NIST Logo and ITL Banner Link to the NIST Homepage Link to the ITL Homepage Link to the NIST Homepage
Search CSRC:

Search the fulltext of NIST's computer security publications:

  Advanced Search

govdelivery bubble icon Sign Up for Email Alerts from NIST's Computer Security Division:

Special Publications (800 Series)

Special Publications in the 800 series (established in 1990) are of general interest to the computer security community. This series reports on ITL's research, guidelines, and outreach efforts in computer security, and its collaborative activities with industry, government, and academic organizations.

[Publications that link to dx.doi.org/... will redirect to another NIST website. See more details about DOIs.]

NumberDateTitle
SP 800-170June 2014(PRE-Publication) 2013 Computer Security Division Annual Report
PRE-Publication SP 800-170
SP 800-168May 2014Approximate Matching: Definition and Terminology
SP 800-168 FAQ
doi:10.6028/NIST.SP.800-168 [Direct Link]
SP 800-165Jun 20132012 Computer Security Division Annual Report
Annual Report (2012)
SP 800-164 
(Draft)
Oct. 31, 2012DRAFT Guidelines on Hardware-Rooted Security in Mobile Devices
Announcement and Draft Publication
SP 800-162Jan 2014Guide to Attribute Based Access Control (ABAC) Definition and Considerations
SP 800-162
SP 800-162 (EPUB) FAQ
SP 800-161 
(Draft)
Jun. 3, 2014DRAFT Supply Chain Risk Management Practices for Federal Information Systems and Organizations (Second Draft)
Announcement and Draft Publication
SP 800-160 
(Draft)
May 12, 2014DRAFT Systems Security Engineering: An Integrated Approach to Building Trustworthy Resilient Systems
Announcement and Draft Publication
SP 800-157 
(Draft)
Mar 7, 2014DRAFT Guidelines for Derived Personal Identity Verification (PIV) Credentials
Announcement and Draft Publication
SP 800-155 
(Draft)
Dec. 8, 2011DRAFT BIOS Integrity Measurement Guidelines
Announcement and Draft Publication
SP 800-153Feb 2012Guidelines for Securing Wireless Local Area Networks (WLANs)
SP 800-153
SP 800-152 
(Draft)
Jan 7, 2014DRAFT A Profile for U. S. Federal Cryptographic Key Management Systems (CKMS)
Announcement and Draft Publication
SP 800-147 B 
(Draft)
July 30, 2012DRAFT BIOS Protection Guidelines for Servers
Announcement and Draft Publication
SP 800-147Apr 2011Basic Input/Output System (BIOS) Protection Guidelines
SP 800-147
SP 800-146May 2012Cloud Computing Synopsis and Recommendations
SP 800-146
SP 800-146 (EPUB) FAQ
SP 800-145Sep 2011The NIST Definition of Cloud Computing
SP 800-145
SP 800-145 (EPUB) FAQ
SP 800-144Dec 2011Guidelines on Security and Privacy in Public Cloud Computing
SP 800-144
SP 800-144 (EPUB) FAQ
SP 800-142Oct 2010Practical Combinatorial Testing
SP 800-142
SP 800-137Sep 2011Information Security Continuous Monitoring for Federal Information Systems and Organizations
SP 800-137
SP 800-135 Rev. 1Dec 2011Recommendation for Existing Application-Specific Key Derivation Functions
SP 800-135 Rev. 1
SP 800-133Dec 2012Recommendation for Cryptographic Key Generation
SP 800-133 FAQ
doi:10.6028/NIST.SP.800-133 [Direct Link]
SP 800-133 (EPUB) FAQ
SP 800-132Dec 2010Recommendation for Password-Based Key Derivation Part 1: Storage Applications
SP 800-132
SP 800-131 AJan 2011Transitions: Recommendation for Transitioning the Use of Cryptographic Algorithms and Key Lengths
SP 800-131A
