NIST has released initial working drafts of proposed updates to the Personal Identity Verification (PIV) standards to support the use of post-quantum cryptography (PQC). The drafts identify the changes expected to be needed to use the ML-DSA digital signature algorithm and the ML-KEM key-encapsulation mechanism with PIV.
The current draft set comprises:
A supporting PQC Overview accompanies the drafts to present a working gap analysis of the specification changes needed across the PIV algorithm profile, command interface, and data model, and outline the general approach under consideration. This approach centers on a dual-stack model that preserves existing classical PIV keys and data objects; adds new key references, certificate containers, and data objects for PQC credentials; and supports backward compatibility and incremental deployment during the transition.
These are preliminary working materials, not formal public drafts. By collaborating with implementers and users to develop these guidelines and specifications, NIST hopes to accelerate the standardization and implementation of PQC in PIV credentials.
NIST welcomes feedback throughout the development process. Interested parties can follow the work and participate by:
NIST has released initial working drafts of proposed updates to the Personal Identity Verification (PIV) standards to support the use of post-quantum cryptography (PQC). The drafts identify the changes expected to be needed to use the ML-DSA digital signature algorithm and the ML-KEM key-encapsulation mechanism with PIV.
The current draft set comprises:
A supporting PQC Overview accompanies the drafts to present a working gap analysis of the specification changes needed across the PIV algorithm profile, command interface, and data model, and outline the general approach under consideration. This approach centers on a dual-stack model that preserves existing classical PIV keys and data objects; adds new key references, certificate containers, and data objects for PQC credentials; and supports backward compatibility and incremental deployment during the transition.
These are preliminary working materials, not formal public drafts. By collaborating with implementers and users to develop these guidelines and specifications, NIST hopes to accelerate the standardization and implementation of PQC in PIV credentials.
NIST welcomes feedback throughout the development process. Interested parties can follow the work and participate by:
NIST has released initial working drafts of proposed updates to the Personal Identity Verification (PIV) standards to support the use of post-quantum cryptography (PQC). The drafts identify the changes expected to be needed to use the ML-DSA digital signature algorithm and the ML-KEM key-encapsulation mechanism with PIV.
The current draft set comprises:
A supporting PQC Overview accompanies the drafts to present a working gap analysis of the specification changes needed across the PIV algorithm profile, command interface, and data model, and outline the general approach under consideration. This approach centers on a dual-stack model that preserves existing classical PIV keys and data objects; adds new key references, certificate containers, and data objects for PQC credentials; and supports backward compatibility and incremental deployment during the transition.
These are preliminary working materials, not formal public drafts. By collaborating with implementers and users to develop these guidelines and specifications, NIST hopes to accelerate the standardization and implementation of PQC in PIV credentials.
NIST welcomes feedback throughout the development process. Interested parties can follow the work and participate by:
This publication provides resources for assessing macOS desktop and laptop, iOS, and visionOS system security in an automated way, including up-to-date and practical recommendations (i.e., secure baselines and associated rules) that are available on the mSCP GitHub site. It also describes use cases for leveraging the mSCP content. Updates from the previous version of this publication highlight the mSCP’s next generation of improvements, including simpler OS version and rule management as well as an expanded audience.
The public comment period is open from June 22 through August 14, 2026. See the publication details for a copy of the draft and instructions for submitting comments.
NOTE: A call for patent claims is included on page ii of this draft. For additional information, see the Information Technology Laboratory (ITL) Patent Policy--Inclusion of Patents in ITL Publications.
Organizations increasingly use Internet of Things (IoT) products for the mission benefits they offer, but care must be taken in acquiring and implementing this equipment.
NIST is updating guidelines for establishing cybersecurity requirements for IoT products to support necessary security controls. Understanding that an IoT product is a system element facilitates an understanding of how it must be considered in the risk management process. The acquisition and integration of an IoT product into an information system may alter the system’s risk assessment based on new risks introduced by the product. An updated risk assessment may require additional or new controls to be selected and implemented in the system. This publication provides general considerations of how IoT products may impact an information system’s risk assessment and subsequent allocation of controls that may be necessary.
NOTE: A call for patent claims is included on page iii of this draft. For additional information, see the Information Technology Laboratory (ITL) Patent Policy--Inclusion of Patents in ITL Publications.
