Search CSRC

This workshop will offer participants the opportunity to: Share and learn about Cybersecurity Framework users’ experiences that will help others in making effective use of the Framework, Discuss and share their views about proposed updates to the Framework to assist NIST in finalizing Version 1.1 later in 2017, and Learn about new Framework-related policy issues and the progress of others' technical work.

NIST and the Department of Health and Human Services (HHS), Office for Civil Rights (OCR) are pleased to co-host the 10th annual conference, Safeguarding Health Information: Building Assurance through HIPAA Security, on September 5-6, 2017 at the Hyatt Regency, Washington, D.C. The conference will explore the current healthcare cybersecurity landscape and the Health Insurance Portability and Accountability Act (HIPAA) Security Rule. This event will highlight the present state of healthcare cybersecurity, and practical strategies, tips and techniques for implementing the HIPAA Security Rule....

On October 19th, 2017, NIST is hosting the IoT Cybersecurity Colloquium to convene stakeholders from across government, industry, international bodies, and academia. Our goal is to better understand the concerns and threats associated with the rapidly broadening landscape of connected devices, known as the Internet of Things (IoT). Registration closes on October 12th! Join our Twitter Chat using #IoTSecurityNIST

As part of an ongoing series of workshops on privacy engineering and risk management, NIST will host a public workshop on June 5th in Gaithersburg, Maryland on privacy risk assessments. This workshop builds off the concepts introduced in January 2017 in NIST Internal Report 8062 (An Introduction to Privacy Engineering and Risk Management in Federal Systems). Participants will discuss the function of privacy risk assessments as a prerequisite for conducting privacy risk management, and the role of privacy risk models. This discussion will assist NIST in the development of a body of guidance on...

On April 2, 2017, the Quest Baldrige Cybersecurity Pre-Conference Workshop will educate participants how to better assess organizational cybersecurity. NIST developed the Baldrige Cybersecurity Excellence Builder self-assessment tool based on the Cybersecurity Framework as well as the Baldrige National Performance Excellence Program. The interactive workshop will help participants use the Baldrige Cybersecurity Excellence Builder to: assess the effectiveness and efficiency of cybersecurity practices, assess cybersecurity results, and identify priorities for improving cybersecurity risk...

Practical, interactive workshop on using the Baldrige Cybersecurity Excellence Builder (BCEB) to assess the effectiveness and efficiency of your organization’s cybersecurity risk management program assess the cybersecurity results you achieve identify your priorities for improving your cybersecurity risk management efforts The Baldrige Cybersecurity Excellence Builder is a voluntary self-assessment tool based on the Cybersecurity Framework, managed by NIST’s Applied Cybersecurity Division, and the Baldrige Excellence Framework, compiled by the Baldrige Performance Excellence Program at...

NIST and the Department of Health and Human Services (HHS), Office for Civil Rights (OCR) are pleased to co-host the 11th annual conference, Safeguarding Health Information: Building Assurance through HIPAA Security, on October 18-19, 2018 at the Hyatt Regency, Washington, D.C. The conference will explore the current healthcare cybersecurity landscape and the Health Insurance Portability and Accountability Act (HIPAA) Security Rule. This event will highlight the present state of healthcare cybersecurity, and practical strategies, tips and techniques for implementing the HIPAA Security Rule....

This workshop will discuss substantive public comments, including open issues) on a draft report about actions to address automated and distributed threats to the digital ecosystem as part of the activity directed by Executive Order 13800, “Strengthening the Cybersecurity of Federal Networks and Critical Infrastructure.” In this workshop, the Departments of Commerce and Homeland Security seek to engage all interested stakeholders—including private industry, academia, civil society, and other security experts—on this draft report, its characterization of the threat landscape, the goals laid...

The National Institute of Standards and Technology is hosting the first of a new series of workshops focusing on the Open Security Controls Assessment Language (OSCAL). OSCAL provides a standardized set of XML-, JSON- and YAML-based formats for use by authors and maintainers of security and privacy control catalogs, control baselines, and system security plans. These formats provide for the automated exchange of control-related information between tools and facilitates the automated assessment of security and privacy controls implemented in an information system. We are seeking attendees who...

The Software and Supply Chain Assurance Forum (SSCA) provides a venue for government, industry, and academic participants from around the world to share their knowledge and expertise regarding software and supply chain risks, effective practices and mitigation strategies, tools and technologies, and any gaps related to the people, processes, or technologies involved. The effort is co-led by the National Institute of Standards and Technology (NIST), the Department of Homeland Security (DHS), the Department of Defense (DoD), and the General Services Administration (GSA). Participants represent a...

NIST is closely monitoring guidance from Federal, State, and local health authorities on the outbreak of COVID-19. To protect the health and safety of NIST employees and the American public they continue to serve, NIST has decided to cancel the May 2020 Advancing Cybersecurity Risk Management conference. For more information on COVID-19, please visit: cdc.gov/covid19. For questions regarding your registration, please contact pauline.truong@nist.gov. We hope you are able to participate in future in-person and virtual NIST cybersecurity risk management events. Building on the 2018 NIST...

