Skip to content
Schedule a Call
Call Now

What are the new NIST cybersecurity guides?

Article by Tsaaro

7 min read

The NIST cybersecurity framework helps organize and improve cyber vulnerabilities. It is a set of rules and best practices to assist businesses in developing and enhancing their cybersecurity posture. The framework offers a set of standards and suggestions that help companies be better equipped to recognize and stop cyberattacks. It also offers instructions regarding how to respond to, stop, and rebuild from cyber disasters.

The National Institute of Standards and Technology (NIST) developed this framework to address the lack of cybersecurity standards and to give companies across industries a consistent set of rules, guidelines, and standards. The gold standard for developing a cybersecurity program is generally regarded as the NIST Cybersecurity Framework (NIST CSF). The framework can be useful since it serves as the highest security management solution that makes it easier to evaluate cybersecurity risk throughout the business, regardless of whether you’re just starting to build a cybersecurity program or are already managing a very established program.

The NIST Cybersecurity Framework: Why Use It?

Let’s first look at the bigger picture and make a list of the cybersecurity concerns that are likely on everyone’s mind.

· Unknown dangers and weaknesses.

· No precise list of the things that must be safeguarded.

· Lack knowledge of cyber risk and do, not “own” necessary mitigating tasks

 

The framework can assist you in overcoming these obstacles. You’ll be able to benefit from what others have learned after successfully tackling issues similar to yours. The framework’s goal is to assist you in prioritizing cybersecurity investments and choices. The framework offers a platform for discussions with stakeholders, such as your high-ranking management and the board of directors, and aids in your ability to analyze the development of your program.

NIST Updates Cybersecurity Guidelines.

The National Institute of Standards and Technology (NIST) has upgraded its cybersecurity recommendations for the health care industry to aid affirm health care in protecting individuals’ sensitive health information.

Incorporating the Health Insurance Portability and Accountability Act (HIPAA) Security Rule: A Cybersecurity Resource Guide (NIST Special Publication 800-66, Revision 2) is the formal title of NIST’s

new draft publication, which would be meant to help guide the industry in safeguarding the privacy, security, and accessibility of electronically protected health information or ePHI. The phrase refers to a broad range of patient information, such as scripts, laboratory results, records of hospitalization, and routine vaccination records.

Federal legislation known as the Health Insurance Portability and Accountability Act of 1996 (HIPAA) mandates the development of national standards to prevent the disclosure of confidential patient health information without the patient’s consent or awareness. Although NIST does not produce regulations to carry out HIPAA, the updated proposal is in line with NIST’s mandate to offer cybersecurity advice. The U.S. Department of Health and Human Services has reported an increase in cyberattacks affecting the provision of healthcare, therefore NIST’s new guidance is especially pertinent at this time.

Until September 21, 2022, NIST is accepting comments on the proposed release.

The version was created by NIST in part to connect it with previously unpublished NIST cybersecurity guidance. Since then, NIST has created the well-known Cybersecurity Framework and continuously updated its set of Security and Privacy Controls, which businesses can utilize to create custom risk management strategies. These and other NIST cybersecurity resources are specifically mentioned in the new HIPAA Security Rule guideline document.

The amended draft’s Appendix F – HIPAA Security Rule Resources may be the most helpful new addition. Even though these categories cover several fundamental and broad terms of facts such as

– Risk Assessment/Risk Management,

– Education, Training & Awareness,

– Protection of Organizational Resources and Data,

– Equipment and Data Loss,

– Information Sharing,

– Access Control/Secure Remote Access,

– Cybersecurity Workforce,

They also cover more specialized subjects that are particularly pertinent to the current security environment. It must be noted, however, that for already overworked healthcare information security personnel, consuming the information of such resources may prove to be a tough lift.

 

Significance of such an improvement.

Concerning the HIPAA Security Rule, the proposed report 800-66, aims to educate the industry about security concerns involving electronic private health information / ePHI, which includes patient data varying from test results to hospital stays.

The HIPAA Security Rule is divided into six primary elements, covering basic guidelines and administrative protections to technical and physical measures. It focuses on preserving the confidentiality, integrity, and availability of ePHI.

The recommendations also highlight the brand-new difficulties brought on by telehealth and telemedicine technologies, cloud services, and mobile device technology.

Resources made available to aid healthcare businesses in defending ePHI from phishing and ransomware, two widespread dangers that are fast developing, are also included.

The proposed document contains recommendations for healthcare organization personnel’s education, awareness, and training as well as techniques to help safeguard organizational data and the tools that store and access ePHI, such as zero-trust architecture and digital identity rules.