", "published": "2026-06-24T00:00:00", "updated": "2026-06-24T00:00:00", "link": "https://csrc.nist.gov/pubs/sp/800/213/r1/ipd", "content": "Comments Due 08/24/2026" }, { "id": "https://csrc.nist.gov/pubs/cswp/36/f/initial-nas-message-security-applying-5g-cybersecu/ipd", "title": "CSWP 36F, Initial NAS Message Security: Applying 5G Cybersecurity and Privacy CapabilitiesInitial Public Draft", "summary": "This NIST Cybersecurity White Paper describes a 5G security feature that protects sensitive information in the Initial Non-Access Stratum (NAS) Message and explains how organizations can verify these protections in deployed 5G networks.
This white paper is part of the NCCoE’s work to accelerate the adoption of 5G security features by demonstrating their implementation on our operational 5G security testbed and providing actionable implementation guidelines to help network operators enhance the cybersecurity and privacy of 5G systems and supporting infrastructures.
Current 5G standards include specifications to address cybersecurity and privacy challenges present in previous generations of cellular systems. In 4G, the initial handshake message used to establish a connection between the device and the network—the Initial NAS Message—was sent without encryption or integrity protection. This leaves the 4G user device and the core network vulnerable to man-in-the-middle attacks.
Current 5G specifications allow the device to send the security-sensitive contents of the initial NAS message in an encrypted and integrity protected form.
This White Paper describes how the NCCoE demonstrated these capabilities and explains how organizations can verify these protections in deployed 5G networks to protect the security and privacy on their networks.
By demonstrating security features on our operational 5G Testbed, we aim to deliver real-world implementation insights to advance 5G security and inform the next generation of wireless security.
This White Paper is available for public comment through September 7, 2026. Visit the NCCoE 5G Cybersecurity project page to learn more and download the White Paper today!
", "published": "2026-08-06T00:00:00", "updated": "2026-08-06T00:00:00", "link": "https://csrc.nist.gov/pubs/cswp/36/f/initial-nas-message-security-applying-5g-cybersecu/ipd", "content": "Comments Due 09/07/2026" }, { "id": "https://csrc.nist.gov/pubs/sp/800/209/r1/ipd", "title": "SP 800-209 Rev. 1, Security Guidelines for Storage InfrastructureInitial Public Draft", "summary": "Storage technology has evolved in two primary directions: (1) increased media storage capacity and (2) architectural changes that provide a software-based abstraction over all forms of background storage technologies. However, the latter evolution has increased management complexity and the probability of configuration errors and associated security threats. This document traces the evolution of the storage technology landscape and analyzes current security threats and resultant risks to provide a comprehensive set of security recommendations in the form of storage security controls.
\nImportant updates in this revision of SP 800-209 include:
\nNOTE: A call for patent claims is included in this draft. For additional information, see the Information Technology Laboratory (ITL) Patent Policy – Inclusion of Patents in ITL Publications.
", "published": "2026-07-22T00:00:00", "updated": "2026-07-22T00:00:00", "link": "https://csrc.nist.gov/pubs/sp/800/209/r1/ipd", "content": "Comments Due 09/08/2026" }, { "id": "https://csrc.nist.gov/pubs/sp/800/239/ipd", "title": "SP 800-239, AI Data Center Security Analysis: A High-Performance Computing (HPC) Driven ApproachInitial Public Draft", "summary": "Building upon established principles from high-performance computing (HPC) threat analyses and security overlays, this publication delivers a thorough threat and security gap analysis for purpose-built AI infrastructure used in model training, inference, and applications. By contrasting AI data centers with traditional HPC systems across architecture, hardware, software stacks, workflows, and storage systems, the publication pinpoints critical security threats and outlines possible solutions to safeguard next-generation AI environments.
NOTE: A call for patent claims is included in this draft. For additional information, see the Information Technology Laboratory (ITL) Patent Policy--Inclusion of Patents in ITL Publications.
", "published": "2026-07-27T00:00:00", "updated": "2026-07-27T00:00:00", "link": "https://csrc.nist.gov/pubs/sp/800/239/ipd", "content": "Comments Due 09/25/2026" } ] }