    [Senate Hearing 114-86]
    [From the U.S. Government Publishing Office]

                                                            S. Hrg. 114-86

                      BUILDING A MORE SECURE CYBER FUTURE:
                   EXAMINING PRIVATE SECTOR EXPERIENCE WITH
                             THE NIST FRAMEWORK

    =======================================================================

                                    HEARING

                                   BEFORE THE

                             COMMITTEE ON COMMERCE,
                          SCIENCE, AND TRANSPORTATION
                              UNITED STATES SENATE

                        ONE HUNDRED FOURTEENTH CONGRESS

                                 FIRST SESSION

                                   __________

                                FEBRUARY 4, 2015

                                   __________

        Printed for the use of the Committee on Commerce, Science, and
                                 Transportation

    [GRAPHIC NOT AVAILABLE IN TIFF FORMAT]

                               U.S. GOVERNMENT PUBLISHING OFFICE
    96-958 PDF                     WASHINGTON : 2015
    ___________________________________________________________________________________
    For sale by the Superintendent of Documents, U.S. Government Publishing Office,
    http://bookstore.gpo.gov. For more information, contact the GPO Customer Contact Center,
    U.S. Government Publishing Office. Phone 202-512-1800, or 866-512-1800 (toll-free).
    E-mail, gpo@custhelp.com.

           SENATE COMMITTEE ON COMMERCE, SCIENCE, AND TRANSPORTATION

                        ONE HUNDRED FOURTEENTH CONGRESS

                                 FIRST SESSION

                       JOHN THUNE, South Dakota, Chairman
    ROGER F. WICKER, Mississippi         BILL NELSON, Florida, Ranking
    ROY BLUNT, Missouri                  MARIA CANTWELL, Washington
    MARCO RUBIO, Florida                 CLAIRE McCASKILL, Missouri
    KELLY AYOTTE, New Hampshire          AMY KLOBUCHAR, Minnesota
    TED CRUZ, Texas                      RICHARD BLUMENTHAL, Connecticut
    DEB FISCHER, Nebraska                BRIAN SCHATZ, Hawaii
    JERRY MORAN, Kansas                  EDWARD MARKEY, Massachusetts
    DAN SULLIVAN, Alaska                 CORY BOOKER, New Jersey
    RON JOHNSON, Wisconsin               TOM UDALL, New Mexico
    DEAN HELLER, Nevada                  JOE MANCHIN III, West Virginia
    CORY GARDNER, Colorado               GARY PETERS, Michigan
    STEVE DAINES, Montana
                        David Schwietert, Staff Director
                       Nick Rossi, Deputy Staff Director
                        Rebecca Seidel, General Counsel
                     Jason Van Beek, Deputy General Counsel
                     Kim Lipsky, Democratic Staff Director
                  Chris Day, Democratic Deputy Staff Director
           Clint Odom, Democratic General Counsel and Policy Director

                                C O N T E N T S

                                  ----------
                                                                       Page
    Hearing held on February 4, 2015.................................     1
    Statement of Senator Thune.......................................     1
    Statement of Senator Nelson......................................     3
    Statement of Senator Moran.......................................    35
    Statement of Senator Peters......................................    37
    Statement of Senator Schatz......................................    39
    Statement of Senator Daines......................................    41
    Statement of Senator Klobuchar...................................    43
    Statement of Senator Manchin.....................................    45
    Statement of Senator Udall.......................................    47
    Statement of Senator Gardner.....................................    48
    Statement of Senator Blumenthal..................................    51

                                   Witnesses

    Dr. Charles H. Romine, Director, Information Technology
      Laboratory, National Institute of Standards and Technology,
      U.S. Department of Commerce....................................     4
        Prepared statement...........................................     6
    Ann M. Beauchesne, Vice President, National Security and
      Emergency Preparedness, U.S. Chamber of Commerce...............    11
        Prepared statement...........................................    12
    Paul N. Smocer, President of BITS, Financial Services Roundtable.    18
        Prepared statement...........................................    20
    Jefferson H. England, Chief Financial Officer, Silver Star
      Communications.................................................    25
        Prepared statement...........................................    26
    Dr. James Lewis, Director and Senior Fellow, Strategic
      Technologies Program, Center for Strategic and International
      Studies........................................................    27
        Prepared statement...........................................    28

                                    Appendix

    Joshua J. Pauli, Ph.D., Associate Professor of Cyber Security,
      Dakota State University, prepared statement....................    55
    Letter dated February 18, 2014 to Hon. John Thune and Hon. Bill
      Nelson from Peter M. Cleveland, Vice President, Global Public
      Policy Group, Intel Corporation................................    56
    Letter dated February 4, 2015 to Hon. John Thune and Hon. Bill
      Nelson from Jennifer M. Safavian, Executive Vice President,
      Government Affairs, Retail Industry Leaders Association (RILA).    68
    Independent Community Bankers of America (ICBA), prepared
      statement......................................................    69
    Response to written questions submitted to Dr. Charles H. Romine
      by:
        Hon. John Thune..............................................    70
        Hon. Roy Blunt...............................................    72
    Response to written questions submitted to Ann M. Beauchesne by:
        Hon. John Thune..............................................    73
        Hon. Roy Blunt...............................................    75
        Hon. Bill Nelson.............................................    77
    Response to written questions submitted to Paul N. Smocer by:
        Hon. John Thune..............................................    79
        Hon. Roy Blunt...............................................    81
        Hon. Bill Nelson.............................................    82
    Response to written questions submitted to Jefferson H. England
      by:
        Hon. John Thune..............................................    83
    Response to written question submitted to Dr. James A. Lewis by:
        Hon. Roy Blunt...............................................    84
        Hon. Bill Nelson.............................................    85

         BUILDING A MORE SECURE CYBER FUTURE: EXAMINING PRIVATE SECTOR
                       EXPERIENCE WITH THE NIST FRAMEWORK

                                  ----------

                          WEDNESDAY, FEBRUARY 4, 2015

                                           U.S. Senate,
            Committee on Commerce, Science, and Transportation,
                                                        Washington, DC.
        The Committee met, pursuant to notice, at 9:59 a.m. in room
    SR-253, Russell Senate Office Building, Hon. John Thune,
    Chairman of the Committee, presiding.
        Present: Senators Thune [presiding], Blunt, Ayotte, Moran,
    Gardner, Daines, Nelson, Cantwell, Klobuchar, Blumenthal,
    Schatz, Udall, and Peters.

                 OPENING STATEMENT OF HON. JOHN THUNE,
                     U.S. SENATOR FROM SOUTH DAKOTA

        The Chairman. This hearing will come to order.
        Good morning and welcome.
        We are here today to examine the private sector's
    experience working with the National Institute of Standards and
    Technology to develop and utilize the Framework for Improving
    Critical Infrastructure Cybersecurity and also to look forward
    to additional steps that can be taken to help improve our
    Nation's cybersecurity.
        No country, company, or consumer is immune to cybersecurity
    threats. The United States faces a growing array of threats
    from hackers, from criminals, terrorists, and nation states who
    seek to gain access to sensitive or classified information.
    This also includes efforts to steal intellectual property or
    consumers' personal information, deny the availability of
    normally accessible online services, or potentially sabotage
    the networks and control systems of critical infrastructure.
        While cyber threats are not new, we saw a number of notable
    cyber events last year. In 2014, security flaws such as
    Sandworm, Shellshock, POODLE, and Heartbleed compromised
    millions of servers and systems. Attacks on point of sale
    systems sent ripples through the retail industry, not to
    mention the significant cyber hack of Sony Pictures.
        In 2014, after a decade without passage of major
    cybersecurity legislation, Congress passed five cybersecurity
    bills that were signed into law. I am especially pleased that
    our committee's work on the Cybersecurity Enhancement Act of
    2014, which I worked on with former Chairman Rockefeller, was
    one of those bills the President signed into law.
        Our Committee's bill ensures the continuation of a
    voluntary and industry-led process for identifying
    cybersecurity standards and best practices for critical
    infrastructure, codifying elements of the successful process
    that NIST undertook to create its Cybersecurity Framework and
    ensuring NIST's continued involvement in this public-private
    collaboration.
        The law also included important provisions for research and
    development, workforce development, and increased public
    awareness. It will help to protect the public and private
    sectors against the growing number of cyber threats from around
    the world by, among other things, strengthening and directing
    better cooperation across Federal agencies in research and
    development, improving our test beds and cloud computing
    security, and authorizing the National Science Foundation's
    successful Cybercorps scholarships.
        I am proud to note that Dakota State University in my home
    state is a leading institution of higher education in the area
    of cybersecurity. I appreciate that Dr. Josh Pauli, an
    Associate Professor of Cyber Security at DSU, has provided
    written remarks discussing that work, and I will submit those
    as a part of the record.
        I called today's hearing primarily to hear from
    stakeholders about their experience with the NIST Framework.
    Released almost one year ago today, the Framework provides a
    common language regarding security issues to facilitate
    discussions within a company between the technical IT security
    managers and senior management. While the Framework targets
    organizations that own or operate critical infrastructure,
    businesses across all sectors may find use of the Framework
    beneficial.
        The success of the Framework thus far is due in large part
    to NIST's collaborative relationship and engagement with the
    private sector. As a non-regulatory agency dedicated to
    promoting U.S. innovation and industrial competitiveness in
    ways that enhance economic security, NIST has been a genuine
    partner and has successfully combined its technical expertise
    in standards with the know-how of the private sector to help
    advance the Nation's technology infrastructure.
        Congress is now tasked with important questions about what
    actions the Federal Government should take next. Included among
    those questions is: one, how do we assess the effectiveness of
    the Framework going forward? What incentives do businesses and
    consumers need to improve their cyber defenses? What type of
    cyber threat information sharing legislation is needed to help
    industry defend against more sophisticated cyber attacks? What
    should we do to better secure our supply chain? And what more
    can be done in related areas?
        These questions are relevant to both the private and public
    sectors. According to the U.S. Government Accountability
    Office, ``Federal agencies have significant weaknesses in
    information security controls . . .'' Last year, I along with
    Senator Rockefeller sent letters to every agency under our
    committee's jurisdiction asking targeted questions about the
    measures being taken to protect systems using unsupported
    operating systems, as well as compliance with the Federal
    Information Security Management Act. As chairman, I will be
    continuing to conduct such oversight of agencies' information
    security management.
        While I am pleased that Congress took a positive step to
    improving our cybersecurity posture by passing a number of
    bills in December, I believe an absolutely missing piece for
    this Congress is finally passing legislation to spur greater
    cyber threat information sharing. It is my hope that the Senate
    can find a path forward in this area soon. The hearing being
    held today underscores the seriousness of the threat and our
    commitment to passing information sharing legislation that did
    not get done in the last Congress.
        I now yield to my distinguished Ranking Member, the Senator
    from Florida, Senator Nelson.

                    STATEMENT OF HON. BILL NELSON,
                       U.S. SENATOR FROM FLORIDA

        Senator Nelson. Thank you, Mr. Chairman. And that is music
    to my ears because that is exactly what we need, greater
    sharing, because cyber attacks and data breaches have real
    consequences on the lives of everyday Americans. They are
    painful for the American family that has to juggle their
    responsibilities while trying to replace their credit card or
    get back the money that was taken from them because of a
    compromised bank account, or reclaim his or her identity, which
    is a nightmare when it gets stolen.
        And they are costly for businesses that have been hacked.
    The estimate for Sony is something like $100 million. Some
    studies estimate that cyber attacks are costing American
    business as much as $400 billion a year. That is extraordinary.
    I see you nodding your head; I want you to testify about that.
        These cyber attacks also threaten the national security.
    Now, if a saboteur came and blew up an electric plant here,
    that would be an attack upon America. Well, a cyber attack can
    do the same thing. And it is coming whether it is in the form
    of an electrical plant or a business grid, or a water system--
    whatever is going to try to inject economic pain and terror
    into the American people. Those attacks are upon us right now,
    and sooner or later, they are going to be successful. So it is
    not a question of if. It is a question of when is the attack
    going to be successful like it was with Sony.
        Now, fortunately, we have got some things on our side.
    Everybody's awareness is being heightened. We have got a great
    National Institute of Standards and Technology that is
    constantly working. You mentioned the stuff in your home state.
    NIST just had their Cybersecurity Framework Workshop down in my
    state.
        We have really got to figure out how we are going to come
    together, whether it be entirely voluntarily or whether there
    be some kind of mandate, because the necessity for all of us
    coming together, both government and the private sector, is
    upon us because of the threat to our way of life and our
    standard of living.
        And so, Mr. Chairman, thank you. I take this very
    seriously. I had the privilege of serving as the Chairman of
    the Subcommittee in Armed Services, where I just came from,
    called Emerging Threats, which has as its jurisdiction
    cybersecurity and the national security interests. I am,
    needless to say, quite interested in this subject, and I
    appreciate your attention in calling this hearing.
        The Chairman. Thank you, Senator Nelson. You are right.
    This has some tremendous national security implications, not to
    mention the enormous economic harm that you alluded to and the
    impact that can have on our country's economic interests.
        We have a great panel with us today. We look forward to
    hearing from them. First off is going to be Dr. Charles Romine.
    He is the Director of the Information Technology Laboratory at
    the National Institute of Standards and Technology under the
    U.S. Department of Commerce. That is a long thing to put on a
    business card right there.
        Ms. Ann Beauchesne. Ms. Beauchesne is the Vice President of
    National Security & Emergency Preparedness at the United States
    Chamber of Commerce.
        Dr. Paul Smocer. Mr. Smocer is the President of BITS, the
    Technology Policy Division of the Financial Services
    Roundtable.
        Mr. Jefferson England. Mr. England is the Chief Financial
    Officer for Silver Star Communications.
        And Dr. James Lewis. Dr. Lewis is the Director and Senior
    Fellow of the Strategic Technologies Program at the Center for
    Strategic and International Studies, CSIS.
        So we will look forward to hearing from all of you. We will
    start at my left and your right with Dr. Romine.

             STATEMENT OF DR. CHARLES H. ROMINE, DIRECTOR,

              INFORMATION TECHNOLOGY LABORATORY, NATIONAL

                 INSTITUTE OF STANDARDS AND TECHNOLOGY,

                      U.S. DEPARTMENT OF COMMERCE

        Dr. Romine. Thank you, Chairman Thune, Ranking Member
    Nelson, and members of the Committee. I am Dr. Charles Romine,
    the Director of the Information Technology Laboratory at NIST.
    Thank you for the opportunity to appear before you today to
    discuss our work in cybersecurity.
        NIST has worked in cybersecurity with Federal agencies,
    industry, and academia since 1972. Our role to research,
    develop, and deploy information security standards and
    technology to protect information systems against threats to
    the confidentiality, integrity, and availability of information
    and services was strengthened through the Computer Security Act
    of 1987, broadened through the Federal Information Security
    Management Act of 2002, and reaffirmed in the Federal
    Information Security Modernization Act of 2014. The
    Cybersecurity Enhancement Act of 2014 also authorizes NIST to
    facilitate and support the development of voluntary, industry-
    led cybersecurity standards and best practices for critical
    infrastructure.
        NIST accomplishes its mission in cybersecurity through
    collaborative partnerships with our national and international
    stakeholders in industry, government, academia, standards
    bodies, and consortia.
        A prime example of these collaborations is the Framework
    for Improving Critical Infrastructure Cybersecurity, or just
    the Framework, in response to Executive Order 13636. The
    Framework consists of standards, guidelines, and practices to
    promote the protection of critical infrastructure. The
    prioritized, flexible, repeatable, and cost-effective approach
    of the Framework helps owners and operators of critical
    infrastructure align their policies, technologies, and day-to-
    day business operations to better protect their data and their
    information technology and industrial control systems and
    tailor it to individual needs.
        The fact that the Framework is and will remain voluntary
    allows us to bring the maximum number of stakeholders to the
    table.
        The Framework was always designed to be a living document,
    shaped by the experiences of those using it. Based on recent
    feedback, I would like to share some thoughts about where we
    are now almost a year since the release of the Framework.
        Organizations are using the Framework in a variety of ways,
    such as raising awareness within their organization, including
    with executive leadership, improving communications of
    cybersecurity expectations with business partners, suppliers,
    and across and among sectors, and demonstrating alignment with
    standards, guidelines, and best practices. We have been
    encouraged by seeing expanding networks within and across
    sectors of the economy utilizing the Framework, making it more
    relevant to their stakeholders.
        For example, technology companies are developing products
    and services tied to the Framework. The auditing community is
    leveraging the Framework to provide a consistent auditable
    standard, and many states are leveraging the Framework to
    improve the security of their critical infrastructure.
        As the Framework incorporates globally recognized standards
    for cybersecurity, it is also serving as a model for other
    countries.
        Current feedback indicates widespread agreement that it is
    too early to update the Framework. Waiting will allow for tools
    and services to be built and implemented. In the meantime, NIST
    will continue the open, transparent, and inclusive process as
    it considers producing guidance on the challenging aspects of
    implementation. NIST will work on areas singled out by the
    Roadmap for Improving Critical Infrastructure Cybersecurity and
    will continue exploring options for future governance of the
    Framework, understanding the benefits of this being a private
    sector-maintained process in the future.
        NIST recognizes our essential role in helping industry,
    consumers, and government manage cybersecurity risks. We are
    extremely proud of our role in establishing and improving the
    comprehensive set of cybersecurity technical solutions,
    standards, guidelines, and best practices and the robust
    collaborations with our Federal Government partners, private
    sector collaborators, and international colleagues.
        But there is still much to do. A sustained dialogue between
    government and the private sector is critical to ensuring we
    can respond to those growing challenges, and we appreciate the
    support of the Committee in this effort.
        Thank you for the opportunity to testify today on NIST's
    work in cybersecurity, and I would be happy to answer any
    questions you may have.
        [The prepared statement of Dr. Romine follows:]

      Prepared Statement of Dr. Charles H. Romine, Director, Information
          Technology Laboratory, National Institute of Standards and
                Technology, United States Department of Commerce
    Introduction
        Chairman Thune, Ranking Member Nelson and Members of the Committee,
    I am Dr. Charles Romine, the Director of the Information Technology
    Laboratory (ITL) at the Department of Commerce's National Institute of
    Standards and Technology (NIST). Thank you for the opportunity to
    appear before you today to discuss NIST's work in cybersecurity.
    The Role of NIST in Cybersecurity
        With programs focused on national priorities from the Smart Grid
    and electronic health records to forensics, atomic clocks, advanced
    nanomaterials, and computer chips and more, NIST's overall mission is
    to promote U.S. innovation and industrial competitiveness by advancing
    measurement science, standards, and technology in ways that enhance
    economic security and improve the quality of life.
        In the area of cybersecurity, NIST has worked with Federal
    agencies, industry, and academia since 1972, starting with the
    development of the Data Encryption Standard, when the potential
    commercial benefit of this technology became clear. NIST's role, to
    research, develop and deploy information security standards and
    technology to protect the Federal Government's information systems
    against threats to the confidentiality, integrity and availability of
    information and services, was strengthened through the Computer
    Security Act of 1987 (Public Law 100-235), broadened through the
    Federal Information Security Management Act of 2002 (FISMA; 44 U.S.C.
    Sec. 3541 \1\) and recently reaffirmed in the Federal Information
    Security Modernization Act of 2014 (Public Law 113-283). Importantly,
    the Cybersecurity Enhancement Act of 2014 (Public Law 113-274)
    authorizes NIST to facilitate and support the development of voluntary,
    industry-led cybersecurity standards and best practices for critical
    infrastructure--consistent with NIST's role in implementation of
    Executive Order 13636, ``Improving Critical Infrastructure
    Cybersecurity''.
    ---------------------------------------------------------------------------
        \1\ FISMA was enacted as Title III of the E-Government Act of 2002
    (Public Law 107-347; 116 Stat. 2899).
    ---------------------------------------------------------------------------
        NIST accomplishes its mission in cybersecurity through
    collaborative partnerships with its customers and stakeholders in
    industry, government, academia, standards bodies, consortia and
    international partners.
    NIST Engagement with Industry
        Beyond NIST's responsibilities under FISMA, under the provisions of
    the National Technology Transfer and Advancement Act (PL 104-113) and
    related OMB Circular A-119, NIST is tasked with the key role of
    encouraging and coordinating Federal agency use of voluntary consensus
    standards and participation in the development of relevant standards,
    as well as promoting coordination between the public and private
    sectors in the development of standards and in conformity assessment
    activities. NIST works with other agencies, such as the Department of
    State, to coordinate standards issues and priorities with the private
    sector through consensus standards organizations such as the American
    National Standards Institute (ANSI), the International Organization for
    Standardization (ISO), the Institute of Electrical and Electronics
    Engineers (IEEE), the Internet Engineering Task Force (IETF), and the
    International Telecommunications Union (ITU).
        Partnership with industry to develop, maintain, and implement
    voluntary consensus standards related to cybersecurity best ensures the
    interoperability, security and resiliency of the global infrastructure
    needed to make us all more secure. It also allows this infrastructure
    to evolve in a way that embraces both security and innovation--allowing
    a market to flourish to create new types of secure products for the
    benefit of all Americans.
        NIST believes further development of cybersecurity standards will
    be needed to improve the security and resiliency of critical U.S.
    information and communication infrastructure. The availability of
    cybersecurity standards and associated conformity assessment schemes is
    essential in these efforts, which NIST supports to help enhance the
    deployment of sound security solutions and build trust among those
    creating and those using the solutions throughout the country.
    Cybersecurity Framework: Current Status
        Almost one year ago, NIST issued The Framework for Improving
    Critical Infrastructure Cybersecurity (Framework) in accordance with
    Section 7 of Executive Order 13636, ``Improving Critical Infrastructure
    Cybersecurity'' (Executive Order). The Framework, created through
    collaboration between industry and government, consists of standards,
    guidelines, and practices to promote the protection of critical
    infrastructure. The prioritized, flexible, repeatable, and cost-
    effective approach of the Framework helps owners and operators of
    critical infrastructure to manage cybersecurity-related risk.
        Executive Order 13636 was designed to increase protection across
    the full range of Critical Infrastructure--those systems and assets
    that the Nation's economic and national security rely upon. Under
    Executive Order 13636, Federal Government security agencies were
    charged to increase the flow of valuable threat information to
    industry, and NIST was charged to play a convener and facilitator role
    in supporting the private sector's efforts to develop the Cybersecurity
    Framework.
        The goal of the Framework is to help organizations align their
    policies, technologies, and day-to-day business operations to better
    protect their data and their information technology (IT) and industrial
    control systems.
        The Framework also was designed to assess the capacity of the
    market to deliver better cybersecurity protection. During the
    development process for the Framework, NIST asked industry to
    contribute ideas about what standards, guidelines, and best practices
    could be used more widely to better manage cybersecurity risks, and
    then what steps should be taken to develop the next set of tools in
    these public-private partnerships.
        In the course of developing the Framework document published in
    February of 2014, NIST estimates that more than 3,000 people from
    industry, academia, and government came to participate in workshops and
    webinars, while providing hundreds of detailed comments on drafts. The
    NIST approach was premised on the understanding that a Framework
    designed by industry would gain greater adoption throughout the private
    sector, and could support a vibrant market for IT security products and
    services.
        The result of this effort is a dynamic tool that has two main
    parts.
        First, the Framework is a collection of existing standards and best
    practices that proved to be helpful in protecting systems from cyber
    threats and ensuring business confidentiality, while protecting
    individual privacy and civil liberties.
        Second, the Framework sets out basic guidelines that organizations
    can use in adopting those practices, providing them with a coherent
    structure to consider the many, varied approaches to cybersecurity that
    have proliferated in recent years.
        NIST heard over and over that a key challenge facing information
    security professionals, senior business leaders, and company executives
    and boards of directors striving to address cybersecurity, was the lack
    of a common vocabulary and approach. As a result, the Framework starts
    with general guidance, and cascades to the more technical and specific,
    to help facilitate that dialogue with and within an organization.
        The fact that the Framework is--and will remain--voluntary has
    allowed NIST to continue to bring the maximum number of stakeholders to
    the table. And the inherent flexibility of the Framework allows each
    organization to tailor it to individual needs.
        Since the release of the Framework, NIST has strengthened its
    collaboration with critical infrastructure owners and operators,
    industry leaders, government partners, and other stakeholders to raise
    awareness about the Framework, encourage use by organizations across
    and supporting the critical infrastructure, and develop implementation
    guides and resources.
        NIST, along with its partners across government, has focused on
    building on that initial awareness and on working arm-in-arm with the
    private sector as the Framework begins to be used within organizations,
    and as those organizations develop supporting products and services.
        The Framework was designed to be a ``living'' document, shaped by
    the experiences of those using it. To learn more about these
    experiences, NIST released a Request for Information (RFI) \2\ on
    August 26, 2014, and held its 6th Cybersecurity Framework Workshop at
    the University of South Florida in Tampa, Florida, on October 29 and
    30, 2014. Responses to the RFI came from industry, academia and
    government organizations at multiple levels, as well as organizations
    representing large constituencies and key stakeholders in critical
    infrastructure sectors.
    ---------------------------------------------------------------------------
        \2\ RFI--Experience with the Framework for Improving Critical
    Infrastructure Cybersecurity, August 26, 2014, https://
    federalregister.gov/a/2014-20315
    ---------------------------------------------------------------------------
        Based on that feedback, and NIST's continued work, I'd like to
    share some thoughts about where NIST is now--almost a year since the
    release of the Framework.
        NIST found that organizations are using the Framework in a variety
    of ways. Many users have found the Framework helpful in raising
    awareness and communicating with stakeholders within their
    organization, including executive leadership. It is also being used to
    improve communications across organizations, allowing cybersecurity
    expectations to be shared with business partners, suppliers, and among
    sectors. The Framework is being used to demonstrate alignment with
    standards, guidelines, and best practices. The Framework is also being
    used as a strategic planning tool to assess risks and current
    practices.
        In addition to those ``users,'' we have been encouraged by seeing
    expanding networks--within and across sectors of the economy--beginning
    to learn about and take advantage of the Framework, making it more
    relevant to their stakeholders.
        This includes:

       Technology companies have been developing products and
            services aligned with the Framework.

       Communities of interest and associations have been sharing
            practical advice to help organizations to optimize their use of
            the Framework.

       The auditing community has begun to leverage the Framework
            to provide a consistent auditable standard.

       Major insurance providers have begun to offer policies tied
            to the Framework and are promoting it among their policy-
            holders.

       States have begun to leverage the Framework to improve the
            security of their infrastructure, including as a foundation for
            their work in cybersecurity for state emergency management
            agencies.

        And, in part because the Framework incorporates globally recognized
    voluntary standards for cybersecurity, it is serving as a model for
    other countries, allowing them to match their business' perspectives
    with their governments' needs. In other words, this is not a ``U.S.-
    only'' Framework.
    Cybersecurity Framework: Next Steps
        NIST is continuing its outreach and awareness program through
    discussions with international partners, global companies and other
    interested governments, while NIST continues the primary outreach
    efforts to U.S. industries and organizations. This includes outreach to
    regulatory agencies, to facilitate a consistent understanding of the
    Framework across the Federal Government, and to reinforce that the
    Framework is not designed or intended to create additional requirements
    for owners and operators of critical infrastructure, who are otherwise
    subject to regulatory requirements.
        As NIST learns from individual organizations about their
    experiences with the Framework--good or otherwise--NIST hopes to share
    that knowledge and insight with others so that they may gain confidence
    in using the Framework. NIST also hopes to provide specifics, for
    example, through appropriate ``case studies,'' for those who are
    seeking more information on how to build or improve their own
    cybersecurity programs.
        The data that is collected and reflected will be the source
    information for any determinations or suggestions for changes that
    might be needed to the Framework going forward. The Framework is
    envisioned as a ``living document.'' At this point, however, there is
    rather widespread agreement among workshop participants that it is too
    soon to consider updating the Framework, and that NIST should continue
    efforts to promote understanding and use of the current version. This
    will allow industry the time to implement, for tools and service to be
    built and offered, as well as for the common vocabulary of the
    Framework to become established. In any event, any changes that might
    be made to the Framework will be made through the same open,
    transparent and inclusive process that was used in the initial creation
    of the Framework.
        In the months ahead, NIST will focus on the challenging aspects of
    implementation and will consider producing guidance that will help
    organizations address these challenges. No modifications or new
    versions of the Framework are anticipated within the next year,
    although NIST will continue to work on areas singled out in the Roadmap
    for Improving Critical Infrastructure Cybersecurity, \3\ released the
    same time as the Framework. NIST also will continue to explore options
    for future governance of the Framework, based on NIST's appreciation of
    the long-term benefits of the Framework becoming a private-sector
    maintained process in the future.
    ---------------------------------------------------------------------------
        \3\ http://www.nist.gov/cyberframework/upload/roadmap-021214.pdf
    ---------------------------------------------------------------------------
        NIST will continue, and increase, its efforts to raise awareness of
    the Framework, including through partnerships with other organizations.
    NIST's efforts will be carried out in the same open and collaborative
    manner which was the hallmark of the Framework's development. One
    priority will be to develop and disseminate information and training
    materials that advance use of the Framework, such as actual or
    exemplary illustrations of how organizations of varying sizes, types,
    and cybersecurity capabilities can practically employ the Framework to
    make themselves more secure.
    National Initiative for Cybersecurity Education
        I would like to provide you now with an update on NIST's work to
    support building a capable cybersecurity workforce--a workforce that is
    agile and can adapt to meet the national need to design, develop,
    implement, maintain and continuously improve cybersecurity, consistent
    with the relevant provisions of the Cybersecurity Enhancement Act of
    2014.
        In 2010, the National Initiative for Cybersecurity Education (NICE)
    was established to enhance the overall cybersecurity posture of the
    United States by accelerating the availability of educational,
    training, and workforce development resources designed to improve the
    cybersecurity behavior, skills, and knowledge of every segment of the
    population. As the lead agency for this initiative, NIST works with
    more than 20 Federal departments and agencies, as well as with industry
    and academia, to raise national awareness about risks in cyberspace,
    broaden the pool of individuals prepared to enter the cybersecurity
    profession, and cultivate a globally competitive cybersecurity
    workforce.
        NICE has also aligned with the President's Job-Driven Training
    Initiative to increase the number of individuals who complete high-
    quality cybersecurity training and education programs and attain the
    skills most needed to provide a pipeline of skilled workers for
    industry and government.
    Additional Research Areas
        NIST performs research and development in related technologies,
    such as the usability of systems including electronic health records,
    voting machines, biometrics and software interfaces. NIST is performing
    basic research on the mathematical foundations needed to determine the
    security of information systems. In the areas of digital forensics,
    NIST is enabling improvements in forensic analysis through the National
    Software Reference Library and computer forensics tool testing.
    Software assurance metrics, tools, and evaluations developed at NIST
    are being implemented by industry to help strengthen software against
    hackers. NIST responds to government and market requirements for
    biometric standards by collaborating with other Federal agencies,
    academia, and industry partners to develop and implement biometrics
    evaluations, enable usability, and develop standards (fingerprint,
    face, iris, voice/speaker, and multimodal biometrics). NIST plays a
    central role in defining and advancing standards, and collaborating
    with customers and stakeholders to identify and reach consensus on
    cloud computing standards.
    Conclusion
        NIST recognizes that it has been entrusted with an essential role
    in helping industry, consumers and government to manage cybersecurity
    risks.
        NIST is extremely committed to fulfilling that role; it is
    committed to improving on existing cybersecurity technical solutions,
    standards, guidelines, and best practices, through robust
    collaborations with our Federal Government partners, private sector
    collaborators, and international colleagues; and NIST is committed to
    helping to ensure that government needs stay aligned with, and are
    informed by, the needs of American industry.
        But let us be clear, and here I am not telling this Committee
    anything it does not know well: even with the body of work that is now
    behind us, there is still much to do. NIST will continue a sustained
    dialogue between government and the private sector to ensure it can be
    responsive to ever-evolving cybersecurity challenges, and in this NIST
    has appreciated the support of the Committee.
        Thank you for the opportunity to testify today on NIST's work in
    cybersecurity. I would be happy to answer any questions you may have.
                                   Attachment
                               Charles H. Romine
    [GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]

        Charles Romine is Director of the Information Technology Laboratory
    (ITL). ITL, one of seven research Laboratories within the National
    Institute of Standards and Technology (NIST), has an annual budget of
    $150 million, more than 350 employees, and about 160 guest researchers
    from industry, universities, and foreign laboratories. Dr. Romine
    oversees a research program designed to promote U.S. innovation and
    industrial competitiveness by developing and disseminating standards,
    measurements, and testing for interoperability, security, usability,
    and reliability of information systems, including cybersecurity
    standards and guidelines for Federal agencies and U.S. industry,
    supporting these and measurement science at NIST through fundamental
    and applied research in computer science, mathematics, and statistics.
    Through its efforts, ITL supports NIST's mission, to promote U.S.
    innovation and industrial competitiveness by advancing measurement
    science, standards, and technology in ways that enhance economic
    security and improve our quality of life. Within NIST's traditional
    role as the overseer of the National Measurement System, ITL is
    conducting research addressing measurement challenges in information
    technology as well as issues of information and software quality,
    integrity, and usability. ITL is also charged with leading the Nation
    in using existing and emerging IT to help meet national priorities,
    including developing cybersecurity standards, guidelines, and
    associated methods and techniques, cloud computing, electronic voting,
    smart grid, homeland security applications, and health information
    technology.
    Education

    Ph.D. in Applied Mathematics from the University of Virginia

    B.A. in Mathematics from the University of Virginia

        The Chairman. Thank you, Dr. Romine.
        Ms. Beauchesne?