On January 22nd-24th, 2020, NIST will host the Identity Management & Access Control in Multiclouds Workshop and Conference. This one-and-a-half day conference will focus on identity management and access control in multi-clouds to mitigate insider threats and return control back to owners of applications and data. Emphasis will be placed on emerging concepts such as zero-trust and service mesh architectures where gaining entry through a firewall or having an IP address does not provide additional privileges. To learn more about this workshop/conference, please visit the NIST Conference events...

The purpose of this workshop is to discuss the National Institute of Standards and Technology’s (NIST’s) proposed approach for helping industry and government improve the security of their DevOps practices. During this workshop, NIST will solicit proposed approaches from the participating organizations and hear from the community about DevSecOps-related topics that NIST could tackle. The findings from the workshop will inform NIST in the creation of new applied guidance to fill any gaps, updates to existing guidance, and potential development of a National Cybersecurity Center of Excellence...

On June 2-3, NIST will host a virtual workshop to enhance the security of the software supply chain and to fulfill the President’s Executive Order (EO) 14028, Improving the Nation’s Cybersecurity, issued May 12, 2021. Among other things, Section 4 of EO 14028 directs the Secretary of Commerce, through NIST, to consult with federal agencies, the private sector, academia, and other stakeholders in identifying standards, tools, best practices, and other guidelines to enhance software supply chain security. Those standards and guidelines will be used by other agencies to govern the federal...

This year’s Multi-Cloud Conference co-hosted by NIST and Tetrate will focus on DevSecOps and ZTA as foundational approaches to development, deployment, and operational phases for achieving high-assurance cloud-native applications. The latest generation of cloud-native applications often consists of a collection of microservices that could be distributed and deployed across a heterogeneous infrastructure (on-premises, public cloud, containerized, running on virtual machines, etc). With the proliferation of DevSecOps, a service mesh has proven to provide the desired bridge between...

On July 2015, the National Strategic Computing Initiative (NSCI) was established to maximize the benefits of High-Performance Computing (HPC) for economic competitiveness and scientific discovery. For HPC systems to deliver their anticipated benefits, their security requirements must be adequately addressed. To that effect, NIST hosted a workshop in September 2016 that brought together stakeholders from industry, academia, and government to gather their perspectives on the state of technology and future directions. As part of that continuing mission, NIST will host a workshop on March 27-28,...

The automotive industry is facing significant challenges from increased cybersecurity risk and adoption of AI and opportunities from rapid technological innovations. To provide assistance to the industry, NIST has started a COI for automotive cybersecurity. This webinar will introduce the members of the COI to projects and research currently active at NIST that are of interest to the community. Participants will also be informed of ways to participate in these projects and research.

Executive Order 13702 established the National Strategic Computing Initiative (NSCI) to maximize the benefits of high-performance computing (HPC) for economic competitiveness and scientific discovery. Security is an essential component of HPC. NIST HPC Security Working Group (WG) has been leading the effort to create a comprehensive and reliable security guidance for HPC systems. As part of the Working Group mission and to reach greater HPC scientific community, NIST, in collaboration with National Science Foundation (NSF), will host the 3rd High-Performance Computing Security Workshop on...

The automotive industry is facing significant challenges from increased cybersecurity risk and adoption of AI and opportunities from rapid technological innovations. This webinar will be the third community of interest call. Angela Smith, technical lead for NIST’s Cybersecurity Supply Chain Risk Management (C-SCRM) will be providing an overview and status of the C-SCRM work effort, and how it’s relevant to the automotive cybersecurity community.

The Information Security and Privacy Advisory Board (ISPAB) is authorized by 15 U.S.C. 278g-4, as amended, and advises the National Institute of Standards and Technology (NIST), the Secretary of Homeland Security (DHS), and the Director of the Office of Management and Budget (OMB) on information security and privacy issues pertaining to Federal government information systems, including through review of proposed standards and guidelines developed by NIST. View and download the Federal Register Notice announcing this meeting.

High-performance computing (HPC) systems provide fundamental computing infrastructure and play a pivotal role in economic competitiveness and scientific discovery. Security is an essential component of HPC. NIST HPC Security Working Group (WG) has been leading the effort to create comprehensive and reliable security guidance for HPC systems. As part of the Working Group mission and to reach the greater HPC scientific community, NIST, in collaboration with the National Science Foundation (NSF), will host the 5th High-Performance Computing Security Workshop on May 7-8, 2025. The workshop aims to...

The Secretary of Commerce has approved three Federal Information Processing Standards (FIPS) for post-quantum cryptography: FIPS 203, 204 and 205.

Draft FIPS 201-3, "Personal Identity Verification (PIV) of Federal Employees and Contractors," is now available for public comment through February 1, 2021.

FIPS 140-3, "Security Requirements for Cryptographic Modules," was approved on March 22, 2019 and announced in the Federal Register on May 1, 2019. FIPS 140-3 supersedes FIPS 140-2.

We recently added a few new features to CSRC's publications section.