Healthcare Security Incident Response Strategy - A Proactive Incident Response (IR) Procedure

Initiating the construction or assessment of the incident response program requires a blueprint. Leveraging leading practices lessons learned from others shortens the incident response learning curve. The National Institute of Standards and Technology (NIST) publishes many documents available for cybersecurity practitioners, specifically, the NIST (SP) 800-61 Computer Security Incident Handling Guide. The guidance in this document addresses the incident response elements required to build a plan and team. This approach removes the guesswork and prevents the program from becoming purely technical in nature. Cybersecurity events and incidents are not just cybersecurity problems but also business problems. Although NIST SPs are designed to ensure compliance by federal agencies, they are considered best practices and often adopted by industry.

The growing complexity of cyber threats, especially within critical infrastructure sectors like healthcare, energy, and maritime, highlights the need for comprehensive frameworks to facilitate the exchange of Cyber Threat Intelligence (CTI). This paper presents a CTI Exchange Governance Model aimed at enhancing the CTI sharing process within the DYNAMO platform, a European Union initiative focused on improving resilience against cyber threats across various phases of the resilience cycle: Prepare, Prevent, Protect, Respond, Recover, and Learn & Adapt. The DYNAMO project provides a suite of tools and strategies to support organizations in critical sectors, enabling efficient threat detection, mitigation, and response while fostering collaboration and compliance with regulatory standards. Sector-specific scenarios have been developed to address unique vulnerabilities in areas like healthcare, energy, and maritime, ensuring practical and targeted solutions for improving cyber resilience. While DYNAMO’s integrated tools handle CTI generation and alerts, a standardized and cohesive framework is still needed to guide and streamline CTI sharing across sectors, addressing gaps in current practices that impact interoperability and timely response. This governance model is structured around five key pillars: Collaboration & Trust, Data Sensitivity & Standardization, Compliance & Regulatory Alignment, Real-Time Collaboration & Response, and Continuous Learning & Improvement. These pillars ensure a secure, standardized, and compliant approach to CTI exchange, particularly in sectors vulnerable to increasingly sophisticated attacks. The model is uniquely tailored to align with DYNAMO's mission, offering a sector-specific approach while integrating best practices from established cybersecurity frameworks. The model is operationalized through the DYNAMO platform, leveraging tools like the Early Warning System (EWS) for real-time CTI sharing and a Data Anonymization Tool to ensure privacy and regulatory compliance. As a result, a practical framework has been developed to tailor the model’s implementation across healthcare, energy, and maritime sectors, ensuring a scalable and adaptable approach to CTI sharing. Ultimately, the governance model enhances CTI exchange by addressing interoperability challenges and strengthens governance practices to support collaboration, improve incident response times, and foster continuous improvement.

The increasing frequency and sophistication of cyber threats have underscored the need for enhanced cybersecurity readiness among organizations in the U.S. and Canada. To address this need, this paper introduces a Cybersecurity Maturity Framework (CMF) designed to assist organizations in systematically assessing and improving their cybersecurity capabilities. The framework provides a structured approach for evaluating current security postures, identifying gaps, and prioritizing investments to mitigate risks effectively. The proposed CMF consists of five maturity levels: Initial, Developing, Established, Advanced, and Optimized. Each level encompasses critical domains, including governance, threat intelligence, incident response, and workforce development, with defined benchmarks to measure progress. By incorporating best practices from the National Institute of Standards and Technology (NIST) Cybersecurity Framework and Canada's Cyber Security Strategy, the CMF ensures alignment with regional regulatory requirements and industry standards. A key feature of the framework is its adaptability to organizations of various sizes and sectors. The CMF integrates advanced technologies such as artificial intelligence (AI) and machine learning (ML) for threat detection and predictive analytics while emphasizing the importance of human factors, including continuous employee training and leadership engagement. Moreover, the framework promotes collaboration between public and private sectors to facilitate information sharing and collective defense against evolving cyber threats. Through case studies, the application of the CMF is demonstrated in enhancing cybersecurity readiness for small and medium enterprises (SMEs) and large organizations in critical sectors such as healthcare, finance, and energy. Results indicate improved incident detection rates, faster response times, and strengthened resilience against sophisticated cyberattacks. This research highlights the necessity of adopting a maturity-based approach to cybersecurity, ensuring organizations can evolve their capabilities to counter dynamic threats. The Cybersecurity Maturity Framework provides a roadmap for sustainable improvement, empowering organizations in the U.S. and Canada to achieve a higher state of preparedness and resilience in the face of an ever-changing cyber threat landscape.

