U.S. Cybersecurity Agency Seeks Feedback on Draft Plan to Update Cyber Incident Response Framework

The Cybersecurity and Infrastructure Security Agency on Dec. 17 published the draft National Cyber Incident Response Plan, or NCIRP, update for public comment. This update tackles significant changes in cyber operations and policy since NCIRP was released in 2016.

The 2023 National Cybersecurity Strategy requested for an update of the 2016 National Cyber Incident Response Plan. The strategy aims to secure the full benefits of a safe and secure digital ecosystem. The strategy aims to build and improve collaboration around five pillars: invest in a resilient future, defend critical infrastructure, disrupt and dismantle threat actors, shape market forces to drive security and resilience, and forge international partnerships to pursue shared goals.

The NCIRP is a strategic national framework for how federal; private sector; state, local, tribal, and territorial, or SLTT; and international partners collectively address cyber incidents under Presidential Policy Directive. This update responds to changes in the cyber threat landscape, federal law and policy, and new organizational capabilities. The NCIRP sets out the structures that the U.S. government will use to coordinate the response to cyber incidents. It also provides a framework for the potential roles of federal agencies, SLTT government, the private sector, and civil society.

The plan describes four lines of effort: Threat Response, Asset Response, Affected Entity Response Intelligence Support, and Intelligence Support.  Moreover, the plan includes coordination mechanisms, vital decision points, and priority activities across the cyber incident response lifecycle.

Some of the key updates in the draft plan include, a clear path for non-federal stakeholders to partake in coordination of cyber incident response, enhanced usability by streamlining content and aligning to an operational lifecycle, relevant policy and legal changes impacting agency roles and responsibilities and a predictable cycle for future enhancements of the NCIRP.

The public comments are due on or before Jan. 15, 2025.