News & Updates

A new NIST Cybersecurity Practice Guide, NIST SP 1800-24, is now available:  "Securing Picture Archiving and Communication System (PACS): Cybersecurity for the Healthcare Sector."

Four draft guidance documents on defining IoT cybersecurity requirements--for federal agencies and IoT device manufacturers--are now available for comment through February 26, 2021:  Draft SP 800-213 and Draft NISTIRs 8259B/C/D.

A new publication formalizes the Common Vulnerabilities and Exposures (CVE) entry metadata submission process that's used in conjunction with the National Vulnerability Database (NVD).

Draft NISTIR 8286A, "Identifying and Estimating Cybersecurity Risk for Enterprise Risk Management," is available for comment through February 1, 2021.

NIST has issued supplemental materials and errata updates for both SP 800-53 Rev. 5 and SP 800-53B, which were originally published in September 2020. New materials include control mappings and control comparisons. 

NIST's NCCoE is publishing two Cybersecurity Practice Guides for data integrity that address identifying and protecting assets against--and detecting and responding to--ransomware and other destructive events. Special Publications (SP) 1800-25 and 1800-26 are now available.

The National Cybersecurity Center of Excellence (NCCoE) at NIST has released Draft NISTIR 8320A, "Hardware-Enabled Security: Container Platform Security Prototype." The public comment period closes January 29, 2021.

NIST has published two documents for the National Online Informative References (OLIR) Program, NISTIR 8278 and NISTIR 8278A.

NIST's National Initiative for Cybersecurity Education (NICE) has released an update of its Workforce Framework for Cybersecurity (NICE Framework) in Special Publication 800-181 Revision 1.

Draft FIPS 201-3, "Personal Identity Verification (PIV) of Federal Employees and Contractors," is now available for public comment through February 1, 2021. 

NIST Special Publication (SP) 800-53B, "Control Baselines for Information Systems and Organizations," has been published.

NIST has published Special Publication (SP) 800-208, "Recommendation for Stateful Hash-Based Signature Schemes."

NIST SP 800-209, "Security Guidelines for Storage Infrastructure," has been published.

NIST Technical Note (TN) 2111, "An Empirical Study on Flow-based Botnet Attacks Prediction," is now available. 

In response to Executive Order 13905, NIST is releasing Draft NISTIR 8323, "Cybersecurity Profile for the Responsible Use of Positioning, Navigation, and Timing (PNT) Services." The public comment period closes November 23, 2020; all relevant comment received will be posted publicly.

NISTIR 8286, "Integrating Cybersecurity and Enterprise Risk Management (ERM)," is now available.

NIST has published NISTIR 8183 Revision 1, "Cybersecurity Framework Version 1.1 Manufacturing Profile."

Draft NISTIR 8212, "ISCMA: An Information Security Continuous Monitoring Program Assessment," is available for public comment through November 13, 2020.

NIST's NCCoE has posted a draft paper, "Securing Data Integrity Against Ransomware Attacks: Using the NIST Cybersecurity Framework and NIST Cybersecurity Practice Guides. The public comment period is open through November 13, 2020.

Draft NISTIR 8301, "Blockchain Networks: Token Design and Management Overview," is now available for comment through October 30, 2020.

Draft NISTIR 8235, "Security Guidance for First Responder Mobile and Wearable Devices," is now available for public comment through November 30, 2020.

NIST has posted a call for comments on "Performance Measurement Guide for Information Security" (SP 800-55 Rev. 1), with a comment period open through December 10, 2020. A new "Measurements for Information Security" project is also available.

NIST Special Publication (SP) 800-53 Revision 5, "Security and Privacy Controls for Information Systems and Organizations," represents a multi-year effort to develop the next generation of controls needed to strengthen and support the Federal Government and critical infrastructure sectors.

NIST has published Special Publication (SP) 1800-11, "Data Integrity: Recovering from Ransomware and Other Destructive Events."

NIST has released the final public draft of NIST Cybersecurity Practice Guide SP 1800-15, "Securing Small-Business and Home Internet of Things (IoT) Devices: Mitigating Network-Based Attacks Using Manufacturer Usage Description (MUD)." The comment period closes October 16, 2020.

The NIST Cybersecurity Practice Guide on "Mobile Device Security: Corporate-Owned Personally-Enabled (COPE)" has been published as SP 1800-21.

The National Cybersecurity Center of Excellence has released Draft NIST Cybersecurity Practice Guide (SP 1800-27), "Securing Property Management Systems," for public comment. The comment period closes on October 28, 2020.

