With flexibility in mind, NIST unveils latest draft of cyber framework

The new version of the federal Cybersecurity Framework being drafted at the National Institute of Standards and Technology will be "backwards compatible."

The new version of the federal Cybersecurity Framework being drafted at the National Institute of Standards and Technology will be “backwards compatible,” a workshop at the agency’s Gaithersburg, Maryland, headquarters was told Tuesday.

It means organizations already using version 1.0 will be able to seamlessly adopt the new draft, NIST’s Matthew Barrett told attendees.

As a result, he said, there would be less flexibility to tinker with the higher level concepts in the framework, like the five key functions that make up its core: identify, protect, detect, respond and recover. But each function is divided and subdivided and there’s more flexibility to add or delete concepts at those levels, Barrett explained.

Adding or removing is fine, but “moving items to a different place in the conceptual framework” will break most implementations, he said, because companies or other organizations using it will have aligned their business processes with the structure in 1.0.

Nonetheless, attendees of the workshop session — at which Barrett introduced the first draft of version 1.1 and discussed some of the feedback the agency already got from industry and cybersecurity practitioners — heard that some pretty high-level questions would be discussed as part of the drafting process.

One of them, said Barrett, was “should we eliminate the phrase ‘critical infrastructure’ [from the title] to reflect the broader applicability” it now has? he asked.

The document is formally titled Framework for Improving Critical Infrastructure Cybersecurity, but is widely used beyond the 16 industry sectors that the government deems “critical.”

Barrett highlighted several other issues that had received a lot of feedback, including identity management.

“This is daunting but it’s also really important,” he said, noting that the key question was about whether to specifically refer to multi-factor authentication. “Should it be mentioned, should it not?” he said.

Other concerns: whether NIST was trying to cram too many changes in, and whether there should be one more draft before a final version is issued.

Barrett joked about the most controversial proposed change — the addition of a section on measuring cybersecurity outcomes.

“Measurement!” Barrett exclaimed, “Holy Cow! Measurement!” NIST got “A lot of feedback” on that topic, he said. “Certainly many deem it very important.”

Earlier, Marilyn Zigmund Luke, the vice president for special projects at America’s Health Insurance Plans — the trade association for health insurers —echoed the concerns of many business leaders that the use of metrics could become a one-size-fits-all approach.

“The only thing we would caution against is focusing so much on metrics that that somehow becomes the main focus of cybersecurity,” she said. “Metrics are useful for internal implementation, but fixating on them” is not a good idea.

Cybersecurity is “a highly evolving and somewhat volatile area to slap some metrics into,” she said, adding that framework needed to maintain flexibility.

“What we’ve learned from implementing the HIPAA security rule is that companies know their own environments best. … The metrics for one organization may be quite different from the metrics for another organization. … Each company is unique and so setting up a process where you have a standard set of metrics” would not be the best way forward, she said.

“We definitely support not only the current revisions, we look forward to working with NIST, providing them with any assistance or information they need,” in the future, she concluded.

Barrett said drafters had not been “clear enough in our language that we meant the section to be [used] for self-assessment.”

Many business groups had complained that the section could turn into a de-facto cybersecurity score that would have to be shared with regulators and investors — or worse, the general public. This would taint the framework’s risk-based foundation in favor of a compliance mentality where companies would tick the boxes needed to get the best score, but not actually think about how to defend their networks from real, adaptive attackers.

“We have to avoid the compliance-based reading of a risk-based document,” said Barrett.

Why federal cyber defense demands an offense-driven mindset

Static checklists and annual penetration tests leave agencies with dangerous blind spots. True resilience requires moving from reactive attestation to continuous, automated validation.

Sen. Wyden urges feds to discard older, insecure, public-facing VPNs

CISA is rethinking how it prioritizes risks and vulnerabilities for feds, private sector

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure