February 24, 2021
While its guidance is voluntary, businesses would be well advised to follow NIST's lead, as it has become the gold standard for general Privacy and Data Security compliance in the United States.
Whether business leaders want to keep their regulators unconcerned, their clients happy, or their brand strong with regard to Privacy and Data Security, they'll need to know about NIST's new focuses.
NIST's first priority will be enhancing risk management, and there is a reason this is likely first: there is expected to be a lot of action in this space in 2021 based on recent events. NIST calling attention to enhancing risk management follows John Katko's, Ranking Member of the House of Representatives Homeland Security Committee, call to revamp federal procurement and the government's approach to cybersecurity in the wake of the foreign espionage activity that breached government systems via a third party software provider serving as part of the federal government's overall technology supply chain. Another separate but similar breach has also been discoveredthis one likely orchestrated by malicious actors associated with a different foreign government.
Recognizing the political appetite for supply chain risk reforms and the necessity to avoid such cybersecurity breaches in the future, NIST is opening its Cybersecurity Framework for public comment and is proposing revisions to its Supply Chain Risk Management in Federal Information Systems and Organizations publication.
Businesses that participate (or want to participate) in procurement contracts with the United States Government should be proactive in both commenting on the NIST Cybersecurity Framework and begin adjusting and aligning their technology supply chain operations to NIST standards.
NIST will also be redoubling their focus on Privacy. In 2020, NIST published its Privacy Framework to complement and supplement the NIST Cybersecurity Framework. While the Cybersecurity Framework sets standards to prevent unauthorized access to information, the Privacy Framework addresses standards for the appropriate use and processing of that information. NIST recently released a crosswalk between the Privacy Framework and the California Consumer Protection Act.
The NIST Privacy Framework, like the Cybersecurity Framework, provides voluntary, self-regulatory suggestions and guidance regarding Privacy and Data Security. However, notably, the guidance is increasingly being incorporated into corporate contracts and other laws (e.g., the Federal Trade Commission looking favorably on the Cybersecurity Framework when assessing whether an organization had unreasonably weak cybersecurity protections).
NIST plans to further strengthen cryptographic standards and validation, our everyday encryption technology. These standards are incredibly important as they ensure the protection of valuable information and can, in most instances, help avoid triggering the notification requirements under most state data breach statutes.
NIST will also focus on cybersecurity awareness, training, and education. This is crucially important and one of the areas that can lead to significant liability and public relations disasters when not handled correctly. An example is the Equifax hack in 2017 that affected the sensitive personal data of individuals spanning multiple countries. Nearly half of the total US population was affected, and the total cost of the breach was over $1.7 billion. The causeaccording to the (former) CEO of Equifax when testifying before Congressof Equifax's security program failing was an individual employee in the technology department failing to "heed security warnings." This is an extreme example, but it puts a spotlight on the danger of employeeswhether from ignorance or malicenot acting in compliance with the business's Privacy and Data Security Policies.
Following NIST's advancements in cybersecurity awareness, training, education, and workforce development will likely weigh heavily in favor of allowing a business to mitigate and minimize potential legal repercussions while also protecting important business and consumer information.
NIST will be improving the metrics and measurements around cybersecurity and privacy. NIST's efforts in these areas will help cross-disciplinary teams "speak the same language" and create a common dialogue that will improve policy compliance. Unfortunately, the silos of business operations can create scenarios in which professionals use similar words, but apply them with different concepts and meanings (e.g., authorized, incident, breach), resulting in inadvertent noncompliance or triggering of legal requirements. The development of these standards can help a business improve efficiency and effectiveness at the enterprise level.
Identity and Access Management will take additional prominence in NIST's guidance given current threats and recent events. Responding to needs felt during the COVID-19 pandemic, NIST will be providing guidance on identity and access management with an emphasis on remote work.
NIST will be focusing on developing methods for determining trustworthy networks and trustworthy platforms. The introduction of the fifth generation of wireless connectivity (5G) and the ever-present and growing Internet of Things industry has accelerated the need for Privacy and Data Security best practices around ascertaining and evaluating a system or platform's trustworthiness.
NIST will continue to focus on providing guidance around securing emerging technologies. Organizations seeking to be at the forefront of technology and proactive in its approach to Privacy and Data Security should start by reviewing the technological challenges catching NIST's attention.
