What is NIST

The National Institute of Standards and Technology (NIST) is a non-regulatory agency of the U.S. Department of Commerce. You can think of NIST as the science and technology expert for the United States. NIST is responsible for promoting U.S. innovation and industrial competitiveness by developing standards, measurements, and technologies. NIST encompasses many forms of science, but what has taken a more prominent role in the United States and globally is NIST's role in Cybersecurity.

In cybersecurity, NIST is perhaps best known for developing frameworks, guidelines, and publications that many organizations, both public and private, accept as authoritative in managing cybersecurity-related risks. NIST does not regulate or enforce laws (like SOX), but their guidelines have such a reputation for solid research and practicality that they stand as a standard for best practices for security, and serve as the basis for regulatory compliance in some instances.

Important Impacts of NIST to Cybersecurity

NIST provides many resources that are critical to building and maintaining a strong cybersecurity program:

• NIST Cybersecurity Framework (CSF): This is perhaps NIST's most recognizable cybersecurity contribution. The Framework is an entirely voluntary framework, meaning it is intended for everybody regardless of size or sector, that provides organizations with a means of learning to understand, manage, and reduce cybersecurity risk. The framework describes a common language and different structure, made up of five functions:

  • Identify - Understand the organization’s assets, systems, capabilities, and risks.

  • Protect - Put safeguard measures in place to ensure delivery of critical services.

  • Detect - Develop and implement the appropriate activities to identify the occurrence of a cybersecurity event.

  • Respond - Develop and implement the appropriate activities to take action regarding a detected cybersecurity incident.

  • Recover: Develop and carry out suitable activities to sustain plans for resilience and to restore any impaired configurations or capabilities of services due to a cybersecurity incident.

• NIST Special Publications (SPs): These are lengthy documents providing detailed guidance on specific cybersecurity topics. Examples include:

  • NIST SP 800-53: provides a catalog of security and privacy controls for information systems and organizations, primarily for use by federal agencies and contractors.

  • NIST SP 800-63 (Digital Identity Guidelines): provides guidance on identity proofing, authentication, and federation that is very relevant to Identity and Access Management (IAM).

  • NIST SP 800-171: focuses on protecting Controlled Unclassified Information (CUI) in non-federal systems and organizations.

  • NIST SP 800-207 (Zero Trust Architecture): provides guidance on an architecture to work with principles of Zero Trust Access.

Why NIST Standards are Critical for Present Cybersecurity

NIST's frameworks and publications are very useful for organizations who want to mature their cybersecurity posture, properly be able to manage risk, or show due diligence. NIST standards and publications are not only used by the U.S. government but are now the de facto standard for many industries around the world.

Here are the reasons NIST guidance is so valuable for today's world:

• Comprehensive Risk Management: NIST has a structured, systematic approach to identifying, assessing, and managing cybersecurity risk. It encompasses more than just technical controls and also covers governance, processes, and people.

• Best Practices and Guidance: Organizations can benefit from NIST's extensive research and experience on what good security looks like instead of going back to square one. NIST provides a valuable level of credibility to develop a solid foundation of good security practices.

• Compliance Accelerator: While NIST does not set regulation, many regulatory authorities (for instance, the ones associated with HIPAA, GDPR, or many industries) cite or use NIST guidelines as a reference. If an organization is following NIST guidelines, that is a huge step in easing the whole process to achieve and be able to show compliance to a number of compliance mandates.

• Common Language for Stakeholders: While the NIST CSF is particularly known for having a common language for technical teams, business people, and executives to talk about and understand cybersecurity risks and investments, this helps to bring everyone up to the same level of communication when it comes to risks and investments.

• Adaptable and Flexible: NIST Frameworks are adaptable and flexible to organizations of any size, any sector, and adjusting to a changing threat landscape and changing technology (cloud, artificial intelligence).

• Cost-efficient Security: NIST helps organizations help to prioritize security investments based upon the clear and actionable advice provided. Sometimes this can result in more effective use of an organization's resources and return on security investment.

• Promotes Zero Trust Architectures: NIST has been a key promoter and developer of guidance for Zero Trust Access to allow organizations to shift away from many traditional security models to a more innovative and secure security model.

• Guidance for Identity Security: With NIST’s focus on digital identity management (e.g. SP 800-63), NIST provides valuable guidance to protect both human and non-human identities, make sure authentication is strong, and manage the secure and consistent lifecycles of access.

ReShield's next generation identity security platform is designed specifically for NIST's principles. Our Identity and Access Management (IAM), Privileged Access Management (PAM), Identity Governance and Administration (IGA), Identity Security Posture Management (ISPM) solutions support NIST's Identify, Protect, Detect, Respond, and Recover functions. Ultimately, ReShield will enable organizations to achieve and demonstrate okay and adhere the principles [Typo: "demonstrate adherence to the principles"] of Least Privilege Access (LPA), Just-in-Time (JIT) Access, Separation of Duties (SoD), and continuous visibility of all human and machines identities [Typo: "machine identities"] that will provide the best chance to put the NIST framework in place, manage risk, and make compliance workable.