Search CSRC

Validation Number: 138 Vendor: Rapid7 Product Name: Nexpose Product Major Version: 6 Product Version Tested: 6.2.1 Tested Platforms: Microsoft Windows XP Professional SP3, 32 bit Microsoft Windows Vista SP1, 32 bit SCAP 1.2 Capabilities: Authenticated Configuration Scanner Common Vulnerabilities and Exposures (CVE) Validated Product Vendor Provided SCAP Information Dates Tested: 10/20/2015 - 4/8/2016 Report Submitted: 11/20/2015 DTR Version:...

Validation Number: 136 Vendor: Tenable Product Name: SecurityCenter Product Major Version: 5 Product Version Tested: 5.0.0.2 Tested Platforms: Microsoft Windows 7, 64 bit Microsoft Windows 7, 32 bit Microsoft Windows Vista, SP2, 32 bit Microsoft Windows XP Pro, SP3, 32 bit Red Hat Enterprise Linux 5, 64 bit Red Hat Enterprise Linux 5, 32 bit SCAP 1.2 Capabilities: Authenticated Configuration Scanner Common Vulnerabilities and Exposures (CVE) Validated Product Vendor...

Validation Number: 135 Vendor: ThreatGuard Product Name: Secutor Prime Product Major Version: 5 Product Version Tested: 5 (build 5000) Tested Platforms: Microsoft Windows XP Professional, SP3, 32 bit Microsoft Windows Vista, SP2, 32 bit Microsoft Windows 7, SP1, 32 bit Microsoft Windows 7, SP1 64 bit Red Hat Enterprise Linux 5, 32 bit Red Hat Enterprise Linux 5, 64 bit SCAP 1.2 Capabilities: Authenticated Configuration Scanner Common Vulnerabilities and Exposures (CVE)...

Validation Number: 133 Vendor: SAINT Corporation Product Name: SAINT Security Suite Product Major Version: 8 Product Version Tested: 8.7.0 (build 70206.432.2.13.2) Tested Platforms: Microsoft Windows 7, 64 bit Microsoft Windows 7, 32 bit Microsoft Windows Vista, SP2, 32 bit Microsoft Windows XP Pro, SP3, 32 bit Red Hat Enterprise Linux 5, 64 bit Red Hat Enterprise Linux 5, 32 bit SCAP 1.2 Capabilities: Authenticated Configuration Scanner Common Vulnerabilities and Exposures...

Validation Number: 130 Vendor: BMC Software Product Name: BMC Client Management Product Major Version: 12.0.0 Product Version Tested: 12.0.0 Build 140901c Tested Platforms: Microsoft Windows 7, 64 bit Microsoft Windows 7, 32 bit Microsoft Windows Vista, SP2, 32 bit Microsoft Windows XP Pro, SP3, 32 bit Red Hat Enterprise Linux 5, 64 bit Red Hat Enterprise Linux 5, 32 bit SCAP 1.2 Capabilities: Authenticated Configuration Scanner Common Vulnerabilities and Exposures (CVE)...

Validation Number: 129 Vendor: McAfee Product Name: Policy Auditor Product Major Version: 6.2 Product Version Tested: 6.2.0.231 Tested Platforms: Microsoft Windows 7, 64 bit Microsoft Windows 7, 32 bit Microsoft Windows Vista, SP2, 32 bit Microsoft Windows XP Pro, SP3, 32 bit Red Hat Enterprise Linux 5, 64 bit Red Hat Enterprise Linux 5, 32 bit SCAP 1.2 Capabilities: Authenticated Configuration Scanner Common Vulnerabilities and Exposures (CVE) Validated Product Vendor...

Validation Number: 127 Vendor: Center for Internet Security Product Name: CIS-CAT Pro Assessor (formerly Configuration Assessment Tool (CIS-CAT)) Product Major Version: 3 Product Version Tested: 3.0.00 Tested Platforms: Microsoft Windows 7, 64 bit Microsoft Windows 7, 32 bit Microsoft Windows Vista, SP2, 32 bit Microsoft Windows XP Pro, SP3, 32 bit Red Hat Enterprise Linux 5, 64 bit Red Hat Enterprise Linux 5, 32 bit SCAP 1.2 Capabilities: Authenticated Configuration Scanner...