            STATEMENT OF ANN M. BEAUCHESNE, VICE PRESIDENT,

             NATIONAL SECURITY AND EMERGENCY PREPAREDNESS,

                        U.S. CHAMBER OF COMMERCE

        Ms. Beauchesne. Thank you. Good morning, Chairman Thune,
    Ranking Member Nelson, and members of the Committee. My name is
    Ann Beauchesne. I am the Vice President of the U.S. Chamber's
    National Security and Emergency Preparedness Department. On
    behalf of the Chamber, I welcome the opportunity to testify
    before the Senate Commerce Committee regarding the business
    community's experience with NIST's Framework for Improving
    Critical Infrastructure Cybersecurity.
        I want to thank the Committee for holding today's hearing.
    Recent cyber incidents underscore the need to keep building
    toward a more secure and resilient cyber future at home and
    globally.
        The good news is that addressing sophisticated cyber
    threats against American businesses has gone from an IT issue
    to a top priority for company executives and boards of
    directors. My statement will focus on the successful rollout of
    the Framework and the positive collaboration that many
    businesses and government entities have developed over the past
    several months.
        The Chamber's promotion of the Framework through our
    Cybersecurity Campaign, as well as the urgent need for
    cybersecurity information sharing legislation. It is
    encouraging to see that the administration has put forward its
    own views on cybersecurity information sharing legislation as
    well. Legislation is needed to help businesses improve their
    awareness of cyber threats, as well as to enhance their
    protection and response capabilities.
        The Chamber believes that the development and rollout of
    the Framework has been a success. We view the Framework as one
    of the best examples of a public-private partnership in action.
    From conception to release, the Chamber, trade associations,
    and companies of all sizes and sectors collaborated closely
    with the administration, NIST, and the Department of Homeland
    Security in developing the Framework. Much of industry's
    favorable reaction is owed in large measure to NIST. They have
    treated the business community as a genuine partner and tackled
    a tough assignment in ways that ought to serve as a model for
    other agencies.
        Last spring, the administration sent the business community
    a powerful message, saying that the Framework should remain
    collaborative, voluntary, and innovative over the long term, in
    a word, ``non-regulatory.'' Businesses need flexible solutions
    to respond to the rapidly changing threat environment. As
    threats continue to evolve, businesses must be able to adapt
    accordingly.
        I appreciate the comments of Silver Star Communications'
    Jeff England who notes in his written testimony that a
    regulatory approach to cybersecurity distracts policymakers'
    attention from the root problem, that is, attacks coming from
    organized criminals and state-sponsored groups.
        Since the Framework's release last February, industry has
    demonstrated its commitment to using it. Critical
    infrastructure are keenly aware and supportive of the
    Framework.
        In my written testimony, I have outlined how numerous
    associations and trade groups are creating tools and resources
    for their members and holding events around the country to
    promote cybersecurity awareness and education of the Framework.
    Going forward, we urge policymakers to commit even greater
    resources over the next several years to grow awareness of the
    Framework and risk-based tools for cybersecurity.
        The Chamber has launched its own cybersecurity campaign
    under the banner of Improving Today, Protecting Tomorrow. Last
    year, we organized roundtable events with State and local
    chambers in Chicago, Austin, Everett, and Phoenix in the run-up
    to our third annual cybersecurity summit in October. Each
    roundtable featured cybersecurity principles from the White
    House, DHS, NIST, as well as local FBI and Secret Service
    officials. At these roundtables, the Chamber and our Federal
    partners have urged businesses of all sizes and sectors to
    adopt fundamental security practices to reduce network and
    system weaknesses. The Chamber is planning to hold more
    cybersecurity roundtables this year with our Federal partners,
    as well as our fourth annual cybersecurity summit on October 6.
        The Framework is a good start, but more work is needed to
    push back against skilled attackers. No single tool or approach
    can prevent advanced and persistent threats or state-sponsored
    cyber attacks. Most small and mid-sized businesses tend to lack
    the money and personnel to beat back highly advanced and
    nefarious actors.
        Despite the Chamber's strong support for the Framework, the
    effort will be incomplete without getting information sharing
    legislation done. While the Chamber recognizes that the
    Commerce Committee does not have jurisdiction over
    cybersecurity information sharing legislation, we continue to
    push Congress to pass a bill that includes robust safeguards
    such as liability, regulatory, FOIA, and antitrust protections
    for businesses that voluntarily exchange threat data with their
    peers and with the Government.
        Last week, 35 associations, including the Chamber, sent the
    Senate a letter urging lawmakers to quickly pass a cyber
    information sharing bill.
        The Senate Intelligence Committee passed a smart and
    workable bill last year which earned broad bipartisan support.
        Cyber attacks aimed at U.S. businesses and government
    entities are being launched from various sources, including
    sophisticated hackers, organized crime, and state-sponsored
    groups. Congressional action on information sharing cannot come
    quickly enough.
        Again, I want to thank you for inviting me to be here. The
    Chamber looks forward to working with you and your staff, and I
    would be happy to answer any questions.
        [The prepared statement of Ms. Beauchesne follows:]

       Prepared Statement of Ann M. Beauchesne, Vice President, National
         Security and Emergency Preparedness, U.S. Chamber of Commerce
        Good morning, Chairman Thune, Ranking Member Nelson, and other
    distinguished members of the Committee. My name is Ann Beauchesne, and
    I serve as vice president of the U.S. Chamber's National Security and
    Emergency Preparedness Department. On behalf of the Chamber, I welcome
    the opportunity to testify before the Senate Commerce committee
    regarding the business community's experience with the National
    Institute of Standards and Technology's (NIST's) Framework for
    Improving Critical Infrastructure Cybersecurity (the framework).\1\
    ---------------------------------------------------------------------------
        \1\ See www.nist.gov/cyberframework.
    ---------------------------------------------------------------------------
        The National Security and Emergency Preparedness Department was
    established in 2003 to develop and implement the Chamber's homeland and
    national security policies. The department works through the National
    Security Task Force, a policy committee composed of roughly 200 Chamber
    members representing practically every sector of the American economy.
    The task force's Cybersecurity Working Group identifies current and
    emerging issues, crafts policies and positions, and provides analysis
    and direct advocacy to government and business leaders.
        The need to address increasingly sophisticated threats against U.S.
    and global businesses has gone from an IT issue to a top priority for
    the C-suite and the boardroom. Chamber President and CEO Thomas J.
    Donohue recently said, ``In an interconnected world, economic security
    and national security are linked. To maintain a strong and resilient
    economy, we must protect against the threat of cyberattacks.''
        My statement focuses on the successful rollout of the framework and
    the positive collaboration that many businesses and government entities
    have developed over the past several months, including our new
    cybersecurity campaign--Improving Today, Protecting
    TomorrowTM. I am also going to highlight policy issues--
    information-sharing legislation being the top legislative priority--
    that lawmakers and the administration need to diligently address. The
    information-sharing discussion puts too little emphasis on improving
    government-to-business sharing. The Chamber wants to expand government-
    to-business information sharing, which is progressing but needs
    improvement.\2\
    ---------------------------------------------------------------------------
        \2\ The Chamber submitted in October 2014 similar comments to
    National Institute of Standards and Technology (NIST) related to
    businesses' awareness and use of the framework. See http://
    csrc.nist.gov/cyberframework/rfi_comments_10_2014.html.
    ---------------------------------------------------------------------------
        The framework is a good start, but more work is needed to push back
    against skilled attackers. Most small and midsize businesses (SMBs)
    tend to lack the money and personnel to beat back highly advanced and
    nefarious actors, such as organized criminal gangs and groups carrying
    out state-sponsored attacks. No single strategy can prevent advanced
    and persistent threats--popularly known as APTs in cybersecurity
    jargon--from breaching an organization's cyber defenses.
        Policymakers have not sufficiently acknowledged this expensive,
    practical reality. American companies should not be expected to
    shoulder the substantial costs of cyberattacks emanating from well-
    resourced bad actors such as criminal syndicates or nation-states--
    costs typically absorbed by national governments. Nation-states or
    their proxies and other sophisticated actors are apparently hacking
    businesses with impunity--and that has got to stop.
        In addition to having policymakers acknowledge cost concerns, the
    Chamber would welcome working with the administration and Congress on
    establishing an intelligent and forceful deterrence strategy, which the
    United States currently lacks. U.S. policymakers need to focus on
    pushing back against illicit actors and not on blaming the victims of
    cybersecurity incidents.\3\
    ---------------------------------------------------------------------------
        \3\ The Chamber submitted comments to the Department of Homeland
    Security (DHS) on cybersecurity solutions for small and midsize
    businesses (SMBs) in April 2014.
    ---------------------------------------------------------------------------
    The Framework Is an Excellent Example of an Effective Public-Private
            Partnership; Critical Infrastructure Awareness of the Framework
            Is Strong, and Sector Activities Are Robust and Maturing
        The Chamber believes that the framework--which was released last
    February--has been a success. The framework represents one of the best
    examples of public-private partnerships in action. NIST and
    stakeholders in the public and private sectors should have a great
    sense of accomplishment. The Chamber, sector-based coordinating
    councils and associations, companies, and other entities collaborated
    closely with NIST in developing the framework since the first workshop
    was held in April 2013.
        Critical infrastructure sectors are keenly aware of and supportive
    of the framework. The Chamber understands that critical infrastructures
    at ``greatest risk'' have been identified and engaged by administration
    officials under the terms of the cyber executive order (EO).\4\
    Government officials ought to ensure that all resources, particularly
    the latest cyber threat indicators, are available to these enterprises
    to counter increasing and advanced threats.
    ---------------------------------------------------------------------------
        \4\ Executive Order (EO) 13636, Improving Critical Infrastructure
    Cybersecurity, is available at www.gpo.gov/fdsys/pkg/FR-2013-02-19/pdf/
    2013-03915.pdf.
    ---------------------------------------------------------------------------
        Further, important elements of U.S. industry are aware of the
    framework and are using it or similar risk management tools. Indeed,
    the Chamber welcomed an assessment from Michael Daniel, White House
    special assistant to the president and cybersecurity coordinator, who
    remarked on September 23, 2014, at the Chamber's third cyber roundtable
    in Everett, Washington, that industry's response to the framework has
    been ``phenomenal.''
        A second White House official, Ari Schwartz, senior director for
    cybersecurity, noted on October 1, 2014, that business support for the
    framework has ``exceeded expectations.'' Such recognition is
    constructive and helps keep the private sector engaged in using the
    framework and promoting it with business partners.\5\
    ---------------------------------------------------------------------------
        \5\ See ``At eight-month mark, industry praises framework and eyes
    next steps,'' Inside Cybersecurity, October 6, 2014, http://
    insidecybersecurity.com/Cyber-Daily-News/Daily-News/at-eight-month-
    mark-industry-praises-framework-and-eyes-next-steps/menu-id-1075.html.
    ---------------------------------------------------------------------------
        Much of industry's favorable reaction is owed in large measure to
    NIST, which tackled the framework's development in ways that ought to
    serve as a model for other agencies and departments. In May 2014, the
    administration sent the business community a powerful message, saying
    that the framework should remain collaborative, voluntary, and
    innovative over the long term.\6\ Interestingly, public focus on the
    framework has created visibility into industry's long-standing efforts
    to address cyber risks and threats--constant, dedicated, and (mostly)
    silent efforts that preceded the creation of the framework.\7\
    ---------------------------------------------------------------------------
        \6\ The Chamber agrees with Michael Daniel's May 22 blog, Assessing
    Cybersecurity Regulations, at www.whitehouse.gov/blog/2014/05/22/
    assessing-cybersecurity-regulations. The blog says that business and
    government ``must build equally agile and responsive capabilities not
    bound by outdated and inflexible rules and procedures.'' The Chamber
    and industry partners especially urge independent agencies and Congress
    to adhere to the dynamic approach advocated by the administration and
    that is embodied in the nonregulatory, public-private framework. See
    June 11, 2014 letter, available at www.uschamber.com/sites/default/
    files/documents/files/11June14GroupLetterT-
    YReplytoDanielCyberBlog_Final_0.pdf.
        \7\ The online publication Inside Cybersecurity provides an
    excellent catalog of industry initiatives to implement data-and
    network-security best practices. See http://insidecyber
    security.com/Sectors/menu-id-1149.html.
    ---------------------------------------------------------------------------
        Most notable, since the framework's release, industry has
    demonstrated its commitment to using it. Many associations are creating
    resources for their members and holding events across the country and
    taking other initiatives to promote cybersecurity education and
    awareness of the framework. Some examples are listed here. Associations
    are planning and exploring additional activities as well.

       The Alliance of Automobile Manufacturers and the Association
            of Global Automakers have initiated a process to establish an
            automobile industry sector information-sharing and analysis
            center (Auto-ISAC) to voluntarily collect and share information
            about existing or potential threats to the cybersecurity of
            motor vehicle electronics and in-vehicle networks.

       The American Chemistry Council (ACC) is developing sector-
            specific guidance based on the NIST cyber framework to further
            enhance and implement the council's Responsible Care Security
            Code. ACC's Chemical Information Technology Center (ChemITC) is
            also piloting an ISAC for the chemical sector.

       The American Gas Association (AGA) has hosted a series of
            webinars on control system cybersecurity, is collaborating with
            small utilities to develop robust cybersecurity programs, and
            is working with companies to review and enhance their
            cybersecurity posture using the Oil and Natural Gas Subsector
            Cybersecurity Capability Maturity Model (ONG-C2M2) from the
            Department of Energy (DOE). Among other activities, AGA has
            stood up the Downstream Natural Gas Information and Analysis
            Center (DNG-ISAC), an ISAC designed to help support the
            information-sharing interests of downstream natural gas
            utilities.

       The American Hotel & Lodging Association (AH&LA) has
            conducted a series of widely attended cyber and data security
            webinars to assist small, medium, and large hotel and lodging
            businesses with implementing key information security measures
            and risk assessments.

       The American Water Works Association (AWWA) has created
            cybersecurity guidance and a use-case tool to aid water and
            wastewater utilities' implementation of the framework. The
            guidance is cross-referenced to the framework. This tool is
            serving as implementation guidance for the framework in the
            water and wastewater systems sector.

       Members of the Communications Sector Coordinating Council
            (CSCC)--made up of broadcasting, cable, wireline, wireless, and
            satellite segments--have participated in multiple NIST,
            Department of Homeland Security (DHS), and industry
            association-sponsored programs, webinars, and panels. The
            sector is completing a year-long effort within the Federal
            Communication Commission's (FCC's) Communications Security
            Reliability and Interoperability Council (CSRIC) that involves
            more than 100 professionals who have worked to adapt the NIST
            framework to the sector segments and provide guidance to the
            industry.

       The Electricity Subsector Coordinating Council has worked
            with DOE to develop sector-specific guidance for using the
            framework. The guidance leverages existing subsector-specific
            approaches to cybersecurity, including DOE's Electricity
            Subsector Cybersecurity Risk Management Process Guideline, the
            Electricity Subsector Cybersecurity Capability Maturity Model,
            NIST's Guidelines for Smart Grid Cyber Security, and the North
            American Electric Reliability Corporation's (NERC) Critical
            Infrastructure Protection Cybersecurity Standards.

       The mutual fund industry, represented by the Investment
            Company Institute (ICI), has added to its committee roster a
            Chief Information Security Officer Advisory Committee. The
            committee's mission is to collaborate on cybersecurity issues
            and information sharing in the financial services industry and
            provide a cyber threat protection resource for ICI members.

       The Information Technology Industry Council (ITI) visited
            Korea and Japan in May 2014 and shared with these countries'
            governments and business leaders the benefits of a public-
            private partnership-based approach to developing globally
            workable cybersecurity policies. ITI highlighted the framework
            as an example of an effective policy developed in this manner,
            reflecting global standards and industry-driven practices. ITI
            principals also spoke at a U.S.-European Union (EU) workshop in
            Brussels in November 2014, comparing U.S. and EU policy
            approaches to cybersecurity and highlighting the positive
            attributes of the framework and its development.

       The National Association of Manufacturers (NAM) has
            spearheaded the D.A.T.A. (Driving the Agenda for Technology
            Advancement) Policy Center, providing manufacturers with a
            forum to understand the latest cybersecurity policy trends,
            threats, and best practices. The D.A.T.A. Center focuses on
            working with small and medium-size manufacturers to help them
            secure their assets.

       Through the American Petroleum Institute (API), the oil and
            natural gas sector has worked with DOE to complete the Oil and
            Natural Gas Subsector Cybersecurity Capability Maturity Model
            (ONG-C2M2). The oil and natural gas sector in 2014 established
            a new Oil and Natural Gas Information Sharing and Analysis
            Center (ONG-ISAC) to provide shared intelligence on cyber
            incidents, threats, vulnerabilities, and responses throughout
            the industry.

       The Retail Industry Leaders Association (RILA), in
            partnership with the National Retail Federation (NRF), has
            created the Retail Cyber Intelligence Sharing Center (R-CISC),
            featuring information sharing, research, and education and
            training. This ISAC enables retailers to share threat data
            among themselves and to receive threat information from
            government and law enforcement partners.

       The U.S. Chamber of Commerce has launched its national
            roundtable series, Improving Today, Protecting Tomorrow
            TM, recommending that businesses of all sizes and
            sectors adopt fundamental Internet security practices.
    The Chamber's New Cybersecurity Campaign Enters Its Second Year;
            Policymakers Need to Focus on Passing Information-Sharing
            Legislation and Deterring Foreign Attackers
        The NIST framework is designed to help s start a cybersecurity
    program or improve an existing one. The framework puts cybersecurity
    into a common language for organizations to better understand their
    cybersecurity posture, set goals for cybersecurity improvements,
    monitor their progress, and foster communications with internal and
    external stakeholders.
        Looking ahead to 2015, the Chamber's cybersecurity campaign intends
    to focus on several areas, including the following:

       Organizing roundtables with local chambers and growing
            market solutions. The Chamber is planning more cyber
            roundtables in 2015. Last year, the Chamber organized
            roundtable events with state and local chambers in Chicago,
            Illinois (May 22); Austin, Texas (July 10); Everett, Washington
            (September 23); and Phoenix, Arizona (October 8) prior to the
            Chamber's Third Annual Cybersecurity Summit on October 28.

        Leading member sponsors of the campaign were American Express,
            Dell, and Splunk. Other sponsors were the American Gas
            Association, Boeing, the Edison Electric Institute, Exelon, HID
            Global, Microsoft, Oracle, and Pepco Holdings, Inc., and The
            Wall Street Journal.

        Each roundtable featured cybersecurity principals from the White
            House, DHS, NIST, and local FBI and U.S. Secret Service
            officials. The Chamber and our partners urged businesses to
            adopt fundamental Internet security practices to reduce network
            and system weaknesses and make the price of successful hacking
            increasingly steep. The Chamber also urged businesses to
            improve their cyber risk management processes. All businesses
            should understand common online threats that can lead them to
            become victims of cybercrime. Using the framework and similar
            risk management tools, such as the Chamber's Internet Security
            Essentials for Business 2.0 guidebook,\8\ is ultimately about
            making your business more secure and resilient. The Chamber
            encouraged businesses to report cyber incidents. Perfect online
            security is unattainable, even for large businesses. Innovative
            solutions are regularly being brought to market because cyber
            threats are always changing. Businesses should report cyber
            incidents and online crime to their FBI or U.S. Secret Service
            field offices.
    ---------------------------------------------------------------------------
        \8\ The booklet is available free for downloading at
    www.uschamber.com/issue-brief/internet-security-essentials-business-20.

       Increasing public awareness of the framework. The Chamber
            urges policymakers to commit greater resources over the next
            several years to growing awareness of the framework and risk-
            based solutions through a national education campaign. A broad-
            based campaign involving federal, state, and local governments
            and multiple sectors of the U.S. economy would spur greater
            awareness of cyber threats and aggregate demand for market-
    ---------------------------------------------------------------------------
            driven cyber solutions.

        The Chamber believes that government--particularly independent
            agencies--should devote their limited time and resources to
            assisting resource-strapped enterprises, not trying to flex
            their existing regulatory authority. After all, while
            businesses are working to detect, prevent, and mitigate
            cyberattacks originating from sophisticated criminal syndicates
            or foreign powers, they shouldn't have to worry about
            regulatory or legal sanctions.

       Improving information-sharing is job No. 1. The framework
            would be incomplete without enacting information-sharing
            legislation that removes legal and regulatory penalties to
            quickly exchange data about threats to U.S. companies.

         Passing legislation this year. Last week, 35
                associations, including the Chamber, strongly urged the
                Senate to quickly pass a cybersecurity information-sharing
                bill.\9\ The Senate Intelligence committee passed a smart
                and workable bill in July 2014, which earned broad
                bipartisan support. Recent cyber incidents underscore the
                need for legislation to help businesses improve their
                awareness of cyber threats and enhance their protection and
                response capabilities.
    ---------------------------------------------------------------------------
        \9\ The coalition letter is available at www.uschamber.com/sites/
    default/files/150127_multi-association_cyber_info-
    sharing_legislation_senate.pdf.

          Above all, the Chamber urges Congress to send a bill to the
                president that gives businesses legal certainty that they
                have safe harbor against frivolous lawsuits when
                voluntarily sharing and receiving threat indicators and
                countermeasures in real time and taking actions to mitigate
                cyberattacks. The legislation also needs to offer
                protections related to public disclosure, regulatory, and
                antitrust matters in order to increase the timely exchange
    ---------------------------------------------------------------------------
                of information among public and private entities.

          The Chamber also believes that legislation needs to safeguard
                privacy and civil liberties and establish appropriate roles
                for civilian and intelligence agencies. The cybersecurity
                measure approved in July 2014 by the Senate Intelligence
                committee reflected practical compromises among many
                stakeholders on these issues.

          Cyberattacks aimed at U.S. businesses and government entities are
                being launched from various sources, including
                sophisticated hackers, organized crime, and state-sponsored
                groups. These attacks are advancing in scope and
                complexity. Congressional action cannot come quickly
                enough.

         Helping SMBs mitigate attacks. The cybersecurity EO
                elevates the importance of bidirectional information
                sharing and calls for expanding the public-private Enhanced
                Cybersecurity Services (ECS) program to critical
                infrastructure. The administration should consider
                developing an ECS program that is affordable to SMBs. On
                the one hand, some businesses would be well equipped
                internally or in partnership with third-party providers to
                make use of cyber threat information. On the other hand,
                the Chamber believes that, depending on their size and
                abilities, most SMBs would need significant guidance and
                perhaps additional assistance with incorporating threat
                information and risk management strategies into their
                organizations.

       Engaging law enforcement. The Chamber plans to continue its
            close contact with the FBI and the U.S. Secret Service to build
            trusted public-private relationships, which are essential to
            confirming a crime and beginning criminal investigations. We
            are encouraging businesses to partner with law enforcement
            before, during, and after a cyber incident. FBI and U.S. Secret
            Service officials have participated in each of the Chamber's
            roundtables.

       Harmonizing cybersecurity regulations. Information-security
            requirements should not be cumulative. The Chamber believes it
            is valuable that agencies and departments are urged under the
            EO to report to the Office of Management and Budget any
            critical infrastructure subject to ``ineffective, conflicting,
            or excessively burdensome cybersecurity requirements.'' We urge
            the administration and Congress to prioritize eliminating
            burdensome regulations on businesses. One solution could entail
            giving businesses credit for information security regimes that
            exist in their respective sectors that they have adopted.\10\
            It is positive that Michael Daniel, the administration's lead
            cyber official, has made harmonizing existing cyber regulations
            with the framework a priority.
    ---------------------------------------------------------------------------
        \10\ The business community already complies with multiple
    information security rules. Among the regulatory requirements impacting
    businesses of all sizes are the Chemical Facilities Anti-Terrorism
    Standards (CFATS), the Federal Energy Regulatory Commission-North
    American Reliability Corporation Critical Information Protection (FERC-
    NERC CIP) standards, the Gramm-Leach-Bliley Act (GLBA), the Health
    Insurance Portability and Accountability Act (HIPAA), and the Sarbanes-
    Oxley (SOX) Act. The Securities and Exchange Commission
    (SEC) issued guidance in October 2011 outlining how and when companies
    should report hacking incidents and cybersecurity risks. Corporations
    also comply with many non-U.S. requirements, which add to the
    regulatory mix.

       Raising adversaries' costs through deterrence. The Chamber
            is reviewing actions that businesses and government can take to
            deter nefarious actors that threaten to empty bank accounts,
            steal trade secrets, or damage vital infrastructures. While we
            have not formally endorsed the report, the U.S. Department of
            State's International Security Advisory Board (ISAB) issued in
            July draft recommendations regarding cooperation and deterrence
    ---------------------------------------------------------------------------
            in cyberspace.

        The ISAB's recommendations--including cooperating on crime as a
            first step, exploring global consensus on the rules of the
            road, enhancing governments' situational awareness through
            information sharing, combating IP theft, expanding education
            and capacity building, promoting attribution and prosecution,
            and leading by example--are sensible and worthy of further
            review by cybersecurity stakeholders.\11\
    ---------------------------------------------------------------------------
        \11\ The ISAB report is available at www.state.gov/documents/
    organization/229235.pdf.

        The Chamber believes that the United States needs to coherently
            shift the costs associated with cyberattacks in ways that are
            legal, swift, and proportionate relative to the risks and
            threats. Policymakers need to help the law enforcement
            community, which is a key asset to the business community but
            numerically overmatched compared with illicit hackers.\12\
    ---------------------------------------------------------------------------
        \12\ The Chamber argues for a clear cyber deterrence strategy in
    its December 2013 letter to NIST on the framework. See http://
    csrc.nist.gov/cyberframework/framework_comments/2013
    1213_ann_beauchesne_uschamber.pdf.

       Making incentives work. In an April 2013 letter to NIST
            regarding businesses' use of the framework and the role of
            incentives, the Chamber provides its views on extending
            liability protections related to information-sharing
            legislation (see p. 6 of this statement), extending a safe
            harbor related to using the framework, extending SAFETY Act
            applicability to the framework, eliminating cybersecurity
            regulations, leveraging Federal procurement, and making the
            research and development (R&D) tax credit permanent.\13\
    ---------------------------------------------------------------------------
        \13\ The letter is available at www.ntia.doc.gov/files/ntia/
    29apr13_chamber_comments.pdf.

