NIST Releases Draft SP 800-100 Revision 1: Information Security Handbook
The initial public draft (ipd) of NIST Special Publication (SP) 800-100r1 (Revision 1), Information Security Handbook: A Guide for Executive Leadership, is now available for comment.
Since the original version of SP 800-100 was released in 2006, the cybersecurity landscape, regulatory environment, and NIST’s body of guidelines have changed substantially. This revision restructures the handbook to align with the general organization of the NIST Cybersecurity Framework (CSF) 2.0 and provides high-level summaries of key cybersecurity topics, including governance, risk management, information exchange, security awareness and training, contingency planning, configuration management, and incident response. It also discusses the relationships between these core concepts for executive leadership in both public- and private-sector organizations. The document points to other NIST publications throughout for more detailed technical implementation guidelines.
The draft covers:
- An overview of key NIST frameworks and how they relate to one another
- Governance, including risk management fundamentals and enterprise risk management
- Topics organized under the CSF’s Identify, Protect, and Detect/Respond/Recover functions
- Continuous monitoring strategy and roles
A public comment review period is open from October 12 to December 4, 2026. Commenters are encouraged to use the comment template and submit feedback to sp800-100-comments@nist.gov.
NOTE: A call for patent claims is included on page iv of this draft. For additional information, see the Information Technology Laboratory (ITL) Patent Policy – Inclusion of Patents in ITL Publications.
NIST Cybersecurity and Privacy Program
Questions and comments can be directed to: sp800-100-comments@nist.gov
CSRC Website questions: csrc-inquiry@nist.gov
|