SP 800-130Aug 2013A Framework for Designing Cryptographic Key Management Systems
SP 800-130
SP 800-128Aug 2011Guide for Security-Focused Configuration Management of Information Systems
SP 800-128
SP 800-127Sep 2010Guide to Securing WiMAX Wireless Communications
SP 800-127
SP 800-127 (EPUB) FAQ
SP 800-126 Rev. 2Sep 2011The Technical Specification for the Security Content Automation Protocol (SCAP): SCAP Version 1.2
SP 800-126 Rev. 2
Errata for SP 800-126 Rev. 2
SP 800-126 Rev. 1Feb 2011The Technical Specification for the Security Content Automation Protocol (SCAP): SCAP Version 1.1
SP 800-126 Rev. 1
SP 800-126Nov 2009The Technical Specification for the Security Content Automation Protocol (SCAP): SCAP Version 1.0
SP 800-126
SP 800-125Jan 2011Guide to Security for Full Virtualization Technologies
SP 800-125
SP 800-124 Rev. 1Jun 2013Guidelines for Managing the Security of Mobile Devices in the Enterprise
SP 800-124 Rev. 1
SP 800-124 Rev. 1 (EPUB) FAQ
SP 800-123Jul 2008Guide to General Server Security
SP 800-123
SP 800-123 (EPUB) FAQ
SP 800-122Apr 2010Guide to Protecting the Confidentiality of Personally Identifiable Information (PII)
SP 800-122
SP 800-122 (EPUB) FAQ
SP 800-121 Rev. 1Jun 2012Guide to Bluetooth Security
SP 800-121 Rev. 1
SP 800-120Sep 2009Recommendation for EAP Methods Used in Wireless Network Access Authentication
SP 800-120
SP 800-119Dec 2010Guidelines for the Secure Deployment of IPv6
SP 800-119
SP 800-118 
(Draft)
Apr. 21, 2009DRAFT Guide to Enterprise Password Management
Announcement and Draft Publication
SP 800-117 Rev. 1 
(Draft)
Jan. 6, 2012DRAFT Guide to Adopting and Using the Security Content Automation Protocol (SCAP) Version 1.2
Announcement and Draft Publication
SP 800-117Jul 2010Guide to Adopting and Using the Security Content Automation Protocol (SCAP) Version 1.0
SP 800-117
SP 800-116Nov 2008A Recommendation for the Use of PIV Credentials in Physical Access Control Systems (PACS)
SP 800-116
SP 800-115Sep 2008Technical Guide to Information Security Testing and Assessment
SP 800-115
SP 800-115 (EPUB) FAQ
SP 800-114Nov 2007User's Guide to Securing External Devices for Telework and Remote Access
SP 800-114
SP 800-113Jul 2008 Guide to SSL VPNs
SP 800-113
SP 800-111Nov 2007Guide to Storage Encryption Technologies for End User Devices
SP 800-111
SP 800-108Oct 2009Recommendation for Key Derivation Using Pseudorandom Functions
SP 800-108
SP 800-107 Rev. 1Aug 2012Recommendation for Applications Using Approved Hash Algorithms
SP 800-107 Rev. 1
SP 800-106Feb 2009Randomized Hashing for Digital Signatures
SP 800-106
SP 800-104Jun 2007A Scheme for PIV Visual Card Topography
SP 800-104
SP 800-103 
(Draft)
Oct. 6, 2006DRAFT An Ontology of Identity Credentials, Part I: Background and Formulation
Announcement and Draft Publication
SP 800-102Sep 2009Recommendation for Digital Signature Timeliness
SP 800-102
SP 800-101 Rev.1May 2014Guidelines on Mobile Device Forensics
SP 800-101 Rev. 1 FAQ
doi:10.6028/NIST.SP.800-101r1 [Direct Link]
SP 800-100Oct 2006Information Security Handbook: A Guide for Managers
SP 800-100 (including updates as of 03-07-2007)
SP 800-98Apr 2007Guidelines for Securing Radio Frequency Identification (RFID) Systems
SP 800-98
SP 800-97Feb 2007Establishing Wireless Robust Security Networks: A Guide to IEEE 802.11i
SP 800-97
SP 800-96Sep 2006PIV Card to Reader Interoperability Guidelines
