Search CSRC

Conference: Second ACM Workshop on Role-Based Access Control (RBAC '97) Abstract: In order for intranets to reach their full potential, access control and authorization management mechanisms must be in place that can regulate user access to information in a manner that is consistent with the current set of laws, regulations, and practices that face businesses today. The purpose o...

Conference: Ninth Annual Pacific Northwest Software Quality Conference Abstract: This paper provides information about the National Institute of Standards and Technology (NIST) effort to produce a comprehensive set of standards and guidelines for the assurance of high integrity software. In particular, the paper presents the results of a Workshop on the Assurance of High Integri...

Journal: SIGNAL Abstract:

The following NIST documents were created to brief a blue ribbon Committee of Visitors (COV) charged with reviewing the agency’s cryptographic standards and guidelines program by NIST’s primary independent advisory panel, the Visiting Committee on Advanced Technology (VCAT). The VCAT held a public meeting on July 14, 2014 to discuss the recommendations from the COV members and finalize a report detailing recommendations to NIST on steps to strengthen its cryptographic standards and guidelines program. The VCAT's report, along with the individual recommendations of the COV members, are...

NIST's Policy on Hash Functions - December 15, 2022 December 15, 2022 NIST is announcing a timeline for a transition for SHA-1. See this announcement for details. After 12/31/2030, any FIPS 140 validated cryptographic module that has SHA-1 as an approved algorithm will be moved to the historical list. NIST recommends that federal agencies transition away from SHA-1 for all applications as soon as possible. Federal agencies should use SHA-2 or SHA-3 as an alternative to SHA-1. Further guidance will be available soon. Send questions on the transition to sha-1-transition@nist.gov....

Completed Specifications and Guidelines The SWID Tag format, defined by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC) standard ISO/IEC 19770-2, is a structured metadata format for describing a software product. NIST recommends use of the latest version of this standard, ISO/IEC 19770-2:2015. A SWID Tag document is composed of a structured set of data elements that identify the software product, characterize the product's version, identify the organizations and individuals that had a role in the production and distribution of...

Comments Received on Draft SP 800-171B Below are comments received on Draft Special Publication 800-171B, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations – Enhanced Security Requirements for Critical Programs and High Value Assets. The public comment period closed on August 2, 2019. Please note that comments on the Public Cost Analysis are submitted and posted to www.regulations.gov/docket?D=DOD-2019-OS-0072 (Regulations.gov docket no. DOD-2019-OS-0072). All comments submitted during the public comment period for Draft NIST SP 800-171B will be posted...

NIST SP 800-116 been updated to Revision 1 to align with FIPS 201-2. High-level changes include: Update to section 4.4 (previously section 7.1) to reflect the FIPS 201-2 requirements for credential validation. Reflection of the FIPS 201-2 deprecation of CHUID authentication mechanism throughout the document. Reflection of the downgrade of VIS authentication mechanism to LITTLE or NO” confidence in cardholder’s identity. Removal of the CHUID +VIS authentication mechanism from the list of recommended authentication mechanisms. Addition of a new appendix titled “Improving Authentication...

Resources for Implementers NIST SP 800-53 Controls Public Comment Site Comment on Controls & Baselines Suggest ideas for new controls and enhancements Submit comments on existing controls and baselines Track the status of your feedback Participate in comment periods Preview changes to future SP 800-53 releases See More: Infographic and Announcement Download the Control System Cybersecurity Tips & Tactics Infographic --> View/Search Controls & Baselines SP 800-53 Release Search View controls & baselines in browser Search controls & baselines...

Call for Proposals Each submission must include: a complete written specification a detailed performance analysis Known Answer Test values a thorough description of the expected security strength an analysis of the algorithm with respect to known attacks a statement of advantages and limitations. Further details are described below. 2.B.1 A complete written specification of the algorithms shall be included, consisting of all necessary mathematical operations, equations, tables, and diagrams that are needed to implement the algorithms. The document shall also include a design...

Welcome to the NIST SP 800-53 Public Comment Website The NIST SP 800-53 Public Comment Site was developed to ensure that the SP 800-53 control catalog provides the most comprehensive and up-to-date set of controls/countermeasures to manage security, privacy, and supply chain risk. By modernizing the NIST comment process and moving to an online dataset instead of following a document-based update process, NIST can provide its stakeholders the most up-to-date controls in multiple data formats to manage risk while encouraging use of automation. Stakeholders can provide feedback on...

The NIST SP 800-53 Controls Public Comment Site was developed to ensure that the SP 800-53 control catalog provides the most comprehensive and up-to-date set of controls/countermeasures to manage security, privacy, and supply chain risk. By modernizing the NIST comment process and moving to an online dataset instead of following a document-based update process, NIST can provide its stakeholders the most up-to-date controls in multiple data formats to manage risk while encouraging use of automation. Stakeholders can provide feedback on controls by: submitting a "proposal" for a new...

General Questions and Background What is the purpose of the SP 800-53 Public Comment Website? NIST believes that robust, widely understood, and participatory development processes produce the strongest, most effective, most trusted, and broadly accepted standards and guidelines. The following principles guide NIST's standards and guidelines development: Transparency: All interested and affected parties have access to essential information regarding standards and guidelines-related activities throughout the development process. Openness: Participation is open to all interested...

