The National Institute of Standards and Technology is asking for comments on the final draft of what it calls a “major federal cybersecurity document,” the agency announced.
The document, Security and Privacy Controls for Federal Information Systems and Organizations, Special Publication (SP) 800-53, Revision 4 , is considered the principal catalog of security safeguards and countermeasures that federal agencies use to protect information systems.
“This is by far the most extensive update to our control catalog since it was first published in 2005,” said Ron Ross, NIST fellow and Federal Information Security Management Act implementation project leader. “We received and responded to several thousand comments from across the federal government, industry and academia during the initial public comment period and have greatly increased the cybersecurity toolset for our customers as a result.”
The document, two years in the making, adds new guidance for handling insider threats, supply chain risk, mobile and cloud computing technologies and other cybersecurity issues and challenges in this latest draft.
According to NIST, other areas addressed in the update include application security, firmware integrity, distributed systems and advanced persistent threat. The revised SP 800-53 also contains a new appendix of privacy controls and related implementation guidance based on the internationally recognized Fair Information Practice Principles.
This revision was conducted as part of the Joint Task Force Transformation Initiative, comprising security experts from NIST, the Department of Defense, the Intelligence Community and the Committee on National Security Systems, NIST said.
Comments on the revision should be sent to sec-cert@nist.gov by March 1, 2013.
Sp800 53 r4 Draft FpdSecurity and Privacy Controls for Federal Information Systems and Organizations by
