Search CSRC

Note: The following is archived information related to NIST SP 800-179. CSD’s macOS security configuration team is working to develop secure system configuration baselines supporting different operational environments for Apple macOS version 10.12, “Sierra.” These configuration guidelines will assist organizations with hardening macOS technologies and provide a basis for unified controls and settings for federal macOS workstation and mobile system security configurations. The configurations are based on a collection of resources, including the existing NIST macOS configuration guidance, the...

The following NIST-authored publications are directly related to this project. NIST SP 800-232 (initial public draft), Ascon-Based Lightweight Cryptography Standards for Constrained Devices: Authenticated Encryption, Hash, and Extendable Output Functions Call for Algorithms: Submission Requirements and Evaluation Criteria for the Lightweight Cryptography Standardization Process (August 27, 2018) Retired White Paper, Profiles for the Lightweight Cryptography Standardization Process (retired August 27, 2018) Federal Register Notice, Announcing Request for Nominations for Lightweight...

Date Event July 20-21, 2015 First Lightweight Cryptography Workshop at NIST August 11, 2016 (Draft) NIST IR 8114 is published. October 17-18, 2016 Second Lightweight Cryptography Workshop at NIST October 31, 2016 End of public comment period to Draft NISTIR 8114 Public comments received (August 11 - October 31,2016) March 28, 2017 NIST IR 8114, Report on Lightweight Cryptography is published. April 26, 2017 (Draft) Profiles for Lightweight cryptography standardization process is...

Authority: This work is being initiated pursuant to NIST’s responsibilities under the Federal Information Security Management Act (FISMA) of 2002, Public Law 107–347. Call for Additional Digital Signature Schemes for the Post-Quantum Cryptography Standardization Process (PDF) Closed June 1, 2023 Submission packages must be received by NIST by June 1, 2023. Submission packages received before March 1, 2023, will be reviewed for completeness by NIST; the submitters will be notified of any deficiencies by March 31, 2023, allowing time for deficient packages to be amended by the submission...

Fully-Homomorphic Encryption (FHE) allows computation of arbitrary functions over encrypted data, without knowing the secret key. This is a Privacy-Enhancing Cryptography (PEC) tool, alongside with Multi-Party Computation (MPC), Zero-Knowledge Proofs (ZKP), Private-Set Intersection (PSI), and others. The NIST PEC program is accompanying FHE developments and initiatives toward future useful standards. FHE is considered in category S5 of the NIST Threshold Call (NISTIR 8214C). Related presentations: • MPTS 2026 (NIST Workshop on Multi-Party Threshold Schemes) hosted three FHE-related...

Our team often writes articles or provides presentations that discuss and provide information about human-centered cybersecurity to various audiences, for example, cybersecurity practitioners or fellow researchers. We are co-hosting the Human-Centered Cybersecurity Series for the Redefining Cybersecurity Podcast (see General Human-Centered Cybersecurity -> Podcasts below). Currently, we are conducting a multi-phased research project to understand the interactions between human-centered cybersecurity researchers and practitioners. We hope the results will lead to the creation of mutually...

What have we been up to? Here are some of the latest updates… We are currently in Phase 1 of updating the CPRT roadmap tool. Stay tuned as NIST adds reference data from other publications to this tool and develops features to interact with the data in new ways in the future. Recent CPRT Additions: 02/19/2026 | NIST AI 100-2 E2025, Adversarial Machine Learning: A Taxonomy and Terminology of Attacks and Mitigations 02/19/2026 | AI RMF 1.0, Artificial Intelligence Risk Management Framework 02/19/2026 | NIST SP 800-60 Vol. 2 Rev. 1, Guide for Mapping Types of Information and Information...

While the public comment period on SP 800-171 and SP 800-171A continues, the SP 800-172 update has begun. Here’s what you can expect. The enhanced security requirements for protecting CUI will be modified to match the structure of the requirements in SP 800-171, Revision 3. The enhanced security requirements will align with the structure and content of the controls and control enhancements in SP 800-53, Revision 5. Enhanced security requirements will be added to address new threats and vulnerabilities. Changes to the enhanced security requirements will support the future development of...

A module validation caveat may warn a user of specific stipulations, conditions, or limitations of a module, to assist in making a risk determination on its usage. The examples below list the potential caveats for a FIPS 140-3 validation (for a list of FIPS 140-2 caveats, see Implementation Guidance G.13 #4). A caveat may be added, modified or expanded by the CMVP during the validation process. Interim Validation Caveats Interim validation The module: Has been fully tested, evaluated for conformance to FIPS 140-3, and recommended for validation by an accredited CST...

