Search CSRC

Type: Presentation

Type: Presentation

Type: Presentation

Type: Presentation

Type: Presentation

A: All or nearly all failures involve only 1 to 6 factors The key insight underlying combinatorial testing’s effectiveness resulted from a series of studies by NIST from 1999 to 2004. NIST research showed that most software bugs and failures are caused by one or two parameters, with progressively fewer by three or more. That is, they were only revealed when multiple conditions were true. For example, a 2-way interaction fault could be "altitude = 0 AND volume < 2.2". So testing all 2-way combinations of parameter values could detect this problem. A method called "pairwise testing" has been...

SEQUENCE COVERING The sequence covering array construct described below was introduced in: D.R. Kuhn, J.M. Higdon, J.F. Lawrence, R.N. Kacker and Y. Lei, "Combinatorial Methods for Event Sequence Testing", First International Workshop on Combinatorial Testing, in Proceedings of the IEEE Fifth International Conference on Software, Testing, Verification and Validation (ICST 2012), Montreal, Quebec, Canada, April 17-21, 2012, pp. 601-609. Preprint The notion of sequence covering has been extended to ordered combination coverage, with a theorem on necessary and sufficient conditions for...

This research grew out of our 2001 paper on failures in medical device software, which found that the failures were triggered by only 1 to 4 variables interacting. Surprisingly, although "pairwise" testing had been popular for many years, no one had looked at the actual distribution of failures by number of interacting factors. We continued this work and published other papers finding that all, or nearly all, software failures involve interactions among a small number of variables, no more than 6, in thousands of failure reports. Below are some of our research areas. If you'd like to find out...

FY 2026 ISPAB BOARD MEMBERS Steven Lipner, Former Chairperson Executive Director SAFECode Term Expired May 2026 Edna Conway CEO & Founder EMC Advisors Term Expires January 2030 Anne Dames Distinguished Engineer International Business Machines (IBM) Term Expires November 2028 Michael Duffy Federal Chief Information Security Officer (CISO), Acting Office of Management and Budget With continuing association with the Cybersecurity and Infrastructure Security Agency (CISA) and the Department of Homeland Security (DHS) Term Expires January 2028 Bill English Chief Information Officer (CIO) /...

Upcoming ISPAB Meetings: No meetings are scheduled at this time. Updates will be provided as they become available. Stay in the Know! Sign up for new meeting notifications or reach out to the ISPAB team directly via email. ARCHIVE: Meetings Held in 2026 January 21-22, 2026 (Hybrid) Federal Register Notice Announcing Meeting Agenda Meeting Minutes Additional Details on the January 2026 Event Page Meetings Held in 2025 July 16-17, 2025 (Virtual) Federal Register Notice Announcing Meeting Agenda Meeting Minutes Link to July 2025 Event...

Topics of Interest In accordance with 15 U.S.C. 278g-4, the duties of the Information Security and Privacy Advisory Board are to identify emerging managerial, technical, administrative, and physical safeguard issues relative to information security and privacy. The focus of the Board's work for FY 2015-2016 includes the following areas: Quantum (physics, pre-shared keys, quantum key distribution, block chains) Cybersecurity Office of Management and Budget OMB Circular A-130 Revised Cyber-marathon CyberStats Measuring outcomes for cybersecurity Cybersecurity protections in...

Sample Certificates and CRL from RFC 5280 certificate/CRL Corresponding section of RFC5280 RSA self-signed certificate C.1 RSA Self-Signed Certificate Section C.1 contains an annotated hex dump of a "self-signed" certificate issued by a CA whose distinguished name is cn=Example CA,dc=example,dc=com. The certificate contains an RSA public key, and is signed by the corresponding RSA private key. End Entity Certificate Using RSA C.2 End Entity Certificate Using RSA Section C.2 contains an annotated hex dump of an end...

The Online Informative Reference Catalog contains all the Reference Data—Informative References and Derived Relationship Mappings (DRMs)—for the National Online Informative References (OLIR) Program. All Reference Data in the Informative Reference Catalog has been validated against the requirements of NIST Interagency Report (IR) 8278A Rev. 1 (Draft), National Online Informative References (OLIR) Program: Submission Guidance for OLIR Developers. If interested in participating in the OLIR program, please refer to the Informative Reference submission page. The OLIR Catalog provides an interface...

The Derived Relationship Mapping (DRMs) Analysis Tool provides Users the ability to generate DRMs for Reference Documents with a Focal Document of the Users’ choice. The DRMs are non-authoritative and represent a starting point when attempting to compare Reference Documents. Refer to Sections 3.3 – 3.6 of NISTIR 8278, National Online Informative References (OLIR) Program: Program Overview, Benefits and Uses for additional guidance around understanding and utilizing the tool. After creating a Display Report, Users can download the report in either a comma-separated value (CSV) file format or...

