Date Published: June 15, 2023
Comments Due:
Email Questions to:
Planning Note (02/26/2024):
This report references the NIST Cybersecurity Framework v1.1.
Author(s)
Natalia Martin (NIST), Ronald Pulivarti (NIST), Justin Wagner (NIST), Samantha Maragh (NIST), Jennifer McDaniel (NIST), Justin Zook (NIST), Andrew Bennett (MITRE), Brett Kreider (MITRE), Christina Sames (MITRE), Julie Snyder (MITRE), Bob Stea (MITRE), Kevin Wilson (MITRE), Martin Wojtyniak (MITRE)
Announcement
The Cybersecurity Framework (CSF) Profile for Genomic Data provides voluntary guidance to help organizations manage, reduce, and communicate cybersecurity and privacy risks for systems, networks, and assets that process genomic data. This publication is a follow-on effort to NIST Internal Report (IR) 8432, The Cybersecurity of Genomic Data, and was developed in collaboration with stakeholders across industry, academia, and government. This effort is informed by direction from Congress, the White House, and NIST’s existing expertise in genomics as well as cybersecurity.
The Profile identifies 12 genomic-related Mission Objectives and prioritizes relevant CSF Subcategories to help organizations protect genomic data throughout the data lifecycle.
Organizations processing genomic data can use this guidance to:
- Understand genomic data cybersecurity considerations
- Assess current organizational cybersecurity practices to identify gaps and areas of improvement for existing practices or infrastructure
- Develop individualized organizational Current (As-Is) and Target (To-Be) Profiles
- Prioritize investments in cybersecurity capabilities aligned to the CSF Subcategories identified as most important to support organizational Mission Objectives
- Understand the relationship between cybersecurity and privacy risk management
The CSF Profile for Genomic Data is intended to supplement, not replace, current cybersecurity standards, regulations, and industry guidelines. Organizations should consider their unique obligations, operating environment, and Mission Objectives when prioritizing and implementing cybersecurity capabilities and controls. While the focus of this CSF Profile is cybersecurity, whenever human genomic data is processed, privacy risk management considerations must also be addressed. As a result, privacy is referenced in multiple places throughout the CSF Profile where cybersecurity and privacy risks overlap. NIST plans to address the broader privacy landscape for genomic data by creating a Profile using the NIST Privacy Framework: A Tool for Improving Privacy Through Enterprise Risk Management (“Privacy Framework”). Once created, the Privacy Framework Profile for Genomic Data should be used as a complementary tool to this CSF Profile.
Submit Comments
The public comment period closes at 11:59 PM ET on July 17, 2023. Please email all draft comments to genomic_cybersecurity_nccoe@nist.gov. We encourage you to submit all feedback using the comment template found on our project page.
Join the Community of Interest
If you have expertise in genomic data and/or cybersecurity, consider joining the NCCoE Genomics Cybersecurity Community of Interest (COI) to receive the latest project news and announcements. Email the team at genomic_cybersecurity_nccoe@nist.gov declaring your interest, or complete the sign-up form on our project page.
NOTE: A call for patent claims is included on page ii of this draft. For additional information, see the Information Technology Laboratory (ITL) Patent Policy – Inclusion of Patents in ITL Publications.
Low-cost genomic sequencing technologies facilitate collection, sequencing, and analysis of vast quantities of genomic data, fueling our nation’s economic and health leadership posture. However, this valuable genomic information may not be protected with sufficient rigor commensurate with cybersecurity and privacy risks. In response, the National Institute of Standards and Technology (NIST) engaged genomic stakeholders across government, academia, and industry to inform the voluntary, risk-based guidance contained in this Cybersecurity Framework (CSF) Profile for Genomic Data. This Profile describes the primary Mission Objectives of organizations processing genomic data and identifies priority CSF Subcategories that can help organizations select and implement cybersecurity capabilities that support their mission. While this Profile shows intersections between cybersecurity and privacy risk management considerations for processing genomic data, it is focused only on the cybersecurity aspects of those intersections. Future work is planned to address broader privacy risk management considerations. The Profile is meant to supplement, not replace, current cybersecurity and privacy standards and industry guidelines that organizations already use to secure their genomic data.
Low-cost genomic sequencing technologies facilitate collection, sequencing, and analysis of vast quantities of genomic data, fueling our nation’s economic and health leadership posture. However, this valuable genomic information may not be protected with sufficient rigor commensurate with...
See full abstract
Low-cost genomic sequencing technologies facilitate collection, sequencing, and analysis of vast quantities of genomic data, fueling our nation’s economic and health leadership posture. However, this valuable genomic information may not be protected with sufficient rigor commensurate with cybersecurity and privacy risks. In response, the National Institute of Standards and Technology (NIST) engaged genomic stakeholders across government, academia, and industry to inform the voluntary, risk-based guidance contained in this Cybersecurity Framework (CSF) Profile for Genomic Data. This Profile describes the primary Mission Objectives of organizations processing genomic data and identifies priority CSF Subcategories that can help organizations select and implement cybersecurity capabilities that support their mission. While this Profile shows intersections between cybersecurity and privacy risk management considerations for processing genomic data, it is focused only on the cybersecurity aspects of those intersections. Future work is planned to address broader privacy risk management considerations. The Profile is meant to supplement, not replace, current cybersecurity and privacy standards and industry guidelines that organizations already use to secure their genomic data.
Hide full abstract
Keywords
Cybersecurity Framework Profile; DNA sequencing; executive order; genomics; genomic data; genomic sequencing; human genome; informed consent
Control Families
None selected
