Search CSRC

ARCHIVED PROJECT: This project is no longer being supported. The content is no longer being updated, and the information may be outdated. The Program Review for Information Security Assistance (PRISMA) project was last updated in 2007; NIST Interagency Report (IR) 7358 and the corresponding PRISMA tool continue to serve as useful resources for high-level guidance and as a general framework, but may not be fully consistent with changes to requirements, standards and guidelines for securing systems. Option two of a PRISMA review focuses on the strategic aspects and the technical...

Archived. This page is archived for informational purposes only. See End-of-Life Announcement: NIST SCAP Validation Program. Security Content Automation Protocol (SCAP) Version 1.3 Validation Program Test Requirements (NIST IR 7511 rev. 5) released April 2018 includes updates pertaining to platforms, component specification test requirements, and introduces module validation as well as the SCAP Inside labeling program. Please see the Summary of Changes table for a complete list of changes between NISTIR 7511 Revision 4 and NISTIR 7511 Revision 5. SCAP Capabilities Authenticated...

Archived. This page is archived for informational purposes only. See End-of-Life Announcement: NIST SCAP Validation Program. Security Content Automation Protocol (SCAP) Version 1.2 Validation Program Test Requirements (NIST IR 7511 Rev. 4) released January 2016 includes updates pertaining to platforms, component specification test requirements, and introduces module validation as well as the SCAP Inside labeling program. Please see the Summary of Changes table for a complete list of changes between NISTIR 7511 Revision 3 and NISTIR 7511 Revision 4. SCAP Capabilities Authenticated...

I. Introduction NIST scientific or technical Public Working Groups bring together organizations actively engaged in the specific field of interest and consist of subject-matter experts who collaborate to determine best practices and to develop consensus standards. During the past decade, NIST has convened multi-disciplinary cloud computing working groups to take on specific challenges that impact the broad US Government adoption of complex cloud-based solutions that combine services from more than one cloud service provider (CSP). The change in technical operations and control dynamics for...

SCAP 1.4 is the current final release of the Security Content Automation Protocol (SCAP). This page lists the publications, schemas, tools, component specifications, identification schemes, metrics, and integrity specifications that comprise SCAP version 1.4. SCAP 1.4 final release Status: Final · Version: 1.4 Publications: NIST Special Publication (SP) 800-126 Rev. 4 and NIST Special Publication (SP) 800-126A Rev. 4. Protocol SCAP: Security Content Automation Protocol Version: 1.4 Status: Final Specification: NIST Special Publication (SP) 800-126 Rev. 4 Specification Annex: NIST...

The Derived Relationship Mapping (DRMs) Analysis Tool provides Users the ability to generate DRMs for Reference Documents with a Focal Document of the Users’ choice. The DRMs are non-authoritative and represent a starting point when attempting to compare Reference Documents. Refer to Sections 3.3 – 3.6 of NISTIR 8278, National Online Informative References (OLIR) Program: Program Overview, Benefits and Uses for additional guidance around understanding and utilizing the tool. After creating a Display Report, Users can download the report in either a comma-separated value (CSV) file format or...

CMVP FIPS 140-2 Management Manual (updated 03-10-2023) The purpose of the CMVP Management Manual is to provide effective guidance for the management of the CMVP, and the conduct of activities necessary to ensure that the standards are fully met. The CMVP Management Manual describes the CMVP process and is applicable to the CMVP Validation Authorities, the CST Laboratories, and the vendors who participate in the program. Consumers who procure validated cryptographic modules may also be interested in the contents of this manual. This manual outlines the management activities and specific...

Post-quantum candidate algorithm nominations are due November 30, 2017. Call for Proposals NIST will form an internal selection panel composed of NIST employees to analyze the submitted algorithms; the evaluation process will be discussed in Section 5. All of NIST’s analysis results will be made publicly available. Although NIST will be performing its own analyses of the submitted algorithms, NIST strongly encourages public evaluation and publication of the results. NIST will take into account its own analysis, as well as the public comments that are received in response to the posting of...

