Recommendations for NIST Cyber Security Framework (CSF) Workshop 3

Here is my input to the NIST CSF process prior to Workshop 3 (July 10-12 in San Diego).
________________________________________________________________________
Dear workshop attendees:

I hope that you find the following recommendations to be helpful.  Wish I could be there!

Russ
________________________________________________________________________

Recommendations:

1. In my judgement, the five "Cyber Security Functions" described in the July 1 draft are inadequate to support agile and continuously innovative cyber security.  As detailed in this analysis, the five functional categories have serious deficiencies:
• "Know" is too broad and too vague
• "Respond" and "Recover" are too narrow and could be combined
• "Detect" does not adequately cover of Threat Intelligence
• Missing:
• Design & Development
• Resilience
• Execution & Operations
• External Engagement
• Agility & Learning
• Total Cost of Risk
• Responsibility & Accountability
2. Rather than using functional categories which are nothing more than "buckets of content", it would be better to organize the framework around performance dimensions.  This will help make the framework more coherent and better justified.
3. I recommend organizing the framework according to Ten Dimensions of Cyber Security Performance, (slides), which are explained individually the linked posts:
1. Optimize Exposure
2. Effective Threat Intelligence
3. Effective Design & Development
4. Quality of Protection & Controls
5. Effective/Efficient Execution & Operations 
6. Effective Response, Recovery, & Resilience
7. Effective External Engagement
8. Effective Learning & Agility
9. Optimize Total Cost of Risk
10. Responsibility & Accountability
4. I recommend that the framework should explicitly support Double Loop Learning, which is described in these two posts:
• Operational Cyber Security & Single Loop Learning
• Agile Cyber Security and Double Loop Learning
5. I recommend that pilot projects be started right away to design and test inference methods for estimating cyber security performance, as sketched in this post.