How NIST Builds Rules: An Inside Look at Standards Development

Last updated 6 days ago. Our resources are updated regularly but please keep in mind that links, programs, policies, and contact information do change.

Every time you use GPS navigation, make an online purchase, or trust that a skyscraper won’t collapse in an earthquake, you’re relying on an invisible network of standards.

These aren’t laws written by Congress or regulations from federal agencies. They’re consensus-based rules created through a process that turns competitors into collaborators and transforms technical disputes into trusted guidelines.

The architect of this system is the National Institute of Standards and Technology.

For over a century, the agency has perfected a process that brings together industry experts, academics, and government officials to create the technical blueprints that keep modern life running smoothly.

Building Trust Through Collaboration

NIST operates on a philosophy that runs counter to most government agencies. Instead of writing rules behind closed doors and imposing them from above, it serves as what insiders call an “expert convener”—bringing together the brightest minds from industry, academia, and government to solve shared problems.

This approach stems from practical necessity. In fast-moving fields like quantum computing, artificial intelligence, and advanced manufacturing, no single company can afford the expensive research needed to move an entire industry forward. NIST fills this gap by creating neutral ground where competitors can collaborate on basic technical challenges without revealing proprietary secrets.

The collaborative spirit extends beyond formal meetings. NIST researchers regularly co-author scientific papers with experts from other organizations, building the knowledge base that supports future standards. This isn’t academic exercise—it’s the foundation that makes standards trustworthy and technically sound.

Federal Law Demands Consensus

NIST’s preference for collaboration isn’t just internal policy. Federal law requires it.

The National Technology Transfer and Advancement Act of 1995 and Office of Management and Budget Circular A-119 direct federal agencies to use voluntary consensus standards instead of creating government-specific rules whenever possible. This policy pushes the entire federal government away from internal rule-making toward adopting standards that broad communities have already developed and agreed upon.

This legal framework shapes everything NIST does. The agency becomes a key player in supporting consensus-based processes rather than replacing them. It’s a profound shift that recognizes private-sector expertise while maintaining public oversight.

Four Pillars of Trustworthy Standards

Not every private-sector process qualifies for federal endorsement. OMB Circular A-119 requires that voluntary consensus standards meet strict criteria. These principles, which NIST champions in its own work, form the foundation of the entire system.

Openness means transparent procedures that allow anyone with direct interest to participate. No backroom deals or closed committees. Meetings are open, documents are public, and participation is available whether you’re a Fortune 500 company or a small business owner.

Balance of Interest prevents any single group from dominating the process. Standards committees must reflect diverse perspectives—producers, suppliers, users, scientists, and regulators. This ensures final standards are fair and technically sound rather than skewed toward one industry segment.

Due Process requires clear, well-documented procedures. All stakeholders must know the rules, receive proper notice of meetings and comment periods, and have their views considered. This procedural regularity gives participants confidence in the system’s fairness.

Consensus and Appeals means general agreement among stakeholders, not just majority votes. All comments and objections receive consideration, with genuine efforts to resolve them. An impartial appeals process provides recourse for participants who believe procedures were unfair.

These principles ensure that the development process itself becomes the first product. Standards created with active participation from communities that will use them are more technically robust, more practical, and far more likely to be adopted voluntarily.

Voluntary vs. Mandatory Standards

Most NIST standards are voluntary. High-profile documents like the Cybersecurity Framework and AI Risk Management Framework are offered as best practices that organizations can choose to adopt. Their power comes from perceived value and the consensus process that created them.

However, NIST also creates mandatory standards for federal agencies. Federal Information Processing Standards (FIPS) are required by law for government non-national security information systems. FIPS 140-3 for cryptographic modules ensures consistent security across federal IT infrastructure.

While mandatory only for federal agencies, FIPS often become requirements for government contractors and benchmarks for high-security practices in the private sector.

