Moving Beyond the Why: How to Implement the NIST Cybersecurity Framework

Richard (Rick) P. Tracy is chief security officer and senior vice president at Telos Corporation, a continuous security solutions and services provider. 

It’s been three months since President Donald Trump issued his cybersecurity executive order.  When I chat with agency leaders about embracing the National Institute of Standards and Technology Cybersecurity Framework, mandated by the order, it’s clear that they have accepted the “why,” but are still struggling with the “how.”

When the order was initially released, there was confusion about the differences between the NIST Cybersecurity Framework and the NIST Risk Management Framework and how they could be used together. But now, agencies are looking for guidance on how to get started.

We recently hosted a user group event of 15 federal IT leaders, and the conversation quickly turned to the challenges they face in developing a cohesive, agencywide cyber risk management strategy built upon NIST best practices while maximizing existing investments. The good news is a bunch of great resources and best practices already exist.

What Do We Have to Work With?

Let’s start at the source. NIST has released some fantastic content on implementation and benefits, most notably the NISTIR 8170, “The Cybersecurity Framework: Implementation Guidance for Federal Agencies.”

In my opinion, the beauty of the cybersecurity framework is in its flexibility. Cybersecurity isn’t one-size-fits-all, so our solutions shouldn’t be either. Instead, NIST includes an implementation guide with many real-world examples showing how federal agencies can integrate the cybersecurity framework with their existing risk management framework implementations to achieve greater cyber risk management capability and visibility.

Think of the implementation guide as an instruction manual to the puzzle that is a strong cyber posture. When I asked the NIST program manager for the cybersecurity framework, Matt Barrett, about the thinking behind the document, he reiterated that the goal was to provide agencies with potential use cases they could implement quickly and derive value from.

As it currently stands, the report 8170 provides eight use cases in which federal agencies can leverage the cybersecurity framework to address common cybersecurity-related responsibilities. To illustrate how valuable these use cases can be, let’s dive into one.

Digging Into a Use Case: Report Cybersecurity Risks

I have found that one of the most important benefits of the cybersecurity framework is the core. The core offers a structure and a verbiage that allows cyber risk objectives, outcomes, priorities and status to be communicated effectively throughout an agency using the cybersecurity framework functions: identify, protect, detect, respond and recover. Together, this is essentially the attempt at developing the common language of cybersecurity.

By utilizing use case No. 7, “Report Cybersecurity Risks,” agencies can leverage the Framework Core to empower fast, accurate enterprisewide communication. Specifically, federal agencies are able to map security controls for their assessment and authorization projects to the NIST Cybersecurity Framework subcategories, which map to higher level categories, which in turn feed the five NIST CSF functions. This allows for cyber risk management discussion at different levels of detail, ranging from technical to business/mission.

With this in mind, agencies might begin by mapping security controls to existing system authority to operate. By mapping these controls, agencies can work to find the connection points between NIST’s Risk Management Framework and Cybersecurity Framework, and Special Publication 800-53, the latter of which covers the steps in the risk management framework.

Revealing these connection points and holes is pivotal. This allows agency leaders to understand the cybersecurity framework’s place in their own infrastructure and determine what urgent changes need to be made to maintain agency compliance while bolstering its cyber posture.

It essentially shows the importance of letting cyber risk management take place at the many different levels within an agency—not just in the IT department. This realization that cyber is as important to an agency head as it is to an in-the-weeds IT employee is absolutely pivotal to the success of agency modernization and the future progress of any cybersecurity architecture.

Looking Into the Cybersecurity Framework’s Future

During my aforementioned meeting with 15 agency leaders, I shared use case No. 7 with my audience, and noticed a definite change in their demeanor. Though it was just one very simple way to connect the both frameworks and their existing infrastructure, it was an example they could wrap their minds around. For this group, use case No. 7 revealed not only the true value of the cybersecurity framework, but how it could be applied.

As we move forward with agencies beginning to implement the NIST Cybersecurity Framework, I believe executives and IT employees alike will quickly discover the benefits of it in the same way. The next version of the NIST Implementation Guide, likely coming in the fall, will provide further opportunities to explore what is possible.