NIST requests review and comments on Special Publication (SP) 800-46 Revision 2, "Guide to Enterprise Telework, Remote Access, and Bring Your Own Device (BYOD) Security." The comment period is open through October 30, 2020.

A preliminary draft of Volume A of SP 1800-31A, "Improving Enterprise Patching for General IT Systems," is available for comment through October 9, 2020.

A draft white paper, "Trusted Internet of Things (IoT) Device Network-Layer Onboarding and Lifecycle Management," is available for comment through October 8, 2020.

NIST has published NISTIR 8272, "Impact Analysis Tool for Independent Cyber Supply Chain Risks."

NIST announces the publication of "NIST Cloud Computing Forensic Science Challenges," NISTIR 8006.

NIST has published its 2019 Annual Report for the NIST/ITL Cybersecurity Program, in  Special Publication (SP) 800-211.

NIST announces the publication of SP 800-56C Revision 2, "Recommendation for Key-Derivation Methods in Key-Establishment Schemes." 

NIST publishes Special Publication (SP) 800-207, "Zero Trust Architecture."

NIST has released two draft NISTIRs for the National Cybersecurity Online Informative References (OLIR) Program: Draft (2nd) NISTIR 8278 and Draft NISTIR 8278A. The comment period for each publication closes September 4, 2020.

NIST provides considerations for secure file exchanges.

NIST has released Draft SP 800-53B, "Control Baselines for Information Systems and Organizations," for public comment. The comment period is open through September 11, 2020.

NIST has published Special Publication (SP) 800-210, "General Access Control Guidance for Cloud Systems."

NIST Technical Note (TN) 2066, "OpenFMB Proof of Concept Implementation Research," describes recent cybersecurity research related to the Smart Grid.

NIST is announcing the third round finalists of the NIST Post-Quantum Cryptography Standardization Process. More details are included in NISTIR 8309.

NIST has released Draft Special Publication (SP) 800-209, "Security Guidelines for Storage Infrastructure," for public comment.  The comment period is open through August 31, 2020.

The National Initiative for Cybersecurity Education (NICE) has released Draft SP 800-181 Revision 1, "Workforce Framework for Cybersecurity (NICE Framework)." The public comment period closes August 28, 2020.

NIST is requesting comments on the Second Draft of NISTIR 8286, "Integrating Cybersecurity and Enterprise Risk Management (ERM)." The public comment period closes August 21, 2020.

NIST has published NISTIR 8214A, "NIST Roadmap Toward Criteria for Threshold Schemes for Cryptographic Primitives."

NIST has released a final public draft for comment: Draft Special Publication (SP) 800-172. The comment period ends on August 21, 2020.

NIST has published Special Publication 800-77 Revision 1, "Guide to IPsec VPNs"

NIST is pleased to announce the release of OSCAL 1.0.0 Milestone 3. This is the third official milestone pre-release of .....

NIST is requesting review and comments on the existing four-volume set of SP 800-63 publications, "Digital Identity Guidelines."  The public comment period ends August 10, 2020.

NIST announces the publication of NIST SP 800-133 Revision 2, "Recommendation for Cryptographic Key Generation."

Two publications, NISTIRs 8259 and 8259A, are now available to provide cybersecurity best practices and guidance for IoT device manufacturers.

NIST announces the publication of SP 800-204A, "Building Secure Microservices-based Applications Using Service-Mesh Architecture."

NIST has posted a draft Cybersecurity White Paper, "Getting Ready for Post-Quantum Cryptography: Explore Challenges Associated with Adoption and Use of Post-Quantum Cryptographic Algorithms." The public comment period ends June 30, 2020.

NIST has published Special Publication (SP) 800-137A, "Assessing Information Security Continuous Monitoring (ISCM) Programs: Developing an ISCM Program Assessment."

NIST has updated its key management guidance by publishing SP 800-57 Part 1 Revision 5, "Recommendation for Key Management: Part 1 – General."

NISTIR 8294, "Symposium on Federally Funded Research on Cybersecurity of Electric Vehicle Supply Equipment (EVSE)," has been published, describing a NIST-hosted event from September 12, 2019. It also includes the meeting agenda and seven presentations.

NIST has published Volume 4 of NISTIR 8011:  "Automation Support for Security Control Assessments: Software Vulnerability Management."

A draft NIST Cybersecurity White Paper is available for comment: "Hardware-Enabled Security for Server Platforms." The public comment period is open through June 2, 2020.

