The National Institute of Standards and Technology is currently moving through a collaborative process to update the NIST Cybersecurity Framework. As a part of this process, NIST hosted the in-person “Journey to the NIST Cybersecurity Framework (CSF) 2.0” workshop on February 22 and 23, 2023, to seek inputs from the community on potential CSF updates. Attendees were expected to be familiar with the CSF, with hands-on experience. Many also participated in a virtual event, Workshop #2, held earlier in February.
The in-person working sessions included six parallel tracks:
- Relationship to Standards and Mappings/Informative References: The relationship and alignment of the CSF to other cybersecurity frameworks, standards and guidelines, as well as how informative references can be updated as they change.
- CSF Core Changes: Potential changes to the Functions, Categories and Subcategories of the CSF Core (minus governance and supply chain cybersecurity topics, which were discussed in separate sessions).
- CSF Guidance and Profiles: Potential updates to guidance on implementing the CSF, including the development of CSF Profiles and implementation of CSF outcomes in each Subcategory.
- Cybersecurity Governance: Potential changes to the CSF to address cybersecurity risk management governance.
- Cybersecurity Supply Chain Risk Management: Potential changes to the CSF to address cybersecurity supply chain risk management.
- Assessment and Measurement: Potential changes to the CSF to address the assessment of cybersecurity risk management, as well as additional guidance on CSF Tiers.
Electrosoft’s CEO, Dr. Sarbari Gupta, served as a facilitator for the “Assessment and Measurement” track during the two-day workshop.
“NIST has done an outstanding job of engaging with the community of CSF practitioners across a broad set of industry sectors to solicit input and feedback. This workshop was a huge success and demonstrates NIST’s commitment to collaboration and transparency as they move forward with the journey to CSF 2.0,” said Dr. Gupta. “I was honored to support the NIST cause and to serve as a facilitator to help promote discussions and draw out thoughts from the community on how the CSF can help organizations measure and progressively improve their risk posture.”
For more information on this important initiative, NIST offers these resources:
- Web page dedicated to the progress toward CSF 2.0
- CSF 2.0 Concept Paper
- RFI analysis
- Workshop #2 recording
- Workshop #1 recording
- Invitation to receive NIST email notifications