Search CSRC

XCCDF Benchmark: XCCDF Sample for Cisco IOS XCCDF Sample for Cisco IOS Status: draft (as of 2004-10-07) Version: 0.12.1 Applies to: Cisco IOS Routers version 11.x Cisco IOS Routers version 12+ Contents 1. Introduction 2. Tailoring Values 2.1. IOS - line exec timeout value 2.2. Logging level for buffered logging 3. Rules 3.1. Management Plane Rules 3.1.1. IOS 11 - no IP finger service 3.1.2. IOS 12 - no IP finger service 3.1.3. Require exec session timeout on admin sessions 3.2. Control Plane Rules 3.2.1. Disable tcp-small-servers 3.2.2. Disable udp-small-servers...

Accessing Enhanced Security Requirements for Controlled Unclassified Information Purpose Assessment procedures and a methodology that can be employed to conduct assessments of the enhanced security requirements in NIST Special Publication 800-172. Scope Assessments conducted using the SP 800-172A procedures are guided and informed by the system security plans for the organizational systems processing, storing, or transmitting CUI. The assessments focus on the overall effectiveness of the security safeguards intended to satisfy the SP 800-172 enhanced security requirements. Download the SP...

Conference presentations on combinatorial methods for assured autonomy How Can we Provide Assured Autonomy? International Conference on Cyber Security, Jan 8-10, 2024 PDF Assured Autonomy through Combinatorial Methods, 6th IEEE Conference on Dependable and Secure Computing, November 7-9, 2023. PDF Combinatorial Coverage for Assured Autonomy. The 1st IEEE International Workshop on Assured Autonomy, Artificial Intelligence and Machine Learning, Charlotte, October 31, 2022 PPT with audio narration MP4 video Assured Autonomy - Problems and Solutions, USAF Testing Colloquium,...

The following sections detail the Schematron rules for SCAP 1.4. SCAP Schematron Rules The SCAP Schematron Rules are ISO Schematron rules written to check many of the requirements documented in NIST SP 800-126 Rev 4. They are for informational purposes only; they do not supercede the requirements in the specification. The rules are subject to change at anytime. Instructions on how to use the resource are provided in the included scap-rules-readme.txt. Version: 1.4.0 Released: 12/11/2025 Download: SCAP 1.4 Schematron File

CPE 3.0 is the next major revision of Common Platform Enumeration (CPE), now in early development at NIST. This page tracks the effort and how to take part. For the current published version, see Common Platform Enumeration (CPE). About the CPE 3.0 effort CPE 2.3 has been in wide use for more than a decade. Implementation experience over that period, together with current security automation needs, has surfaced a set of issues worth addressing in a future version. The CPE 3.0 effort will evaluate how platforms and products are identified for current security automation use cases, including...

Publications: Daniel Borbor, Lingyu Wang, Sushil Jajodia, Anoop Singhal,"Securing Networks Against Unpatchable and Unknown Vulnerabilities Using Hetrogeneous Hardening Options", 31st IFIP Conference on Data and Application Security and Privacy (DBSEC 2017), Philadelphia, Pennsylvania, July 19-21, 2017. Xiaoyan Sun, Anoop Singhal, Peng Liu,"Towards Actionable Mission Impact Assessment in the Context of Cloud Computing", 31st IFIP Conference on Data and Application Security and Privacy (DBSEC 2017), Philadelphia, Pennsylvania, July 19-21, 2017. Changwei Liu, Anoop Singhal, Duminda...

These are standard publications and guidelines that provide perspectives and frameworks to inform, measure, and manage cybersecurity vulnerabilities and exposures. NIST SP 800-55 Vol. 1 Measurement Guide for Information Security: Volume 1 — Identifying and Selecting Measures Volume 1, Identifying and Selecting Measures, provides a flexible approach to the development, selection, and prioritization of information security measures. This volume explores both quantitative and qualitative assessment and provides basic guidance on data analysis techniques as well as impact and likelihood...

