Information systems—from communications platforms to internet-connected devices—require security and privacy safeguards to work successfully and protect users.
To address these concerns, the National Institute of Standards and Technology (NIST) has issued an updated draft of its widely used Special Publication (SP) 800-53, Security and Privacy Controls for Information Systems and Organizations. Developed by a joint task force consisting of representatives of the civil, defense, and intelligence communities, the draft fifth revision of SP 800-53 represents an ongoing effort to produce a unified information security framework for the federal government.
The latest draft goes beyond information security and the federal government to address ways organizations can maintain security and privacy in their interconnected systems.
Ron Ross, NIST fellow and team leader of the joint task force that wrote the updated publication, said revision five “takes the guidance in new directions—we are crafting the next-generation catalog of controls that can also be applied to secure the Internet of Things.”
Privacy is now fully integrated throughout the new draft, which is a first for any control catalog.
“This revision covers the overlap in security and privacy for systems, as well as the ways in which they are distinct,” says Naomi Lefkovitz, NIST senior privacy policy advisor. “It also enhances the ability for both professional teams to collaborate yet still maintain their respective authorities.”
SP 800-53 Revision 5 adds two new control families that focus solely on privacy. The remaining privacy controls are integrated throughout the rest of the control families. For example, one privacy control addresses the data captured by sensors such as those used in traffic-monitoring cameras. The control advises configuring such sensors in a way that minimizes their capturing data about individuals that’s not necessary for the traffic-monitoring system to perform its function.
While previous versions targeted federal agencies, other organizations—particularly industry—are voluntarily adopting SP 800-53. The controls have been updated to address the needs of the more diverse user group, including enterprise-level security and privacy professionals, component product developers, and systems engineers who are now working on privacy and security.
The authors of Security and Privacy Controls for Information Systems and Organizations, Special Publication 800-53 Revision 5 request comments on the draft by September 12. Comments can be emailed to sec-cert@nist.gov.