NIST compliance can be a bit complicated, and we are here to help you break down what it really means. NIST stands for the National Institute of Standards and Technology, a non-regulatory government agency that traditionally develops standards and guidelines to protect information of federal agencies. They have developed a framework for cybersecurity to provide guidance on how to better protect data.
What is NIST 800-171?
NIST 800-171 is a special publication aimed at “protecting controlled unclassified information (CUI) in nonfederal information systems and organization.” The framework is designed to limit breaches in federal data by better protecting the confidentiality of information systems operated by non-federal organizations or contracted agencies that are not under other safeguarding requirements to protect CUI. With threats to cybersecurity, NIST frameworks are necessary and useful for keeping important information safe.
Do You Need to Follow NIST 800-171?
If you are a federal contractor with access to CUI, you must comply with this framework. In many cases, it will be directly prescribed in your contract.
How Do You Know What is Considered CUI?
If you do work as a contractor or sub-contractor for the federal government, it is extremely likely that you have access to some controlled unclassified information (CUI) and need to follow NIST compliance. There are dozens of categories of CUI encompassing information from all federal agencies that may not be formally “classified” but still require extensive measures of protection.
How do You Comply With NIST 800-171?
- First, you will need to read the standard from start to finish. Make sure you understand what your responsibilities are to protect the CUI’s confidentiality.
- The extensive standard is made up of 14 security objectives. The 14 security objectives are: Access Controls, Awareness and Training, Audit and Accountability, Configuration Management, Identification and Authentication, Incident Response, Maintenance, Media Protection, Physical Protection, Personnel Security, Risk Assessment, Security Assessment, System and Communications Protection and System and Information Integrity.
- Within each of these objectives comes a number of different requirements. Your primary responsibility for compliance will be finding a satisfactory solution for each requirement that best suits your agency and its work.
What is the NIST Cybersecurity Framework?
In addition to the obligatory NIST 800-171 framework, NIST has also developed the voluntary Cybersecurity Framework. It is a set of standards, guidelines and best practices for the management of cybersecurity risk. It is designed to be cost-effective and flexible with the goal of promoting the protection of critical data in various sectors of the economy.
It consists of 5 main pillars: Identify, Protect, Detect, Respond and Recover. The framework was created as guidance that can be adapted for use across many industries. It is an excellent resource for those who may not be obligated to NIST compliance but are still looking to improve their agency’s cybersecurity system.
5 Core Functions of the NIST Cybersecurity Framework (CSF)
Identify – A foundational aspect of the framework to manage the risks to assets, data, systems, people, and capabilities. Identification provides the context for the resources that support critical functions and the risks that organizations face.
Protect – Proper protection limits the potential damage of cyber attacks and malicious software through initiatives such as access control, identity management, data security, information protection, protective hardware/software, and staff awareness training.
Detect – Software and personnel monitoring a system must be able to detect a cybersecurity event in progress. If caught in time, they can close access to limit the degree of damage or data theft.
Respond – The impact of a cybersecurity event should be contained as thoroughly as possible. This core function also includes response planning, how the incident is communicated, analysis of the event, and improvements made to prevent a repeat incident.
Recover – This function supports a timely return to normal operations after a cybersecurity incident. It may include restoring data & systems from backups, replacing compromised hardware, and communicating with those affected.
Expert Cybersecurity Support
NIST compliance for the 800-171 Special Publication is daunting and complex. Whether you need a hand achieving NIST cybersecurity compliance or just generally want to learn to better protect your company’s data, contact us today for a consultation to see how our team can help.
