Search CSRC

The National Cybersecurity Center of Excellence has two final publications (NIST SP 1800-19, NIST IR 8320B) and an initial public draft (NIST IR 8320C) on trusted cloud and hardware-enabled security.

NIST's NCCoE releases "Protecting Information and System Integrity in Industrial Control System Environments: Cybersecurity for the Manufacturing Sector," NIST Special Publication 1800-10.

NIST has released a preliminary draft of NIST Special Publication 1800-19A, Trusted Cloud: Security Practice Guide for VMWare Hybrid Cloud Infrastructure as a Service (IaaS) Environments (Executive Summary).

This guide demonstrates how organizations can discover, identify and label unstructured data using data classification practices. The public comment period is open through March 30, 2026.

Two PIV publications are being revised: "Interfaces for Personal Identity Verification" (SP 800-73-5, 3 parts), and "Cryptographic Algorithms and Key Sizes for Personal Identity Verification" (SP 800-78-5). Submit your public comments through December 8, 2023.

Version 2 of test Personal Identity Verification (PIV) Cards now available.

When software programs in a network are unmanaged, or unidentified, they are vulnerable to attacks, and.....

800-90 A Rev. 1: Recommendation for Random Number Generation Using Deterministic RBG800-90 B: Recommendation for the Entropy Sources Used for Random Bit Generation 800-90 C: Recommendation for RBG Constructions are 3 drafts

In order to facilitate the development of applications and middleware that support the Personal Identity Verification (PIV) Card, the National Institute of Standards and Technology (NIST) has developed a set of test PIV Cards. The set of test PIV Cards contains sixteen ...

Algorithm Specifications Algorithm specifications for Key-Based KDFs (SP800-108) are available from the Cryptographic Toolkit. Algorithm Validation Testing Requirements The algorithm validation testing requirements for SP 800-108 are specified in: The SP800-108 Key Derivation Function Validation System (KBKDFVS). Testing Notes Prerequisites for KBKDF testing are listed in the CAVP Frequently Asked Questions (CAVP FAQ) General Question GEN.5. As of 1-1-2016, TDES KO2 encrypt is no longer compliant. (See SP800-131A Revision 1.) Test Vectors Use of these test vectors does not...

Algorithm Specifications Algorithm specifications for Key Agreement Schemes and Key Confirmation (SP800-56A) are available from the Cryptographic Toolkit. Algorithm Validation Testing Requirements The algorithm validation testing requirements for SP 800-56A are specified in: The KAS Validation System (KASVS) Testing Notes Prerequisites for KAS testing are listed in the CAVP Frequently Asked Questions (CAVP FAQ) General Question GEN.5. Test Vectors Use of these test vectors does not replace validation obtained through the CAVP. The test vectors linked below can be used...

Algorithm Specifications Algorithm specifications for Key Agreement Schemes and Key Confirmation (SP800-56A) are available from the Cryptographic Toolkit. Algorithm Validation Testing Requirements The algorithm validation testing requirements for SP 800-56A are specified in: The KAS Validation System (KASVS) Testing Notes Prerequisites for KAS testing are listed in the CAVP Frequently Asked Questions (CAVP FAQ) General Question GEN.5. Test Vectors Use of these test vectors does not replace validation obtained through the CAVP. The test vectors linked below can be used...

The following products have been placed on the Removed Products List because they do not conform to the requirements of FIPS 201-2 effective since 9/05/14. Note: Validation of SP 800-73-1, SP 800-73-2 and SP 800-73-3 based PIV Middleware has been superseded by SP 800-73-4 (or higher) based PIV Middleware validation. All questions regarding the implementation and/or use of any PIV Middleware included in the validation list should first be directed to the vendor. SP 800-73-3 PIV Middleware Validation List Certificate # Product Name Vendor Validation Date...

Security Requirements for Protecting CUI Purpose Recommended security requirements for protecting the confidentiality of CUI: (1) when the CUI is resident in a nonfederal system and organization; (2) when the nonfederal organization is not collecting or maintaining information on behalf of a federal agency or using or operating a system on behalf of an agency; and (3) where there are no specific safeguarding requirements for protecting the confidentiality of CUI prescribed by the authorizing law, regulation, or governmentwide policy for the CUI category listed in the CUI...

Abstract: The Cryptographic Module Validation Program (CMVP) validates third-party assertions that cryptographic module implementations satisfy the requirements of Federal Information Processing Standards (FIPS) Publication 140-3, Security Requirements for Cryptographic Modules. The current cryptographic modu...

Abstract: The capabilities demonstrated by the NCCoE Migration to Post-Quantum Cryptography project support several security objectives and controls identified by the NIST Cybersecurity Framework 2.0 (CSWP 29) and Security and Privacy Controls for Information Systems and Organizations (SP 800-53), respectivel...

Abstract: The NIST Cybersecurity Framework (CSF) 2.0 introduced the term “Community Profiles” to reflect the use of the CSF for developing use case-specific cybersecurity risk management guidance for multiple organizations. This guide provides considerations for creating and using Community Profiles to help i...

Abstract: The National Institute of Standards and Technology (NIST) initiated a public standardization process to select one or more schemes that provide Authenticated Encryption with Associated Data (AEAD) and optional hashing functionalities and are suitable for constrained environments. In February 2019, 5...

Abstract: This report summarizes the feedback received on the work of the NIST Cybersecurity for the Internet of Things (IoT) program on IoT product cybersecurity criteria at a virtual workshop in June 2022. The purpose of this workshop was to obtain feedback on specific considerations—and techniques for addr...

Abstract: The National Institute of Standards and Technology (NIST) initiated a public standardization process to select one or more Authenticated Encryption with Associated Data (AEAD) and hashing schemes suitable for constrained environments. In February 2019, 57 candidates were submitted to NIST for consid...

Abstract: In order to facilitate the development of applications and middleware that support the Personal Identity Verification (PIV) Card, NIST has developed a set of test PIV Cards and a supporting public key infrastructure (PKI). This set of test cards includes not only examples that are similar to cards i...

Abstract: This bulletin summarizes the information presented in NIST Special Publication (SP) 800-38G, "Recommendation for Block Cipher Modes of Operation: Methods for Format-Preserving Encryption." The publication specifies two methods for format-preserving encryption, FF1 and FF3.

Abstract: This bulletin describes the NIST security configuration checklists program and is based on NIST Special Publication 800-70: Security Configuration Checklists Program for IT Products, by Murugiah Souppaya, John Wack and Karen Kent. The bulletin discusses checklists and their benefits, and explains ho...

Abstract: On June 10, 1994, the National Institute of Standards and Technology (NIST) hosted a one-day workshop to present and discuss key escrow encryption technology, including the recently-approved Escrowed Encryption Standard (EES), Federal Information Processing Standard (FIPS) Publication 185. Speakers...

Abstract: The purpose of the workshop, held at the National Institute of Standards and Technology (NIST) on December 10-11, 1992, was to review the existing and required technologies for digital signature certification authorities, and to develop recommendations for certificate contents, formats, generation,...