Search CSRC

Abstract: This bulletin summarizes the information presented in NISTIR 7511, Rev. 4, "Security Content Automation Protocol (SCAP) Version 1.2 Validation Program Test Requirements". This is the fourth revision of the NISTIR which defines the requirements and associated test procedures necessary for products or...

Abstract: The United States has embarked on a major transformation of its electric power infrastructure. This vast infrastructure upgrade--extending from homes and businesses to fossil-fuel-powered generating plants and wind farms--is central to national efforts to increase energy efficiency, reliability, and...

Abstract: The Common Vulnerability Scoring System (CVSS) is an open standard designed to convey severity and risk of information system vulnerabilities. CVSS was commissioned by the National Infrastructure Advisory Council (NIAC) in support of the global Vulnerability Disclosure Framework. It is currently mai...

Abstract: This ITL Bulletin describes the Cybersecurity Framework that NIST is developing to reduce cyber risks to our nation's critical infrastructure and announces the first Cybersecurity Framework Workshop.

Abstract: In order to facilitate the development of applications and middleware that support the Personal Identity Verification (PIV) Card, NIST has developed a set of test PIV Cards and a supporting public key infrastructure. This set of test cards includes not only examples that are similar to cards that ar...

Abstract: This bulletin summarizes the recommendations developed by NIST to assist organizations in designing, implementing and operating email systems that are secure. Topics covered in the bulletin include a description of the contents and the appendices of the guideline; the structure of email systems; and...

Abstract: This bulletin explains the Domain Name System (DNS) infrastructure, and discusses NIST's recommendations to help organizations analyze their operating environments and the threats to their DNS services, and to apply appropriate risk-based security measures for all DNS components. The bulletin summar...

Abstract: This bulletin provides information for organizational security managers who are responsible for designing and implementing security patch and vulnerability management programs and for testing the effectiveness of the programs in reducing vulnerabilities. The information is also useful to system admi...

Abstract: This bulletin summarizes an article entitled "Understanding the New FISMA-Required NIST Standards and Guidelines" by Ron S. Ross, PhD. It highlights FIPS 199, "Standards for Security Categorization of Federal Information and Information Systems," which is NIST's flagship standard in support of the F...

Abstract: CSPP-OS provides a worked example of the guidance in NISTIR-6462 for the development of Common Criteria Protection Profiles for commercial off the shelf (COTS) information technology. The intended audience consists of those individuals and organizations in both government and private sectors who are...

Abstract: The passage of the Computer Security Act of 1987 and the recent issuance of the "National Policy for the Security of National Security Telecommunications and Information Systems," a classified Presidential directive, has clarified the division of responsibilities between the National Institute of St...

WPEC 2026 brings together multiple perspectives of privacy-enhancing cryptography (PEC) in a learning environment. The three-day virtual workshop is organized for sharing insights about PEC capabilities, ongoing research use cases, real-world deployment, challenges and opportunities, and the related context of privacy and auditability.

The National Institute of Standards and Technology (NIST) announces the phased conclusion of the Security Content Automation Protocol (SCAP) Validation Program.

This report (NIST IR 8498) provides practical cybersecurity guidance for small-scale solar inverter implementations that are typically used in homes and small businesses.

Draft CSWP 36C, Reallocation of Temporary Identities - Applying 5G Cybersecurity & Privacy Capabilities White Paper Series for Public Comment. The public comment period is open through December 6, 2024.

The NCCoE has released an initial public draft for "Supply Chain Traceability: Manufacturing Meta-Framework." Public comments are welcome through November 15, 2024.

An initial public draft of Cybersecurity White Paper (CSWP) 33, "Product Development Cybersecurity Handbook: Concepts and Considerations for IoT Product Manufacturers" is now available for public comment through May 17, 2024.

A new publication formalizes the Common Vulnerabilities and Exposures (CVE) entry metadata submission process that's used in conjunction with the National Vulnerability Database (NVD).

Cybersecurity and usability must coexist. Systems that prioritize usability over a .....

On January 12-13, 2016 the Applied Cybersecurity Division (ACD) in the National Institute of Standards and Technology’s (NIST) Information Technology Laboratory hosted the “Applying Measurement Science in the Identity Ecosystem”...

This draft white paper is a best practices guide. The paper is in response to the Cybersecurity Strategy and Implementation Plan (CSIP), published by the Office of Management and Budget (OMB) ...

On February 25, 2014, the Association of Public-Safety Communications Officials (APCO) International, in cooperation with FirstNet and the Department of Commerce held a half-day workshop titled “Public Safety Mobile Application Security Requirements” attended by ...

Recent news reports about leaked classified documents have caused concern from the cryptographic community about......

This report (NISTIR 7878) describes measures of combinatorial coverage that can be used in evaluating the degree of t-way coverage of any test suite, regardless of whether it was initially constructed for ...

Earlier this year the President signed a Memorandum issuing the Digital Government Strategy, which was designed to build a 21st Century digital government that delivers better services to the American people. The strategy recognizes the potential for mobile