Search CSRC

Call for Proposals 4.A Security The security provided by a cryptographic scheme is the most important factor in the evaluation. Schemes will be judged on the following factors: 4.A.1 Applications of Public-Key Cryptography NIST intends to standardize post-quantum alternatives to its existing standards for digital signatures (FIPS 186) and key establishment (SP 800-56A, SP 800-56B). These standards are used in a wide variety of Internet protocols, such as TLS, SSH, IKE, IPsec, and DNSSEC. Schemes will be evaluated by the security they provide in these applications, and in additional...

The following sections detail the Schematron rules for SCAP 1.3. SCAP Schematron Rules The SCAP Schematron Rules are ISO Schematron rules written to check many of the requirements documented in NIST SP 800-126 Rev 3. They are for informational purposes only; they do not supercede the requirements in the specification. The rules are subject to change at anytime. Instructions on how to use the resource are provided in the included scap-rules-readme.txt. Version: 1.3.5 Released: 08/06/2020 Download: SCAP Schematron Package SHA-256:...

The following sections detail the Schematron rules for SCAP 1.2. SCAP Schematron Rules The SCAP Schematron Rules are ISO Schematron rules written to check many of the requirements documented in NIST SP 800-126 Rev 2. They are for informational purposes only; they do not supercede the requirements in the specification. The rules are subject to change at anytime. Instructions on how to use the resource are provided in the included readme.txt. Version: 1.2.6 Released: 12/16/2016 Download: SCAP Schematron Package SHA-1: BBFD29657FB9B9F3EB48A3D021817FBB1DB8E21D SHA-256:...

OCIL - The Open Checklist Interactive Language - Schema Element Dictionary - OCIL Schema - Element Dictionary Schema: OCIL Version: 1.1 Release Date: May 20, 2009 VERSION 1.1 The Open Checklist Interactive Language (OCIL) is a language to express a set of questions to be presented to a user and procedures to interpret responses to these questions for the purpose of developing security checklists. Although its intended domain of use is IT security, its generic nature allows for other applications. For instance, it could be used for authoring research surveys,...

The Applicability Language specification defines a standardized structure for forming complex logical expressions out of Well-formed Names (WFNs). These expressions, also known as applicability statements, are used to tag checklists, policies, guidance, and other documents with information about the product(s) to which the documents apply. For example, a security checklist for Mozilla Firefox 3.6 running on Microsoft Windows Vista could be tagged with a single applicability statement that ensures only systems with both Mozilla Firefox 3.6 and Microsoft Windows Vista will have the security...

The Dictionary specification defines the concept of a CPE dictionary, which is a repository of CPE names and metadata, with each name identifying a single class of IT product. The Dictionary specification defines processes for using the dictionary, such as how to search for a particular CPE name or look for dictionary entries that belong to a broader product class. Also, the Dictionary specification outlines all the rules that dictionary maintainers must follow when creating new dictionary entries and updating existing entries. CPE Dictionary Resources Release 2.3 CPE 2.3 Dictionary...

The Name Matching specification defines the procedures for comparing Well-formed Names (WFNs) to each other so as to determine whether they refer to some or all of the same products. CPE Name Matching Resources Name Matching CPE 2.3 Name Matching Resources (August 2011) Documentation: NISTIR 7696

The Naming specification defines the logical structure of Well-formed Names (WFNs), URI bindings, and formatted string bindings, and the procedures for converting WFNs to and from the bindings. CPE Naming Resources Release 2.3 CPE 2.3 Naming Resources (August 2011) XML Schema Files: [what is a schema?] CPE 2.3 Naming (XSD 1.0) Documentation: NISTIR 7695

The following overlays are maintained for archival purposes only. They are either not based on the current security and privacy controls in NIST SP 800-53 or the overlay contact information is no longer accurate. Email Messaging Systems Overlay Name: NIST SP 800-177, Rev. 1, Email Messaging Systems Overlay Publication Date: February 19, 2019 Technology or System: Email Messaging Systems Overlay Author: Scott Rose, NIST Overview: Overlay for email messaging systems using the SP 800-53, Revision 4 controls. Email system is taken to mean any system (as defined by FIPS 199), that...

