User:Shawndouglas/sandbox/sublevel11

4. NIST Special Publication 800-53, Revision 5 and the NIST Cybersecurity Framework

Originally released in 2005, NIST's Special Publication 800-53, Revision 5: Security and Privacy Controls for Information Systems and Organizations has since gone through five revisions. The SP 800-53 cybersecurity standards framework is largely a control framework that "provides a catalog of security and privacy controls for information systems and organizations to protect organizational operations and assets, individuals, other organizations, and the Nation from a diverse set of threats and risks, including hostile attacks, human errors, natural disasters, structural failures, foreign intelligence entities, and privacy risks."

The security controls—which act as recommended safeguards or countermeasures to protecting the integrity and availability of the information system, as well as the privacy and retention of the system's information—are classified by the complexity of and risks associated with the information system, using impact value classifications of "low," "moderate," and "high." Though controls can be applied from just one classification, organizations and agencies are free to select additional controls from other categories and tailor them to their needs and goals.

The controls are organized into 20 different families, and those families can have both baseline controls and control enhancements. The baseline controls are what they sound like: the core controls to be implemented as part of the security family's goal. For example, the first family Access control has a baseline control "AC-2 Account management," which recommends the organization develop a series of account management steps for its information systems. Additionally, "AC-2 Account management" has control enhancements, which can be selectively chosen to bolt on additional requirements to the base control. "AC-2 (3) Account management: Disable accounts" is a control enhancement that further stipulates the system be able to automatically disable certain accounts after a designated period of time.

This guide leans heavily on SP 800-53 despite its mild complexity and due to its thoroughness, keeping in mind ways to present cybersecurity planning from a more neutral, non-governmental organization approach. In fact, at the end of this guide, in Appendix 1, you'll find a somewhat simplified version of mostly "low" baseline controls and control enhancements, with a few select "moderate" and "high" mixed in. However, despite best efforts, some of the wording of those controls—particularly those that directly address networking issues—couldn't be simplified, and the overall collection of controls may still prove daunting to individuals not well versed in the technical language of cybersecurity. In that case, the NIST Cybersecurity Framework may prove a more comfortable framework to work with.

4.1 NIST Cybersecurity Framework

The NIST Cybersecurity Framework is the resulting cybersecurity guidance that came out of 2013's U.S. Executive Order 13636: Improving Critical Infrastructure Cybersecurity. Building off the frameworks of NIST Special Publication 800-53 (Revision 5), COBIT 5, and the ISO 27000 series of standards, the NIST Cybersecurity Framework attempts to be a more high-level, concise, and voluntary framework for those without a rich technical background to better implement cybersecurity measures within their organization.

Version 1.0 of the framework was introduced in 2014, and by 2016:

• Seventy percent of organizations viewed the framework as "a security best practice," though fifty percent noted its required high level of investment as problematic to adoption.
• Sixty-four percent of organizations chose to use only part of the framework "due to cost and lack of regulatory pressures."
• Eighty-three percent of organizations that said they would be adopting the framework in 2017 also indicated they would only use part of the framework.

However, organizations are slowly changing their view from more moment-in-time approaches to cybersecurity, to more long-term and continual conformance and improvement approaches. Version 1.1 of the NIST Cybersecurity Framework was introduced in April 2018, updating guidance on authentication and identity procedures, self-assessment of cybersecurity risk, and vulnerability disclosure. As of March 2023, the NIST continues to update the Cybersecurity Framework, publishing a version 2.0 concept paper in January "to seek additional input on the structure and direction of the Cybersecurity Framework (CSF or Framework) before crafting a draft of CSF 2.0." The authors note the potential for significant changes from version 1.1, including scoping the document to organizations of all sizes, types, and sectors, while also increasing international collaboration and engagement and better reflecting changes in cybersecurity practices. Since the framework is:

• already based upon NIST SP 800-53 and other solid frameworks, with plans to further relate the framework to other NIST frameworks for version 2.0;
• developed "to foster risk and cybersecurity management communications amongst both internal and external organizational stakeholders"; and
• potentially going to see greater international collaboration and engagement among foreign governments and industry for upcoming revisions;

... the framework is likely to be further embraced in some form worldwide.

It should be noted, however, that the framework isn't strictly intended to be a standalone framework; rather it's meant to be customized and used in conjunction with the control, program, and risk frameworks it's based upon. At its core, the NIST Cybersecurity Framework promotes the functions of identification, protection, detection, response, and recovery. Aligned with those functions are nearly 300 controls pulled from the referenced frameworks, reinforcing the related concepts of security control development, project management, and risk management being rooted into the framework.