Search CSRC

NIST announces the release of NIST Interagency Report (NISTIR) 7946, CVSS Implementation Guidance. This Interagency Report provides guidance to individuals scoring IT vulnerabilities using the Common Vulnerability Scoring System (CVSS) Version 2.0 scoring metrics.

NIST announces the final release of Special Publication (SP) 800-162, Guide to Attribute Based Access Control (ABAC) Definition and Considerations. ABAC is a logical access control methodology where authorization to perform a set of operations is determined by evaluating attributes ...

NIST announces the completion of Special Publication (SP) 800-130, A Framework for Designing Cryptographic Key Management Systems. This publication contains a description of the topics to be considered and the documentation requirements ...

Draft Special Publication 800-73-4, Interfaces for Personal Identity Verification, and Draft Special Publication 800-78-4, Cryptographic Algorithms and Key Sizes for Personal Identity Verification, are now available

NIST announces the release of Special Publication 800-107, Revision 1, Recommendation for Using Approved Hash Algorithms. In this revision, the security properties of SHA-512/224 and SHA-512/256 are addressed, the discussion of the security of HMAC

The NIST Computer Security Division is pleased to release the Revised Draft Federal Information Processing Standard (FIPS) 201-2, Personal Identity Verification of Federal Employees and Contractors. The Revised Draft FIPS 201-2 reflects the disposition of comments ...

NIST announces the final release of Special Publication (SP) 800-153, Guidelines for Securing Wireless Local Area Networks (WLANs). The purpose of this publication is to provide organizations with recommendations for improving the security configuration and monitoring ...

NIST announces the public comment release of draft Special Publication (SP) 800-61 Revision 2, Computer Security Incident Handling Guide. It seeks to assist organizations in mitigating the risks from computer security incidents by providing practical guidelines on responding ...

Researchers have recently announced they have discovered a new way to break a number of cryptographic hash algorithms. Click here to read NIST's brief comments on recent cryptanalytic attacks on secure hashing functions and the continued security provided by SHA-1.

NIST has established the NIST Personal Identity Verification Validation Program (NPIVP) to validate Personal Identity Verification (PIV) components required by Federal Information Processing Standard (FIPS) 201. The objectives of the NPIVP program are: to validate the compliance/conformance of PIV card applications with the specifications in NIST SP 800-73; and to provides the assurance that PIV card applications that have been validated by NPIVP are interoperable. All of the tests under NPIVP are handled by third-party test facilities that are accredited under the Cryptographic and...

NIST has defined cloud computing in NIST SP 800-145 document as a model for enabling ubiquitous, convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, servers, storage, applications, and services) that can be rapidly provisioned and released with minimal management effort or service provider interaction. For more than a decade, cloud computing has offered cost savings both in terms of capital expenses and operational expenses, while leveraging leading-edge technologies to meet the information processing needs of users in the public and...

Recent Updates October 20, 2026: SP 800-53 Control Overlays for Securing AI Systems (COSAiS) has been renamed to SP 800-53 Control Overlays for Super Intelligence Systems (COSIS) per the September 29, 2026, Executive Order on Inaugurating the Era of Super Intelligence. Executive departments and agencies shall use "Super Intelligence" and "SI" in place of "Artificial Intelligence" and "AI". Previously issued documents and publications have not been altered. January 8, 2026: To facilitate discussion at the Cyber AI Profile Workshop #2 on January 14, 2026, an annotated outline...

WEBCAST ONLY – Registration is not required to view the webcast, but registered viewers will receive a reminder and updates prior to the webcast. This webcast will provide a 2-hour overview and deep dive of the recently released NIST Special Publication (SP) 800-37, Revision 2, Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy. This webcast will feature an introduction by Dr. Ron Ross, NIST Fellow, an overview of the updates in SP 800-37, Revision 2, followed by a deep dive into the Steps and Tasks of the RMF by Kelley...

WEBCAST ONLY – Registration is not required to view the webcast, but registered viewers will receive a reminder and updates prior to the webcast. This webcast will provide a 2-hour overview and deep dive of the recently released NIST Special Publication (SP) 800-37, Revision 2, Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy. This webcast will feature an introduction by Dr. Ron Ross, NIST Fellow, an overview of the updates in SP 800-37, Revision 2, followed by a deep dive into the Steps and Tasks of the RMF by Kelley...

