Explains NIST cybersecurity standards and publications, including the NIST Cybersecurity Framework, SP 800 series, and risk management guidelines. Articles break down how organizations can adopt NIST standards to strengthen security and meet compliance requirements.
posts
In 2023, MGM Resorts lost roughly $100 million to a ransomware attack that started with a social engineering phone call. The attackers didn't exploit some exotic zero-day. They called a help desk, impersonated an employee, and got credentials reset. MGM had security tools. What they lacked was a
The Framework Nobody Reads But Everyone Claims to Follow I once walked into a mid-sized financial firm that proudly declared on their website they were "aligned with NIST standards." Thirty minutes into the assessment, I found admin passwords on sticky notes, no multi-factor authentication on critical systems, and
A $4.88 Million Average — and a Framework Most Organizations Ignore IBM's 2024 Cost of a Data Breach Report pegged the global average at $4.88 million per incident. That's a record. Yet when I ask mid-size companies whether they've implemented any NIST standards,
The Framework Everyone References but Few Actually Implement In 2023, the MOVEit Transfer breach ripped through over 2,600 organizations worldwide. Many of those companies had compliance checklists. Many referenced NIST standards in their security policies. And yet, basic access controls and patch management — core tenets of NIST guidance — were
800 Pages of Security Guidance — and Most Teams Read None of It In 2023, the MOVEit Transfer breach compromised data from over 2,600 organizations worldwide. Many of those organizations claimed compliance with major frameworks. The problem wasn't that NIST standards didn't cover the vulnerability class
In February 2024, NIST released version 2.0 of its Cybersecurity Framework — the biggest overhaul in a decade. Within weeks, I watched organizations scramble to figure out what changed and what they needed to do about it. Most of them were still struggling to implement version 1.1. Here'
In March 2022, the Verizon Data Breach Investigations Report team released preliminary findings showing that 82% of breaches involved the human element — phishing, stolen credentials, and social engineering. Meanwhile, most organizations I work with still treat NIST standards like a dusty compliance checkbox rather than what they actually are: a
In April 2021, the Colonial Pipeline hadn't yet made global headlines — but the SolarWinds breach was still fresh, and the Microsoft Exchange Server vulnerabilities had just rattled tens of thousands of organizations. Every one of those incidents had something in common: the affected organizations either ignored or incompletely
When Change Healthcare suffered its catastrophic ransomware attack in early 2024 — disrupting pharmacy operations across the United States for weeks — investigators found a familiar culprit: stolen credentials and no multi-factor authentication on a critical system. The company's parent, UnitedHealth Group, eventually disclosed the breach affected roughly 100 million
