The National Institute of Standards and Technology has released draft guidance showing how organizations can use generative artificial intelligence to support cybersecurity analysis and reporting.

The initial public draft of NIST Special Publication 1353, Cybersecurity Framework 2.0: Quick-Start Guide for Using Artificial Intelligence (AI) for CSF Analysis and Reporting, provides structured prompts and example materials for applying AI to Cybersecurity Framework 2.0 activities.

The guide focuses on using generative AI to analyze, plan, implement, and monitor progress toward cybersecurity outcomes. NIST is accepting public comments through October 15.

Three AI-assisted cybersecurity use cases

NIST organizes the guide around three illustrative use cases. The first uses AI to review an organization’s cybersecurity policy, strategy, and risk governance against Cybersecurity Framework outcomes.

The second demonstrates how AI can help create a draft current-state profile. In the example, the system maps organizational documents and employee interview notes to framework outcomes, documents assumptions, and identifies gaps in the available evidence.

The third use case draws on internal documents and industry references to produce a draft target-state profile. That profile describes the cybersecurity outcomes an organization wants to achieve based on its objectives, stakeholder expectations, requirements, and risk environment.

NIST emphasizes that the examples demonstrate one possible approach. They do not constitute prescriptive assessment or assurance methods. The publication also does not provide comprehensive AI or cybersecurity best practices.

Applying the guidance to laboratory systems

For laboratory leaders, the draft offers a potential starting point for reviewing cybersecurity governance across laboratory information management systems, electronic laboratory notebooks, instrument workstations, cloud services, and connected automation.

A laboratory could use an approved AI tool to organize existing policies, system inventories, vendor documentation, and staff interview notes before comparing them with Cybersecurity Framework outcomes. The resulting draft could help lab managers and information technology teams identify missing documentation, unclear responsibilities, or systems that require further investigation.

For example, a current-state review could examine how a laboratory controls access to instrument computers, manages vendor support accounts, documents software updates, or backs up data generated by stand-alone systems. A target-state profile could then describe the desired cybersecurity outcomes and help teams prioritize improvements.

Lab Management Certificate

The Lab Management certificate is more than training—it’s a professional advantage.

Gain critical skills and IACET-approved CEUs that make a measurable difference.

That work should remain distinct from a formal audit or assurance process. AI-generated conclusions require supporting evidence and qualified human review before they are entered into quality, compliance, or audit records. This distinction is particularly important in regulated laboratories, where documentation must remain accurate, traceable, and retrievable. An audit-readiness approach to data integrity and security can help managers connect cybersecurity controls with documentation requirements.

Human review remains essential

Before using AI for cybersecurity assessments, laboratory leaders should define which tools employees may use and which records they may submit. Sensitive research, patient information, intellectual property, security configurations, and account credentials require appropriate controls for handling.

Laboratories should also retain the source material supporting each generated conclusion, document assumptions, identify unsupported statements, and assign responsibility for reviewing outputs. These practices reflect the close relationship between laboratory data integrity and data security.

Lab managers do not need to conduct cybersecurity assessments alone. Their role includes identifying critical laboratory systems, explaining operational dependencies, and working with information technology, quality, compliance, and instrument vendors to evaluate risks. This cross-functional approach can prevent technical reviews from overlooking equipment that operates outside centrally managed networks.

The NIST draft does not address laboratories specifically. However, its structured approach gives lab managers a practical framework for examining cybersecurity governance without treating AI as an assessor or source of assurance. As laboratories become more dependent on interconnected instruments and digital records, maintaining that boundary will be central to responsible use.

This article was created with the assistance of Generative AI and has undergone editorial review before publishing.