National Institute of Standards and Technology (NIST)
The US federal agency that develops standards, including the most widely used cybersecurity frameworks.
Overview
Part of the US Department of Commerce, NIST publishes the Cybersecurity Framework, the SP 800 series and AI risk management guidance.
Its powers include publishing standards that others adopt.
Instruments connected to it in this glossary include NIST CSF and NIST SP 800 series.
Check the official sources below for legal scope, applicable dates and exceptions. This entry is an explanatory reference, not legal advice.
Why it matters
Its standards become requirements once regulators cite them or contracts demand them.
Who it affects
Organisations in technology and cybersecurity.
Where it sits
Ten linked steps connect where you operate to the proof that you complied.
- 01Jurisdiction
- 02Industry
- 03Activity
- 04Authority
- 05Regulation
- 06Requirement
- 07Guidance
- 08Control
- 09Evidence
- 10Enforcement
Connections
The terms most closely tied to NIST. Select one to open it.
What to do about it
- 1Confirm whether NIST has power over you, and through which licence, registration, membership or activity.
- 2Follow its rules, guidance and enforcement publications as they are issued.
- 3Map each obligation it creates to a control with a named owner.
- 4Keep examination-ready evidence for its highest-risk obligations.
From requirement to evidence.
Regulation Layer tracks its publications in the change feed, maps its obligations to your controls.
Request early access →