Standards provide critical benefits across a wide variety of contexts, including safety and health, environmental protection, and quality of products and services. However, while these benefits are generally acknowledged, estimating the social and economic value of standards and determining how specific entities and activities influence their development require careful analysis. In October of 2018, the National Institute of Standards and Technology (NIST) asked the RAND Corporation to estimate the benefit of NIST’s research contributing to particular fire safety standards. The original objectives of the project were to (1) document the role of the NIST in the standards development process, (2) estimate the value these standards provide to society, and (3) thereby inform the economic value of NIST’s contribution to these standards. This report presents results for the first two objectives. Given that NIST’s contribution is one of several inputs combining to create these standards, NIST’s share of the credit for their value could not be quantified. Our analysis focused on case studies in standards for home smoke alarms and for protecting structures at the wildland-urban interface (WUI). Our analysis draws on a wide variety of qualitative and quantitative methods to holistically describe the impacts of these standards and NIST’s role in their development. The intended audience of this report includes those who work on fire safety research, fire safety standards, building codes, and technology transfer. The conclusions presented here may also be of interest for broader resource allocation and federal budget justification purposes. Finally, this report was written to be accessible to any interested members of the general public.

The Clean Air Mercury Rule (CAMR) which was published in the Federal Register on May 18, 2005, requires that calibration of mercury continuous emissions monitors (CEMs) be performed with NIST-traceable standards. Western Research Institute (WRI) is working closely with the Electric Power Research Institute (EPRI), the National Institute of Standards and Technology (NIST), and the Environmental Protection Agency (EPA) to facilitate the development of the experimental criteria for a NIST traceability protocol for dynamic elemental mercury vapor generators. The traceability protocol will be written by EPA. Traceability will be based on the actual analysis of the output of each calibration unit at several concentration levels ranging from about 2-40 ug/m{sup 3}, and this analysis will be directly traceable to analyses by NIST using isotope dilution inductively coupled plasma/mass spectrometry (ID ICP/MS) through a chain of analyses linking the calibration unit in the power plant to the NIST ID ICP/MS. Prior to this project, NIST did not provide a recommended mercury vapor pressure equation or list mercury vapor pressure in its vapor pressure database. The NIST Physical and Chemical Properties Division in Boulder, Colorado was subcontracted under this project to study the issue in detail and to recommend a mercury vapormore » pressure equation that the vendors of mercury vapor pressure calibration units can use to calculate the elemental mercury vapor concentration in an equilibrium chamber at a particular temperature. As part of this study, a preliminary evaluation of calibration units from five vendors was made. The work was performed by NIST in Gaithersburg, MD and Joe Rovani from WRI who traveled to NIST as a Visiting Scientist.« less

A Look at its Past Decade and a Gaze towards its Future. As the National Metrology Institute (NMI) for the United States, the National Institute of Standards and Technology (NIST), formerly the National Bureau of Standards, has provided measurement services, both calibrations and reference materials, for more than 100 years. Through these services, our customers have benefitted from our measurement capabilities and expertise in many areas, including amount of substance; dimensional metrology; electricity and magnetism; ionizing radiation; mass and related quantities; photometry and radiometry; thermodynamics; and time and frequency. NIST’s customers have also had access to some of the lowest measurement uncertainties available and a dependable way to establish traceability to the International System of Units (SI) [http://www.nist.gov/pml/wmd/metric/si-units.cfm].In response to the signing of the International Committee for Weights and Measures (CIPM) Mutual Recognition Arrangement (MRA), NIST first established an institution-wide quality system for the measurement services 10 years ago [http://www.bipm.org/en/cipm-mra/objectives.html]. NIST’s Quality System for Measurement Services has advanced the quality of service and measurements we provide our customers by fostering an environment in which NIST management and staff work towards continual improvement in the development and delivery of NIST measurement services. This paper describes NIST’s Quality System for the Measurement Services and its relevance to international standards of quality, such as the International Organization for Standardization and the International Electrotechnical Commission (ISO/IEC) 17025 standard and ISO Guide 34 [http://www.nist.gov/nistqs/]. It also provides a history of this quality system and a glimpse of future goals for improving its implementation.

