NIST underscores work on supply chain, metrics and tiers in cyber framework update plan

NIST’s “concept paper” on how to update the landmark cybersecurity framework sets the stage for deep discussions with industry on supply chain security, assessing organizations’ cyber efforts, and further clarification on the use of “tiers,” a core component of the original CSF.

NIST on Jan. 19 issued the concept paper “Potential Significant Updates to the Cybersecurity Framework” and opened a comment period through March 3. Stakeholders from critical infrastructure sectors offered positive initial reviews citing the focus on...