The National Institute of Standards and Technology (NIST) is seeking public input by Sept. 30 on plans to develop human-centered cybersecurity guidance that puts people’s needs, abilities, and limitations at the forefront.
In an Aug. 17 blog post, NIST said it released a concept paper outlining plans for practical guidelines and resources that would complement its existing cybersecurity publications. The effort is intended to address what NIST sees as a gap in authoritative guidance on putting human-centered cybersecurity into practice.
“Above all, we see people not just as vulnerabilities to be contained; they’re also defenders, reporters, and problem-solvers to be empowered,” NIST computer scientists Julie Haney and Jody Jacobs wrote.
According to NIST, human-centered cybersecurity (HCC) focuses on improving cybersecurity outcomes by considering the needs, abilities, and limitations of people who affect or are affected by cybersecurity when organizations design and implement security technologies and processes or make cybersecurity decisions.
NIST said the approach could help address challenges including security professional burnout, employee frustration and mistakes, noncompliance, and losses in productivity, money, and reputation.
The agency said existing cybersecurity frameworks and publications do not always incorporate human-centered considerations beyond employee security awareness training. However, the agency warned that awareness training alone is not enough.
“Overreliance on training creates unrealistic expectations that employees will commit the knowledge to memory, understand the concepts, and always make the ‘right’ decisions, without addressing the root causes of many cybersecurity issues, like hard-to-use and disruptive security processes or an uninformed organizational security culture,” Haney and Jacobs wrote.
The concept paper identifies several barriers to broader adoption of human-centered cybersecurity, including overreliance on annual awareness training. Other barriers include a cybersecurity field that often emphasizes technology over people, a lack of HCC expertise in the cybersecurity workforce, and uncertainty about how organizations should measure HCC outcomes.
To address those gaps, NIST is considering several options for future guidance, including integrating HCC guidelines directly into existing NIST cybersecurity publications, issuing standalone publications aligned with existing frameworks, and developing shorter resources focused on topics such as cybersecurity culture, usable cybersecurity, and communications.
NIST is also considering various potential formats for the guidelines, including case studies, quick-start guides, videos, tools and methodologies, checklists and templates, and training modules for cybersecurity professionals and organizational decision-makers.
The agency is asking organizations of all types and sizes to review the concept paper and provide feedback by Sept. 30. NIST said that input will help determine the direction of its future HCC guidelines and resources.