It is important, however, to note that NIST is not the be-all-and-end-all of Privacy and Data Security. Regulated industries, such as Healthcare, Finance, or Education, may have their own sector-specific requirements. State governments each have their own privacy and data security regulations which are not obligated to give deference to NISTthough it is common for them to do sowhich is why NIST standards are so often utilized by businesses operating in multiple states. Any business with an international footprint is likely subject to international regulatory regimes not accounted for in the NIST standards.
For counsel on any steps recommended by NIST or other Privacy and Data Security compliance needs and best practices, please do not hesitate to reach out to the Privacy and Data Security team here at Ward and Smith.
-- 2021 Ward and Smith, P.A. For further information regarding the issues described above, please contact Peter N. McClelland, CIPP/US.
This article is not intended to give, and should not be relied upon for, legal advice in any particular circumstance or fact situation. No action should be taken in reliance upon the information contained in this article without obtaining the advice of an attorney.
We are your established legal network with offices in Asheville, Greenville, New Bern, Raleigh, and Wilmington, NC.
Read this article:
New Year, New Technology Priorities - Ward and Smith, PA
- Report: Apple acquires French startup behind AI and computer vision technology - 9to5Mac - April 22nd, 2024 [April 22nd, 2024]
- CACI Awarded $1.3 Billion Task Order to Provide Communications and Information Technology Expertise to U.S. ... - Business Wire - April 22nd, 2024 [April 22nd, 2024]
- What is semi-automated offside technology and how does it work? - The Athletic - April 22nd, 2024 [April 22nd, 2024]
- Can technology save us from an ecological apocalypse? - interview - CyberNews.com - April 22nd, 2024 [April 22nd, 2024]
- Does LaLiga have goalline technology? What about other major leagues? - AS USA - April 22nd, 2024 [April 22nd, 2024]
- Driver Assistance Technologies: NHTSA Should Take Action to Enhance Consumer Understanding of Capabilities and ... - Government Accountability Office - March 31st, 2024 [March 31st, 2024]
- OpenAI reveals Voice Engine, but won't yet publicly release the risky AI voice-cloning technology - The Associated Press - March 31st, 2024 [March 31st, 2024]
- Nexalin Technology Full Year 2023 Earnings: US$0.63 loss per share (vs US$0.30 loss in FY 2022) - Yahoo Finance - March 31st, 2024 [March 31st, 2024]
- 'Battle for your brain': What the rise of brain-computer interface technology means for you - WBUR News - March 31st, 2024 [March 31st, 2024]
- Firsthand Technology Value Fund (NASDAQ:SVVC) Research Coverage Started at StockNews.com - Defense World - March 31st, 2024 [March 31st, 2024]
- Suzhou Anjie Technology Full Year 2023 Earnings: Misses Expectations - Simply Wall St - March 31st, 2024 [March 31st, 2024]
- Inside the shadowy global battle to tame the world's most dangerous technology - POLITICO Europe - March 31st, 2024 [March 31st, 2024]
- The Technological Pivot Of History: Power In The Age Of Exponential Innovation Analysis - Eurasia Review - March 31st, 2024 [March 31st, 2024]
- 'Women Behind the Wheel' explores the intersection of gender, culture and cars - NPR - March 31st, 2024 [March 31st, 2024]
- Shanghai Weihong Electronic Technology Full Year 2023 Earnings: Revenues Beat Expectations, EPS Lags - Simply Wall St - March 31st, 2024 [March 31st, 2024]
- A Look At The Fair Value Of Powertech Technology Inc. (TWSE:6239) - Simply Wall St - March 31st, 2024 [March 31st, 2024]
- Weaver Network Technology Full Year 2023 Earnings: EPS Beats Expectations, Revenues Lag - Simply Wall St - March 31st, 2024 [March 31st, 2024]
- New York City will introduce controversial AI gun detection technology amid subway crime crisis - SiliconANGLE News - March 31st, 2024 [March 31st, 2024]
- Earnings Not Telling The Story For Beijing CTJ Information Technology Co., Ltd. (SZSE:301153) - Simply Wall St - March 31st, 2024 [March 31st, 2024]