Official comments on the Second Round Candidates should be submitted using the "Submit Comment" link for the appropriate algorithm. Comments from the pqc-forum Google group subscribers will also be forwarded to the pqc-forum Google group list. We will periodically post and update the comments received to the appropriate algorithm. All relevant comments will be posted in their entirety and should not include PII information in the body of the email message. Please refrain from using OFFICIAL COMMENT to ask administrative questions, which should be sent to pqc-comments@nist.gov. The rationale...

The SP 800-90 series on random bit generation may not immediately be updated following the addition of new cryptographic algorithms to NIST’s portfolio. In the time between an algorithm’s approval and the next revision of a 90 series standard, questions often arise regarding the applicability of existing guidelines to the new algorithms. This page provides information and updates on the use of approved algorithms in the NIST random bit generation standards. For the latest implementation guidance from the Cryptographic Module Validation Program (CMVP) see the FIPS 140-3 Implementation Guidance...

The security of SI systems is closely intertwined with the security of the IT infrastructure on which they run and operate. Many organizations are already implementing SP 800-53 controls and have the institutional processes in place to plan control implementations for their organizations, missions, and systems and to assess the effectiveness of the controls for meeting organizational risk management requirements. Control overlays offer organizations or communities of interest ways to further customize the controls (or control baselines) for a specific technology or type of system, mission...

Shortcut URL: https://csrc.nist.gov/bcm/authentication-for-confidentiality-modes Authenticity is a goal that includes two types of assurance for data: its integrity (i.e., that the data is unaltered from its original form) and origin (i.e., that the data was in fact generated at its purported source). Authentication is a process (e.g., a cryptographic technique) for providing assurance of authenticity. Cryptographic authentication implies some form of data expansion (i.e., an increase in the size of the protected data). Authenticity is a critical requirement for most information technology...

SCAP 1.4 is the current final release of the Security Content Automation Protocol (SCAP). This page lists the publications, schemas, tools, component specifications, identification schemes, metrics, and integrity specifications that comprise SCAP version 1.4. SCAP 1.4 final release Status: Final · Version: 1.4 Publications: NIST Special Publication (SP) 800-126 Rev. 4 and NIST Special Publication (SP) 800-126A Rev. 4. Protocol SCAP: Security Content Automation Protocol Version: 1.4 Status: Final Specification: NIST Special Publication (SP) 800-126 Rev. 4 Specification Annex: NIST...

The following sections detail the Schematron rules for SCAP 1.4. SCAP Schematron Rules The SCAP Schematron Rules are ISO Schematron rules written to check many of the requirements documented in NIST SP 800-126 Rev 4. They are for informational purposes only; they do not supercede the requirements in the specification. The rules are subject to change at anytime. Instructions on how to use the resource are provided in the included scap-rules-readme.txt. Version: 1.4.0 Released: 12/11/2025 Download: SCAP 1.4 Schematron File

CPE 3.0 is the next major revision of Common Platform Enumeration (CPE), now in early development at NIST. This page tracks the effort and how to take part. For the current published version, see Common Platform Enumeration (CPE). About the CPE 3.0 effort CPE 2.3 has been in wide use for more than a decade. Implementation experience over that period, together with current security automation needs, has surfaced a set of issues worth addressing in a future version. The CPE 3.0 effort will evaluate how platforms and products are identified for current security automation use cases, including...

The Cryptographic Module Validation Program Conference 2002 will be held on March 26-27, 2002 at the Washington Plaza Hotel in Washington DC. Sponsored by NIST and the Canadian Security Establishment (CSE), this conference will focus on the Cryptographic Module Validation Program (CMVP). The CMVP Conference will include presentations and discussions on the new FIPS 140-2 standard, Security Requirements for Cryptographic Modules, differences between FIPS 140-1 and FIPS 140-2, algorithm testing suites, Common Criteria and the CMVP, a number of panel discussions from Federal and user agencies...

The Cryptographic Module Validation Program Symposium 2004 will be held on September 14-15, 2004 at the DoubleTree Hotel & Executive Meeting Center in Rockville, MD. NIST and the Communications Security Establishment (CSE) invite you to this event. The CMVP Symposium will include presentations and discussions on the FIPS 140-2, Security Requirements for Cryptographic Modules, supporting documents such as the Derived Test Requirements and Implementation Guidance, cryptographic algorithm testing suites, expectations, future direction, panel discussions from Federal and user agencies and...

(All presentations in .pdf format.) Federal Register Notice Announcing Meeting Minutes Computer Security Division Activities William Curt Barker, Division Chief, Computer Security Division, NIST Creating Value from Vulnerability Tony Sager, Chief, Vulnerability Analysis & Operations Group Information Assurance Directorate National Security Agency Foundations of Measurement Science for Information Systems Ron Boisvert, Chief, Mathematical & Computational Sciences Division, NIST NIST Security Measurement NIST SP 800-55 Revision 1 William Curt Barker, Division Chief, Computer Security...

