Search CSRC

Purpose To evaluate current personal identity verification technologies, systems, components, techniques, and procedures that would satisfy requirements for identifying Federal employees and contractors seeking access to Federal facilities and information systems. Topics Personal identity source document (ISD) authentication; verifying a claim of identity using fingerprint or facial images; use of security tokens such as integrated circuit cards for storing and processing identity credentials; communicating with security token reader/writers via electronic contact and contact-less methods;...

(All presentations in .pdf format.) Federal Register Notice Announcing Meeting Minutes SP 800-53 Rev. 4, Security and Privacy Controls for Federal Information Systems and Organizations Ron Ross, NIST Fellow, Computer Security Division, NIST Dom Cussatt, Senior Policy Advisor, U.S. Department of Defense Greg Hall, Identity Management Program Manager, ODNI/CIO Tim Ruland, Chief IT Security Officer, U.S. Census Bureau OIG Perspectives on Cloud Computing and FISMA (OIG Panel) Gale Stone, (Moderator), Deputy Assistant Inspector General for Audit, SSA Dr. Brett M. Baker, Assistant IG for...

NIST and the Department of Health and Human Services (HHS), Office for Civil Rights (OCR) are pleased to co-host the 11th annual conference, Safeguarding Health Information: Building Assurance through HIPAA Security, on October 18-19, 2018 at the Hyatt Regency, Washington, D.C. The conference will explore the current healthcare cybersecurity landscape and the Health Insurance Portability and Accountability Act (HIPAA) Security Rule. This event will highlight the present state of healthcare cybersecurity, and practical strategies, tips and techniques for implementing the HIPAA Security Rule....

Quick links (MPTS 2025): Call for talks (PDF file); Talk proposal form (PDF file); Registration page (ZoomGov); Workshop dates and place: November 17–20, fully virtual. Attendance: Attendance is free, but requires online registration Daily schedule: To be announced in late September 2025 Call for talks (explaining two types of talks): Regular talk: Submit by September 10 (general contribution talk) "Preview talk": Submit by November 03 (in scope of the Threshold Call), aligned with a "Preview Writeup" (LaTeX template available: .ZIP, .PDF) Introduction The NIST...

The NIST Post-Quantum Cryptography Standardization Process has entered the third phase, in which 7 third round finalists and eight alternate candidates are being considered for standardization. NIST held the third NIST PQC Standardization Conference June 7-9, 2021 to discuss various aspects of these candidates, and to obtain valuable feedback for the final selection(s). Each submission team, of the 15 finalists and alternates, was invited to give a short update on their algorithm. The conference was held virtually. Call for Papers Agenda (includes links to on-demand videos) On-Demand...

Over the last two decades a very wide range of standards have been developed covering a wide range of aspects of cyber security. These documents have been published by national and international formal standardisation bodies, as well as by industry consortia. Many of these standards have become very widely used - to take just one example, the ISO/IEC 27000 series of standards has become the internationally adopted basis for managing corporate information security.Despite their wide use, there will always be a need to revise existing security standards and to add new standards to cover new...

Three days of talks and briefs about threshold schemes, from experts in the area. Quick Links Scroll down to see the embedded videos of the presentations Direct links to slide-decks and videos (See under "Schedule — list of presentations") Workshop program (PDF file updated 2020-Nov-20: agenda, bios of talks' speakers, abstracts, collaborators) Call for participation (PDF file) NIST Multi-Party Threshold Cryptography project (Another webpage) NISTIR 8214A (PDF file) Description Introduction The MPTS2020 workshop is intended as an informal consultation step about the...

(All presentations in .pdf format.) Federal Register Notice Announcing Meeting Minutes Possible Government-Wide Information Security Enhancements Some Informal and Unofficial Thoughts Bruce Brody, ISPAB Board Member Federal Enterprise Architecture Security and Privacy Profile Sallie McDonald, U.S. Department of Homeland Security Cyber Security Practitioner (CSP) Professionalization Program: An Approach for Professional Development - Based on the Program Established at the Department of Veterans Affairs Bruce Brody, ISPAB Board Member A New World of Clues: NIST Provides Resources to...

NIST held a Random Number Generation Workshop from July 19-22, 2004 in Gaithersburg, Maryland. See below for the workshop agenda and selected presentations. Workshop Agenda Comments Received on Draft ANS X9.82 Random Number Generation Presentations: Why Random Numbers for Cryptography, Miles Smid, Orion Security Solutions The Strategy Behind the Proposed Random Number Generation Standard, Paul Timmel X9.82 Part 1: Overview and Basic Principles, Don Johnson ANSI X9.82, Part 3: Deterministic Random Bit Generators (DRBGs), Elaine Barker, NIST Five DRBG Algorithms Based on Hash...

