Search CSRC

Two days of presentations about threshold schemes for multi-party and single-device settings. Scroll down to see the embedded videos of the presentations Agenda Click here for a printable PDF version of the workshop schedule. 1st day (March 11, 2019) All talks take place in the Green Auditorium in the Main Building (101) at the NIST campus in Gaithersburg, MD, USA Badge pick-up (for on time and late arrivals) is done in front of the the Green auditorium — attendees need to pre-register to attend the conference. Expected speakers are highlighted in bold. Click on each...

The NIST SP 800-53 Controls Public Comment Site was developed to ensure that the SP 800-53 control catalog provides the most comprehensive and up-to-date set of controls/countermeasures to manage security, privacy, and supply chain risk. By modernizing the NIST comment process and moving to an online dataset instead of following a document-based update process, NIST can provide its stakeholders the most up-to-date controls in multiple data formats to manage risk while encouraging use of automation. Stakeholders can provide feedback on controls by: submitting a "proposal" for a new...

Improving the Nation's Cybersecurity (May 12, 2021). For more information, see this other NIST site.

The final public draft (fpd) of NIST Special Publication (SP) 800-171r3 (Revision 3) and initial public draft (ipd) of NIST SP 800-171Ar3 (Revision 3) are now available for public review. The comment period is open through January 26, 2024.

This year’s Multi-Cloud Conference co-hosted by NIST and Tetrate will focus on DevSecOps and ZTA as foundational approaches to development, deployment, and operational phases for achieving high-assurance cloud-native applications. The latest generation of cloud-native applications often consists of a collection of microservices that could be distributed and deployed across a heterogeneous infrastructure (on-premises, public cloud, containerized, running on virtual machines, etc). With the proliferation of DevSecOps, a service mesh has proven to provide the desired bridge between...

Type: Poster

2017.01.27 - Microsoft Virtual PC Windows 7 32-bit VHD (USGCB-Windows7-VPC-x86-1.1.x.0-20110124.zip) - End of Life (EOL). This VHD is no longer supported and is unavailable. 2015.04.20 - USGCB SCAP 1.2 Content Final Release for Microsoft Windows XP, Windows Vista, Windows 7, Windows XP Firewall, Windows Vista Firewall, Windows 7 Firewall, Internet Explorer 7, and Internet Explorer 8 posted. 2015.02.25 - USGCB SCAP 1.2 Content Release Candidate 1 for Microsoft Windows XP, Windows Vista, Windows 7, Windows XP Firewall, Windows Vista Firewall, Windows 7 Firewall, Internet Explorer 7, and...

2019-2018 PIV News Archive March 21, 2019: Presentations of the FIPS 201-3 Business Requirements Meeting are available here. February 8, 2019: Safe the date for the Federal Business Requirements Meeting for FIPS 201 Revision 3 on 3/19/19. FIPS 201, Personal Identity Verification (PIV) for Federal Employees and Contractors, will be going through a third revision soon. In preparation for the revision, NIST invites federal departments and agencies’ representatives to participate in this government-only meeting to discuss the change requests accumulated over the past five years....

2016 [Updated 12-19-2016] -- Module Drop Policy Effective July 1, 2017, the CMVP will automatically drop modules in IUT after 18 months. Effective January 1, 2018, the CMVP will drop modules that have not been validated within 2 years of submission or IUTB, whichever occurred first. When the module is dropped, the vendor and lab will have to restart the validation process by sending an updated submission and paying a new cost recovery fee at the current rate. [Updated 06-01-2016][11-12-2015] -- Validation Sunsetting Policy The CMVP is adopting a five year validation...

As NIST continues to refine the SP 800-53 Comment Site, screenshots included in the User Guide may differ slightly from the latest version. Each topic area below includes a step-by-step guide demonstrating how to: Navigate to the SP 800-53 Public Comment Site Users can reach the SP 800-53 Public Comment Site directly, or by browsing from the NIST Risk Management Framework (RMF) project page. Option 1: Access by Direct Link Access the SP 800-53 Public Comment Site directly: https://csrc.nist.gov/Projects/risk-management/sp800-53-controls/public-comments. Figure 1 below shows the...

The Cyberspace Policy Review (May 2009) served as a driver for both the National Strategy for Trusted Identities in Cyberspace (NSTIC) and the National Initiative for Cybersecurity Education (NICE).

Policy for a Common Identification Standard for Federal Employees and Contractors (August 27, 2004) initiated the development effort for FIPS 201 and other publications and testing related to Personal Identity Verification (PIV).

See the CSRC Homepage for additional resources on Telework Cybersecurity. "The ability for an organization’s employees, contractors, business partners, vendors, and other users to perform work from locations other than the organization’s facilities." (SP 800-46 Rev. 2)

This is the process of creating and using a government-wide secure and reliable form of identification for federal employees and contractors, in support of HSPD-12, Policy for a Common Identification Standard for Federal Employees and Contractors. FIPS 201 defines a reliable, government-wide identity credential for use in applications such as access to federally-controlled facilities and information systems. It also specifies a PIV system within which a common identity credential can be created and later used to verify a claimed identity.

Quick-Start Guides are intended to give users an easy starting point for understanding relevant NIST technical publications and resources.

See the NIST semiconductors page for additional NIST resources, including a semiconductor glossary and information about the CHIPS Act.

See the Protecting Controlled Unclassified Information project for more information, as well as the National Archives' CUI Registry.

The process for identifying, acquiring, installing, and verifying patches for products and systems. Patches correct security and functionality problems in software and firmware. From a security perspective, patches are most often of interest because they are mitigating software flaw vulnerabilities; applying patches to eliminate these vulnerabilities significantly reduces the opportunities for exploitation. Also, patches are usually the most effective way to mitigate software flaw vulnerabilities, and are often the only fully effective solution. (SP 800-40 Rev. 3)

Driver for the National Checklist Program. The National Archives and Records Administration (NARA) is sponsoring a FAR clause regarding SP 800-171.

The ability of a system or component to function under stated conditions for a specified period of time. [SP 800-160 Volume 2, Appendix B]

"Small businesses are defined differently depending on the industry sector. For [NISTIR 7621 Rev. 1], the definition of a small business includes for-profit, non-profit, and similar organizations with up to 500 employees. Synonymous with “Small Enterprise or Small Organization”. See the SBA [Small Business Administration] website www.sba.gov for more information." (NISTIR 7621 Rev. 1)

"Big Data consists of extensive datasets--primarily in the characteristics of volume, variety, velocity, and/or variability--that require a scalable architecture for efficient storage, manipulation, and analysis." (SP 1500-1, Appendix A)

The Comprehensive National Cybersecurity Initiative (March 2010) was originally described in Homeland Security Presidential Directive/HSPD-23 (January 8, 2008). The CNCI is a driver for cybersecurity education and supply chain risk management.

See the NIST Cybersecurity for IoT Program for details about how the Applied Cybersecurity Division supports the development and application of standards, guidelines, and related tools to improve the cybersecurity of connected devices and the environments in which they are deployed. [This "Internet of Things" CSRC topic page consolidates content related to IoT that exists on the CSRC website.]

Information system contingency planning refers to a coordinated strategy involving plans, procedures, and technical measures that enable the recovery of information systems, operations, and data after a disruption. Contingency planning generally includes one or more of the following approaches to restore disrupted services: Restoring information systems using alternate equipment; Performing some or all of the affected business processes using alternate processing (manual) means (typically acceptable for only short-term disruptions); Recovering information systems operations at an...