NIST Draft Publications Open for Comment

SP 800-73-6, Interfaces for Personal Identity Verification: Part 1 – PIV Card Application Namespace, Data Model and RepresentationInitial Working Draft

2026-06-12T00:00:00-04:00

NIST has released initial working drafts of proposed updates to the Personal Identity Verification (PIV) standards to support the use of post-quantum cryptography (PQC). The drafts identify the changes expected to be needed to use the ML-DSA digital signature algorithm and the ML-KEM key-encapsulation mechanism with PIV.

The current draft set comprises:

SP 800-73 Part 1: PIV Card Application Namespace, Data Model, and Representation
SP 800-73 Part 2: PIV Card Application Card Command Interface
SP 800-78: Cryptographic Algorithms and Key Sizes for PIV

A supporting PQC Overview accompanies the drafts to present a working gap analysis of the specification changes needed across the PIV algorithm profile, command interface, and data model, and outline the general approach under consideration. This approach centers on a dual-stack model that preserves existing classical PIV keys and data objects; adds new key references, certificate containers, and data objects for PQC credentials; and supports backward compatibility and incremental deployment during the transition.

These are preliminary working materials, not formal public drafts. By collaborating with implementers and users to develop these guidelines and specifications, NIST hopes to accelerate the standardization and implementation of PQC in PIV credentials.

NIST welcomes feedback throughout the development process. Interested parties can follow the work and participate by:

Joining the public mailing list — Subscribe at piv-standards+subscribe@list.nist.gov, and take part in discussions at piv-standards@list.nist.gov (archive).
Engaging on GitHub — Review the drafts, file issues, or open pull requests at the project repository.

SP 800-73-6, Interfaces for Personal Identity Verification: Part 2 – PIV Card Application Card Command InterfaceInitial Working Draft

2026-06-12T00:00:00-04:00

The current draft set comprises:

SP 800-73 Part 1: PIV Card Application Namespace, Data Model, and Representation
SP 800-73 Part 2: PIV Card Application Card Command Interface
SP 800-78: Cryptographic Algorithms and Key Sizes for PIV

NIST welcomes feedback throughout the development process. Interested parties can follow the work and participate by:

Joining the public mailing list — Subscribe at piv-standards+subscribe@list.nist.gov, and take part in discussions at piv-standards@list.nist.gov (archive).
Engaging on GitHub — Review the drafts, file issues, or open pull requests at the project repository.

SP 800-78-6, Cryptographic Algorithms and Key Sizes for Personal Identity VerificationInitial Working Draft

2026-06-12T00:00:00-04:00

The current draft set comprises:

SP 800-73 Part 1: PIV Card Application Namespace, Data Model, and Representation
SP 800-73 Part 2: PIV Card Application Card Command Interface
SP 800-78: Cryptographic Algorithms and Key Sizes for PIV

NIST welcomes feedback throughout the development process. Interested parties can follow the work and participate by:

Joining the public mailing list — Subscribe at piv-standards+subscribe@list.nist.gov, and take part in discussions at piv-standards@list.nist.gov (archive).
Engaging on GitHub — Review the drafts, file issues, or open pull requests at the project repository.

SP 800-239, AI Data Center Security Analysis: A High-Performance Computing (HPC) Driven ApproachInitial Public Draft

2026-07-27T00:00:00-04:00

Building upon established principles from high-performance computing (HPC) threat analyses and security overlays, this publication delivers a thorough threat and security gap analysis for purpose-built AI infrastructure used in model training, inference, and applications. By contrasting AI data centers with traditional HPC systems across architecture, hardware, software stacks, workflows, and storage systems, the publication pinpoints critical security threats and outlines possible solutions to safeguard next-generation AI environments.

NOTE: A call for patent claims is included in this draft. For additional information, see the Information Technology Laboratory (ITL) Patent Policy--Inclusion of Patents in ITL Publications.

IR 8613, Multi-Cloud Architecture Challenges: Security and Compliance ImplicationsInitial Public Draft

2026-08-21T00:00:00-04:00

NIST Internal Report (IR) 8613 ipd (initial public draft), Multi-Cloud Architecture Challenges, identifies, categorizes, and analyzes the security and compliance challenges that are unique to or significantly amplified by multi-cloud architectures. This analysis by the NIST Multi-Cloud Security Public Working Group (MCSPWG) addresses security and Authorization to Operate (ATO) challenges and highlights areas where additional community research could meaningfully reduce risk.

The MCSPWG identified 23 consolidated challenge areas that represent novel friction points and architectural misalignments that emerge when orchestrating control across autonomous cloud silos. The most significant structural challenge areas are:

Security-significant differences in cloud-native services across providers
Organizational logistics and staffing complexity across heterogeneous environments
Difficulty in implementing centralized security capabilities across provider boundaries

These structural gaps are most acute in five areas: (1) identity and access management, (2) telemetry and logging, (3) configuration and change management, (4) data protection, and (5) compliance and authorization.

Submit Your Comments:

NIST invites input from federal agencies, industry partners, researchers, and the broader cybersecurity community. The public comment period is open through October 5, 2026.

How to Participate:

Email your completed template to ir8613-comments@nist.gov with the subject line "NIST.IR.8613 Comments."

SP 1353, NIST Cybersecurity Framework 2.0: Quick-Start Guide for Using Artificial Intelligence (AI) for CSF Analysis and ReportingInitial Public Draft

2026-08-19T00:00:00-04:00

This new quick-start guide illustrates practical and actionable ways AI could be used for analyzing, planning, implementing, and monitoring an organization’s progress toward achieving CSF 2.0 outcomes.

