What NIST Means for Your Security and Your Business

Technology plays a critical role in modern businesses. You depend on your smartphone, desktop or laptop computer, software, productivity apps, and much more for reliable communications and operations. When you think of all the components that play into your average day, it’s astonishing to realize all of the ways your data has the potential to become compromised.

Do you work with controlled unclassified information? If so, much of your technology and data security responsibilities are subject to NIST oversight. NIST, the National Institute of Standards and Technology, is the Department of Commerce agency that oversees technology standards. Controlled unclassified information (CUI) is basically any information that isn’t labeled as “classified” but still considered sensitive enough to warrant increased protection. This type of information generally relates to the interests of the United States.

Why NIST Applies to Your Business

One of the foundational goals of NIST was to drive innovation and modern ideas to keep the United States competitive against economic rivals abroad, and establishing technology standards is a key factor. Since technology is behind most modern operations, adhering to NIST guidelines will help from a data security standpoint.

NIST releases publications to cover specific technology topics, and in 2015 released NIST 800-171, a special publication addressing CUI and the security measures for storage, access, and sharing of CUI. Businesses that store, access, and share CUI need to be NIST 800-171 compliant.

What Is NIST 800-171?

NIST 800-171 gives businesses the minimum technology security requirements for CUI as it relates to storage, access, and sharing of this information. How does this apply to you?

Security requirements in NIST 800-171 cover key areas:

Cyber security protocols and information management
Procedures for monitoring IT systems, including networks
Guidelines for controls concerning CUI
Physical and technological security processes

What Can You Do To Ensure Your Business is NIST 800-171 Compliant?

You’ll want to put together a general checklist of steps that will start you on the path to NIST 800-171 compliance:

Identify the information you store, access, and share that is considered CUI
Your CUI may be stored in multiple locations, and you’ll want to verify each location CUI is stored or accessed
It’s recommended that you categorize your data and separate CUI
Encrypt CUI
Monitor your network to track and log all access to CUI
Outline policies and training procedures for storage, access, and sharing of CUI to maintain consistency

As you can see, taking the necessary steps to meet these key requirements not only makes your business NIST 800-171 compliant to protect CUI but also adds more security measures for your IT systems and environment. Your primary goal is to protect CUI, and preventing unauthorized access to CUI is best achieved with a technology audit to review your IT environment and address CUI following NIST 800-171.

NIST 800-171 compliance protects CUI, but increased security protects your business