The United States continues to have complete dependence on information technology deployed in critical infrastructure systems and applications in both the public and private sectors. From the electric grid to voting systems to "Internet of Things" consumer products, the nation remains highly vulnerable to sophisticated, well-resourced cyber-attacks from hostile nation-state actors, criminal and terrorist groups, and rogue individuals. Certain types of advanced threats have the capability to breach our critical systems, establish a presence within those systems (often undetected), and inflict immediate and long-term damage to the economic and national security interests of the Nation.

For the Nation to survive and flourish in the 21^st century, where hostile actors in cyberspace are assumed and information technology will continue to dominate every aspect of our lives, we must develop trustworthy, secure IT components, services, and systems that are cyber resilient. Cyber resilient systems have required security safeguards that are "built in" as a foundational part of the system architecture and design and that can withstand an attack and continue to operate—even in a degraded or debilitated state—to carry out essential functions.

To address these vulnerabilities, NIST is releasing the initial public draft of NIST Special Publication 800-160 Volume 2, Systems Security Engineering: Cyber Resiliency Considerations for the Engineering of Trustworthy Secure Systems, a publication that provides guidelines to help organizations address Advanced Persistent Threats (APT). APTs are threats to IT infrastructure of targeted organizations, orchestrated for purposes of exfiltrating information, undermining, or impeding critical aspects of a mission, program, or organization. This publication is intended to be used in conjunction with NIST Special Publication 800-160 Volume 1, Systems Security Engineering: Considerations for a Multidisciplinary Approach in the Engineering of Trustworthy Secure Systems, which is the flagship Systems Security Engineering guideline (SP 800-160 has been updated and rebranded as “Volume 1.”).

The new publication, Volume 2, addresses actions necessary to develop more defensible and survivable systems—including the components that compose and the services that depend on those systems. The publication can be viewed as a handbook for achieving cyber resiliency, which is the ability to anticipate, withstand, recover from, and adapt to adverse conditions, stresses, attacks, or compromises on cybersecurity resources. Organizations can select, adapt, and use some or all of the cyber resiliency constructs described in this publication and apply them to the technical, operational, and threat environments for which systems need to be engineered.

Systems engineers and enterprise security and risk management professionals can apply the guidance and cyber resiliency considerations outlined in this publication to help ensure that the component products, systems, and services that they need, plan to provide, or have already deployed, can survive when confronted by the APT. The guidance can also be used to guide and inform any investment decisions regarding cyber resiliency. The ultimate objective is to obtain trustworthy secure systems that are fully capable of supporting critical missions and business operations while protecting stakeholder assets, and to do so with a level of assurance that is consistent with the risk tolerance of those stakeholders.