Key Takeaways
- The NIST Cybersecurity Framework (CSF) v2.0 remains the cornerstone for managing cyber risk, but rapid advances in AI and quantum computing demand a refreshed approach.
- Five strategic pillars—Adaptive Risk Management, Resilience via Design, Trust‑Centered Governance, Crypto‑Agility & Quantum Readiness, and Human Capital & Collaboration—are identified as essential for building resilience and trust in the “acceleration era.”
- NIST is developing a Cyber AI Profile based on the CSF to provide concrete guidance on securing AI development and deployment, with a focus on practical, implementable resources for all organization sizes.
- The National Cybersecurity Center of Excellence (NCCoE) is leading six AI‑focused projects, embedding AI considerations across its work and emphasizing the need for a common AI taxonomy, use‑case illustrations, and flexible, machine‑readable guidance formats.
- Workshop participants highlighted critical gaps: agentic AI considerations, longevity of guidance, testing and evaluation challenges, AI governance, transparency, and the continued necessity of human‑in‑the‑loop processes.
- State and local government professionals are encouraged to engage with the Cyber AI Profile working groups, review drafts, and submit comments to ensure the guidance remains relevant, usable, and aligned with operational realities.
Introduction and Context
Over the past several years, the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF)—now at version 2.0—has served as the primary reference for federal, state, local, and private‑sector organizations seeking to manage cybersecurity risk. The CSF’s core functions (Identify, Protect, Detect, Respond, Recover) have provided a flexible, risk‑based structure that can be tailored to diverse missions and technologies. However, the emergence of powerful artificial intelligence (AI) systems and the looming threat of quantum computing are reshaping the risk landscape. These technologies accelerate both the speed and sophistication of cyber threats while also offering new defensive capabilities. Consequently, organizations must reconsider traditional risk‑management assumptions and adopt a more agile, forward‑looking posture to maintain resilience and trust.
Strategic Pillars for Resilience
In response to this evolving environment, Chuck Brooks outlined five strategic pillars that enterprises should emphasize to increase resilience and trust in what he terms the “acceleration era.” The first pillar, Adaptive Risk Management, calls for continuous monitoring, real‑time threat intelligence, and dynamic adjustment of controls rather than static, periodic assessments. Resilience via Design encourages embedding redundancy, fault tolerance, and recoverability into systems from the outset, ensuring that attacks or failures cause minimal disruption. Trust‑Centered Governance stresses transparent policies, accountability mechanisms, and stakeholder engagement to build confidence in both technology and processes. Crypto‑Agility and Quantum Readiness prepares organizations to transition swiftly to post‑quantum cryptographic algorithms as quantum computers mature, safeguarding data confidentiality and integrity. Finally, Human Capital and Collaboration recognizes that skilled personnel, cross‑functional teamwork, and partnerships with academia, industry, and government are vital for sustaining effective cybersecurity programs amid rapid technological change.
NIST Updates and the Cyber AI Profile
Recognizing the need for concrete guidance, NIST has launched a series of updates this spring, detailed on its public website. Central to these efforts is the development of a Cyber AI Profile grounded in the CSF. The profile aims to address cybersecurity risks associated with both the development and use of AI, as well as the application of AI to improve cybersecurity defenses. NIST, through its National Cybersecurity Center of Excellence (NCCoE), is considering a Community Profile that translates CSF principles into actionable recommendations for the AI domain. The process includes opportunities for public comment, iterative drafts, and stakeholder workshops to ensure the guidance is broadly applicable, technically sound, and responsive to real‑world challenges.
NCCoE Activities and AI Integration
The Federal News Network recently highlighted the NCCoE’s expanding AI focus. Director Cherilyn Pascoe noted that AI is becoming a foundational element across all center projects, with six distinct initiatives currently exploring the intersection of AI and cybersecurity. These projects seek to produce practical guidance that can be adopted by government agencies, industry partners, and academic institutions. Pascoe emphasized that AI’s influence will likely permeate every future NCCoE effort, underscoring the urgency of establishing standards, best practices, and interoperable frameworks that enable secure AI adoption while mitigating associated risks.
Workshop Feedback and Key Themes
During the second NIST Cyber AI Profile Workshop, participants voiced strong support for the initiative and identified several critical gaps that the profile must address. Discussions revealed a need for special considerations around agentic AI—systems capable of autonomous decision‑making—and called for more illustrative examples in the guidance. Attendees urged that the profile avoid overly prescriptive, short‑lived recommendations, instead focusing on enduring principles that can accommodate rapid innovation. A consistent, industry‑agnostic AI taxonomy was highlighted as essential for clear communication across sectors. Participants also requested concrete use cases (e.g., operational technology cybersecurity) and illustrative examples to aid implementation. To enhance usability, suggestions included a workbook‑style format, machine‑readable outputs, and extensive hyperlinking for easy navigation.
Additional themes centered on AI governance and accountability, noting that current approaches vary widely and require harmonization. Testing and evaluation emerged as a common challenge, with participants advocating for performance metrics, certifications, and benchmarking to assess AI system reliability. The workshop also stressed the role of cybersecurity in ensuring the trustworthiness of AI decisions, advocating for transparency, integrity, and accountability mechanisms. Finally, there was broad consensus that human‑in‑the‑loop (HITL) processes and ongoing training remain indispensable, even as AI automation advances, to oversee critical security functions and intervene when necessary.
Implications for State and Local Government
For state and local government professionals, the evolving NIST guidance offers both a roadmap and a call to action. Engaging with the Cyber AI Profile working groups provides an opportunity to shape standards that reflect the unique constraints and missions of public‑sector entities, such as limited budgets, legacy systems, and heightened accountability to citizens. By reviewing drafts, submitting comments, and participating in workshops, these stakeholders can help ensure that the resulting guidance is practical, scalable, and aligned with the operational realities of municipal agencies, public utilities, and emergency services. Moreover, adopting the five strategic pillars—particularly Adaptive Risk Management and Human Capital & Collaboration—can empower governments to bolster their cybersecurity posture while fostering trust with the communities they serve.
Conclusion and Call to Action
The NIST CSF has long been a cornerstone of cybersecurity best practice, but the accelerating impact of AI and quantum computing necessitates a proactive evolution of that framework. The five strategic pillars articulated by Brooks provide a high‑level blueprint for building resilience and trust, while the nascent Cyber AI Profile promises to translate those principles into specific, actionable guidance for the AI era. Active participation in NCCoE projects, workshop dialogues, and public comment periods will be crucial for ensuring that the resulting standards are relevant, usable, and effective across sectors—especially for state and local governments tasked with protecting critical infrastructure and public data. By embracing this collaborative, forward‑looking approach, organizations can navigate the complexities of the acceleration era and maintain robust cybersecurity defenses in the face of ever‑changing threats.