SP 1800-39, Data Classification PracticesInitial Public Draft

2026-02-12T00:00:00-05:00

This guide, Data Classification Practices, demonstrates how organizations can discover, identify, and label unstructured data using data classification practices. Performing Data Classification Practices allows an organization to know its data and apply technologies that minimize the risk of valuable or sensitive data being lost or mismanaged. Data Classification Practices prepare an organization for the use of emerging security measures—including Zero Trust Architecture, quantum-safe cryptography, and AI model training that requires labeled data. This 1800-series NIST publication documents how the NCCoE and its collaborators created a synthetic dataset and used commercially available data classification tools to discover, identify, and label unstructured data.

Background

Organizations trying to protect sensitive data from unauthorized access or disclosure need to understand all their data—structured and unstructured—across all the places that data might live. Sensitive data, such as PII, may reside in a variety of systems, digital conversations, data lakes, and file repositories. Identifying and classifying sensitive data is crucial for minimizing data loss and preparing organizations for advanced security measures, including Zero Trust Architecture, quantum-safe cryptography, and AI model training.

The goal of this project is to demonstrate data classification practices for identifying and understanding sensitive unstructured data. This NIST Cybersecurity Practice Guide provides users with the information they need to apply data classification practices to discover, identify, and label sensitive unstructured data using commercially available data classification technology. By doing so, organizations can better understand their data and minimize the risk of losing or mismanaging valuable or sensitive data.

The public comment period ends on March 30, 2026.

Other [Concept Paper] Accelerating the Adoption of Software and Artificial Intelligence Agent Identity and AuthorizationInitial Public Draft

2026-02-05T00:00:00-05:00

The NIST National Cybersecurity Center of Excellence is interested in launching a project to demonstrate how identity standards and best practices can be applied to software agents, with a focus on agentic AI applications.

Artificial Intelligence (AI) technology brings great opportunities to organizations. Specifically, AI agents—software systems that use data and algorithms to autonomously perform tasks—offer the promise of improved productivity, efficiency, and decision-making in complex scenarios. However, realizing these benefits requires understanding the potential risks from giving AI agents access to diverse data sets, tools, and applications, and applying appropriate identification and authorization controls to mitigate these risks.

We Need Your Feedback

To help the community provide input on this potential project, the NCCoE has released a concept paper, Accelerating the Adoption of Software and Artificial Intelligence Agent Identity and Authorization, outlining considerations for a potential NCCoE project focused on applying identity standards and best practices to AI agents.

The concept paper provides an overview of the types of feedback that would be most helpful, such as:

Use Cases: How are organizations currently using or planning to use AI agents?
Challenges: What new and unique problems do AI agents bring compared to other software?
Standards: What current or emerging standards are being used to guide AI agent identity and access management?
Technologies: What technology is being used or planned to support AI agents?
More detailed questions on the identification, authorization, auditing and non-repudiation of AI agents, as well as controls to prevent and mitigate prompt injection techniques.

How to Submit Feedback

This concept paper is open for public comment through April 2, 2026. We encourage you to visit our project page for more details and instructions to submit comments. We appreciate your feedback to inform the NCCoE’s work to accelerate the adoption of secure technologies.

NIST Draft Publications Open for Comment

SP 1800-39, Data Classification PracticesInitial Public Draft

Other [Concept Paper] Accelerating the Adoption of Software and Artificial Intelligence Agent Identity and AuthorizationInitial Public Draft