The U.S. National Institute of Standards and Technology (NIST) has revised its cybersecurity guidance for positioning, navigation and timing (PNT) services, realigning it to version 2.0 of the NIST Cybersecurity Framework and expanding its treatment of GPS disruption, artificial-intelligence risk and supply-chain threats, according to trade coverage published on 12 May 2026.
PNT services are the satellite and terrestrial systems that tell equipment where it is and, more importantly for infrastructure operators, what time it is to within billionths of a second. The revision is guidance rather than regulation: it gives operators of data centers, power grids, financial systems and telecom networks a structured way to inventory their dependence on those signals and to defend the systems that consume them.
Executive Summary
NIST’s foundational PNT profile was written to satisfy Executive Order 13905, signed in February 2020, which directed the federal government to help critical-infrastructure owners use PNT services more responsibly. That original profile was built on the first-generation Cybersecurity Framework (CSF 1.1). CSF 2.0, published in February 2024, added a sixth core function — Govern — alongside Identify, Protect, Detect, Respond and Recover, and pushed supply-chain risk management from a subcategory into a first-class concern. A PNT profile pinned to the older framework was, over time, going to drift out of step with how organizations actually structure their security programs.
The substantive additions matter more than the renumbering. Deliberate GPS jamming and spoofing have moved from a theoretical concern to a routinely reported operating condition in several regions, particularly for aviation and maritime users, and the same interference affects any fixed receiver in range. Adding explicit treatment of AI risk acknowledges that machine-learning systems are increasingly used both to detect anomalous timing signals and, on the other side, to generate more convincing spoofed ones. Supply-chain coverage addresses a quieter problem: most operators do not buy PNT directly, they buy it embedded inside a network switch, a phasor measurement unit or a timing appliance from a vendor they have never audited on this dimension.
For infrastructure buyers, the practical value is leverage. Voluntary NIST profiles tend to become procurement language, insurance questionnaires and audit checklists within a few budget cycles, which is usually how they change behaviour.
Timing Is Infrastructure, Even When Nobody Owns It
Precise time is the least-discussed dependency in modern digital infrastructure. Distributed databases use timestamps to order transactions and resolve conflicts; if clocks in two availability zones diverge, writes can be applied out of order or reject each other. Mobile networks use tight synchronization to keep adjacent cells from interfering, and time-division and 5G radio schemes are particularly unforgiving of drift. Electrical grids use time-stamped phasor measurements — sampled tens of times per second across hundreds of miles — to detect instability, which only works if every sampler agrees on the moment of sampling. Financial venues are required to timestamp orders to prove sequence. In each case the clock is not a feature of the system; it is a precondition for the system being correct.
The awkward part is that most of this timing arrives free, from space, via GPS and its counterparts. A rooftop antenna the size of a coffee mug feeds a receiver that disciplines a local oscillator, and the resulting signal is distributed inside the building over NTP or the more precise Precision Time Protocol. Nobody is billed for it, so it rarely appears on a dependency map, and it is frequently owned by facilities or network engineering rather than by security. A NIST profile that forces the question — which of our systems fail, and how visibly, if this signal degrades — is doing useful work before it recommends a single control.
Degradation is also the hard case. An antenna that goes dark is easy to detect and fail over. A receiver that is being spoofed reports a confident, plausible, wrong time, and a good spoof walks the clock slowly enough that naive threshold alarms never fire. That failure mode propagates silently into logs, transaction ordering and forensic timelines, which is precisely why it belongs in a cybersecurity framework rather than a facilities runbook.
What CSF 2.0 Actually Changes for a PNT Program
The addition of the Govern function is not cosmetic. Under CSF 1.1, an operator could describe technical PNT controls without ever assigning accountability for them. Govern asks who owns the risk, how it is expressed in policy, what the risk tolerance is, and how third-party dependencies are managed. For timing, that maps onto a real organizational gap: the team that installs the GPS antenna, the team that runs the NTP servers and the team that would be blamed for a corrupted transaction log are usually three different teams with no shared document.