        The Chamber appreciates that the administration is assessing a mix
            of incentives that could induce businesses to use the
            framework.\14\ However, in the Chamber's view, it is imperative
            that the administration, independent agencies, and lawmakers
            extend to companies the assurance that the cybersecurity
            framework and any actions taken in relation to it remain
            collaborative, flexible, and innovative over the long term. The
            Chamber believes that the presence of these qualities, or the
            lack thereof, would be a key determinant to use of the
            framework by U.S. critical infrastructure as well as businesses
            generally.
    ---------------------------------------------------------------------------
        \14\ See www.whitehouse.gov/blog/2013/08/06/incentives-support-
    adoption-cybersecurity-framework.
    ---------------------------------------------------------------------------
    Roadmap for the Future of the Cybersecurity Framework
        In February 2014, NIST released a Roadmap to accompany the
    framework. The Roadmap outlines further areas for possible
    ``development, alignment, and collaboration.'' \15\ The Chamber noted
    in an October 2014 letter to NIST some key areas that we see as needing
    more attention. The Chamber would highlight for the Committee the
    importance of aligning international cybersecurity regimes with the
    framework.
    ---------------------------------------------------------------------------
        \15\ The Roadmap is available at www.nist.gov/cyberframework/
    upload/roadmap-021214.pdf.
    ---------------------------------------------------------------------------
        Many Chamber members operate globally. We appreciate that NIST has
    been actively meeting with foreign governments to urge them to embrace
    the framework. Like NIST, the Chamber believes that efforts to improve
    the cybersecurity of the public and private sectors should reflect the
    borderless and interconnected nature of our digital environment.
        Standards, guidance, and best practices relevant to cybersecurity
    are typically industry driven and adopted on a voluntary basis; they
    are most effective when developed and recognized globally. Such an
    approach would avoid burdening multinational enterprises with the
    requirements of multiple, and often conflicting, jurisdictions.\16\ The
    administration should organize opportunities for stakeholders to
    participate in multinational discussions. The Chamber encourages the
    Federal Government to work with international partners and believes
    that these discussions should be stakeholder driven and occur on a
    routine basis.
    ---------------------------------------------------------------------------
        \16\ The Chamber sent a letter in September 2013 to Dr. Andreas
    Schwab, member of the European Parliament's Internal Market and
    Consumer Protection Committee, recommending amendments to the proposed
    European Union (EU) cybersecurity directive. The Chamber argues that
    cybersecurity and resilience are best achieved when organizations
    follow voluntary global standards and industry-driven practices.
    ---------------------------------------------------------------------------
    The Public and Private Sectors Need to Increase the Framework's Success
            by Improving Collaboration and Eliminating Barriers to Smart
            and
            Efficient Cybersecurity
        NIST and multiple stakeholders produced a smart framework that
    participants can take pride in. But more work lies ahead. The Chamber
    looks forward to working with policymakers to ensure that preexisting
    regulations are harmonized with the collaborative and voluntary nature
    of the framework. Businesses also seek the enactment of information-
    sharing legislation to achieve timely and actionable situational
    awareness to improve detection, mitigation, and response capabilities.
        The Chamber is committed to protecting America's business community
    and enhancing the Nation's resilience against an array of physical and
    cyber threats. Government and business entities need to continue
    leveraging the framework to strengthen collective resilience and
    security and make ongoing improvements. We look forward to working with
    Congress and the administration to build on the progress that we--
    industry and government--have made together.

        The Chairman. Thank you, Ms. Beauchesne.
        Mr. Smocer?

       STATEMENT OF PAUL N. SMOCER, PRESIDENT OF BITS, FINANCIAL
                          SERVICES ROUNDTABLE

        Mr. Smocer. Thank you, Mr. Chairman. Last year, with this
    committee's stewardship, Congress passed the Cybersecurity
    Enhancement Act of 2014. The Act's focus on an open, voluntary
    cybersecurity framework development process and its emphasis on
    cybersecurity R&D, career development, awareness, and education
    improve the information security of our country's cyber
    ecosystem. The act's passage signaled Congress' commitment to
    cultivate the public-private partnership so essential to our
    Nation's security.
        Now we are witnessing a new era of attacks by organized
    crime syndicates and nation states. These attacks threaten the
    availability of services and threaten individual's privacy and
    even the accuracy of their information through data
    manipulation or destruction. This growing threat endangers all
    institutions in our sector and companies in other sectors.
        The financial sector has historically made huge investments
    in security and in driving collaboration across industries and
    with government. Our institutions invest because they recognize
    their customers trust them, but individual institution's
    investments can only do so much as the cyber ecosystem extends
    beyond any one company. Companies connect with sectors, across
    sectors, and with the government. The reliance on each other
    gives us all a critical role in the cyber landscape and
    requires coordinated action for the most effective response.
        Recognizing the necessity for collaboration, our sector has
    facilitated a series of collaborative activities, as I note in
    my written testimony, including a significant effort around the
    development of the NIST Cybersecurity Framework. Let me spend
    some time on the Framework.
        As a leader in cybersecurity, our sector wanted to be
    engaged in the Framework's development. From the onset, BITS,
    as an organization and as a representative for the Financial
    Sector Coordinating Council, participated with NIST. We took
    part in all the workshops, providing our diverse membership's
    perspectives. We appreciated the opportunity to be a major
    contributor. We wanted to ensure the Framework addressed our
    sector's attributes, and we wanted to understand how it would
    harmonize with our existing requirements. We applaud the NIST
    development engaged so many other sectors. NIST's inclusive
    approach is reflected in today's broad embrace of the
    Framework.
        Our members use the Framework to communicate ideas and
    achieve buy-in for various cybersecurity initiatives. They use
    it to communicate expectations and requirements to their
    vendors.
        Given its age, the Framework's uses are still evolving. One
    evolution we see is its use as a baseline for cyber insurance
    underwriting. A critical next step in the Framework's evolution
    will involve ways independent regulators align their
    expectations with it. We are concerned with a lack of a uniform
    approach across all regulators. Last week, BITS provided input
    to the Cybersecurity Forum for Independent and executive branch
    Regulators urging harmonization of regulatory requirements.
    Some agencies have charted divergent paths not aligning with
    the Framework or its collaborative process. Consequently,
    companies will need to devote time to manage a patchwork of
    incompatible agency requirements and invest funding in
    potentially duplicative efforts. This strains already taxed
    security resources. We ask this committee as part of its
    oversight to encourage agencies to focus on coordination and
    harmonization.
        The NIST Cybersecurity Framework is very helpful in
    mitigating cyber risk, but we need to do more to end the cyber
    threat and Congress can help. We strongly believe passing
    effective cyber threat information sharing legislation would
    bolster the Framework. Our sector has worked with prior
    Congresses toward the development of a bipartisan bill. We hope
    in this Congress we witness the enactment of legislation that
    incentivizes the real-time sharing of cyber threat indicators
    amongst companies within and between sectors and with the
    Government and provides a targeted level of liability and
    disclosure protection, offers a good faith defense for sharing,
    and includes appropriate levels of privacy and civil liberties
    protections.
        Protecting consumers, companies, and the Nation must remain
    our collaborative focus. The ability to share information is at
    the core of our Nation's response to the current cyber threat.
    We are encouraged by the recent bipartisan progress and will
    continue to advocate for effective legislation.
        In conclusion, the NIST Cybersecurity Framework benefits
    and strengthens the overall cybersecurity of organizations
    across the cyber ecosystem. It is important in combating the
    growing threat of cyber attacks. With that said, we can do more
    to encourage its voluntary adoption, particularly encouraging
    agencies to coordinate and harmonize their cybersecurity
    guidance to avoid duplicative requirements.
        Thank you again for inviting me to testify on this critical
    issue. Chairman Thune, Ranking Member Nelson, we look forward
    to working closely with you and the rest of the Committee on
    this important issue.
        [The prepared statement of Mr. Smocer follows:]

           Prepared Statement of Paul N. Smocer, President of BITS,
                         Financial Services Roundtable
        Chairman Thune, Ranking Member Nelson, Members of the Committee,
    thank you for this opportunity to appear before you today to address
    the important topic of cybersecurity and the evolution of public and
    private efforts to protect critical infrastructure from cyber threats.
        My name is Paul Smocer, and I am the President of BITS, the
    technology policy division of the Financial Services Roundtable (FSR).
    FSR is a trade association representing the country's leading financial
    service companies. Our members include banking, insurance, asset
    management, finance, and payment companies. Cybersecurity has been a
    key focus area for FSR and our companies for decades. Since 1996, BITS
    has played an important leadership role in cybersecurity, fraud
    reduction, third-party vendor management, payments and emerging
    technologies. BITS addresses issues at the intersection of financial
    services, technology, and public policy.
    Cyber Threat Environment
        Late last year, with this Committee's stewardship, Congress passed
    the Cybersecurity Enhancement Act of 2014 (Public Law No: 113-274). We
    believe the Act's focus on supporting and facilitating an open and
    voluntary cybersecurity standards development process is an important
    step in improving the overall information security of our country's
    cyber ecosystem. Moreover, we applaud the Act's emphasis on
    cybersecurity research and development, cybersecurity career
    development, and cyber awareness and education. Indeed, with the
    passage of this Act, Congress has signaled its commitment to cultivate
    the public-private partnership--a partnership that is essential to our
    Nation's security.
        Even with these improvements, more needs to be done. The current
    cyber threat environment is grim. Each day, cyber risk grows as attacks
    increase in number, pace, and complexity. We are no longer in the days
    wherein the threat was confined to individual hacktivists and
    fraudsters. We are now in an era of attacks by not only organized crime
    syndicates, but also nation-states. Correspondingly, the attacks have
    grown beyond webpage vandalism and fraud into large-scale attacks that
    threaten the availability of services to citizens and threaten the
    privacy and accuracy of their information. Our sector is increasingly
    concerned with these threats, particularly with the potential for
    attacks that could undermine the integrity of the financial system
    through data manipulation or destruction. This growing threat affects
    all institutions in our sector regardless of size or type of financial
    institution including large and small, banks, credit unions, insurers
    and investment firms. Increasingly, and as we have recently witnessed,
    other sectors face these same threats.
        As mentioned, with each day that passes, the cyber threat against
    our Nation's critical infrastructure, private sector companies, and
    individuals' privacy intensifies. According to Symantec's 2014
    ``Internet Security Threat Report,'' the number of targeted spear-
    phishing campaigns in 2013 rose by 91 percent over the previous year.
    These campaigns are a key method used by cyber attackers to infiltrate
    victim's systems and gather information. In recent years, we have also
    witnessed serious and significant attacks from various nation-state
    actors and organized criminals on the Estonian, Georgian, and Ukrainian
    telecommunications systems;\1\ European power plants;\2\ a U.S. public
    utility;\3\ the NASDAQ;\4\ Target and other major retailers and their
    customers.\5\ Moreover, a recent report reveals that of the estimated
    $2-3 trillion generated annually from the ``internet economy,''
    cybercrime alone extracts between 15 percent and 20 percent of that
    total value.\6\ In response, the private sector has increased its
    spending on cybersecurity, with one financial services firm spending as
    much as $250 million a year.
    ---------------------------------------------------------------------------
        \1\ Reuters, ``Ukraine: Cyberattack on communications, MPs phones
    blocked,'' http://www
    .cnbc.com/id/101465198, (March 4, 2014).
        \2\ Symantec Security Response, ``Dragonfly: Western Energy
    Companies Under Sabotage Threat,'' http://www.symantec.com/connect/
    blogs/dragonfly-western-energy-companies-under-sabotage-threat, (June
    30, 2014).
        \3\ ICS-CERT Monitor, ``Internet Accessible Control Systems At
    Risk,'' https://ics-cert.us-cert.gov/sites/default/files/Monitors/ICS-
    CERT_Monitor_%20Jan-April2014.pdf, (January-April 2014).
        \4\ Michael Riley, ``How Russian Hackers Stole the Nasdaq,'' http:/
    /www.businessweek.com/articles/2014-07-17/how-russian-hackers-stole-
    the-nasdaq, (July 17, 2014).
        \5\ Symantec Corporation, '' Internet Security Threat Report
    2014,'' http://www.symantec.com/content/en/us/enterprise/
    other_resources/b-istr_main_report_v19_21291018.en-us.pdf, (April
    2014).
        \6\ Center for Strategic and International Studies, ``Net Losses:
    Estimating the Global Cost of Cybercrime Economic impact of cybercrime
    II, http://www.mcafee.com/us/resources/reports/rp-economic-impact-
    cybercrime2.pdf, (June 2014).
    ---------------------------------------------------------------------------
        The quote often attributed to Willie Sutton that he robbed banks
    ``because that's where the money is'' reminds us as to why financial
    institutions are often the subject of cyber-attacks. Being a focus of
    the attacks is certainly one reason why the financial sector has
    historically led the way in making huge investments in not only
    security infrastructure and the best-qualified people to maintain the
    systems, but also in driving collaboration across industries and with
    the government. The primary reason for these investments though is the
    recognition that our customers trust us to protect them--to protect
    their investments, their records and their information. Individual
    financial institutions invest in personnel, infrastructure, services,
    and top of the line security protocols to protect their customers and
    themselves and to respond to cyber-attacks. These investments protect
    the individual institutions and their customers, but on its own, an
    individual institution generally only has the ability to protect what
    is within its ``four walls of the company''. However, as we all know,
    companies do not exist only within those walls. We are connected within
    our sector, across sectors, and with the government. This reliance on
    each other gives all of us a unique and critical role in the cyber
    landscape and requires coordinated action for the most effective
    response. Recognizing the cyber threat environment continues to expand
    in complexity and frequency and that individual institution efforts
    alone will not be enough, executives from the financial services sector
    have stepped up efforts to work together.
    Financial Sector Collaborations
        Our sector has facilitated a series of collaborations that resulted
    in a number of achievements, such as:

       The development of the Financial Services Information
            Sharing and Analysis Center (FS-ISAC) in 1999, which has grown
            in membership and capabilities since then, and significantly
            helped the sector response to the 2012-2013 distributed denial
            of service attacks (DDoS) preventing wide-scale outages;

       Creation of Soltra Edge, an initiative that will help
            standardize and automate the flow of real-time cyber threat
            information;

       Collaborating with the merchant and retail community to
            share best practices on cybersecurity, information sharing and
            payments security; and

       The significant and coordinated financial services industry
            effort during the development of the NIST Cybersecurity
            Framework.
    The NIST Cybersecurity Framework
        Almost two years ago, President Obama issued Executive Order 13636,
    calling for the development of a voluntary cybersecurity framework by
    the National Institute of Standards and Technology (NIST). The
    executive order directed NIST to seek private sector input through a
    collaborative process. From the outset, BITS/FSR--both as an
    organization and as a sector representative for the Financial Services
    Sector Coordinating Council (FSSCC)--participated in the NIST
    Cybersecurity Framework's development by taking part in all six NIST-
    facilitated workshops, providing the perspective of our uniquely
    diverse membership to this important effort. We appreciated the
    opportunity to be one of the major contributors to NIST's hard work
    that almost a year ago today, resulted in NIST's release of the
    Framework for Improving Critical Infrastructure Cybersecurity.
        The financial services sector is often credited, and rightly so, as
    being one of leaders in cybersecurity. That is why we wanted to be a
    part of the Framework's development. We wanted to ensure the eventual
    framework addressed our unique sector attributes, and we wanted to
    understand how it would harmonize our existing requirements. We
    recognized too that in an interconnected world, we as a sector are not
    an island unto ourselves. We need and rely on entities that provide us
    with information technology, power, telecommunications and other
    critical services. We applaud that NIST's process for developing the
    Framework engaged these other sectors during the Framework's drafting.
    NIST's successful approach at inclusion of so many essential parties is
    reflected in how broadly embraced the Framework has become across so
    many sectors.
        With respect to the Framework, its true value is that it
    synthesizes a process for cyber risk management that is accessible from
    the boardroom to the operations floor, across not only individual
    enterprises but also entire sectors. It relies on international
    standards and is consistent with the regulatory requirements that have
    been in place for our sector for more than a decade. It is a ``Rosetta
    Stone'' in that it provides a common lexicon for categorizing and
    managing cyber risks across sectors and enterprises for various
    unifying risk management jargons and creates a common understanding
    around various risk management terms, methodologies, ideas and
    language.
        As a result, we have heard from member financial institutions that
    in terms of internal enterprise usage, Chief Information Security
    Officers (CISOs) are using the Framework to communicate ideas and
    achieve ``buy-in'' for various cybersecurity initiatives. Externally,
    firms are beginning to use it to communicate expectations and
    requirements to vendors. That said the Framework has only been in
    circulation for a relatively short time. This is an important fact for
    this Committee to keep in mind as it reviews the Framework at its
    anniversary. Because it has been only one year--one budget cycle for
    most firms--usage from institution to institution varies.
    Appropriately, the number of institutions that are aware and use the
    Framework, and the ways in which the Framework will be used, will
    evolve over time. An example of how the Framework continues to permeate
    new industries is its progressing role in the insurance space. The
    potential for the Framework to act as a baseline standard for cyber-
    insurance underwriters shows a new level of possibility and versatility
    for the voluntary standards.
        Regarding the Framework development process, it was a success due
    in large part to its transparency and because it sought to harmonize
    various views into a cohesive whole. Indeed, BITS/FSR continues to
    participate in the evolution and maturation of the Framework through
    NIST's ongoing activities. For example, later this month we will be
    participating as a sector representative at NIST's ``Cybersecurity and
    Consumer Protection Summit: Executive Technical Workshop on Improving
    Cybersecurity and Consumer Privacy'' at Stanford University.
        Just last week, BITS provided input to the Cybersecurity Forum for
    Independent and Executive Branch Regulators, which is comprised of all
    the independent regulators that are looking at ways to align and
    harmonize with the Framework and thus increase overall effectiveness
    and consistency of regulatory authorities' cybersecurity efforts
    pertaining to critical infrastructure. BITS reviewed how financial
    institutions manage cybersecurity risks, comply with comprehensive
    regulatory requirements, and collaborate to mitigate cyber risks. We
    urged the regulators to focus on harmonizing regulatory requirements to
    reduce regulatory compliance burdens and to focus resources on
    mitigating cyber risk.
        However, the process has not been uniform across all stakeholders.
    In the year since the Framework's release, some Federal and state
    agencies have charted similar yet divergent paths to enhancing
    cybersecurity that do not embrace the Framework's open and
    collaborative process, instead favoring agency-unique approaches that
    often do not align with the Framework. As a result, information
    security practitioners have had to devote their time to managing a
    patchwork of conflicting agency efforts and organizations have to
    invest funding in potentially duplicative efforts, which are
    significant drains on available resources. While some may say that is
    the ``cost of doing business'', such a statement ignores the current
    reality: There is already a recognized shortage of security
    professionals and money needing to be increasingly invested in
    cybersecurity limits investment in new products to serve consumers.
        Thus, we would urge this Committee, as part of its oversight
    function, to encourage agencies to focus more on coordination and
    harmonization.
    Financial Top Level Domains
        Like the process behind the NIST Framework, the financial services
    industry is no stranger to voluntary processes designed to benefit the
    greater good. I would like to highlight two of our most recent
    successes: .BANK and .INSURANCE, and Soltra Edge.
        As background, in 2008, the Internet Corporation for Assigned Names
    and Numbers (ICANN) approved its new generic Top-Level Domains Program.
    This program in 2013 opened the door to a land rush on new top-level
    domains--the top-level domains we were accustomed to such as .COM and
    .ORG are no longer the only suffixes available. For a time we advocated
    against this domain name expansion especially as it related to
    financial services oriented domains out of concern for customer
    confusion, potential for increased malicious activity and ultimately
    increased costs to brand holders. When it became clear our concerns
    would not be addressed, the Financial Services Roundtable/BITS and the
    American Bankers Association, along with other financial services
    organizations, partnered to create a new registry operator dedicated
    specifically to the financial services sector--fTLD Registry Services,
    LLC.
        This newly created organization submitted community-based
    applications for .BANK and .INSURANCE. I say community because unlike
    some entrepreneurs who have entered this space with little or no
    concern for protecting financial institutions or their customers, fTLD
    is dedicated to serving and protecting the global financial services
    industry. This is evidenced by the more than 120 financial services
    domestic and international entities who directly or through others
    endorsed our applications on behalf of the industry.
        Besides being a financial services' owned, operated and governed
    registry, fTLD's domains of BANK and .INSURANCE will go beyond being
    simply an alternative to the legacy domains of .COM and .ORG. These
    domains will have robust operational requirements including
    eligibility, verification and name selection standards as well as
    enhanced technical requirements including, but not limited to, Domain
    Name Security Extensions (DNSSEC), strong encryption standards and e-
    mail authentication requirements to mitigate for example phishing and
    spoofing activities. fTLD is also planning other innovative uses that
    will be announced at a later date. All of these enhanced requirements
    and capabilities could only happen when individual organizations
    voluntarily came together to work towards a better and safer Internet.
        Secondly, I want to highlight Soltra Edge, a threat intelligence-
    sharing platform created by a joint venture between FS-ISAC and the
    Depository Trust and Clearing Corporation and voluntarily funded by
    contributions from the financial services community. Soltra Edge is a
    software solution that supercharges the current information-sharing
    model to make it more automated and collaborative so that trusted,
    actionable intelligence from disparate sources can be uniformly
    disseminated in near real time to defend more effectively against cyber
    threats. The software for Soltra Edge only takes a few minutes to
    download and install with the basic license completely free, making
    this solution accessible to the largest and smallest financial
    institutions.
        While this effort started in the financial services sector, we
    expect the technology behind Soltra Edge to be adopted broadly by other
    critical sectors including healthcare, energy, transportation, retail
    and others.
        Though Soltra Edge represents significant progress in closing the
    gap between threat intelligence sharing and implementing mitigating
    controls, a platform like this is still constrained by legal
    limitations on what information can be shared. Congress has an
    important role to play in filling this gap. The passage of effective
    cyber threat information sharing legislation is a critical step to
    enabling optimal sharing capability.
    The Public-Private Partnership: How Congress Can Help
        While the NIST Cybersecurity Framework is a helpful tool, it is not
    the silver bullet that puts an end to the cyber threat. As such, an
    institution could use the NIST Cybersecurity Framework fully and it
    could still be compromised. Thus, more is needed, and Congress can
    help. At a basic level, policymakers can help by recognizing that the
    firm that experiences the cyber-attack--be it a bank, retailer, or an
    entertainment firm--is a victim. Political leaders and regulators
    should work to de-stigmatize attacks and encourage companies to come
    forward and share threat information that could help other companies
    protect themselves, their employees and their customers.
        Despite the success of the information-sharing model used by the
    financial services sector, more can be done. We believe the Framework
    would be bolstered by the passage of effective cyber threat information
    sharing legislation. Our sector has been focused on this effort for
    many years and has continued to work closely with key committees in
    both the House and Senate. The legislation should not be delayed. BITS/
    FSR has supported several pieces of information sharing legislation
    developed by both the House and Senate. Most recently BITS/FSR has
    supported the cyber threat information sharing legislation passed by
    the Senate Intelligence Committee last year, the Cybersecurity
    Information Sharing Act of 2014 (CISA). BITS/FSR worked closely with
    former Chair Chambliss, Vice Chair Feinstein and their staff to develop
    the bipartisan bill. In our view, that bill encompassed key components
    to help enhance the volume and scope of threat information sharing.
    Furthermore, the legislation had the support of not only the financial
    services sector but also a wide range of critical infrastructure
    sectors. Congress must enact legislation that incentivizes the sharing
    and receiving of cyber threat indicators amongst companies within
    sectors, between sectors, and with the government. BITS/FSR believes
    that for legislation to be truly effective it must include the
    following provisions:

       Facilitate real-time sharing to enable institutions and
            government to act quickly;

       Provide a targeted level of liability and disclosure
            protections for cyber threat information sharing and receiving
            between individual institutions, through existing sharing
            mechanisms such as our FS-ISAC, private to government, and
            government to private;

       Offer a good faith defense for the sharing of threat
            information and data;

       Provide protection from disclosure through the Freedom of
            Information Act or to prudential regulators;

       Facilitate the appropriate declassification of information
            by the intelligence agencies and expedites the issuance of
            clearances to appropriate private sector individuals; and

       Include appropriate levels of privacy and civil liberties
            requirements.

        BITS/FSR is encouraged by recent bipartisan progress and will
    continue to advocate for legislation that will allow our members to
    share cyber threat information with each other, various business
    sectors, the government, and law enforcement, to protect their
    customers.
    Conclusion
        In conclusion, the NIST Cybersecurity Framework benefits and
    strengthens the overall cybersecurity posture of critical
    infrastructure organizations, including those sectors on which
    financial institutions rely. The Framework will continue to play an
    important role as we continue to combat the growing threat of cyber-
    attacks. With that said, more can be done to encourage adoption of this
    voluntary Framework. This Committee should use its oversight
    authorities to encourage agencies to coordinate and harmonize
    cybersecurity requests, examinations, and guidance. Security
    professionals and investment dollars are constrained. When different
    regulators place duplicative burdens on security, that takes away from
    resources that could be devoted to preventing cyber-attacks. That, in
    turn, does not help any company and ultimately weakens our ability to
    protect the Nation's critical infrastructure.
        The risks associated with cyber-attacks and threats are vitally
    important to the private and public sectors. Protecting consumers,
    companies, and the Nation must remain the focus. The ability to share
    information is at the core for our Nation's response to the current
    cyber threat.
        Thank you again for inviting me to testify on this critical issue.
    Chairman Thune and Ranking Member Nelson, we look forward to working
    closely with you and the rest of the Committee on this important issue.

        The Chairman. Thank you, Mr. Smocer.
        Mr. England?

      STATEMENT OF JEFFERSON H. ENGLAND, CHIEF FINANCIAL OFFICER,
                       SILVER STAR COMMUNICATIONS

        Mr. England. Chairman Thune, Ranking Member Nelson, members
    of the Committee, thank you very much for inviting me to be
    here and share with you some of my experiences as we have used
    the Cybersecurity Framework that NIST developed in our own
    organization.
        In February 2013, when President Obama issued an Executive
    Order calling upon critical infrastructure industries to
    voluntarily take measures to improve their cybersecurity
    posture, I had just accepted this position as the Chief
    Financial Officer at Silver Star Communications. I am new to
    telecom. And as a risk manager in our organization, I knew that
    I had a responsibility to figure out ways to address, among
    other things, cybersecurity risk in our organization.
        Shortly after that, I had an opportunity to visit with some
    of our friends at U.S. Telecom.
        And as NIST had released their initial draft of the
    Framework, they had called upon industry representatives to
    provide some feedback regarding the initial draft copy of that
    Framework. We chose, as an organization, to go through and
    begin using it as best as we felt like we could as a way of
    providing some feedback. One of the items that we had passed
    along was this utilization of a gap analysis, which we know has
    been included in the final version of the Framework that was
    released, as you say, Chairman Thune, almost a year ago.
        We found that the Framework has been extremely beneficial
    in our organization. Not only did it give our IT staff and
    managers a framework whereupon we could exercise disciplined
    cybersecurity improvements in our organization, but it forced
    within us an opportunity to communicate at all levels within
    our organization, at level that had not previously existed
    before. We found, as we have gone through and used this, that
    voluntary adoption is key to the success within our
    organization. First off, we felt like the ability to adapt the
    Framework to use within our organization--we are a small
    business. We have roughly 9,500 access lines in western
    Wyoming. We found that the ability to adapt and use it as best
    met our need is one of the great strengths of the Framework.
        Ranking Member Nelson, you had mentioned the NIST Framework
    meeting that was taking place in February. I had an opportunity
    to speak at that conference. And in that meeting, I
    demonstrated some ways in which we had taken the Framework, as
    it exists, and used the information to build management tools
    where we could provide visibility within our organization
    regarding our progress and our activities on our cybersecurity
    practices in our organization.
        We believe that due to the voluntary nature of the
    Framework, it allows us to build ourselves as an organization
    upon having a stronger, competitive advantage amongst our
    peers, and we have found, as we have adapted the use of the
    Framework internally that it has created opportunities for us
    to discuss cybersecurity risk with our customers and with our
    vendors in a way that we had not previously done. We were
    surprised, as we began using this. We called upon some of our
    larger suppliers to get some feedback. We were hoping to
    franchise from them and their policies to implement without
    organization, and we were surprised, as we did so, that a
    number of our vendors did not have written policies and
    procedures in place regarding cybersecurity practices. And so
    it created a dialogue between us and them, and we found that to
    be very beneficial.
        And then we also found, as we have gone through and
    utilized the framework internally within our organization--just
    anecdotally I can tell you when I visited with our IT staff
    initially, they looked at the complete Framework. And it is
    voluminous. It is a wealth of information. But my IT staff
    immediately said this is going to take an additional one-and-a-
    half full-time resources to go through and complete this thing.
    And since we believed it was a voluntary adoption and not a
    checklist, I turned around to my IT staff and I said, look, you
    are looking at this all wrong. We are not adding work upon you.
    This Framework is designed to help shape how you do the work
    you are already doing. When we had that perspective internally
    and we could consider the facts that we were exposing our view
    into a number of areas regarding cybersecurity that we
    previously had not done, it had made some big improvements for
    us in our organization.
        Finally, I would just like to go on record and make a case
    against regulation. We believe that regulation creates a
    minimum standards environment where a checklist approach is
    undesirable in this space. I have concern that whether it be in
    our organization or others, if it were a regulated requirement,
    it would be far easier for me to hand over the checklist to my
    IT staff and say complete this and turn in a report, and it
    would have bypassed all of the meaningful conversations that we
    have had within our organization.
        We also believe that having a minimum set of standards puts
    perpetrators on alert as to where they should be focusing their
    attentions.
        And finally, as we commented earlier by Ms. Beauchesne, we
    believe that going about it on a regulated approach alone is a
    misguided attempt by government. It has the opportunity to
    distract attention from the real perpetrators which are the
    criminals who are attacking our system. And we believe that
    through information sharing and other practices, that we can
    help focus Government attention on bringing justice to the
    perpetrators.
        [The prepared statement of Mr. England follows:]

     Prepared Statement of Jefferson H. England, Chief Financial Officer,
                           Silver Star Communications
        Silver Star Communications, located in Freedom, WY, has been using
    the NIST Cyber Security Framework since it was originally released in
    draft form. Our initial intent was to review the framework and provide
    comment and feedback to NIST regarding its value to us as a rural
    telephone and Internet service provider. Our initial impressions were
    positive and some of our comments, including the incorporation of a gap
    analysis, ware included in the official released version of the
    framework.
        We have found that the framework has created an environment that
    encourages discussion, both internal and external, regarding its
    application in our organization. But above all, the greatest benefit
    from the framework has been the ability to use and adapt it within our
    organization such that it has become a meaningful management tool for
    improved cybersecurity practices.
        The framework helped provide us with a disciplined approach to
    reviewing cybersecurity practices within our organization. In the
    course of completing a self assessment, there were many processes and
    procedures identified that we had not previously considered. The focus
    on current state relative to desired state in the context of acceptable
    risk provided meaningful focus and direction to IT staff and
    management. Additionally, since the framework allowed for
    organizational specific adaptation, we developed an internal reporting
    mechanism that provided executive visibility into our progress on
    highest priorities.
        The voluntary nature of the framework has been the key to success
    for use within our organization.
        We believe cybersecurity to be a competitive advantage whereby we
    differentiate ourselves from our competitors and make ourselves more
    attractive to our suppliers and those we serve. Because of this, we are
    self driven toward improvement and have begun sharing our cybersecurity
    practice with those we serve more openly. Curious as to whether or not
    our suppliers have used the framework, we began asking them to share
    with us their cybersecurity practices. These conversations have been
    extremely valuable in helping us identify customers and suppliers who
    share similar cybersecurity risk tolerances to our own and has become
    an important part of our vendor selection process.
        We also believe that a regulatory mandate requiring the use of the
    framework creates a minimum standard environment. We believe this to be
    problematic because minimum standards are more likely to be treated as
    a checklist that can be delegated without having the necessary
    interdepartmental conversations regarding exposure and acceptable risk
    tolerance. There is also risk that minimum standards would put
    perpetrators on alert as to where they should focus their attentions
    for exploitation potentially placing organizations at additional
    cybersecurity risk than before.
        Finally, we believe that a regulated approach to cybersecurity may,
    at least in part, misplace government attention away from the root
    problem. Cyber attackers are criminals and state sponsored cyber
    attacks are acts of war. Government action regarding cybersecurity
    should place primary emphasis on tracking down and bringing cyber
    criminals to justice.

