Michele Iversen, director of risk assessment and operational integration for DoD’s chief information office for cybersecurity, says that NIST’s current resources and guidelines are “not always comprehensive enough to cover the many use cases that arise,” such as those outside critical infrastructure. “It appears that [the Cybersecurity Framework] depends on measuring, or assessing risk, but [avoids] alignment to the NIST standard commonly used to assess cybersecurity risks,” Iverson wrote in response to a request for information NIST issued regarding a second update of its cybersecurity framework. Iverson suggested that NIST connect some of the dots between its resources and clarify how they line up with each other, and makes a number of more specific suggestions.
Source: