Follow @InsideCyber for full coverage of @RSAConference next week. @SaraEFriedman will provide exclusive reports from San Francisco.

“The CSF provided a defensible rationale for investments in cybersecurity as we could connect a budget line item to a goal associated with a specific function," said Ola Sage of CyberRx.

On supply chain, NIST's Pascoe said, stakeholders emphasized how the focus should not just be on supplier risk but also contract management. @NISTcyber

“We are at an inflection point regarding the sharing of information that could impact the lives of millions of people. Are we equipped & ready to share information broadly enough? Is the right information reaching those who need it most, in sufficient time?” @SecMayorkas @DHSgov

Two electric sector groups are receptive to working with the Federal Energy Regulatory Commission to set up a vendor cyber certification and accreditation effort as a way to secure supply chains, according to recent filings with the commission. @publicpowerorg @AEPnews @FERC

Pentagon has updated its cybersecurity reference architecture to address mandates from the 2021 cyber executive order with a focus on zero trust. @DeptofDefense #ZeroTrust

National Security Telecommunications Advisory Committee is offering proposals to harmonize federal cyber regulations including a new office within CISA and to encourage consistent procurement language across agencies. #cybersecurity

Bill by Sens. John Hickenlooper & Shelley Moore Capito would establish a Commerce Dept working group to “improve communication over #cybersecurity insurance coverage levels,” addressing potential confusion over what’s covered in cyber insurance policies. @Hickenlooper @SenCapito

“I believe deeply that regulated entities should not choose their regulator. Unfortunately, that is the exact intent of the past 15 months of false and misleading attacks on my record and my character."

Report from @USTelecom finds strong “cybersecurity culture” is a difference-maker in fending off attacks and especially beneficial for small & mid-sized businesses, with entities in the IT, communications and financial services sectors scoring highest on a cyber culture “index.”

Cheri Pascoe of @NISTcyber says third CSF 2.0 workshop will be in the fall. Between now & then, NIST has a "concept paper" on the cybersecurity framework out for comment until March 3. Next up will be a draft version of 2.0 and a comment period on that document.

Locascio’s opening remarks provided context on how CSF fits into the agency’s mission, followed by a short speech by Deputy Commerce Secretary Don Graves. @NISTcyber @CommerceGov

"Frequent communications, education and training are critical elements of a robust cybersecurity strategy--and can make a significant, often defining difference for ventures large and small." @USTelecom @rhmcyber

“CISA has a remarkable opportunity with [Cyber Performance Goals] to tie them to NIST standards and provide small businesses with valuable information on what they can do to improve security.” @JoshMagri @CyberRiskInst @NISTcyber @CISACyber

The 5 functions in the CSF could be expanded to include supply chain, stakeholders said, while also making suggestions on how to add more supply chain detail in the “Identify” function of the framework. @NISTcyber @CyberRiskInst @cloudsa @SchneiderNA