So there's an executive order: Now what?

The day after President Barack Obama announced the cybersecurity executive order in his State of the Union address, agency leaders, interest groups and other stakeholders congregated in Washington to flesh out the logistics of implementing the directive.

Speaking Feb. 13 at the Commerce Department, officials from some of the agencies most closely tied to government cybersecurity efforts outlined early plans for developing, establishing and implementing a cross-sector security framework. They also discussed some of what they believe will be the biggest challenges.

"We must curtail risks while also continuing to foster growth and innovation, and that is a complex challenge for leaders and for experts in the field," said Rebecca Blank, deputy secretary of Commerce. "This challenge cannot and should not be addressed by government alone, and I'm not alone in that belief. Our public- and our private-sector leaders have to work closely together. This is not something that either sector can do by itself. Our message today with this executive order...is that this administration is stepping up to the plate to fulfill what we believe to be pressing issues in this area."

Michael Daniel, White House cybersecurity coordinator, noted that efforts will center on three pillars: information sharing, privacy and standards. Echoing the theme of the day -- public/private partnership -- Daniel highlighted the enormous amount of input from industry and other stakeholders that went into preparing the executive order. But he also acknowledged that there will be major challenges ahead as the massive effort gets under way, including the still-necessary passage of cyber legislation in Congress.

"These are all hard things that are going to take time to get right," Daniel said. "This executive order is a down payment on legislation...not a substitute."

Gen. Keith Alexander, commander of U.S. Cyber Command and director of the National Security Agency, reiterated the call for congressional action.

"A real-time defensive posture for our military's critical networks will require legislation to remove barriers to public and private sharing of [information about] attacks and intrusions in the private-sector networks," Alexander said. "Legislation is also necessary to create incentives for better, voluntary cooperation with cyber standards development and implementation, and to update and modernize government authorities to address these cyber threats. And where appropriate, cyber legislation needs to address industry liability concerns."

Two of the most hotly debated issues in cybersecurity regulation -- privacy and standards -- are singled out in the executive order and will be receiving special attention, officials said.

According to James Cole, deputy attorney general at the Justice Department, a system of safeguards, training and assessments, which will encompass entire government chains of command and be guided by the Federal Information Processing Standard, will help protect privacy and civil liberties.

"We must not lose sight of our commitment to secure individual privacy and civil liberties as we know it," Cole said. "How will we ensure that information received and disseminated under the executive order will be protected consistently with our commitment? We will do so by ensuring that the cybersecurity activities we are conducting are transparent in a manner of guidance and oversight [with] officials trained to safeguard privacy and civil liberties."

The executive order also focuses on the development and implementation of a cybersecurity framework, which the National Institute of Standards and Technology has been charged with overseeing. Patrick Gallagher, undersecretary of Commerce for standards and technology and director of NIST, said the framework's architecture will and must be a collaborative effort with the private sector.

"This framework will belong to industry. We believe that the most effective outcome is one where government will depend on the actions of the private sector, deriving practices to achieve security performance in critical infrastructure," Gallagher said. "More than anything, the framework is a framework for action. If it's theoretical, it won't mean anything."

Gallagher also noted that on Feb. 12 leaders from NIST and the Department of Homeland Security signed a memorandum of understanding to coordinate and align the two agencies' efforts.

"The challenge is making sure these efforts are effective," he said. "Our job is to support your effort with information about the technology, about the threats, about the vulnerabilities -- to share best practices, promote adoption and harmonize the federal efforts. The framework...can help achieve these goals."