April 16, 2018 Cybersecurity Framework Version 1.1 Acknowledgements This publication is the result of an ongoing collaborative effort involving industry, academia, and government. The National Institute of Standards and Technology (NIST) launched the project by convening private- and public-sector organizations and individuals in 2013. Published in 2014 and revised during 2017 and 2018, this Framework for Improving Critical Infrastructure Cybersecurity has relied upon eight public workshops, multiple Requests for Comment or Information, and thousands of direct interactions with stakeholders from across all sectors of the United States along with many sectors from around the world. The impetus to change Version 1.0 and the changes that appear in this Version 1.1 were based on:      Feedback and frequently asked questions to NIST since release of Framework Version 1.0; 105 responses to the December 2015 request for information (RFI), Views on the Framework for Improving Critical Infrastructure Cybersecurity; Over 85 comments on a December 5, 2017 proposed second draft of Version 1.1; Over 120 comments on a January 10, 2017, proposed first draft Version 1.1; and Input from over 1,200 attendees at the 2016 and 2017 Framework workshops. In addition, NIST previously released Version 1.0 of the Cybersecurity Framework with a companion document, NIST Roadmap for Improving Critical Infrastructure Cybersecurity. This Roadmap highlighted key “areas of improvement” for further development, alignment, and collaboration. Through private and public-sector efforts, some areas of improvement have advanced enough to be included in this Framework Version 1.1. NIST acknowledges and thanks all of those who have contributed to this Framework. This publication is available free of charge from: https://doi.org/10.6028/NIST.CSWP.04162018 iv