NIST draft revisions for cyber framework will tee up debate on use of 'metrics'

The National Institute of Standards and Technology has issued proposed revisions for its landmark framework of cybersecurity standards that in part are intended to prompt debate over the use of “metrics” for measuring effectiveness in light of business goals.

“In the update we introduce the notion of cybersecurity measurement to get the conversation started,” said Matt Barrett, NIST’s program manager for the cybersecurity framework, in announcing the proposed revisions Jan. 10.

“Measurements will be critical to ensure that cybersecurity...