The supply-chain emphasis lands on a genuinely under-examined surface. PNT capability is overwhelmingly delivered as a component — a receiver module, a timing card, an oscillator, firmware that parses satellite messages. Buyers evaluating a timing appliance typically compare holdover specifications and price, not the provenance of the receiver chipset or the vendor’s firmware-update practices. Asking suppliers to document that lineage is the kind of requirement that is trivial to write and expensive to satisfy, and it will surface differences between vendors who have anticipated the question and those who have not.
The AI dimension is the newest and, on the evidence available in the headline alone, the least defined. There are at least three distinct concerns worth separating: machine-learning models used to classify anomalous PNT signals, which can be evaded or poisoned; AI-assisted generation of spoofing waveforms, which lowers the skill required to mount an attack; and AI systems that consume PNT data as an input, where corrupted timing quietly corrupts inference. Guidance that treats these as one topic would be less useful than guidance that treats them as three.
Who Benefits, and What It Costs to Comply
The clearest commercial beneficiaries are vendors of resilient timing: makers of rubidium and cesium clocks and high-quality oven-controlled oscillators that let a facility ride out signal loss in holdover for hours or days, suppliers of multi-constellation receivers that can fall back from GPS to Galileo, GLONASS or BeiDou, providers of terrestrial and fibre-delivered time services, and the smaller field of anti-spoofing and signal-authentication products. None of these are new categories. What a widely cited framework profile changes is the buyer’s ability to justify the line item, because “NIST’s profile asks us to demonstrate holdover capability” is a more durable argument than an engineer’s professional unease.
The cost falls unevenly. Large hyperscale and carrier operators have generally engineered timing redundancy already, often with multiple antennas, atomic holdover and diverse distribution; for them the work is documentation, governance and supplier attestation rather than capital equipment. Regional colocation providers, industrial operators and mid-sized utilities are the ones more likely to discover a single receiver feeding a single time server with no holdover behind it. That asymmetry is worth naming plainly: guidance of this kind tends to raise the floor, and raising the floor is more expensive for whoever is standing on it.
It is also worth being precise about what this announcement is and is not. It is a revision to voluntary guidance, aligned to a voluntary framework, from a standards body with no enforcement authority. It does not compel any operator to buy anything or meet any deadline. The realistic mechanism of influence is indirect — contract language, insurer questionnaires, sector regulators who cite NIST documents by reference — and that mechanism works on a timescale of years, not quarters. Readers should treat the substantive question as open until the document text itself is examined: alignment to CSF 2.0 is a structural claim, and whether the underlying technical recommendations have materially advanced is something only the revised profile can answer.
Background
NIST is the U.S. federal standards body whose cybersecurity publications are used far beyond the federal government, both domestically and internationally, as a common vocabulary for security programs. Its Cybersecurity Framework, first issued in 2014 and revised as CSF 2.0 in February 2024, is descriptive rather than prescriptive: it organizes outcomes into core functions and lets each sector write a “profile” mapping those outcomes to its own risks. The PNT profile is one such sector-style profile, created after Executive Order 13905 in February 2020 identified over-reliance on satellite timing as a national infrastructure risk.
That concern has only sharpened. GPS and its peer constellations broadcast extremely weak signals from roughly 20,000 kilometres away, which makes them inherently easy to overpower locally with modest equipment. Widespread interference has been reported around several conflict zones in recent years, affecting aviation and maritime navigation, and the same physics applies to any fixed rooftop receiver. Meanwhile the number of systems that silently depend on nanosecond-accurate time — cloud databases, 5G radio networks, grid phasor measurement, financial timestamping — has grown considerably faster than the redundancy protecting it.
Source: NIST revises PNT services cybersecurity guidance under CSF 2.0 to address GPS disruption, AI risks, supply chain threats — Industrial Cyber, 12 May 2026, reporting NIST’s realignment of its positioning, navigation and timing profile to version 2.0 of the Cybersecurity Framework.