Critical infrastructure companies could face new liability risks if they fail to meet voluntary cyber security standards being developed by the National Institute of Standards and Technology.
The slated release of a draft of the standard on Thursday was delayed, apparently due to the federal government shutdown. NIST's main website was shuttered on Thursday.
[ For a quick, smart take on the news you'll be talking about, check out InfoWorld TechBrief -- subscribe today. | Read Bill Snyder's Tech's Bottom Line blog for what the key business trends mean to you. ]
The standards effort was launched after an Executive Order by President Barack Obama earlier this year. A preliminary version of the draft standard has been floating around for several weeks, however.
The formal draft version, when released, will be available for public review until February 2014, according to the original schedule. Once the review is complete, will release a final version of the standards that incorporates changes recommended by stakeholders.
The NIST cyber security framework is designed to serve as a security best practices guide for organizations in critical infrastructure sectors, like power, telecommunications, financial services and energy. The framework was developed with input from industry stakeholders.
It is not designed to mandate specific security controls. Rather, it offers broad standards for identifying and protecting critical data, services and assets against cyber threats. It offers a set of best practices for detecting and responding to an attack, mitigating the fallout from cyber incidents and for managing risks overall.
Obama issued the Executive Order in February to address, what he said was an immediate need to protect critical infrastructure targets against cyber attacks. Administration officials said the order came only after repeated failures by Congress to pass meaningful cyber security legislation.
Participation in the standards program is voluntary. The Executive Order leaves it up to the federal agencies in charge of each critical sector to push adoption of the standards through a combination of incentives and other market driven means.
In practice though, critical infrastructure owners and operators will likely be left with little choice but to follow the standards, or at least show they have comparable security measures in place, said Jason Wool, an attorney with Venable LLP, a Washington D.C-based law firm.
Companies that ignore the standards and are breached will open themselves up to negligence, shareholder and breach of contract lawsuits along with other liability claims. The standards will likely be viewed as the minimum level of care and integrity within critical infrastructure sectors, Wool noted.
"You don't have to adopt these standards. But the fact that this framework [spells out] activities that are recommended for cyber security, establishes a bar that companies need to meet," Wool said. "The framework requires, at minimum, that owners and operators of critical infrastructure look at themselves and do a gap analysis."