From Problem to Solution

Creating a NIST standard follows a careful process that applies the scientific method on a massive scale. It begins with identifying a problem, proposes solutions, subjects them to rigorous public review, refines them based on evidence, and publishes validated results for global use.

Each stage emphasizes transparency, collaboration, and evidence-based decision-making. The goal is producing standards that are both technically sound and broadly accepted.

Identifying the Need

The spark for new standards can come from anywhere, reflecting NIST’s role as a responsive national laboratory.

Crisis often drives innovation. The Great Baltimore Fire of 1904 devastated the city partly because firefighters from neighboring areas found their hoses incompatible with Baltimore’s hydrants. A subsequent NIST study found over 600 different fire-hose coupling sizes across the country. This interoperability failure spurred NIST to work with the National Fire Protection Association on national standards that today ensure different fire departments can work together seamlessly.

Industry requests represent another major source. In 1905, the American Foundrymen’s Association asked NIST to produce standardized iron samples with known chemical composition. This allowed foundries to calibrate instruments and ensure steel quality. The request led to Standard Reference Materials, a program that today provides over 1,200 certified materials forming the basis of quality control for countless industries.

Anticipating future threats is a core NIST mission. Researchers recognized that powerful quantum computers pose grave future threats to encryption protecting virtually all digital information today. NIST initiated its Post-Quantum Cryptography standardization process in 2016, a multi-year global effort to develop new cryptographic algorithms that can resist both conventional and quantum computer attacks.

Legislative or executive mandates sometimes provide direct orders. The Computer Security Act of 1987 tasked NIST with developing standards to improve federal computer security. More recently, Executive Order 14028 on cybersecurity directed NIST to develop the Cybersecurity Framework and consumer software labeling criteria.

Gathering Experts

Once NIST identifies a need, it doesn’t retreat to its laboratories. Instead, it begins intensive outreach and collaboration to bring relevant expertise together.

The agency convenes stakeholders from industry, academia, and government through formal partnerships, research consortia, and public working groups. These forums provide neutral ground for competitors to collaborate on basic research and define shared technical challenges.

NIST often works through existing Standards Development Organizations like ASTM International and the International Organization for Standardization. Rather than starting from scratch, NIST leverages established processes and global reach of these bodies, participating in technical committees to help develop needed standards.

The technical basis for standards builds on rigorous science. NIST researchers collaborate extensively with external experts, often producing joint peer-reviewed publications that establish the measurement science and technical understanding necessary for robust standards. This ensures standards rest on verifiable data and scientific principles rather than opinion.

Open Public Review

This phase represents the heart of NIST’s commitment to openness and transparency. Developing standards face public scrutiny, and consensus-building begins in earnest.

Requests for Information are broad calls to the public for input on major standards efforts. Industry experts, academics, and other stakeholders submit information, opinions, and recommendations. This process proved crucial for both the Cybersecurity Framework and AI Risk Management Framework, ensuring NIST gathered the widest possible range of perspectives before drafting standards.

Public Drafts are essential to the process. NIST rarely publishes final standards without releasing public drafts for comment. This iterative approach allows the public to point out errors, suggest improvements, and raise concerns. NIST then revises documents based on feedback before releasing new drafts. This loop can repeat several times, ensuring final documents are thoroughly vetted and refined.

Workshops and Meetings complement written comments through public workshops, webinars, and technical meetings. These events allow stakeholders to engage in real-time discussion with NIST staff and each other. They’re vital forums for clarifying complex technical issues, resolving disagreements, and building consensus needed to move forward.

Building Consensus

After public review, the hard work of synthesizing feedback and forging consensus begins. NIST staff meticulously analyze every public comment and workshop feedback. This isn’t simple vote counting. The goal is understanding feedback substance and harmonizing different viewpoints.

Drafts circulate through relevant technical committees and subcommittees for further comment, editing, and formal voting in some processes. This phase requires delicate negotiation, balancing different stakeholder needs to arrive at final standards with broad support and technical soundness.

The core principle of consensus means final products should be ones all parties can support, even if they don’t perfectly reflect initial positions.