- Vontron Technology Full Year 2023 Earnings: EPS: CN0.35 (vs CN0.34 in FY 2022) - Simply Wall St - March 31st, 2024 [March 31st, 2024]
- Huawei Revenue Rises as Technology Giant Commits to Growth - Technology Magazine - March 31st, 2024 [March 31st, 2024]
- Shenzhen Fortune Trend technology Full Year 2023 Earnings: Beats Expectations - Simply Wall St - March 31st, 2024 [March 31st, 2024]
- USPACE Technology Group Limited (HKG:1725) May Have Run Too Fast Too Soon With Recent 28% Price Plummet - Simply Wall St - March 31st, 2024 [March 31st, 2024]
- NYC to test gun-detecting technology in subway system - SILive.com - March 31st, 2024 [March 31st, 2024]
- Cancer Treatment: 3D Printing and Scanning Technology - Surviving Mesothelioma - March 31st, 2024 [March 31st, 2024]
- Does Contel Technology (HKG:1912) Have A Healthy Balance Sheet? - Simply Wall St - March 31st, 2024 [March 31st, 2024]
- Oppo Find X7 series now supports 5G-Advanced technology with up to 10 Gbps downlink speed - The Indian Express - March 31st, 2024 [March 31st, 2024]
- DCPS receives nearly $20k in grants for technology program advancements - The Owensboro Times - March 31st, 2024 [March 31st, 2024]
- Hangzhou Electronic Soul Network Technology Full Year 2023 Earnings: Misses Expectations - Simply Wall St - March 31st, 2024 [March 31st, 2024]
- International Business Digital Technology Full Year 2023 Earnings: CN0.07 loss per share (vs CN0.019 loss in FY ... - Simply Wall St - March 31st, 2024 [March 31st, 2024]
- Analysts Are More Bearish On Guangzhou Tinci Materials Technology Co., Ltd. (SZSE:002709) Than They Used To Be - Simply Wall St - March 31st, 2024 [March 31st, 2024]
- Daheng New Epoch Technology Full Year 2023 Earnings: EPS: CN0.11 (vs CN0.16 in FY 2022) - Simply Wall St - March 31st, 2024 [March 31st, 2024]
- Tesla offers U.S. customers a month's trial of its driver-assist technology - Reuters - March 31st, 2024 [March 31st, 2024]
- Slam Dunk Technology: How AI Is Revolutionizing The Game Of Basketball - Forbes - March 31st, 2024 [March 31st, 2024]
- China Environmental Technology and Bioenergy Holdings Full Year 2023 Earnings: CN0.03 loss per share (vs CN ... - Simply Wall St - March 31st, 2024 [March 31st, 2024]
- Vuma and Huawei team up to launch industry first 50G PON ... - Light Reading - July 15th, 2023 [July 15th, 2023]
- See What Kim Kardashian and Kylie Jenner Look Like With Aging ... - E! NEWS - July 15th, 2023 [July 15th, 2023]
- AFRL conducts swarm technology demonstration > ONE AFRL ... - afrl.af.mil - May 20th, 2023 [May 20th, 2023]
- Shell to use new AI technology in deep sea oil exploration - Reuters - May 20th, 2023 [May 20th, 2023]
- Former Google CEO says AI at 'center' of technology competition between US and China - Fox News - May 20th, 2023 [May 20th, 2023]
- Agriculture and technology combine to drive the industrys growth - Times of India - May 20th, 2023 [May 20th, 2023]
- Technology and the Skills Shortage - Financial Times - May 20th, 2023 [May 20th, 2023]
- New License Agreement Announced for Next-Generation Base ... - BioPharm International - May 20th, 2023 [May 20th, 2023]
- Orion Governance Licenses Technology from GE to Deliver Next Generation Data Governance Solution - Yahoo Finance - May 20th, 2023 [May 20th, 2023]
- World needs to be 'vigilant' as AI technology improves and ... - KTVZ - May 20th, 2023 [May 20th, 2023]
- After Losing Son, Ridgefield Mother Pushes For Technology to Prevent Hot Car Deaths - NBC Connecticut - May 20th, 2023 [May 20th, 2023]
- After last year's fan violence in Queretaro, has Fan ID technology ensured safety for Liga MX fans? - ESPN - ESPN - May 20th, 2023 [May 20th, 2023]
- Bleach: The Soul Reapers' Gigai Technology, Explained - CBR - Comic Book Resources - May 20th, 2023 [May 20th, 2023]
- Cogito Tech - Catalyzing Transformation in Global Healthcare ... - Business Standard - May 20th, 2023 [May 20th, 2023]
- Barriers to Use of Technology in Diabetes Management - Patient Care Online - May 20th, 2023 [May 20th, 2023]
- Blue technology startups presented at the inaugural Gulf Blue ... - The University of Southern Mississippi - May 20th, 2023 [May 20th, 2023]