        The Chairman. Thank you, Mr. England.
        Dr. Lewis?

     STATEMENT OF DR. JAMES A. LEWIS, DIRECTOR AND SENIOR FELLOW,
       STRATEGIC TECHNOLOGIES PROGRAM, CENTER FOR STRATEGIC AND
                         INTERNATIONAL STUDIES

        Dr. Lewis. Thank you, Mr. Chairman, and I thank the
    Committee for the opportunity to testify.
        Executive Order 13636, Improving Critical Infrastructure
    Cybersecurity, released in 2013 was a major shift in U.S.
    policy on cybersecurity. One of the flaws in the 2012
    comprehensive Senate legislation was it tried to give a single
    agency the authority to regulate cyberspace. The EO, by tasking
    sector-specific agencies to use the Framework for better
    cybersecurity, is a better approach. The executive order
    instructed NIST to develop a Cybersecurity Framework to guide
    companies in securing critical infrastructure. The process is
    voluntary, as you have heard. This executive order is likely to
    be followed by another on information sharing in early 2015.
        These executive actions are the building blocks for better
    cybersecurity. But what we want to think about is are they
    adequate. And the primary measurement for adequacy is are we
    stopping opponents from getting in. Adoption is not a good
    measure for success. Even if all companies adopt the Framework,
    it does not mean better cybersecurity. The only way to measure
    effectiveness is to ask if the number of successful
    penetrations in the outflow of data has decreased. If hackers
    still get in and data still flows out, the Framework needs to
    be further amended.
        In 2013, the FBI notified 3,000 companies that they had
    been hacked and lost data. There may have been more. If this
    number declines in 2015, it says the Framework is working.
        Judging from the news, however, the number of successful
    attacks against U.S. companies has not decreased. We do not
    know if this is because companies have not adopted the
    Framework or if they have been unable to implement it or if it
    is because the Framework is in itself ineffective.
        For example, it appears that Sony had not implemented the
    NIST Framework, but even if it had, the North Koreans still
    would have gotten in. And North Korea is the least skilled of
    our likely opponents.
        Implementing the NIST Framework is not easy. Many small and
    medium-sized companies lack the manpower, training, and
    resources to implement the Framework.
        Cost is an important issue for companies of all sizes.
    Improving cybersecurity asks a business to spend money on
    things it will not generate a return on investment, and we do
    not have a mechanism for them to recoup costs.
        This means that cybersecurity involves a business decision
    by companies about how much risk they will take and how much
    they are willing to spend to lower that risk. Many companies
    still underestimate risk, and the Framework provides a good way
    for them to rethink their approach to cybersecurity.
        The Framework could be seen as part of an emerging national
    approach to cybersecurity, shaped by Government action and
    economic incentives. These incentives come from regulation,
    market risk, and civil liability. The Framework helps
    regulators and companies manage risk in critical
    infrastructure. Federal Trade Commission actions and consumer
    reaction will incentivize companies to better protect personal
    information.
        The Federal Government needs to do more to discourage cyber
    espionage, but companies need to do better at defense. The
    market will penalize companies that have under-prioritized
    cybersecurity, and companies face the risk of civil liability
    because a case could be made that a company that has not
    implemented the NIST Framework has failed to exercise due
    diligence. And I think this will have a powerful shaping effect
    over the next couple of years.
        Now, is all of this enough for better cybersecurity?
    Probably not. But it is a good start, and the NIST Framework is
    a step forward in what is going to be a long process to make
    this Nation more secure.
        With that, I thank you and I am happy to take your
    questions.
        [The prepared statement of Dr. Lewis follows:]

     Prepared Statement of Dr. James A. Lewis, Director and Senior Fellow,
    Strategic Technologies Program, Center for Strategic and International
                                    Studies
        I thank the Committee for the opportunity to testify on private
    sector experience with the National Institute of Standard's (NIST)
    Cybersecurity framework. The Framework provides a list of measures
    companies can take it improve their cybersecurity. I will discuss three
    issues: what we know about the Framework's adoption, how effective it
    is, and where it can be improved.
        An initial conclusion is we lack sufficient data to say
    definitively whether the Framework is working or not to build a more
    secure cyber future. The Framework itself was released relatively
    recently, in February 2014. It will take more time for the Framework to
    be implemented, adjusted and to see if it what effect it has on
    cybersecurity. My comments on the Framework are best seen as
    preliminary until we have gained further experience and data on its
    implementation. On the larger issue of building a more secure cyber
    future, in which the NIST Framework may play a part, there is
    sufficient data and experience to describe the situation and to make
    general recommendations for improvement,
        Executive Order (EO) 13636, ``Improving Critical Infrastructure
    Cybersecurity,'' released in February 2013 was a major shift in U.S.
    policy on cybersecurity. Instead of making a single agency responsible
    for cybersecurity, it assigned responsibility to existing, sector-
    specific regulatory agencies. The EO instructed the National Institutes
    of Standards and Technology to develop a ``Cybersecurity Framework''
    released in February 2014, that companies could use to guide their
    defensive efforts and that agencies could use to measure if the
    critical infrastructure companies they regulated were doing an adequate
    job. The process is voluntary. In addition, approximately 200 critical
    infrastructure companies were notified by the White House that they
    would be held to a higher level of scrutiny given their strategic
    importance. This Executive Order is likely to be followed by another
    executive action in early 2015 on information sharing. The executive
    actions and the NIST Framework are building blocks for better
    cybersecurity, but while they are good first steps, the U.S. remains
    vulnerable.
        We should, if the Framework is effective in improving
    cybersecurity, see changes in the attacker population, with the less
    skilled attackers dropping out and the more skilled (or better
    resourced) changing attack techniques. Even if the Framework is
    effective now, if it is not dynamic and evolve along with the threats
    we face, it might not produce a lasting decrease in the rate of data
    exfiltration, as skilled opponents adjusts to improved defenses. This
    outcome is possible if the attacker seeking to exfiltrate data is an
    intelligence agency or foreign military who have the resources and
    dedication to wage a persistent campaign.
        For example, and judging from public sources, it appears that Sony
    had not implemented most of the NIST Framework recommendations, but it
    is not clear that even if it had, North Korea would have been prevented
    from gaining access and doing damage. The defenses needed for
    determined State opponents like Iran and North Korea lie outside the
    NIST Framework.
        One way to think about critical infrastructure is from the
    perspective of an enemy ``targeteer,'' planning what American targets
    to strike with cyber attacks in order to achieve the desired military
    effect. For these opponents, America is a target rich environment, with
    thousand of potential targets, many of which are poorly defended. If
    the opponent wishes to make a political statement, it will look for a
    single poorly defended target with symbolic or political value. If the
    desired effect is temporary military advantage, it might strike a few
    dozen civilian targets--logistics systems and perhaps critical
    infrastructure in the areas that would support deployed U.S. forces, in
    Hawaii and the West Coast, for example, if the conflict was with forces
    under PACCOM. If the desired effect was extensive damage to the U.S.
    economy and military capabilities, a broad campaign with hundreds of
    civilian targets would need to be attacked. Fortunately, this attack
    scenario is very unlikely and only one or two countries have this
    capability.
        The EO 13636 process attempted to identify some of these critical
    civilian targets, but in general we have no idea whether the Framework
    complicates opponent planning for cyber attack. The dilemma for cyber
    security is that, unlike other possible attacks against the U.S., we
    have not found an effective defensive strategy. Our military forces
    deter truly damaging attacks--no country willingly seeks war with the
    U.S.--but they did not deter North Korea from damaging Sony or Iran
    from attempting to damage banks. We need a blend of adequate defenses
    at the company level and robust Federal efforts to dissuade opponents
    if we are to build a secure cyber future and while the right formula
    has not been found, the NIST strategy could form a useful part of an
    effective national approach to cybersecurity.
        A compliance approach to security lists actions taken; a better
    approach is to ask to see the results of those actions. Good data on
    results is unavailable, and much of the discussion of cybersecurity is
    strangely disconnected from fact. The primary categories for
    measurement are the number of companies adopting of the Framework and
    its effectiveness in thwarting opponents.
        But adoption is not an adequate measurement for success. Even if
    all companies were to voluntarily implement the NIST Framework, it does
    not necessarily mean that there will be an improvement in
    cybersecurity. The measures listed by NIST are likely to improve
    security if implemented correctly, but to what degree there will be
    improvement is unknown, nor do we have any idea of how many companies
    have implemented the Framework recommendations, or how well they have
    done so. For example, if there was widespread adoption of the framework
    but little effect on penetration and exfiltration, it would be
    premature to say that the tide has turned in cyberspace. The difficulty
    in linking recommendation and effect strongly affects how we manage
    risk, and the lack of data hampers a range of initiatives, from
    creating a cyber insurance market to applying the NIST Framework.
        The only way to accurately measure effectiveness is to ask if the
    number of successful penetrations and the outflow of data have
    decreased. If hackers still get in and data still flows out, the
    Framework is not working. These are result-based measures, fundamental
    for determining the return on investment in cybersecurity. Many things
    can be asserted or even measured, but they are useful only to the
    extent they can be correlated with effects.
        Judging from the news, the number of successful computer breaches
    against U.S. companies and agencies has not decreased. We do not know
    if this is because companies have not adopted the framework, have been
    unable to implement it, or if it is because the Framework is
    ineffective. An initial estimate is that all three of these estimates
    are likely true, but to guide policy and legislation we need to
    understand whether which is the most likely cause for the absence of a
    visible improvement in U.S. cybersecurity.
        The success rate of opponents, determined by their ability to
    penetrate target computer networks and to exfiltrate data from these
    networks, is the only true measure of the Framework's effectiveness. In
    2013, press reports state that the FBI notified 3000 companies that
    they had been hacked--and there may have been more that we do not know
    about. If this number declines in 2015, it indicates that the Framework
    is successful.
        NIST did put out a Request for Information (RFI) on the private
    sector's experience so far with using the agency's cybersecurity
    framework and in October it received more than fifty responses form
    companies and associations. A majority of respondents were supportive
    of the Framework and acknowledged its increasing adoption in various
    sectors. Other comments included support for the Framework's easily
    understood guidance, worries that small and medium size enterprises
    were not capable of meeting the guidelines due to costs, and confusion
    about the voluntary nature of the Framework. A majority of respondents
    called for continued support for the Framework.
        A Request for Information is not the best approach to assessment,
    because companies that report ``self-select,'' with only those with
    good stories to tell providing a response. There will be a desire to
    say that the Framework is working well, as this would remove the
    impetus for further cybersecurity measures. These are normal problems
    with survey data, but they could skew responses to produce an overly
    rosy picture. An alternative approach would be to use Commerce
    Department (of which NIST is a part) authorities under the Defense
    Production Act (DPA) to require companies to respond. Using the DPA
    would allow Commerce to devise an adequate sample of companies that
    would allow it to estimate adoption rates by sector and company size.
    Other agencies also can collect information for sector specific groups.
    There may be some resistance to conducting a survey. This resistance in
    itself would be a good indication of intent regarding the Framework.
        There have been only few efforts, such as DHS's continuous
    monitoring effort and the Australian Signals Directorate work on its
    ``Strategies to Mitigate Targeted Cyber Intrusions,'' to show that
    implementing a measure produces an observable reduction in successful
    attacks. These efforts allow us to say that some measures drastically
    reduce opponent success rate. Many of these measures are included in
    the Framework, along with a quantity of other.
        Several issues complicate the implementation of the NIST Framework.
    Many small and medium sized companies lack the manpower, training and
    resources to fully implement the Framework. Straightforward measures,
    such as the ASD mitigation strategies, are appropriate from small and
    medium companies but may not work as well in the complicated networks
    of large companies. Cost is an important issue for companies of all
    sizes--essentially cyber security requires a business to allocate
    resources to purposes that will not generate a return on investment. In
    cybersecurity, we are asking companies to spend money on activities
    that do not generate a return and we have not offered any mechanisms
    for them to recoup this cost. Of course, a good way for companies to
    think about spending on cyber security is that it is like insurance,
    where a company spends money to reduce and manage risk.
        This means that at the level of the firm, cyber security involves
    business decisions where companies should decide how much risk they are
    willing to take, what mitigation efforts (like insurance) best manage
    risk, and then spend accordingly on protection. Anecdotal evidence
    suggests that many companies still underestimate cyber security risks,
    but this is changing and the recent series of events, in particular the
    Target breach (which led to the resignation of the Chief Executive
    Officer and a dramatic decline in revenue), have helped to focus
    attention and raise awareness in company management and boards.
        The Framework provides a useful focal point for company discussions
    of cybersecurity, and a commonly held view is that it is a good first
    step. Over time, it is likely that as companies implement the
    Framework, they will modify it and identify measures that best fit
    their own purposes, as they experiment with different approaches and
    find what works best. Each critical infrastructure sector may find that
    some parts of the framework are more important for their business than
    others and modify implementation in ways that works best for them.
        The effect of the Framework on reducing cybersecurity risk might be
    different for critical infrastructure than for intellectual property.
    Survey data on penetration and exfiltration success rates will show
    where individual defense are inadequate and where collective action is
    needed, through increased international engagement in diplomacy and law
    enforcement cooperation to reduce cyber risks. To continue the
    insurance analogy, we want to take governmental actions that reduce
    systemic risk so that companies can spend less on ``insurance,'' e.g.,
    cybersecurity.
        One of the most valuable lessons of EO 13636 is that one size does
    not fit all. In retrospect, one of the most serious flaws of the 2012
    draft Senate legislation was its efforts to assign a single agency the
    authorities to regulate cyberspace. The EO, by tasking regulatory
    agencies to ensure that their existing regulations adequately take the
    Framework into account, better reflects the diversity of the economy.
        What is emerging is a structure for national cybersecurity shaped
    by the different incentives (or lack thereof) that companies faces in
    making business decisions about cybersecurity. These incentives are
    created by are regulatory authority, business risk, and civil
    liability.

       Critical infrastructure: improved cybersecurity will be the
            result of partnerships between companies and their sector
            regulators. This is the area where the Framework and the
            Executive Order have made the most valuable contributions,
            since it provides a basic template against which company
            actions can be measured.

       Personally identifiable information: Federal Trade
            Commission (FTC) actions and market penalties can incentivize
            companies to better protect personally identifiable
            information, but the level of cybersecurity at major companies
            holding PII is has been inadequate.

       Intellectual property: there is no regulatory mechanism to
            penalize companies for the loss of IP, nor should there be.
            When a company is hacked and loses IP, a part of the
            responsibility is shared by the Federal Government, which needs
            to do more to discourage economic espionage by foreign actors,
            but the bulk of the responsibility is held by the company,
            which has made bad business decisions to under-prioritized
            cybersecurity. Increasingly, the market will penalize such
            companies, at least temporarily, and these companies face
            increased risk of civil liability. Shareholders and customers
            can now ask if a company had implemented the NIST Framework; if
            it had not, a case could reasonably be made that the management
            had failed to exercise due diligence.

        From one perspective, cobbling together measures like the
    Framework, FTC rules, and some yet-undefined set of mechanisms for
    information sharing might seem like a ramshackle approach to one of the
    principle security problems of our time. There is some truth to this,
    but another perspective is that the complexity of the problem, the
    deeply ingrained problems with the technology, and the consequences of
    any cyber action for security and economics at both the global and
    national level, militates against any single solution that can be
    easily and rapidly adopted. Federal action can accelerate progress and
    provide structures for collective action, and from this perspective,
    the NIST Framework is a valuable step forward in what will be a long
    and uncertain process to make cyberspace more secure.
        I again thank the Committee for the opportunity to Testify and
    would be happy to answer any questions.

        The Chairman. Thank you, Dr. Lewis. You all did an
    exceptionally good job of staying within the 5-minute sort of
    not requirement, but suggestion that we have.
        We will do 5-minute rounds of questions for members of the
    Committee who are here.
        And I will start it off, Mr. England, by pointing out--I
    think this is your first time testifying before Congress. Is
    that correct?
        Mr. England. It is.
        The Chairman. Welcome.
        And your company, as I understand it, was formed by a bunch
    of ranchers in Wyoming back in the early 1900s.
        Mr. England. That is correct. Initially our telephone line
    was the top wire on a barbed wire fence.
        The Chairman. I suspect in western Wyoming in the early
    1900s, forming your own communications company was born out of
    necessity probably.
        Mr. England. Pretty much so.
        The Chairman. Well, anyway, the point I want to make is
    that yours is a small rural business, and does not have the
    endless resources, as you mentioned, to address cybersecurity
    risk. And as the CFO for Silver Star, the question is, how have
    you been able to use the Framework in a cost effective way to
    guide how you protect your networks? And a follow up would be,
    has the common language helped you make business decisions and
    better communicate with your IT managers and your outside
    suppliers?
        Mr. England. Yes. Thank you, Chairman Thune.
        To answer the first part of your question regarding the
    cost effectiveness, it is true that making improvements
    identified within the Framework costs money. That is just
    unavoidable. However, using the Framework within our
    organization did not create additional cost for us as a
    business. And so, as an example, when my IT staff came in and
    discussed with me the fact that there was a lot of information
    in that Framework and how are they going to dedicate time to
    reviewing that in addition to their regular job functions, I
    explained to them that they were looking about it all wrong.
    The Framework was a way of providing some structure to the way
    that they were already doing their jobs that kept it in the
    framework of cybersecurity improvements. So we found some very
    easy things that we were able to do.
        As an example, one of the things that the Framework invites
    members to do is to consider cybersecurity risk as part of a
    risk management meeting. And when we looked through our whole
    strategic planning process internally, we knew that we were
    doing a risk assessment meeting to talk about any and all other
    risks. We had not previously considered cybersecurity risk as
    part of that meeting. And so in making an improvement
    internally, based on the suggestions provided in the Framework,
    we were able to add this discussion item at no cost to us, and
    yet it helped shape the whole way that we did the rest of our
    capital budgeting and everything else internally. So we found
    some very good benefits at minimal cost initially.
        And then the second part of your question about the common
    language of the Framework. I think that our experience was that
    the Framework has five functional areas. It ranges from the
    beginning of identifying and responding and recover at the end.
    We found that on the front end, the identify, the respond and
    recover at the back end--these were very common understandable
    things for executive leaders and directors in our organization
    because these are things we are already trying to do as it is.
        The middle sections of detect and protect were more IT
    focused. And so we did have to rely on our IT staff and sitting
    down and having conversations with them. But where the real
    value was is that I was able to turn to my IT staff and ask
    them to help me identify where our current tier assignment was,
    and then as an executive leader in our organization, I was able
    to help provide direction where our target tier, our acceptable
    risk levels would be.
        And so this dialogue that we had between executive and IT
    managers regarding overall cybersecurity risk in the
    organization was an extreme benefit for us. And we felt that
    the language contained within the Framework was conducive for
    that type of conversation.
        The Chairman. The first impulse of Government is often to
    regulate. I think you make a good point, Mr. England, that
    cybersecurity mandates can lead to minimum checklists and
    signal to hackers potential areas for exploitation.
        Dr. Romine, you stated that NIST has reached out to
    regulatory agencies to reinforce the fact that the Framework is
    not designed or intended to create additional regulatory
    requirements for critical infrastructure owners and operators.
    And that is a principle we really worked hard to incorporate
    into the legislation that moved last year.
        And I just want to ask you the question, why is a voluntary
    Framework the best approach, given the severity of the threat,
    and what kind of feedback have you received from other
    agencies?
        Dr. Romine. Thank you, Mr. Chairman. And I appreciate the
    support of the Committee for all of the work that we are doing.
        Our approach is to try to make sure that there is an
    understanding that a voluntary program does not equate to a
    weak program. In fact, voluntary programs for cybersecurity can
    be highly effective. The reason the voluntary approach I think
    makes the most sense is that it maintains the conversation. It
    maintains the engagement across sectors and provides the
    mechanism, as Mr. England pointed out, to incorporate the
    cybersecurity risk as part of the overall risk management of
    the enterprise whereas, as he pointed out, anything that would
    require adhering to regulation in this particular space--the
    tendency would be to push that to the IT component of the
    organization and just assume that that is being taken care of.
    And I think that is going to be far less effective.
        The Chairman. Thank you.
        Senator Nelson?
        Senator Nelson. Mr. Romine, the voluntary program works as
    long as everybody is volunteering.
        I look at this through two portals: data security, personal
    privacy; and national security.
        Mr. England, I think you are right that the market will
    shape the requirements because if people are having their
    personal privacy taken away, and they go through all of that
    harassment, they are going to demand of the company. Now,
    companies naturally have a reluctance to come forward by
    telling that they have been invaded, and perhaps some of that
    loss can be taken care of by insurance, as you all have
    testified.
        But when you get to the question of national security, the
    terrorist is not likely going to attack your operation, Mr.
    England. They are going to go for the bigger spectacular thing.
        So this morning, we had six or seven people killed on the
    New York railroad system. All signs are that it was just a
    train crash into a vehicle. But how about a cyber attack on a
    transportation system that may shut down the railroad or cause
    two trains to run together? What about Target? 70 million
    shoppers' data taken. How about Yahoo? Passwords and user names
    in a cyber attack. How about EBay changing the passwords
    because of a cyber attack? Several banks, including J.P.
    Morgan, 76 million households and 7 million small businesses
    affected. Home Depot, 56 million accounts, $62 million to cover
    the cost. Sony, we already talked about, $100 million, directly
    a cyber attack for its intended purpose to intimidate.
        So, Ms. Beauchesne, how can you say that everything is
    working, as you testified?
        Ms. Beauchesne. Thank you, sir.
        Well, I would say that we do not want to have mandates on
    the private sector. The bad guys do not have mandates and
    regulations. The threat is evolving quickly. We need to have
    the private sector be able to evolve quickly and continue to
    evolve their defenses. I think the strongest incentive for the
    private sector is that they want to protect their information.
    They want to protect their customers. It is in their best
    interests for them to stay in business to do that. That is the
    incentive.
        Senator Nelson. Well, as I said in the opening comments, if
    a terrorist comes in and with a satchel charge blows up a major
    electrical grid, sewer plant, water plant, that is obviously a
    terrorist attack. But they can do the same thing with a cyber
    attack where the effect even is more extensive.
        Can you tell us what percent of the companies represented
    on your task force have actually implemented this Framework,
    this voluntary Framework?
        Ms. Beauchesne. No, sir. We have not surveyed them. I do
    not have an exact number for you.
        But I will tell you that through our campaign that we have
    done around the country, all of the companies are highly
    interested in adopting the Framework and using the Framework.
    And this is not new. The Framework is a new tool but it is made
    up of best practices and standards and guidelines that
    companies have been using for several years now.
        Senator Nelson. Would you submit for the Committee's
    consideration the percentage of that, as well as the percentage
    of your general membership implementing the Framework?
        And, Mr. Smocer, among the publicly traded companies
    represented by the Business Roundtable, have any of your
    members identified cyber attacks as the reason for declining
    earnings?
        Mr. Smocer. Within the Financial Services Roundtable, to
    the best of my knowledge, no, not at this point.
        Senator Nelson. Do they consistently report, in their SEC
    filings, cyber attacks?
        Mr. Smocer. With regard to the SEC filings, obviously cyber
    risk is one of the risks they need to consider, and if there
    are indications under SEC rules that that risk has importance,
    then yes, they are reporting it, sir.
        Senator Nelson. Mr. Moran?

                    STATEMENT OF HON. JERRY MORAN,
                        U.S. SENATOR FROM KANSAS

        Senator Moran [presiding]. Thank you very much.
        Senator Thune indicated he was departing for a few minutes
    for a Finance Committee meeting, and next on the list is Mr.
    Peters after me.
        Ms. Beauchesne, you indicated in your testimony that the
    NIST Framework has been a helpful tool, but then you also
    promoted needing to go further with information sharing. You
    indicated that is not the jurisdiction of this committee. But I
    want to explore what we can learn from NIST and the partnership
    that is created there to encourage that information sharing.
        I probably will ask Mr. England a similar question. But how
    do we get the smallest businesses? What is the incentive for
    them to participate today, and what barriers need to be
    overcome to see that they do participate potentially on
    information sharing?
        Ms. Beauchesne. Thank you.
        First of all, I think take a look at the Framework. It is
    only a year old. Right? So we are still socializing it. We are
    still getting people to be aware of that, and that is part of
    the Chamber's job, working with NIST. It has been a terrific
    partnership because the private sector was involved in every
    step of the development of the Framework. So they had a big
    stake in this working.
        As far as getting smaller companies to adopt the Framework,
    the more that people are using it, the cost of adoption will go
    down. Right?
        Senator Moran. So the cost of participation will be----
        Ms. Beauchesne. A market influence, yes, sir.
        Not everyone, especially the small or medium-sized
    businesses, can afford to go out and hire a FireEye, a
    Mandiant. So we want everyone to use this tool. And again, the
    Framework is one tool in the toolbox. It is a process. It is a
    great one. Everyone is talking the same language. Everyone is
    looking at the same kind of process.
        But as you said, more needs to be done. And that is the
    information sharing piece, and that is the Chamber's number one
    cybersecurity priority this year. We really need to get that
    legislation done. If we are going to get to the next level so
    that the Federal Government shares information with the private
    sector, that we are seeing the threats at the same time, that
    we are sharing information in real time, not 6 months later
    when the FBI comes knocking on your door.
        Senator Moran. Do you know the description of the
    businesses, the kind of demographic or size, revenue, number of
    employees, kind of the description of the typical business that
    participates in the industry information sharing and analysis
    centers or a number of fusion centers across the country,
    including one in Topeka, Kansas that gets great national
    reviews? Is there an indication that small business is able and
    interested to participate?
        Ms. Beauchesne. I actually will defer to my colleague here
    on the ISAC participation. My understanding, though, is it is
    probably more mid-sized and large-sized companies. The smaller
    ones frankly do not have the staff or time that is my
    understanding.
        Mr. Smocer. Our experience within the Financial Services
    Information Sharing and Analysis Center is that it does run the
    gamut from large to small. I would say the smaller
    organizations typically tend to be more consumers of the shared
    information. So in terms of protecting themselves, they tend to
    get the information that the larger institutions are witnessing
    in terms of attempted attacks, the nature of those attacks,
    consume that information, and then prepare to defend themselves
    better from that information.
        I think one thing to recognize too is a lot of smaller
    institutions or organizations, be they in financial services or
    otherwise, are often supported by outside IT service providers.
    So I think one thing that is critical too in the information
    sharing debate is to make sure that those kind of service
    providers are engaged because they will help protect small
    institutions that they service.
        Senator Moran. That is a good point. The business that
    conducts business with a smaller business needs to be insistent
    upon the right framework in place for who they are contracting
    with.
        Mr. Smocer. And one of the advantages of the Framework for
    smaller businesses too is that in gauging the effectiveness of
    their service providers, they can use the Framework to ask the
    right questions of their service providers in a kind of lexicon
    that is common. We tend to think of the Framework as almost a
    Rosetta Stone in terms of taking a lot of disparate language
    around technology and cybersecurity and placing it in a common
    lexicon that service providers, customers, clients can
    understand.
        Senator Moran. And I would point out that while it may be
    an IT company that you are subcontracting or contracting with,
    a business contracts with lots of other businesses unrelated in
    a sense to IT, and there is an opportunity for the attack to
    occur there. And I do not know if this is demonstrated by facts
    yet today, but I assume that it may come to the point in which
    it is easier to attack the smaller business that contracts with
    a larger business and you arrive at the same point of very
    damaging occurrences. Does that make sense?
        Mr. Smocer. It does. And certainly in some of the examples
    that Senator Nelson was giving, in particular, one large
    retailer that was ostensibly attacked through a small HVAC
    provider.
        Senator Moran. Mr. England, just let me ask you why your
    company has the incentive to do what you are doing?
        Mr. England. It is a business imperative. You know, we talk
    about insurance as a protection against liability, but I like
    to think of the example of life insurance. It really does not
    benefit me if I am dead. And as a small business, I am
    dependent on the trust of my customers and being able to
    deliver them services in a secure environment. And as a small
    business, we could sustain probably just a small number of
    attacks before we would be--as a business entity, our going
    concern, would be in jeopardy. So there is a strong incentive
    to do that.
        And I echo the comments that have been shared already that
    this is why we view it as a competitive advantage for us. We
    have had open conversations with larger companies that we are
    connecting to, and we have had open conversations with people
    who are providing services to us because it is a great risk.
        Senator Moran. Thank you very much.
        Mr. Peters?