Download the SP 800-53 Controls in Different Data Formats Note that NIST Special Publication (SP) 800-53, 800-53A, and SP 800-53B contain additional background, scoping, and implementation guidance in addition to the controls, assessment procedures, and baselines. This NIST SP 800-53 database represents the derivative format of controls defined in NIST SP 800-53 Revision 5, Security and Privacy Controls for Information Systems and Organizations. If there are any discrepancies noted in the content between these NIST SP 800-53 and 53A derivative data formats and the latest published NIST SP...

[Redirect to https://doi.org/10.6028/NIST.SP.1299]

Enhanced Security Requirements for Protecting Controlled Unclassified Information: A Supplement to NIST Special Publication 800-171 Purpose Enhanced security requirements to help protect the confidentiality, integrity, and availability of Controlled Unclassified Information (CUI) associated with critical programs or high value assets from the advanced persistent threat (APT). Scope The enhanced security requirements in NIST SP 800-172 are supplemental and do not impact the basic and derived security requirements contained in NIST SP 800-171, nor the scope of the implementation of the NIST...

Assessing Security Requirements for Controlled Unclassified Information Purpose Assessment procedures and a methodology that can be employed to conduct assessments of the CUI security requirements in NIST SP 800-171. Scope A system security plan describes how the SP 800-171 security requirements are met. The plan describes the system boundary; the environment in which the system operates; how the requirements are implemented; and the relationships with or connections to other systems. The scope of the assessments conducted using the procedures described in SP 800-171A are guided and...

Accessing Enhanced Security Requirements for Controlled Unclassified Information Purpose Assessment procedures and a methodology that can be employed to conduct assessments of the enhanced security requirements in NIST Special Publication 800-172. Scope Assessments conducted using the SP 800-172A procedures are guided and informed by the system security plans for the organizational systems processing, storing, or transmitting CUI. The assessments focus on the overall effectiveness of the security safeguards intended to satisfy the SP 800-172 enhanced security requirements. Download the SP...

The following table summarizes the SP 800-140x series publications and their relationships to ISO/IEC 19790:2012(E) and ISO/IEC 24759:2017(E) and links these to their associated supplemental information webpages. NIST Special Publications (SPs) that Modify ISO/IEC Standards and supplemental info links NIST SP Title ISO/IEC 19790:2012(E) ISO/IEC 24759:2017(E) Supplemental Info Link SP 800-140 FIPS 140-3 Derived Test Requirements (DTR) modifies -- §6.1 through §6.12...

Short URL: https://csrc.nist.gov/projects/cmvp/sp800-140c The following information is referenced from Section 6.2, Approved Security Functions, of NIST SP 800-140Cr2. Transitions | Block Cipher | Digital Signature | Secure Hash Extendable Output Functions | Message Authentication | Entropy Source DRBG | RBG | Other Security Functions | Change Log 6.2.1 Transitions Barker EB, Roginsky AL (2019) Transitioning the Use of Cryptographic Algorithms and Key Lengths. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) 800-131A, Rev. 2....

Short URL: https://csrc.nist.gov/projects/cmvp/sp800-140d The following information is referenced from Section 6.2, Sensitive security parameter generation and establishment methods, of NIST SP 800-140Dr2. Transitions | Symmetric Key Gen. | Key-Based Key Derivation Password-Based Key Deriv. | Asymmetric Key-Pair Gen. Key Agreement | Key Agreement Key Deriv. | Protocol-Suite Key Deriv. Key Transport | Key-Encapsulation Mech. | Entropy Source | DRBG | RBG | Other SSPEM | Change Log 6.2.1 Transitions Barker EB, Roginsky AL (2019) Transitioning the Use of Cryptographic Algorithms and Key...

Protecting Controlled Unclassified Information (CUI) in nonfederal systems and organizations is critical to federal agencies. The suite of guidance (NIST Special Publication (SP) 800-171, SP 800-171A, SP 800-172, and SP 800-172A) focuses on protecting the confidentiality of CUI and recommends specific security requirements to achieve that objective. Comments Received SP 800-171 Revision 3 (Final Public Draft) and SP 800-171A Revision 3 (Initial Public Draft) February 21, 2024: NIST issues summary and analysis of comments received in response to SP 800-171 Revision 3 (final public...

Short URL: https://csrc.nist.gov/projects/cmvp/sp800-140b This page provides information related to preparing, submitting, coordinating, and finalizing a module for the CMVP. These are the how-to processes and procedures used at the point a CMVP lab has completed testing and is ready to create and submit the package. Module Package Creation Module Information Structure (MIS) Resources To facilitate automated verification and processing of the modules, much of the information needs to be submitted in a structured and organized format. The CMVP uses JSON as the submission format to...

Comments Received on SP 800-172r3 (FPD) Below are comments received on the final public draft of SP 800-172r3, Enhanced Security Requirements for Protecting Controlled Unclassified Informa tion The public comment period closed on January 16, 2026. All comments submitted during the public comment period for Draft NIST SP 800-172r3 will be posted below without change or redaction, so commenters should not include information they do not wish to be posted (e.g., personal or business information). Date Received From 29 September 2025 Aboubacar Camara...

How Can We Help? The most common reasons users contact the NIST Cybersecurity Supply Chain Risk Management (C-SCRM) team are to: Request more information about C-SCRM technical documents (e.g., clarifying a concept from a Special Publication (SP) such as Cybersecurity Supply Chain Risk Management for Systems and Organizations [SP 800-161 Revision 1]). Questions and comments about Cybersecurity Supply Chain Risk Management (C-SCRM) are always welcome and can be directed to scrm-nist@nist.gov. Join a C-SCRM E-mail Listserv. The following Listservs are available: Federal C-SCRM...