- CureVac files expanded patent lawsuit against Pfizer/BioNTech over ... - Reuters - May 20th, 2023 [May 20th, 2023]
- Harrison Ford defends use of de-ageing technology in new Indiana Jones film: I know that that is my face - Yahoo News - May 20th, 2023 [May 20th, 2023]
- Sanwo-Olu: Nigeria needs technology to compete with likes of China - Guardian Nigeria - May 20th, 2023 [May 20th, 2023]
- Prejudice in technology, and the necessity of time: Books in brief - Nature.com - May 20th, 2023 [May 20th, 2023]
- New technology uses ordinary sunlight to disinfect drinking water ... - Stanford University News - May 20th, 2023 [May 20th, 2023]
- Incredible AI technology shows what UK cities will look like in 2050 - LADbible - May 20th, 2023 [May 20th, 2023]
- Your Firm and Your Tools - Top Technology Initiatives - CPAPracticeAdvisor.com - May 20th, 2023 [May 20th, 2023]
- Tom Hanks: I could appear in movies after death with AI technology - BBC - May 20th, 2023 [May 20th, 2023]
- Transform your career with Chief Technology Officer online course - Economic Times - May 20th, 2023 [May 20th, 2023]
- e-Learning Jamaica Technology in Education Conference Slated for ... - Government of Jamaica, Jamaica Information Service - May 20th, 2023 [May 20th, 2023]
- Andrew Maynard | What's a Luddite? From Industrial Revolution to ... - TribDem.com - May 20th, 2023 [May 20th, 2023]
- At Yale, Kaloyan Kolev used technology to create and to make ... - Yale News - May 20th, 2023 [May 20th, 2023]
- This technology could alter the entire planet. These groups want every nation to have a say. - MIT Technology Review - April 17th, 2023 [April 17th, 2023]
- The secret lives of snakes and how Georgia College uses technology to study them - 13WMAZ.com - April 8th, 2023 [April 8th, 2023]
- Technology Innovation Institute to host 2nd 'Additive Manufacturing the Future' seminar in Abu Dhabi - Devdiscourse - April 8th, 2023 [April 8th, 2023]
- Can Array Technologies Inc (ARRY) Stock Rise to the Top of Technology Sector Thursday? - InvestorsObserver - March 31st, 2023 [March 31st, 2023]
- Here's Why We Think Pfeiffer Vacuum Technology (ETR:PFV) Might Deserve Your Attention Today - Simply Wall St - February 18th, 2023 [February 18th, 2023]
- Will WM Technology Inc (MAPS) Stay at the Top of the Technology Sector? - InvestorsObserver - February 18th, 2023 [February 18th, 2023]
- Ways in which technology can enhance the abilities of law enforcement agents to assist the community - Times of India - February 7th, 2023 [February 7th, 2023]
- Meet The Titans: Google And OpenView (Microsoft) Faceoff On Chat Technology Innovation - Forbes - February 5th, 2023 [February 5th, 2023]
- MACOM Technology Solutions Holdings, Inc.'s (NASDAQ:MTSI) Stock Has Been Sliding But Fundamentals Look Strong: Is The Market Wrong? - Simply Wall St - February 5th, 2023 [February 5th, 2023]
- WVU Dept. of Ophthalmology acquires state-of-the-art technology for simulation lab - WV News - February 5th, 2023 [February 5th, 2023]
- Executive Vice President of Technology & Operations Alok Sethi Just Sold A Bunch Of Shares In Franklin Resources, Inc. (NYSE:BEN) - Simply Wall St - February 5th, 2023 [February 5th, 2023]
- Is Now The Time To Put Amkor Technology (NASDAQ:AMKR) On Your Watchlist? - Simply Wall St - January 27th, 2023 [January 27th, 2023]
- There Are Reasons To Feel Uneasy About New Oriental Education & Technology Group's (NYSE:EDU) Returns On Capital - Simply Wall St - January 27th, 2023 [January 27th, 2023]
- Technology has set us on a path toward one of two dystopian scenariosbut its not too late to save democracy - Fortune - January 17th, 2023 [January 17th, 2023]
- IonQ Acquires Entangled Networks And Locks In Quantum Networking Technology Critical To Its Future Success - Forbes - January 10th, 2023 [January 10th, 2023]
- Industrialization 3.0 - How Technology, Wall Street, And The Government Can Help The US Win In A World Of Re-Industrialization - Forbes - January 10th, 2023 [January 10th, 2023]
- Connect with aspirational India through technology and work in interest of world: Anurag Thakur to NRIs - Economic Times - January 8th, 2023 [January 8th, 2023]