The NIST Preliminary Cybersecurity Framework

In late October, the U.S. National Institute of Standards and Technology (NIST) released its Preliminary Cybersecurity Framework.  Although a U.S. standards-setting body, NIST is influential and is looked to as a trendsetter in security, cloud computing and other IT standards.

This Framework is voluntary and provides guidance on managing cybersecurity risk for operators of critical infrastructure (e.g., power generation, transportation and telecommunications). President Obama directed that the Framework be developed to encourage these operators to manage cybersecurity risks with as much rigour as they manage financial, safety and operational risks.  This is a recurrent theme in recent thinking about cybersecurity.