What are the new NIST cybersecurity guides?

Article by Tsaaro

September 5, 2022

7 min read

The NIST cybersecurity framework helps organize and improve cyber vulnerabilities. It is a set of rules and best practices to assist businesses in developing and enhancing their cybersecurity posture. The framework offers a set of standards and suggestions that help companies be better equipped to recognize and stop cyberattacks. It also offers instructions regarding how to respond to, stop, and rebuild from cyber disasters.

The National Institute of Standards and Technology (NIST) developed this framework to address the lack of cybersecurity standards and to give companies across industries a consistent set of rules, guidelines, and standards. The gold standard for developing a cybersecurity program is generally regarded as the NIST Cybersecurity Framework (NIST CSF). The framework can be useful since it serves as the highest security management solution that makes it easier to evaluate cybersecurity risk throughout the business, regardless of whether you’re just starting to build a cybersecurity program or are already managing a very established program.

The NIST Cybersecurity Framework: Why Use It?

Let’s first look at the bigger picture and make a list of the cybersecurity concerns that are likely on everyone’s mind.

· Unknown dangers and weaknesses.

· No precise list of the things that must be safeguarded.

· Lack knowledge of cyber risk and do, not “own” necessary mitigating tasks

The framework can assist you in overcoming these obstacles. You’ll be able to benefit from what others have learned after successfully tackling issues similar to yours. The framework’s goal is to assist you in prioritizing cybersecurity investments and choices. The framework offers a platform for discussions with stakeholders, such as your high-ranking management and the board of directors, and aids in your ability to analyze the development of your program.

NIST Updates Cybersecurity Guidelines.

The National Institute of Standards and Technology (NIST) has upgraded its cybersecurity recommendations for the health care industry to aid affirm health care in protecting individuals’ sensitive health information.

Incorporating the Health Insurance Portability and Accountability Act (HIPAA) Security Rule: A Cybersecurity Resource Guide (NIST Special Publication 800-66, Revision 2) is the formal title of NIST’s

new draft publication, which would be meant to help guide the industry in safeguarding the privacy, security, and accessibility of electronically protected health information or ePHI. The phrase refers to a broad range of patient information, such as scripts, laboratory results, records of hospitalization, and routine vaccination records.

Federal legislation known as the Health Insurance Portability and Accountability Act of 1996 (HIPAA) mandates the development of national standards to prevent the disclosure of confidential patient health information without the patient’s consent or awareness. Although NIST does not produce regulations to carry out HIPAA, the updated proposal is in line with NIST’s mandate to offer cybersecurity advice. The U.S. Department of Health and Human Services has reported an increase in cyberattacks affecting the provision of healthcare, therefore NIST’s new guidance is especially pertinent at this time.

Until September 21, 2022, NIST is accepting comments on the proposed release.

The version was created by NIST in part to connect it with previously unpublished NIST cybersecurity guidance. Since then, NIST has created the well-known Cybersecurity Framework and continuously updated its set of Security and Privacy Controls, which businesses can utilize to create custom risk management strategies. These and other NIST cybersecurity resources are specifically mentioned in the new HIPAA Security Rule guideline document.

The amended draft’s Appendix F – HIPAA Security Rule Resources may be the most helpful new addition. Even though these categories cover several fundamental and broad terms of facts such as

– Risk Assessment/Risk Management,

– Education, Training & Awareness,

– Protection of Organizational Resources and Data,

– Equipment and Data Loss,

– Information Sharing,

– Access Control/Secure Remote Access,

– Cybersecurity Workforce,

They also cover more specialized subjects that are particularly pertinent to the current security environment. It must be noted, however, that for already overworked healthcare information security personnel, consuming the information of such resources may prove to be a tough lift.

Significance of such an improvement.

Concerning the HIPAA Security Rule, the proposed report 800-66, aims to educate the industry about security concerns involving electronic private health information / ePHI, which includes patient data varying from test results to hospital stays.

The HIPAA Security Rule is divided into six primary elements, covering basic guidelines and administrative protections to technical and physical measures. It focuses on preserving the confidentiality, integrity, and availability of ePHI.

The recommendations also highlight the brand-new difficulties brought on by telehealth and telemedicine technologies, cloud services, and mobile device technology.

Resources made available to aid healthcare businesses in defending ePHI from phishing and ransomware, two widespread dangers that are fast developing, are also included.

The proposed document contains recommendations for healthcare organization personnel’s education, awareness, and training as well as techniques to help safeguard organizational data and the tools that store and access ePHI, such as zero-trust architecture and digital identity rules.

Conclusion.

Healthcare organizations have until September 21, 2022, to offer additional feedback, even though this draught is meant to take into account the hundreds of pre-draft comments NIST received. However, given the security issues the healthcare industry is currently facing, the 800-66r2 draught offers a plethora of substance and practical advice that anyone tackling healthcare cybersecurity should be able to apply right away. Take the first step towards a secure your organization’s data by scheduling a call with our privacy expert team at Tsaaro Solutions today.