Publication and Outreach

Once consensus is reached and standards are finalized, they’re formally published and made available globally.

Official publication occurs in NIST’s publication series, each serving specific purposes. This formal publication gives standards their official status.

Public access represents a cornerstone of NIST’s mission. All publications are available free through government portals including the main NIST website, the Computer Security Resource Center for cybersecurity documents, GovInfo.gov for central repository access, and Data.gov for open data.

NIST’s work continues after publication through extensive outreach including training materials, guidance development, and educational events to promote standards’ value, increase implementation understanding, and encourage adoption.

Understanding NIST Publications

Building the Cybersecurity Framework

The creation of NIST’s Cybersecurity Framework demonstrates how the agency’s principles translate into real-world impact. The CSF story shows how government can guide complex industries toward common goals through collaboration and consensus, creating one of the world’s most successful voluntary standards.

Presidential Direction

The framework’s catalyst came from the highest government level. In 2013, recognizing growing cyberattack threats against essential services, President Obama issued Executive Order 13636 on improving critical infrastructure cybersecurity.

The order didn’t call for rigid regulations. Instead, it directed NIST to work with stakeholders across private and public sectors to develop a voluntary framework for reducing cyber risks to critical infrastructure. This directive matched NIST’s strengths as a convener and non-regulatory expert body.

Open Development Process

NIST immediately launched development using its open, collaborative approach. The process maximized inclusion, ensuring the final product would be created by the community, not just for it.

The agency began with a Request for Information asking for input on existing cybersecurity standards, guidelines, and best practices already working in the private sector. The goal was organizing proven effectiveness rather than reinventing approaches.

Over a year, NIST hosted workshops across the country. These weren’t lectures but interactive sessions where hundreds of experts from industry, academia, and government debated the developing framework’s structure, content, and language.

Based on responses and workshop feedback, NIST collected, categorized, and publicly posted thousands of comments. This input produced a preliminary discussion draft subjected to another round of intense public review before the first official version was published in 2014.

Simple but Powerful Structure

The CSF’s success stems from its elegant, accessible structure. Rather than creating complex checklists of hundreds of technical controls, NIST organized the framework around five simple functions describing the entire cybersecurity risk management lifecycle.

These Core Functions provide common language everyone from CEOs to IT technicians can understand:

Identify: Understand cybersecurity risks to systems, assets, data, and capabilities.

Protect: Develop and implement appropriate safeguards to ensure critical service delivery.

Detect: Develop and implement appropriate activities to identify cybersecurity event occurrence.

Respond: Develop and implement appropriate activities to take action regarding detected cybersecurity events.

Recover: Develop and implement appropriate activities to maintain resilience plans and restore capabilities or services impaired by cybersecurity events.

These functions break down into granular Categories and Subcategories mapped to specific technical controls from detailed standards like NIST SP 800-53 and ISO 27001. This structure makes the framework incredibly flexible. It tells organizations what they need to do without dictating how they must do it.

Global Impact

Though voluntary for the private sector, the Cybersecurity Framework has been remarkably successful. Vast numbers of organizations use it, from small businesses—for which the Federal Trade Commission provides guidance—to the largest global corporations.

The framework has become America’s de facto standard for building cybersecurity programs and achieved significant international influence. It’s been translated into numerous languages, and countries like the United Kingdom have mapped their governance codes to it, recognizing it as a global benchmark.

The CSF demonstrates that in complex, rapidly evolving fields like cybersecurity, flexible, outcome-based frameworks often prove more effective than rigid regulations. Static laws become outdated quickly. The CSF provides durable yet adaptable approaches. Its development process, rooted in deep industry collaboration, ensured it was practical and aligned with business needs from day one.

Protecting Secrets Through Transparency

NIST’s cryptography work demonstrates commitment to long-term, forward-looking standardization and maintaining public trust through radical transparency. In security, where secrets are paramount, the process of creating tools to protect those secrets must be completely open. Cryptographic standards are only useful if trusted, and NIST has learned that trust is earned through public, evidence-based, verifiable processes.