(All presentations in .pdf format.) Federal Register Notice (None Provided for this Meeting) Minutes (None Provided) Wednesday, December 2, 2009 Cloud Computing and the US Government Trusted Internet Connection (TIC) Program Peter Tseronis, Senior Advisor, DOE Peter Mell, NIST Lisa Schlosser, Board Member Health IT Ashley Corbin, CMS/OIS Jodi Daniel, ONC/HHS Gail Belles, VA Kitt Winter, HIT/SSA Jaren Doherty, Board Member Smart Grid Jules Polonetsky, Future of Privacy Forum Dave Dalva, CISCO Lynn McNulty, Board Member Thursday, December 3, 2009 Research and Development for Secure...

On Thursday, May 20, 2010, NIST held a 1-day forum & workshop on Cloud Computing. The purpose of this forum & workshop -- The Federal Chief Information Officer is charged with improving performance and lowering the cost of government operations by leveraging cloud computing. The Federal CIO has asked the National Institute of Standards and Technology (NIST) to lead federal efforts on standards for data portability, cloud interoperability, and security. NIST's mission, as a non-regulatory federal agency within the U.S. Department of Commerce, is to promote U.S. innovation and industrial...

Presentations & Speakers at a Glance: NARA's Controlled Unclassified Information (CUI) Implementation Guidance for Executive Order 13556, Patrick Viscuso, NARA; and Telework Reference Architecture, Oscar Ahumada, DHS. NOTE: FORUM MEETINGS ARE OPEN TO ONLY FEDERAL/STATE EMPLOYEES, HIGHER EDUCATION EMPLOYEES, AND THEIR DESIGNATED SUPPORT CONTRACTORS. REGISTRANTS MUST USE A .GOV, .EDU, OR .MIL ADDRESS FOR SIGN-UP. SUPPORT CONTRACTORS MUST INDICATE THE AGENCY OR ORGANIZATION THEY SUPPORT. The Federal Computer Security Program Managers Forum (the "Forum") is an informal group...

Full Workshop Details NIST hosted this workshop to focus on technical and administrative efforts to increase trust online by improving the Public Key Infrastructure (PKI) certificate marketplace supporting Secure Socket Layer (SSL) and Transport Layer Security (TLS). The workshop provides an opportunity for industry, research and academia communities, and government sectors, to review, promote and move toward consensus on emerging industry standards and guidelines and to learn about NIST's current cryptographic research, activities, programs and standards development. Topics expected to be...

Presentations & Speakers at a Glance: Overview of SP 800-88, Revision 1, Guidelines for Media Sanitization, Andy Regenscheid, NIST. NOTE: FORUM MEETINGS ARE OPEN TO ONLY FEDERAL/STATE EMPLOYEES, HIGHER EDUCATION EMPLOYEES, AND THEIR DESIGNATED SUPPORT CONTRACTORS. REGISTRANTS MUST USE A .GOV, .EDU, OR .MIL ADDRESS FOR SIGN-UP. SUPPORT CONTRACTORS MUST INDICATE THE AGENCY OR ORGANIZATION THEY SUPPORT. The Federal Computer Security Program Managers Forum (the "Forum") is an informal group sponsored by the National Institute of Standards and Technology (NIST) to promote the sharing...

Presentations & Speakers at a Glance: Trustworthy Email, Scott Rose, NIST; Best Practices for PIV Authentication, Hilde Ferraiolo, NIST; and Baseline Tailor, SW-aided Security Control Selection, Joshua Lubell, NIST. NOTE: FORUM MEETINGS ARE OPEN TO ONLY FEDERAL/STATE EMPLOYEES, HIGHER EDUCATION EMPLOYEES, AND THEIR DESIGNATED SUPPORT CONTRACTORS. REGISTRANTS MUST USE A .GOV, .EDU, OR .MIL ADDRESS FOR SIGN-UP. SUPPORT CONTRACTORS MUST INDICATE THE AGENCY OR ORGANIZATION THEY SUPPORT. The Federal Computer Security Program Managers Forum (the "Forum") is an informal group...

Full Workshop Details Cryptography and security applications make extensive use of random numbers and random bits, particularly for the generation of cryptographic keying material. A key to initiate a cryptographic algorithm needs to be unpredictable and statistically unique, that is, to have at most a negligible chance of repeating the value of a previously selected key. Selecting a key at random ensures that there is no known structure to the key selection process that an adversary might be able to use to determine the key, other than by an exhaustive search. NIST is in the process of...

