Archive for category: Public Policy

You are here: / / / Public Policy

Modernizing Public Benefits: NIST’s New Digital Identity Initiative

/in , , , /by

The U.S. Department of Commerce’s National Institute of Standards and Technology (NIST) is embarking on an innovative collaborative project aimed at enhancing the digital identity guidelines to support public benefits programs. This initiative is designed to aid beneficiaries in accessing essential services such as food, housing, medical care, and other basic living expenses. 

Collaborative Partnerships 

NIST is partnering with the Digital Benefits Network (DBN) at Georgetown University’s Beeck Center for Social Impact + Innovation and the nonprofit Center for Democracy & Technology (CDT). This cooperative research and development agreement focuses on developing resources that ensure a balance between security, privacy, equity, and usability in public benefits programs. The partnership underscores the importance of adapting digital identity guidelines to meet the diverse needs of different populations. 

Addressing Diverse Needs 

Improving benefits delivery requires balancing access and security while considering the different needs, barriers, and circumstances of various populations. This initiative brings together a diverse set of communities to address these challenges effectively. 

Digital Identity in Public Benefits 

The rise in fraud and cybersecurity threats during the COVID-19 pandemic prompted benefits-administering agencies to implement new safeguards, such as digital accounts and identity verification processes. However, methods involving facial recognition or data brokers have raised significant concerns regarding privacy, data security, due process, and biases that may disproportionately affect marginalized communities. Despite recommendations from NIST and the Government Accountability Office, the adoption of more effective, evidence-based identity verification methods has been slow. 

Focusing on Equity and Privacy 

This collaborative effort aims to improve security and privacy while making the benefits application process more equitable. By empowering state agencies with stronger implementation resources, the initiative seeks to increase security and privacy in benefits applications and systems, ensuring that the process is fair for all applicants and beneficiaries. 

Community Engagement and Public Workshops 

NIST’s extensive community engagement process will incorporate input from federal partners, state benefit program administrators, state IT and cybersecurity leaders, digital identity experts, technologists, advocates, and individuals with direct experience navigating the U.S. public benefit landscape. This approach aims to create voluntary resources for public sector organizations administering public benefits. 

NIST, DBN, and CDT will host public workshops and working sessions to foster community dialogue, gather input, and deepen the understanding of digital identity risk management in the public benefits ecosystem. The outcome will be a profile of NIST’s Digital Identity Guidelines (Special Publication 800-63), aiding practitioners and public sector leaders in evaluating the necessary authentication and identity proofing practices for their specific benefits delivery needs. 

Looking Ahead 

This modernization effort represents a significant step forward in ensuring that public benefits programs are secure, equitable, and accessible to all. By addressing the diverse needs of different populations and incorporating extensive community input, NIST and its partners aim to build a more inclusive and effective benefits delivery system. 

Stay tuned for updates on this important initiative as it progresses and transforms the landscape of public benefits in the United States. Read more on NIST’s Website.  

NIST Finalizes Guidelines for Protecting Sensitive Information: What You Need to Know

/in , , , /by

In the realm of cybersecurity, the protection of sensitive information is paramount, especially when it comes to entities doing business with the federal government. Recently, the National Institute of Standards and Technology (NIST) has taken significant strides in refining and clarifying its guidelines for safeguarding Controlled Unclassified Information (CUI), crucial for organizations engaged in federal contracts and programs. 

NIST has unveiled its latest updates in two pivotal publications: Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations (NIST SP 800-171, Revision 3), and its complementary piece, Assessing Security Requirements for Controlled Unclassified Information (NIST SP 800-171A, Revision 3). These guidelines serve as the bedrock for ensuring the protection of CUI, encompassing a wide array of sensitive data, from intellectual property to employee health information. 

The revisions aim to enhance clarity and alignment with existing cybersecurity frameworks, drawing heavily upon NIST’s comprehensive catalog of security and privacy controls (NIST SP 800-53) and assessment procedures (NIST SP 800-53A). Previously, discrepancies in wording between guidelines and source catalogs could lead to ambiguity in security requirements. With this update, NIST endeavors to streamline and harmonize its cybersecurity guidance, providing organizations with clear and unambiguous directives. 

A crucial aspect of the update is the incorporation of feedback from the cybersecurity community, garnered through public comment on draft versions of the guidelines released last year. Responding to the community’s interest, NIST has made strides in making the guidelines available in machine-readable formats, such as JSON and Excel. This move not only facilitates easier reference and use but also benefits cybersecurity tool developers and implementing organizations, fostering more efficient implementation of security measures. 

For those already acquainted with Revision 2 of the guidelines, NIST has issued an analysis of changes, elucidating the evolution of each requirement. This resource serves as a valuable reference for implementers navigating the transition to the updated guidelines. 

Complementing SP 800-171, the companion publication SP 800-171A equips users with the necessary tools to assess security requirements effectively. With a comprehensive set of updated assessment procedures, users can ascertain compliance with the revised security standards, ensuring robust protection of sensitive information. 

Looking ahead, NIST plans to further bolster its suite of publications on protecting CUI associated with high-value assets and critical programs. These forthcoming updates, including NIST SP 800-172 (enhanced security requirements) and NIST SP 800-172A (enhanced security requirement assessments), underscore NIST’s ongoing commitment to fortifying cybersecurity measures across both public and private sectors. 

In essence, the finalization of NIST’s guidelines marks a significant milestone in bolstering the cybersecurity posture of organizations entrusted with safeguarding sensitive information. By providing clarity, alignment, and accessibility, these guidelines empower entities to navigate the complex landscape of cybersecurity threats with confidence and resilience. Read more at the NIST Computer Security Resource Center.  





Electronic Signature & Records Association
183 Wind Chime Ct, Suite 203
Raleigh, NC 27615
919-573-5019
esra@esignrecords.org