                    STATEMENT OF HON. GARY PETERS,
                       U.S. SENATOR FROM MICHIGAN

        Senator Peters. Thank you, Mr. Moran.
        I really have enjoyed the testimony here and what is going
    to be an increasingly important discussion in the years ahead.
    And so I appreciate all of your involvement in this issue.
        Mr. Lewis, if I can start with a question for you. In your
    testimony you, I think, very wisely said that the question is
    not how many folks are adopting the Framework. It is whether or
    not it is actually effective. And I think the jury is still
    out. It is still new. We are in the process of implementing it
    and companies are adopting it. So we will have more data points
    as we go forward. If you can kind of elaborate how we would
    assess that.
        And in particular, you mentioned at the very end of your
    testimony too that you think this is a good start, but you also
    believe it is not enough. So where do you think we are going to
    be? We are going to have data points, obviously, to assess
    this. But where do we have to go that is even further than this
    Framework? What were you implying in your testimony?
        Dr. Lewis. Well, and thank you for the question.
        The administration has chosen a voluntary approach, backed
    up by the implicit threat of regulatory action if companies do
    not do anything. And the jury is still out, as you said.
        For me, the easiest way would be to just look at the number
    of incidents that we see, the losses that we see, and whether
    it is going up or down. And one of the ways I think about this
    is we have four or five primary opponents in cyberspace: the
    Russians who can pretty much do whatever they want, the Chinese
    who have a massive amount of resources, Iran and North Korea
    who have really improved in recent years, and the groups that
    Iran supports, some of the terrorist groups that Senator Nelson
    might be talking about. These are pros. Let us see how they
    react. Right? If their success rate goes down--and they have
    had an unbroken string of successes for more than a decade--
    then we can say we have done enough. But we do not have the
    data to say that.
        If it is not enough, then we need to think where is it we
    want to take action to harden critical infrastructure and where
    is it we want to take action as a Government to work with these
    nation state opponents to get them to change their behavior.
        So I think those are the two areas.
        Watch the Framework. People have said they wanted to do
    voluntary stuff for a long time. Now is their chance. Prove
    that it works. If it does, great. But even if it works, there
    will still be a class of opponents who can only respond to
    Government action, and that is where we need to think.
        Senator Peters. Especially with the state actors is where
    we are going to need to do it.
        Dr. Lewis. Right.
        Senator Peters. Mr. Smocer, you mentioned in your testimony
    that you think that we could see a baseline of activity from
    companies based on insurance and insurance standards. And I
    also heard a number of folks comment that with regulation, you
    basically have a checklist process that you are going to go
    through.
        How is it fundamentally different if it is an insurance
    company? Would an insurance company basically give you a
    checklist, say if you do these things, you will be insured? If
    you do not--what is the difference between those two approaches
    as you see it?
        Mr. Smocer. I would say that the way the Framework will be
    used is less about the checklist and more about underwriting
    the risk that the company faces. So I think as in any
    insurance, you need to have some level of standard underwriting
    and some lexicon that provides that to be able to get the
    actuary numbers to figure out the risk and figure out the
    premiums therefore that you are going to charge.
        I think what the Framework does is it provides a really
    good risk framework that, as many of my colleagues have pointed
    out, is understandable from the board room down to the
    operations floor. And therefore, I think the insurance
    companies see this as an opportunity potentially to say this is
    the tool that we have been looking for to give us some standard
    underwriting guidance to be able to figure out our premiums and
    risk scenarios.
        Senator Peters. Thank you.
        Mr. Romine, in your testimony you talked about your NICE
    initiative which deals with education because for us to
    effectively deal with this problem, we need folks who are
    highly skilled and trained in cybersecurity. Could you
    elaborate a little bit on what you talked about and how the
    initiative is progressing and what we need to do to make sure
    that we have the training programs in place to train folks who
    can deal with some of the threats from China and Russia and the
    others that are coming at us?
        Dr. Romine. Certainly. Thank you, sir.
        The NICE program that NIST is privileged to lead housing
    the national program office for NICE is actually a broad
    interagency activity. And it is focused on three things. One is
    cybersecurity awareness. One is fundamental education from K
    through postgraduate. And then related to that one is the
    development of a cybersecurity workforce, capable workforce.
        And so the last one I think is the one that you are
    specifically interested in. And I would say a lot has been done
    in that space. There is a lot left to do. We have collaborated
    with the Department of Labor and the Office of Personnel
    Management, OPM, and others, the Department of Education, the
    National Science Foundation, and many of our other partners.
    And I think we are addressing some of the shortcomings
    associated with sort of understanding the needs, the
    requirements of that cybersecurity work force, the STEM
    education that is required to underpin a professional workforce
    in cybersecurity.
        And so I think there is more to come. We still have a
    shortfall. This is, I think, well known. We need more capable
    cybersecurity actors. But we are making progress.
        Senator Moran. Mr. Schatz?

                    STATEMENT OF HON. BRIAN SCHATZ,
                        U.S. SENATOR FROM HAWAII

        Senator Schatz. Thank you.
        It seems all of the panelists emphasize--or at least most
    of the panelists emphasize that the voluntary nature of the
    Framework was key to its initial success. But I still believe
    there need to be quantifiable metrics to determine adoption
    among companies.
        Can each of you briefly suggest more rigorous and precise
    ways to measure the adoption of the Framework beyond the
    October RFI?
        Dr. Romine. I can start briefly and say that from NIST's
    perspective, it is the ongoing engagement with our industry
    partners. This is something that we did not deliver this to the
    President and walk away. We are actually continuing to engage.
    And what we are seeing is a shift in the conversation. The
    momentum is building.
        Senator Schatz. But you are a data person. So what are
    going to be the metrics? I mean, that sounds like me talking.
    Let us talk about what are the metrics for success for those
    programs.
        Dr. Romine. I represent a measurement institute, and so
    this is something that we take very, very seriously. Of course,
    one of the problems that you have to worry about is you can
    sometimes get what you measure if you are not careful about
    designing the measurements.
        We are still trying to figure out exactly the appropriate
    approach for measuring the rate or the level of use of the
    Framework. But I think----
        Senator Schatz. So we do not have metrics yet.
        Dr. Romine. We do not yet. The Framework is still--as we
    have pointed out, it is kind of in its infancy. It is less than
    a year old, and I think the amount of momentum is pretty
    striking given that fact of its youth. But we are working on
    ways that we can try to assess this.
        Senator Schatz. What is your time-frame for developing
    metrics and reporting back to the Congress on progress?
        Dr. Romine. I would be reluctant to give you a very
    specific time, but I can tell you we are diligently working on
    trying to determine the best approach for measuring that.
        Senator Schatz. Ms. Beauchesne?
        Ms. Beauchesne. Well, I am not from a metrics institute.
    But I will tell you I would think about it this way. Everyone
    wears seatbelts now. People do not smoke now. I think we need a
    campaign like that. And when we start to see people around the
    country understanding we are talking about the cyber Framework,
    that it is not just a big news story when they hit a Federal
    department or one of our big retailers, everyone understands
    what it means to protect your networks and what good cyber
    hygiene means, then that will be success.
        Mr. Smocer. And I approach it from a slightly different
    perspective coming from an industry that already has a fair
    amount of cybersecurity regulation associated with it. I mean,
    our concern is primarily around assuring that our members are
    aware of it. And part of the way we are doing that, by the way,
    is through some survey information that we are doing. So
    through the FSISAC, the Information Sharing and Analysis
    Center, through the sector coordinating council that we have,
    we have done an awareness survey, and we know that the
    institutions are very aware of it. We are then probably going
    to move on to kind of what the usage is.
        Our big concern, though, is reconciling the Framework with
    the existing regulatory structure that we have.
        Mr. England. I do not have the same kind of national reach
    that my colleagues do here to get that kind of visibility. But
    I can just share with you my own personal experience.
        This year, we have, independent from all this, gone through
    a review of our whole vendor management process. And as we have
    gone through that, we realized that this would perhaps be an
    ideal opportunity to ask some critical questions about
    cybersecurity. And in particular, we have included a question
    as to whether or not our vendors and suppliers, those we
    partner with, are using the NIST Cybersecurity Framework.
        I think, as Ms. Beauchesne pointed out, the more
    conversations that we are having about this, the more dialogues
    that we are having with those that we interface with on our
    systems--and we are seeing more interest growing in it and more
    conversations surrounding it as a result. And so I think it is
    an organic growth.
        Senator Schatz. Dr. Lewis?
        Dr. Lewis. Thank you.
        I would call everyone's attention to section 10 of the
    Executive Order which says that if the voluntary measures do
    not work, the White House reserves the right to do more in a
    regulatory fashion. They did an assessment of the effectiveness
    of the Framework a few months after it came out. Amazingly
    enough, they found that it was succeeding. I do not know how
    they figured that out.
        We have multiple data sources and we need to use them all.
    The sector-specific agencies that oversee critical
    infrastructure sectors need to collect data on the status of
    these companies and how many times they have been hacked.
        Senator Schatz. And is it NIST's job to aggregate all of
    those data, or is there a lead Government agency? You mentioned
    the FBI going to a company. But is there a point agency on
    aggregating all of these data?
        Dr. Lewis. There is not, and that might be a useful thing.
    I think NIST is not really the aggregator here. NIST could come
    up with standards for aggregation. FBI statistics are useful.
    Just the number of times they have sent people out to notify
    companies, which was in the thousands in the last 2 years.
        Senator Schatz. But right now there is no lead Federal
    Government agency in terms of getting our arms around the
    problem.
        Dr. Lewis. No. DHS does not have the authority nor do they
    have the sources. The intelligence community collects data on
    foreign success rates. That data is classified, but I would
    suggest that we are not doing so well. DOD collects information
    on the defense industrial base. And finally, Commerce has some
    authorities they have not taken advantage of.
        Senator Schatz. OK. Thank you. My time is up.
        The Chairman [presiding]. Senator Daines?

                    STATEMENT OF HON. STEVE DAINES,
                       U.S. SENATOR FROM MONTANA

        Senator Daines. Thank you, Mr. Chairman.
        Prior to coming up here and starting this new day job, I
    spent 28 years in the private sector. So I am always one that
    hopes to see more private sector-led solutions here. In fact, I
    was 12 years as exec in a cloud computing company, and it was
    always in our best interest to make sure we had our networks
    hardened and always had the best practices on cybersecurity
    because if we failed to do so, we did not have a business any
    longer.
        Mr. Romine, a question for you. This Framework was released
    about a year ago, February 12, 2014, version 1.0. How long did
    it take from kind of the beginnings of the process to put
    together V1.0 here before it released?
        Dr. Romine. It took the full year. We were given a year by
    the executive order. The first request for information that we
    asked the private sector to react was immediately after the
    release of the executive order. We subsequently needed to
    engage all of the stakeholders, private sector, Government
    regulators, industry associations, and international community
    over the course of the next year in five separate workshops
    that were held geographically distributed around the country.
    On the basis of that feedback, after an initial release of a
    draft, we subsequently amended the draft, and the version that
    you see that was given to the President on schedule, I am proud
    to say, was the culmination of that year's effort.
        Senator Daines. So round numbers, it is about 2 years old I
    guess as we sit here today, from the beginning of the process
    to where we are at today.
        Dr. Romine. That is correct.
        Senator Daines. You probably had your beta release, and
    then you have got your version 1.0 here.
        Dr. Romine. Yes, sir.
        Senator Daines. I know as we were building our company--one
    of our strategic advantages--we could run faster than anybody
    else. That is how we won in the technology space. And we grew a
    large company. We capitalized nearly $2 billion from virtually
    starting up from nowhere. I mean, I have lived in the world
    here of data and cloud computing.
        But I am just wondering how current now, given the speed at
    which the bad guys are moving, given the start about 2 years
    ago--you know, when is version 2.0 to come out, and how often
    do you see updating the standard?
        Dr. Romine. Thank you, sir.
        I think it is important to note that the Framework is not
    technology-specific. That is, we are not trying to institute
    specific technologies that are going to be out of date almost
    as soon as a document appears. Instead, it describes a process,
    a framework that you can use to communicate your cybersecurity
    needs both internally, as well as with external stakeholders.
    And so I do not think that is something that will--even though
    this is a fast-moving area, I----
        Senator Daines. I see that. It is clearly a framework and a
    process that is laid out here in terms of assessing risk and so
    forth.
        Dr. Romine. That is right.
        Senator Daines. One thing I also notice about D.C.--this is
    a town that seems to reward activity and not results. How do
    you help companies try to quantify this process in terms of
    eventually the outcome? We have moved this process here, but
    they have got to put, I think, some kind of quantitative
    assessment whether it is a 0 to 100 scale, whether it is a
    letter scale to say--and I have a question for Mr. England too.
    If you say are they complying with NIST, what does that mean?
        Dr. Romine. I can just start by saying as part of the
    Framework, in fact, there is an evaluation of the level of
    assurance that an organization has that they are responding to
    the various functions that are listed in the Framework, the so-
    called tiers that we have developed. And so there is an
    internal assessment capability already.
        With regard to helping businesses, particularly small and
    medium businesses, we have active engagement. We have outreach
    that predates the development of the Framework, and we are now
    using those outreach mechanisms with trade associations, with
    small businesses throughout the country to socialize the
    Framework, to increase awareness.
        Senator Daines. One thing I think is helpful, I guess, is,
    is there a way to try to grade, assess, quantify what it means
    to have adopted this Framework, I think moving in that
    direction, so there is a way to have a comparative analysis
    between company A or company B?
        Dr. Romine. I think it depends. It is a little bit
    dangerous to go that route principally because the companies
    face different contexts of use, and so comparing across is
    going to be very challenging. I think the internal assessment
    of how effective your cybersecurity enterprise or your risk
    management approach is----
        Senator Daines. That is probably the better question in
    terms of looking--it is a continuum here in a rapidly very
    dynamic--you know, rapidly changing environment. If we start
    here, we do this assessment, 6 months later or a year later, we
    can see if we are making progress or not. I think it probably
    is some value add.
        And last, what I see too--I will know when these are being
    used when something like this has got its--you can tell it is
    not just sitting on the shelf and gathering dust. I am just
    always a little skeptical of this town where they just want to
    create some activity. We got a standard and here it is. And the
    real question will be adoption and focusing whether we want
    more of this. It is like bread. If it is fresh, they are going
    to want it. If it gets stale, it will just be another binder on
    the bookshelf.
        Dr. Romine. I could not agree more. We heard universally
    from all of our stakeholders that more shelf-ware was not what
    was needed, and I think we took that into account in engaging
    broadly across the stakeholder interests and listening to their
    concerns and developing, in conjunction with the stakeholders,
    a document that is actually usable.
        Senator Daines. All right. Thank you. I am out of time.
        The Chairman. Thank you, Senator Daines.
        Senator Klobuchar?

                   STATEMENT OF HON. AMY KLOBUCHAR,
                      U.S. SENATOR FROM MINNESOTA

        Senator Klobuchar. Thank you very much, Mr. Chairman.
        Thank you everyone. Mr. Smocer, please say hello to
    Governor Pawlenty, my friend, who I know is, I guess, your
    boss.
        Mr. Smocer. He is in fact my boss.
        Senator Klobuchar. Is he doing OK?
        Mr. Smocer. Yes.
        [Laughter.]
        Mr. Smocer. No. He is doing very well.
        Senator Klobuchar. All right. Very good.
        And then also I think you mentioned the major retailer who
    was attacked, and of course, I think everyone knows that was
    Target out of Minnesota. So we have seen firsthand the
    devastating effect this can have even though there was not a
    lot of actual damage to consumers, but what happened to Target
    because of that, even though they were in fact victims of
    theft. And we are proud that they have come back from that.
        But I think we all know the effect that this has on
    companies and on consumers. And I just think there is a moment
    here, maybe because of what happened with Sony and other
    things, where there might be a space to actually move forward
    on some legislation which, as we all know, crosses many
    committees. And I happen to be on two of them, Commerce as well
    as Judiciary, where I think we can move forward.
        I was going to ask you, Mr. Romine, just if you could
    answer briefly, if there are any industries you think are ahead
    of this that are doing better jobs than others in terms of
    taking this on.
        Dr. Romine. We have certainly had active engagement from a
    number of sectors. The ones who are the most, I think,
    critically dependent upon information technology have had kind
    of a head start on cybersecurity issues, and so the financial
    services sector certainly is a leading sector in that area. I
    think the energy sector--some of the regulated industries,
    industries that have had to cope with regulation overall, I
    think have also kind of had a little bit of a head start.
        Senator Klobuchar. And could you explain how the Framework
    is going to be technology-neutral? I know there have been some
    concerns raised about overly complex regulations.
        Dr. Romine. That is right.
        Senator Klobuchar. Can you explain in a not complex way?
        Dr. Romine. I will do my best.
        The Framework itself is completely technology agnostic. It
    does not specify any particular technologies. It just talks
    about standards and best practices. And I should point out that
    the Framework is actually predicated on use of existing bodies
    of standards, many of them international. And I think it is an
    important thing to note that that gives greater opportunity to
    harmonize things, particularly for multinational corporations
    who have a difficult time responding to different regulatory
    environments in different parts of the globe.
        Senator Klobuchar. Ms. Beauchesne, I know the Chamber has
    been working with law enforcement, you know, FBI, Secret
    Service, cops on the beat. I used to be a prosecutor for 8
    years, and at the beginnings of this, I cannot tell you what
    this was like. We had line officers that would show up at a
    house that had some cyber problem and turn on the computer and
    all the evidence would vanish because someone had set it up
    that way. And I know there has been more training in law
    enforcement, and certainly as you get to the upper levels,
    there is more training.
        Is the working relationship good? How do you think this can
    move forward in terms of making sure we are doing a better job
    in being as sophisticated as the crooks that are taking our
    private data?
        Ms. Beauchesne. That is a very good question. Thank you.
        I think that, again, keeping this Framework flexible,
    keeping it non-regulatory so that we can move at the speed of
    the bad guys is essential.
        As far as law enforcement, I think the relationship is very
    good. When we have gone around the country doing the Chamber's
    Cyber Campaign, we have included the local FBI and the local
    Secret Service person so that our members in Austin, Texas, for
    instance, get to meet them, get to have face time with them so
    that when something does happen, they know where to go.
        And I would also say at the Bureau, we now have a private
    sector office, a private sector lead there. So our members have
    one-stop shopping and know where to go. So I think it is a good
    relationship.
        Senator Klobuchar. Very good.
        My last question is actually for anyone that wants to chime
    in. Senator Blunt and I successfully included an amendment to
    make sure that NIST was accountable in the process in terms of
    getting us information on what is happening.
        But my question is the President talked about information
    sharing and liability protection legislation as an important
    incentive to encourage further participation in both the NIST
    Framework and other cybersecurity efforts. I guess I would ask
    the panel, especially from the private sector side, how
    important is this for moving forward.
        Mr. Smocer. Sure. I think we were certainly very encouraged
    by the comments because I think the liability protection is a
    key component that we have been looking for. I think we would
    love to see that extended. In the Framework, the
    recommendation--it was mainly private-to-government that would
    be covered by the liability protection. We think that needs to
    extend a bit to the private-to-private sharing models as well.
    You know, a lot of times----
        Senator Klobuchar. Are there like antitrust concerns? You
    know, if you start giving data to your competitors saying
    something is happening in terms of the liability issues you are
    worried about.
        Mr. Smocer. Well, I think if I were a GC, that might be one
    of the reasons I would discourage information sharing. But I
    think in reality the recognition is this--when it comes to
    cybersecurity, this largely has to be a noncompetitive issue
    because the reality is that any institution that gets attacked
    is probably witnessing the next victim's circumstance. So if we
    can share that information more freely with the right
    protections in place, I think that is very important.
        Senator Klobuchar. Anyone else?
        Ms. Beauchesne. If I could just add on the information
    sharing piece. Absolutely, the liability protections are
    absolutely essential for the private sector. Whether it is
    FOIA, whether it is regulatory, the antitrust, businesses need
    those safeguards in order to share that information. We do not
    want to be blaming the victim. We want the companies to be able
    to share that information with impunity.
        Senator Klobuchar. All right. Thank you very much.
        The Chairman. Thank you, Senator Klobuchar.
        Senator Manchin has returned.

                    STATEMENT OF HON. JOE MANCHIN,
                    U.S. SENATOR FROM WEST VIRGINIA

        Senator Manchin. Thank you so much, Mr. Chairman. I am so
    sorry because we've got two or three meetings going on. I would
    hate to look like it is being rude, but we are not. We are just
    trying to make all of our meetings.
        Let me just say this to all of you. I want to thank you all
    for your service and also being here and helping us through
    these most difficult situations.
        To Mr. Romine, you first, sir. The West Virginia National
    Guard is partnering with the University of Charleston and the
    Blue Ridge Technical College on a cyber training program that
    will help address the workforce shortage issues that are
    highlighted in the roadmap for improving critical
    infrastructure cybersecurity. The West Virginia National Guard
    and the University of Charleston have also developed
    undergraduate and graduate-level cybersecurity certificate
    programs based on the national training standards.
        How is your office and the National Initiative for
    Cybersecurity Education coordinating with the West Virginia
    National Guard on this program and what can we do, all of us
    and yourself, better to support innovative partnerships like
    this?
        Dr. Romine. Thank you, Senator. We are certainly always
    pleased when there are organizations that are taking this very
    seriously and developing curricula and contributing to solving
    the workforce issue. I do not have any specifics about that
    particular case except that I would say we would be delighted
    to engage and have discussion.
        Senator Manchin. Do you all have the ability to partner up
    with them to help them take these programs to higher levels, or
    how does that work?
        Dr. Romine. We certainly have the ability to contribute and
    share ideas under our program.
        Senator Manchin. So I can get them in contact with you to
    make sure we can hook up?
        Dr. Romine. I would welcome that.
        Senator Manchin. Ms. Beauchesne, banks and other financial
    institutions are already responsible for following a variety of
    regulations related to cybersecurity. They have requirements to
    protect against breaches, as well as requirements about how to
    respond in the event of a breach. They could be responsible for
    cyber theft that occurs through a third party even if the
    threat was not the fault of the bank.
        If financial institutions continue to bear the financial
    liability for cyber attacks, what incentive will other
    industries, such as retail, have to invest in voluntary
    cybersecurity protections?
        And they are starting to move a piece of legislation
    saying, listen, somebody else has to have skin in the game. If
    it is not my fault and you will not invest, whether it be--I am
    using Target, and maybe they have done everything possible. But
    it was a tremendous breach. But basically it fell on the
    responsibility of the banks.
        I have been called personally. They said your credit card
    has been jeopardized, and we want you to cut it up. We will
    send you a new one. I have had that done twice now.
        So with all that being done, the banks are saying we would
    not have to have this if they are doing everything possible.
        So two things. What can they do, and do you think that it
    should be a dual responsibility? Whoever is at fault may have
    not done what technology would allow them to do. Should the
    institution, whether it be commercial or retail, bear the
    brunt?
        Ms. Beauchesne. Yes. I think that the brunt should be
    shared by all involved.
        Senator Manchin. Do you think legislation would be needed
    to share that rather than the financial sector taking the full
    brunt?
        Ms. Beauchesne. I am not completely familiar with the
    legislation, so I will not commit to that.
        But what I would say is we are----
        Senator Manchin. It is pretty simple. Who pays? Who did
    wrong and who pays?
        Ms. Beauchesne. I think we are going to see a sharing of
    who pays. I think that you are seeing companies step up, and
    here is why because it is not just about who pays. They want to
    protect their customers. They want to protect their brand, and
    it is in their interest to do so.
        Senator Manchin. I know they want to, but when they know
    that it is not going to cost them anything when it is breached
    and they have not stepped up and bought the latest and greatest
    technology to try to develop it and work, what is their
    incentive to do so? And you are going to have to convince all
    of us that we need to step in there and say, OK, you are at
    fault, you pay.
        Anybody else want to comment on this? I see Mr. Lewis down
    there shaking his head.
        Dr. Lewis. So I talked to the head of a major credit card
    company, and what he said to me is, you know, it is a problem
    for us, but if I put a nickel on your credit card bill, are you
    going to notice. And that will cover the expenses. So everyone
    in the room who has a credit card, you are paying 5 or 10 cents
    a year, and that covers fraud.
        The debate is over two things. First, the cost is going up,
    and you may start to notice when you are paying more, and that
    is where you are getting companies saying, hey, wait a minute.
    Why am I holding responsibility for this?
        Senator Manchin. You are talking about the financial
    companies, financial institutions.
        Dr. Lewis. Yes, because currently they bear the liability,
    and they would like not to.
        Senator Manchin. I am just saying the innovative and
    creative ideas will come if you make me responsibility and hold
    me liable. I will push the demographics, if you will, if I know
    that it could fall back on me. If not, I might be a little
    complacent, saying you know what, Mr. Eamon here is going to
    have to pay it, so I am not worried. I have done all I can. I
    do not need to do anymore. I am not going to incur that much
    more expense.
        Dr. Lewis. We did a study of major breaches and what we
    found is the first phase is the bad guys get in. The second
    phase is they are discovered, and the third phase is everyone
    points at everyone else and says they are responsible. So some
    allocation of responsibility would be good.
        Senator Manchin. Thank you, Mr. Chairman. I am sorry.
        The Chairman. Thank you, Senator Manchin.
        Next up as we move west, Senator Udall.

                     STATEMENT OF HON. TOM UDALL,
                      U.S. SENATOR FROM NEW MEXICO

        Senator Udall. Thank you very much, Chairman Thune, and
    great to be back with you on the Commerce Committee. And I am
    going to talk a little bit about a couple of things we have
    worked on in the past.
        Today American citizens, businesses, and government
    agencies face what I think are very serious cyber threats, and
    so I really appreciate this hearing. Everything from personal
    data, to trade secrets, to national security are at risk from
    intrusion by independent hackers and foreign governments. They
    even tell me our own Senate offices are frequently the subject
    of those kinds of attacks from foreign governments. Cyber
    threats are real and can cripple our water systems, our oil
    pipelines, and hospitals, and I think we need to take these
    threats very seriously.
        I have supported cybersecurity legislation in the Senate,
    including the Rockefeller and Thune Cybersecurity Enhancement
    Act that became law, I believe in the last Congress. I support
    measures to improve our cybersecurity defense, including
    important work at two national laboratories in my home state of
    New Mexico. Los Alamos National Laboratory is a leader in
    quantum cryptography, and Sandia National Laboratory is engaged
    in efforts to secure the national electrical grid from cyber
    attack. Sandia has partnerships with universities and the
    private sector. They are helping computer science students
    become cyber professionals.
        And when I look at this field, like many Americans, I also
    have a lot of concerns about what our own Government is doing
    in terms of domestic surveillance. And I think it is absolutely
    clear we need to strike the right balance between security and
    our civil liberties. But I know that is not the main focus
    here.
        So, Dr. Romine, I would like to ask you about the subject
    of cloud computing. Your testimony briefly notes that NIST
    plays a role for advancing standards for cloud computing.
    Senator Moran and I worked on a piece of legislation, which was
    signed into law last year, called the Federal IT Acquisition
    Reform Act. And we know from the GAO that smarter Federal IT
    policies could lead to billions of dollars in taxpayer savings.
    This includes greater use of cloud computing across the Federal
    Government.
        So I would like to ask what is NIST's vision with respect
    to cloud computing. What does NIST see as the primary
    challenges for cybersecurity when it comes to cloud computing,
    and how is NIST working with other Federal agencies to support
    their transition to the cloud?
        Dr. Romine. Thank you, Senator.
        NIST has been involved in cloud computing. We have an
    ongoing cloud computing research program and standards program
    today in my laboratory, the Information Technology Laboratory.
    We engaged with other Federal stakeholders during the
    development of the FedRAMP process which is based on standards
    that we developed in consultation with the private sector
    again. Our standard MO is to work with the private sector on
    these issues. We establish the basic definitions for cloud
    computing.
        With regard to cybersecurity, one of the challenges, of
    course--cloud computing has sort of a multi-tendency component
    to it, meaning that multiple people are on the same hardware at
    the same time, and there is the potential for sort of bleeding
    over. So we have to be careful about that.
        But another issue and one that we have just issued guidance
    about has to do with cloud forensics. That is, given that you
    are no longer necessarily just local in your IT space but
    rather using a cloud provider, how do you after the fact figure
    out what happened using forensics techniques. And so we have
    got some recent guidance that we have issued on that.
        Senator Udall. I do not know if any of the other panelists
    have any comment on what he was talking about. You all are good
    on that?
        You noticed and you talked about working with the private
    sector. Is NIST getting the level of cooperation it needs from
    industry stakeholders?
        Dr. Romine. I think the level of engagement has been
    astonishing. We have been very pleased at the number of people
    who have engaged with us both in terms of responding to
    requests for information in the early processes of Framework
    development, for example, as well as 6 months after or 8 months
    after the Framework was released, information about how it is
    being used and the lessons that we can learn. That response has
    been tremendous. The workshop engagement has been fantastic. So
    we are very excited.
        Senator Udall. Thank you very much.
        And thank you, Chairman Thune.
        The Chairman. Thank you, Senator Udall.
        Senator Gardner is up next.

                    STATEMENT OF HON. CORY GARDNER,
                       U.S. SENATOR FROM COLORADO

        Senator Gardner. Thank you, Mr. Chairman. Thanks for
    holding this hearing as well, and thank you to the witnesses
    for being here today and your testimony.
        I had an opportunity about 6 months ago to visit one of the
    largest tech employers in Colorado, manufacturing. They focus a
    lot on security issues, focus a lot on issues dealing with
    servers around the country, around the world really looking
    for, I guess, attacks, aberrations in terms of what is
    happening to their systems. And it was an interesting point
    that they made. They had said something to me to the effect of
    we no longer are just assuming that we will be able to prevent
    and keep out these attacks, but we have to assume that the
    attacks have been made, that somebody has made it inside. And
    now we are just trying to figure out how to keep them out of
    everything else and I guess cordon them off, so to speak, into
    an area where it does no harm.
        Do you think that is an accurate way to look at the world
    of technology today, Dr. Romine?
        Dr. Romine. I think in most conversations with
    cybersecurity professionals, you will find that there is no
    discussion that we will be 100 percent successful at keeping
    people out of our systems. And so what I think has to happen is
    an understanding of sort of where the crown jewels are
    regardless of, whether you are the Federal Government or
    whether private sector, what sector that you are in, and then
    seek additional steps to ensure that the very serious--whether
    it is proprietary information, whether it is personally
    identifiable information, those kinds of assets have to have
    special protection.
        Senator Gardner. And obviously, you do a lot of work at the
    NIST lab, whether it is NTIA work, telecommunications work, the
    atomic clock, things like GPS, and other issues. And this
    Framework which you believe is and will always be voluntary--is
    that correct?
        Dr. Romine. Yes, sir.
        Senator Gardner. The other question I have is if you have
    this Framework, you have set this Framework up, you have
    agreement, how do you define success. What is success 5 years
    out from now with the Framework in place?
        Dr. Romine. I think one of the perhaps useful analogies
    here is if you take a look at the evolution of safety programs
    in the private sector, for example, they initiated with let us
    do the following things. This is a checklist of things in order
    to ensure that we are trying to have a safe environment. And
    that was sort of all you did.
        Over the course of decades I think, there has been a move
    from that to baking safety into everything that you do
    operationally, and I think the same thing is going to happen
    here. The culture is going to change. One year into the
    Framework, we are not expecting a complete culture shift, but
    we are seeing signs that the conversations that need to take
    place between suppliers and between components of an
    organization and the executives--those conversations are taking
    place or beginning to take place. So I think the more pervasive
    that becomes, I think the more we have confidence that people
    are taking seriously the need to secure their networks and
    their systems and information.
        Senator Gardner. Ms. Beauchesne and perhaps Mr. England
    might be able to address the next question. Ms. Beauchesne, in
    your testimony you talked about making incentives work. You
    talked about liability issues. You talked about leveraging
    Federal procurements, making research and development tax
    credit permanent, those kinds of things. Are there currently
    private sector incentives to achieve these cybersecurity needs
    and making sure that we are bolstering and doing everything we
    can to prevent attacks or vulnerabilities?
        And I guess what I mean by that is this. Is simply the cost
    of an attack so great that that provides the incentive? Are
    banks that are looking to make loans to companies looking at
    cybersecurity and saying we believe that you present too much
    of a risk for us to make a loan and therefore the interest rate
    is going to be higher or lower because you have done such a
    good job. Are there ISO ratings that you could look at and say
    this is a NIST standard of security that we believe is
    necessary in order to people to carry out their function
    without risk?
        Ms. Beauchesne. I think what you said is right. They want
    to do the right thing--right--because the risks are so high,
    the costs of doing business. They have to do the right thing.
        But the other piece of that I think is we need to look at
    especially the small and medium-sized companies that are being
    attacked by nation states. I mean, that is costly to protect
    against. The Framework is not going to do that. If we had every
    company in the country adopt the Framework, that still would
    not prevent the Chinese or the Russians or whomever from
    attacking our companies. So I do think incentives are out
    there.
        That is not our biggest push, if you will. I mean, we want
    the information sharing legislation. Incentives exist. We are
    looking at the Safety Act. We are looking at insurance. But the
    bottom line is we want the Framework to remain flexible, non-
    regulatory, and let us get that information sharing piece done.
        Senator Gardner. And are you satisfied, Dr. Romine--in my
    question and answer that it will remain voluntary. Are you
    satisfied with that?
        Ms. Beauchesne. From everything I hear, yes.
        Senator Gardner. Mr. England?
        Mr. England. I mean, in terms of incentives, we do not
    really look into the equation in terms of what the cost of a
    breach might be because with the size of our business as a
    small business, our costs are far greater. If we have breaches
    that displace the trust of our customers and the people that we
    connect to, our ability to continue as a going concern for a
    business is what our risk is. So the incentives are there
    because there is an inherent business imperative to do it.
        And it is one of the reasons why I have been a big
    proponent of the Framework and the voluntary nature of it
    because when you start throwing into it some of these regulated
    pieces--as Ms. Beauchesne mentioned, the threat is ever-
    evolving, and so we have to have a tool and a mechanism that is
    ever-evolving as well and allow for adaptation as we go because
    the problem with the regulation side of it--and, of course, it
    depends on how it is written, but it is not a I go through
    this, I determine that I have met some minimum standard or
    minimum requirement, and I am done because you will never be
    done.
        And so for us, our incentive actually is to be here today
    and to petition against the regulation because, to be quite
    honest with you, anything that would be regulated as minimum
    standard requirements is not going to be enough. And so we are
    going to have to do our own activities above and beyond that
    anyway in order to maintain our systems the way that we want.
    And so what is going to happen is it is actually going to be
    more costly for us to implement cybersecurity activities in our
    organization because we are following a dual track, what the
    regulating body wants and what the market demands.
        Senator Gardner. Thank you.
        Thank you, Mr. Chairman.
        The Chairman. Thank you, Senator Gardner.
        Senator Blumenthal?

