Search CSRC

NIST is soliciting comments on Draft NISTIR 8272, "Impact Analysis Tool for Interdependent Cyber Supply Chain Risks." The public comment period ends April 17, 2020.

NIST invites comments on Draft NIST Special Publication (SP) 800-216, "Recommendations for Federal Vulnerability Disclosure Guidelines." The public comment period is open through August 9, 2021.

This announcement is a pre-draft call for comments to solicit preliminary feedback on SP 800-38F. The public comment period is open through July 10, 2026.

NIST's NCCoE has released Draft NISTIR 8335, "Identity as a Service for Public Safety." The public comment period ends August 2, 2021.

Draft FIPS 201-3 Virtual Public Workshop December 9, 2020 Presentations, Recording and Q&A chat transcript Business Requirements Meeting of FIPS 201-3 (Government only) March 19, 2019 Agenda with Presentations Workshop on Upcoming Special Publications Supporting FIPS 201-2 March 3-4, 2015 Agenda with Presentations Revised Draft FIPS 201-2 Workshop August 26, 2012 Presentations Draft FIPS 201-2 Workshop April 18-19, 2011 Presentations: Overview (Goals of the workshop, purpose of the revision, overall revision process, summary of proposed changes) Hildegard Ferraiolo, NIST...

The following specifications comprise SCAP version 1.0. Please note that this version of SCAP is no longer supported by NIST. Protocol SCAP: Security Content Automation Protocol Version: 1.0 Status: Final (Support Withdrawn) Specification: NIST SP800-126 Tools SCAP Content Validation Tool Earlier versions of this tool are end of life and are no longer available. The current version validates content conforming to SCAP versions 1.2, 1.3, and 1.4. It does not validate SCAP 1.0 or 1.1. Download it from the SCAP 1.4 page. Languages XCCDF: The eXtensible Configuration Checklist...

Validation Number: 140 Vendor: SPAWAR Systems Center Atlantic Product Name: SCAP Compliance Checker Product Major Version: 4 Product Version Tested: 4.1.1 RC7 Tested Platforms: Microsoft Windows Server 2012, 64 bit Microsoft Windows 7, 64 bit Red Hat Enterprise Linux 6, 32 bit Red Hat Enterprise Linux 7, 64 bit SCAP 1.2 Capabilities: Authenticated Configuration Scanner Common Vulnerabilities and Exposures (CVE) Open Checklist Interactive Language (OCIL) Validated Product...

Validation Number: 134 Vendor: Qualys Product Name: Qualys SCAP Auditor Product Major Version: 1.2 Product Version Tested: 1.2 (5.10.1 Build: 2) Tested Platforms: Microsoft Windows 7, 64 bit Microsoft Windows 7, 32 bit Red Hat Enterprise Linux 5, 64 bit Red Hat Enterprise Linux 5, 32 bit SCAP 1.2 Capabilities: Authenticated Configuration Scanner Common Vulnerabilities and Exposures (CVE) Validated Product Vendor Provided SCAP Information Dates Tested:...

Validation Number: 145 Vendor: McAfee Product Name: McAfee Policy Auditor Product Major Version: 6 Product Version Tested: 6.5.0.263 Tested Platforms: Microsoft Windows 10 SP0 32-bit Microsoft Windows 10 SP0 64-bit Microsoft Windows Server 2012 R2 SP0 64-bit Red Hat Enterprise Linux 7 64-bit SCAP 1.3 Capabilities: Authenticated Configuration Scanner Common Vulnerabilities and Exposures (CVE) Option Validated Product Vendor Provided SCAP Information...

NIST has set up a [email protected] mailing list. The mailing list will be used to discuss the standardization and adoption of secure, interoperable and efficient post-quantum algorithms. You must be subscribed to send email to the mailing list. Please use the instructions below to subscribe. To join: mailto:[email protected] You will receive a response message from [email protected]. Please click the "Join" link inside that email to confirm your subscription request. To unsubscribe: mailto:[email protected] Mailing List...

Blockchain-based Secure Software Assets Management (BloSS@M) demonstrates continuous ATO with OSCAL. This site contains team's resources. 1. Bloss@m's network overview.

Research tools to support combinatorial testing. No license is required and there are no restrictions on distribution or use. All software is provided free of charge and will remain free in the future. NIST is an agency of the US Government, so this software is public domain. You are free to include it and redistribute it in commercial products if desired. ACTS is in Java, and will run on any platform with the latest Java release (Java free download is at java.com). There are many users running current Windows, Mac OS, and Linux systems. ACTS Basic version download Java .jar file. No...

Learn OSCAL Through an Immersive Online Escape Room Experience The NIST OSCAL Team is excited to share an immersive online escape room experience designed to help community members learn OSCAL in a hands-on, engaging way. Rather than traditional presentations or documentation walkthroughs, this escape room invites participants to actively apply OSCAL concepts in realistic scenarios. By solving challenges and progressing through the experience, users will gain a deeper, more practical understanding of how OSCAL supports modern security assessment and authorization workflows. The escape...

NIST has published SP 800-125A, Security Recommendations for Hypervisor Deployment on Servers.

The National Institute of Standards and Technology (NIST), in cooperation with the Australian Federal Government agency, Centrelink, will hold a public workshop on July 13-15, 2009, at the NIST Gaithersburg campus.

NIST is requesting comments on Draft SP 800-56C Revision 2, "Recommendation for Key-Derivation Methods in Key-Establishment Schemes." The public comment period ends May 15, 2020.

NIST requests comments on the draft report NISTIR 8062, Privacy Risk Management for Federal Information Systems, which describes a privacy risk management framework for federal information systems.

Abstract: The purpose of this publication is to provide guidelines for selecting and specifying security controls for information systems supporting the executive agencies of the federal government. The guidelines have been developed to help achieve more secure information systems within the federal governmen...

Abstract: The purpose of this publication is to provide guidelines for selecting and specifying security controls for information systems supporting the executive agencies of the federal government. The guidelines have been developed to help achieve more secure information systems within the federal governmen...

Abstract: The purpose of this publication is to provide guidelines for selecting and specifying security controls for information systems supporting the executive agencies of the federal government. The guidelines have been developed to help achieve more secure information systems within the federal governmen...

Abstract: The purpose of this publication is to provide guidelines for selecting and specifying security controls for information systems supporting the executive agencies of the federal government. The guidelines have been developed to help achieve more secure information systems within the federal governmen...

NIST has released Draft Special Publication (SP) 800-172A, "Assessing Enhanced Security Requirements for Controlled Unclassified Information." Public comments are due June 11, 2021.

Abstract: This bulletin summarizes the information presented in NISTIR 8014, Considerations for Identity Management in Public Safety Mobile Networks, written by Nelson Hastings and Joshua Franklin. The publication analyzes approaches to identity management for public safety networks in an effort to assist ind...

Abstract: This ITL Bulletin summarizes the contents of NIST Special Publication 800-63, Electronic Authentication Guideline, by William E. Burr, Donna F. Dodson, and W. Timothy Polk, which provides technical guidance on existing and widely implemented methods for remote authentication. The bulletin covers the...

Abstract: This document provides an introduction to security for private branch exchange systems (PBXs). The primary audience is agency system administrators and others responsible for the installation and operation of PBX systems. Major threat classes are explained, common vulnerabilities identified, and cou...