Joseph Marks | Nextgov | February 16, 2017 | 0 Comments

Why NIST's Framework Avoids a One-Sized-Fits-All Approach to Cybersecurity


The NIST Cybersecurity Framework, a sort of guidebook for good cybersecurity, has been adopted by about 30 percent of U.S. companies since its release three years ago and that number could reach 50 percent by 2020.

Companies’ understanding of the document doesn’t always stretch far beyond its basic principles, however, and the National Institute of Standards and Technology faces a challenge getting companies, federal agencies and other organizations to use the framework in the flexible way it was intended, Matthew Barrett, the framework’s program manager told Nextgov.

“People are conversant about the framework. They might even know five functions [Identify, Protect, Detect, Respond and Recover], but not all of them can go deeper,” Barrett said. “I’m not critical about that. I just look at it as people are still getting their arms around the full value of the framework.”

» Get the best federal technology news and ideas delivered right to your inbox. Sign up here.

NIST is accepting public comments on its first proposed update to the framework, which are due April 10, and expects to release a final update in fall of 2017.

Nextgov caught up with Barrett on the sidelines of the RSA Cybersecurity Conference in San Francisco. The transcript below is edited for length and clarity.

Nextgov: So, what’s new in the updated framework?

Barrett: ‘Proposed updates’ is a key phrase. We’ve tentatively entitled this the ‘draft version 1.1,’ so think of it as a minor revision. But we’ll see what the stakeholders say if it’s minor or not.

Folks wanted to understand the cyber dimension of supply chain risk management, so we really beefed that up in all sorts of different ways. Then, there’s a whole new section on cybersecurity measurement, just trying to establish a basic taxonomy we all can use in the same way we did for cybersecurity outcomes in the framework.

Nextgov: How are people talking about the framework when you come to events like these three years on?

Barrett: If you go out and look at the booths, a lot of products are using the five functions to help people understand the applicability of their products. People understand the framework, so they’re relaying things in framework speak.

People are also beginning to talk about whether organizations need some way to get certified against the framework or to warrant their status relative to the framework.

Nextgov: That’s interesting because the whole idea of the framework is that it’s advisory, not a requirement.

Barrett: The more people think of it as a de facto standard, the more we get into that territory where there’s a tipping point and it becomes a bad thing not to use the framework. I think it’s a healthy part of the ecosystem if something works and is valuable. But another dimension of that, and one that NIST is pretty passionate about, is that things need to remain voluntary.

Or, at least, if framework use is mandated, allow folks the flexibility to use it in ways that optimize it for them. Cybersecurity’s not one size fits all. The framework was developed with that principle in mind.

Nextgov: Are people you meet at RSA talking a lot about what they want to see in the 1.1. version?

Barrett: There are lots of opinions on where the framework should go. There’s a little bit of a warmer, colder game going on with the proposed updates. Did we go far enough with supply chain risk management or did we go too far? Same thing with measurement. It’s a double-edged sword. You put measurement in there and people get a little concerned that maybe the framework might be weaponized if you will.

Nextgov: What does weaponized mean?

Barrett: A regulator looks at it and says: ‘This is excellent. Everyone should be [scoring] 10 in all categories tomorrow.’

Nextgov: Including in industries where scoring a 10 wouldn’t make sense?

Barrett: Yes. To be clear, regulators get a lot of pressure to be clear about their expectations and when they aren’t clear that also has some tension for private-sector organizations. My fear is that they’ll take away the customization dimension of cybersecurity.

Nextgov: Are you concerned that the draft cybersecurity executive order considers requiring NIST framework compliance by agencies?

Barrett: Feds are used to working under this mandatory regime, FISMA [the Federal Information Security Management Act, which agencies are graded against annually] and all the FISMA guidance. Even though the draft [executive order] language doesn’t say, ‘you must use the framework this way,’ I think, because feds are held accountable to FISMA compliance, they’re going to tend to be in that space where they really want to be told what to do precisely. It erodes that customization dimeson of the framework.

Nextgov: What’s the value for NIST in attending conferences like this?

Barrett: The trap for us is becoming a little insular. We want to make sure we’re continually interacting with our colleagues in the private and public sector to understand what the biggest challenges are and how can we help them. That’s one thing these conferences do is just make sure we’re really dialed into what people need. The other thing we’re doing here is we’re educating about our programs, making sure people know there are proposed updates.

Nextgov: Will there be a 1.1 or a 2.0 version a couple years from now?

Barrett: It’s really up to stakeholders. Our plan is to continue asking stakeholders is it time for an update.  


Thank you for subscribing to newsletters from
We think these reports might interest you:

  • Modernizing IT for Mission Success

    Surveying Federal and Defense Leaders on Priorities and Challenges at the Tactical Edge

  • Communicating Innovation in Federal Government

    Federal Government spending on ‘obsolete technology’ continues to increase. Supporting the twin pillars of improved digital service delivery for citizens on the one hand, and the increasingly optimized and flexible working practices for federal employees on the other, are neither easy nor inexpensive tasks. This whitepaper explores how federal agencies can leverage the value of existing agency technology assets while offering IT leaders the ability to implement the kind of employee productivity, citizen service improvements and security demanded by federal oversight.

  • Effective Ransomware Response

    This whitepaper provides an overview and understanding of ransomware and how to successfully combat it.

  • Forecasting Cloud's Future

    Conversations with Federal, State, and Local Technology Leaders on Cloud-Driven Digital Transformation

  • IT Transformation Trends: Flash Storage as a Strategic IT Asset

    MIT Technology Review: Flash Storage As a Strategic IT Asset For the first time in decades, IT leaders now consider all-flash storage as a strategic IT asset. IT has become a new operating model that enables self-service with high performance, density and resiliency. It also offers the self-service agility of the public cloud combined with the security, performance, and cost-effectiveness of a private cloud. Download this MIT Technology Review paper to learn more about how all-flash storage is transforming the data center.


When you download a report, your information may be shared with the underwriters of that document.