at itfrom a policy stpoint uh it’s the samekind of conversations that we’ve beenhaving for like at least 10 years ifyou’re talking to other people maybeeven like 20 years and it’s privacy it’ssecurity it’s IP it’s content moderationand so I a lot of what I’ve been sayingto governments is look to your datagovernance program and what is datagovernance program security and privacyso having the Frameworks talk to eachother in that way is incredibly helpfulbecause there are parts of the worldthat are looking at AI as something thatneeds to be controlled but there are alot of governments globally that arelooking at AI as an opportunity for themand they’re looking at how to capitalizeoff that and how to have a regulatoryenvironment that allows for Innovationand so there’s so many different ways toanswer that like how do you help createan Innovative economy and I would sayit’s a layered approach right so makingsure that your foundations are correctdo you have a good Privacy Law do youhave a good cyber security law and thenon top of that then there are you knowyou Frameworks guidelines codes ofconduct things like that and to havesomething like the CSF that then callsupon and points to the AI RMF and havethe a RMF do the same is incrediblyhelpful because it allows countries tofind some a first place a first Port ofU of Entry as they look to develop theirregulatory um or or their kind of yeahregulatory approach to AI um also ithelps create best practices which isincredibly helpful I mean you know thereare there’s been so much work arounddefinitions and not all of it aligns butI think where there is alignment I thinkyou around oecd definition um that setsa good standard and so then when youextrapolate out and you start talkingabout the airf the CSF it allowscountries to say okay there is a thirdor second or third way here we don’thave to have hard prescriptiveregulations so all these Frameworks umeven though the CSF has technicallynothing thing nothing to do with AI andthat it’s not directly aimed at AI itreally does underpin AI so you know weneed a 2.0 we need this to remain agilewe need it to be there so that there istrust around Innovation you know it’sfunny you um you know mentioned heyshould we have the framework of allFrameworks right and at first glancewhen you you think about all that umthere is to to reference you go can’t wejust have one but what I love about thisis that we don’t have to have one rightum a business can pull from heavily fromone and and reference the other asneeded or reference all of them asneeded so I think it’s important that itremains kind of fluid and and theability now that it’s streamlined andonline and able to reference back andfor and forth is soimportant yeah one of the things um youknow you have the core functions forcyber security and you have the corefunctions for AI risk management andboth of them share governance as as theas one of the core functions um and sohaving the two governance structurestalk to each other to inform your largerEnterprise risk management I think is isextraordinarily helpful um I feel likethis has been a little bit of a LoveFest over CSF 2.0 that might be part ofmy fault because I I I like it um Iteach it uh but what have we not talkedabout on this stage you want what elseexcites you about it um I know Angelicain your organization we talked a alittle bit about mapping and the themapping tools that are now available umI know that we talked a little bit aboutthe maturity tools that are nowavailable and referenced in the in theframework is there anything else wehaven’t talked about or anything youelse you care to share I I think what’sinteresting about um the evolution ofthis framework is that your journeynever ends with CSF it’s it’s ongoingthis is what a risk-based uh uhframework helps you do it it helps youmature your organization as you’removing as you’re driving new business umI think for us we’re really excitedbecause we’re looking at how do youevaluate where you are in the journeycan you do a self- evaluation do youhave to pay someone to help you do thatwe’re kind of experimenting with withall of that so for us we’re looking youknow our goal when we first started outwas to get to uh tier threeimplementation um and we’re evaluatingthat right now and with uh 2.0 lookobviously moving towards uh tier 4 andwe just want to always self assess sofor us it’s looking at what tool can webuild to uh do our own self assessmentum make sure we can validate that andhopefully one day make that an open-Source tool that anybody can use whetheryou’re small business or a largeEnterprise like ours um because again