[Federal Register Volume 78, Number 33 (Tuesday, February 19, 2013)]
[Presidential Documents]
[Pages 11739-11744]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2013-03915]
[[Page 11737]]
Vol. 78
Tuesday,
No. 33
February 19, 2013
Part III
The President
-----------------------------------------------------------------------
Executive Order 13636--Improving Critical Infrastructure Cybersecurity
Presidential Documents
Federal Register / Vol. 78 , No. 33 / Tuesday, February 19, 2013 /
Presidential Documents
___________________________________________________________________
Title 3--
The President
[[Page 11739]]
Executive Order 13636 of February 12, 2013
Improving Critical Infrastructure Cybersecurity
By the authority vested in me as President by the
Constitution and the laws of the United States of
America, it is hereby ordered as follows:
Section 1. Policy. Repeated cyber intrusions into
critical infrastructure demonstrate the need for
improved cybersecurity. The cyber threat to critical
infrastructure continues to grow and represents one of
the most serious national security challenges we must
confront. The national and economic security of the
United States depends on the reliable functioning of
the Nation's critical infrastructure in the face of
such threats. It is the policy of the United States to
enhance the security and resilience of the Nation's
critical infrastructure and to maintain a cyber
environment that encourages efficiency, innovation, and
economic prosperity while promoting safety, security,
business confidentiality, privacy, and civil liberties.
We can achieve these goals through a partnership with
the owners and operators of critical infrastructure to
improve cybersecurity information sharing and
collaboratively develop and implement risk-based
standards.
Sec. 2. Critical Infrastructure. As used in this order,
the term critical infrastructure means systems and
assets, whether physical or virtual, so vital to the
United States that the incapacity or destruction of
such systems and assets would have a debilitating
impact on security, national economic security,
national public health or safety, or any combination of
those matters.
Sec. 3. Policy Coordination. Policy coordination,
guidance, dispute resolution, and periodic in-progress
reviews for the functions and programs described and
assigned herein shall be provided through the
interagency process established in Presidential Policy
Directive-1 of February 13, 2009 (Organization of the
National Security Council System), or any successor.
Sec. 4. Cybersecurity Information Sharing. (a) It is
the policy of the United States Government to increase
the volume, timeliness, and quality of cyber threat
information shared with U.S. private sector entities so
that these entities may better protect and defend
themselves against cyber threats. Within 120 days of
the date of this order, the Attorney General, the
Secretary of Homeland Security (the ``Secretary''), and
the Director of National Intelligence shall each issue
instructions consistent with their authorities and with
the requirements of section 12(c) of this order to
ensure the timely production of unclassified reports of
cyber threats to the U.S. homeland that identify a
specific targeted entity. The instructions shall
address the need to protect intelligence and law
enforcement sources, methods, operations, and
investigations.
(b) The Secretary and the Attorney General, in
coordination with the Director of National
Intelligence, shall establish a process that rapidly
disseminates the reports produced pursuant to section
4(a) of this order to the targeted entity. Such process
shall also, consistent with the need to protect
national security information, include the
dissemination of classified reports to critical
infrastructure entities authorized to receive them. The
Secretary and the Attorney General, in coordination
with the Director of National Intelligence, shall
establish a system for tracking the production,
dissemination, and disposition of these reports.
(c) To assist the owners and operators of critical
infrastructure in protecting their systems from
unauthorized access, exploitation, or harm, the
Secretary, consistent with 6 U.S.C. 143 and in
collaboration with the Secretary of
[[Page 11740]]
Defense, shall, within 120 days of the date of this
order, establish procedures to expand the Enhanced
Cybersecurity Services program to all critical
infrastructure sectors. This voluntary information
sharing program will provide classified cyber threat
and technical information from the Government to
eligible critical infrastructure companies or
commercial service providers that offer security
services to critical infrastructure.
(d) The Secretary, as the Executive Agent for the
Classified National Security Information Program
created under Executive Order 13549 of August 18, 2010
(Classified National Security Information Program for
State, Local, Tribal, and Private Sector Entities),
shall expedite the processing of security clearances to
appropriate personnel employed by critical
infrastructure owners and operators, prioritizing the
critical infrastructure identified in section 9 of this
order.
(e) In order to maximize the utility of cyber
threat information sharing with the private sector, the
Secretary shall expand the use of programs that bring
private sector subject-matter experts into Federal
service on a temporary basis. These subject matter
experts should provide advice regarding the content,
structure, and types of information most useful to
critical infrastructure owners and operators in
reducing and mitigating cyber risks.