SP 800-96
SP 800-95Aug 2007Guide to Secure Web Services
SP 800-95
SP 800-94 Rev. 1 
(Draft)
July 25, 2012DRAFT Guide to Intrusion Detection and Prevention Systems (IDPS)
Announcement and Draft Publication
SP 800-94Feb 2007Guide to Intrusion Detection and Prevention Systems (IDPS)
SP 800-94
SP 800-92Sep 2006Guide to Computer Security Log Management
SP 800-92
SP 800-92 (EPUB) FAQ
SP 800-90 A Rev. 1 (2nd Draft) 
(Draft)
Apr. 21, 2014DRAFT Recommendation for Random Number Generation Using Deterministic Random Bit Generators
Announcement and Draft Publication
SP 800-90 AJan 2012Recommendation for Random Number Generation Using Deterministic Random Bit Generators
SP 800-90A
SP 800-90 Arev1-B-C 
(Draft)
Sep. 9, 2013DRAFT Draft SP 800-90 Series: Random Bit Generators
800-90 A Rev. 1: Recommendation for Random Number Generation Using Deterministic Random Bit Generators
800-90 B: Recommendation for the Entropy Sources Used for Random Bit Generation
800-90 C: Recommendation for Random Bit Generator (RBG) Constructions

Announcement and Draft Publication
SP 800-89Nov 2006Recommendation for Obtaining Assurances for Digital Signature Applications
SP 800-89
SP 800-88 Rev. 1 
(Draft)
Sep. 6, 2012DRAFT Guidelines for Media Sanitization
Announcement and Draft Publication
SP 800-88Sep 2006Guidelines for Media Sanitization
SP 800-88 (including updates as of 09-11-2006)
SP 800-87 Rev 1Apr 2008Codes for Identification of Federal and Federally-Assisted Organizations
SP 800-87 Rev. 1
SP 800-86Aug 2006Guide to Integrating Forensic Techniques into Incident Response
SP 800-86
SP 800-85 B-1 
(Draft)
Sept. 11, 2009DRAFT PIV Data Model Conformance Test Guidelines
Announcement and Draft Publication
SP 800-85 BJul 2006PIV Data Model Test Guidelines
SP 800-85B
SP 800-85 A-2Jul 2010PIV Card Application and Middleware Interface Test Guidelines (SP800-73-3 Compliance)
SP 800-85A-2
SP 800-84Sep 2006Guide to Test, Training, and Exercise Programs for IT Plans and Capabilities
SP 800-84
SP 800-84 (EPUB) FAQ
SP 800-83 Rev. 1Jul 2013Guide to Malware Incident Prevention and Handling for Desktops and Laptops
SP 800-83 Rev. 1
SP 800-82 Rev.2 
(Draft)
May 14, 2014DRAFT Guide to Industrial Control Systems (ICS) Security
Announcement and Draft Publication
SP 800-82 Rev. 1Apr 2013Guide to Industrial Control Systems (ICS) Security
SP 800-82 Rev. 1 FAQ
doi:10.6028/NIST.SP.800-82r1 [Direct Link]
SP 800-81 Rev. 1Apr 2010Secure Domain Name System (DNS) Deployment Guide
SP 800-81 Rev. 1
SP 800-81 -2Sep 2013Secure Domain Name System (DNS) Deployment Guide
SP 800-81-2
SP 800-79 2 
(Draft)
Jun 2, 2014DRAFT Guidelines for the Authorization of Personal Identity Verification Card Issuers (PCI) and Derived PIV Credential Issuers (DPCI)
Announcement and Draft Publication
SP 800-79 -1Jun 2008Guidelines for the Accreditation of Personal Identity Verification (PIV) Card Issuers (PCI's)
SP 800-79-1
SP 800-78 -4 
(Draft)
May 19, 2014DRAFT Cryptographic Algorithms and Key Sizes for Personal Identity Verification
Announcement and Draft Publication
SP 800-78 -3Dec 2010Cryptographic Algorithms and Key Sizes for Personal Identification Verification (PIV)
SP 800-78-3
SP 800-77Dec 2005Guide to IPsec VPNs
SP 800-77
SP 800-76 -2Jul 2013Biometric Specifications for Personal Identity Verification
SP 800-76-2
SP 800-76 -1Jan 2007Biometric Data Specification for Personal Identity Verification