Ithink you know as I mentioned and justwant to double down is that you knowthis isn’t just something a checklistthis is not um a a final destinationthis is an ongoing Journeyabout what your organization is going todo um to make sure to assess cybersecurity risk based off of where you areum in the sector or who your customersare and so I think that’s really reallyimportant to continuously evaluate thatum and and be able if you can save somemoney you don’t have to pay anybody doit on your own yeah so we’re excitedabout that coming out for sap hopefullyuh before the end of theyear Jen and then Danielle thank you formy job um in this I’m looking for theright verbs for uh you know the 3.0around supply chain um aroundresilience uh because I think those areum increasingly regulated spaces wherewe must proactively prove that we aredoing the right things I you know Iappreciate the difficulty in achievingconsensus language um and that you knowobserving that in 2014 we weren’t readyfor the governance piece and now we areand I think we that workshops wereincredibly helpful to kind of distillsome of these pieces not quite there butthose are certainly um you know we’llwe’ll um ride this new uh frameworkhorse uh and I think that time will tellon on those other aspects which aregrowing around supply chain and uh thirdthird and fourth party risk managementas well asresilience I think what excites me isnist itself in the work that it’s doingum like I said when I have to sit downin front of government nist is providingme a way to say that there is a flexibleyet agile approach to all of this um youknow we are seeing a lot of prescriptiveheavy-handed regulation um around theworld happen while governments are alsosaying they really want to innovate andI so I think having um the variousFrameworks that NIS produces allows forus to have a conversation about um myleast Salesforce but the industry try tolead with trust that we can be trustedto try to do what is right and and andinnovate in a way that is trustworthy sohaving this provide the opportunity umthrough acollaborative um relationship build uhstandards and a path forward to maturityand robust Innovation is incrediblyhelpful and it’s really what excites mein in the policy environment right nowbecause it’s there’s so much coming atus and we’re trying to to respond and sohaving um more open conversations thatis not just about hard regulation butcould be about a code of conduct like Isaid or guidelines it’s really excitingand fun at least for me but maybe that’sbecause I’m a policy wonkum the thing that’s exciting for me umI’m a very visual person and you knowthis um but when when the uh draft cameout I I kind of took and did a uh likewhat does this mean right and it wentfrom 1.1 which was very it focused usfocused and it exploded right to theworld and any size of company anytechnology any maturity um big or smallum I also loved on the other end of thatthat cyber security is a part of theoverall ERM I’m sure a lot of you mayhave experience with um security groupsthat think they’re the only and thebiggest issue um which while it is truethat you know we have needed um someelevation it’s nice to understand thelarger context of that um and where wefit in what I most love and am mostpassionate about is um our ability as anoem to partner with our supply base andour dealer network and to really sitwith our suppliers in in small andmedium-sized businesses with within thatand now we have a common template andand framework that we can bring them init and and it applies to them so that’swhat I’m truly excitedabout and so I don’t intend to lead thislike a workshop um but we have nistsitting here and Jen did um reference Ithink Ari was the first one to referenceuh the cyber security framework 2.1 or3.0 little too soon you get a day’sbreak but uh you know the the ne likethe what could be helpful and one of thethings that um while I’m a huge fan ofthis one of the things that has beensitting with me a little bit is is howare the small and mediumsized businessesgoing to use the quick start guides andhow are they going to integrate thequick start guides with the Cyberperformance goals and and then how areyou going to measure those are some ofthe the opportunities I think we have toworkshop and discuss and and furtherevolve the framework that we all so muchrely on on I don’t know if anybody elsehad any thoughts so I actually sit onthe Cyber Readiness Institute uminitiative I don’t know if you’refamiliar um but we have talked aboutactually taking some of the um smallbusinesses that are members and walkingthem through during some workshops