News & Updates

NIST is releasing two guides to address the challenge of ransomware: NISTIR 8374, "Ransomware Risk Management: A Cybersecurity Framework Profile," and a companion quick start guide, "Getting Started with Cybersecurity Risk Management: Ransomware."

NIST is seeking information to assist in evaluating and improving its cybersecurity resources—including the widely-used NIST Cybersecurity Framework (CSF) and a variety of existing and potential standards, guidelines, and other information. Comments are due by April 25, 2022.

NIST requests comments on Draft Special Publication (SP) 800-219, "Automated Secure Configuration Guidance from the macOS Security Compliance Project (mSCP)." The public comment period closes on March 23, 2022.

Second Drafts of NIST SP 800-140C/D Rev. 1 Available for Comment until March 25, 2022.

NIST has published NISTIR 8286B, "Prioritizing Cybersecurity Risk for Enterprise Risk Management." It is part of the NISTIR 8286 subseries, which enables risk practitioners to more fully integrate cybersecurity risk management (CSRM) activities into the broader enterprise risk processes.

The SSDF has been updated to version 1.1 in the new release of NIST Special Publication (SP) 800-218.

NIST has published SP 1800-32, "Securing Distributed Energy Resources: An Example of Industrial Internet of Things Cybersecurity."

NIST has released Draft NISTIR 8286C, "Staging Cybersecurity Risks for Enterprise Risk Management and Governance Oversight." The public comment period closes March 11, 2022.

NIST has released Special Publication (SP) 800-53A Revision 5, "Assessing Security and Privacy Controls in Information Systems and Organizations."

The Secretary of Commerce has approved the publication of FIPS 201-3, NIST latest revision of "Personal Identity Verification (PIV) of Federal Employees and Contractors."

NIST is currently reviewing Special Publication (SP) 800-106, "Randomized Hashing for Digitial Signatures," (2009) and is requesting public feedback on all aspects of the publication by March 16, 2022.

NIST is proposing to revise Special Publication (SP) 800-22 Revision 1a. Please submit public comments by February 14, 2022. 

NIST is releasing the draft of a major revision to Special Publication (SP) 800-160 Volume 1, Engineering Trustworthy Secure Systems, which is available for comment through February 25, 2022.

Draft NISTIR 8389, “Cybersecurity Considerations for Open Banking Technology and Emerging Standards,” is available for comment through March 3, 2022.

Draft NISTIR 8403, “Blockchain for Access Control Systems,” is open for comment through February 7, 2022.

The National Initiative for Cybersecurity Education (NICE) has released a second draft of NISTIR 8355, NICE Framework Competencies: Assessing Learners for Cybersecurity Work. 

NIST announces the release of a major update to Special Publication (SP) 800-160 Volume 2, Revision 1, "Developing Cyber-Resilient Systems: A Systems Security Engineering Approach."

The National Cybersecurity Center of Excellence (NCCoE) has released a new draft project description, Secure IPv6-Only Implementation in the Enterprise.

A draft NIST Cybersecurity White Paper, Combination Frequency Differencing, is now available for public comment.

NIST has released final IoT-specific guidance (NIST Special Publications 800-213 and 800-213A) to federal organizations to support extending their risk management process to the inclusion of IoT devices in federal systems.

Two draft publications on enterprise patch management are available for public comment through January 10, 2022: Draft SP 800-40 Rev. 4 and Draft SP 1800-31.

NISTIR 8286A, Identifying and Estimating Cybersecurity Risk for Enterprise Risk Management, provides an in-depth discussion of the concepts introduced in NISTIR 8286, Integrating Cybersecurity and Enterprise Risk Management (ERM).

A second public draft of Special Publication (SP) 800-161 Revision 1, "Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations," is open for comment through December 10, 2021.

The National Cybersecurity Center of Excellence (NCCoE) has released three new draft reports on hardware-enabled security and trusted cloud for public comment.

Draft Special Publication (SP) 800-108 Revision 1, "Recommendation for Key Derivation Using Pseudorandom Functions," is available for public comment through January 18, 2022.