Cybersecurity Policy Report, NIST Seeks Public Input on ‘Human-Centered’ Cybersecurity, (Aug 18, 2026)

By Tony Foley

The National Institute of Standards and Technology (NIST) yesterday released a concept paper about what it called “human-centered” cybersecurity and is requesting feedback from the public on what comes next.

NIST noted in a blog post the frustrations of individuals who have been forced to deal with complicated passwords and phishing simulation tests and cybersecurity professionals who are confronted with constant security alerts and increasingly difficult judgment calls. These issues have led to cyber breaches that trace back not to technology failures but to human activities like clicking on malicious links, reusing or setting easy passwords, and resorting to less-secure workarounds.

NIST said human-centered cybersecurity (HCC) was an approach that focused on improving cybersecurity outcomes by putting individuals’ needs, abilities, and limitations at the forefront when designing, implementing, and making decisions about cybersecurity. People should not be considered only as vulnerabilities to be contained, it said, but as defenders, reporters, and problem-solvers to be empowered.

The blog contends that existing exhaustive cybersecurity publications and frameworks do not always include or incorporate HCC considerations beyond recommendations to train employees. NIST maintains that overreliance on training creates unrealistic expectations that employees will commit the knowledge to memory, understand the concepts, and always make the “right decisions” without addressing the root causes of many issues, such as hard-to-use and disruptive security processes or an uninformed organizational security structure.

The concept paper is designed to fill the gaps by developing practical guidelines that complement existing NIST publications and help organizations implement HCC. It summarizes HCC themes and suggests possible approaches and formats that were based in part on input from cybersecurity experts and researchers via surveys, workshops, and other forums. The blog invites comments from the public on the concept paper through Sept. 30 by e-mail to human-cybersec@nist.gov.

News: FederalLegislation DataSecurity