                 STATEMENT OF HON. RICHARD BLUMENTHAL,
                     U.S. SENATOR FROM CONNECTICUT

        Senator Blumenthal. Thank you, Mr. Chairman, and thank you
    for holding this hearing and making it a priority because, as
    we know on both sides of the aisle and as one of our military
    leaders has said, and I am sure it has been repeated here, that
    the next Pearl Harbor may well be a cyber attack. Sony was
    certainly a sign that we ignore, at our grave peril, that a
    cyberattack may be the method of choice for aggressors who mean
    to do harm to our country.
        And my view is that we are patently vulnerable at the
    moment, and I think the testimony this morning has reinforced
    my view that this Nation must do better. We are susceptible now
    by choice. It is not an accident. It is not something that we
    cannot anticipate. It is by choice that we are, in effect,
    failing to address this peril before it hits us. And I believe
    there needs to be greater Government direction and legislative
    involvement.
        For the moment the best and most immediate response is for
    the private sector to do more with the encouragement and
    incentives that Government can provide. And as you know, as
    directed by the Government's Executive Order on Cybersecurity,
    the Secretaries of Homeland Security, Commerce, and Treasury
    were required to provide a report to the White House on how the
    Government can best provide those kinds of incentives to
    participate in the Framework, especially for smaller
    businesses.
        And I am very concerned about the impact on smaller
    businesses because the effect on a Sony eventually becomes an
    effect on smaller businesses; just as the effect on a defense
    contractor becomes an effect on the suppliers and components
    makers and so forth that we see in manufacturing submarines or
    the Joint Strike Fighter or helicopters, which we make in
    Connecticut. So I am interested in what progress has been made
    in developing better incentives.
        Dr. Lewis, as you alluded to in your testimony, it appears
    there may have been a lack of incentives on the part of many
    companies to make the right decisions about cybersecurity. So
    let me ask you. What were your thoughts on the recommended
    incentives that agencies made to the President following the
    executive order? Did any of these ideas particularly impress
    you as being effective?
        Dr. Lewis. Thank you for the question.
        I would note in general that I think this program will
    remain voluntary until there are too many incidents to ignore.
    And we are approaching that. We have got a lot of people who do
    not like us out there in the world, and they are very active in
    cyberspace because it is so easy.
        The problem with the incentives is really it has to be
    legislation. It has to be the Congress that creates incentives
    because incentives are either regulatory relief, tax relief, or
    some kind of money. And if you do not have those three things,
    it really is not that much of an incentive. It is not enough.
        Senator Blumenthal. So, in effect, what I hear you saying
    is that the President's executive order will be a nullity
    unless the Congress acts.
        Dr. Lewis. I think that legislation of some kind is
    necessary. I think the White House decided in 2012 to move
    ahead because of the problems then with legislation, but I know
    that they would probably welcome adequate legislation that
    would strengthen authorities and create incentives such as
    liability protection.
        Senator Blumenthal. So at a time when, rightly or wrongly,
    there has been criticism of the President for, in effect,
    usurping authority through executive order, here is an area
    where clearly legislation is necessary to accomplish the goals
    that we all believe are absolutely requisite at this point in
    our history.
        Dr. Lewis. Having followed the development of the executive
    order pretty closely, I think that everyone would agree that
    this is an area where Congress has to take the lead. Congress
    has to legislate.
        Senator Blumenthal. Dr. Romine, let me ask you in the time
    I have remaining. One idea that has been discussed is that
    Federal agencies develop a ``certificate of compliance'' or
    some other sort of identifier much like the Energy Star system,
    which is in a way a seal of approval to recognize the companies
    that are proven to be observing guidelines laid out in the NIST
    Framework.
        How could NIST be helpful in a process like that one? Do
    you think there is anything that would prevent NIST from
    working with Federal agencies to provide some certificate of
    compliance, which would be a strong incentive or encouragement
    for companies, in effect, to protect themselves more
    adequately?
        Dr. Romine. Thank you, Senator.
        I am not sure that having NIST play both the role of
    participating in partnership with the private sector and then
    coming behind and doing some sort of an audit would preserve
    our ability to work collaboratively with those folks.
        The other thing I will say with regard to incentives,
    although some of the discussion has surrounded incentives where
    there are market failures, I think we also have to recognize
    the inherent market incentives that are being made evident. One
    is, of course, managing the overall risk, in particular your
    reputational risk, and there have been companies that have been
    singled out here as victims of hacking, and that is problematic
    for them. When you become known in that way, it is a serious
    reputational risk, and I think there are some incentives to
    avoid that.
        The other incentives involve the burgeoning development of
    the insurance industry, cybersecurity insurance that is
    beginning to be underpinned by some of the work that went into
    the Framework.
        Senator Blumenthal. Well, I would just say in closing--and
    my time has expired--they paid a price, a reputational price,
    as well as enormous costs to their business, whether it is
    Target or Sony, and some of the individuals have paid a
    personal price, individuals in command of the companies. But
    that price all too often is one that is shared among innocent
    parties, companies that are linked to that one, consumers who
    pay a higher price whether it is through insurance or the
    charges that are passed on. So eventually failure to protect
    themselves has a cost that is societal and economic spread
    broadly throughout the Nation and that is why we are here
    today.
        Thank you, Mr. Chairman.
        The Chairman. Thank you, Senator Blumenthal.
        I am going to ask a couple of quick questions here. I think
    everybody else--unless we check with my colleagues here if they
    want to have a second round.
        Dr. Romine, NIST also plays a role in certain technical
    aspects of information sharing under its existing FISMA
    statutory authority. The NIST draft guide to cyber threat
    information sharing released recently provides guidance for an
    organization's coordinated computer security incident handling.
        So question number one is, what feedback has NIST received
    from stakeholders regarding the guide and how will the final
    version recognize the different approaches for cyber threat
    information sharing being used in the public and private
    sectors?
        Dr. Romine. Thank you, Mr. Chairman.
        The release of Special Publication 800-150, which you refer
    to, has gotten a lot of feedback. The feedback has been robust.
    The time for feedback I think closed just this past November,
    and we are dispositioning those comments now.
        I think it is important to note that again the guidance
    that we have provided is technology agnostic. We talk about
    various different approaches. Our role, as you correctly
    pointed out, is the sort of standards for the kind of
    information exchange that is envisioned, this information
    sharing.
        And it is important to point out we want to ensure that
    that information sharing is done in a way that is standard and
    interoperable principally because we want to have computers be
    able to ingest that information and act on it in sort of
    network speed instead of just sharing information. I think
    sometimes people talk about information sharing currently as
    being phone calls from network operators that happen to know
    each other, and I think we want to get well beyond that into a
    much more integrated approach.
        The Chairman. Do you believe NIST ought to have a role in
    providing additional guidance on cyber threat information
    sharing by non-Federal entities?
        Dr. Romine. I think we are very comfortable with the role
    that we have today, the standards and guidelines and best
    practices for information sharing, as well as the work that we
    have done to underpin security automation, which is what I
    alluded to just now.
        With regard to the private sector, I think that is much
    more of a policy issue and something I do not think would be
    necessarily appropriate for us to engage in.
        The Chairman. You mentioned in your testimony that tech
    companies have been developing products and services aligned
    with the Framework. Are there any examples of those types of
    products and services you can share with us?
        Dr. Romine. I could do that. I am not prepared to do it
    today, but I am happy to provide the Committee with some of
    these products and services that are beginning to be developed.
        The Chairman. Senator Gardner, anything else? All right.
        Well, we have got a few things. We will keep the hearing
    record open for a couple weeks for members to submit any
    additional questions for the record, and I will probably have a
    few of those myself.
        But I appreciate very much the great job of our panel
    today. Thank you not only for your remarks but also for your
    responses to our questions. It is an issue of great importance
    on so many levels to our country, and it is important that we
    get it right. Your expertise and counsel will be very important
    in helping shape the decisions that we make here. So thank you
    for that.
        And with that, this hearing is adjourned.
        [Whereupon, at 11:46 a.m., the hearing was adjourned.]

                                A P P E N D I X

     Prepared Statement of Joshua J. Pauli, Ph.D., Associate Professor of
                    Cyber Security, Dakota State University

      On Implementation of S. 1353: Cybersecurity Enhancement Act of 2014

        It is with great honor that I submit this testimony in support of
    the Cybersecurity Enhancement Act of 2014 and to share my professional
    opinion on how to best implement specific portions of the Act. As one
    of the lead cybersecurity faculty members at Dakota State University
    (DSU) in Madison, SD, I am deeply interested and invested in any
    legislation that affects the future of cybersecurity education. Dakota
    State University (DSU) is one of the leading institutions of higher
    education in the Nation in the area of cybersecurity, where we are
    designated as one of only 13 institutions in the Nation as a National
    Security Agency (NSA) Center of Academic Excellence (CAE) in Cyber
    Operations. The NSA and Department of Homeland Security (DHS) have also
    designate DSU as a CAE in Information Assurance Education and a CAE in
    Information Assurance Research. We currently have over 500 students
    studying cyber security at the bachelors, masters, and doctorate level.
        Assisting Senator Thune's office during the last 18 months on this
    piece of legislation has given me an opportunity to see the detailed
    goals, proposed implementation, and intended outcomes of this Act come
    into focus. Now that the Act has been signed into law, it is critical
    that we identify the most appropriate ways to ensure the success of the
    legislation. The most applicable way to ensure the level of success
    that we all hope for is to leverage existing mechanisms and models that
    have a proven track record of success as much as we can. This will
    ensure we don't ``reinvent the wheel'', and instead provide funding and
    support to programs that we already trust and are currently reaping the
    benefits from.
        One example of this in this Act is the inclusion, by name, of the
    National Science Foundation's Scholarship for Service (NSF-SFS)
    CyberCorps program in Section 302. The positive outcomes from this NSF
    program cannot be argued and there is certainly universal support for
    the continued and expanded support of it. As the Primary Investigator
    for DSU's NSF-SFS CyberCorps program, I can provide firsthand evidence
    of the success of the program as many of my colleagues around the
    Nation at other NSF-SFS CyberCorps institutions would as well. It is
    one of the driving forces in making DSU a cybersecurity leader in
    higher education. I applaud you for its inclusion in the Act and
    encourage you to continue to increase its funding level in future
    years, as it's truly a ``best bang for buck''.
        Along these lines, I would like call your attention to TITLE III--
    EDUCATION AND WORKFORCE DEVELOPMENT and specifically SEC. 301.
    CYBERSECURITY COMPETITIONS AND CHALLENGES. Creating and holding
    cybersecurity competitions and challenges that help identify the next
    wave of cyber professionals are activities that have long been
    conducted by colleges and universities in partnership with NSF, DHS,
    NSA, and others. One current Federal program that fits perfectly with
    this goal of the Act is NSA's Center of Academic Excellence in Cyber
    Operations that started in 2012. This designation program aims to
    partner with institutions of higher education around the Nation that
    have academic degree programs that match, almost verbatim, to the (d)
    Areas of Skill included in the Act:

      (1)  ethical hacking;

      (2)  penetration testing;

      (3)  vulnerability assessment;

      (4)  continuity of system operations;

      (5)  security in design;

      (6)  cyber forensics;

      (7)  offensive and defensive cyber operations;

        The NSA's CAE in Cyber Operations program can help implement
    curriculum, competitions, workshops, and related assistance in these
    exact seven areas. Without a doubt, any educational efforts dedicated
    to these areas should not only include this NSA program, but I strongly
    encourage you to have the NSA lead any efforts related to these
    specific areas of skill. By doing so, you're not only directly
    leveraging the NSA's knowledge and expertise, but more importantly, you
    would then have a direct pathway to the designated institutions across
    the Nation that are already working in this exact domain. The NSA and
    these 13 institutions already have a working structure and model to
    take on these type of projects and deliver them back out to the greater
    community in a timely and cost-effective manner.
        Section 301 also includes (b) Participation that includes (1)
    students enrolled in grades 9 through 12. This is another perfect match
    for an already existing program that I would strongly urge you to make
    use of as you implement this Act. The NSA created the GenCyber
    (``Generation Cyber'') Summer Camp program in 2013 through a
    partnership with NSF to create a series of summer camps aimed at high
    school students and high school teachers held on college and university
    campuses. Summer 2014 was the first year of these camps and there were
    six very successful camps. DSU held a camp for 172 high school students
    that were interested in learning more about cybersecurity. 2015 will
    include 20-25 camps across the Nation and the NSA has a vision to
    expand GenCyber to be 200+ camps in the coming years in the same way
    that the ``Star Talk'' Summer Camps for linguistics has grown and
    prospered across the Nation (https://startalk.umd.edu). Providing
    support to NSA for GenCyber would be a very wise investment in our
    children's future as it's critical we continue to get this age group
    interested in cybersecurity and GenCyber is already two years down this
    path. Supporting NSA's GenCyber will support not the NSA's goals for
    this project, but also the GenCyber institutions that are holding
    camps, and the thousands of high school students that will soon be
    taking part in these summer experiences. GenCyber has the real
    potential to change how and when high school students are exposed to
    cybersecurity education, which is critical as we try to fill the
    pipeline of exceptional cybersecurity talent.
        While there will certainly be new programs and partners involved
    with the implementation of the Act, it is critical that we look to our
    trusted partners, as you already done with NSF-SFS CyberCorps, that we
    know will do a tremendous job and deserve additional support to
    continue the necessary work in cybersecurity education. The NSA's
    Center of Academic Excellence in Cyber Operations and GenCyber Summer
    Camp programs are exactly the type of cybersecurity education partners
    that deserve direct support as this Act is implemented.
        I welcome the chance to provide additional guidance and feedback on
    S.1353 as it has the potential to help mature cybersecurity education a
    great deal across the Nation.
                                     ______

                                              Intel Corporation
                                      Washington, DC, February 18, 2014

    Hon. John Thune,
    Chairman,
    United States Senate ,
    Committee on Commerce, Science, and Transportation,
    Washington, DC.

    Hon. Bill Nelson,
    Ranking Member,
    United States Senate,
    Committee on Commerce, Science, and Transportation,
    Washington, DC.

    Re: Senate Commerce, Science, and Transportation Committee Hearing,
                ``Building a More Secure Cyber Future: Examining Private
                Sector Experience with the NIST Framework''

    Dear Chairman Thune and Ranking Member Nelson:

        Intel Corporation commends you for holding a full committee hearing
    on February 4, 2015, ``Building a More Secure Cyber Future: Examining
    Private Sector Experience with the NIST Framework,'' and we thank you
    for the opportunity to submit written testimony for the record.
        We appreciate the Committee's attention to cybersecurity--advancing
    cybersecurity across the global digital infrastructure has long been a
    priority for Intel as well. Indeed, security, along with power-
    efficient performance and connectivity, comprise the three computing
    pillars around which Intel concentrates our innovation efforts, and
    Intel has long shared the sentiment that we cannot delay in
    collectively addressing the evolving cybersecurity threats facing us
    all. Our commitment to cybersecurity has extended to the Framework for
    Improving Critical Infrastructure Cybersecurity (the ``Framework''),
    from its inception through its early implementation. President Obama
    issued Executive Order 13636--Improving Critical Infrastructure
    Cybersecurity, in February 2013, and over the ensuing year Intel
    collaborated with government and industry stakeholders to develop the
    Framework. The first version of the Framework was delivered on February
    12, 2014, and soon thereafter Intel launched a pilot project to test
    the Framework's use at Intel.
        Intel's pilot project assessed cybersecurity risk for our Office
    and Enterprise infrastructure, and demonstrated that the Framework
    provided clear benefit to Intel. We focused on developing a use case
    that would create a common language and encourage the use of the
    Framework as a process and risk management tool, rather than as a set
    of static compliance requirements. Our early experience with the
    Framework helped us harmonize our risk management technologies and
    language, improve our visibility into Intel's risk landscape, inform
    risk tolerance discussions across our company, and enhance our ability
    to set security priorities, develop budgets, and deploy security
    solutions. The pilot resulted in a set of reusable tools and best
    practices for utilizing the Framework to assess infrastructure risk; we
    plan to use these tools and best practices to expand Intel's use of the
    Framework. It is our hope that other organizations follow the path we
    forged in demonstrating the value of the Framework when it is put in
    action, by developing their own Framework use cases and driving
    adoption of the Framework. A detailed account of our pilot project and
    the benefits we derived from using the Framework is contained in the
    attached white paper, The Cybersecurity Framework in Action: An Intel
    Use Case, which we respectfully attach for the record.
        Thank you again for devoting your Committee's resources to
    addressing our cybersecurity challenges, and for providing oversight
    over the Framework. The Framework embodies a longstanding pillar of
    Intel's cybersecurity strategy: supporting collaboration between
    government, industry, and non-governmental organization stakeholders to
    improve cybersecurity in a way that promotes innovation, protects
    citizens' privacy and civil liberties, and preserves the promise of the
    Internet as a driver of global economic development and social
    interaction. We look forward to collaborating with the Committee to
    achieve our mutual goals moving forward. For more information, please
    contact John Miller.
                Best regards,
                                            Peter M. Cleveland,
                                                        Vice President,
                                                Global Public Policy Group.
                                   Attachment

    [GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]

                                     ______

                            Retail Industry Leaders Association
                                        Arlington, VA, February 4, 2015

    Hon. John Thune,
    Chairman,
    Senate Committee on Commerce, Science, and Transportation,
    United States Senate,
    Washington, DC.

    Hon. Bill Nelson,
    Ranking Member,
    Senate Committee on Commerce, Science, and Transportation,
    United States Senate,
    Washington, DC.

    Dear Chairman Thune and Ranking Member Nelson:

        On behalf of the Retail Industry Leaders Association (RILA), I
    write to thank you for holding today's hearing entitled, ``Building a
    More Secure Cyber Future: Examining Private Sector Experience with the
    NIST Framework.'' Retailers greatly appreciate the Committee's
    leadership in seeking to find a sensible path to address critical
    cybersecurity issues.
        RILA is the trade association of the world's largest and most
    innovative retail companies. RILA members include more than 200
    retailers, product manufacturers, and service suppliers, which together
    are responsible for more than $1.5 trillion in annual sales, millions
    of American jobs and more than 100,000 stores, manufacturing facilities
    and distribution centers domestically and abroad.
        Retailers embrace innovative technology to provide American
    consumers with unparalleled services and products online, through
    mobile applications, and in our stores. While technology presents great
    opportunity, nation states, criminal organizations, and other bad
    actors also are using it to attack businesses, institutions, and
    governments. As we have seen, no organization is immune from attacks
    and no security system is invulnerable. Retailers understand that
    defense against cyber-attacks must be an ongoing effort, evolving to
    address the changing nature of the threat. RILA is committed to working
    with Congress to give government and retailers the tools necessary to
    thwart this unprecedented attack on the United States (U.S.) economy
    and bring the fight to cybercriminals around the globe.
        As leaders in the retail community, we are taking new and
    significant steps to enhance cybersecurity throughout the industry. To
    that end, RILA formed the Retail Cyber Intelligence Sharing Center (R-
    CISC) in 2014 in partnership with America's most recognized retailers.
    The Center has opened a steady flow of information sharing between
    retailers, law enforcement and other relevant stakeholders. These
    efforts already have helped prevent data breaches, protected millions
    of American customers and saved retailers millions of dollars. The R-
    CISC is open to all retailers regardless of their membership in RILA.
        For years, RILA members have been developing and deploying new
    technologies to achieve pioneering levels of security and service. The
    cyber-attacks that our industry faces change every day and our members
    are building layered and resilient systems to meet these threats. Key
    to this effort is the ability to design systems to meet actual threats
    rather than potentially outdated cybersecurity standards that may be
    enshrined in law. That is why development of any technical
    cybersecurity standards beyond a mandate for reasonable security must
    be voluntary and industry-led such as the standards embodied in the
    National Institute of Standards and Technology Cybersecurity Framework.
    RILA members using the Framework have found it to be a helpful tool in
    evaluating their cybersecurity posture and support the continued use of
    voluntary, industry-led processes as a key method of addressing dynamic
    technology challenges.
        One area of cybersecurity that needs immediate attention is payment
    card technology. RILA members have long supported the adoption of
    stronger debit and credit card security protections. The woefully
    outdated magnetic stripe technology used on cards today is the chief
    vulnerability in the payments ecosystem. This 1960s era technology
    allows cyber criminals to create counterfeit cards and commit fraud
    with ease. Retailers continue to press banks and card networks to
    provide U.S. consumers with the same Chip and PIN technology that has
    proven to dramatically reduce fraud when it has been deployed elsewhere
    around the world. According to the Federal Reserve, PINs on debit cards
    make them 700 percent more secure than transactions authorized by
    signature.\1\
    ---------------------------------------------------------------------------
        \1\ Federal Reserve, ``2011 Interchange Fee Revenue, Covers Issuer
    Costs, and Covered Issuer and Merchant Fraud Losses Related to Debit
    Card Transactions,'' (March 5, 2013).
    ---------------------------------------------------------------------------
        Increasing cyber threat information sharing is also vital to
    defeating sophisticated and coordinated cyber actors. RILA strongly
    supports cybersecurity information sharing legislation that provides
    liability protections for participating organizations. Legislation also
    should increase funding for government sponsored research into next
    generation security controls and enhance law enforcement capabilities
    to investigate and prosecute criminals internationally. The cyber-
    attacks faced by every sector of our economy constitute a grave
    national security threat that should be addressed from all angles.
        RILA thanks the Committee for holding this important hearing to
    look into the positive private sector experience with the NIST
    Cybersecurity Framework, cyber information sharing legislation, and
    cybersecurity more broadly. We look forward to working with you on
    these vital issues. Should you have any additional questions regarding
    this matter, please feel free to contact Nicholas Ahrens, Vice
    President, Privacy and Cybersecurity.
                Sincerely,
                                          Jennifer M. Safavian,
                          Executive Vice President, Government Affairs.
                                     ______

     Prepared Statement of Independent Community Bankers of America (ICBA)

                 Cybersecurity: The Community Bank Perspective

        On behalf of the more than 6,500 community banks represented by
    ICBA, thank you for convening today's hearing on ``Building a More
    Secure Cyber Future: Examining Private Sector Experience with the NIST
    Framework.'' The financial services industry and community banks are
    typically on the front lines of defending against cybersecurity threats
    and take their role in securing data and personal information very
    seriously. ICBA is pleased to take this opportunity to submit the
    following statement for the record which sets forth the community bank
    perspective on cybersecurity and the National Institute for Standards
    and Technology (NIST) framework.
        All Critical Infrastructure Sectors Must Be Covered and Existing
    Mandates Must Be Recognized. ICBA supports the 2013 Executive Order and
    the NIST framework implementing it because they create a baseline to
    reduce cyber risk to all critical infrastructure sectors. This is a
    critical test for any new legislation, frameworks, or standards in the
    area of data security: It should extend comparable standards to all
    critical infrastructure sectors, including the commercial facilities
    sector which incorporates the retail industry and other potentially
    vulnerable entities. Financial institutions have long been subject to
    rigorous and effective data security protocols established by the
    Gramm-Leach-Bliley Act. Any new data security mandates must recognize
    the existing standards and practices community banks observe to protect
    the confidentiality and integrity of customer personal data as well as
    to mitigate cyber threats.
        Threat Information Sharing is Critical. ICBA supports the sharing
    of advanced threat and attack data between Federal agencies and the
    appropriate financial sector participants, including community banks.
    Community banks rely on this critical information to help them manage
    their cyber threats and protect their systems. ICBA supports community
    banks' involvement with services such as the Financial Services
    Information Sharing and Analysis Center (FS-ISAC). The FS-ISAC is a
    non-profit, information-sharing forum established by financial services
    industry participants to facilitate the public and private sectors'
    sharing of physical and cybersecurity threat and vulnerability
    information. ICBA also supports FS-ISAC efforts to take complex threat
    information across communities, people and devices and analyze,
    prioritize, and route it to users in real-time as long as those efforts
    incorporate community banks and such advancements are cost effective to
    community banks.
        Regulators Should Recognize Third Party Risk. Community banks
    significantly rely on third parties to support their systems and
    business activities. While community banks are diligent in their
    management of third parties, mitigating sophisticated cyber threats to
    these third parties, especially when they have connections to other
    institutions and servicers, can be challenging. Regulators must be
    aware of the significant interconnectivity of these third parties and
    must collaborate with them to mitigate this risk. This can be done by
    agencies evaluating the concentration risks of service providers to
    financial institutions, and broadening supervision of technology
    service providers to include more core, IT service providers by
    expanding the Multi-Regional Data Processing Servicer Program (MDPS) to
    include such providers.
        Properly Aligned Incentives Will Enhance Data Security and
    Cybersecurity. When an entity's systems are breached, it is critical
    that the party that incurs the breach, whether it be a retailer,
    financial institution, data processor or other entity, bear
    responsibility for the related fraud losses and costs of mitigation.
    Allocating financial responsibility with the party that incurs the
    breach will provide a strong incentive for all parties to effectively
    secure data.
        Additionally, aligning incentives to maximize data security and
    cybersecurity by all parties that process and/or store consumer data
    will make the payments system stronger over time.
        Thank you again for convening today's hearing. ICBA looks forward
    to working with the Senate Committee on Commerce, Science, and
    Transportation to improve cybersecurity.
                                     ______

         Response to Written Questions Submitted by Hon. John Thune to
                             Dr. Charles H. Romine
        Question 1. Dr. Romine, in follow up to my question at the hearing,
    please provide for the record examples of products and services that
    the private sector is developing to support use of the Framework.
        Answer. A variety of products and services have been developed by
    the private sector, including, but not limited to, implementation
    guides, mappings to the Framework, case studies, educational materials,
    example profiles, and other document templates. Recently, NIST added an
    ``Industry Resources'' link to the Cybersecurity Framework website
    (www.nist.gov/cyberframework) which is a non-exhaustive list of these
    resources to share for broader use.
        It is important to note that in doing this certain commercial
    entities, equipment, or materials may be identified in this Website or
    linked websites in order to support Framework understanding and use.
    Such identification is not intended to imply recommendation or
    endorsement by NIST, nor is it intended to imply that the entities,
    materials, or equipment are necessarily the best available for the
    purpose.

        Question 2. In response to my question, you testified briefly
    regarding the feedback NIST has received in its draft Guide to Cyber
    Threat Information Sharing. NIST also has identified automated
    indicator sharing as one of the areas for development, alignment, and
    collaboration in its Roadmap for Improving Critical Infrastructure
    Cybersecurity released on February 12, 2014. Would you please elaborate
    on NIST's work to develop technical standards for information sharing,
    including machine-to-machine sharing, for use in both the public and
    private sectors?
        Answer. While the NIST draft Special Publication 800-150, Guide to
    Cyber Threat Information Sharing, provides high-level guidance on how
    to form, join, and effectively participate in information sharing
    communities, NIST has also participated in, and led significant
    initiatives to develop technical standards for information sharing.
    NIST's Security Content Automation Protocol (SCAP) specifications
    provide low-level technical guidance in support of automated
    information exchange. SCAP is a suite of interoperable open technical
    specifications, developed through ongoing public-private collaboration,
    that enable automated, machine-to-machine exchange of information.
    SCAP-validated tools can be used to evaluate the security posture of an
    IT system. SCAP is used to describe known security vulnerabilities,
    identify configuration issues, and to collect system artifacts that can
    attest to the system's current security state and to develop and
    publish indicators.
        In addition to our role in the development of the SCAP
    specifications, NIST operates the National Vulnerability Database
    (NVD), the U.S. government repository of SCAP content. The NVD
    repository includes information regarding over 68,000 known software
    flaws, 281 security checklists that provide security configuration
    guidance for operating systems and applications, and over 101,000
    product names and identifiers. The NVD-hosted SCAP content and
    resources are widely used by both public and private sector
    organizations, including many commercial anti-virus software
    developers.
        NIST continues to engage with both the private sector and Federal
    departments and agencies to help develop and refine technical
    specifications that enable the near-real-time exchange of cyber threat
    indicators. Through its participation in consensus-driven standards
    development efforts, such as the International Organization for
    Standardization's (ISO) Joint Technical Committee 1 (JTC1), NIST is
    able to help advance the development of technical specifications that
    enable the creation, use, and automated exchange of indicator data.

