Understanding NIST: What All Model Risk Management (MRM) Teams Should Know

The National Institute of Standards and Technology (NIST) is a non-regulatory Federal agency within the U.S. Department of Commerce. The NIST Cybersecurity Framework helps businesses understand cybersecurity risk and how to manage and protect their networks more effectively.

To that end, NIST provides its standards, guidelines, and research outputs freely to the public to support innovation and industrial competitiveness. Its contributions to model risk management (MRM) include the development of comprehensive standards and best practices that address the complexities and challenges associated with model validation, verification, and governance.

By leveraging NIST’s robust frameworks, such as the Risk Management Framework (RMF) and the Cybersecurity Framework (CSF), professionals can better assess and mitigate risks associated with model deployment and use. These resources help ensure that models are not only compliant with regulatory requirements but also resilient against emerging threats, thereby safeguarding the integrity and trustworthiness of financial systems.

What Model Risk Management Teams Should Know about NIST

The NIST Cybersecurity Framework is divided into five categories; Identify, Protect, Detect, Respond, and Recover. These functions break down further into 23 categories and over 100 subcategories, each defining different cybersecurity outcomes and controls.

Trust is becoming increasingly critical as machine learning and AI shape the tech future at financial institutions and other industries like insurance, healthcare, etc. AI systems are meant to be dependable and secure, and NIST is here to help MRM teams achieve this goal. With this in mind, it’s important for Model Risk Management (MRM) teams to know how to use NIST to make the most of its capabilities. 

That starts by understanding the five NIST CSF categories:

Identify

The first function in using the NIST Cybersecurity Framework is to identify and organize everything in the organization, like equipment, software, and data usage. This also involves applying a risk management framework (RMF) as outlined in NIST SP 800-37. 

The RMF makes it easier to manage security and privacy risk by covering categorization, authorization, control selection and monitoring. It helps MRM teams to manage risks in real time and maintain system authorization. This process involves keeping a detailed inventory and proper documentation with senior management oversight.

By incorporating security and privacy into the system development life cycle, the RMF gives senior leaders the information they need for smart risk management decisions and sets accountability for the controls in place. 

Discover another regulation | A Model Risk Management Overview of E-23 Compliance Strategies

Protect and Detect

The second and third functions are closely linked to the first. The ‘Protect’ function involves applying security controls and practices from NIST SP 800-53 to safeguard information systems and data, and implementing required security controls within Controlled Unclassified Information (CUI) as per SP 800-171. The ‘Detect’ function focuses on monitoring unauthorized access to software and services. 

Protecting classified information is a given, what gets overlooked is the unclassified information. Tracking who logs onto and uses the organization’s network helps spot unauthorized users and investigate suspicious activities. The NIST framework helps encrypt and protect sensitive data, whether it’s active or not, and ensures regular security software updates.

Proper training and awareness of this framework are also key. MRM teams should understand cybersecurity and its benefits, allowing them to recognize personal risk. Knowing how to use the framework means MRM teams cna fully leverage its capabilities, using tools to detect unauthorized access and potential threats. 

This keeps the organization in control and ensures MRM teams understand the importance of maintaining confidentiality and adhering to security protocols, providing significant advantage. 

Respond

In case of a data breach, it’s crucial to notify all parties involved whose data might be at risk. This is where the fourth function, ‘Respond’, comes into play. This part of the framework involves developing procedures to detect and manage cybersecurity incidents effectively. 

To keep operations running smoothly, MRM teams need to communicate effectively with internal and external stakeholders, keeping everyone updated on the situation. Investigating and containing the attack is necessary to prevent future breaches. Implementing a response plan and conducting proper analysis helps minimize security breaches. Updating the cybersecurity policy and planning for potential incidents also improves future responses. 

By following these practices, MRM teams can significantly enhance their organization’s resilience against cyber threats and ensure continued operational stability.

Recover

The fifth and final function of the NIST Cybersecurity Framework, the ‘Recover’ function, deals with the aftermath of a security breach. MRM teams should assess the damage and repair affected systems, ensuring everything remains operational and secure. This includes replacing or fixing damaged parts and checking that no further vulnerabilities exist.

Clear communication is crucial to maintain trust and ensure all stakeholders are aware of the organization’s commitment to security and resilience. Like the ‘Respond’ function, MRM teams should keep everyone informed about recovery activities, providing regular updates on progress and function taken to prevent future incidents. 

Explore another regulation | Navigating SS1/23: A Compliance Guide for Model Risk Management (MRM) Teams

Conclusion

By aligning their strategies with the NIST Cybersecurity Framework’s five functions, MRM teams can effectively manage cybersecurity risks, achieve compliance, and safeguard their organizations against cyber threats. This comprehensive approach not only enhances security structures but also creates a culture of continuous improvement, making sure that organizations remain robust and adaptive in the face of evolving cyber challenges.