Early Transparency

NIST’s public cryptography journey began in the 1970s when the field was largely the exclusive domain of military and intelligence agencies.

The Data Encryption Standard represented a groundbreaking move. NIST initiated a program to develop publicly available cryptographic standards protecting sensitive but unclassified government and commercial data. After a public call for algorithms, it selected an IBM candidate and, following public workshops analyzing security, published it as DES in 1977.

For the first time, strong, government-vetted cryptography was available for public and commercial use, laying groundwork for secure electronic commerce we know today.

The AES Competition

By the 1990s, computing advances meant DES was nearing the end of its secure life. Learning from DES experience, NIST avoided developing new algorithms internally. Instead, in 1997, it launched an unprecedented worldwide public competition to find a replacement.

NIST invited cryptographers globally to submit candidate algorithms. Fifteen were accepted and subjected to years of intense public scrutiny, with the global cryptographic community analyzing algorithms for weaknesses and performance.

This open, competitive process, compared to global academic peer review, resulted in selecting the Rijndael algorithm, which became the Advanced Encryption Standard in 2001. The AES competition was a transparency and collaboration triumph, solidifying NIST’s position as a global cryptography leader and creating a trusted standard now protecting data on billions of devices worldwide.

Rebuilding Trust

The trust reservoir built by the AES process was tested in 2013. News reports based on leaked classified documents raised concerns within the cryptographic community about some NIST standards’ integrity and potential for hidden weaknesses or “backdoors.”

NIST’s response demonstrated how to handle trust crises. Instead of being defensive or secretive, the agency embraced transparency. It immediately initiated a formal, public review of its entire cryptographic standards development process.

This included public comment periods where NIST published current processes and solicited public input on improvements to enhance trust and transparency. The agency requested that its oversight body, the Visiting Committee on Advanced Technology, convene an independent panel of leading non-government cryptographic experts to review processes and make recommendations.

Based on public comments and the panel report, NIST developed and published NISTIR 7977, documenting its commitment to open, transparent, inclusive processes and making principles and procedures matters of public record.

By opening itself to public scrutiny and formalizing transparency commitments, NIST demonstrated understanding of a fundamental security truth: trust isn’t given; it must be continuously earned. As NIST stated, “Trust is crucial to the adoption of strong cryptographic algorithms.”

Quantum-Resistant Future

The principles formalized in NISTIR 7977 now apply to one of our time’s most significant technological challenges: the quantum computing threat. NIST is finalizing its Post-Quantum Cryptography standardization process, an effort begun in 2016 to select new public-key cryptographic algorithms secure against attacks from both today’s computers and future powerful quantum computers.

This process directly descends from the successful AES competition. It has been a multi-year, multi-round public effort where algorithms submitted by global teams have been subjected to years of public analysis and “crypto-bashing” by the global community.

NIST’s cryptography history reveals profound understanding that in this field, process is as important as product. The elaborate, multi-year public competitions for AES and PQC aren’t bureaucratic delays; they’re necessary performances of transparency. They’re mechanisms by which the global community can verify standard strength and integrity, generating universal trust required for adoption and effective digital world security.

Standards in Daily Life

NIST’s impact extends from factory floors to smartphone screens, providing common language and trusted benchmarks enabling safety, quality, and innovation across the American economy.

Manufacturing Revolution

Modern manufacturing relies on networked Industrial Control Systems. NIST provides specialized guidance to protect these vital systems, including developing Cybersecurity Framework Profiles tailored for specific sectors like semiconductor manufacturing, helping companies prioritize actions to manage cyber risk.

As technologies like additive manufacturing revolutionize production, NIST ensures standards support them. NIST researchers participate in technical committees within organizations like ASTM and ISO to develop international standards for every additive manufacturing aspect, from metal and polymer powder properties to laser and electron beam design processes.