NIST has published "Mitigating the Risk of Software Vulnerabilities by Adopting a Secure Software Development Framework (SSDF)," a new NIST Cybersecurity White Paper.

NIST has released a Draft NIST Cybersecurity White Paper on "Methodology for Characterizing Network Behavior of Internet of Things Devices." The public comment period ends May 1, 2020.

NIST has released Draft Special Publication (SP) 800-210, "General Access Control Guidance for Cloud Systems," for public comment. The comment period is open through May 15, 2020.

NIST publishes Revision 1 of SP 800-175B, "Guideline for Using Cryptographic Standards in the Federal Government: Cryptographic Mechanisms."

NIST is requesting comments on Draft SP 800-56C Revision 2, "Recommendation for Key-Derivation Methods in Key-Establishment Schemes."  The public comment period ends May 15, 2020.

NIST has released Draft SP 800-124 Revision 2, "Guidelines for Managing the Security of Mobile Devices in the Enterprise," for public comment. The comment period ends June 26, 2020.

NIST has published seven documents in the SP 800-140x subseries--supporting documents for FIPS 140-3 and the Cryptographic Module Validation Program.

NIST is requesting comments on Draft NISTIR 8286, "Integrating Cybersecurity and Enterprise Risk Management (ERM)." The public comment period closes April 20, 2020.

NIST has published a new ITL Bulletin (March 2020) that addresses enterprise security solutions for telework, remote access, and BYOD. Also, a new Telework Cybersecurity summary is available on the CSRC homepage and will be updated as new resources are added for organizations and teleworkers. 

NISTIR 8170, "Approaches for Federal Agencies to Use the Cybersecurity Framework," provides guidance on how to use the NIST Cybersecurity Framework in federal agencies, in conjunction with the current and planned suite of NIST security and privacy risk management publications.

NIST has released the Final Public Draft of Special Publication (SP) 800-53 Revision 5, "Security and Privacy Controls for Information Systems and Organizations," for public comment. Comments are due by May 29, 2020.

NIST is soliciting comments on Draft NISTIR 8272, "Impact Analysis Tool for Interdependent Cyber Supply Chain Risks." The public comment period ends April 17, 2020.

Draft SP 800-133 Revision 2, "Recommendation for Cryptographic Key Generation," is available for comment. The comment period closes April 17, 2020.

NIST has released Draft NISTIR 8183 Rev. 1, "Cybersecurity Framework Version 1.1 Manufacturing Profile," for public comment. Comments are due by May 4, 2020.

The National Initiative for Cybersecurity Education, led by the National Institute of Standards and Technology (NIST) is pleased to announce the NIST Internal Report (NISTIR) 8287: A Roadmap for....

NIST has published Revision 2 of Special Publication 800-171, "Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations."

A second public draft of NIST SP 800-207, "Zero Trust Architecture," is available for comment. The comment period closes March 13, 2020.

NIST solicits feedback on Draft NISTIR 8246, National Vulnerability Database (NVD) Metadata Submission Guidelines for Common Vulnerabilities and Exposures (CVE) Numbering Authorities (CNAs) and Authorized Data Publishers. Comments are due March 20, 2020.

NIST is initiating an update of Special Publication (SP) 800-161, "Supply Chain Risk Management Practices for Federal Information Systems and Organizations," seeking preliminary comments on possible clarifications, additions, and removal of information. Comments are due by February 28, 2020.

Draft NISTIR 8276, "Key Practices in Cyber Supply Chain Risk Management: Observations from Industry” is available for comment; the comment period closes March 4, 2020.  Six new Case Studies in Cyber SCRM are also available, along with a "Summary of Findings and Recommendations."

NIST has released Draft NISTIR 8278, "National Cybersecurity Online References (OLIR) Program: Guidance for OLIR Users and Developers." Public comments are due by February 24, 2020.

NIST has released Draft NIST Special Publication (SP) 800-204A, "Building Secure Microservices-based Applications Using Service-Mesh Architecture," for comment. The public comment period ends February 14, 2020.

NIST has published the Cybersecurity White Paper "A Taxonomic Approach to Understanding Emerging Blockchain Identity Management Systems."

NIST has released Draft Special Publication (SP) 800-137A, "Assessing Information Security Continuous Monitoring (ISCM) Programs: Developing an ISCM Program Assessment." Public comments are due by February 28, 2020.

NIST has released the second public draft of NISTIR 8259, "Recommendations for IoT Device Manufacturers: Foundational Activities and Core Device Cybersecurity Capability Baseline." The public comment period ends February 7, 2020.