SP 800-76-1
SP 800-73 -4 
(Draft)
May 19, 2014DRAFT Interfaces for Personal Identity Verification (3 Parts)
Part 1- PIV Card Application Namespace, Data Model and Representation
Part 2- PIV Card Application Card Command Interface
Part 3- PIV Client Application Programming Interface

Announcement and Draft Publication
SP 800-73 -3Feb 2010Interfaces for Personal Identity Verification (4 Parts)
Part 1: End Point PIV Card Application Namespace, Data Model & Representation
Part 2: PIV Card Application Card Command Interface
Part 3: PIV Client Application Programming Interface
Part 4: The PIV Transitional Interfaces & Data Model Specification
SP 800-72Nov 2004Guidelines on PDA Forensics
SP 800-72
SP 800-70 Rev. 2Feb 2011National Checklist Program for IT Products: Guidelines for Checklist Users and Developers
SP 800-70 Rev. 2
SP 800-69Sep 2006Guidance for Securing Microsoft Windows XP Home Edition: A NIST Security Configuration Checklist
SP 800-69
SP 800-68 Rev. 1Oct 2008Guide to Securing Microsoft Windows XP Systems for IT Professionals
SP 800-68 Rev. 1
SP 800-67 Rev. 1Jan 2012Recommendation for the Triple Data Encryption Algorithm (TDEA) Block Cipher
SP 800-67 Rev. 1
SP 800-66 Rev 1Oct 2008An Introductory Resource Guide for Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule
SP 800-66 Rev. 1
SP 800-65 Rev. 1 
(Draft)
July 14, 2009DRAFT Recommendations for Integrating Information Security into the Capital Planning and Investment Control Process (CPIC)
Announcement and Draft Publication
SP 800-65Jan 2005Integrating IT Security into the Capital Planning and Investment Control Process
SP 800-65
SP 800-64 Rev. 2Oct 2008Security Considerations in the System Development Life Cycle
SP 800-64 Rev. 2
SP 800-63 -2Aug 2013Electronic Authentication Guideline
SP 800-63-2
SP 800-63 -1Dec 2011Electronic Authentication Guideline
SP 800-63-1
SP 800-61 Rev. 2Aug 2012Computer Security Incident Handling Guide
SP 800-61 Rev. 2
SP 800-60 Rev. 1Aug 2008Guide for Mapping Types of Information and Information Systems to Security Categories
Vol. 1: Guide for Mapping Types of Information and Information Systems to Security Categories
Vol. 2: Appendices
SP 800-59Aug 2003Guideline for Identifying an Information System as a National Security System
SP 800-59
SP 800-58Jan 2005Security Considerations for Voice Over IP Systems
SP 800-58
SP 800-57 Part 3-Rev.1 
(Draft)
May 5, 2014DRAFT Recommendation for Key Management: Part 3 - Application-Specific Key Management Guidance
Announcement and Draft Publication
SP 800-57 Part 1Jul 2012Recommendation for Key Management: Part 1: General (Revision 3)
SP 800-57 Part 1, Rev. 3
SP 800-57 Part 2Aug 2005Recommendation for Key Management: Part 2: Best Practices for Key Management Organization
SP 800-57 Part 2
SP 800-57 Part 3Dec 2009Recommendation for Key Management, Part 3 Application-Specific Key Management Guidance
SP 800-57 Part 3
SP 800-56 B-Rev.1 
(Draft)
Mar. 13, 2014DRAFT Recommendation for Pair-Wise Key-Establishment Schemes Using Integer Factorization Cryptography
Announcement and Draft Publication
SP 800-56 A Rev. 2May 2013Recommendation for Pair-Wise Key-Establishment Schemes Using Discrete Logarithm Cryptography
SP 800-56A Rev. 2
Public Comments received on Draft SP 800-56A Rev. 2
SP 800-56 BAug 2009Recommendation for Pair-Wise Key Establishment Schemes Using Integer Factorization Cryptography
