- NIST is seeking input on a new approach to human-centered cybersecurity
- The concept focuses on how people interact with security processes and systems
- The proposed guidance would go beyond traditional employee awareness training
The National Institute of Standards and Technology has released a concept paper on human-centered cybersecurity, or HCC, and is seeking stakeholder input as it considers developing practical guidance for organizations.
What Is Human-Centered Cybersecurity?
NIST defines HCC as an approach that prioritizes individuals’ needs, capabilities and limitations throughout the design, deployment and decision-making stages of cybersecurity. The agency said the approach recognizes people not only as potential vulnerabilities but also as defenders, reporters and troubleshooters who can contribute to security efforts.
According to NIST, cybersecurity incidents can involve human factors such as clicking malicious links, using easily guessed or reused passwords, misconfiguring settings or adopting less-secure workarounds to complete tasks. The agency said failing to address these factors can contribute to security professional burnout, employee frustration and noncompliance, as well as lost productivity, financial losses and reputational harm.
What Guidance Does NIST Plan to Develop?
NIST plans to develop practical resources for organizations seeking to incorporate HCC into their cybersecurity programs. The guidance would supplement the agency’s existing cybersecurity publications and address gaps that NIST said are not fully covered by current frameworks.
The agency said employee awareness training remains useful but does not resolve underlying issues such as difficult security processes or organizational culture. NIST’s planned work is informed by feedback from cybersecurity practitioners and researchers collected through surveys, interviews, workshops and other engagements.
The HCC effort is part of NIST’s broader work to update cybersecurity guidance as organizations face evolving technologies and operational challenges. Earlier this year, the agency sought comments on revisions to its operational technology cybersecurity guide, including updates addressing artificial intelligence, zero trust architectures, cloud services and other emerging technologies. NIST has also sought stakeholder input on modernizing the National Vulnerability Database as AI changes vulnerability management practices.
The concept paper seeks additional stakeholder feedback to help NIST determine how to proceed with its human-centered cybersecurity work.
