On May 12, the US National Institute of Standards and Technology (NIST) posted new guidelines for IT security. The guidelines offer best practices for security of information systems, based on international engineering standards.

Proposing the implementation of the new security guidelines at every level of IT systems, NIST is hopeful the guidelines will result in a systems engineering process in which security is fundamental to product design instead of being just an afterthought.

The new IT security guidelines are the outcome of a two-year effort at NIST. According to co-author and NIST fellow Ron Ross, the process underscoring the framing of the new guidelines was not reactive to any particular cyber threats - such as 'Heartbleed' - but rather underpinned by comprehensive security principles.

Ross also revealed that, for developing the engineering guidelines, the NIST worked "really closely" with DOD; building on a task force formed - in 2009 - with intelligence agencies, for standardizing information security for the federal government.

Asserting that the guidelines are voluntary, and federal agencies as well as private firms can apply them, Ross said: "We don't want to tell industry how to do their job but we can ask them to use best practices and point them to things that we think are appropriate."