SP 800-56B
SP 800-56 CNov 2011Recommendation for Key Derivation through Extraction-then-Expansion
SP 800-56C
SP 800-55 Rev. 1Jul 2008Performance Measurement Guide for Information Security
SP 800-55 Rev. 1
SP 800-54Jul 2007Border Gateway Protocol Security
SP 800-54
SP 800-53 Rev. 4Apr 2013Security and Privacy Controls for Federal Information Systems and Organizations
SP 800-53 Rev. 4 (including updates as of 01-15-2014) FAQ
doi:10.6028/NIST.SP.800-53r4 [Direct Link]
Word version of SP 800-53 Rev. 4 (01-15-2014)
XML file for SP 800-53 Rev. 4 (01-15-2014)
Summary of NIST SP 800-53 Revision 4
SP 800-53 A Rev. 1Jun 2010Guide for Assessing the Security Controls in Federal Information Systems and Organizations, Building Effective Security Assessment Plans
SP 800-53A Rev. 1
Security Assessment Overview and Cases
SP 800-52 Rev. 1Apr. 2014Guidelines for the Selection, Configuration, and Use of Transport Layer Security (TLS) Implementations
SP 800-52 Rev. 1 FAQ
doi:10.6028/NIST.SP.800-52r1 [Direct Link]
SP 800-51 Rev. 1Feb 2011Guide to Using Vulnerability Naming Schemes
SP 800-51 Rev. 1
SP 800-50Oct 2003Building an Information Technology Security Awareness and Training Program
SP 800-50
SP 800-49Nov 2002Federal S/MIME V3 Client Profile
SP 800-49
SP 800-48 Rev. 1Jul 2008Guide to Securing Legacy IEEE 802.11 Wireless Networks
SP 800-48 Rev. 1
SP 800-47Aug 2002Security Guide for Interconnecting Information Technology Systems
SP 800-47
SP 800-46 Rev. 1Jun 2009Guide to Enterprise Telework and Remote Access Security
SP 800-46 Rev. 1
SP 800-45 Version 2Feb 2007Guidelines on Electronic Mail Security
SP 800-45 Version 2
SP 800-44 Version 2Sep 2007Guidelines on Securing Public Web Servers
SP 800-44 Version 2
SP 800-43Nov 2002Systems Administration Guidance for Windows 2000 Professional System
SP 800-43
SP 800-41 Rev. 1Sep 2009Guidelines on Firewalls and Firewall Policy
SP 800-41 Rev. 1
SP 800-40 Rev. 3Jul 2013Guide to Enterprise Patch Management Technologies
SP 800-40 Rev. 3
SP 800-40 Version 2.0Nov 2005Creating a Patch and Vulnerability Management Program
SP 800-40 Version 2.0
SP 800-39Mar 2011Managing Information Security Risk: Organization, Mission, and Information System View
SP 800-39
SP 800-38 ADec 2001Recommendation for Block Cipher Modes of Operation - Methods and Techniques
SP 800-38A
SP 800-38 A - AddendumOct 2010Recommendation for Block Cipher Modes of Operation: Three Variants of Ciphertext Stealing for CBC Mode
SP 800-38A Addendum
SP 800-38 BMay 2005Recommendation for Block Cipher Modes of Operation: The CMAC Mode for Authentication
SP 800-38B
CMAC Examples (updated)
SP 800-38 CMay 2004Recommendation for Block Cipher Modes of Operation: the CCM Mode for Authentication and Confidentiality
SP 800-38C (including updates as of 07-20-2007)
SP 800-38 DNov 2007Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC
SP 800-38D
SP 800-38 EJan 2010Recommendation for Block Cipher Modes of Operation: The XTS-AES Mode for Confidentiality on Storage Devices
SP 800-38E
SP 800-38 FDec 2012Recommendation for Block Cipher Modes of Operation: Methods for Key Wrapping
SP 800-38F FAQ
doi:10.6028/NIST.SP.800-38F [Direct Link]
SP 800-38 G 
(Draft)
July 8, 2013DRAFT Recommendation for Block Cipher Modes of Operation: Methods for Format-Preserving Encryption
Announcement and Draft Publication
