Direction from the U.S. Commerce Department's National Institute of Standards and Technology (NIST) is only binding on federal agencies but the Guidelines are frequently looked to by private-sector security professionals as best practices for creating information security policies.