***Disclaimer: Items in the following lists are provided for research purposes, and do not imply endorsement by NIST.*** U.S. Government Activities / Initiatives Related Standards / Best Practices C-SCRM Research / References Involved Standards Organizations / Associations U.S. Government Activities / Initiatives Committee on National Security Systems Directive (CNSSD) 505 - "...provides the guidance for organizations that own, operate, or maintain [National Security Systems (NSS)] to address supply chain risk and implement and sustain SCRM capabilities". Comprehensive National...

NPIVP maintains pre-validation lists for PIV Card Applications and PIV Middleware. Participation on the lists is voluntary and is a joint decision by the vendor and the NPIVP test facility. Products are listed alphabetically by vendor name. Posting on the list does not imply guarantee of final validation. PIV Card Application Pre-Validation List PIV Middleware Pre-Validation List

Algorithm Specifications Algorithm specifications for Key-Based KDFs (SP800-108) are available from the Cryptographic Toolkit. Algorithm Validation Testing Requirements The algorithm validation testing requirements for SP 800-108 are specified in: The SP800-108 Key Derivation Function Validation System (KBKDFVS). Testing Notes Prerequisites for KBKDF testing are listed in the CAVP Frequently Asked Questions (CAVP FAQ) General Question GEN.5. As of 1-1-2016, TDES KO2 encrypt is no longer compliant. (See SP800-131A Revision 1.) Test Vectors Use of these test vectors does not...

Algorithm Specifications Algorithm specifications for current FIPS-approved and NIST-recommended random number generators are available from the Cryptographic Toolkit. Current testing includes the following algorithm: DRBG (SP 800-90A) Algorithm Validation Testing Requirements Deterministic Random Bit Generators (DRBG) The DRBG Validation System (DRBGVS) specifies validation testing requirements for the DRBG algorithm in SP800-90A . Testing Notes Prerequisites for DRBG testing are listed in the CAVP Frequently Asked Questions (CAVP FAQ) General Question GEN.5. Test Vectors...

Blogs… Cybersecurity Risk Management: Choosing the Right Approach to Get the Job Done, June 2023. Taking Measure Rethinking Cybersecurity from the Inside Out, R. Ross, November 2016. Bulletins… ITL Bulletin Rethinking Security though Systems Security Engineering, R. Ross, L. Feldman, G. Witte, December 2016. Videos… The Need for Systems Thinking in Cybersecurity, R. Ross, October 2021.

SCAP Checklists Security checklists (or benchmarks) that provide detailed low level guidance on setting the security configuration of operating systems and applications. SCAP Enumeration and Mapping Data Feeds SCAP related reference data for tool developers, integrators and SCAP Validated Product users.

Overlay Submission Documents All documents must be complete and submitted to [email protected] for inclusion in the SCOR. Download All Files Download all files below as .ZIP or select individual files from list Submission Form Participation Agreement (Public Org) and Participation Agreement (Federal Gov) Overlay Technical Criteria (Not a download; references section below) Overview of the SCOR Submission Process Organizations sanitize their security control overlay for public review and ensure overlay is based on NIST SP 800-53 security controls. Organizations...

The Name Matching specification defines the procedures for comparing Well-formed Names (WFNs) to each other so as to determine whether they refer to some or all of the same products. CPE Name Matching Resources Name Matching CPE 2.3 Name Matching Resources (August 2011) Documentation: NISTIR 7696

The Naming specification defines the logical structure of Well-formed Names (WFNs), URI bindings, and formatted string bindings, and the procedures for converting WFNs to and from the bindings. CPE Naming Resources Release 2.3 CPE 2.3 Naming Resources (August 2011) XML Schema Files: [what is a schema?] CPE 2.3 Naming (XSD 1.0) Documentation: NISTIR 7695