thecpgs and what does nist mean to them sothat’s on the the plan for this year umshout out to CRI um bcyber ready.comfree totally free but um we’d love to dothat and would love to uh you know keepyou guysengaged and then Jen you’d mentioned umthe matur I think it was you thatmentioned the maturity model and thesupply chain uh risk managementchallenges associated with second andthird tier vendors we know that cmmc iscoming out as well or is out I thinkI’ve lost track I was on vacation for alittle while um and how do thoseintegrate with each other I don’t knowif anybody deals in cmmc at all or doany of you deal in supply chain I don’tknow but I I assume you do but I wouldlove to to see how those opportunitiesdevelop and evolve especially since thisthe framework now focuses withingovernance on supply chain security whenI think with the tooling and the abilityto assess once and then apply it to manythings I mean that has a lot of that’shigh payoff for a small medium businessit’s also incredibly important for aglobal company like ours that has has tochuggle all of um increasingly you knowcomplex regulations and so the idea incmmc if I the the commonality acrossthose will be really helpful because Idon’t have to run separate assessmentsbut can really assess it uh broadly andthen apply it to many which I think isthe you know will be the harmonizationthat we the real value of uh2.o and here we go harmonization ofstandards that’s the thing that I I Ilove to I love to think about that umwell this has been an excellent panel ifthere’s anything I I haven’t raised feelfree to do it or forever hold your peacethis has been a really wonderfulconversation thank you so much thank youthank you and congratulations Missyes okay thankyou thank you what a fantastic uh paneland these fabulous women I love to seeit um thank you thank you so much uheverybody for being with us thank younist for thisframework uh there’s so much to unpackhere thank you to all of theparticipants all of you are who havebeen listening I think as we’ve heardfrom sort of a diverse uh all thesediverse sectors that the reallyinteresting work of the framework uh 2.0starts now a lot of work ahead and um aswe apply it to a fast changing world sowe were really pleased to host you atthe Aspen Institute and we wish you areally fantastic day thanks everybody[Applause][Music]byebye
Ten years after the launch of the seminal Cybersecurity Framework (CSF), the National Institute of Standards and Technology (NIST) released the long-awaited Version 2.0 the morning of February 26.
Hours later, NIST leaders joined us to discuss the new CSF, as well as a suite of new supplementary resources accompanying it: online tools, implementation examples, and quick start guides to help organizations reduce their cybersecurity risks. We were honored to hear from Under Secretary of Commerce for Standards and Technology and NIST Director Laurie E. Locascio as well as Cherilyn Pascoe and Adam Sedgewick, the CSF Program Leads on versions 1 and 2. They shared why organizations need to supercharge their cybersecurity efforts and how CSF 2.0 can take cybersecurity risk management to the next level within the larger context of enterprise risk management.
Finally, we hosted a panel of industry experts on how the CSF has changed the way we assess, implement, and even talk about cybersecurity — and get their take on this new version.
NIST Speakers
Dr. Laurie Locascio Under Secretary of Commerce for Standards and Technology and Director, NIST
Read about Dr. Laurie Locascio
Dr. Laurie Locascio is currently the Under Secretary of Commerce for Standards & Technology & the director of the National Institute of Standards and Technology (NIST). Locascio most recently served as vice president for research at the University of Maryland College Park and University of Maryland Baltimore. Before joining the University of Maryland, Locascio worked at NIST for 31 years, rising from a research biomedical engineer to eventually leading the agency’s Material Measurement Laboratory. She also served as the acting associate director for laboratory programs, providing direction and operational guidance for NIST’s lab research programs. As a researcher, she has published 115 scientific papers and has received 12 patents in the fields of bioengineering and analytical chemistry. She is a fellow of the National Academy of Inventors, the American Association for the Advancement of Science, the American Chemical Society, and the American Institute for Medical and Biological Engineering. Dr. Locascio was recently elected to the National Academy of Engineering.
