NIST Updates Cybersecurity Framework (CSF)

Last week, the National Institute of Standards and Technology (NIST) issued a draft update to the Framework for Improving Critical Infrastructure, also known as the “Cybersecurity Framework” or CSF. This Version 1.1 update includes (i) a new section addressing measurement and demonstration of cybersecurity; (ii) considerations regarding Cyber Supply Chain Risk Management (SCRM) added throughout the CSF; and (iii) clarification of existing key terms and concepts.

The proposed additions regarding cybersecurity measurement are intended to “get the conversation started” and help companies map their business outcomes to their cyber risk management practices. The update aims to enable organizations to produce meaningful cyber risk information to use in enterprise-level risk management decisions, which can also be conveyed to dependents, partners and customers as applicable. Supply chain-focused updates are intended to bolster existing sections of the CSF as well as develop a common vocabulary for cyber supply chain risk management across industries and project types.

Version 1.1 of the CSF is intended to be “fully compatible” with the existing Version 1.0. Comments on Version 1.1 must be submitted by April 10, 2017, and NIST intends to publish a final Framework Version 1.1 in the fall of 2017.