National Institute of Standards and Technology (NIST)

The NIST cybersecurity also termed as NIST Framework for Improving Critical Infrastructure Cybersecurity expects private organizations to provide a structure that assesses and improves their capabilities in the prevention, detection, and response to cyber incidents. NIST first prepared the first program in 2014 for critical infrastructures operators. According to Mell and Grance (2011), the NIST framework has three sections: framework core, implementation tiers, and the framework profile. One element that the NIST framework requires is the ability of private organizations to understand their environments by having full visibility of both physical and digital assets.

The assets require protection from potential cybersecurity events by training employees, securing data and maintaining configurations. The third element is introducing measures to detect which is a prevention strategy for ICS networks. The last element is response and recovering any impaired configurations through plans. The Federal Information and Information Systems have set the minimum security requirements through the Federal Information Processing Standards 200. According to the National Institute of Standards and Technology (2013), the FIPS 200 is brief and contains approximately 17 security areas that the federal agencies require organizations to meet. However, these requirements are covered in depth in the NIST Special Publication 800-53. 

The requirements include: access control; planning; environmental and physical protection; media protection; maintenance; incident response; authentication and identification; contingency planning; configuration management; certification, accreditation, and security assessments; audit and accountability; awareness and training; system and Information Integrity; System and Communications Protection; System and Services Acquisition; System and Services Acquisition; and personal security. The implementation of the FIPS 200 is accomplished by meeting the 17 standards provided by the NIST Special Publication 800-53. The federal agencies require organizations to conduct annual reviews to ensure they identify what they learned, changes in the security requirements, and available security technologies. 

References

Mell, P., & Grance, T. (2011). The NIST definition of cloud computing.National Institute of Standards and Technology (NIST) (2013). Security and Privacy Controls for Federal Information Systems and Organizations. National Institute of Standards and Technology (NIST).