Cherilyn Pascoe Director, National Cybersecurity Center of Excellence, NIST
Read about Cherilyn Pascoe
Cherilyn Pascoe is the Director of the NIST National Cybersecurity Center of Excellence (NCCoE). She provides strategic direction and technical leadership for the NCCoE, aligns the NCCoE’s work with the industry, government, and NIST priorities, and builds relationships with key stakeholders. Prior to her role as Director of the NCCoE she served as the Senior Technology Policy Advisor, advising NIST leadership on technology policy and strategy, including cybersecurity, privacy, and artificial intelligence. She also led the NIST Cybersecurity Framework program and was a team member of the NIST AI Risk Management Framework. Prior to joining NIST in 2021, she served more than a decade in staff leadership roles on the US Senate Committee on Commerce, Science, and Transportation. Most recently, she served as Deputy Policy Director managing the Committee’s Space and Science Subcommittee, which has jurisdiction over science, technology, standards, and civil space policy.
Adam Sedgewick Acting Associate Director for IT Standardization, NIST
Read about Adam Sedgewick
Adam Sedgewick serves as Acting Associate Director for IT Standardization at the National Institute of Standards and Technology, where he has worked since 2012. In this role, Adam advises NIST leadership on standardization activities, cybersecurity, privacy, and related issues.
In 2017, Adam served as Technology Policy Advisor in the Department of Commerce’s Office of Policy in Strategic Planning. Prior to NIST, Adam was Senior Advisor to the Federal Chief Information Officer Council, developing and assisting in the implementation of governmentwide policy related to technology issues. Adam was a Professional Staff Member for the Senate Committee on Homeland Security and Governmental Affairs for nine years, handling cybersecurity and federal information technology policy.
Industry Speakers
Jen Buckner Senior Vice President, Technology Risk Management, Mastercard
Read about Jen Buckner
Jennifer “Jen” Buckner leads Mastercard’s Second Line of Defense Technology Risk team, ensuring effective governance and oversight of security and technology risk management practices , including risk frameworks, policies, and procedures aligned with industry best practices and regulatory expectations, objective risk assessment, challenge, monitoring, and reporting, and collaborative internal and industry partnerships.
Jen is a former U.S. Army Brigadier General who held numerous intelligence and leadership positions throughout her 30-year military career. In her last government role, Jen served as the U.S. Army’s Director of Cyber, where she led governance and oversight of cyber capabilities and championed emerging technologies to detect and disrupt significant cyber threats.
In operational roles, Jen shaped U.S. Cyber Command’s response to major cyber events attributed to nationstate adversaries, led a U.S. government interagency task force to counter ISIS in cyberspace, and established relationships with U.S and foreign partners focused on mitigating the threat of cyber-attacks. As the first Chief of the Army’s cyber branch and training center, she developed and implemented strategies for cyber talent recruitment, retention, and leader development.
Jen currently serves on Everfox Executive Advisory Board and Cyber Risk Institute Board; as a Leadership Fellow with the Association of the U.S. Army, she engages with academic institutions, national organizations and community partners on national security, cyber operations, and leader development.
An Army Sports Hall of Fame athlete, master parachutist and former All-American collegiate swimmer, Jen holds a BS in Mechanical Engineering Management from West Point and an MBA from Central Michigan University. She was the first U.S. Army Cyber Fellow at the National Security Agency, completed Harvard’s Executive Education Program in Cybersecurity, National Association of Corporate Directors Battlefield to Boardroom program, and Carnegie Mellon’s Chief Risk Officer Certificate program.
Anjelica Dortch Senior Director & Head of Global Cybersecurity Policy, SAP
Read about Anjelica Dortch
Anjelica Dortch is Senior Director and Head of Global Cybersecurity Policy at SAP where she manages the company’s cybersecurity, artificial intelligence, and workforce policy portfolio. Prior to joining SAP, Ms. Dortch led scale up of tech policy positions at IBM within the Government and Regulatory Affairs team with a focus on artificial intelligence, hybrid cloud, and intellectual property. Ms. Dortch spent 10 years working for a variety of U.S. federal agencies including the Executive Office of the President as a Senior Technology Advisor where she led coordination of several tech policy initiatives within the U.S. government. She has co-authored U.S. policies and strategies including the 2018 National Cyber Strategy, the Presidential Executive Order on America’s Cybersecurity Workforce (EO 13870), the U.S. Federal Cloud Computing Strategy (or Cloud Smart), and the Administration’s Report on Artificial Intelligence. Ms. Dortch is the recipient of the Office of Management and Budget Special Achievement award, Women Leading for Impact award, the University of Maryland Outstanding Alumnus award, and Federal Computer Week’s Rising Star award. Ms. Dortch holds a Bachelor of Arts degree in Philosophy and a Master of Science in Financial Management and Information Systems from the University of Maryland.
