NIST seeks comment on key cyber guide for agencies

The National Institute of Standards and Technology (NIST) has made major revisions to a key cybersecurity document for agencies, cataloguing principal security safeguards and countermeasures to protect their information systems.

This final public draft of "Security and Privacy Controls for Federal Information Systems and Organizations, Special Publication (SP)800-53, Revision 4," is now online, and the agency is seeking comment. Feedback on the document should be sent to sec-cert@nist.gov by March 1.

"This is by far the most extensive update to our control catalog since it was first published in 2005," said Ron Ross, FISMA Implementation Project leader and NIST fellow, in a statement. "We received and responded to several thousand comments from across the federal government, industry and academia during the initial public comment period and have greatly increased the cybersecurity toolset for our customers as a result."

Recent revisions include new guidance for handling insider threats, supply chain risk, mobile and cloud computing technologies, as well as a variety of cybersecurity concerns: application security, firmware integrity, distributed systems and advanced persistent threat.

The draft also address gaps in threat coverage, increases security control and created new mapping tables to international security standards, while introducing overlays to help agencies develop security plans catered to their mission.

The latest revision was conducted as part of the Joint Task Force Transformative Initiative, which is made up of security experts from NIST, the Department of Defense, the intelligence community and the Committee on National Security Systems.