As cybersecurity issues surge, it highlights the pressing need for increased awareness. In our digitally interconnected world, where information technology underpins the lives of individuals, businesses, and even national security, the threat of cyberattacks looms large. To enhance national cybersecurity preparedness, there is a critical call to action: we must promote public awareness of cybersecurity issues and bolster the ranks of trained cybersecurity professionals. This research introduces a novel cybersecurity awareness model based on the National Institute of Standards and Technology (NIST). Its primary goal is to make NIST accessible to secondary school students pursuing ICT courses and their invaluable resource, the school counselling units. The model aims to instil cybersecurity awareness in secondary school students and guide them in choosing the most suitable higher education paths, particularly in the ICT and cybersecurity fields. The study comprises three phases. In the first phase, a systematic literature review (SLR) examines globally applicable cybersecurity education models. The second phase investigates the implementation of cybersecurity education for secondary school students in Malaysia. This includes interviews with school counselling units responsible for guiding students toward higher education and surveys of students in grades four and five enrolled in ICT courses. The third and pivotal phase focuses on developing the proposed model. It involves analysing and implementing the results of the SLR, mapping them to the NIST framework, and incorporating themes from interviews and surveys. As a tangible representation of the model, a mobile application prototype has been developed. The Cybersecurity Awareness Model empowers school counselling units to seamlessly integrate career exploration with career decision-making for secondary students at any stage of their development. Moreover, it offers a means to create strategies for after-school programs, particularly in the dynamic field of cybersecurity. This model is expected to guide students in exploring academic majors and careers, preparing for higher education post-high school, initiating internships or job searches, and adapting to a world in constant flux. In doing so, it not only empowers individuals but also strengthens the nation's resilience in the face of cybersecurity challenges.

In the fall of 2019, the National Institute of Standards and Technology (NIST) funded threes studies to better understand equity and inclusivity. This report documents phase two of a three phased sequential, exploratory mixed methods study designed to provide an in-depth look at the population of NIST federal employees to identify factors, attitudes, and processes that might result in gender- specific barriers at NIST. Phase 1 analyzed human resources demographic data, compensation data, and performance data of NIST federal employees from 2011 to 2019 to determine any relevant trends. Phase 1 informed the development of an in-depth interview protocol designed to identify the differences, if any, in the ways in which men and women experience work at NIST. A total of 40 (36 female and 4 male) participants were interviewed. Three interconnected themes emerged in the data: 1) a culture at NIST that creates a Chilly Climate for women; 2) gendered experiences that contribute to and are outcomes of that chilly climate; and 3) gendered outcomes that influence women s experiences in the organization. The culture has evolved from NIST s scientific roots, scientific excellence, a strong belief in meritocracy, and as a Federal agency. Each of these characteristics contribute to a gendered social structure and the perception that change is not needed. This backdrop sets the stage for the characterizations of NIST from the interviews as a Boys Club and an Elitist environment. The radically different perspectives of men and women based in the culture result in experiences and outcomes that provide advantages and opportunities for men while erecting barriers to survival for women, including isolation and possibly exclusion. These barriers result in consequences of discrimination as well as lack of trust and resignation. Participant quotes are used as exemplars to provide details related to each of these themes. Overall, the interviews demonstrate that women and men experience a very different NIST.

The National Institute of Standards and Technology (NIST), formerly the National Bureau of Standards, was established by the U.S. Congress in 1901 and charged with establishing a measurement foundation to facilitate U.S. and international commerce. NIST provides reference materials and reference instruments that are used to ensure the accuracy, metrological traceability, and comparability of measurement results in many diverse fields of science, industry, and technology. This document provides and explains the vocabulary used at NIST to describe the reference materials and reference instruments available to NIST s customers. This document also describes the methods used in developing NIST reference materials. The definitions and descriptions provided supersede those used in the original versions of this publication, NIST SP260-136 and SP260-136-2020.