        Question 3. In addition to automated indicator sharing, NIST
    identified a number of additional areas for development, alignment, and
    collaboration in its Roadmap for Improving Critical Infrastructure
    Cybersecurity, released on February 12, 2014. Subsequently, on December
    5, 2014, NIST released an update reflecting the responses and feedback
    received in response to its August 26, 2014, Request for Information.
    Please provide an update on NIST's role, current status, and path
    forward to address each of the following areas: authentication,
    conformity assessment, cybersecurity workforce, data analytics, Federal
    agency cybersecurity alignment, supply chain risk management, and
    technical privacy standards.
        Answer. NIST's role in cybersecurity is to develop information
    security standards, guidelines, tests, and metrics to protect non-
    national security Federal information, systems, and services against
    threats impacting their confidentiality, integrity and availability, by
    conducting research that generates the data needed to support these
    tools. As part of this mission, NIST facilitates and plays an active
    role in the development of voluntary, industry-led cybersecurity
    standards and best practices. NIST accomplishes its mission in
    cybersecurity through collaborative partnerships with our customers and
    stakeholders in industry, government, academia, standards organizations
    and international partners.
        The Roadmap for Improving Critical Infrastructure Cybersecurity
    highlighted several areas identified by stakeholders that require
    continued focus; they are important but evolving areas that have yet to
    be developed or need further research and understanding. While tools,
    methodologies, and standards exist for some of the areas, they need to
    become more mature, available, and widely adopted. NIST continues to
    work with stakeholders in each of these areas to identify primary
    challenges, solicit input to address those identified needs, and
    collaboratively develop and execute action plans for addressing them.
    NIST is actively engaging with diverse stakeholders through existing
    programs, including the National Strategy for Trusted Identities in
    Cyberspace (NSTIC) and the National Initiative for Cybersecurity
    Education (NICE), to identify primary challenges, solicit input, and
    develop and execute plans to address those identified needs in each of
    the areas identified in the roadmap.

        Question 4. The U.S. Chamber of Commerce has noted that standards
    are most effective when developed and recognized globally, which can
    help to prevent the burden of multiple, conflicting jurisdictional
    requirements. The Cybersecurity Enhancement Act (Public Law 113-274)
    recognized NIST's convening role in international standards development
    and required NIST to consult with foreign governments and international
    organizations to support the Framework development process. Please
    elaborate on the importance of global alignment in cybersecurity and
    how NIST has worked with international organizations to promote the
    Framework and the public-private partnership model overseas.
        Answer. Pursuant to U.S. law and Administration policy, Federal
    agencies are required to use voluntary consensus standards in their
    procurement and regulatory activities, except where inconsistent with
    law or otherwise impractical. The U.S. consensus standardization
    community is comprised mostly of non-governmental standards developers.
    These groups are primarily shaped by extensive industry participation
    and are market driven. U.S. government participation is motivated by
    the need to achieve cost-efficient, timely and effective solutions to
    regulatory, procurement and policy objectives. These diverse
    motivations are mutually beneficial.
        Meanwhile, many governments are proposing and enacting strategies,
    policies, laws, and regulations covering information technology for
    critical infrastructure. Because many organizations and most sectors
    operate globally or rely on the global digital infrastructure, these
    requirements are affecting, or may affect, how organizations operate,
    conduct business, and develop new products and services. Diverse or
    specialized requirements that vary by country or region, can impede
    interoperability, result in duplication, harm cybersecurity, and hinder
    innovation. In turn, this can significantly reduce the availability and
    use of innovative technologies to critical infrastructures in all
    industries and hamper the ability of organizations to operate globally
    and to effectively manage new and evolving risks.
        Because the Framework references globally accepted standards,
    guidelines and practice, organizations domiciled inside and outside of
    the United States can use the Framework to efficiently operate globally
    and manage new and evolving risks.
        During the development of the Framework and since its completion,
    NIST has engaged with foreign governments and private sector entities
    to explain the Framework and seek alignment of approaches when
    possible; worked with industry stakeholders to support their
    international engagement; and exchanged information with standards
    developing organizations, and the public and private sectors to ensure
    the Cybersecurity Framework remains aligned and compatible with
    existing and developing standards and practices.

        Question 5. How has NIST worked with insurance companies in
    particular in developing the Framework? How do insurance policies
    provide an incentive for companies to increase their cybersecurity?
        Answer. During the development of the Framework, NIST sought the
    participation of insurance companies, given their extensive knowledge
    of the effectiveness of specific cybersecurity practices and their
    ability to help evaluate specific proposed elements from this
    perspective. This collaboration included a panel at the 4th
    Cybersecurity Framework Workshop in Dallas, Texas, where panelists from
    AIG, ACE USA, Willis, and Lockton answered questions from the audience,
    and discussed the current state of the cybersecurity insurance market,
    how the Cybersecurity Framework could help insurance carriers grow the
    first-party market and be incorporated into underwriting/brokering
    processes, and anticipated challenges that may arise. According to the
    Department of Homeland Security--who NIST has partnered with on
    projects relating to cybersecurity insurance industry: ``A robust
    cybersecurity insurance market could help reduce the number of
    successful cyber attacks by: (1) promoting the adoption of preventative
    measures in return for more coverage; and (2) encouraging the
    implementation of best practices by basing premiums on an insured's
    level of self-protection.'' \1\
    ---------------------------------------------------------------------------
        \1\ http://www.dhs.gov/publication/cybersecurity-insurance
    ---------------------------------------------------------------------------
        As industry continues to use the Framework, and insurance companies
    leverage the Framework to provide policies and services, NIST will
    continue to work with them to understand their specific implementations
    and how it could inform future work.
                                     ______

          Response to Written Question Submitted by Hon. Roy Blunt to
                             Dr. Charles H. Romine
        Question. The Framework itself is voluntary and based upon a risk
    management model, as opposed to compliance with rote standards.
    Wouldn't the concept of a mandatory survey be counter to the voluntary
    approach adopted by NIST, and could it impact the use of the Framework
    if private sector owners and operators of critical infrastructure view
    using the Framework as being linked to new reporting requirements?
    Please provide your perspective on the mandatory survey proposal.
        Answer. NIST believes that a mandatory survey would be premature
    and will not provide meaningful results to help determine the adoption
    of the Framework. Adding a mandatory reporting requirement on top of a
    voluntary Framework could create confusion about the intent of the
    Executive Order and lead to less participation and use of the
    Framework, as well as reduce trust in NIST's consensus development
    process adversely affecting future participation.
        After some time has passed, measurement of use and effectiveness of
    the Framework is an element of NIST's plans. Costs (including burden on
    companies) and benefits of doing that as well as alternative options
    would be considered at that time. Measurement should also include how
    products and services--and the overall market forces--are supporting
    use of the Framework, and where legislative changes may assist with
    use.
        Based on feedback from the private sector, the immediate focus of
    the Administration is on raising awareness about the value of the
    voluntary Framework in addressing and reducing risk, and encouraging
    its use. NIST continues to hear from the private sector--including our
    most recent discussions with leaders across many sectors--that raising
    awareness and stimulating use are the essential first steps on the path
    to achieving effectiveness.
        NIST believes that this is the pathway to effectiveness. Concerns
    about cybersecurity and risk need to be integrated into each
    organization's approach for doing business. There is no single,
    definitive and universal end point for improving quality or
    cybersecurity. NIST is asking organizations to do a serious evaluation
    of their current cybersecurity practices and develop plans to improve
    their capabilities through use of the Framework--a process that will
    take time.
        NIST is also seeing a range of products and services being
    developed or modified to assist organizations use the Cybersecurity
    Framework. The Administration is also working to ensure that this
    approach can scale globally--as NIST sees that alignment it's likely to
    also see increased use of the Framework for companies with
    international business.
        The voluntary nature of the framework in enabling a larger number
    of stakeholders to use the underlying practices--choosing a subset for
    a mandatory survey might create an impression that only this subset
    should use the Framework. The private sector voluntarily participated
    in the Framework development process and NIST has found that
    organizations are willing to discuss how they are using or intend to
    use the Framework. NIST will work with DHS on their sector-wide
    assessments, monitor surveys that private sector organizations conduct,
    and will continue to receive information through workshops, meetings,
    and potentially future Requests for Information. Much of this will be
    geared to gathering information on how to improve future versions of
    the Framework.
                                     ______

         Response to Written Questions Submitted by Hon. John Thune to
                               Ann M. Beauchesne
        Question 1. In August 2013, the Department of Commerce Internet
    Policy Taskforce released a series of recommendations incorporating
    stakeholder input for ways the government could incentivize use of the
    framework. The U.S. Chamber of Commerce has also suggested a number of
    incentives. What incentives do you think would have the biggest impact
    on business behavior?
        Answer. The U.S. Chamber generally separates the cybersecurity
    incentives discussion into two categories--(1) incentives related to
    information sharing and (2) incentives related to using risk management
    tools like the National Institute of Standards and Technology (NIST)
    Framework for Improving Critical Infrastructure Cybersecurity (the
    framework).
        First, incentives spurring bidirectional information about cyber
    threats among multiple government and private entities are most
    important to Chamber members. The Chamber needs Congress to send a bill
    to the president that gives businesses legal certainty that they are
    protected from liability when voluntarily sharing and receiving threat
    indicators and countermeasures in real time and taking actions to
    mitigate cyberattacks.
        The legislation also needs to offer protections related to public
    disclosure, regulatory, and antitrust matters in order to increase the
    timely exchange of information among public and private entities. The
    Chamber believes that legislation needs to safeguard privacy and civil
    liberties and establish appropriate roles for civilian and intelligence
    agencies. At the time of this writing, the draft Cybersecurity
    Information Sharing Act of 2015 (CISA) goes the furthest compared with
    other proposals in addressing the legal and policy priorities that the
    Chamber has been pushing for several years.
        Second, the Chamber appreciates that the administration is
    considering a limited number of incentives for the private sector to
    voluntarily use the framework.\1\ However, the most important incentive
    that the administration and lawmakers could extend to companies is the
    assurance that the cybersecurity framework would remain collaborative,
    flexible, and innovative over the long term. The Chamber believes that
    the presence of these qualities, or the lack thereof, would be a key
    determinant to participation by businesses, including critical
    infrastructure, in using the framework.
    ---------------------------------------------------------------------------
        \1\ www.whitehouse.gov/blog/2015/02/02/strengthening-cyber-risk-
    management
    ---------------------------------------------------------------------------
        Ultimately, policymakers need to meet with each critical
    infrastructure sector to discuss what businesses need to potentially
    encourage greater use of the cybersecurity framework. The right
    incentives may be available or they may need to be created. In April
    2013, the Chamber sent NIST a letter regarding businesses' use of the
    framework and the role of incentives.
        Here are some incentives that are frequently discussed by public
    and private sector stakeholders, which the Chamber is willing to
    consider:

       Extending liability protections (information sharing).
            Businesses seek to participate in the online equivalent of a
            Neighborhood Watch program for cybersecurity. Companies'
            security professionals want to exchange cyber threat
            information and vulnerabilities with their peers and
            government--but they fear being sanctioned for doing the right
            thing. The Chamber strongly urges Congress to pass an
            information-sharing bill this year with strong protections
            related to liability, public disclosure, regulatory, and
            antitrust concerns.

       Extending liability protections (framework). Congress may
            consider extending liability protections to companies that
            voluntarily adopt the cybersecurity framework. This is a
            welcome option. However, our experience with S. 3414, the
            Cybersecurity Act of 2012, demonstrates that the level of
            protection authorized in the bill (i.e., against punitive
            damages sought in a lawsuit) was relatively weak. The bill
            provided insufficient protection to sway businesses' decision
            making in favor of the legislation. In other words, the stick
            was considerably bigger than the carrot.

       Extending liability protections (SAFETY Act). The
            administration and Congress are expected to assess how the
            Support Anti-terrorism by Fostering Effective Technologies Act
            of 2002 (SAFETY Act) could allow for legal liability
            protections for providers of qualified cybersecurity
            technologies. The act is intended to expand the development and
            commercialization of innovative products and services to
            mitigate significant cybersecurity incidents. This may require
            a review and possibly a modification of the events that would
            trigger SAFETY Act coverage and the types of technologies and
            services that would be covered. House cybersecurity legislation
            in the 113th Congress (H.R. 3696) contained such as provision.

       Harmonizing cybersecurity regulations. Information-security
            requirements should not be cumulative. The Chamber believes it
            is valuable that agencies and departments are urged under the
            2013 cybersecurity executive order (EO) to report to the Office
            of Management and Budget any critical infrastructure subject to
            ``ineffective, conflicting, or excessively burdensome
            cybersecurity requirements.'' The Chamber urges the
            administration and Congress to prioritize eliminating
            burdensome regulations on businesses. One solution could entail
            giving businesses credit for information security regimes that
            exist in their respective sectors. It is positive that Michael
            Daniel, the administration's lead cyber official, has made
            harmonizing existing cyber regulations with the framework a
            priority in a February 2, 2015, blog.

       Leveraging Federal procurement. The Chamber generally
            supports a government procurement process that rewards vendors
            that follow industry-recognized cybersecurity guidance.
            However, we are concerned about the unintended consequences of
            procurement incentives, such as a program that leads to one-
            size-fits-all outcomes or to artificially chosen technology
            winners and losers. The Chamber urges the administration to be
            mindful of how procurement incentives, however beneficial in
            the American context, could prompt foreign governments to
            emulate this policy as a way of restricting U.S. companies'
            access to overseas markets.

        The Chamber cautions against expanding the scope of section 8 of
            the 2013 cybersecurity EO.\2\ The administration recognizes
            that it should not determine how companies design, develop, and
            manufacture their technology and products. There are well-
            established laws and policies on the books to ensure that
            government procurement processes leverage--rather than
            duplicate and weaken--industry-led, international technology
            standards and best practices.
    ---------------------------------------------------------------------------
        \2\ www.whitehouse.gov/the-press-office/2013/02/12/executive-order-
    improving-critical-infrastructure-cybersecurity

       Making the research and development (R&D) tax credit
            permanent. Congress should make the R&D tax credit permanent to
            help businesses adopt a multilayered cybersecurity program that
            matures over time in relation to risks. This is particularly
            important for small and midsize company owners and operators
            who typically lack the money and human talent to deploy a
    ---------------------------------------------------------------------------
            sophisticated program.

        Question 2. The U.S. Chamber has noted that standards are most
    effective when developed and recognized globally, which can help
    prevent the burden of multiple, conflicting jurisdictional
    requirements.
        The Cybersecurity Enhancement Act (Public Law 113-274) recognized
    NIST's convening role in international standards development and
    required NIST to consult with foreign governments and international
    organizations to support the framework development process. How can the
    U.S. Chamber leverage its members' global operations to facilitate this
    international alignment?
        Answer. The Chamber is urging U.S. and foreign government officials
    to align international cybersecurity regimes with the framework. Many
    Chamber members operate globally. We applaud NIST for actively meeting
    with foreign officials urging them to embrace the framework. Like NIST,
    the Chamber believes that efforts to improve the cybersecurity of the
    public and private sectors should reflect the borderless and
    interconnected nature of our digital environment.
        Standards, guidance, and best practices relevant to cybersecurity
    are typically industry driven and adopted on a voluntary basis. They
    are most effective when developed and recognized globally. Such an
    approach would avoid burdening multinational enterprises with the
    requirements of multiple, and often conflicting, jurisdictions.
        The Chamber is planning to hold meetings in May in Berlin and
    Brussels with U.S. and European public officials and industry
    representatives to discuss issues of mutual interest including the
    cybersecurity framework, digital innovation, international data flows,
    and data privacy. Our organization intends to engage additional
    countries and regions globally.
        Meanwhile, the Chamber urges the administration to organize
    opportunities for stakeholders to participate in multinational
    discussions. We encourage the Federal Government to work with
    international partners and believe that these discussions should be
    stakeholder driven and occur on a routine basis.
                                     ______

         Response to Written Questions Submitted by Hon. Roy Blunt to
                               Ann M. Beauchesne
        Question 1. You state in your testimony that the NIST framework is
    incomplete without Congress enacting information-sharing legislation.
    Can you elaborate on this? Is it fair to say that, in the same sense
    the NIST framework is voluntary, that the sharing of cyber threat
    indicators must be voluntary as well?
        Answer. I would like to begin with part two of this question by
    saying that cybersecurity information sharing must be voluntary. The
    U.S. Chamber would oppose any program mandating that companies report
    cyber threat data to the government, save for what companies agree to
    via contract.
        Improving information sharing should be job No. 1 for policymakers.
    The National Institute of Standards and Technology's (NIST's) Framework
    for Improving Critical Infrastructure Cybersecurity (the framework)
    would be incomplete without enacting information-sharing legislation
    that removes legal and regulatory barriers to rapidly exchanging data
    about threats to U.S. companies. On January 27, 35 associations,
    including the Chamber, urged the Senate to quickly pass a cybersecurity
    information-sharing bill. The Senate Intelligence committee passed in
    July the Cybersecurity Information Sharing Act (CISA) of 2014, a smart
    and workable bill, which earned broad bipartisan support.
        Recent cyber incidents underscore the need for legislation to help
    businesses improve their awareness of cyber threats and enhance their
    protection and response capabilities. The Chamber urges Congress to
    send a bill to the president that gives businesses legal certainty that
    they have safe harbor against frivolous lawsuits when voluntarily
    sharing and receiving threat indicators and countermeasures in real
    time with multiple private and public entities, as well as when
    monitoring information systems to mitigate cyberattacks. The
    legislation also needs to offer protections related to public
    disclosure, regulatory, and antitrust matters in order to increase the
    timely exchange of technical cyber threat indicators (CTIs) and
    countermeasures among public and private entities.
        The Chamber further believes that legislation needs to safeguard
    privacy and civil liberties and establish appropriate roles for
    civilian and intelligence agencies. For example, businesses must remove
    personal information from CTIs before sharing indicators. Private
    entities must share ``electronic mail or media, an interactive form on
    an Internet website, or a real time, automated process between
    information systems'' with DHS--a civilian entity--if they are to be
    offered protection from liability.
        CISA, which is sponsored by Sens. Richard Burr and Dianne
    Feinstein, reflects practical compromises among many stakeholders on
    these issues. At the time of this writing, the measure was marked up on
    March 12 and reported to the full Senate on a strong bipartisan vote of
    14-1. The Chamber urges the Senate to pass CISA soon.

        Question 2. In your testimony, you cited the need for the U.S.
    government to raise the costs on malicious cyber-attackers through an
    intelligent and forceful deterrence strategy. Can you elaborate what a
    cyber-deterrence strategy should look like?
        Answer. The Chamber is reviewing actions that businesses and
    government can take to deter nefarious actors that threaten to empty
    bank accounts, steal trade secrets, or damage vital infrastructures.
    While our organization has not formally endorsed the report, the U.S.
    Department of State's International Security Advisory Board (ISAB)
    issued in July draft recommendations regarding cooperation and
    deterrence in cyberspace.
        The ISAB's recommendations--including cooperating on crime as a
    first step, exploring global consensus on the rules of the road,
    enhancing governments' situational awareness through information
    sharing, combating IP theft, expanding education and capacity building,
    promoting attribution and prosecution, and leading by example--are
    sensible and worthy of further review by cybersecurity stakeholders.\1\
    ---------------------------------------------------------------------------
        \1\ The ISAB report is available at www.state.gov/documents/
    organization/229235.pdf.
    ---------------------------------------------------------------------------
        The Chamber believes that the United States needs to coherently
    shift the costs associated with cyberattacks in ways that are legal,
    swift, and proportionate relative to the risks and threats.
    Policymakers need to help the law enforcement community, which is a key
    asset to the business community but numerically overmatched compared
    with illicit hackers.\2\
    ---------------------------------------------------------------------------
        \2\ The Chamber argued for a clear cyber deterrence strategy in its
    December 2013 letter to NIST on the framework. See http://
    csrc.nist.gov/cyberframework/framework_comments/2013
    1213_ann_beauchesne_uschamber.pdf.
    ---------------------------------------------------------------------------
        The Chamber would welcome working with you, other lawmakers, and
    the administration on establishing an effective cyber deterrence
    strategy, using an array of policy tools that the United States lacks.

        Question 3. The framework itself is voluntary and based upon a risk
    management model, as opposed to compliance with rote standards.
    Wouldn't the concept of a mandatory survey be counter to the voluntary
    approach adopted by NIST, and could it impact the use of the framework
    if private sector owners and operators of critical infrastructure view
    using the framework as being linked to new reporting requirements?
    Please provide your perspective on the mandatory survey proposal.
        Answer. The framework is a remarkable public-private achievement.
    NIST worked closely with the Chamber's Cybersecurity Working Group and
    other private sector organizations to develop the framework. NIST
    treated the business community as a genuine partner as it tackled a
    tough assignment in ways that should serve as a model for other
    agencies and departments.
        Generally, the Chamber does not survey its members, which we have
    also communicated to Sen. Nelson. However, the Chamber is committing
    substantial resources to promoting the framework to its membership and
    the wider business community. As highlighted in my testimony, the
    Chamber has organized an extensive, ongoing cybersecurity education and
    advocacy campaign--Improving Today, Protecting Tomorrow TM--
    partnering with state and local chambers to host events in Chicago,
    Austin, Seattle, and Phoenix.
        The Chamber also hosted a number of events in Washington, D.C.,
    including America's Small Business Summit 2014 and the Third Annual
    Cybersecurity Summit, where discussion of the framework was prominently
    featured. Further, we are planning events this year to build on the
    success of the 2014 campaign.
        Use of the framework is voluntary--not mandatory--which is why many
    businesses and public-sector organizations, such as county IT
    departments, have embraced it. Industry's interest in cybersecurity and
    the framework is robust and expanding. Michael Daniel, White House
    special assistant to the president and cybersecurity coordinator, said
    in September 2014 at the Chamber's third cyber roundtable in Seattle
    that industry's response to the framework has been ``phenomenal.''
        The Chamber supported the Cybersecurity Enhancement Act of 2014 (S.
    1353, P.L. 113-274), sponsored by Sens. Rockefeller and Thune and
    signed into law on December 18, 2014. The act directs the comptroller
    general to conduct a study assessing the extent to which ``sectors of
    critical infrastructure have adopted a voluntary, industry-led set of
    standards,'' and ``the reasons behind the decisions'' of critical
    infrastructure to do so. The Chamber believes that this study would
    offer much more insight about framework use than a mandatory survey of
    individual firms.
        It is worth adding that critical infrastructure sectors are keenly
    aware of and supportive of the framework and similar risk management
    tools. The Chamber understands that critical infrastructures at
    ``greatest risk'' (CIGR) have been identified and engaged by
    administration officials under the terms of the 2013 cybersecurity
    executive order (EO).\3\ If the United States is to build a more secure
    cyber future, the Chamber urges you and other government officials to
    ensure that all resources, particularly the latest cyber threat
    information, are available to CIGR to counter increasing and advanced
    threats.
    ---------------------------------------------------------------------------
        \3\ www.whitehouse.gov/the-press-office/2013/02/12/executive-order-
    improving-critical-infrastructure-cybersecurity
    ---------------------------------------------------------------------------
        At the time of this writing, it is not clear that Federal entities
    such as the Department of Homeland Security (DHS) have utilized all
    resources at their disposal to help CIGR mitigate expensive
    cyberattacks emanating from highly advanced and nefarious actors.
    Policymakers have not sufficiently acknowledged this expensive,
    practical reality. Nation-states or their proxies and other
    sophisticated criminal actors are apparently hacking businesses with
    impunity. This needs to stop.

        Question 4. Ms. Beauchesne, in your testimony you cite the need to
    harmonize preexisting regulations on cybersecurity. Please submit for
    record specific details regarding which agencies and what regulations
    are duplicative, burdensome, inconsistent, or otherwise in conflict
    with the NIST framework and our goal of better cybersecurity.
        Answer. Information-security requirements should not be cumulative.
    The Chamber believes it is valuable that agencies and departments are
    urged under the 2013 cybersecurity EO to report to the Office of
    Management and Budget any critical infrastructure subject to
    ``ineffective, conflicting, or excessively burdensome cybersecurity
    requirements.'' We urge the administration and Congress to prioritize
    eliminating burdensome regulations on businesses.\4\ Thus, it is
    positive that Michael Daniel, the administration's lead cyber official,
    has made harmonizing preexisting cyber regulations with the framework a
    priority.\5\
    ---------------------------------------------------------------------------
        \4\ The business community already complies with multiple
    information security rules. Among the regulatory requirements impacting
    businesses of all sizes are the Chemical Facilities Anti-Terrorism
    Standards (CFATS), the Federal Energy Regulatory Commission-North
    American Reliability Corporation Critical Information Protection (FERC-
    NERC CIP) standards, the Gramm-Leach-Bliley Act (GLBA), the Health
    Insurance Portability and Accountability Act (HIPAA), and the Sarbanes-
    Oxley (SOX) Act. The Securities and Exchange Commission
    (SEC) issued guidance in October 2011 outlining how and when companies
    should report hacking incidents and cybersecurity risks. Corporations
    also comply with many non-U.S. requirements, which add to the
    regulatory mix.
        \5\ www.whitehouse.gov/blog/2015/02/02/strengthening-cyber-risk-
    management
    ---------------------------------------------------------------------------
        The Chamber would defer to leading sector associations and
    companies to determine what works best for them vis-a-vis government
    regulators. The examples that follow partially illustrate the
    challenges involved in streamlining regulations.
        First, some businesses in the communications sector--made up of
    broadcasting, cable, wireline, wireless, and satellite segments--
    believe that agency duplication is a growing concern. Multiple
    agencies--including DHS, the Federal Communications Commission (FCC),
    and the National Telecommunications and Information Administration
    (NTIA)\6\--address cybersecurity in the communications sector. Whether
    it is the communications sector or another one, quality cybersecurity
    expertise is hard to attract and retain. Cyber personnel and their
    business colleagues (e.g., with legal and risk management duties)
    should not be unduly stressed battling both advanced hackers and
    Federal regulators. Regulatory overlap could easily lead to conflicting
    rules and the splintering of industry resources, which would be
    detrimental to cybersecurity. Such a problem is not unique to the
    communications sector.
    ---------------------------------------------------------------------------
        \6\ www.ntia.doc.gov/press-release/2015/iptf-seeks-comment-key-
    cybersecurity-issues
    ---------------------------------------------------------------------------
        Second, financial institutions offer numerous products and services
    that subject them to multiple cybersecurity and information privacy
    programs, including the Gramm-Leach-Bliley Act (GLBA) and various rules
    and guidance issued by Federal and state regulators. Federal financial
    sector regulators work toward harmonizing their mandates across
    agencies through bodies like the Federal Financial Institutions
    Examination Council (FFIEC)\7\ and the Financial and Banking
    Information Infrastructure Committee (FBIIC). Nevertheless, agencies
    commonly leave the interpretation of rules and guidance documents to
    individual agency officials who may interpret them differently, often
    leading to confusing or conflicting recommendations.
    ---------------------------------------------------------------------------
        \7\ http://ithandbook.ffiec.gov/it-booklets/business-continuity-
    planning.aspx
    ---------------------------------------------------------------------------
        Further, beyond the Federal level, there are several state-based
    financial regulatory entities that create their own guidance and have
    oversight responsibilities, adding to the regulatory mix. The financial
    services industry needs improved consistency and clarity among their
    various regulators to minimize costs while maximizing business safety
    and soundness.
        Third, the natural gas sector is impacted by a long list of
    recommended practices, standards, and guidelines--including the DHS
    Transportation Security Administration (TSA) Pipeline Security
    Guidelines (2011),\8\ the Department of Energy's (DOE's) Cybersecurity
    Capability Maturity Model (C2M2),\9\ and DHS' Cyber Security Evaluation
    Tool (CSET)--which are employed by industry operators to bolster their
    cybersecurity posture and resilience in an all-hazards context. Natural
    gas companies have worked diligently to use one or more of these
    standards and recommended practices. However, as companies are
    increasingly pressured by government agencies to use multiple tools,
    cybersecurity can become more of a record-keeping and compliance
    exercise rather than an exercise in advancing legitimate security.
    ---------------------------------------------------------------------------
        \8\ www.tsa.gov/assets/pdf/guidelines_final_apr2011.pdf
        \9\ http://energy.gov/oe/services/cybersecurity/cybersecurity-
    capability-maturity-model-c2m2-program/cybersecurity
    ---------------------------------------------------------------------------
        The Chamber hopes that the new Cybersecurity Forum for Independent
    and Executive Branch Regulators can help, according to its fall 2014
    charter, ``identify and explore opportunities to align, leverage, and
    deconflict cross-sector regulatory authorities' approaches and promote
    cybersecurity protection.'' \10\ We would like to maintain a dialogue
    with your office and the Commerce committee as the administration and
    the interagency forum tackle the regulatory streamlining initiative
    tied to the framework.
    ---------------------------------------------------------------------------
        \10\ http://pbadupws.nrc.gov/docs/ML1428/ML14288A568.pdf; http://
    pbadupws.nrc.gov/docs
    /ML1501/ML15014A296.pdf
    ---------------------------------------------------------------------------
                                     ______

        Response to Written Questions Submitted by Hon. Bill Nelson to
                               Ann M. Beauchesne
        Question 1. I want to follow up on the request I made to you at the
    hearing. Of the 200 or so members that make up the National Security
    Task Force, how many of them have implemented the framework? How many
    members in your general membership have implemented the framework?
        Answer. The U.S. Chamber of Commerce believes that the Framework
    for Improving Critical Infrastructure Cybersecurity (the framework) is
    a remarkable public-private achievement. The National Institute of
    Standards and Technology (NIST) worked closely with the Chamber's
    Cybersecurity Working Group and other private sector organizations to
    develop the framework. NIST treated the business community as a genuine
    partner as it tackled a tough assignment in ways that should serve as a
    model for other agencies and departments.
        Generally, the Chamber does not survey its members. Yet, the
    Chamber is committing substantial resources to promoting the framework
    to its membership and the wider business community. As highlighted in
    my testimony, the Chamber has organized an extensive, ongoing
    cybersecurity education and advocacy campaign--Improving Today,
    Protecting Tomorrow TM--partnering with state and local
    chambers to host events in Chicago, Austin, Seattle, and Phoenix.
        The Chamber also hosted a number of events in Washington, D.C.,
    including America's Small Business Summit 2014 and the Third Annual
    Cybersecurity Summit, where discussion of the framework was prominently
    featured. Further, we are planning events this year to build on the
    success of the 2014 campaign.
        Use of the framework is voluntary, not mandatory, which is why many
    businesses and public-sector organizations, such as county IT
    departments, have embraced it. Industry's interest in cybersecurity and
    the framework is robust and expanding. Michael Daniel, White House
    special assistant to the president and cybersecurity coordinator, said
    in September 2014 at the Chamber's third cyber roundtable in Seattle
    that industry's response to the framework has been ``phenomenal.''
        The Chamber supported the Cybersecurity Enhancement Act of 2014 (S.
    1353, P.L. 113-274), sponsored by Sens. Rockefeller and Thune and
    signed into law on December 18, 2014. The act directs the comptroller
    general to conduct a study assessing the extent to which ``sectors of
    critical infrastructure have adopted a voluntary, industry-led set of
    standards,'' and ``the reasons behind the decisions'' of critical
    infrastructure to do so. The Chamber believes that this study would
    offer much more insight about framework use.
        It is worth adding that critical infrastructure sectors are keenly
    aware of and supportive of the framework and similar risk management
    tools. The Chamber understands that critical infrastructures at
    ``greatest risk'' (CIGR) have been identified and engaged by
    administration officials under the terms of the 2013 cybersecurity
    executive order (EO).\1\ If the United States is to build a more secure
    cyber future, the Chamber urges you and other government officials to
    ensure that all resources, particularly the latest cyber threat
    information, are available to CIGR to counter increasing and advanced
    threats.
    ---------------------------------------------------------------------------
        \1\ www.whitehouse.gov/the-press-office/2013/02/12/executive-order-
    improving-critical-infrastructure-cybersecurity
    ---------------------------------------------------------------------------
        At the time of this writing, it is not clear that Federal entities
    such as the Department of Homeland Security (DHS) have utilized all
    resources at their disposal to help CIGR mitigate expensive
    cyberattacks emanating from highly advanced and nefarious actors.
    Policymakers have not sufficiently acknowledged this expensive,
    practical reality. Nation-states or their proxies and other
    sophisticated criminal actors are apparently hacking businesses with
    impunity. This needs to stop.
        In addition to having policymakers acknowledge cost concerns, the
    Chamber would welcome working with you, other lawmakers, and the
    administration on establishing an intelligent and forceful deterrence
    strategy, using an array of policy tools that the United States lacks.

