How Does the NIST Cybersecurity Framework Evolve?

TL;DR

The NIST Cybersecurity Framework helps organizations manage cyber risk by organizing existing standards and best practices around practical outcomes. Its voluntary, flexible structure is intended to support cost-effective adoption, clear communication with business leaders, international use, continuous improvement, stronger privacy considerations, and eventual industry ownership as stakeholders identify gaps and shape future versions.

Transcript

One of the biggest events in 2014 has been the issuance of the cybersecurity framework issued by the White House. And joining us today is the point man on that framework, Adam Sedgwick, who's a senior advisor at the Information Technology Laboratory of the National Institute of Standards and Technology. Welcome, Adam. Thanks for having me today, Er... Read More

Key Insights

• The framework is a collection of cybersecurity standards and best practices designed to help critical infrastructure organizations manage risk. It was developed through an open process convened by NIST in response to Executive Order 13636 on improving critical infrastructure cybersecurity.
• Stakeholder participation shaped the framework from its early drafts through the final version. Organizations therefore understood its direction before release, and both potential users and technology providers began considering how their practices, tools, and capabilities could align with its approach to cyber risk.
• The framework focuses on security outcomes instead of prescribing a single implementation method. This design gives organizations room to select approaches that are cost-effective, appropriate to their business needs, and consistent with the risk management decisions they already need to make.
• The framework translates technical standards into concepts that business leadership can understand. Its accessible structure is not intended to remove technical depth, because the foundation still consists of established standards, practices, and technologies used to manage cybersecurity risk.
• Voluntary participation does not make the framework weak, according to NIST. A voluntary, market-oriented approach can support effective solutions while preserving flexibility, organizational growth, and the ability of multinational businesses to address requirements in different countries.
• The framework has international relevance because it references international standards and reflects practices already used by multinational organizations. Its open and transparent development process also allows other countries and governments facing similar challenges to understand and potentially use its structure.
• Version 1.0 establishes continuous improvement as a central principle. Cybersecurity is not treated as a problem that disappears after a single project, but as an organizational risk that requires ongoing management, evaluation, and adjustment as needs and technologies change.
• Privacy is an important area for further development because security and privacy responsibilities are often handled by different groups. The framework introduces privacy considerations for activities such as training and monitoring, while the roadmap identifies a need for additional tools, capabilities, and privacy-enhancing technologies.

Questions & Answers

Q: What is the NIST Cybersecurity Framework designed to do?

The NIST Cybersecurity Framework is designed to help organizations manage cybersecurity risk by identifying useful standards and best practices across industry and critical infrastructure. It focuses on outcomes that organizations should pursue while allowing them to determine how best to achieve those outcomes. The structure is intended to make cybersecurity practices easier to understand, adopt, communicate, and improve.

Q: Why was the NIST Cybersecurity Framework created?

The framework was developed in response to Executive Order 13636, which addressed improving critical infrastructure cybersecurity. The administration recognized that organizations faced meaningful vulnerabilities and difficulties managing cybersecurity risk. NIST was tasked with convening an open process, working with industry, and clarifying the standards and practices that could help organizations begin or strengthen their cybersecurity programs.

Q: How did industry stakeholders influence the cybersecurity framework?

Industry and critical infrastructure stakeholders participated throughout the framework's development. NIST shared drafts, held conversations with intended users, and based the final structure on their contributions and expectations. This continuing involvement meant that stakeholders generally knew what the final version would contain, while organizations and technology providers could begin considering how their practices and tools fit within it.

Q: How does the framework address implementation costs?

The framework addresses cost by concentrating on desired cybersecurity outcomes rather than requiring one fixed implementation method. Organizations can evaluate which approaches are cost-effective and sensible for their own business needs. NIST presents this flexibility as part of risk management, allowing each organization to recognize its current position, identify improvements, and choose investments that match its circumstances.

Q: Why is the cybersecurity framework described as voluntary?

The framework is voluntary so organizations and the market can determine which approaches best fit their needs. NIST argues that voluntary does not mean weak. The voluntary structure allows flexibility, supports growth, and helps organizations with global operations use practices that can conform with requirements across different countries while still pursuing effective cybersecurity risk management outcomes.

Q: How can the framework improve communication with business leaders?

The framework presents cybersecurity concepts in language that can be understood beyond highly technical teams. Stakeholders reported that many technical standards made sense to specialists but were difficult to translate across an organization or explain to business leadership. By organizing established standards and practices around understandable outcomes, the framework helps technical and business participants discuss cybersecurity needs using a shared structure.

Q: How will future versions of the framework be developed?

Future versions will be shaped by stakeholder experience as organizations adopt and use version 1.0. Practical use is expected to reveal gaps and areas requiring improvement. NIST plans to continue stakeholder conversations, use the companion roadmap to guide work on unresolved subjects, and explore governance models that could eventually give industry greater ownership over later versions.

Q: How does the framework account for privacy risks?

The framework introduces privacy considerations that organizations should examine while building or improving cybersecurity programs. These considerations include activities such as training and monitoring, which could create new privacy risks if handled poorly. NIST also identifies privacy as an area needing further work, including workshops and exploration of tools, capabilities, and privacy-enhancing technologies that stakeholders can use.

Summary & Key Takeaways

• Developed in response to Executive Order 13636, the framework identifies standards and best practices that organizations can use to manage cybersecurity risk. NIST convened an open process with industry and critical infrastructure stakeholders, sharing drafts and incorporating feedback so the final structure reflected the needs of organizations expected to use it.

• The framework focuses on desired security outcomes while allowing organizations to choose suitable implementation methods. NIST argues that this flexibility supports cost-effective decisions, clearer communication between technical teams and business leaders, and adoption across organizations of different sizes, sectors, business needs, and levels of cybersecurity maturity.

• Version 1.0 is presented as the beginning of a continuing process rather than a permanent solution. Stakeholder experience will reveal gaps, privacy work will explore better tools and capabilities, and future governance may shift toward industry while NIST concentrates more on research, development, and supporting standards mechanisms.