1. Home
  2. |Insights
  3. |NIST Updates Cybersecurity Framework (CSF)

NIST Updates Cybersecurity Framework (CSF)

Client Alert | 1 min read | 01.18.17

Last week, the National Institute of Standards and Technology (NIST) issued a draft update to the Framework for Improving Critical Infrastructure, also known as the “Cybersecurity Framework” or CSF. This Version 1.1 update includes (i) a new section addressing measurement and demonstration of cybersecurity; (ii) considerations regarding Cyber Supply Chain Risk Management (SCRM) added throughout the CSF; and (iii) clarification of existing key terms and concepts.

The proposed additions regarding cybersecurity measurement are intended to “get the conversation started” and help companies map their business outcomes to their cyber risk management practices. The update aims to enable organizations to produce meaningful cyber risk information to use in enterprise-level risk management decisions, which can also be conveyed to dependents, partners and customers as applicable. Supply chain-focused updates are intended to bolster existing sections of the CSF as well as develop a common vocabulary for cyber supply chain risk management across industries and project types.

Version 1.1 of the CSF is intended to be “fully compatible” with the existing Version 1.0. Comments on Version 1.1 must be submitted by April 10, 2017, and NIST intends to publish a final Framework Version 1.1 in the fall of 2017.

Contacts

Insights

Client Alert | 3 min read | 05.28.26

PFAS Regulatory Alert: EPA Rolls Back RCRA Proposed Rule on “Hazardous Waste” but Does Not Disturb Proposed RCRA Rule on PFAS

Earlier this month, the U.S. Environmental Protection Agency (EPA) withdrew a February 2024 Biden administration proposed rule, “Definition of Hazardous Waste Applicable to Corrective Action for Releases From Solid Waste Management Units,” under the Resource Conservation and Recovery Act (RCRA).[1] The withdrawn proposal would have revised RCRA corrective action regulations to expressly apply the broader statutory definition of “hazardous waste,” rather than only the narrower regulatory definition. Now, EPA is maintaining the status quo for corrective action under RCRA. However, EPA’s withdrawal of its proposed RCRA hazardous waste definition makes no mention of its corresponding proposal from 2024 to list nine per- and polyfluoroalkyl substances (PFAS) as RCRA hazardous constituents.[2] This disjointed withdrawal, while providing some certainty for regulated entities, does not resolve how EPA plans to address PFAS under the RCRA program....

View All Insights