These are standard publications and guidelines that provide perspectives and frameworks to inform, measure, and manage cybersecurity vulnerabilities and exposures. NIST SP 800-55 Vol. 1 Measurement Guide for Information Security: Volume 1 — Identifying and Selecting Measures Volume 1, Identifying and Selecting Measures, provides a flexible approach to the development, selection, and prioritization of information security measures. This volume explores both quantitative and qualitative assessment and provides basic guidance on data analysis techniques as well as impact and likelihood...

Top Level Special Publications Process Flow Abstracts Documentation and Governance for the FIPS 140-3 Cryptographic Module Validation Program Federal Information Processing Standards Publication (FIPS) 140-3 became effective September 22, 2019, permitting CMVP to begin accepting validation submissions under the new scheme beginning September 2020. The FIPS 140-3 standard introduces some significant changes in the management over the previous standard. Rather than encompassing the module requirements directly, FIPS 140-3...

RFGs and CMVP Resolutions - Link to Cryptographic Module User Forum (CMUF) webpage where CMVP posts the latest Request For Guidance (RFG) and CMVP Resolutions FIPS 140-3 IG (August 19, 2026) - Latest version of FIPS 140-3 Implementation Guidance (IG) IG Change Summary & Archived Versions [08-19-2026] New Guidance: 1.B Clarifications on the Definition and Requirements of Hybrid Modules Updated Guidance: 2.3.C Processor Algorithm Accelerators (PAA) and Processor Algorithm Implementation (PAI) – (Admin update) Added an...

Program Related Transitions Interim Validations The CMVP is offering an interim validation process for module submissions. This interim validation option is voluntary; however, CSTLs must notify CMVP of the vendor's intent prior to 1 Oct 2024. Vendors do not need to take any action if they would prefer to wait for their full review to be completed to receive full, five-year validation. Vendors who would like to elect the interim validation should follow the process below. These module submissions will be reviewed for completeness by CMVP staff. If needed, there will be a brief...

Combinatorial coverage measures are used in industry for high assurance software used in critical applications. Industry examples include the following: Kuhn, D. R., Raunak, M. S., & Kacker, R. N. (2021). Combinatorial Frequency Differencing. NIST Cybersecurity Whitepaper. - Describes measures of the frequency of combination coverage and difference between Class and Non-class elements in machine learning classification problems. Illustrates application of these methods for identifying weaknesses in physical unclonable function implementations. Kuhn, D. R., Raunak, M. S., & Kacker, R. N....

At A Glance Purpose: Implement the controls in the security and privacy plans for the system and organization Outcomes: controls specified in security and privacy plans implemented security and privacy plans updated to reflect controls as implemented Resources for Implementers RMF Quick Start Guide (QSG): Implement Step FAQs Security Configuration Settings Multiple Supporting NIST Publications include templates Examples include: SP 800-88, Guidelines for Media Sanitization, SP 800-34 Revision 1, Contingency Planning Guide for Federal Information...

At A Glance Purpose: Determine if the controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting the security and privacy requirements for the system and the organization. Outcomes: assessor/assessment team selected security and privacy assessment plans developed assessment plans are reviewed and approved control assessments conducted in accordance with assessment plans security and privacy assessment reports developed remediation actions to address deficiencies in controls are taken security and privacy plans are...

As NIST continues to refine the SP 800-53 Comment Site, screenshots included in the User Guide may differ slightly from the latest version. Each topic area below includes a step-by-step guide demonstrating how to: Navigate to the SP 800-53 Public Comment Site Users can reach the SP 800-53 Public Comment Site directly, or by browsing from the NIST Risk Management Framework (RMF) project page. Option 1: Access by Direct Link Access the SP 800-53 Public Comment Site directly: https://csrc.nist.gov/Projects/risk-management/sp800-53-controls/public-comments. Figure 1 below shows the...