The document’s purpose is to:

Provide structured AI prompts as tools for practitioners to begin creating CSF-related artifacts in support of achieving CSF outcomes
Identify current state of practice for AI prompt engineering in CSF implementation and analysis

While the focus was not to write about AI best practices or to provide cybersecurity guidelines thereof, there are places where specific precautions are denoted with the /!\ notation.

This guide includes three notional use cases, examples of prompts for structuring natural language inputs to produce specified CSF 2.0 outputs from a generative AI model, simulated organizational files for a fictitious company, tips for getting started, and more.

USE CASE 1 illustrates the use of an AI-assisted review to evaluate organization cybersecurity policy, strategy, and risk governance in alignment with the CSF 2.0 outcomes.
USE CASE 2 illustrates how to produce a draft Organization Current State Profile – mapping artifacts and personnel interview notes to CSF 2.0 outcomes, documenting any assumptions, and recording observed gaps in the interviews and evidence.
USE CASE 3 illustrates how to draw upon internal and industry references to create a draft CSF target state profile describing desired outcomes to meet mission objectives, stakeholder expectations, address the risk landscape, and fulfill requirements.

Use case examples illustrate a possible approach and are not prescriptive assessment or assurance methodologies.

Note: The README file in the Supplemental Materials List contains the ZIP file checksums.

Submit Your Comments:

The comment period is open through October 15, 2026, at 11:59 PM. Email comments to: csf@nist.gov.

Note: NIST is only seeking comments on the quick-start guide and supplied AI prompts. NIST is not seeking comment on the fictional organizational documents. Those are for illustrative purposes only.

This publication is the most recent within a portfolio of CSF 2.0 quick-start guides released by the CSF 2.0 project team since February 26, 2024. These resources offer tailored pathways for different audiences to engage with the CSF 2.0, making the Framework easier to implement. View all CSF 2.0 quick-start guides.

SP 800-213A Rev. 1, PRE-DRAFT Call for Comments: IoT Device Cybersecurity Requirement CatalogInitial Preliminary Draft

2026-08-31T00:00:00-04:00

Following the publication of draft revision IoT Product Cybersecurity Guidelines for the Federal Government: Establishing IoT Product Cybersecurity Requirements, NIST SP 800-213 Rev. 1, NIST has initiated the process of revising the companion document IoT Device Cybersecurity Guidance for the Federal Government: IoT Device Cybersecurity Requirement Catalog, NIST SP 800-213A, to incorporate lessons learned, align with relevant NIST guidance (e.g., Cybersecurity Framework (CSF) 2.0, NIST SP 800-53 Rev. 5.2.0)—as well as IoT cybersecurity standards and practices, and address changes in the IoT threat landscape.

We welcome any valuable perspectives on potential revisions to the current SP 800-213A to maximize the document’s effectiveness, relevance, and usability in helping the community understand and manage cybersecurity risk. To help guide this input, NIST has included specific questions below, though reviewers are encouraged to address any, all, or additional topics in their comments.

The public comment period is open through October 15, 2026. Submit comments via email to iotsecurity@nist.gov with the subject line “Comments on SP 800-213A.”

Specifically, NIST asks for input on the following questions to help us plan and produce an initial revision of NIST SP 800-213A:

Addressing IoT Products. Given that draft NIST SP 800-213 Rev. 1 discusses IoT products while NIST SP 800-213A was written for IoT devices, how should we align NIST SP 800-213A with NIST SP 800-213 Rev. 1 in relation to IoT products? For example, the scope of SP 800-213A could be expanded to IoT products, or the scope of SP 800-213A could remain IoT devices with additional guidelines used for IoT product components other than the IoT device (e.g., mobile applications, backends). We welcome suggestions of other paths forward as well.
Novel and Unique IoT Adoption and Use Cases. How is your organization using IoT and are there novel IoT use cases we should consider in the update?
Addressing Unique and Tailored IoT Deployments. How can the NIST SP 800-213A guidelines appropriately handle situations in which an organization combines multiple off-the-shelf components (e.g., Raspberry Pi, sensors) to create an IoT sub-system akin to an IoT product?
Foundational Guidelines to Base our Work Upon. The content in NIST SP 800-213A was sourced primarily from NIST SP 800-53 Rev. 5, as well as the NIST Cybersecurity Framework (CSF). What other sources should we look to?
Document Usability. How can descriptions and discussions for each capability in NIST SP 800-213A best help practitioners identify appropriate IoT product cybersecurity capabilities in different operational environments?

Submitted comments, including attachments and other supporting materials, will become part of the public record and are subject to public disclosure. Personally identifiable information and confidential business information should not be included (e.g., account numbers, Social Security numbers, names of other individuals). Comments that contain profanity, vulgarity, threats, or other inappropriate language will not be posted or considered.

SP 800-38E Rev. 1, Recommendation for Block Cipher Modes of Operation: XTS-AES Mode for Confidentiality on Storage DevicesInitial Public Draft

2026-09-03T00:00:00-04:00

Revision 1 updates the referenced specification to IEEE Std. 1619-2025 and clarifies NIST’s requirements for the approved use of XTS-AES, including its scope of use, data-unit and key-scope limits, key requirements, and the ordering convention for ciphertext stealing.

Rather than reproducing the XTS-AES specification, this recommendation incorporates IEEE Std. 1619-2025 by reference. To facilitate review of the draft SP, IEEE Std. 1619-2025 is publicly available during the public comment period.

The public comment period is open through October 16, 2026.

NOTE: A call for patent claims is included in this draft. For additional information, see the Information Technology Laboratory (ITL) Patent Policy – Inclusion of Patents in ITL Publications.