Sec. 5. Privacy and Civil Liberties Protections. (a)
Agencies shall coordinate their activities under this
order with their senior agency officials for privacy
and civil liberties and ensure that privacy and civil
liberties protections are incorporated into such
activities. Such protections shall be based upon the
Fair Information Practice Principles and other privacy
and civil liberties policies, principles, and
frameworks as they apply to each agency's activities.
(b) The Chief Privacy Officer and the Officer for
Civil Rights and Civil Liberties of the Department of
Homeland Security (DHS) shall assess the privacy and
civil liberties risks of the functions and programs
undertaken by DHS as called for in this order and shall
recommend to the Secretary ways to minimize or mitigate
such risks, in a publicly available report, to be
released within 1 year of the date of this order.
Senior agency privacy and civil liberties officials for
other agencies engaged in activities under this order
shall conduct assessments of their agency activities
and provide those assessments to DHS for consideration
and inclusion in the report. The report shall be
reviewed on an annual basis and revised as necessary.
The report may contain a classified annex if necessary.
Assessments shall include evaluation of activities
against the Fair Information Practice Principles and
other applicable privacy and civil liberties policies,
principles, and frameworks. Agencies shall consider the
assessments and recommendations of the report in
implementing privacy and civil liberties protections
for agency activities.
(c) In producing the report required under
subsection (b) of this section, the Chief Privacy
Officer and the Officer for Civil Rights and Civil
Liberties of DHS shall consult with the Privacy and
Civil Liberties Oversight Board and coordinate with the
Office of Management and Budget (OMB).
(d) Information submitted voluntarily in accordance
with 6 U.S.C. 133 by private entities under this order
shall be protected from disclosure to the fullest
extent permitted by law.
Sec. 6. Consultative Process. The Secretary shall
establish a consultative process to coordinate
improvements to the cybersecurity of critical
infrastructure. As part of the consultative process,
the Secretary shall engage and consider the advice, on
matters set forth in this order, of the Critical
Infrastructure Partnership Advisory Council; Sector
Coordinating Councils; critical infrastructure owners
and operators; Sector-Specific Agencies; other relevant
agencies; independent regulatory agencies; State,
local, territorial, and tribal governments;
universities; and outside experts.
Sec. 7. Baseline Framework to Reduce Cyber Risk to
Critical Infrastructure. (a) The Secretary of Commerce
shall direct the Director of the National
[[Page 11741]]
Institute of Standards and Technology (the
``Director'') to lead the development of a framework to
reduce cyber risks to critical infrastructure (the
``Cybersecurity Framework''). The Cybersecurity
Framework shall include a set of standards,
methodologies, procedures, and processes that align
policy, business, and technological approaches to
address cyber risks. The Cybersecurity Framework shall
incorporate voluntary consensus standards and industry
best practices to the fullest extent possible. The
Cybersecurity Framework shall be consistent with
voluntary international standards when such
international standards will advance the objectives of
this order, and shall meet the requirements of the
National Institute of Standards and Technology Act, as
amended (15 U.S.C. 271 et seq.), the National
Technology Transfer and Advancement Act of 1995 (Public
Law 104-113), and OMB Circular A-119, as revised.
(b) The Cybersecurity Framework shall provide a
prioritized, flexible, repeatable, performance-based,
and cost-effective approach, including information
security measures and controls, to help owners and
operators of critical infrastructure identify, assess,
and manage cyber risk. The Cybersecurity Framework
shall focus on identifying cross-sector security
standards and guidelines applicable to critical
infrastructure. The Cybersecurity Framework will also
identify areas for improvement that should be addressed
through future collaboration with particular sectors
and standards-developing organizations. To enable
technical innovation and account for organizational
differences, the Cybersecurity Framework will provide
guidance that is technology neutral and that enables
critical infrastructure sectors to benefit from a
competitive market for products and services that meet
the standards, methodologies, procedures, and processes
developed to address cyber risks. The Cybersecurity
Framework shall include guidance for measuring the
performance of an entity in implementing the
Cybersecurity Framework.
(c) The Cybersecurity Framework shall include
methodologies to identify and mitigate impacts of the
Cybersecurity Framework and associated information
security measures or controls on business
confidentiality, and to protect individual privacy and
civil liberties.
