Cybersecurity and Privacy Reference Tool CPRT

Roadmap

Our initial planning for the CPRT project comprises three phases:

Phase 1: Free the Data

We are currently in Phase 1, which involves developing the data format and freeing the data from a selection of our guidelines and frameworks with broad impact. This data is typically locked into publications. By moving it into a shared repository using a newly-developed unified data format, we will now be able to offer new ways to interact with and download the data. Phase 1 offers only basic tools for interacting within each reference datasets.

Phase 2: Manage the Data

Phase 2 in late 2022 will involve managing the data. We’ll develop new internal administrative tools enabling NIST subject matter experts to update and curate the reference datasets in the CPRT Catalog throughout the life cycle.

Phase 3: Expand the User Experience

Eventually, in Phase 3 we will be expanding the user experience, developing new tools and adding functionalities to the public interface for users to interact with the reference datasets.  Some example use cases include:

• Navigating and discovering relationships and dependencies among the different datasets.

• Crosswalking between NIST and industry sector-specific reference datasets.

• Soliciting input and comments from the community at the data element level, such as control, function, category, practice, skill, etc.

• Releasing updates at the data element level.

• Providing a historical record of changes at the data element level.

• Enabling stakeholders to build their own profile, overlay, baseline, and template based on the NIST reference data.