> For the complete documentation index, see [llms.txt](https://specs.govstack.global/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://specs.govstack.global/registries/development/10-other-resources/10.5-cross-functional-security-and-interoperability-standards.md).
# 10.5 Cross Functional Security and Interoperability Standards
This section defines the security and interoperability standards that govern the design, implementation, and operation of the Digital Registries Building Block. These standards provide the normative frameworks from which cross-cutting and functional requirements are derived.
## **10.5.1 NIST Cybersecurity Framework (CSF)**
The Digital Registries Building Block is governed by the [NIST Cybersecurity Framework (CSF)](https://www.nist.gov/cyberframework) as the primary, overarching security framework. The NIST CSF provides a risk-based, process-oriented approach to cybersecurity and establishes the five core functions used to guide security decisions across the full system lifecycle:
* Identify
Protect
Detect
Respond
Recover
All architectural choices, security controls, and operational practices for Digital Registries are expected to be aligned with these functions.
## **10.5.2 GovStack Digital Platform Security Framework (GIZ / ITU / DIAL)**
The Digital Registries Building Block adheres to the [GovStack Digital Platform Security Framework](https://docs.google.com/document/d/11Jofvxb418iCvKGzCJuOAvSUFF2eMGowJkn5ooe_k6Y/edit?usp=sharing), jointly developed by GIZ, ITU, and DIAL, which translates international cybersecurity best practices into a GovStack-specific security model.
When applied to Digital Registries, the framework guides how registry data is protected, accessed, monitored, and governed throughout its lifecycle. In particular, the framework:
* core security domains,
defines clearly numbered security issues and concerns that can be mapped directly to registry capabilities and integrations.
and shared terminology used consistently across all GovStack Building Blocks.
It serves as the authoritative reference for interpreting and applying security standards within the GovStack ecosystem.
## **10.5.3 Controlled Unclassified Information (CUI) assumption**
For the purpose of security design and risk management, the Digital Registries Building Block assumes that the maximum sensitivity level of information processed is Controlled Unclassified Information (CUI).
This conservative assumption ensures that registries remain suitable for cross-sector and whole-of-government use, including contexts involving personal, institutional, or sensitive reference data.
## **10.5.4 NIST SP 800-171 Rev.2 — Protection of CUI**
In alignment with the CUI assumption, the Digital Registries Building Block follows [NIST Special Publication 800-171 Rev.2](https://csrc.nist.gov/pubs/sp/800/171/r2/upd1/final), which defines security requirements for protecting CUI in non-federal systems and organizations.
This standard informs the selection and structuring of security controls related to:
* access control,
identification and authentication,
audit and accountability,
configuration management,
incident response,
system and communications protection.
## **10.5.5 Interoperability-by-Design principle**
The Digital Registries Building Block follows an interoperability-by-design standard, whereby systems are designed to interoperate through clearly defined interfaces, shared semantics, and mediated integration, rather than direct point-to-point coupling.
This principle is grounded in:
* separation of concerns between building blocks,
use of standard APIs,
and mediation through dedicated integration components.
This approach aligns with whole-of-government and multi-sector interoperability objectives.
## **10.5.6 Semantic interoperability standards**
Semantic interoperability for Digital Registries is governed by the use of standardized terminologies, code sets, and controlled vocabularies, ensuring that data exchanged across systems preserves its meaning and context.
Where applicable, internationally recognized domain standards (e.g. health, agriculture, population statistics) are used, and local terminologies are mapped to shared reference vocabularies.
## **10.5.7 Privacy-by-Design and data protection principles**
The Digital Registries Building Block is guided by privacy-by-design principles, including:
* data minimization,
purpose limitation,
separation of identity and domain data, and
proportional access to registry information.
These principles ensure that registry infrastructure remains neutral, reusable, and compliant with diverse legal and regulatory environments.
## **10.5.8 Whole-of-Government reuse standard**
Digital Registries are treated as foundational, reusable digital public infrastructure components, intended for cross-sector and whole-of-government use. This standard emphasizes: avoidance of duplicated registries, consistent identification and reference mechanisms, and long-term sustainability of shared digital assets.
## **10.5.9 API description standard (OpenAPI)**
The use of OpenAPI provides a clear and machine-readable description of APIs, making it easier for different systems and teams to understand how to connect to each other.
This common contract supports consistent implementation and enables automation for documentation, testing, validation, and the application of security and access controls across the platform.
Multiple OpenAPI versions are accepted for the following reasons:
* OpenAPI 3.0.0 / 3.0.1 are widely adopted and supported by existing government platforms, API gateways, and tooling. Allowing these versions ensures backward compatibility and lowers adoption barriers for countries with existing infrastructure.
OpenAPI 3.1.0 aligns fully with JSON Schema 2020-12, enabling more precise data validation, clearer schema definitions, and improved support for future interoperability needs. It represents the forward-looking and preferred evolution of the specification.
OpenAPI Version [3.0.0](https://spec.openapis.org/oas/v3.0.0), [3.0.1](https://spec.openapis.org/oas/v3.0.1), [3.1.0](https://spec.openapis.org/oas/v3.1.0).
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://specs.govstack.global/registries/development/10-other-resources/10.5-cross-functional-security-and-interoperability-standards.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.