Danielle Gilliam-Moore Director, Global Public Policy, Salesforce
Read about Danielle Gilliam-Moore
Danielle Gilliam-Moore first started her 5-year career on Capitol Hill as an intern for Senator Casey (D-PA) in 2010. Along the way, she worked for the Senate Committee on Homeland Security and Governmental Affairs, working on Cybersecurity and Counterterrorism. She then moved to work for Senator Tammy Baldwin (D-WI) where she was responsible for a portfolio that included defense, foreign relations, homeland security, and veterans’ issues. Danielle first worked off the Hill as the Manager for the Legislative Strategy team at BSA | The Software Alliance. In 2017 Danielle first joined Salesforce as Manager for Federal Government Affairs. Now as the Director for Global Public Policy, she works on software related policy issues such as trade, artificial intelligence, privacy, and cybersecurity.
Danielle is a graduate of Smith College where she earned a B.A. in political science and religious studies.
Christine Pelione Cybersecurity Strategic Risk Manager, General Motors Company
Read about Christine Pelione
Christine Pelione, GM’s Cybersecurity Strategic Risk Manager, is responsible for the management of enterprise, product, and manufacturing cybersecurity risk in securing innovative technologies throughout GM’s ecosystem and to engage cross-functionally to promote awareness and increase cyber resiliency across industries.
She is responsible for leading cybersecurity and corporate functions in elevating a holistic, enterprise-wide view of cyber risk and maturation; to integrate corporate cybersecurity strategies and processes; to identify and nurture collaborative engagements strengthening cybersecurity capabilities; to drive individual, corporate and industry cybersecurity culture; and to govern corporate business response and recovery efforts. Christine also serves as the Vice Chair of the Auto-ISAC’s Education and Training Standing Committee and as co-chair of the Small Business Advisory Council for the Cyber Readiness Institute.
Christine is currently pursuing a Master of Science in Information Technology Security and Assurance from Carnegie Mellon University, holds an Advanced Computer Science Certificate from Stanford University and a Bachelor of Arts in Business Administration from Baker College.
Moderators
Jeff Greene Senior Director, Cybersecurity Programs, Aspen Digital, The Aspen Institute
Read about Jeff Greene
Jeff Greene is the Senior Director for Cybersecurity Programs at the Aspen Institute. Jeff joined Aspen in July of 2022 from the White House, where he served as the Chief for Cyber Response & Policy in the National Security Council’s Cyber Directorate. Jeff led the NSC’s defensive cyber and incident response efforts, and his team developed and drafted Executive Order 14028 (Improving the Nation’s Cybersecurity). Jeff also ran the White House counter-ransomware effort and oversaw the whole-of-government effort to harden the cybersecurity of U.S. critical infrastructure in advance of Russia’s further invasion of Ukraine.
Jeff previously served as Director of the National Cybersecurity Center of Excellence at the National Institute of Standards and Technology (NIST). Prior to joining NIST he was the Vice President of Global Government Affairs and Policy at Symantec, where he led a global team of policy experts. While at Symantec Jeff also served as an appointed member of NIST’s Information Security and Privacy Advisory Board and was a special government employee working on President Obama’s 2016 Commission on Enhancing National Cybersecurity. Before Symantec Jeff worked on both the House and Senate Homeland Security Committees, was Counsel to the Senate’s Special Investigation into Hurricane Katrina, and practiced law at a large Washington, D.C. firm.