This paper presents a summary of the strategies and activities underway at the National Institute of Standards and Technology (NIST) in electronics packaging, interconnection and assembly (P/I/A). In addition, a sampling of collaborations involving these works is included. The overall NIST effort in P/I/A is composed of targeted programs conducted by the NIST laboratories and by the NIST Advanced Technology Program (ATP). A dominant aspect of the laboratory-based P/I/A program focuses on the metrology and data needed to support the product technologies envisioned within industry roadmaps. A significant aspect of the work includes efforts in metrology, materials, complex material assemblies, and microelectronic components and circuits. In parallel, the NIST ATP is supporting on a cost-share basis a variety of industry-based development projects of high-risk enabling technologies for new or improved products, manufacturing, and processes in P/I/A.

The increased reliance of industrial automation on interconnected systems has made it vulnerable to cyber threats. Conventional security techniques frequently inadequately handle the dynamic and developing threat landscape. This chapter examines the essential function of Cyber Threat Intelligence (CTI) in improving the security framework of IACS environments. It specifically emphasizes utilizing artificial intelligence (AI) to automate and enhance cyber threat intelligence (CTI) processes, facilitating proactive threat detection, analysis, and response. This chapter will explore the problems associated with safeguarding IACS, the advantages of establishing a comprehensive CTI program, and the utilization of AI methodologies, including machine learning, deep learning, and natural language processing, for the gathering, analysis, and dissemination of threat data. Practical examples and case studies will demonstrate the implementation of AI-driven CTI techniques in reducing cyber risks and enhancing the resilience of essential industrial infrastructure.

On September 5–8, 2023, the National Institute of Standards and Technology (NIST) held the second Standards and Performance Metrics for On‐Road Automated Vehicles Workshop. This four‐day virtual event provided updates on NIST’s recent work in automated vehicles (AVs) and gave stakeholders an opportunity to provide feedback and input on current and future NIST research. The workshop included high‐level keynote presentations, a series of industry keynote presentations, and NIST presentations on its current AV activities. The industry keynotes and NIST presentations were paired with breakout sessions that discussed NIST’s progress, community challenges, and stakeholder research needs in six key areas: systems interaction, perception, cybersecurity, communications, artificial intelligence, and digital infrastructure. There was general agreement that developing standards allows for better comparisons and evaluations of emerging technologies. Other key themes included: 1) Digital technologies for automation and related security/privacy concerns, including artificial intelligence, machine learning, and smart communication technologies (i.e., vehicle‐to‐vehicle (V2V), vehicle‐to‐infrastructure (V2I), and vehicle‐to‐everything (V2X)), 2) Need for standardized or common language to improve information sharing, 3) Open data sets to support and validate technical advances and standardization across system components and areas (i.e., standards evolving in parallel with technology), and 4) Pivotal role for NIST as a convener to bring diverse stakeholders together for knowledge exchange and cross‐industry dialogue.

In consultation with ASTM and other stakeholders in Tissue-Engineered Medical Products (TEMPs) industry, the National Institute of Standards and Technology (NIST) initiated a project designed to produce Reference Material scaffolds for tissue engineering. The rationale for Reference Material scaffolds was developed through several NIST/Industry workshops. In brief, Reference Material scaffolds have multiple uses: facilitating the development and the validation of new test methods that measure interactions among various components of a TEMP; comparison with other scaffolds and scaffold materials in terms of cellular responses, biodegradation, and releases of growth factors; and comparisons of responses among various cell lines. The primary customers for Reference Material scaffolds are expected to be the TEMPs industry, academic researchers, regulators, and standards developing organizations. There are many properties of a TEMP that warrant development of multiple Reference Material scaffolds. Currently, NIST is defining a set of Reference Material scaffolds based on geometric descriptors such as permeability, pore volume, pore size distribution, interconnectivity, and tortuosity. In consultation with ASTM, NIST is testing three candidate scaffolds produced by: three dimensional (3-D) printing, stereolithography, and fused deposition modeling (FDM). Scaffolds made by these methods have been obtained from Mayo Clinic (Rochester, MN), Case Western Reserve University (CWRU) (Cleveland, OH), and Osteopore International (Singapore), respectively, for structural characterization. These prototype scaffolds, with well-defined architectures, have been selected to address the following items of interest: 1) establishment of useful functional definitions of porosity content, interconnectivity, and pores; 2) evaluation of testing methods listed in the Standard Guide for the Porosity of Polymeric Scaffolds for Use in Tissue-Engineered Medical Products, which is being drafted by ASTM. Currently, NIST and the Center for Devices and Radiological Health of the Food and Drug Administration, as well as other groups from US and foreign laboratories, are actively carrying out cross-validation test of these prototype scaffolds.

