NIST is only used in the United States and provides a policy framework for computer security guidance on how private sector organizations can assess and then improve their ability to prevent, detect, and respond to cyber-attacks.