NIST Seeks Information on Cybersecurity Framework Experience

In the RFI, NIST seeks to understand public awareness of the Framework, and asks whether the Framework has gained the traction needed to be a factor in how organizations manage cyber risks. NIST also inquires about implementation of the Framework, the benefits and challenges to adoption, and whether some sectors require additional sector-specific guidance prior to use. Overall, the RFI includes nineteen specific questions covering the major areas for which NIST seeks public comment, although NIST welcomes broader comments on the “degree of awareness and voluntary use and subsequent improvement of the Framework.”

The RFI presents another important opportunity for industry to shape the Framework’s direction and guide its development. Whether an organization decides to use the Framework, organizations can expect to see the Framework’s structure and approach to influence cybersecurity-related expectations in board rooms and among policymakers.

The RFI is expected to appear in the Federal Register next week. Upon publication, organizations will have forty-five days to file comments. NIST seeks comments from all critical infrastructure sectors, but also invites submissions from other audiences, including standard-setting organizations, solution providers, other members of industry, and consumers.

For an in-depth analysis of the NIST Cybersecurity Framework, click here.

Authored by Harriet Pearson, Paul Otto, and Jared Bomberg