Internet of Things (IoT) technology is becoming more pervasive in the home environment. These technologies are increasingly used by non-technical users who have little understanding of the technologies or awareness of the security and privacy implications of use. We conduct research to help improve consumers' security and privacy experiences and outcomes when using IoT, with a specific focus on smart home devices. Pursuant to September 29, 2026, Executive Order 14434: Inaugurating the Era of Super Intelligence. AI has been changed to SI except when referring to previously completed work and...

Short URL: https://csrc.nist.gov/phishing Phishing continues to be an escalating cyber threat facing organizations of all types and sizes, including industry, academia, and government. Our team performs research to understand phishing within an operational (real-world) context by examining user behaviors during phishing awareness training exercises. Our projects provide insights into users’ rationale and role in early detection, and how these might be scaffolded with technological solutions. Recent efforts have focused on the NIST Phish Scale, a method for rating the human detection...

Call for Proposals 4.B Cost As the cost of a public-key cryptosystem can be measured on many different dimensions, NIST will continually seek public input regarding which performance metrics and which applications are most important. If there are important applications that require radically different performance tradeoffs, NIST may need to standardize more than one algorithm to meet these diverse needs. 4.B.1 Public Key, Ciphertext, and Signature Size Schemes will be evaluated based on the sizes of the public keys, ciphertexts, and signatures that they produce. All of these may be...

CCE entries are currently assigned to configuration issues by members of the CCE Content Team and posted on the public CCE Web site. Operating system vendors are encouraged to coordinate with the CCE Content Team to have CCEs assigned to their configuration controls and/or new platforms. Please contact cce@nist.gov for more information. Typically, a CCE Content Team Analyst first encounters a configuration issue in one of two ways: (1) The most common way an analyst encounters a configuration issue is a configuration guidance statement is in a resource document or audit tool. For example,...

Autonomous systems must function correctly in an enormous range of environments. For example, self-driving cars must deal with lighting, rain, fog, pedestrians, animals, other vehicles, road markings, signs, etc. How do we ensure that autonomous systems are safe in such complex and rapidly changing environments, when conventional test coverage and formal verification methods cannot be applied? Achieving assured autonomy in any environment requires methods for measuring the input space, to show that the test environment adequately covers real-world conditions that may be encountered....

These are reference sources for frameworks, algorithms validation, software assurance, testing, and other measurements related to information security. Automated Combinatorial Testing for Software Combinatorial or t-way testing is a proven method for more effective software testing at lower cost. The research toolkit can make sure that there are no simultaneous input combinations that might inadvertently cause a dangerous error. Cryptographic Algorithm Validation Program (CAVP) The NIST Cryptographic Algorithm Validation Program provides validation testing of Approved (i.e.,...

Official comments on the Third Round Candidate Algorithms should be submitted using the "Submit Comment" link for the appropriate algorithm. Comments from the pqc-forum Google group subscribers will also be forwarded to the pqc-forum Google group list. We will periodically post and update the comments received to the appropriate algorithm. All relevant comments will be posted in their entirety and should not include PII information in the body of the email message. Please refrain from using OFFICIAL COMMENT to ask administrative questions, which should be sent to pqc-comments@nist.gov The...

Information about the CVP exam can be found here: https://home.pearsonvue.com/nist-cmvp The CVP exam is now available. Candidates (FIPS 140 testers) from one of the Cryptographic and Security Testing labs should have the lab’s CVP certification exam POC send an email to NIST CMVP (cmvplab@nist.gov) with the subject line "CVP Test Registration" and the Registration Spreadsheet Template (below) completed and attached. More than one candidate may be listed in the spreadsheet. Associated Documents: CVP Certification Guide PearsonVue ID Policy Candidate Information Spreadsheet...

Online Informative References Submissions We welcome your participation in the Online Informative Reference (OLIR) Program. The NISTIR 8278Ar1 (Revision 1) National Online Informative References (OLIR) Program: Submission Guidance for OLIR Developers contains detailed participation requirements and all procedures involved during the life cycle. Developers of Informative References considering a submission are welcome to contact NIST with questions. Questions and draft Informative Reference documents should be directed to olir@nist.gov. Submitting parties can expect to hear back from NIST...

