Skip to content
Schedule a Call
Call Now

What are the new NIST cybersecurity guides?

Article by Tsaaro

7 min read

The NIST cybersecurity framework helps organize and improve cyber vulnerabilities. It is a set of rules and best practices to assist businesses in developing and enhancing their cybersecurity posture. The framework offers a set of standards and suggestions that help companies be better equipped to recognize and stop cyberattacks. It also offers instructions regarding how to respond to, stop, and rebuild from cyber disasters.

The National Institute of Standards and Technology (NIST) developed this framework to address the lack of cybersecurity standards and to give companies across industries a consistent set of rules, guidelines, and standards. The gold standard for developing a cybersecurity program is generally regarded as the NIST Cybersecurity Framework (NIST CSF). The framework can be useful since it serves as the highest security management solution that makes it easier to evaluate cybersecurity risk throughout the business, regardless of whether you’re just starting to build a cybersecurity program or are already managing a very established program.

The NIST Cybersecurity Framework: Why Use It?

Let’s first look at the bigger picture and make a list of the cybersecurity concerns that are likely on everyone’s mind.

· Unknown dangers and weaknesses.

· No precise list of the things that must be safeguarded.

· Lack knowledge of cyber risk and do, not “own” necessary mitigating tasks

 

The framework can assist you in overcoming these obstacles. You’ll be able to benefit from what others have learned after successfully tackling issues similar to yours. The framework’s goal is to assist you in prioritizing cybersecurity investments and choices. The framework offers a platform for discussions with stakeholders, such as your high-ranking management and the board of directors, and aids in your ability to analyze the development of your program.

NIST Updates Cybersecurity Guidelines.

The National Institute of Standards and Technology (NIST) has upgraded its cybersecurity recommendations for the health care industry to aid affirm health care in protecting individuals’ sensitive health information.

Incorporating the Health Insurance Portability and Accountability Act (HIPAA) Security Rule: A Cybersecurity Resource Guide (NIST Special Publication 800-66, Revision 2) is the formal title of NIST’s

new draft publication, which would be meant to help guide the industry in safeguarding the privacy, security, and accessibility of electronically protected health information or ePHI. The phrase refers to a broad range of patient information, such as scripts, laboratory results, records of hospitalization, and routine vaccination records.

Federal legislation known as the Health Insurance Portability and Accountability Act of 1996 (HIPAA) mandates the development of national standards to prevent the disclosure of confidential patient health information without the patient’s consent or awareness. Although NIST does not produce regulations to carry out HIPAA, the updated proposal is in line with NIST’s mandate to offer cybersecurity advice. The U.S. Department of Health and Human Services has reported an increase in cyberattacks affecting the provision of healthcare, therefore NIST’s new guidance is especially pertinent at this time.

Until September 21, 2022, NIST is accepting comments on the proposed release.

The version was created by NIST in part to connect it with previously unpublished NIST cybersecurity guidance. Since then, NIST has created the well-known Cybersecurity Framework and continuously updated its set of Security and Privacy Controls, which businesses can utilize to create custom risk management strategies. These and other NIST cybersecurity resources are specifically mentioned in the new HIPAA Security Rule guideline document.

The amended draft’s Appendix F – HIPAA Security Rule Resources may be the most helpful new addition. Even though these categories cover several fundamental and broad terms of facts such as

– Risk Assessment/Risk Management,

– Education, Training & Awareness,

– Protection of Organizational Resources and Data,

– Equipment and Data Loss,

– Information Sharing,

– Access Control/Secure Remote Access,

– Cybersecurity Workforce,

They also cover more specialized subjects that are particularly pertinent to the current security environment. It must be noted, however, that for already overworked healthcare information security personnel, consuming the information of such resources may prove to be a tough lift.

 

Significance of such an improvement.

Concerning the HIPAA Security Rule, the proposed report 800-66, aims to educate the industry about security concerns involving electronic private health information / ePHI, which includes patient data varying from test results to hospital stays.

The HIPAA Security Rule is divided into six primary elements, covering basic guidelines and administrative protections to technical and physical measures. It focuses on preserving the confidentiality, integrity, and availability of ePHI.

The recommendations also highlight the brand-new difficulties brought on by telehealth and telemedicine technologies, cloud services, and mobile device technology.

Resources made available to aid healthcare businesses in defending ePHI from phishing and ransomware, two widespread dangers that are fast developing, are also included.

