NIST Requests Comments On Proposed Update To Cybersecurity Framework

The National Institute of Standards and Technology ("NIST") proposed updating its popular cybersecurity standards and practices blueprint for organizations and businesses. The updated Framework for Improving Critical Infrastructure Cybersecurity (the "Framework") ("Draft Version 1.1") includes new provisions for assessing cybersecurity risk posed by third-party vendors, and a new section on measuring the cost-effectiveness of cybersecurity programs. The proposal is NIST's first attempt to update the Framework since it was issued in February 2014 pursuant to President Obama's February 2013 Executive Order 13636, "Improving Critical Infrastructure Cybersecurity." NIST noted that Draft Version 1.1 is informed by feedback from users, responses to its official request for information, and workshop comments that identified certain areas of the Framework that needed refining, clarification and enhancement.