(d) In developing the Cybersecurity Framework, the
Director shall engage in an open public review and
comment process. The Director shall also consult with
the Secretary, the National Security Agency, Sector-
Specific Agencies and other interested agencies
including OMB, owners and operators of critical
infrastructure, and other stakeholders through the
consultative process established in section 6 of this
order. The Secretary, the Director of National
Intelligence, and the heads of other relevant agencies
shall provide threat and vulnerability information and
technical expertise to inform the development of the
Cybersecurity Framework. The Secretary shall provide
performance goals for the Cybersecurity Framework
informed by work under section 9 of this order.
(e) Within 240 days of the date of this order, the
Director shall publish a preliminary version of the
Cybersecurity Framework (the ``preliminary
Framework''). Within 1 year of the date of this order,
and after coordination with the Secretary to ensure
suitability under section 8 of this order, the Director
shall publish a final version of the Cybersecurity
Framework (the ``final Framework'').
(f) Consistent with statutory responsibilities, the
Director will ensure the Cybersecurity Framework and
related guidance is reviewed and updated as necessary,
taking into consideration technological changes,
changes in cyber risks, operational feedback from
owners and operators of critical infrastructure,
experience from the implementation of section 8 of this
order, and any other relevant factors.
Sec. 8. Voluntary Critical Infrastructure Cybersecurity
Program. (a) The Secretary, in coordination with
Sector-Specific Agencies, shall establish a voluntary
program to support the adoption of the Cybersecurity
Framework by owners and operators of critical
infrastructure and any other interested entities (the
``Program'').
[[Page 11742]]
(b) Sector-Specific Agencies, in consultation with
the Secretary and other interested agencies, shall
coordinate with the Sector Coordinating Councils to
review the Cybersecurity Framework and, if necessary,
develop implementation guidance or supplemental
materials to address sector-specific risks and
operating environments.
(c) Sector-Specific Agencies shall report annually
to the President, through the Secretary, on the extent
to which owners and operators notified under section 9
of this order are participating in the Program.
(d) The Secretary shall coordinate establishment of
a set of incentives designed to promote participation
in the Program. Within 120 days of the date of this
order, the Secretary and the Secretaries of the
Treasury and Commerce each shall make recommendations
separately to the President, through the Assistant to
the President for Homeland Security and
Counterterrorism and the Assistant to the President for
Economic Affairs, that shall include analysis of the
benefits and relative effectiveness of such incentives,
and whether the incentives would require legislation or
can be provided under existing law and authorities to
participants in the Program.
(e) Within 120 days of the date of this order, the
Secretary of Defense and the Administrator of General
Services, in consultation with the Secretary and the
Federal Acquisition Regulatory Council, shall make
recommendations to the President, through the Assistant
to the President for Homeland Security and
Counterterrorism and the Assistant to the President for
Economic Affairs, on the feasibility, security
benefits, and relative merits of incorporating security
standards into acquisition planning and contract
administration. The report shall address what steps can
be taken to harmonize and make consistent existing
procurement requirements related to cybersecurity.
Sec. 9. Identification of Critical Infrastructure at
Greatest Risk. (a) Within 150 days of the date of this
order, the Secretary shall use a risk-based approach to
identify critical infrastructure where a cybersecurity
incident could reasonably result in catastrophic
regional or national effects on public health or
safety, economic security, or national security. In
identifying critical infrastructure for this purpose,
the Secretary shall use the consultative process
established in section 6 of this order and draw upon
the expertise of Sector-Specific Agencies. The
Secretary shall apply consistent, objective criteria in
identifying such critical infrastructure. The Secretary
shall not identify any commercial information
technology products or consumer information technology
services under this section. The Secretary shall review
and update the list of identified critical
infrastructure under this section on an annual basis,
and provide such list to the President, through the
Assistant to the President for Homeland Security and
Counterterrorism and the Assistant to the President for
Economic Affairs.
(b) Heads of Sector-Specific Agencies and other
relevant agencies shall provide the Secretary with
information necessary to carry out the responsibilities
under this section. The Secretary shall develop a
process for other relevant stakeholders to submit
information to assist in making the identifications
required in subsection (a) of this section.
(c) The Secretary, in coordination with Sector-
Specific Agencies, shall confidentially notify owners
and operators of critical infrastructure identified
under subsection (a) of this section that they have
been so identified, and ensure identified owners and
operators are provided the basis for the determination.
The Secretary shall establish a process through which
owners and operators of critical infrastructure may
submit relevant information and request reconsideration
of identifications under subsection (a) of this
section.