Enhanced Security Requirements for Protecting Controlled Unclassified Information: A Supplement to NIST Special Publication 800-171 Purpose Enhanced security requirements to help protect the confidentiality, integrity, and availability of Controlled Unclassified Information (CUI) associated with critical programs or high value assets from the advanced persistent threat (APT). Scope The enhanced security requirements in NIST SP 800-172 are supplemental and do not impact the basic and derived security requirements contained in NIST SP 800-171, nor the scope of the implementation of the NIST...

Validation Number: 133 Vendor: SAINT Corporation Product Name: SAINT Security Suite Product Major Version: 8 Product Version Tested: 8.7.0 (build 70206.432.2.13.2) Tested Platforms: Microsoft Windows 7, 64 bit Microsoft Windows 7, 32 bit Microsoft Windows Vista, SP2, 32 bit Microsoft Windows XP Pro, SP3, 32 bit Red Hat Enterprise Linux 5, 64 bit Red Hat Enterprise Linux 5, 32 bit SCAP 1.2 Capabilities: Authenticated Configuration Scanner Common Vulnerabilities and Exposures...

Validation Number: 127 Vendor: Center for Internet Security Product Name: CIS-CAT Pro Assessor (formerly Configuration Assessment Tool (CIS-CAT)) Product Major Version: 3 Product Version Tested: 3.0.00 Tested Platforms: Microsoft Windows 7, 64 bit Microsoft Windows 7, 32 bit Microsoft Windows Vista, SP2, 32 bit Microsoft Windows XP Pro, SP3, 32 bit Red Hat Enterprise Linux 5, 64 bit Red Hat Enterprise Linux 5, 32 bit SCAP 1.2 Capabilities: Authenticated Configuration Scanner...

Fireside Chat: Complexity is the new Cyber Adversary The cascading risk that made Lehman Brothers infamous for accelerating the global financial crisis or the Northeast Power Outage that disabled parts of US and Canada in 2003 exemplify how counterparty risk could turn a single breach into a disastrous systemic failure. Cyber risks face similar consequences. They are not enabled simply by individual cyber vulnerabilities, but by the Complex Systems-of-Systems they inhabit. Composed of legacy and new HW, SW and IoT elements connected by myriad channels, haphazardly integrated over many years,...

Private Set Intersection (PSI) enables two (or more) parties, each with a private set, to identify which are the common elements across the sets, while not revealing information about the non-common elements. For example, two persons with privates lists of contacts can use PSI to determine which contacts they have in common. This is a very special case of Multiparty Computation (MPC), with well-known feasible solutions. More generally, a Private Set Operation (PSO) can relate to an arbitrary set operation, where the input sets remain private (i.e., beyond what each party [or coalition of...

- OCIL Schema - Element Dictionary Schema: OCIL Version: 1.0 Release Date: December 29, 2008 VERSION 1.0 The Open Checklist Interactive Language (OCIL) is a language to express a set of questions to be presented to a user and procedures to interpret responses to these questions for the purpose of developing security checklists. Although its intended domain of use is IT security, its generic nature allows for other applications. For instance, it could be used for authoring research surveys, academic course exams, and instructional walkthroughs. This document was originally developed by...

OCIL - The Open Checklist Interactive Language - Schema Element Dictionary - OCIL Schema - Element Dictionary Schema: OCIL Version: 1.1 Release Date: May 20, 2009 VERSION 1.1 The Open Checklist Interactive Language (OCIL) is a language to express a set of questions to be presented to a user and procedures to interpret responses to these questions for the purpose of developing security checklists. Although its intended domain of use is IT security, its generic nature allows for other applications. For instance, it could be used for authoring research surveys,...

Authentication mechanisms such as passwords and multi-factor authentication methods (e.g., smart cards and tokens) provide examples of the challenges involved in creating usable cybersecurity solutions. Our research explores the usage and usability of authentication mechanisms. We focus on how these mechanisms can be improved to aid in their correct, secure employment by different user populations while avoiding user frustration and circumvention. Also see our Youth Security & Privacy research area for publications related to youth passwords. Pursuant to September 29, 2026, Executive Order...

Our team often writes articles or provides presentations that discuss and provide information about human-centered cybersecurity to various audiences, for example, cybersecurity practitioners or fellow researchers. We are co-hosting the Human-Centered Cybersecurity Series for the Redefining Cybersecurity Podcast (see General Human-Centered Cybersecurity -> Podcasts below). Currently, we are conducting a multi-phased research project to understand the interactions between human-centered cybersecurity researchers and practitioners. We hope the results will lead to the creation of mutually...