The NIST PQC team will host talks -- open to the public -- relating to the 3rd Round of the NIST PQC standardization process. Date Speaker Title Media March 26, 2021 11:00am - 12:00pm* Prasanna Ravi Temasek Labs, Nanyang Technological University Sujoy Sinha Roy Graz University of Technology Side-Channel Analysis of Lattice-based PQC Candidates Presentation Video February 23, 2021 11:00am - 12:00pm David Jao University of Waterloo Implementation of isogeny-based cryptography Presentation Video...

Validation Number: 144 Vendor: Arctic Wolf Product Name: Arctic Wolf Risk Scan Engine Product Major Version: 6 Product Version Tested: 6.3.5 Tested Platforms: Microsoft Windows 7, SP1, 32-bit Microsoft Windows 7, SP1, 64-bit Microsoft Windows Vista, SP2 Microsoft Windows 8.1 SP0 32-bit Microsoft Windows 8.1 SP0 64-bit Microsoft Windows 10 SP0 32-bit Microsoft Windows 10 SP0 64-bit Microsoft Windows Server 2012 R2 SP0 64-bit Red Hat Enterprise Linux 6 32-bit Red Hat Enterprise Linux 6...

Participating in Federal C-SCRM Forum Participation in the Forum, including events and online exchanges, is open to: federal C-SCRM program managers federal personnel who have a dedicated and recurring responsibility for performing C-SCRM functions federal contractors who provide direct C-SCRM support (upon request by their federal sponsor and approval by the Forum co-hosts). The Forum may establish working groups or study groups and welcomes all suggestions to the co-hosts. NIST is hosting the Forum as part of its mandate under the SECURE Technology Act and the Federal...

Background NIST cryptography standards (Federal Information Processing Standards, or “FIPS”) and other publications (typically specified in the Special Publication (SP) 800 series) are intended to protect non-national security federal information and information systems. Outside the Federal Government, these publications are voluntarily relied upon across many sectors to promote economic development and protect sensitive personal and corporate information. Cryptography standards and other publications must be reviewed and maintained regularly because of rapid technological advances, the...

Table 2 identifies and describes the decision options available for handling publications. The Crypto Publication Review Board will make its decision proposals and final recommendations to NIST management based on these options. Table 2. Publication Decision Options Publication Decision Option Description Standards (FIPS) NIST Special Publications Reaffirm The publication content is confirmed as current and remains unchanged. NIST determines the publication is current and needs no changes. NIST adds "Publication is current as of <date>."...

Validation Number: 145 Vendor: McAfee Product Name: McAfee Policy Auditor Product Major Version: 6 Product Version Tested: 6.5.0.263 Tested Platforms: Microsoft Windows 10 SP0 32-bit Microsoft Windows 10 SP0 64-bit Microsoft Windows Server 2012 R2 SP0 64-bit Red Hat Enterprise Linux 7 64-bit SCAP 1.3 Capabilities: Authenticated Configuration Scanner Common Vulnerabilities and Exposures (CVE) Option Validated Product Vendor Provided SCAP Information...

A workshop was held on April 27-29th, 2021 to discuss entropy validations. The slides and recording from the workshop are available on the NIST Events page: https://www.nist.gov/news-events/events/2021/04/sp-800-90b-entropy-source-validation-workshop.

Our conference and journal papers on assured autonomy and explainable AI. We try to include links to the full papers, but for those not yet linked, please contact us for a copy: kuhn@nist.gov. Papers 2025 Lanus, E., Lee, B., Chandrasekaran, J., Freeman, L. J., Raunak, M. S., Kacker, R. N., & Kuhn, D. R. (2025, March). Data frequency coverage impact on ai performance. In 2025 IEEE International Conference on Software Testing, Verification and Validation Workshops (ICSTW) (pp. 258-267). IEEE. Wei, Q., Sikder, F., Feng, H., Lei, Y., Kacker, R., & Kuhn, R. (2025). SmartExecutor:...

Credits: Ned Goren NED GOREN IT Specialist ITL/CSD/SSA NIST Nedim Goren (Ned) is a security researcher for the NIST Secure Systems and Applications Group. Prior to that Ned was a member of the RMF (FISMA) Team at NIST. Prior to joining NIST, he served as a security control assessor and lead ISSO at the Census Bureau. Ned started conducting security control assessments in 2005, first as a contractor and since 2009 as a federal employee. As lead ISSO, he managed the day-to-day operations of the consolidated Census Bureau ISSOs. At NIST Ned was also a...