Please join us as we introduce a Trustworthy Supplier Framework, a toolbox developed to assist in understanding component protection options and inform better buying decisions as part of supply chain risk management. Although this effort began in support of the Department of Defense, the Institute for Defense Analyses is now seeking to engage a broader set of stakeholders in industry, government and academia to provide input and shape the Framework's contents to best address supply chain risk in commercial-off-the-shelf (COTS) products. The Trustworthy Supplier Framework maps various existing...

Purpose: Convene users of the NIST Risk Management Framework to discuss how the RMF is currently being used in the federal government and the private sector, including successes and challenges with its use, and opportunities for enhancement. This half day workshop will include: A policy update from the Office of Management and Budget; An update on the NIST Risk Management Framework and the Cybersecurity Framework; Industry panels on risk management, automation, and industry approaches to risk management in the system development lifecycle; A risk management tool demonstration; and...

Practical, interactive workshop on using the Baldrige Cybersecurity Excellence Builder (BCEB) to assess the effectiveness and efficiency of your organization’s cybersecurity risk management program assess the cybersecurity results you achieve identify your priorities for improving your cybersecurity risk management efforts The Baldrige Cybersecurity Excellence Builder is a voluntary self-assessment tool based on the Cybersecurity Framework, managed by NIST’s Applied Cybersecurity Division, and the Baldrige Excellence Framework, compiled by the Baldrige Performance Excellence Program at...

The National Institute of Standards and Technology (NIST), in coordination with the Department of Defense (DoD) and the National Archives and Records Administration (NARA), is hosting an informational workshop providing an overview of Controlled Unclassified Information (CUI), the Defense Acquisition Regulations System (DFARS) Safeguarding Covered Defense Information and Cyber Incident Reporting Clause, and NIST Special Publications 800-171 and 800-171A. This workshop will also feature panels of Federal Government representatives discussing expectations for evaluating evidence and implementing...

We are pleased to announce that a teleconference introducing the SCAP Version 2 effort has been scheduled for Thursday, October 4, 2018 at 1:00 PM Eastern time. David Waltermire from the National Institute of Standards and Technology (NIST) and Jessica Fitzgerald-McKay from the National Security Agency (NSA) will present the concepts and plans for moving forward. The NIST White Paper describing the transition to SCAP Version 2 is available here: https://www.nist.gov/publications/transitioning-scap-version-2 As this is a community-driven effort, we encourage and appreciate your...

On Tuesday, September 10, 2019, NIST’s National Cybersecurity Center of Excellence Supply Chain Assurance project team is having an Industry Day, starting at 8:30am. The purpose of this Industry Day is to identify the issues and challenges of Cyber Supply Chain Risk Management (C-SCRM) in enterprises as input to a potential NCCoE demonstration project. NIST starts the day by presenting its preliminary plans for this project. Then, there will be short presentations from a few stakeholders, sharing their views of the challenges enterprises face when verifying that their purchased computing...

The purpose of this workshop is to discuss the National Institute of Standards and Technology’s (NIST’s) proposed approach for helping industry and government improve the security of their DevOps practices. During this workshop, NIST will solicit proposed approaches from the participating organizations and hear from the community about DevSecOps-related topics that NIST could tackle. The findings from the workshop will inform NIST in the creation of new applied guidance to fill any gaps, updates to existing guidance, and potential development of a National Cybersecurity Center of Excellence...

At this conference, we will discuss various aspects of the candidate algorithms and obtain valuable feedback for informing decisions on standardization. NIST will invite the submission teams for both the selected algorithms, as well as the algorithms advancing to the fourth round, to give an update on their algorithms. Call for Papers (closed 9/15/2022) On-Demand Videos Session I - Welcome and Algorithm Updates Session II - Side Channels Session III - NSA Talk/Security Session IV - Candidate Updates/Hardware I Session V - Migration Session VI - Hardware II Conference Inquiries:...

Read the Code of Conduct for NIST Meetings Call for Submissions (Submission Deadline: March 30, 2025) On March 5, 2025, NIST released the draft Cybersecurity White Paper (CSWP) 39, Considerations for Achieving Crypto Agility - Strategies and Practices. This white paper provides an in-depth survey of current approaches and considerations to achieving crypto agility. It discusses challenges, trade-offs, and some approaches to providing operational mechanisms for achieving crypto agility while maintaining interoperability. It also highlights some critical working areas that require additional...