Ari Schwartz Managing Director of Cybersecurity Services and Policy, Venable LLP
Read about Ari Schwartz
A leading voice in national cybersecurity policy, Ari guides the establishment of cybersecurity consulting services for Venable and directs Venable’s Cybersecurity Risk Management Group. Ari assists organizations with understanding and developing risk management strategies, including implementation of the Cybersecurity Framework and other planning tools to help minimize risk. Ari also coordinates the Cybersecurity Coalition and the Center for Cybersecurity Policy and Law, a group of leading cybersecurity companies dedicated to educating policymakers on cybersecurity issues and promoting a vibrant marketplace for cybersecurity technology solutions and is the current Chair of the IT Sector Coordinating Council. Prior to joining Venable, Ari was a member of the White House National Security Council, where he served as special assistant to the president and senior director for cybersecurity. Ari also served in the Department of Commerce, where he advised the secretary on technology policy matters related to the National Institute of Standards and Technology (NIST), the National Telecommunications and Information Administration (NTIA), and the U.S. Patent and Trademark Office (USPTO).
Kemba Walden President, Paladin Global Institute
Read about Kemba Walden
Kemba Walden is an American lawyer who serves as the President of the Paladin Global Institute. Walden comes to Paladin after serving as the acting United States National Cyber Director in 2023. She joined the Office of the National Cyber Director as its inaugural principal deputy in June 2022. While at the White House, she substantially contributed to the development of and launched the National Cybersecurity Strategy (March 2023) and the corresponding Implementation Plan (June 2023). Walden also executed the joint OMB/ONCD Spring Guidance to Federal Departments and Agencies on cyber priorities as they develop their fiscal year 2025 budgets (June 2023). She had a substantial role in developing the National Cybersecurity Workforce and Education Strategy, ultimately executing it in July 2023. In addition, Walden lead the U.S. Government in U.S.-Cyber Dialogues with Singapore and Ukraine and was the head of the U.S. Delegation in several international cyber fora, including Cyber UK, Israel Cyber Week, and the OAS Cybersecurity Summit. In 2023, she brought cybersecurity into the global national security conversation at the Munich Security Conference.
Walden was previously an Assistant General Counsel in the digital crimes unit at Microsoft where she launched and lead Microsoft’s counter ransomware program. Prior to Microsoft, Walden spent a decade in government service at the United States Department of Homeland Security, most recently at the Cybersecurity and Infrastructure Security Agency where she focused on election security, the financial services sector, and the energy sector. Walden was also an inaugural member of the Cyber Safety Review Board responsible for reviewing the Log4Shell vulnerability as well as the Lapsus$ Ransomware gang and producing recommendations for improving the cybersecurity of the Nation.
Walden continues to serve as a co-chair of the Ransomware Task Force and serves as an adjunct professor at Georgetown’s School of Continuing Studies teaching a graduate level course entitled “Information Security Laws and Regulatory Compliance.”
She earned a B.A. from Hampton University, a Master’s in Public Affairs from Princeton University, and a J.D. from the Georgetown University Law Center.
{"includes":[{"object":"taxonomy","value":"134"}],"excludes":[{"object":"page","value":"203538"},{"object":"type","value":"callout"},{"object":"type","value":"form"},{"object":"type","value":"page"},{"object":"type","value":"article"},{"object":"type","value":"company"},{"object":"type","value":"person"},{"object":"type","value":"press"},{"object":"type","value":"report"},{"object":"type","value":"workstream"}],"order":[],"meta":"","rules":[],"property":"","details":["title"],"title":"Browse More Events","description":"","columns":2,"total":4,"filters":[],"filtering":[],"abilities":[],"action":"swipe","buttons":[],"pagination":[],"search":"","className":"random","sorts":[]}
Facebook
Twitter
LinkedIn
Email