For the most up to date macOS security recommendations, please visit the mSCP GitHub page listed below, which is supported by SP-800-219r1, Apple Security Guidance: macOS Security Compliance Project. https://github.com/usnistgov/macos_security

Base EaaS Architecture Without A Decentralized Root Of Trust In this example, the client system is equipped with a Hardware Root of Trust (HRT) device. Examples of HRT devices are the Trusted Platform Module, Intel® Identity Protection Technology, and the ARM® TrustZone technology. The client system runs a dedicated software application capable of interfacing with the local HRT device on the one end and with the EaaS on the other end. The application communicates with the entropy server using standard plaintext protocols, such as HTTP. The dedicated application initiates the procedure for...

In order to perform FIPS 140 conformance testing, a laboratory must become an accredited CST laboratory under the National Voluntary Laboratory Accreditation Program (NVLAP). A list of current labs may be found by visiting National Voluntary Laboratory Accreditation Program (NVLAP) / Directory Search and under the "Program" drop-down select “ITST: Cryptographic and Security Testing”. Module testing results produced by an accredited CST laboratory can then be submitted to the CMVP in order to seek FIPS 140 module validation. CST labs and NIST each charge fees for their respective parts of the...

All questions regarding the implementation and/or use of any validated cryptographic module should first be directed to the appropriate VENDOR point of contact (listed for each entry). SEARCH our database of validated modules. The validated modules search provides access to the official validation information of all cryptographic modules that have been tested and validated under the Cryptographic Module Validation Program as meeting requirements for FIPS 140-1, FIPS 140-2, and FIPS 140-3. The search results list all issued validation certificates that meet the supplied search criteria and...

DISCLAIMER: The Cryptographic Module Validation Program (CMVP) Modules In Process and Implementation Under Test (IUT) Lists are provided for information purposes only. Participation on the list is voluntary and is a joint decision by the vendor and Cryptographic Security and Testing Laboratory (CSTL). Modules are listed alphabetically by vendor name. Posting on the list does not imply guarantee of final validation. The status / state of each cryptographic module in the process is identified below with the current action in parenthesis. Modules In Process List Cost Recovery (NIST Billing...

CMVP FIPS 140-2 Management Manual (updated 03-10-2023) The purpose of the CMVP Management Manual is to provide effective guidance for the management of the CMVP, and the conduct of activities necessary to ensure that the standards are fully met. The CMVP Management Manual describes the CMVP process and is applicable to the CMVP Validation Authorities, the CST Laboratories, and the vendors who participate in the program. Consumers who procure validated cryptographic modules may also be interested in the contents of this manual. This manual outlines the management activities and specific...

ARCHIVED PROJECT: This project is no longer being supported. The content is no longer being updated, and the information may be outdated. The following RBAC case studies and experience reports may be useful in planning for RBAC implementations. We will add to this collection as more reports become available. (Please note that the authors and organizations below are not affiliated with NIST or any other agency of the US Government, unless otherwise noted, and NIST cannot endorse or comment on these publications.) Submit comments or suggestions on this collection to the Project...

Join the NIST Risk Management Framework (FISMA Implementation Project) Email List NIST will inform our stakeholders immediately when updates to the emerging set of security standards and guidelines are available, or when there are important project-related events scheduled. Please note that only mailing list administrators are able to send messages on this email list. Join the NIST RMF Email List Troubleshooting If your organization's firewall is preventing you from joining via the NIST Risk Management Framework Email List, please send an email to sec-cert@nist.gov. A NIST...

ARCHIVED PROJECT: This project is no longer being supported. The content is no longer being updated, and the information may be outdated. The Program Review for Information Security Assistance (PRISMA) project was last updated in 2007; NIST Interagency Report (IR) 7358 and the corresponding PRISMA tool continue to serve as useful resources for high-level guidance and as a general framework, but may not be fully consistent with changes to requirements, standards and guidelines for securing systems. The PRISMA review is based upon five levels of maturity: policy, procedures,...

ARCHIVED: The NIST HIPAA Security Rule Toolkit is no longer supported, and is provided here only for historical purposes. HIPAA Security Rule Toolkit The NIST HIPAA Security Toolkit Application is intended to help organizations better understand the requirements of the HIPAA Security Rule, implement those requirements, and assess those implementations in their operational environment. Target users include, but are not limited to, HIPAA covered entities, business associates, and other organizations such as those providing HIPAA Security Rule implementation, assessment, and compliance...

The United States Government Configuration Baseline (USGCB) - Disclaimer Disclaimer for Microsoft Content Do not attempt to implement any of the settings without first testing them in a non-operational environment. These recommendations have only been tested on Windows 7 Ultimate 32-bit, Windows 7 Ultimate 64-bit, Windows 7 Enterprise x86, and Windows 7 Enterprise x64. These settings may be applicable to other Windows systems and service packs; however, NIST has not tested other Windows based systems with these settings. Please see the National Checklist Program (NCP) website for...