The Act amends the NIST Act so that the Institute, on an ongoing basis, facilitates and supports an industry-led, consensus-driven and voluntary body of standards, guidelines, practices, methods and processes for reducing critical infrastructure cyber risk at reasonable cost; in doing so the Director coordinates closely and regularly with private sector personnel, critical infrastructure owners and operators and industry bodies (the sector councils and the sharing and analysis centres among them) and draws on their expertise; consults the heads of national security, sector-specific and other agencies, state and local governments, other nations and international organisations; identifies a prioritised, flexible, repeatable, performance-based and cost-effective approach, with security measures and controls, that owners and operators may adopt voluntarily to identify, assess and manage cyber risk; includes methodologies to identify and mitigate effects on business confidentiality and to protect privacy and civil liberties; builds in consensus standards adopted voluntarily and industry best practice; aligns with voluntary international standards as far as possible; and avoids duplicating, conflicting with or superseding regulatory requirements and mandatory standards.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.