NIST's Draft Update To Cybersecurity Framework Focuses On Third-Party Vendors And The Cost-Effectiveness Of Cybersecurity Programs

On January 10, 2017, the National Institute of Standards and Technology ("NIST") released a proposed update to its popular cybersecurity blueprint for organizations and businesses, known as the Framework for Improving Critical Infrastructure Cybersecurity (the "Framework").¹  The updated Framework, titled "Draft Version 1.1," includes, among other things, new provisions for assessing the cybersecurity risk posed by third-party vendors and the addition of a new section on measuring the cost effectiveness of cybersecurity programs.  The proposed changes are NIST's first attempt to update the Framework since it was issued in February 2014 pursuant to President Obama's February 2013 Executive Order 13636, "Improving Critical Infrastructure Cybersecurity."  Based on feedback from users, responses to its official request for information, and workshop comments, NIST has identified certain areas of the Framework that needed refining, clarification, or enhancement.  Draft