The framework includes recommendations for the steps businesses should take to implement a cybersecurity program or improve an existing one. The document also defines four tiers of cybersecurity readiness, with the lowest tier defined as a business with risk management practices that are "not formalized."
In the lowest tier, "risk is managed in an ad hoc and sometimes reactive manner," the framework said. "Prioritization of cybersecurity activities may not be directly informed by organizational risk objectives, the threat environment, or business/mission requirements."
At the other end of the cybersecurity spectrum, businesses with adaptive cybersecurity practices base their efforts on "lessons learned and predictive indicators derived from previous cybersecurity activities," the framework said. "Through a process of continuous improvement, the organization actively adapts to a changing cybersecurity landscape."
More than 3,000 people have engaged with NIST during the creation of the framework, Gallagher said. NIST will host a workshop on the framework Nov. 14 and 15 at North Carolina State University in Raleigh, and Gallagher expects the framework to evolve even after the official release next February.
Grant Gross covers technology and telecom policy in the U.S. government for The IDG News Service. Follow Grant on Twitter at GrantGross. Grant's email address is firstname.lastname@example.org.