Presentations & Speakers at a Glance: An Enterprise Continuous Monitoring Technical Reference Architecture, Peter Mell, NIST; and Information Security Continuous Monitoring (Ongoing Monitoring in Support of Organizational Risk Management), NIST SP 800-137, Arnold Johnson, NIST. NOTE: FORUM MEETINGS ARE OPEN TO ONLY FEDERAL/STATE EMPLOYEES, HIGHER EDUCATION EMPLOYEES, AND THEIR DESIGNATED SUPPORT CONTRACTORS. REGISTRANTS MUST USE A .GOV, .EDU, OR .MIL ADDRESS FOR SIGN-UP. SUPPORT CONTRACTORS MUST INDICATE THE AGENCY OR ORGANIZATION THEY SUPPORT. The Federal Computer Security...

Presentations & Speakers at a Glance: Federal Risk and Authorization Management Program (FedRAMP), Matt Goodrich, GSA; and NIST SP 800-63-1, NIST. NOTE: FORUM MEETINGS ARE OPEN TO ONLY FEDERAL/STATE EMPLOYEES, HIGHER EDUCATION EMPLOYEES, AND THEIR DESIGNATED SUPPORT CONTRACTORS. REGISTRANTS MUST USE A .GOV, .EDU, OR .MIL ADDRESS FOR SIGN-UP. SUPPORT CONTRACTORS MUST INDICATE THE AGENCY OR ORGANIZATION THEY SUPPORT. The Federal Computer Security Program Managers Forum (the "Forum") is an informal group sponsored by the National Institute of Standards and Technology (NIST) to...

(All presentations in .pdf format.) Federal Register Notice Announcing Meeting Minutes SP 800-53 Rev. 4, Security and Privacy Controls for Federal Information Systems and Organizations Ron Ross, NIST Fellow, Computer Security Division, NIST Dom Cussatt, Senior Policy Advisor, U.S. Department of Defense Greg Hall, Identity Management Program Manager, ODNI/CIO Tim Ruland, Chief IT Security Officer, U.S. Census Bureau OIG Perspectives on Cloud Computing and FISMA (OIG Panel) Gale Stone, (Moderator), Deputy Assistant Inspector General for Audit, SSA Dr. Brett M. Baker, Assistant IG for...

Presentations & Speakers at a Glance: Updates from GAO and FedRAMP; Presentations on Executive Order 13636, Cryptographic Technology, Continuous Monitoring, National Vulnerability Database, Industrial Control System Security, SP 800-53, Revision 4, Supply Chain Risk Management, IT Security Concerns During a Consolidation/Merger, and more! NOTE: FORUM MEETINGS ARE OPEN TO ONLY FEDERAL/STATE EMPLOYEES, HIGHER EDUCATION EMPLOYEES, AND THEIR DESIGNATED SUPPORT CONTRACTORS. REGISTRANTS MUST USE A .GOV, .EDU, OR .MIL ADDRESS FOR SIGN-UP. SUPPORT CONTRACTORS MUST INDICATE THE AGENCY OR...

Presentations & Speakers at a Glance: Overview of SP 800-88, Revision 1, Guidelines for Media Sanitization, Andy Regenscheid, NIST. NOTE: FORUM MEETINGS ARE OPEN TO ONLY FEDERAL/STATE EMPLOYEES, HIGHER EDUCATION EMPLOYEES, AND THEIR DESIGNATED SUPPORT CONTRACTORS. REGISTRANTS MUST USE A .GOV, .EDU, OR .MIL ADDRESS FOR SIGN-UP. SUPPORT CONTRACTORS MUST INDICATE THE AGENCY OR ORGANIZATION THEY SUPPORT. The Federal Computer Security Program Managers Forum (the "Forum") is an informal group sponsored by the National Institute of Standards and Technology (NIST) to promote the sharing...

Presentations & Speakers at a Glance: Implementing the Privacy Controls from NIST SP 800-53 Rev 4, Appendix J Operationally Within DHS, Debra Danisek & Jeff Gallucci, DHS; U.S. Government Configuration Baseline, NIST. NOTE: FORUM MEETINGS ARE OPEN TO ONLY FEDERAL/STATE EMPLOYEES, HIGHER EDUCATION EMPLOYEES, AND THEIR DESIGNATED SUPPORT CONTRACTORS. REGISTRANTS MUST USE A .GOV, .EDU, OR .MIL ADDRESS FOR SIGN-UP. SUPPORT CONTRACTORS MUST INDICATE THE AGENCY OR ORGANIZATION THEY SUPPORT. The Federal Computer Security Program Managers Forum (the "Forum") is an informal group...