        Question 2. What is the prevalence of cyber insurance policies
    among members of the U.S. Chamber of Commerce? And what is the amount
    of annual payouts under those policies?
        Answer. The prevalence of cyber insurance among Chamber members is
    unknown. Typically, the Chamber does not ask its members about such
    matters because this information is relatively sensitive.
        We note, however, that more than 50 major insurance providers now
    offer cyber insurance coverage. According to a Marsh Risk Management
    Research report, demand for cyber insurance grew by 21 percent across
    all industries in 2013, compared with 2012, and the pace is increasing.
    Financial institutions accounted for the largest percentage--nearly 30
    percent--of that increase. Other data-intensive sectors, including
    retail/wholesale and professional services, saw increases of 19 percent
    and 13 percent, respectively. It appears that demand for cyber
    insurance is booming as a result of a number of high-profile hacks and
    data breaches, spurring explosive growth in what is approximately a $2
    billion industry.
        The Chamber applauds the insurance industry for developing market-
    driven policies to help businesses mitigate losses from a variety of
    cyber incidents, including data breaches, business interruption, and
    network damage. Business purchases of cybersecurity insurance should go
    hand in hand with investments in cybersecurity.
        Cyber insurance risk is challenging to measure, model, and price.
    Nevertheless, growing awareness of the cybersecurity framework and
    almost daily headlines about cyber incidents have stimulated industry's
    interest in cyber insurance. A healthy cyber insurance market should
    play a role in businesses' reducing the number of successful
    cyberattacks by implementing risk management tools in return for more
    coverage.
        The Chamber supports a growing cyber insurance market, which is
    nascent compared with more established lines such as auto, life, and
    health. But, the Chamber would not support public policies either
    compelling insurers to offer cyber insurance or mandating that firms
    buy cyber insurance.
        The Chamber plans to promote cyber risk management tools, including
    cyber insurance, as part of its national roundtable cybersecurity
    series. The campaign emphasizes growing awareness of the framework--
    particularly recommending that businesses of all sizes and sectors
    adopt fundamental Internet security practices--and teaming up with law
    enforcement and entities like DHS.
        If the campaign comes to a Florida city, the Chamber would welcome
    having you as a keynote speaker.
                                     ______

         Response to Written Questions Submitted by Hon. John Thune to
                                 Paul N. Smocer
        Question 1. The financial services sector is a leader in cyber
    threat information-sharing innovation, as evidenced by the successful
    collaboration via the FS-ISAC and the creation of Soltra Edge, a new
    threat intelligence-sharing software platform. What are the key
    principles that cyber threat information sharing legislation must
    include to eliminate existing constraints on the activities of the FS-
    ISAC and Soltra Edge?
        Answer. The financial services sector realizes that in order to
    appropriately defend itself, threat information sharing is key.
        The FS-ISAC coordinates information sharing today among its member
    institutions, with industry associations, and between financial
    institutions and the Federal Government, law enforcement and other
    critical infrastructure sectors. Information is shared through the
    traffic light protocol (TLP), which allows recipients of the threat
    data to know the sensitivity of the information they receive and their
    ability to share. This allows data to be distributed to the right
    audiences in a more secure and trusted format. Soltra Edge expands on
    the FS-ISAC's trust model for cyber threat information sharing in that
    Soltra Edge is an automation platform that collects, distills, and
    transfers threat intelligence from and to a variety of other sources,
    including, but not limited to the FS-ISAC.
        Because of the level of current sharing that occurs, the financial
    services sector is often and rightly credited as being one of leaders
    in cybersecurity and, particularly, cyber threat information sharing.
    Even at that level though, not everyone participates in sharing and
    even those that do at times become reticent to share. In the latter
    case, this is particularly true when there is some success to an attack
    versus just an attempt to attack. In these cases, issues of liability
    often influence the decisions to share freely.
        One must also recognize that our sector exists in an interconnected
    world. As a sector, we are not an island unto ourselves. We need and
    rely on the sectors that provide us with power, water,
    telecommunications, computing, etc. A key reason for the immaturity in
    those sectors is concern over the potential liabilities associated with
    sharing such information.
        To encourage better information sharing within our sector, in other
    sectors, between the sectors, and to the government, sensible ``Good
    Samaritan'' protections are needed. Without such legislation, cyber
    threat information sharing will not expand beyond those companies that
    already do so to those companies that should do so, but fear litigation
    and potential reputational damage for sharing. In particular, we
    believe that in order to protect current initiatives, such as the FS-
    ISAC and Soltra Edge, and to expand cyber threat sharing beyond those
    that already do so, legislation is needed that includes the following
    provisions:

       Facilitates real-time sharing to enable institutions and
            government to act quickly;

       Provides a targeted level of liability and disclosure
            protections for cyber threat information sharing and receiving
            between individual institutions, through existing sharing
            mechanisms such as our FS-ISAC, private to government, and
            government to private;

       Offers a good faith defense for the sharing of threat
            information and data;

       Provides protection from disclosure through the Freedom of
            Information Act or to prudential regulators;

       Facilitates the appropriate declassification of information
            by the intelligence agencies and expedites the issuance of
            clearances to appropriate private sector individuals; and

       Includes appropriate levels of privacy and civil liberties
            requirements.

        The threat of cyber-attacks is a real and constant danger to our
    industry and to other critical infrastructure sectors upon which we,
    and the Nation as a whole, rely. The financial services industry is
    dedicated to improving our capacity to protect customers and their
    sensitive information. Effective cyber threat information sharing
    mitigates cyber risks to our customers, clients, partners and networks
    from malicious cyber activity.

        Question 2. Mr. Smocer, you mentioned in your testimony that the
    Cybersecurity Forum for Independent and Executive Branch Regulators is
    looking at ways to align and harmonize with the Framework and thus
    streamline regulatory agencies' cybersecurity efforts regarding
    critical infrastructure. Can you tell me how the financial services
    sector will benefit from harmonizing regulatory authorities and
    requirements and how this Forum is facilitating such benefits?
        Answer. According to the Charter for the Independent and Executive
    Branch Regulators, ``[t]he purpose of the voluntary Cybersecurity Forum
    for Independent and Executive Branch Regulators (The Forum) is to
    increase the overall effectiveness and consistency of regulatory
    authorities' cybersecurity efforts pertaining to U.S. Critical
    Infrastructure, much of which is operated by industry and overseen by a
    number of Federal regulatory authorities. The Forum will enhance
    communication among regulatory agencies and regulated entities through
    the sharing of best practices and exploring ways to align, leverage,
    and deconflict approaches to enhance cybersecurity protections, and
    will establish processes to encourage coordination and consistency
    where multiple Agencies have regulatory authority over a common
    industry.'' We laud such an approach and hope that it bears fruit.
    However, as described in our response to Sen. Blunt's question, there
    is some cause for concern.
        Simply, financial institutions are subject to various cyber
    security and information privacy requirements under the Gramm Leach
    Bliley Act and to regulatory standards and guidance issued by numerous
    financial regulators. In today's world, financial institutions often
    are multi-faceted, offering products and services that subject them to
    the regulatory authority of multiple agencies.
        To their credit, the Federal financial sector regulators do attempt
    to bring some consistency to their guidance and regulatory expectations
    across agencies through organizations such as the Federal Financial
    Institutions Examination Council (FFIEC) and the Financial and Banking
    Information Infrastructure Committee (FBIIC). To a limited extent, this
    helps avoid a single organization facing multiple expectations about
    the same operations. Even then, agencies often leave the interpretation
    of that guidance to agency-specific reviewers who may interpret it
    differently. Moreover, beyond the Federal level, there are a plethora
    of state level financial regulators who create their own guidance and
    by law have oversight responsibilities. For financial institutions,
    consistency among their various regulators helps keep down costs and
    overhead while still assuring safety and soundness.
        Beyond our industry though, the financial services sector would
    benefit from harmonizing regulatory standards across critical
    infrastructure sectors, such as telecommunications and electrical
    power. This would help all the sectors that rely upon each other to be
    able to better assess the level of cyber risk between sectors. It would
    better allow agencies responsible for assuring the Nation's cyber
    protection of the consistency of cybersecurity efforts across sectors.
    Practically, as the number of regulators with disparate requirements
    increases, the ability to train and place cybersecurity experts--
    already an expertise with a recognized shortage--also becomes more
    taxed.
                                     ______

          Response to Written Question Submitted by Hon. Roy Blunt to
                                 Paul N. Smocer
        Question. Mr. Smocer, in your testimony you mention your concerns
    that some Federal and state agencies have their own approaches to
    regulation that do not align with the Framework.
        Please submit for record specific details regarding which agencies
    and what regulations are duplicative, burdensome, inconsistent, or
    otherwise in conflict with the NIST framework and our goal of better
    cybersecurity.
        Answer. As mentioned in my prior testimony, FSR/BITS is a trade
    association representing the country's leading financial service
    companies. Under current regulatory regimes, some of our individual
    member institutions face regulation from the following regulatory
    bodies:

       The Securities and Exchange Commission (SEC);

       FINRA;

       The Federal Reserve System;

       The Office of the Comptroller of the Currency (OCC) ;

       The Federal Deposit Insurance Corporation (FDIC);

       The Consumer Financial Protection Bureau (CFPB);

       The U.S. Commodity Futures Trading Commission (CFTC);

       State banking agencies, and

       State insurance agencies.

        None of the above regulators, however, are Executive Branch
    agencies. Thus, these agencies are not subject to the President's
    Executive Orders and they do not have to adhere to the Administration's
    directives to harmonize cybersecurity regulations. Perhaps because of
    this, we have seen examples of agencies each asking their own set of
    cybersecurity examination questions that may loosely ``track'' to the
    NIST Cybersecurity Framework, but in substance deviate from agency to
    agency.
        For example:

       In April 2014, the SEC's Office of Compliance Inspections
            and Examinations (OCIE) issued a risk alert in which it
            announced that it would be conducting cybersecurity-focused
            examinations of approximately 50+ registered broker-dealers and
            investment advisors. In this same risk alert (http://
            www.sec.gov/ocie/announcement/
            Cybersecurity+Risk+Alert++%2526+Appendix+-+4.15.14.pdf), OCIE
            stated that ``some'' of its questions would ``track information
            outlined in the `Framework for Improving Critical
            Infrastructure Cybersecurity.'' Of the 28 example questions
            with subparts not all did.

       On November 3, 2014, the FFIEC issued its ``FFIEC
            Cybersecurity Assessment General Observations.'' This document
            detailed the FFIEC's cybersecurity examinations of 500+
            community institutions and provided cybersecurity areas to
            focus on and certain questions to consider when considering
            cybersecurity risk. It did not, however, tie these focus area
            or questions to the NIST Cybersecurity Framework.\1\
    ---------------------------------------------------------------------------
        \1\ https://www.ffiec.gov/press/PDF/
    FFIEC_Cybersecurity_Assessment_Observations.pdf

       Without a reference to the NIST Cybersecurity Framework, the
            New York State Department of Financial Services issued an
            ``examination guidance'' to all New York State chartered or
            licensed banking institutions on December 10, 2014, stating
            that it would be conducting ``new targeted cybersecurity
            preparedness assessments'' of these entities.\2\ In this
            announcement, the Department also announced that as part of
            that assessment it would be asking 12 specific questions.\3\
    ---------------------------------------------------------------------------
        \2\ http://www.dfs.ny.gov/about/press2014/pr1412101.htm
        \3\ http://www.dfs.ny.gov/banking/bil-2014-10-10_cyber_security.pdf

       On February 3, 2015, FINRA issued its ``Report on
            Cybersecurity Practices.'' \4\ Like the SEC, it referenced the
            NIST Cybersecurity Framework. However, in detailing
            cybersecurity best practices that firms should implement, it
            did not ``map'' such practices back to the NIST Cybersecurity
            Framework categories or subcategories. Such an exercise would
            be left to an individual firm that wished to compare the
            Framework against this new set of cybersecurity best practices.
    ---------------------------------------------------------------------------
        \4\ http://www.finra.org/web/groups/industry/@ip/@reg/@guide/
    documents/industry/p602363.pdf

        We certainly are glad to see an increasing focus on cybersecurity
    by agencies that play an important role in protecting the financial
    services industry. However, lack of harmonization between agencies and
    with the Cybersecurity Framework means that regulated organizations
    must continually reinvest their resources not in defending themselves
    against cyber assaults, but in assessing and reassessing themselves
    against multiple agency expectations. That is simply not an effective
    approach.
                                     ______

        Response to Written Questions Submitted by Hon. Bill Nelson to
                                 Paul N. Smocer
        Question 1. Some members of the Financial Services Roundtable sell
    insurance products that cover financial losses associated with
    cyberattacks. Do you have any data on how much is being paid out to
    insureds as a result of losses from cyberattacks?
        Answer. FSR does not have, nor do we collect, data on what our
    member companies pay out under various cyber insurance policies.

        Question 2. Last week, the press reported on a massive hacking ring
    that is alleged to have stolen up to $1 billion from banks in numerous
    countries, including the United States. The news, which emerged from a
    report written by Kaspersky Lab, is just the latest in a string of
    massive hacks and breaches in recent years, including last year's
    breach at JPMorgan Chase. At what point does consumer dissatisfaction
    with cyberattacks affect a company's decisions to devote more resources
    to cybersecurity?
        Answer. Specific to the report from Kaspersky Lab, FSR has been
    aware of the analysis that has underlied this report since early
    January. Our BITS division has distributed such information to security
    experts within our member companies. In addition, the FS-ISAC has
    distributed information to the entire financial sector. At this point
    in time, we are unaware of incidences where this malware has harmed our
    member companies or their customers. Like all cyber-attacks, FSR will
    continue to monitor these threats and work with our member companies
    and the FS-ISAC to share threat information and assist our members in
    responding to them and in protecting customers.
        More broadly, the Kaspersky report and other recent security trends
    point to the fact that the threats are rapidly growing. However, it is
    important to recognize that financial institutions' investment in cyber
    is a long-established practice. While recent events help feed the
    continual reassessment of cyber risk within institutions that, in turn,
    help drive investments in cyber protections, it would be improper to
    suggest that recent events have somehow been a stimulus that awoke the
    sector to this risk. The sector has focused on this risk for decades.
        As I noted in my testimony, the current cyber threat environment is
    grim. Each day, cyber risk grows as attacks increase in number, pace,
    and complexity. We are no longer in the days wherein the threat was
    confined to individual hacktivists and fraudsters. We are now in an era
    of attacks by not only organized crime syndicates, but also nation-
    states. Correspondingly, the attacks have grown beyond webpage
    vandalism and fraud into large-scale attacks that threaten the
    availability of services to citizens and threaten the privacy and
    accuracy of their information. Our sector is increasingly concerned
    with these threats, particularly with the potential for attacks that
    could undermine the integrity of the financial system through data
    manipulation or destruction. This growing threat affects all
    institutions in our sector regardless of size or type of financial
    institution including large and small, banks, credit unions, insurers
    and investment firms. Increasingly, and as we have recently witnessed,
    other sectors face these same threats.
        Being a focus of attacks is certainly one reason why the financial
    sector has historically led the way in making huge investments in not
    only security infrastructure and the best-qualified people to maintain
    the systems, but also in driving collaboration across industries and
    with the government. The primary reason for these investments though is
    the recognition that our customers trust us to protect them--to protect
    their investments, their records and their information. Individual
    financial institutions invest in personnel, infrastructure, services,
    and top of the line security protocols to protect their customers and
    themselves and to respond to cyber-attacks. These investments protect
    the individual institutions and their customers. The level and nature
    of cybersecurity investments are subjects of discussions within both
    the C-suite of institutions and with their boards. Institution
    executives know they are responsible for managing risk in their
    companies, and recognize that cyber-risk in particular bears special
    attention. Directors understand their oversight role in assuring
    management is fulfilling those responsibilities. Both management's and
    directors' ability to assess and respond to cyber risk is also the
    subject of review by financial regulators.

        Question 3. What is the prevalence of cyber insurance policies
    among members of the Financial Services Roundtable? And what is the
    amount of annual payouts under those policies?
        Answer. While we do not have data specific to our members, our
    research has revealed that 2014 marked an important milestone in the
    growth of cyber insurance, with a significant jump in both the number
    of companies offering cyber insurance and the number of firms buying
    cyber insurance. Currently, over fifty major insurance providers now
    offer cyber liability insurance coverage. Demand for that insurance
    rose by 21 percent across all industries in 2013 compared to 2012, with
    financial institutions representing the biggest increase of 29 percent
    in coverage buying. In 2014 that pace doubled, in some areas tripled,
    in what suddenly has become a $2 billion industry.
        Several developments contribute to the growth in cyber insurance.

      1.  The recent increase in cyber incidents, both in number and
            severity, including a string of high-profile hacks and data
            breaches.

      2.  A growing realization that although steps can be taken to
            minimize the likelihood of experiencing a successful cyber-
            attack and the severity of the loss if the attack succeeds, its
            occurrence cannot be entirely eliminated, especially if the
            enterprise becomes the target of a sophisticated, persistent
            adversary. It is becoming accepted that cybersecurity is
            similar to healthcare in the sense that one can take
            precautions, but not prevent entirely.

      3.  Increased appreciation and understanding of best practices, such
            as those found in the NIST Cybersecurity Framework, has
            improved underwriting ability, which has bolstered supply.

        Regarding payouts by member company insurers, as noted in my
    response to question #1 above, we do not have, nor do we collect, data
    on FSR member company payouts on cyber insurance policies.
                                     ______

         Response to Written Questions Submitted by Hon. John Thune to
                              Jefferson H. England
        Question 1. In August of 2013, the Department of Commerce Internet
    Policy Taskforce released a series of recommendations incorporating
    stakeholder input for ways the government could incentivize use of the
    Framework. Some of the potential incentives mentioned include engaging
    cyber insurance companies, studying tort liability, identifying
    opportunities for regulatory streamlining, further research and
    development initiatives, government procurement, and technical
    assistance. What incentives do you think would have the biggest impact
    on business behavior?
        Answer. As a small business, we recognize that the greatest
    incentive is the ability to attract and retain customers by
    demonstrating capability in our cybersecurity practices and the ability
    to enter into contracts with our vendors to deliver secure services to
    our customers. The market already provides strong cybersecurity
    incentives.
        However, tort liability review would have a powerful impact on
    business behavior. Individuals who attack our networks are criminals.
    State sponsored attacks on our networks are acts of war. As businesses,
    we need to know that if we employ reasonable cybersecurity practices
    that our government has our back when it comes to brining the
    perpetrators to justice. Not only will evildoers be more discouraged
    from committing cybercrime, but business and consumers will by
    extension have greater protection. Businesses know that they need to
    accept responsibility. and providing protections from liability.
        There are already many creative ideas designed to protect an
    individual's identity. Examples include multi-factor authentification
    when accessing personal information, cyber ``keys'' that are required
    to unlock certain personal information, and virtual information that is
    a proxy for real information so that the need for safeguarding the
    virtual information is less relevant. Government sponsorship of
    research and development initiatives and government procurement are
    also ways that can incentivize business to reach beyond what they may
    already be doing. In the rural telephone industry, recovery on certain
    cybersecurity expenditures is not allowed via the universal service
    fund and yet we are required to provide defined levels of Internet
    service. There is a disconnect in our industry that needs to be
    addressed.
        Cyber insurance companies already have a business imperative to
    ``incentivize'' the market because of the risk they themselves are
    assuming by insuring companies conducting business over the internet,
    so I do not believe there is a need for government to engage them in
    this space unless it is to be a lessons learned exercise.
        It is my experience that business tends to reach out to peers and
    suppliers for recommendations and assistance so I cannot speak to the
    value of Federal technical assistance.
        I would also caution against grants for cybersecurity improvements
    as I believe this model to be a disincentive. Grants are typically
    awarded on a needs basis potentially causing businesses that are
    currently engaged in improvement (on their own dime) to cease all
    improvement until they receive grant dollars. The result is a race to
    the bottom in terms of cyber security quality because improvements may
    be limited to the availability of grant dollars as distributed.

        Question 2. What role, if any, do you think your industry
    regulator, the Federal Communications Commission, should have with
    respect to the Framework and cybersecurity regulations or guidelines in
    general?
        Answer. I believe there is a significant role that the FCC can play
    with respect to the framework and cybersecurity regulations or
    guidelines in general.
        First and foremost, there needs to be continued education within
    our industry regarding the availability of the framework and its
    benefits to telecommunications providers. Staff availability and
    encouragement is critical for more widespread adoption. Creating an
    atmosphere of fear and regulation is counterproductive.
        Second, the FCC can and should recognize that the framework itself
    (let alone organizational adoption) is still in its infancy and needs
    the proper time to grow and evolve into a meaningful tool. I (and other
    employees of Silver Star Communications) participate as members of the
    Communications Security, Reliability and Interoperability Council
    (CSRIC) Working Group IV which was created with the primary purpose of
    developing voluntary mechanisms that provide macro-level assurance to
    the Federal Communications Commission (FCC) and the public that
    communication providers are taking the necessary corporate and
    operational measures to manage cybersecurity risks across the
    enterprise. The outcomes from this organization have been impressive,
    including widespread industry participation and meaningful industry
    suggestions and practical solutions, including a set of specific
    guidance to small and medium sized businesses that face very different
    challenges than the much larger communications companies. The FCC has
    played an important role in contributing to the outcomes of this
    working group and has been able to gain important visibility regarding
    industry progress from this group.
        Third, the FCC can be a government advocate for communications
    providers with respect to tracking down and bringing criminals and
    state sponsored attackers to justice. The easy solution is to play the
    hard hand and penalize business through regulation and liability but
    this approach only treats the symptoms without addressing the cause of
    the problem.
        Finally, I believe that the FCC has a responsibility to uphold the
    original scope of Executive Order 13636 and stand firm in the position
    that cybersecurity improvements should be voluntary in nature.
    Regulation implies that at some point (typically a reporting period)
    there is a static state in regards to cybersecurity, that somehow an
    organization is complete or done when the requirements are met. Cyber
    security activities are far too dynamic and businesses need to respond
    and even fail in their attempts to improve. The market rewards
    businesses who make decisions to make commerce a safer cyber
    experience. The FCC should recognize that things will go wrong. There
    will be more cybersecurity breaches. With each one, there are cries for
    improved regulation or to hold someone (excepting the criminals who
    carried out the attack) responsible without drawing attention to the
    fact that at the same time there are amazing advancements made in
    protecting information by organizations who are voluntarily adopting
    practices to be more competitive. I would add that because of the
    existing business imperative, these advancements will always outpace
    regulation. The consequence is that there is extreme waste of resources
    both on the part of businesses performing outdated activities to be
    compliant with regulation and by the regulating body enforcing outdated
    measures.
                                     ______

          Response to Written Question Submitted by Hon. Roy Blunt to
                               Dr. James A. Lewis
        Question. The Framework itself is voluntary and based upon a risk
    management model, as opposed to compliance with rote standards.
        Wouldn't the concept of a mandatory survey be counter to the
    voluntary approach adopted by NIST, and could it impact the use of the
    Framework if private sector owners and operators of critical
    infrastructure view using the Framework as being linked to new
    reporting requirements?
        Answer. The NIST Framework is part of a larger approach to
    cybersecurity created by the February 2013 Executive Order (EO) 13636
    (http://www.whitehouse.gov
    /the-press-office/2013/02/12/executive-order-improving-critical-
    infrastructure-cyber
    security). It is a standards-based approach reinforced by information
    sharing and partnerships between critical infrastructure companies and
    sector-specific agencies. The Framework must be put in the larger EO
    context to be understood. The EO instructed that:

       NIST develop a voluntary cybersecurity framework (Section
            7);

       The Secretaries of Treasury and Commerce identify possible
            incentives for better cybersecurity (Section 8);

       The Departments of Homeland Security and Justice, and the
            Director of National Intelligence take steps to improve
            information sharing (the subject of a February 2105 Executive
            Order) (Section 4);

       That all agencies integrate strong privacy and civil
            liberties protections into cybersecurity initiatives to secure
            critical infrastructure (Section 7), and

       The White House, DHS, and agencies responsible for
            regulating the security of critical infrastructure review and
            report on the adequacy of the Framework and of existing
            regulation for cybersecurity (Section 10).

        The EO already has a two-part reporting requirement. The first
    requirement was for agencies to determine whether and how existing
    regulation could be streamlined and aligned with the NIST Framework.
    Executive Branch departments and agencies with responsibility for
    regulating private-sector critical infrastructure were tasked to assess
    whether existing regulatory authority was sufficient to meet the
    objectives of the Framework and identify what changes, if any, were
    needed. At the conclusion of the review, the White House determined
    last May that existing regulatory requirements, combined with strong,
    voluntary partnerships, could mitigate risks to critical infrastructure
    (http://www.whitehouse.gov/blog/2014/05/22/assessing-cy
    bersecurity-regulations).
        The EO also calls for agencies, in consultation with critical
    infrastructure owners and operators, to determine by September 2016 if
    cybersecurity requirements are ineffective, conflicting, or excessively
    burdensome. This 2016 reporting will provide data to assess whether if
    the Framework is useful or not. The areas for further consideration
    include deciding if any action is needed before 2016, and ensuring that
    any review imposes only a minimal burden. There is an unfortunate
    precedent in a 2011 Commerce Department survey of telecom companies on
    cybersecurity-related issues, where the survey was both complicated and
    expensive. Congress can help ensure that this experience is not
    repeated and that requirements are not excessively burdensome.
        Congress can also help ensure that in meeting the EO requirement,
    the Executive Branch collects only the data that will allow it to
    assess if Framework is effective in improving cybersecurity and where
    it needs to be amended or strengthened. This essentially revolves
    around two questions: have companies adopted the framework and is it
    improving their cybersecurity. Without knowing the answer to these
    questions, we cannot say if the Framework has improved our defenses
    against the kinds of actions that affected Anthem, Sony, and many other
    companies. A simple attestation runs the risk of suffering from what is
    called in survey research, ``respondent error.'' The best way to reduce
    the likelihood of this error is to find quantitative metrics that will
    indicate Framework performance. A quantitative approach is a standard
    practice in business and should be duplicated in the reports required
    by the EO.
        Over time, it is likely that as companies implement the Framework,
    their experience will narrow it to a shorter and more focused list of
    actions relevant to their particular industry sector, as they
    experiment with different approaches to implementing it. Each
    industrial sector may find that some parts of the framework are more
    important for their business than others. An assessment of adoption and
    effectiveness would speed this evolution and answer important questions
    about the contributions of the Executive Order and the Framework to
    better cybersecurity and to national defense.
                                     ______

         Response to Written Question Submitted by Hon. Bill Nelson to
                               Dr. James A. Lewis
        Question. NIST is considering the future governance of the
    Framework so that it is maintained by the private sector instead of by
    NIST. We have seen with Target, Home Depot, and the numerous other
    breaches that have occurred in recent years that voluntary industry-
    maintained standards often do not work. Instead, such industry self-
    regulation just becomes a minimum standard. And when companies suffer
    cyberattacks, harming consumers and themselves, they will often just
    say that they were fully compliant with their respective industry's
    standards to avoid responsibility for their weak cybersecurity. Do you
    think there is any danger in that becoming the case for the Framework
    if it becomes wholly maintained and operated by the private sector?
        Answer. The NIST Framework is part of a new approach to
    cybersecurity created by the February 2013 Executive Order (EO) 13636.
    It is a voluntary, standards-based approach, reinforced by information
    sharing, and the involvement of sector specific regulatory agencies.
    The administration also hopes to identify incentives but any real
    incentive will probably require legislation.
        The involvement of sector specific agencies means that the future
    development of the Framework will most likely take two separate paths.
    Sector specific agencies, agencies, in consultation with their critical
    infrastructure owners and operator partners, will adjust and customize
    the Framework to better meet the needs of their sectors. At the same
    time, it is possible that a private entity, such as a non-profit
    organization will undertake to maintain and update the Framework
    Document. My understanding is that NIST intends to pass responsibility
    for updating the Framework to such an entity if it can find a neutral
    non-profit with sufficient technical expertise.
        The EO tasks the sector-specific agencies to work with critical
    infrastructure owners and operators to maintain and adapt the Framework
    to their sector's circumstances. This means that future work on the
    Framework, as part of the larger cybersecurity structure created by EO
    13636, will be undertaken as apart of public-private partnerships
    between critical infrastructure companies and agencies. Since work on
    the Executive Order began in August 2012, many high-profile incidents
    have highlighted the need for improved cyber security. Cybersecurity
    has become an issue of concern for many corporate boards. More
    incidents can be expected to occur in the future. This heightened
    attention and increasing risk, along with the government-private sector
    partnerships, suggests that the impetus will be for these partnerships
    to improve and extend the Framework and avoid the pitfalls of self-
    regulation. Congress will have an opportunity to review the status of
    the Framework and its implementation in September of 2016, since the EO
    requires agencies to report on implementation, burdensomeness, and
    effectiveness. This will provide us with data to determine that the
    framework is actually contributing to better cybersecurity in critical
    infrastructure or needs to be amended or replaced.

                                      [all]