4 ms·

The usage of specific NIST guidelines should probably be federal law based on industry.

• jandrewrogers 2y ago
  The NIST guidelines are among the most competent from a government source that exist in my opinion. A practical issue is that even if we legislated those guidelines, many other national governments demand compliance with their own published guidelines which often directly contradict NIST. This creates challenges for companies that operate in multiple countries. I’ve seen the situation multiple times where “security requirements” that span borders were mutually exclusive yet are mandated on both sides of the border. It is impossible to comply yet compliance is expected. Fortunately, the audits are purely superficial; you do your best to comply with whichever bureaucracy is fussiest and no one looks too closely. This is a suboptimal outcome on many levels. Trying to harmonize these contradictory requirements through an international treaty organization like ISO would produce something so watered down as to be pointless theater. I would generally endorse the NIST guidelines as a standard. Unfortunately, many other countries reject that standard and require you to comply with some other guidelines to do business in their country. This is a problem.
• nunez 2y ago
  They already are for any federal software that you use and are all but required by many regulating bodies in the private sector.