Current threat intelligence systems often lack scalable, adaptive AI architectures capable of delivering real-time incident detection and dynamic response, particularly in resource-constrained environments. This paper presents a novel AI-driven architectural design for operational threat intelligence, specifically tailored to enhance cybersecurity in global and Kenyan judiciaries. The proposed model integrates three foundational frameworks, which are Integrated Adaptive Cyber Defence (IACD), the Cyber Kill Chain, and Moving Target Defence (MTD), into an architecture that supports real-time data ingestion, continuous AI model retraining, and automated response orchestration. The research design for this study adopts a mixed-methods approach, combining qualitative and quantitative methods to ensure a comprehensive understanding of the AI-driven operational Cyber Threat Intelligence (CTI) model. Key features include a dynamic feedback loop for adaptive learning, AI-powered multi-stage threat detection aligned with attack lifecycle mapping, and resource-efficient dynamic defence mechanisms suitable for low-resource judicial environments. This design significantly improves incident response capabilities by enabling faster, more accurate threat detection and automated mitigation, reducing mean time to detect and respond. By providing a scalable, transparent, and explainable AI model, the architecture offers a practical blueprint for enhancing cybersecurity resilience in judicial systems worldwide, with applicability to the unique challenges faced by Kenyan courts. This work lays the foundation for future extensions involving federated learning to enable secure, multi-court deployments, further strengthening collective judicial cybersecurity defences.

Black hat hackers use malicious exploits to circumvent security controls and take advantage of system vulnerabilities worldwide, costing the global economy over $450 billion annually. While many organizations are increasingly turning to cyber threat intelligence (CTI) to help prioritize their vulnerabilities, extant CTI processes are often criticized as being reactive to known exploits. One promising data source that can help develop proactive CTI is the vast and ever-evolving Dark Web. In this study, we adopted the computational design science paradigm to design a novel deep learning (DL)-based exploit-vulnerability attention deep structured semantic model (EVA-DSSM) that includes bidirectional processing and attention mechanisms to automatically link exploits from the Dark Web to vulnerabilities. We also devised a novel device vulnerability severity metric (DVSM) that incorporates the exploit post date and vulnerability severity to help cybersecurity professionals with their device prioritization and risk management efforts. We rigorously evaluated the EVA-DSSM against state-of-the-art non-DL and DL-based methods for short text matching on 52,590 exploit-vulnerability linkages across four testbeds: web application, remote, local, and denial of service. Results of these evaluations indicate that the proposed EVA-DSSM achieves precision at 1 scores 20% - 41% higher than non-DL approaches and 4% - 10% higher than DL-based approaches. We demonstrated the EVA-DSSM’s and DVSM’s practical utility with two CTI case studies: openly accessible systems in the top eight U.S. hospitals and over 20,000 Supervisory Control and Data Acquisition (SCADA) systems worldwide. A complementary user evaluation of the case study results indicated that 45 cybersecurity professionals found the EVA-DSSM and DVSM results more useful for exploit-vulnerability linking and risk prioritization activities than those produced by prevailing approaches. Given the rising cost of cyberattacks, the EVA-DSSM and DVSM have important implications for analysts in security operations centers, incident response teams, and cybersecurity vendors.