NIST Cybersecurity Framework Adoption Hampered By Costs, Survey Finds
Security pros consider the NIST framework an industry best practice, yet half of its adopters say its complete implementation involves a high level of investment.
![](https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/bltc94608acf452fd67/655cf371ab171e040a838b2a/329050_DR23_Graphics_Website_V5_Default_Image_v1.png?width=1280&auto=webp&quality=95&format=jpg&disable=upscale)
US organizations say the major investment required in fully implementing the NIST Cybersecurity Framework is hampering their full adoption of it, according to a survey report released by Tenable Network Security.
The Trends in Security Framework Adoption Survey, which includes responses from around 300 US IT and security pros, was conducted to determine patterns in the adoption of various security frameworks. A majority of organizations (84%) have at least one security framework in place.
While the survey data reveals that 70% organizations view NIST's framework as a security best practice, 50% see the high level of investment that it requires as a barrier to adoption. The NIST framework was the most popular choice of security frameworks to be implemented over the next year, the study found.
Some 64% of organizations are using part of the NIST framework and notĀ all of the recommended controls due to the cost and lack of regulatory pressures. Also, 83% of those planning to adopt the NIST framework in the coming year say they will take a similar approach--adoptingĀ some and not all of the CSF controls.
"Historically, CISOs have been hesitant to take full advantage of the NIST Cybersecurity Framework because of a high investment requirement and a lack of regulatory mandate," said Ron Gula, CEO of Tenable. "This is changing as organizations begin to shift their mindset from moment-in-time compliance with frameworks like PCI DSS to continuous conformance with the NIST Cybersecurity Framework."
Read more from the report here.
About the Author
You May Also Like
Catch the Threat Before it Catches you: Proactive Ransomware Defense
September 5, 2024How to Evaluate Hybrid-Cloud Network Policies and Enhance Security
September 18, 2024DORA and PCI DSS 4.0: Scale Your Mainframe Security Strategy Among Evolving Regulations
September 26, 2024Harnessing the Power of Automation to Boost Enterprise Cybersecurity
October 3, 2024
[Virtual Event] The Essential Guide to Cloud Management
October 17, 2024Black Hat Europe - December 9-12 - Learn More
December 10, 2024SecTor - Canada's IT Security Conference Oct 22-24 - Learn More
October 22, 2024