SP 800-37 Rev. 1Feb 2010Guide for Applying the Risk Management Framework to Federal Information Systems: A Security Life Cycle Approach
SP 800-37 Rev. 1 (including updates as of June 05, 2014) FAQ
doi:10.6028/NIST.SP.800-37r1 [Direct Link]
Supplemental Guidance on Ongoing Authorization, (June 2014)
SP 800-36Oct 2003Guide to Selecting Information Technology Security Products
SP 800-36
SP 800-35Oct 2003Guide to Information Technology Security Services
SP 800-35
SP 800-34 Rev. 1May 2010Contingency Planning Guide for Federal Information Systems
SP 800-34 Rev. 1 (including updates as of 11-11-2010)
Business Impact Analysis (BIA) Template (SP 800-34 Rev. 1)
Contingency Planning: Low Impact System Template (SP 800-34 Rev. 1)
Contingency Planning: Moderate Impact System Template (SP 800-34 Rev. 1)
Contingency Planning: High Impact System Template (SP 800-34 Rev. 1)
SP 800-33Dec 2001Underlying Technical Models for Information Technology Security
SP 800-33
SP 800-32Feb 2001Introduction to Public Key Technology and the Federal PKI Infrastructure
SP 800-32
SP 800-30 Rev. 1Sep 2012Guide for Conducting Risk Assessments
SP 800-30 Rev. 1
SP 800-30 Rev. 1 (EPUB) FAQ
SP 800-29Jun 2001A Comparison of the Security Requirements for Cryptographic Modules in FIPS 140-1 and FIPS 140-2
SP 800-29
SP 800-28 Version 2Mar 2008Guidelines on Active Content and Mobile Code
SP 800-28 Version 2
SP 800-27 Rev. AJun 2004Engineering Principles for Information Technology Security (A Baseline for Achieving Security)
SP 800-27 Rev. A
SP 800-25Oct 2000Federal Agency Use of Public Key Technology for Digital Signatures and Authentication
SP 800-25
SP 800-24Apr 2001PBX Vulnerability Analysis: Finding Holes in Your PBX Before Someone Else Does
SP 800-24
SP 800-23Aug 2000Guidelines to Federal Organizations on Security Assurance and Acquisition/Use of Tested/Evaluated Products
SP 800-23
SP 800-22 Rev. 1aApr 2010A Statistical Test Suite for Random and Pseudorandom Number Generators for Cryptographic Applications
SP 800-22 Rev. 1a
SP 800-21 2nd editionDec 2005Guideline for Implementing Cryptography in the Federal Government
SP 800-21 2nd Edition
SP 800-20Oct 1999Modes of Operation Validation System for the Triple Data Encryption Algorithm (TMOVS): Requirements and Procedures
SP 800-20 (including updates as of 03-2012)
SP 800-19Oct 1999Mobile Agent Security
SP 800-19
SP 800-18 Rev.1Feb 2006Guide for Developing Security Plans for Federal Information Systems
SP 800-18 Rev. 1
SP 800-17Feb 1998Modes of Operation Validation System (MOVS): Requirements and Procedures
SP 800-17
SP 800-16 Rev. 1 (3rd draft) 
(Draft)
Mar. 14, 2014DRAFT A Role-Based Model for Federal Information Technology / Cyber Security Training (3rd public draft)
Announcement and Draft Publication
SP 800-16Apr 1998Information Technology Security Training Requirements: A Role- and Performance-Based Model
SP 800-16
Appendices A, B, C, D
Appendix E
SP 800-15Jan 1998MISPC Minimum Interoperability Specification for PKI Components, Version 1
SP 800-15
SP 800-14Sep 1996Generally Accepted Principles and Practices for Securing Information Technology Systems
SP 800-14
SP 800-13Oct 1995Telecommunications Security Guidelines for Telecommunications Management Network
SP 800-13
SP 800-12Oct 1995An Introduction to Computer Security: The NIST Handbook
SP 800-12
SP 800-12 (HTML)
Back to Top