Conclusion.

Healthcare organizations have until September 21, 2022, to offer additional feedback, even though this draught is meant to take into account the hundreds of pre-draft comments NIST received. However, given the security issues the healthcare industry is currently facing, the 800-66r2 draught offers a plethora of substance and practical advice that anyone tackling healthcare cybersecurity should be able to apply right away. Take the first step towards a secure your organization’s data by scheduling a call with our privacy expert team at Tsaaro Solutions today.

628 thoughts on “What are the new NIST cybersecurity guides?”

  2. Joycet

    Very informative article! I appreciate the depth of analysis. If you want to delve deeper, here’s a helpful resource: EXPLORE FURTHER. Eager to hear everyone’s thoughts!

Leave a Reply

Your email address will not be published. Required fields are marked *

Let’s Decode DeepSeek AI and Associated Privacy Concerns  
Tsaaro Consulting

Let’s Decode DeepSeek AI and Associated Privacy Concerns  

“It was invigorating to have a new competitor… DeepSeek’s model is impressive, particularly around what they’re able to deliver for …

•
January 31, 2025
certain legitimate uses
What are ‘Certain Legitimate Uses’ under the DPDP Act, 2023 and the Draft DPDP Rules, 2025? 
Tsaaro Consulting

What are ‘Certain Legitimate Uses’ under the DPDP Act, 2023 and the Draft DPDP Rules, 2025? 

Introduction The Digital Personal Data Protection Act 2023 (DPDP Act) provides that consent is a prerequisite to process the personal …

•
January 30, 2025
Data Fiduciaries Under the DPDP Act,
Understanding the Obligations of Significant Data Fiduciaries Under the DPDP Act, 2023 and the Draft DPDP Rules, 2025
Tsaaro Consulting

Understanding the Obligations of Significant Data Fiduciaries Under the DPDP Act, 2023 and the Draft DPDP Rules, 2025

The Digital Personal Data Protection (DPDP) Act, 2023, introduces an overall approach to the protection of the digital personal data …

•
January 23, 2025
Draft DPDP Rules
Fortifying Data: A Guide to Security Safeguards under the DPDPA and Draft DPDP Rules
Tsaaro Consulting

Fortifying Data: A Guide to Security Safeguards under the DPDPA and Draft DPDP Rules

Today, personal data has become one of the most valuable resources, powering industries and shaping digital economies. However, the misuse …

•
January 20, 2025
draft dpdp rules 2025
Understanding Data Principal Rights Under DPDPA, 2023 and Draft DPDP Rules, 2025
Tsaaro Consulting

Understanding Data Principal Rights Under DPDPA, 2023 and Draft DPDP Rules, 2025

Introduction: Data protection laws worldwide empower individuals, referred to as ‘Data Subjects’ under the GDPR or ‘Data Principals’ under India’s …

•
January 9, 2025
Recent Comments

SHARE THIS POST

Would you like to read regular updates from Tsaaro.
Subscribe to our newsletter

Our Latest Blogs

Read what the latest hapennings in the cyber world are and learn what the
experts have to say about them

© 2024 Tsaaro Consulting. All rights reserved.
Linkedin Instagram Youtube

About Tsaaro

Resources

Other Links

Tsaaro Netherlands Office

Regus Schiphol Rijk Beech Avenue 54-62, Het Poortgebouw, Amsterdam, 1119 PW, Netherlands

Tsaaro Pune Office

Tech Centre, Rajiv Gandhi Infotech Park, Hinjewadi, Pune, Maharashtra

Tsaaro Noida Office

302, Tower C, ATS Bouquet, Noida Sector – 132, Uttar Pradesh, India

Tsaaro Bengaluru Office I

Manyata, Embassy Business Park, Outer Ring Road, Bengaluru, Karnataka

Tsaaro Bengaluru Office II

Second State, CMH Road, Indiranagar, Bengaluru, Karnataka

Call Our Experts:

+91 95577 22103

small_c_popup.png
small_c_popup.png
small_c_popup.png
small_c_popup.png
small_c_popup.png
small_c_popup.png
small_c_popup.png
small_c_popup.png
small_c_popup.png
small_c_popup.png
small_c_popup.png
small_c_popup.png
small_c_popup.png
small_c_popup.png
small_c_popup.png
small_c_popup.png
small_c_popup.png

We’d love to help your organization achieve your Data Protection goals!

Schedule a complimentary consultation with our Team of Experts.