GAO to NIST advisers: Voluntary nature of cyber framework makes measuring its use an 'inherent challenge'

The Government Accountability Office told an advisory board of the National Institute of Standards and Technology that measuring adoption of the NIST cybersecurity framework is challenging because private-sector use is strictly voluntary.

“One of the issues was the whole fact that this is a voluntary tool,” said the GAO’s Kush Malhotra at a meeting of NIST's Information Security and Privacy Board on Thursday.

The voluntary nature of the framework, however, is a major reason for its widespread support among industry...