NISTjuhised

NIST guidelines, or NISTjuhised, are a collection of publications by the National Institute of Standards and Technology (NIST) that provide standards, guidelines, and best practices for information security, privacy, risk management, and related technologies. They are primarily aimed at U.S. federal information systems but are widely used by private sector organizations worldwide. The guidance is voluntary, yet many publications are mandated through policy or procurement.

A central component is the NIST Cybersecurity Framework (CSF), first published in 2014 to help manage cybersecurity risk for critical infrastructure. It organizes activity into five functions—Identify, Protect, Detect, Respond, Recover—and supports a risk-based, adaptable approach. The SP 800-series covers security and privacy controls and related processes; notable items include SP 800-53 Rev. 5 (Security and Privacy Controls), SP 800-53A (assessment), SP 800-37 (Risk Management Framework), and SP 800-171 for protecting Controlled Unclassified Information in nonfederal systems. NIST also publishes SP 800-63 (Digital Identity Guidelines).

Guidelines are developed through open public comment and expert review and are freely available on the NIST website. They are widely adopted by U.S. government agencies and by private organizations as baselines or best practices, and they are periodically updated to reflect new threats, technologies, and regulatory needs.

NIST guidelines serve as a foundational reference for securing information systems and protecting privacy, offering structured, scalable approaches suitable for organizations of varying sizes and risk appetites.