Search CSRC

NIST has published revisions of two Special Publications (SP) that identify security functions and sensitive security parameter generation and establishment methods allowed within the context of the Cryptographic Module Validation Program (CMVP).

Draft NIST Special Publication 800-205, "Attribute Considerations for Access Control Systems," is available for public comment. Please submit comments by April 1, 2019.

The National Institute of Standards and Technology (NIST) announces the Intersection of Cloud and Mobility Forum and Workshop to be held on Tuesday, March 25, Wednesday, March 26, and Thursday, March 27, 2014.

NIST is hosting the National Cybersecurity Center of Excellence (NCCoE) Workshop on June 26, 2012 to introduce the Center to the public. The Center plans to bring together industry, government and business communities to address present-day cybersecurity challenges, ...

Access control is the process of defining and limiting which users are allowed access to particular resources. NIST researchers have recently published a book on Attribute-based access control (ABAC), one of the latest development in a series of access control models going back more than 40 years.

Abstract: This document constitutes a preparation toward devising criteria for the standardization of threshold schemes for cryptographic primitives by the National Institute of Standards and Technology (NIST). The large diversity of possible threshold schemes, as identified in the NIST Internal Report (NISTI...

NIST is introducing a plan to transition away from the current limited use of the Secure Hash Algorithm 1 (SHA-1) hash function. Other approved hash functions are already available. The transition will be completed by December 31, 2030.

Abstract: This report summarizes the presentations and feedback received by the NIST Cybersecurity for the Internet of Things (IoT) Program at the hybrid workshop on "Cybersecurity for IoT Workshop: Future Directions” held March 31 – April 1, 2026. The purpose of this workshop was to consider emer...

Abstract: Entities participating in the generation or verification of digital signatures depend on the authenticity of the process. This Recommendation specifies methods for obtaining the assurances necessary for valid digital signatures: assurance of domain parameter validity, assurance of public key validit...

Abstract: Today’s rapidly changing technical environment requires federal agencies to adopt a minimum set of management controls to protect their information technology (IT) resources. These management controls are directed at individual information technology users in order to reflect the distributed nature...

Abstract: The Access Control for SAR Systems (ACSS) project focused on developing a prototype privilege management system used to express and enforce policies for controlling access to Suspicious Activity Report (SAR) data within the law enforcement domain. This report details the work conducted for the ACSS...

Abstract: This bulletin summarizes the information presented in NIST Special Publication (SP) 800-34, Rev. 1, Contingency Planning Guide for Federal Information Systems. This publication updates federal contingency planning practices by integrating risk management and system development life cycle considerati...

Abstract: Asset identification plays an important role in an organization?s ability to quickly correlate different sets of information about assets. This specification provides the necessary constructs to uniquely identify assets based on known identifiers and/or known information about the assets. This speci...

Abstract: The Homeland Security Presidential Directive HSPD-12 called for a common identification standard to be adopted governing the interoperable use of identity credentials to allow physical and logical access to Federal government locations and systems. The Personal Identity Verification (PIV) of Federal...

Abstract: This bulletin summarizes the information found in NIST SP 800-125A: Security Recommendations for Hypervisor Deployment on Servers, which provides technical guidelines regarding the secure execution of baseline functions of the hypervisor and are therefore agnostic to the hypervisor architecture.

Abstract: The rapid development and wide application of distributed network systems have made network security – especially access control and data privacy – ever more important. Blockchain technology offers features such as decentralization, high confidence, and tamper-resistance, which are advantages to sol...

Abstract: This Recommendation specifies the design principles and requirements for the entropy sources used by Random Bit Generators, and the tests for the validation of entropy sources. These entropy sources are intended to be combined with Deterministic Random Bit Generator mechanisms that are specified in...

NIST requests nominations of candidate algorithms for the Advanced Encryption Standard (AES).

NIST has released Internal Report (IR) 8557 for the Virtual Workshop on Usable Cybersecurity and Privacy for Immersive Technologies

Abstract: This bulletin summarizes the information presented in NIST Special Publication (SP) 800-184, Guide for Cybersecurity Event Recovery. The publication provides organizations with strategic guidance for planning, playbook developing, testing and improvements of recovery planning following a cybers...

The National Institute of Standards and Technology (NIST) is requesting comments on a proposed process to solicit, evaluate, and standardize one or more quantum-resistant public-key cryptographic algorithms.

Abstract: This three-volume report, Guidelines for Smart Grid Cybersecurity, presents an analytical framework that organizations can use to develop effective cybersecurity strategies tailored to their particular combinations of Smart Grid-related characteristics, risks, and vulnerabilities. Organizations in t...

Abstract: The objective of system security planning is to improve protection of information system resources. All federal systems have some level of sensitivity and require protection as part of good management practice. The protection of a system must be documented in a system security plan. The completion o...

Abstract: Cryptography is often used in an information technology security environment to protect data that is sensitive, has high value, or is vulnerable to unauthorized disclosure or undetected modification during transmission or while in storage. Cryptography relies upon two basic components...

Abstract: The data that is captured on mobile phones can be a source of valuable information to organizations that are investigating crimes, policy violations and other security incidents. The science of recovering digital evidence from mobile phones, using forensically sound conditions and accepted methods,...