Search CSRC

The National Institute of Standards and Technology (NIST) seeks comments on draft NISTIR 7628, Smart Grid Cyber Security Strategy and Requirements.

NIST held a one-day workshop for U.S. Government agencies on March 3, 2006, to discuss the NIST Personal Identity Verification Program (NPIVP).

Purpose: Convene users of the NIST Risk Management Framework to discuss how the RMF is currently being used in the federal government and the private sector, including successes and challenges with its use, and opportunities for enhancement. This half day workshop will include: A policy update from the Office of Management and Budget; An update on the NIST Risk Management Framework and the Cybersecurity Framework; Industry panels on risk management, automation, and industry approaches to risk management in the system development lifecycle; A risk management tool demonstration; and...

Spring 2017 Software and Supply Chain Assurance Forum

This is the first in a series of public workshops NIST is hosting on the development of the Privacy Framework: An Enterprise Risk Management Tool. In this half-day event, on October 16th, in Austin, Texas, attendees will hear from NIST representatives what to expect from the framework development process. They will learn from panels of experts how organizations are currently managing privacy risks, and where the challenges lie. The workshop also will be an opportunity to begin the discussion of how the NIST Privacy Framework can meet organizations’ needs to better protect individuals’ privacy....

On November 7-9, 2018, NIST will host the 2018 Cybersecurity Risk Management Conference. Building on previous NIST workshops, the conference aims to share and explore best practices and receive and discuss stakeholder input on key cybersecurity and privacy risk management topics. The newly expanded conference is a continuation of the annual Cybersecurity Framework Workshops of the past, with addition of the topics and stakeholder groups associated with NIST projects such as Risk Management Framework, Supply Chain Risk Management, and Privacy Engineering. The conference will be organized...

The Software and Supply Chain Assurance Forum (SSCA) provides a venue for government, industry, and academic participants from around the world to share their knowledge and expertise regarding software and supply chain risks, effective practices and mitigation strategies, tools and technologies, and any gaps related to the people, processes, or technologies involved. Forums are held 2-3 times / year and are FREE and open to the public; registration is required.

NIST will be hosting the third in a series of public workshops on the development of the Privacy Framework: An Enterprise Risk Management Tool on July 8th-July 9th in Boise, Idaho. We thank Boise State University for hosting this two-day event, where attendees will have an opportunity to actively engage in facilitated discussions to advance the development of the framework. Additional details about pre-read materials will be available closer to the event. This workshop will be open to the public.

NIST is hosting a virtual workshop on September 15-16, 2020 to support its work on Responsible Use of Positioning, Navigation and Timing (PNT) services. See the event homepage for more information. The September 15th workshop will include: A webinar to provide an update on NIST’s latest efforts to develop a Profile for the systems that form or use PNT data. Panel discussions with representatives from industry and federal agencies to discuss their use of systems that form or use PNT data, impact to operations or services if PNT is disrupted, and federal efforts to improve the resiliency of...

Abstract: The protection of Controlled Unclassified Information (CUI) resident in nonfederal systems and organizations is of paramount importance to federal agencies and can directly impact the ability of the Federal Government to successfully conduct its essential missions and functions. This publication pro...

Abstract: The protection of Controlled Unclassified Information (CUI) is of paramount importance to federal agencies and can directly impact the ability of the Federal Government to successfully conduct its essential missions and functions. This publication provides federal agencies with recommended security...

Abstract: The protection of Controlled Unclassified Information (CUI) is of paramount importance to federal agencies and can directly impact the ability of the Federal Government to successfully conduct its essential missions and functions. This publication provides organizations with assessment procedures an...

Abstract: The protection of Controlled Unclassified Information (CUI) in nonfederal systems and organizations is important to federal agencies and can directly impact the ability of the Federal Government to successfully carry out its assigned missions and business operations. This publication provides federa...

Abstract: The protection of Controlled Unclassified Information (CUI) resident in nonfederal systems and organizations is of paramount importance to federal agencies and can directly impact the ability of the federal government to successfully conduct its essential missions and functions. This publication pro...

Abstract: The protection of Controlled Unclassified Information (CUI) resident in nonfederal systems and organizations is of paramount importance to federal agencies and can directly impact the ability of the federal government to successfully conduct its assigned missions and business operations. This public...

Abstract: [The errata update includes minor editorial changes to selected CUI security requirements, some additional references and definitions, and a new appendix that contains an expanded discussion about each CUI requirement.] The protection of Controlled Unclassified Information (CUI) resident in nonfede...

Abstract: The protection of Controlled Unclassified Information (CUI) resident in nonfederal systems and organizations is of paramount importance to federal agencies and can directly impact the ability of the federal government to successfully conduct its assigned missions and business operations. This public...

Abstract: The protection of Controlled Unclassified Information (CUI) while residing in nonfederal information systems and organizations is of paramount importance to federal agencies and can directly impact the ability of the federal government to successfully carry out its designated missions and business o...

Abstract: This bulletin summarizes the information presented in NIST SP 800-183, Networks of 'Things'. This publication offers an underlying and foundational science to IoT based on the realization that IoT involves sensing, computing, communication, and actuation.

Abstract: The protection of Controlled Unclassified Information (CUI) while residing in nonfederal information systems and organizations is of paramount importance to federal agencies and can directly impact the ability of the federal government to successfully carry out its designated missions and business o...

Abstract: This bulletin summarizes the information presented in NIST Special Publication (SP) 800-30 Rev.1, Guide to Conducting Risk Assessments. This publication was developed by the Joint Task Force Transformation Initiative, a joint partnership among the Department of Defense, the Intelligence Community, N...

Abstract: This bulletin summarizes the information presented in NIST Special Publication (SP) 800-153, Guidelines for Securing Wireless Local Area Networks (WLANs): Recommendations of the National Institute of Standards and Technology. The publication was written by Murugiah Souppaya of NIST and Karen Scarfon...

Abstract: This bulletin summarizes the information presented in NIST Special Publication (SP) 800-128, Guide to Security-Focused Configuration Management of Information Systems. The publication was written by Arnold Johnson, Kelley Dempsey, and Ron Ross of NIST, and by Sarbari Gupta and Dennis Bailey of Elec...

Abstract: This bulletin summarizes the information presented in NIST Special Publication (SP) 800-39, Integrated Enterprise-Wide Risk Management: Organization, Mission and Information System View. This publication was developed by the Joint Task Force Transformation Initiative, a joint partnership among the D...

Abstract: Special Publication 800-53A, Revision 1 provides guidelines for developing security assessment plans and associated security control assessment procedures that are consistent with Special Publication 800-53, Revision 3, Recommended Security Controls for Federal Information Systems and Organizations,...