NIST asks for feedback on using AI to check cybersecurity plans

The National Institute of Standards and Technology is formally soliciting feedback on a new guide designed to integrate artificial intelligence into cybersecurity assessments. NIST Special Publication 1353 ipd details practical applications of AI for analyzing an organization’s progress with the Cybersecurity Framework 2.0.

The document provides structured AI prompts as tools for practitioners, enabling them to create cybersecurity-related documents, and includes three notional use cases illustrating how AI can evaluate policy, map current states, and define target profiles. NIST notes it is only seeking comments on the guide and prompts, not the illustrative fictional organizational documents included within.

AI Prompts for CSF 2.0 Analysis and Reporting

NIST released Special Publication 1353 ipd, a guide designed to demonstrate how artificial intelligence can be applied to cybersecurity assessments using the Cybersecurity Framework (CSF) 2.0, signaling a formal push to integrate AI into organizational security practices. The guide details structured AI prompts intended as tools for cybersecurity practitioners, enabling them to generate CSF-related documentation and analyze progress toward security outcomes. These prompts are not theoretical exercises; the document includes three notional use cases illustrating specific applications within the CSF 2.0 framework.

One use case focuses on leveraging AI to review an organization’s cybersecurity policy, strategy, and risk governance in alignment with CSF 2.0 outcomes. Another demonstrates how AI can draft an Organization Current State Profile, mapping existing artifacts and interview notes to the framework’s outcomes while documenting assumptions and gaps.

A third illustrates the creation of a draft CSF target state profile, outlining desired outcomes based on mission objectives, risk landscapes, and requirements. According to the guide, these examples represent a possible approach and are not intended as prescriptive assessment methodologies.