Through its Hollings Manufacturing Extension Partnership, a nationwide network of centers, NIST provides direct assistance to small and medium-sized manufacturers, helping them adopt technologies, improve efficiency, and meet cybersecurity requirements for defense and critical supply chains.

Healthcare Standards

In healthcare, where accuracy and privacy can be life-or-death matters, NIST provides measurement science and IT standards essential for modern healthcare systems.

For decades, a major healthcare challenge has been getting different electronic health record systems to communicate. NIST has led efforts to tackle this problem by developing testing tools and technical infrastructure supporting data interoperability standards. Its tools for validating standards like HL7 v2 messaging and Clinical Document Architecture help ensure patient records sent from hospitals to primary care physicians arrive intact and readable.

The Health Insurance Portability and Accountability Act Security Rule requires healthcare organizations to protect patient data but doesn’t always specify how. NIST’s security guidance provides clear, detailed roadmaps. NIST Special Publication 800-53, detailing hundreds of security and privacy controls, and the Cybersecurity Framework are widely used by healthcare organizations as go-to guides for implementing technical and procedural safeguards needed for HIPAA compliance and protecting sensitive patient information.

From insulin pumps to pacemakers, modern medical devices often connect to networks, creating potential vulnerabilities. NIST develops standards and testing protocols for medical device communications, helping ensure life-saving devices can share data reliably and securely, free from interference or malicious attack.

Consumer Protection

NIST’s influence extends to products we buy and use daily, ensuring quality, safety, and cybersecurity.

To ensure food label nutritional information is accurate or steel beams have proper strength, companies need to calibrate measurement equipment against known, perfect samples. NIST provides these “perfect samples” as Standard Reference Materials. NIST produces and sells over 1,200 of these materials, each with precisely certified chemical or physical properties.

The most famous might be SRM 2387, Peanut Butter, which food companies use to validate methods for measuring nutritional content. But NIST also makes SRMs for everything from cement used in roads to steel in buildings, providing ultimate physical benchmarks for quality control across the economy.

Through its Voluntary Product Standards Program, NIST works with industries to establish nationally recognized requirements for common products. Standards like DOC PS 1-22 for Structural Plywood and DOC PS 20-25 for American Softwood Lumber provide common bases for understanding product characteristics, ensuring materials used to build homes are safe, reliable, and consistent.

In response to Executive Order 14028, NIST has led efforts to establish criteria for cybersecurity labeling programs for consumer products. This work develops foundation for programs, similar to “Energy Star” efficiency labels, that would provide consumers with clear, understandable information about Internet of Things devices and software security.

NIST has developed baseline security criteria for consumer IoT products like smart speakers and baby monitors, and specific recommendations for consumer-grade routers, aiming to empower consumers to make safer choices and incentivize manufacturers to build more secure products from the start.

The Invisible Foundation

The remarkable breadth of NIST’s work, from abstract AI risk principles to tangible peanut butter composition, reveals the agency’s unique and vital role. Its core competency isn’t tied to any single industry but to the universal process of “advancing measurement science, standards, and technology.”

This foundational mission allows NIST to adapt and apply its collaborative, consensus-driven model to whatever new challenges and opportunities arise. As our world grows more complex, the invisible blueprint that makes it work remains strong, reliable, and trustworthy.

NIST’s success demonstrates that influence earned through expertise and collaboration can be more powerful and enduring than authority imposed through law. In an era of increasing polarization and declining trust in institutions, NIST’s model offers a different path—one where diverse stakeholders come together around shared technical challenges to create solutions that benefit everyone.

The agency’s work continues evolving as new technologies emerge and global challenges shift. Whether addressing artificial intelligence risks, quantum computing threats, or the next unforeseen crisis, NIST’s process remains constant: bring the best minds together, work transparently, build consensus, and create standards that make the world safer, more efficient, and more innovative.

Our articles make government information more accessible. Please consult a qualified professional for financial, legal, or health advice specific to your circumstances.