The National Institute of Standards and Technology (NIST) is seeking public input by Sept. 30 on plans to develop human-centered cybersecurity guidance that puts people’s needs, abilities, and limitations at the forefront. In an Aug. 17 blog post, NIST said it released a concept paper outlining plans for practical guidelines and resources that would complement its existing cybersecurity publications. The effort is intended to address what NIST sees as a gap in authoritative guidance on putting human-centered cybersecurity into practice. “Above all, we see people not just as vulnerabilities to be contained; they’re also defenders, reporters, and problem-solvers to be empowered,” NIST computer scientists Julie Haney and Jody Jacobs wrote. According to NIST, human-centered cybersecurity (HCC) focuses on improving cybersecurity outcomes by considering the needs, abilities, and limitations of people who affect or are affected by cybersecurity when organizations design and implement security technologies and processes or make cybersecurity decisions. NIST said the approach could help address challenges including security professional burnout, employee frustration and mistakes, noncompliance, and losses in productivity, money, and reputation. The agency said existing cybersecurity frameworks and publications do not always incorporate human-centered considerations beyond employee security awareness training. However, the agency warned that awareness training alone is not enough. “Overreliance on training creates unrealistic expectations that employees will commit the knowledge to memory, understand the concepts, and always make the ‘right’ decisions, without addressing the root causes of many cybersecurity issues, like hard-to-use and disruptive security processes or an uninformed organizational security culture,” Haney and Jacobs wrote. The concept paper identifies several barriers to broader adoption of human-centered cybersecurity, including overreliance on annual awareness training. Other barriers include a cybersecurity field that often emphasizes technology over people, a lack of HCC expertise in the cybersecurity workforce, and uncertainty about how organizations should measure HCC outcomes.