Click on the image to access the 2nd public draft of Special Publication (SP) 800-161, Revision 1, Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations (released October 28, 2021). PRESENTATION for WORKSHOP (.PDF) Event Description: The NIST Cybersecurity Supply Chain Risk Management Team is hosting a webinar to provide an overview of the changes made in its 2nd public draft of Special Publication 800 – 161, Revision 1, Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations. NIST seeks to engage stakeholders to provide clarity,...

A virtual workshop on February 1, 2023 will introduce the initial public drafts of two NIST Special Publications (SPs): NIST SP 800-157r1 (Revision 1), Guidelines for Derived Personal Identity Verification (PIV) Credentials NIST SP 800-217, Guidelines for PIV Federation These two draft SPs complement FIPS 201-3, which defines the requirements and characteristics of government-wide interoperable identity credentials used by federal employees and contractors. For workshop details and registration instructions, visit the workshop homepage.

The National Institute of Standards and Technology (NIST) will be hosting a webinar to introduce two recently published Public Draft Special Publications (SPs): The 3-part Drafts of SP 800-73 Revision 5, Interfaces for Personal Identity Verification (PIV) and Draft SP 800-78 Revision 5, Cryptographic Algorithms and Key Sizes for Personal Identity Verification. These publications are complements to FIPS 201-3, which defines the requirements and characteristics of government-wide interoperable identity credentials used by federal employees and contractors. The workshop will discuss the...

WPEC 2024 (September 24th–26th) is a virtual workshop, free to attend, and with a call for talk proposals. Featured topics: Private-Set Intersection (PSI); Fully-Homomorphic Encryption (FHE); Secure Multi-Party Computation (MPC); Zero-Knowledge Proofs (ZKP). WPEC 2024 fosters Privacy-Enhancing Cryptography (PEC), hosting The First PSI Day, and various talks on FHE, MPC and ZKP. The workshop slides and videos are available (check the schedule of each day, or the list of abstracts below) Useful links: Videos of the 6 sessions (NIST Video Gallery); Workshop Call (PDF file); Submission Form...

Quick links (MPTS 2025): Call for talks (PDF file); Talk proposal form (PDF file); Registration page (ZoomGov); Workshop dates and place: November 17–20, fully virtual. Attendance: Attendance is free, but requires online registration Daily schedule: To be announced in late September 2025 Call for talks (explaining two types of talks): Regular talk: Submit by September 10 (general contribution talk) "Preview talk": Submit by November 03 (in scope of the Threshold Call), aligned with a "Preview Writeup" (LaTeX template available: .ZIP, .PDF) Introduction The NIST...

Conference: Human Computer Interaction International 2021 Abstract: Organizations use phishing training exercises to help employees defend against the phishing threats that get through automatic email filters, reducing potential compromise of information security and privacy for both the individual and their organization. These exercises use fake and realistic phish...

Conference: 11th International Conference on Cryptology (INDOCRYPT 2010) Abstract: In this paper we propose a new sequential mode of operation – the Fast wide pipe or FWP for short – to hash messages of arbitrary length. The mode is shown to be (1) preimage-resistance preserving, (2) collision-resistance-preserving and, most importantly, (3) indifferentiable from a random oracle u...

Conference: 12th Annual International Cryptology Conference (CRYPTO '92) Abstract: NIST Received comments from 109 separate government agencies, companies, and private individuals concerning the proposed Digital Signature Standard. Both positive and negative comments were received. However the number of negative comments was significantly larger than normally received for a propos...

Conference: The 6th IEEE Intl Conference on Trust, Privacy and Security in Intelligent Systems, and Application Abstract: This paper investigates the application of large language models (LLMs) for the automated translation and information extraction of access control policies from a natural language source. Prior research in this domain have predominantly relied on manual methods, traditional natural language processi...

Journal: Computer Abstract: Combination coverage based testing supplements basic structural coverage based test selection. This provides a sound test engineering method with defensible, quantitative measures of test completeness.

Journal: Computer Abstract: Testing is the most commonly used approach for software assurance, yet it remains as much judgment and art as science. We suggest that structural coverage measures must be supplemented with measures of input space coverage, providing a means of verifying that an adequate input model has been defined...