NIST’s cybersecurity framework is changing -- what you should know

On April 10, the comment period closes for the National Institute of Standards and Technology revised Framework for Improving Critical Infrastructure Cybersecurity (a.k.a. NIST cybersecurity framework). The framework was initially published in February 2014 as the result of a presidential executive order. Its main objective was and is to provide “a set of industry standards and best practices to help organizations manage cybersecurity risks.” Although the framework is voluntary, many private- and public-sector organizations have adopted or will adopt it, especially with President Donald Trump’s recent draft executive order.

While the NIST framework is not the perfect be-all and end-all for cyber risk management, it does provide organizations and the industry at large with a common language and basis against which to assess and continually improve their programs.

A few functional changes stand out in the revised version of the framework. The first, which should really be the starting point for any comprehensive cyber risk management program, is an entirely new section about measuring the performance and maturity of organizations’ cyber risk programs. It also discusses the need and complexity of correlating those metrics to business objectives and outcomes. That means measuring both how organizations are reducing risk to the business and identifying the benefits to the business resulting from good cybersecurity, such as how many new customers the organization has gained and/or how much more revenue was brought in.

In just about every other aspect of enterprise management, measuring success based on impact on business objectives and outcomes is not a novel concept. Due to the challenges of measurement and correlations in cybersecurity, however, accurately measuring how much risk was reduced or how much an organization gained due to strong cyber risk management is almost considered the holy grail. 

Historically, the benefits of effective cyber risk management have been measured qualitatively -- not getting breached, staying out of the headlines, etc.  The best quantitative attempts to date to measure the impact of cyber risk on business have primarily been based on limited statistics and expert-based guestimates that do not take into account events on the ground like threats and vulnerabilities actually detected in the environment. 

If measurement is included in the framework, it will mark a significant change in the industry. It will encourage organizations to map numbers to actions and enable more effective decision making at all levels. It would be instructive for future NIST cybersecurity framework revisions to include more specific guidelines around how to measure business outcomes, despite that, as  version 1.1 says, it is often difficult to do. For example, it would be helpful if the framework explained how to best measure and reflect the reduction in business risk associated with the other functional provisions.

Another significant change in the framework is the addition of recommendations surrounding supply-chain risk management. Third-party risk management has been on the radar for a while now, but version 1.1 outlines the need for organizations’ entire supply chain to be secure. That includes, of course, third-party vendors and their employees, but also adds outsource providers, data storage providers, lower-tier suppliers and the actual products themselves.  For example, the framework helps ensure that a company’s suppliers follow secure practices so that products purchased as components of the company’s finished product do not come with malware already installed.  The NIST framework now includes a section about vetting all companies, people and products in the supply chain.  It’s not just about building better security around the companies and people who work for them; it’s also about securing products and services those parties are providing. The change fills an important gap related to third-party risk management.

Finally, the access-control category has changed within the framework. It was renamed to identity management and access control. The change adds more focus on making sure identities and credentials are managed from the time they are created to the time they are deactivated. For example, making sure user S. Grossman is really Steven Grossman; confirming it’s really Steven using the credential; and ensuring when Steven leaves the company, the credential is changed or deactivated.  This change is also a positive step toward providing more direction around  control over who is accessing what assets and ensuring the person is who he is supposed to be.  It also helps protect against insider threats, an area that could use more specific call outs in the next revision.

Version 1.1 is a good improvement that expands and deepens the framework’s coverage by measuring cyber risk reduction, ensuring secure practices across the supply chain and tightening controls around identity and access management.  

The NIST cybersecurity framework is high level enough that it is applicable for stakeholders and organizations across the board. If followed correctly, it sets up a solid cybersecurity foundation that, if the revisions are incorporated, guides organizations to making sure they are hitting all the bases.  The devil is in the details, so it is important to recognize it as the starting point, not the end of the road.  There are other frameworks, by NIST and other standards bodies, that drill down into execution. However, it would be beneficial to have both recommendations and execution in one standard framework.  We’ll see which changes are adopted next fall when the final version is expected to be released.