NIST Seeks Industry Input On Significant Updates To Cybersecurity Framework For Protecting Organizations And Critical Infrastructure

The National Institute of Standards and Technology ("NIST") has released a Concept Paper document setting out significant updates to its Cybersecurity Framework ("CSF"). First released in 2014 (and now styled "CSF 1.0"), the CSF is designed to assist organizations with understanding "the characteristics of their approach to managing cybersecurity risk" by identifying risk tolerances and business requirements in order to achieve cybersecurity objectives. The CSF was updated in 2018 ("CSF 1.1") and, through its Concept Paper, NIST is conducting a comprehensive review to update and establish "CSF 2.0".

The Canadian Centre for Cyber Security ("CCCS")—the Government of Canada's single, unified source of expert advice and support on cyber security for critical infrastructure operations and the private sector—recommends the CSF as one potential mechanism to enhance organizational cyber security. In its "path to enterprise security", the CCCS notes that the CSF is widely