Search CSRC

Abstract: Operational Technology (OT) environments often lack comprehensive asset inventories due to a lack of resourcing, limitations of legacy systems, geographically distributed assets, diverse communication protocols, and operational constraints. OT environments also face unique asset management challenge...

Abstract: Organizations increasingly use Internet of Things (IoT) products for the mission benefits they can offer, but care must be taken in the acquisition and implementation of this equipment. Understanding that an IoT product is a system element facilitates an understanding of how the IoT product must be...

Abstract: The Water and Wastewater Systems (WWS) sector plays an important role in our national critical infrastructure. It is important that these utilities are equipped with resources to help them address and reduce their cybersecurity risks. Through the Cybersecurity for the Water and Wastewater Sector pro...

Abstract: The macOS Security Compliance Project (mSCP) provides resources that enable system administrators, security professionals, security policy authors, information security officers, and auditors to secure and assess macOS desktop and laptop, iOS, and visionOS system security in an automated way. This p...

Abstract: Operational Technology (OT) backups are vital for recovery from reliability or cyber incidents. Effective backup management in an OT environment involves integrating backups into the change management process, creating them regularly, testing them, and reviewing them during recovery exercises.

Abstract:

Abstract:

Abstract:

Abstract: N/A

Abstract: Throughout Fiscal Year 2025 (FY 2025) — from October 1, 2024, through September 30, 2025 — the NIST Information Technology Laboratory (ITL) Cybersecurity and Privacy Program successfully responded to numerous challenges and opportunities in security and privacy. This Annual Report highli...

Abstract: Industrial Control Systems (ICS) that operate manufacturing environments play a critical role in the supply chain. Manufacturing organizations rely on control systems to monitor and control physical processes that produce goods for public consumption. These same systems are facing an increasing numb...

Abstract: The report proposes a conceptual aggregation model for software acquisitions. The proposed approach relies on the immutability and auditability of blockchain technology. The model also enables automated, dynamic queries to the National Vulnerability Database (NVD) to continuously identify newly disc...

Abstract: A RESTful API platform is a stateless architectural framework that leverages standard HTTP protocols to manage and exchange data as "resources," serving as the primary bridge for communication between modern web applications. This alignment with Web is the reason they are also called Web APIs and re...

Abstract: The protection of controlled unclassified information (CUI) resident in nonfederal systems and organizations is of paramount importance to federal agencies and can directly impact the ability of the Federal Government to successfully conduct its essential missions and functions. This publication pro...

Abstract: A security configuration checklist is a document that contains instructions, procedures, or machine-readable and executable content to configure an IT product to a specific risk posture for an operational environment, verify that the product has been configured properly, identify unauthorized config...

Abstract:

Abstract: High-performance computing (HPC) systems provide fundamental computing infrastructure for large-scale and complex simulations, big data analysis, and the training of artificial intelligence (AI) and machine learning (ML) models, all at exceptional speeds. Securing HPC systems is essential to safegua...

Abstract: Cryptography is often used in an information technology security environment to protect data that is sensitive, has high value, or is vulnerable to unauthorized disclosure or undetected modification during transmission or while in storage. Cryptography relies upon two basic components...

Abstract: This Special Publication serves as a technical extension of FIPS 205, the specification for the Stateless Hash-based Digital Signature Algorithm (SLHsig). While standard SLHsig parameter sets are designed to maintain full security for up to 2^64 signatures, the resulting signature sizes and/or verif...

Abstract: This document introduces the white paper series titled Applying 5G Cybersecurity and Privacy Capabilities. This series is being published by the National Cybersecurity Center of Excellence (NCCoE) 5G Cybersecurity project. 5G introduced new security capabilities in the standards focusing on securing...

Abstract: The Domain Name System (DNS) is an integral part of any enterprise network architecture. An attack against the DNS infrastructure of an enterprise threatens every network operation in that enterprise. DNS operations are composed of different roles that each have their own set of security considerati...

Abstract: Mobile Driver’s Licenses, and Verifiable Digital Credentials more broadly, represent an emerging technology with the capability to enhance the methods we use to prove identity both in-person and online. Many sectors stand to benefit from this emerging technology, including financial institutio...

Abstract: Modern enterprise IT systems rely on a family of application programming interfaces (APIs) for integration to support organizational business processes. Hence, a secure deployment of APIs is critical for overall enterprise security. This, in turn, requires the identification of risk factors or vulne...

Abstract: This guide demonstrates how organizations can discover, identify and label unstructured data using data classification practices. Performing Data Classification Practices allows an organization to know its data and apply technologies that minimize the risk of valuable or sensitive data being lost or...

Abstract: Few software development life cycle (SDLC) models explicitly address software security in detail, so secure software development practices usually need to be added to each SDLC model to ensure that the software being developed is well-secured. This document recommends the Secure Software Development...