Drafts Open for Comment

Many of NIST's cybersecurity and privacy publications are posted as drafts for public comment. Comment periods are still open for the following publications. Select the publication title to access downloads, related content, and instructions for submitting comments. Your thoughtful reviews and comments are greatly appreciated and help us to improve our standards and guidance.

Also see a complete list of public drafts that includes those whose comment periods have closed.

Comments Due	Series	Number	Title Publications
09/30/2023	AI	100-2 E2023	Comments Due: 09/30/2023 Adversarial Machine Learning: A Taxonomy and Terminology of Attacks and Mitigations AI 100-2 E2023 Adversarial Machine Learning: A Taxonomy and Terminology of Attacks and Mitigations This NIST report on artificial intelligence (AI) develops a taxonomy of attacks and mitigations and defines terminology in the field of adversarial machine learning (AML). Taken together, the taxonomy and terminology are meant to inform other standards and future practice guides for assessing and...
10/06/2023	IR	8477	Comments Due: 10/06/2023 Mapping Relationships Between Documentary Standards, Regulations, Frameworks, and Guidelines: Developing Cybersecurity and Privacy Concept Mappings IR 8477 Mapping Relationships Between Documentary Standards, Regulations, Frameworks, and Guidelines: Developing Cybersecurity and Privacy Concept Mappings Understanding how the elements of diverse sources of cybersecurity and privacy content are related to each other is an ongoing challenge for people in nearly every organization. This document explains NIST’s proposed approach for identifying and documenting relationships between concepts such as...
10/09/2023	SP	1800-35	Comments Due: 10/09/2023 Implementing a Zero Trust Architecture SP 1800-35 Implementing a Zero Trust Architecture The Zero Trust Architecture (ZTA) team at NIST's National Cybersecurity Center of Excellence (NCCoE) has published the third version of volume D of a preliminary draft practice guide titled "Implementing a Zero Trust Architecture” and is seeking the public's comments on its contents.This guide...
10/13/2023	SP	800-204D	Comments Due: 10/13/2023 Strategies for the Integration of Software Supply Chain Security in DevSecOps CI/CD pipelines SP 800-204D Strategies for the Integration of Software Supply Chain Security in DevSecOps CI/CD pipelines Cloud-native applications are made up of multiple loosely coupled components called microservices. This class of applications is generally developed through an agile software development life cycle (SDLC) paradigm called DevSecOps, which uses flow processes called continuous integration/continuous...
10/16/2023	IR	8472	Comments Due: 10/16/2023 Non-Fungible Token Security IR 8472 Non-Fungible Token Security Non-fungible token (NFT) technology provides a mechanism to sell and exchange both virtual and physical assets on a blockchain. While NFTs are most often used for autographing digital assets (associating one’s name with a digital object), they utilize a strong cryptographic foundation that may...
10/27/2023	SP	800-50 Rev. 1	Comments Due: 10/27/2023 Building a Cybersecurity and Privacy Learning Program SP 800-50 Rev. 1 Building a Cybersecurity and Privacy Learning Program Cybersecurity awareness and training resources, methodologies, and requirements have evolved since NIST SP 800-50 was introduced in 2003. New guidance from the National Defense Authorization Act (NDAA) for FY2021 and the Cybersecurity Enhancement Act of 2014 have informed this revision. In addition,...
10/31/2023	SP	1800-35	Comments Due: 10/31/2023 Implementing a Zero Trust Architecture (Volume E, Risk and Compliance Management) SP 1800-35 Implementing a Zero Trust Architecture (Volume E, Risk and Compliance Management) The Zero Trust Architecture (ZTA) team at NIST's National Cybersecurity Center of Excellence (NCCoE) has released the second version of volume E of a preliminary draft practice guide titled Implementing a Zero Trust Architecture and is seeking the public's comments on the contents. This guide...
10/31/2023	IR	8481	Comments Due: 10/31/2023 Cybersecurity for Research: Findings and Possible Paths Forward IR 8481 Cybersecurity for Research: Findings and Possible Paths Forward To support implementation of the research cybersecurity effort detailed in Section 10229 of the CHIPS and Science Act, NIST is leading an initiative to disseminate and make publicly available resources to help qualifying institutions of higher education identify, assess, manage, and reduce...
11/04/2023	CSWP	29	Comments Due: 11/04/2023 The NIST Cybersecurity Framework 2.0 CSWP 29 The NIST Cybersecurity Framework 2.0 This is the public draft of the NIST Cybersecurity Framework (CSF or Framework) 2.0.The Framework has been used widely to reduce cybersecurity risks since its initial publication in 2014. Many organizations have told NIST that CSF 1.1 remains an effective framework for addressing cybersecurity...