Data block matrix examples and code: https://github.com/usnistgov/blockmatrix - implementations in Java and in Go https://github.com/PM-Master/blockmatrix - Java API to manage users and attributes using a blockmatrix. https://github.com/PM-Master/NDAC - implementation as a component of Next Gen Database Access Control (NDAC) Hyperledger Fabric drop-in component coming Dec. 5, 2022 For more, see here

As of November 7, 2020, the CMVP requires that all FIPS 140-2 and FIPS 140-3 module validation submissions include documentation justifying conformance to SP 800-90B if applicable. SP 800-90B, along with FIPS 140-3 Implementation Guidance documents (IGs) D.J, D.K, and D.O, outline the requirements for an entropy source to be included in a FIPS-approved cryptographic module. With the publication of SP 800-90C, the CMVP is also accepting submissions for Random Bit Generators. The associated IG is IG D.T. The list of validated entropy sources can be found in the Entropy Source Validation...

The Entropy Validation Server Test System is the process by which a lab may submit all information around an entropy source to receive a validation. This is done by interacting with the Web API offered by the Entropy Validation Server. For information on the protocol, reporting issues, and requesting access, view the GitHub page: https://github.com/usnistgov/esv-server. The same server also accepts submissions for Random Bit Generators demonstrating conformance to SP 800-90C. The protocol is based on ACVP. Information on that can be found here: Automated Cryptographic Validation Testing....

ATTENTION: The Project Lead is no longer at NIST. Inquiry responses may be delayed. NIST SP 800-216, Recommendations for Federal Vulnerability Disclosure Guidelines, is based on the policies and processes shown in the figure below. Minimal changes have been made to support vulnerability management at the local and federal levels.

Access the tools and libraries that support developing, converting, validating, and working with OSCAL content. This page includes developer utilities, APIs, command-line tools. OSCAL Tools and Libraries: Converter utilities into JSON from XML and into XML from JSON Command line data conversion tool: OSCAL Java CLI A Java API for OSCAL CSX and XSLT OSCAL Tools

2013 [04-05-2013] -- The First International Cryptographic Module Conference Bringing experts together from around the world to confer on the topic of cryptographic modules. Discussion on technical topics underlying the implementation of a cryptographic module including physical security, key management, side-channel analysis, key management, cryptographic algorithm implementation testing, standardization (FIPS 140-2, ISO/IEC 19790), validation programs and more. September 24-26, 2013 in Gaithersburg, MD. Registration February through August 2013. Details at: ICMC 2013 2012...

Call for Proposals Each submission must include: a complete written specification a detailed performance analysis Known Answer Test values a thorough description of the expected security strength an analysis of the algorithm with respect to known attacks a statement of advantages and limitations. Further details are described below. 2.B.1 A complete written specification of the algorithms shall be included, consisting of all necessary mathematical operations, equations, tables, and diagrams that are needed to implement the algorithms. The document shall also include a design...

DISCLAIMER: The Cryptographic Module Validation Program (CMVP) Modules In Process and Implementation Under Test (IUT) Lists are provided for information purposes only. Participation on the list is voluntary and is a joint decision by the vendor and Cryptographic Security and Testing Laboratory (CSTL). Modules are listed alphabetically by vendor name. Posting on the list does not imply guarantee of final validation. The status / state of each cryptographic module in the process is identified below with the current action in parenthesis. Modules In Process List Cost Recovery (NIST Billing...

The following overlays are maintained for archival purposes only. They are either not based on the current security and privacy controls in NIST SP 800-53 or the overlay contact information is no longer accurate. Email Messaging Systems Overlay Name: NIST SP 800-177, Rev. 1, Email Messaging Systems Overlay Publication Date: February 19, 2019 Technology or System: Email Messaging Systems Overlay Author: Scott Rose, NIST Overview: Overlay for email messaging systems using the SP 800-53, Revision 4 controls. Email system is taken to mean any system (as defined by FIPS 199), that...