Why NIST's Framework Avoids a One-Sized-Fits-All Approach to Cybersecurity

The NIST Cybersecurity Framework, a sort of guidebook for good cybersecurity, has been adopted by about 30 percent of U.S. companies since its release three years ago and that number could reach 50 percent by 2020.

Companies’ understanding of the document doesn’t always stretch far beyond its basic principles, however, and the National Institute of Standards and Technology faces a challenge getting companies, federal agencies and other organizations to use the framework in the flexible way it was intended, Matthew Barrett, the framework’s program manager told Nextgov.

“People are conversant about the framework. They might even know five functions [Identify, Protect, Detect, Respond and Recover], but not all of them can go deeper,” Barrett said. “I’m not critical about that. I just look at it as people are still getting their arms around the full value of the framework.”

» Get the best federal technology news and ideas delivered right to your inbox. Sign up here.

NIST is accepting public comments on its first proposed update to the framework, which are due April 10, and expects to release a final update in fall of 2017.

Nextgov caught up with Barrett on the sidelines of the RSA Cybersecurity Conference in San Francisco. The transcript below is edited for length and clarity.

Nextgov: So, what’s new in the updated framework?

Barrett: ‘Proposed updates’ is a key phrase. We’ve tentatively entitled this the ‘draft version 1.1,’ so think of it as a minor revision. But we’ll see what the stakeholders say if it’s minor or not.

Folks wanted to understand the cyber dimension of supply chain risk management, so we really beefed that up in all sorts of different ways. Then, there’s a whole new section on cybersecurity measurement, just trying to establish a basic taxonomy we all can use in the same way we did for cybersecurity outcomes in the framework.

Nextgov: How are people talking about the framework when you come to events like these three years on?

Barrett: If you go out and look at the booths, a lot of products are using the five functions to help people understand the applicability of their products. People understand the framework, so they’re relaying things in framework speak.

People are also beginning to talk about whether organizations need some way to get certified against the framework or to warrant their status relative to the framework.

Nextgov: That’s interesting because the whole idea of the framework is that it’s advisory, not a requirement.

Barrett: The more people think of it as a de facto standard, the more we get into that territory where there’s a tipping point and it becomes a bad thing not to use the framework. I think it’s a healthy part of the ecosystem if something works and is valuable. But another dimension of that, and one that NIST is pretty passionate about, is that things need to remain voluntary.

Or, at least, if framework use is mandated, allow folks the flexibility to use it in ways that optimize it for them. Cybersecurity’s not one size fits all. The framework was developed with that principle in mind.

Nextgov: Are people you meet at RSA talking a lot about what they want to see in the 1.1. version?

Barrett: There are lots of opinions on where the framework should go. There’s a little bit of a warmer, colder game going on with the proposed updates. Did we go far enough with supply chain risk management or did we go too far? Same thing with measurement. It’s a double-edged sword. You put measurement in there and people get a little concerned that maybe the framework might be weaponized if you will.

Nextgov: What does weaponized mean?

Barrett: A regulator looks at it and says: ‘This is excellent. Everyone should be [scoring] 10 in all categories tomorrow.’

Nextgov: Including in industries where scoring a 10 wouldn’t make sense?

Barrett: Yes. To be clear, regulators get a lot of pressure to be clear about their expectations and when they aren’t clear that also has some tension for private-sector organizations. My fear is that they’ll take away the customization dimension of cybersecurity.

Nextgov: Are you concerned that the draft cybersecurity executive order considers requiring NIST framework compliance by agencies?

Barrett: Feds are used to working under this mandatory regime, FISMA [the Federal Information Security Management Act, which agencies are graded against annually] and all the FISMA guidance. Even though the draft [executive order] language doesn’t say, ‘you must use the framework this way,’ I think, because feds are held accountable to FISMA compliance, they’re going to tend to be in that space where they really want to be told what to do precisely. It erodes that customization dimeson of the framework.

Nextgov: What’s the value for NIST in attending conferences like this?

Barrett: The trap for us is becoming a little insular. We want to make sure we’re continually interacting with our colleagues in the private and public sector to understand what the biggest challenges are and how can we help them. That’s one thing these conferences do is just make sure we’re really dialed into what people need. The other thing we’re doing here is we’re educating about our programs, making sure people know there are proposed updates.

Nextgov: Will there be a 1.1 or a 2.0 version a couple years from now?

Barrett: It’s really up to stakeholders. Our plan is to continue asking stakeholders is it time for an update.