11/04/2023	Other		Comments Due: 11/04/2023 Discussion Draft of the NIST Cybersecurity Framework 2.0 Core with Implementation Examples Other Discussion Draft of the NIST Cybersecurity Framework 2.0 Core with Implementation Examples Discussion Draft of the NIST Cybersecurity Framework 2.0 Core with Implementation Examples This is the discussion draft of Implementation Examples (Examples) for the NIST Cybersecurity Framework (CSF or Framework) 2.0. It complements and is based on the Core from the NIST CSF 2.0 Public Draft, also open for comment. NIST seeks input on: concrete improvements to the Examples;whether the...
11/10/2023	SP	1800-36	Comments Due: 11/10/2023 Trusted Internet of Things (IoT) Device Network-Layer Onboarding and Lifecycle Management: Enhancing Internet Protocol-Based IoT Device and Network Security SP 1800-36 Trusted Internet of Things (IoT) Device Network-Layer Onboarding and Lifecycle Management: Enhancing Internet Protocol-Based IoT Device and Network Security The NIST National Cybersecurity Center of Excellence (NCCoE) has released the second preliminary drafts of volumes A and D of NIST SP 1800-36, Trusted Internet of Things (IoT) Device Network-Layer Onboarding and Lifecycle Management. The comment period is open until November 10, 2023.About the...
11/15/2023	SP	800-73-5	Comments Due: 11/15/2023 Interfaces for Personal Identity Verification: Part 2 – PIV Card Application Card Command Interface SP 800-73-5 Interfaces for Personal Identity Verification: Part 2 – PIV Card Application Card Command Interface In January 2022, NIST revised Federal Information Processing Standard (FIPS) 201, which establishes standards for the use of Personal Identity Verification (PIV) Credentials – including the credentials on PIV Cards. NIST Special Publication (SP) 800-73-5: Parts 1–3 and SP 800-78-5 have subsequently...
11/15/2023	SP	800-73-5	Comments Due: 11/15/2023 Interfaces for Personal Identity Verification: Part 3 – PIV Client Application Programming Interface SP 800-73-5 Interfaces for Personal Identity Verification: Part 3 – PIV Client Application Programming Interface In January 2022, NIST revised Federal Information Processing Standard (FIPS) 201, which establishes standards for the use of Personal Identity Verification (PIV) Credentials – including the credentials on PIV Cards. NIST Special Publication (SP) 800-73-5: Parts 1–3 and SP 800-78-5 have subsequently...
11/15/2023	SP	800-73-5	Comments Due: 11/15/2023 Interfaces for Personal Identity Verification: Part 1 – PIV Card Application Namespace, Data Model and Representation SP 800-73-5 Interfaces for Personal Identity Verification: Part 1 – PIV Card Application Namespace, Data Model and Representation In January 2022, NIST revised Federal Information Processing Standard (FIPS) 201, which establishes standards for the use of Personal Identity Verification (PIV) Credentials – including the credentials on PIV Cards. NIST Special Publication (SP) 800-73-5: Parts 1–3 and SP 800-78-5 have subsequently...
11/15/2023	SP	800-78-5	Comments Due: 11/15/2023 Cryptographic Algorithms and Key Sizes for Personal Identity Verification SP 800-78-5 Cryptographic Algorithms and Key Sizes for Personal Identity Verification In January 2022, NIST revised Federal Information Processing Standard (FIPS) 201, which establishes standards for the use of Personal Identity Verification (PIV) Credentials – including the credentials on PIV Cards. NIST Special Publication (SP) 800-73-5: Parts 1–3 and SP 800-78-5 have subsequently...
11/22/2023	FIPS	203	Comments Due: 11/22/2023 Module-Lattice-Based Key-Encapsulation Mechanism Standard FIPS 203 Module-Lattice-Based Key-Encapsulation Mechanism Standard NIST requests comments on three draft Federal Information Processing Standards (FIPS):FIPS 203, Module-Lattice-Based Key-Encapsulation Mechanism StandardFIPS 204, Module-Lattice-Based Digital Signature Standard FIPS 205, Stateless Hash-Based Digital Signature StandardThese proposed standards specify...
11/22/2023	FIPS	205	Comments Due: 11/22/2023 Stateless Hash-Based Digital Signature Standard FIPS 205 Stateless Hash-Based Digital Signature Standard NIST requests comments on three draft Federal Information Processing Standards (FIPS):FIPS 203, Module-Lattice-Based Key-Encapsulation Mechanism StandardFIPS 204, Module-Lattice-Based Digital Signature Standard FIPS 205, Stateless Hash-Based Digital Signature StandardThese proposed standards specify...
11/22/2023	FIPS	204	Comments Due: 11/22/2023 Module-Lattice-Based Digital Signature Standard FIPS 204 Module-Lattice-Based Digital Signature Standard NIST requests comments on three draft Federal Information Processing Standards (FIPS):FIPS 203, Module-Lattice-Based Key-Encapsulation Mechanism StandardFIPS 204, Module-Lattice-Based Digital Signature Standard FIPS 205, Stateless Hash-Based Digital Signature StandardThese proposed standards specify...

Current Publications

NIST Series Pubs
- Final Pubs
- Drafts Open for Comment
- Drafts (all)
- View By Series
  - FIPS (standards)
  - SP 800 (guidance)
  - SP 1800 (practice guides)
  - SP (all subseries)
  - IR (interagency/internal reports)
  - CSWP (cybersecurity white papers)
  - ITL Bulletins
Other Pubs