National Cybersecurity Center of Excellence

The NCCoE is part of NIST, a non-regulatory federal agency within the U.S. Department of Commerce that develops measurement standards and conducts research in measurement science. According to the NIST website,[6] the Federal Information Security Management Act of 2002 (FISMA) "reaffirmed NIST's role of developing information security standards (Federal Information Processing Standards) and guidelines for non-national security federal information systems and assigned NIST some specific responsibilities, including the development of: Standards to be used by Federal agencies to categorize information and information systems based on the objectives of providing appropriate levels of information security according to a range of risk levels; Guidelines recommending the types of information and information systems to be included in each category; and Minimum information security requirements (management, operational and technical security controls) for information and information systems in each category." Many private sector organizations voluntarily adopt these standards, guidelines and security requirements. As a NIST center, the NCCoE is an applied space for the demonstration of standards-based approaches to cybersecurity.

President Barack Obama issued Executive Order 13636,[7] "Improving Critical Infrastructure Cybersecurity", in February 2013 tasking NIST to create a cybersecurity framework that helps organizations mitigate risks to the nation's essential systems such as power generation and distribution, the financial services sector, and transportation. NIST released the Framework for Improving Critical Infrastructure Cybersecurity[8] in February 2014, which "consists of standards, guidelines and practices to promote the protection of critical infrastructure." The NCCoE demonstrates how the framework can be implemented in real-world environments.[9] When an industrial sector approaches the center with a cybersecurity problem, the center maps the solution's hoped-for capabilities to the Cybersecurity Framework, as well as to other standards, controls and best practices.

The NCCoE's launch was formally announced on February 21, 2012, by U.S. Senator Barbara Mikulski (D-Md.), Maryland Lt. Governor Anthony Brown, Montgomery County Executive Isiah Leggett and Under Secretary of Commerce for Standards and Technology and NIST Director Patrick D. Gallagher. NIST issued a press release the same day stating that the center was created to "work to strengthen U.S. economic growth by supporting automated and trustworthy e-government and e-commerce." The NCCoE will "host multi-institutional, collaborative efforts that build on expertise from industry and government", according to the press release.

In September 2014, the National Institute of Standards and Technology (NIST) awarded a contract to the MITRE Corporation to operate the Department of Commerce's first Federally Funded Research and Development Center (FFRDC), the National Cybersecurity FFRDC, which supports the NCCoE. According to the press release on the NIST website,[10] "this FFRDC is the first solely dedicated to enhancing the security of the nation's information systems." The press release states that the FFRDC will help the NCCoE "expand and accelerate its public-private collaborations" and focus on "boosting the security of U.S. information systems." "FFRDCs operate in the public interest and are required to be free from organizational conflicts of interest as well as bias toward any particular company, technology or product—key attributes given the NCCoE's collaborative nature…The first three task orders under the contract will allow the NCCoE to expand its efforts in developing use cases and building blocks and provide operations management and facilities planning."

The partners that founded the NCCoE are the National Institute of Standards and Technology (NIST), the state of Maryland and Montgomery County. This partnership was instrumental in establishing the center as a nationally recognized cybersecurity resource that has the potential to increase the number of local cybersecurity companies, local workforce development and provide local companies with exposure to NIST's expertise.[4]

National Cybersecurity Excellence Partners (NCEPs) offer technology companies the opportunity to develop long-term relationships with the NCCoE and NIST. As core partners, NCEPs can provide hardware, software, or personnel who collaborate with the NCCoE on current projects.[4]

Sector representatives approach the NCCoE on behalf of their industry to share business problems that can be solved through a cybersecurity solution. These representatives can also provide insight during the project build process and help validate the center's approach to developing an example solution.[11]

Members of government agencies and academic institutions can discuss their cybersecurity challenges with the NCCoE, provide insight and feedback on existing center projects, or collaborate with technology companies in the center's labs.[11]

Other users, such as businesses working to improve their cybersecurity, have the opportunity to test the NCCoE's example solutions, evaluate their effectiveness, and provide feedback.[11]