The proposed document contains recommendations for healthcare organization personnel’s education, awareness, and training as well as techniques to help safeguard organizational data and the tools that store and access ePHI, such as zero-trust architecture and digital identity rules.

Conclusion.

Healthcare organizations have until September 21, 2022, to offer additional feedback, even though this draught is meant to take into account the hundreds of pre-draft comments NIST received. However, given the security issues the healthcare industry is currently facing, the 800-66r2 draught offers a plethora of substance and practical advice that anyone tackling healthcare cybersecurity should be able to apply right away. Take the first step towards a secure your organization’s data by scheduling a call with our privacy expert team at Tsaaro Solutions today.

1,182 thoughts on “What are the new NIST cybersecurity guides?”

  2. Joycet

    Very informative article! I appreciate the depth of analysis. If you want to delve deeper, here’s a helpful resource: EXPLORE FURTHER. Eager to hear everyone’s thoughts!

Leave a Reply

Your email address will not be published. Required fields are marked *

Eu Ai act
First Rules of the EU AI Act Come into Effect: What Does it Mean?
Tsaaro Consulting

First Rules of the EU AI Act Come into Effect: What Does it Mean?

The evolving digital landscape in the 21st century have placed a challenge for governments and organizations as they attempt to …

•
March 7, 2025
Digital Personal Data Protection (DPDP) Act
Exemptions Under the Digital Personal Data Protection (DPDP) Act, 2023  
Tsaaro Consulting

Exemptions Under the Digital Personal Data Protection (DPDP) Act, 2023  

Introduction  The Digital Personal Data Protection (DPDP) Act, 2023, and the Digital Personal Data Protection Rules, 2025 establish a comprehensive …

•
February 27, 2025
cybersecurity,
WHAT DRIVES CYBERSECURITY: A COMPREHENSIVE OVERVIEW 
Tsaaro Consulting

WHAT DRIVES CYBERSECURITY: A COMPREHENSIVE OVERVIEW 

In today’s interconnected world, cybersecurity plays a crucial role in protecting our digital lives. From protecting personal data to safeguarding …

•
February 21, 2025
Transfer Impact Assessments
Understand Transfer Impact Assessments: Insights from CNIL’s Practical Guide 
Tsaaro Consulting

Understand Transfer Impact Assessments: Insights from CNIL’s Practical Guide 

Introduction  A Transfer Impact Assessment (TIA) is a critical evaluation conducted under the General Data Protection Regulation (GDPR) to assess …

•
February 20, 2025
Draft DPDP Rules
The DPDP Act, 2023 and the Draft DPDP Rules, 2025: What Do They Mean for India’s AI Start-Ups?
Tsaaro Consulting

The DPDP Act, 2023 and the Draft DPDP Rules, 2025: What Do They Mean for India’s AI Start-Ups?

Introduction The Digital Personal Data Protection Act (DPDPA), 2023 and the Draft DPDP Rules, 2025 have ushered in a new …

•
February 12, 2025
Recent Comments

SHARE THIS POST

Would you like to read regular updates from Tsaaro.
Subscribe to our newsletter

Our Latest Blogs

Read what the latest hapennings in the cyber world are and learn what the
experts have to say about them

© 2024 Tsaaro Consulting. All rights reserved.
Linkedin Instagram Youtube

About Tsaaro

Resources

Other Links

Tsaaro Netherlands Office

Regus Schiphol Rijk Beech Avenue 54-62, Het Poortgebouw, Amsterdam, 1119 PW, Netherlands

Tsaaro Pune Office

Tech Centre, Rajiv Gandhi Infotech Park, Hinjewadi, Pune, Maharashtra

Tsaaro Noida Office

302, Tower C, ATS Bouquet, Noida Sector – 132, Uttar Pradesh, India

Tsaaro Bengaluru Office I

Manyata, Embassy Business Park, Outer Ring Road, Bengaluru, Karnataka

Tsaaro Bengaluru Office II

Second State, CMH Road, Indiranagar, Bengaluru, Karnataka

Call Our Experts:

+91 95577 22103

small_c_popup.png
small_c_popup.png
small_c_popup.png
small_c_popup.png
small_c_popup.png
small_c_popup.png
small_c_popup.png
small_c_popup.png
small_c_popup.png
small_c_popup.png
small_c_popup.png
small_c_popup.png
small_c_popup.png
small_c_popup.png
small_c_popup.png
small_c_popup.png
small_c_popup.png

We’d love to help your organization achieve your Data Protection goals!

Schedule a complimentary consultation with our Team of Experts.