2022 FIPS 201 Rev. 3 Public Comments Special thanks to those who participated in the workshops and provided technical comments in shaping this standard. The commentators represented a wide range of government and industry organizations including the following (file is in .pdf format): 2020 Draft comments and dispositions 2012 FIPS 201 Rev. 2 Public Comments Special thanks to those who have participated in the workshops and provided valuable technical comments in shaping this standard. The commentators represented a wide range of government and industry organizations,...

Official comments on the Third Round Candidates should be submitted using the "Submit Comment" link for the appropriate algorithm. Comments from the pqc-forum Google group subscribers will also be forwarded to the pqc-forum Google group list. We will periodically post and update the comments received to the appropriate algorithm. All relevant comments will be posted in their entirety and should not include PII information in the body of the email message. Please refrain from using OFFICIAL COMMENT to ask administrative questions, which should be sent to [email protected]. The...

Understanding user perceptions and behavior is critical to achieving security objectives. People are repeatedly bombarded with messages about the dangers lurking on the Internet and are encouraged (or forced) to take numerous security-related actions, often without a clear understanding of why and to what end. We conduct research to discover people’s security and privacy perceptions, attitudes, and behaviors with a goal of developing cybersecurity guidance that: 1) takes into account user needs, skills, and limitations and 2) helps people make sound security decisions. Recent projects include...

The CSOR has allocated the following registration branch for objects defined under the ARPA/Air Force-sponsored Information Object Security (IOS) project: {joint-iso-ccitt(2) country(16) us(840) organization(1) gov(101) csor(3) iosp(3)}. The IOS project was a multi-year effort to investigate and develop advanced security services to the Internet sponsored by the Advanced Research Project Agency (ARPA) and the Air Force. The architecture developed consists of sequences of components specified in ASN.1. Each component, and subsequent sub-type, carries an object identifier. Most of the...

NIST regularly conducts and awards contracts, grants, or cooperative agreements to conduct research into cybersecurity supply chain risk management (C-SCRM) and related topics. The following are relevant research activities: Cyber Risk Analytics: A NIST and GSA-Sponsored grant from 2015-2017 examining the relationship between various risk management practices and publicly disclosed breaches. The Cyber Risk Predictive Analytics Project Cyber Risk Analytics Project Review Workshop (with video) Industry C-SCRM Best Practices: Ongoing work developing case studies exploring effective risk...

Program Goal Human-centered cybersecurity is an approach that considers human needs, motivations, behaviors, abilities, and limitations when developing and implementing cybersecurity products, processes, policies, and services. The Human-Centered Cybersecurity program within the NIST Human-Centered Technologies Group provides research evidence and guidance to policymakers, system engineers, organizational decision makers, and cybersecurity professionals so that they can make better decisions that consider the human element, thereby advancing cybersecurity adoption and empowering people to be...

Validation Number: 139 Vendor: IBM Product Name: IBM BigFix Compliance Product Major Version: 9.2 Product Version Tested: 9.2.6.94 CPE 2.3 Tested Platforms: Red Hat Enterprise Linux 5, 64 bit Red Hat Enterprise Linux 5, 32 bit SCAP 1.2 Capabilities: Authenticated Configuration Scanner Common Vulnerabilities and Exposures (CVE) Validated Product Vendor Provided SCAP Information Dates Tested: 3/7/2016 - 5/16/2016 Report Submitted: 5/19/2016 DTR...

Validation Number: 131 Vendor: IBM Product Name: IBM Endpoint Manager Product Major Version: 9 Product Version Tested: 9.1.1117.0 Tested Platforms: Microsoft Windows 7, 64 bit Microsoft Windows 7, 32 bit SCAP 1.2 Capabilities: Authenticated Configuration Scanner Validated Product Vendor Provided SCAP Information Dates Tested: 9/4/2014 - 10/3/2014 Report Submitted: 10/3/2014 DTR Version: NISTIR 7511 Rev. 3 Validation Test Suite:...