NIST publishes feedback from all levels of government on its cybersecurity framework

This week, the National Institute of Standards and Technology published an analysis of invited comments for its Cybersecurity Framework.

NIST’s December 2015 Request for Information on the Cybersecurity Framework called for comments on using the framework to improve cybersecurity risk management, sharing best practices, and long-term governance of the framework.

In its Analysis of Cybersecurity Framework RFI Responses, NIST identified 10 recurring themes among the responses and provides an explanation of each, along with associated key terms and example responses.

“We received 105 comments from a diverse group that included local, state national and international governments, a cross section of the critical-infrastructure community, and a number of other types of organizations,” said Matthew Barrett, NIST’s program manager for the Cybersecurity Framework. “The responses actually represent thousands of organizations because a large number of industry organizations submitted comments on behalf of all of their member companies.”

While perspectives varied on whether it would soon be time for a framework update, respondents agreed on the need for a collaborative update process, similar to the initial development process, and with minimal disruption to current industry use, as explained in the document. Some commenters said the focus should be on clarifying use of the framework, in particular for supply chain risk management and when using implementation tiers.

Respondents discussed the relationship between the framework and regulatory requirements. For example, respondents discussed the possibility that it could enable multiple regulatory agencies to align diverse requirements in the regulatory process. But respondents also called for “caution against the potential for regulation to add burdens on their organizations,” according to the analysis.

Other themes focused on sharing additional information about framework use and best practices. Respondents requested more guidance on framework implementation, particularly for small- and medium-sized businesses. Another theme covered the need for continued international alignment and harmonization of cyber security standards. All RFI responses are available publicly.

The Cybersecurity Framework emerged in February 2014 due to a Presidential Executive Order. The goal of the framework is to minimize risks to critical infrastructure in the United States, such as the transportation, banking, water and energy sectors. The executive order directed NIST to work with stakeholders across the country to develop the voluntary framework based on existing cybersecurity standards, guidelines and best practices.

NIST notes that its next upcoming Cybersecurity Framework Workshop 2016, that will continue conversation with stakeholders, will be held at NIST’s Gaithersburg, Md., campus from April 6 and 7. Registration for the event closes March 30, 2016.

Article Topics

biometrics  |  cybersecurity  |  NIST  |  risk mitigation  |  standards