Sec. 10. Adoption of Framework. (a) Agencies with
responsibility for regulating the security of critical
infrastructure shall engage in a consultative process
with DHS, OMB, and the National Security Staff to
review the preliminary Cybersecurity Framework and
determine if current cybersecurity regulatory
requirements are sufficient given current and projected
risks. In making such determination, these agencies
shall consider the identification
[[Page 11743]]
of critical infrastructure required under section 9 of
this order. Within 90 days of the publication of the
preliminary Framework, these agencies shall submit a
report to the President, through the Assistant to the
President for Homeland Security and Counterterrorism,
the Director of OMB, and the Assistant to the President
for Economic Affairs, that states whether or not the
agency has clear authority to establish requirements
based upon the Cybersecurity Framework to sufficiently
address current and projected cyber risks to critical
infrastructure, the existing authorities identified,
and any additional authority required.
(b) If current regulatory requirements are deemed
to be insufficient, within 90 days of publication of
the final Framework, agencies identified in subsection
(a) of this section shall propose prioritized, risk-
based, efficient, and coordinated actions, consistent
with Executive Order 12866 of September 30, 1993
(Regulatory Planning and Review), Executive Order 13563
of January 18, 2011 (Improving Regulation and
Regulatory Review), and Executive Order 13609 of May 1,
2012 (Promoting International Regulatory Cooperation),
to mitigate cyber risk.
(c) Within 2 years after publication of the final
Framework, consistent with Executive Order 13563 and
Executive Order 13610 of May 10, 2012 (Identifying and
Reducing Regulatory Burdens), agencies identified in
subsection (a) of this section shall, in consultation
with owners and operators of critical infrastructure,
report to OMB on any critical infrastructure subject to
ineffective, conflicting, or excessively burdensome
cybersecurity requirements. This report shall describe
efforts made by agencies, and make recommendations for
further actions, to minimize or eliminate such
requirements.
(d) The Secretary shall coordinate the provision of
technical assistance to agencies identified in
subsection (a) of this section on the development of
their cybersecurity workforce and programs.
(e) Independent regulatory agencies with
responsibility for regulating the security of critical
infrastructure are encouraged to engage in a
consultative process with the Secretary, relevant
Sector-Specific Agencies, and other affected parties to
consider prioritized actions to mitigate cyber risks
for critical infrastructure consistent with their
authorities.
Sec. 11. Definitions. (a) ``Agency'' means any
authority of the United States that is an ``agency''
under 44 U.S.C. 3502(1), other than those considered to
be independent regulatory agencies, as defined in 44
U.S.C. 3502(5).
(b) ``Critical Infrastructure Partnership Advisory
Council'' means the council established by DHS under 6
U.S.C. 451 to facilitate effective interaction and
coordination of critical infrastructure protection
activities among the Federal Government; the private
sector; and State, local, territorial, and tribal
governments.
(c) ``Fair Information Practice Principles'' means
the eight principles set forth in Appendix A of the
National Strategy for Trusted Identities in Cyberspace.
(d) ``Independent regulatory agency'' has the
meaning given the term in 44 U.S.C. 3502(5).
(e) ``Sector Coordinating Council'' means a private
sector coordinating council composed of representatives
of owners and operators within a particular sector of
critical infrastructure established by the National
Infrastructure Protection Plan or any successor.
(f) ``Sector-Specific Agency'' has the meaning
given the term in Presidential Policy Directive-21 of
February 12, 2013 (Critical Infrastructure Security and
Resilience), or any successor.
Sec. 12. General Provisions. (a) This order shall be
implemented consistent with applicable law and subject
to the availability of appropriations. Nothing in this
order shall be construed to provide an agency with
authority for regulating the security of critical
infrastructure in addition to or to a greater
[[Page 11744]]
extent than the authority the agency has under existing
law. Nothing in this order shall be construed to alter
or limit any authority or responsibility of an agency
under existing law.
(b) Nothing in this order shall be construed to
impair or otherwise affect the functions of the
Director of OMB relating to budgetary, administrative,
or legislative proposals.
(c) All actions taken pursuant to this order shall
be consistent with requirements and authorities to
protect intelligence and law enforcement sources and
methods. Nothing in this order shall be interpreted to
supersede measures established under authority of law
to protect the security and integrity of specific
activities and associations that are in direct support
of intelligence and law enforcement operations.
(d) This order shall be implemented consistent with
U.S. international obligations.
(e) This order is not intended to, and does not,
create any right or benefit, substantive or procedural,
enforceable at law or in equity by any party against
the United States, its departments, agencies, or
entities, its officers, employees, or agents, or any
other person.
(Presidential Sig.)
THE WHITE HOUSE,
February 12, 2013.
[FR Doc. 2013-03915
Filed 2-15-13; 11:15 am]
Billing code 3295-F3