Search CSRC

Recent Updates June 30, 2026: NIST SP 800-18r2 (Revision 2), Developing Security, Privacy, and Cybersecurity Supply Chain Risk Management Plans for Systems, has been finalized and is now available. This revision broadens the scope of system planning, aligns plan development with the RMF steps and tasks, and emphasizes the use of machine-readable data formats for automated data collection to support risk management decisions throughout the system life cycle. August 27, 2025: In response to Executive Order 14306, NIST SP 800-53 Release 5.2.0 has been finalized and is now available on...

Abstract:

Abstract: This Quick-Start Guide gives an overview of creating and using organizational profiles for NIST CSF 2.0. An Organizational Profile describes an organization’s current and/or target cybersecurity posture in terms of cybersecurity outcomes from the Cybersecurity Framework (CSF) Core. Organizational Pr...

Abstract: Informative References identify relationships between elements of different source documents and can be consumed in human- or machine-readable formats. For example, within the CSF 2.0, each informative reference indicates one or more parts of another document in which readers can find additional inf...

Abstract: This Quick-Start Guide (QSG) draws on concepts and practices from enterprise risk management, cybersecurity risk management, and workforce management to help organizations improve communication about cybersecurity risks and to plan and implement workforce decisions based upon risk reality and planne...

Abstract: Use the CSF to Improve Your C-SCRM Processes. The CSF can help an organization become a smart acquirer and supplier of technology products and services. This guide focuses on two ways the CSF can help you: 1) Use the CSF’s GV.SC Category to establish and operate a C-SCRM capability. 2) Define and co...

Abstract: This Quick-Start Guide describes how to apply the CSF 2.0 Tiers. CSF Tiers can be applied to CSF Organizational Profiles to characterize the rigor of an organization’s cybersecurity risk governance and management outcomes. This can help provide context on how an organization views cybersecurity risk...

Abstract: This guide provides an introduction to using the NIST Cybersecurity Framework (CSF) 2.0 for planning and integrating an enterprise-wide process for integrating cybersecurity risk management information, as a subset of information and communications technology risk management, into enterprise risk ma...

Abstract: This guide provides small-to-medium sized businesses (SMB), specifically those who have modest or no cybersecurity plans in place, with considerations to kick-start their cybersecurity risk management strategy by using the NIST Cybersecurity Framework (CSF) 2.0. The guide also can assist other relat...

Abstract: This brief report presents a high-level overview of the CSF 2.0 and provides links to relevant resources such as the CSF 2.0 specification and supporting Quick-Start Guides.

Journal: Digital Investigation Abstract: Any investigation can have a digital dimension, often involving information from multiple data sources, organizations and jurisdictions. Existing approaches to representing and exchanging cyber-investigation information are inadequate, particularly when combining data sources from numerous organizat...

Abstract: The objective of this document is to provide test requirements and test assertions that could be used to validate the compliance/conformance of two PIV components: PIV middleware and PIV card application with the specification in NIST SP 800-73-3, Interfaces for Personal Identity Verification.

Abstract: The objective of this document [SP 800-85A-1] is to provide test requirements and test assertions that could be used to validate the compliance/conformance of two PIV components PIV middleware and PIV card application with the specifications in NIST SP 800-73-2.

Abstract: This document, Special Publication 800-76, is a companion document to FIPS 201, Personal Identity Verification (PIV) of Federal Employees and Contractors. It describes technical acquisition and formatting specifications for the biometric credentials of the PIV system, including the PIV Card itself....

Abstract: This document provides derived test requirements and test assertions for generating conformance tests for the following classes of specification in SP 800-73: (a) End-Point Client-Application Programming Interface (Chapter 6 of SP 800-73). (b) End-Point PIV Card Application Card Command Interface (C...

Abstract: NIST Special Publication 800-68 has been created to assist IT professionals, in particularly Windows XP system administrators and information security personnel, in effectively securing Windows XP systems. It discusses Windows XP and various application security settings in technical detail. The gui...

Abstract: This document specifies the test plan, processes, derived test requirements, and detailed test assertions for testing the following: (a)PIV middleware (client application API conformance) (b)PIV on-card application (for conformance to card application card command interface) (c)PIV Data objects repr...

Journal: ACM Transactions on Information and System Security (TISSEC) Abstract: In this article we propose a standard for role-based access control (RBAC). Although RBAC models have received broad support as a generalized approach to access control, and are well recognized for their many advantages in performing large-scale authorization management, no single authoritative defi...

Conference: Third ACM Workshop on Role-Based Access Control (RBAC '98) Abstract: Role Based Access Control (RBAC), an access control mechanism, reduces the cost of administering access control policies as well as making the process less error-prone. The Admin Tool developed for the NIST RBAC Model manages user/role and role/role relationships stored in the RBAC Database. This pa...

NIST has published Internal Report (IR) 8621, NIST Workshop on SI Incident Management, on stakeholder perspectives and key findings from the May 14, 2026, workshop. Motivated by the federal directive "America's AI Action Plan", the report examines the unique challenges of managing super intelligence (SI) incidents, including cybersecurity attacks that target SI systems as well as harms that arise from misuse, malfunction, or unintended actions.

NIST has released a draft revision of Special Publication (SP) 800-185, SHA-3 Derived Functions: cSHAKE, KMAC, TupleHash, and ParallelHash. The public comment period is open through December 7, 2026.

NIST Interagency Report (IR) 8587 is now available: "Protecting Tokens and Assertions from Forgery, Theft, and Misuse: Implementation Recommendations for Agencies and Cloud Service Providers."

To help strengthen the security and resilience of global supply chains, the NIST National Cybersecurity Center of Excellence (NCCoE) has released the finalized version of NIST Internal Report 8536, Supply Chain Traceability Principles: A Manufacturing Meta-Framework, which provides an interoperable, industry-neutral framework to securely exchange and verify traceability information across supply chains while enabling organizations to continue using existing industry standards.

NIST has published Internal Report (IR) 8214C, NIST First Call for Multi-Party Threshold Schemes.

The initial public draft of NIST IR 8587, "Protecting Tokens and Assertions from Forgery, Theft, and Misuse: Implementation Recommendations for Agencies and Cloud Service Providers," is now available for public comment through January 30, 2026.