The NIST Security and Privacy Control Overlay Repository (SCOR) provides stakeholders a platform for voluntarily sharing control overlays created by subject matter experts to help reduce the duplication of effort and share best practices for the information security and privacy community. What is a Control Overlay? An overlay may provide a fully specified set of controls, control enhancements, and parameter values to address specific circumstances, situations, and/or conditions unique to specific communities of interest, industry sectors, or coalitions/partnerships. Learn More About...

The following table summarizes publication reviews completed by the Crypto Publication Review Board, including links to announcements, received comments, the Board's initial decision proposal, and the final decision approved by NIST management. Also, see a list of publications currently under review and descriptions of the publication decision options—Reaffirm, Update, Revise, Convert, Withdraw. Latest updates: •1/6/26: Decision to update SP 800-56Ar3, reaffirm SP 800-56Br2, and revise SP 800-56Cr2. Completed Publication Reviews and Decisions (sorted by Final Decision, newest to...

The following table lists the ten Finalists of the lightweight crypto standardization process. Official comments on the Finalists should be submitted using the "Submit Comment" link for the appropriate algorithm. Comments from the lwc-forum Google group subscribers will also be forwarded to the lwc-forum Google group list. We will periodically post and update the comments received to the appropriate algorithm. All relevant comments will be posted in their entirety and should not include PII information in the body of the email message. Please refrain from using OFFICIAL COMMENT to ask...

A multidisciplinary NIST initiative seeks to address the Covid-19 pandemic by analyzing the availability, effectiveness, accuracy, and privacy of automated contact tracing efforts. PEC team members have been participating, by studying privacy tradeoffs of widespread contact tracing applications and considering how privacy can be improved within these systems. 2021-January-26-28: NIST workshop Challenges for Digital Proximity Detection in Pandemics: Privacy, Accuracy, and Impact. The workshop was held to engage with the broader community. PEC team members helped organize the breakout session...

As of November 7, 2020, the CMVP requires that all FIPS 140-2 and FIPS 140-3 module validation submissions include documentation justifying conformance to SP 800-90B if applicable. SP 800-90B, along with FIPS 140-3 Implementation Guidance documents (IGs) D.J, D.K, and D.O, outline the requirements for an entropy source to be included in a FIPS-approved cryptographic module. With the publication of SP 800-90C, the CMVP is also accepting submissions for Random Bit Generators. The associated IG is IG D.T. The list of validated entropy sources can be found in the Entropy Source Validation...

June 26, 2026 ESV Document Updates An update to the Random Bit Generator (RBG) Report Template v1.2 has been published. May 7, 2026 ESV Updates The CMVP is now accepting submissions justifying conformance of a random bit generator to SP 800-90C. There are updates to the documents on the Entropy Validation Documents page, adding the RBG Report Template v1.0. March 12, 2025 ESV Document Updates New Public Use Document v1.2 and Entropy Assessment Report v1.2 templates are available. June 25, 2024 ESV Document Updates There are updates to the documents on...

ATTENTION: The Project Lead is no longer at NIST. Inquiry responses may be delayed. NIST SP 800-216, Recommendations for Federal Vulnerability Disclosure Guidelines, is based on the policies and processes shown in the figure below. Minimal changes have been made to support vulnerability management at the local and federal levels.

Title / Topic Description Executive Order (EO) 14028 On Improving The Nation's Cybersecurity Executive Order 14028, “Improving the Nation’s Cybersecurity” marks a renewed commitment and prioritization of federal cybersecurity modernization and strategy. To keep pace with modern technological advancements and evolving threats, the Federal Government continues to migrate to the cloud. In support of these efforts, the Secretary of Homeland Security acting through the Director of the Cybersecurity and Infrastructure Security Agency...