Search CSRC

Abstract: Self-assessments provide a method for agency officials to determine the current status of their information security programs and, where necessary, establish a target for improvement. This self-assessment guide utilizes an extensive questionnaire containing specific control objectives and techniques...

Abstract: On July 17, 1995, the National Institute of Standard and Technology (NIST), Computer Systems Laboratory (CSL), established the Cryptographic Module Validation (CMV) Program which validates cryptographic modules to Federal Information Processing Standard (FIPS) 140-1, Security Requirements for Crypto...

Abstract: This document recommends a process for selecting automated risk analysis tools. It is primarily intended for managers and those responsible for managing risks in computer and telecommunications systems. The document describes important considerations for developing selection criteria for acquiring r...

Abstract: The Security Guide for Interconnecting Information Technology Systems provides guidance for planning, establishing, maintaining, and terminating interconnections between information technology (IT) systems that are owned and operated by different organizations. They are consistent with the requireme...

NIST is seeking information on the “Framework for Improving Critical Infrastructure Cybersecurity” (the “Framework”).

The final public drafts (fpd) of NIST Special Publication (SP) 800-157 Revision 1, Guidelines for Derived Personal Identity Verification (PIV) Credentials, and SP 800-217, Guidelines for Personal Identity Verification (PIV) Federation, are now available for public review and comment. The public comment period for both final drafts are open through January 10, 2025.

Abstract: This publication from the National Initiative for Cybersecurity Education (NICE) describes the Workforce Framework for Cybersecurity (NICE Framework), a fundamental reference for describing and sharing information about cybersecurity work. It expresses that work as Task statements and describes Know...

Abstract: Smart Grid technologies will introduce millions of new intelligent components to the electric grid that communicate in much more advanced ways (e.g., two-way communications, and wired and wireless communications) than in the past. This report is for individuals and organizations who will be addressi...

Abstract: This document, Special Publication 800-76, is a companion document to FIPS 201, Personal Identity Verification (PIV) of Federal Employees and Contractors. It describes technical acquisition and formatting specifications for the biometric credentials of the PIV system, including the PIV Card itself....

Abstract: The key asset in Federal agencies today is the information and data used to implement, sustain and maintain critical government programs and operations. Current efforts in ensuring that the United States can recover and restore activities which have great impact on the physical and economic health a...

Abstract: Computer security "incidents" occur with alarming frequency. The incidents range from direct attacks by both hackers and insiders to automated attacks such as network worms. Weak system controls are frequently cited as the cause, but many of these incidents are the result of improper use of existing...

Abstract: The security problems associated with a network of computers are an extension of those of stand-alone computer systems, but require additional security controls due to the distributed and autonomous nature of the network components. The purpose of this investigation was to generate a pre-development...

NIST has published NISTIR 8360, "Machine Learning for Access Control Policy Verification."

NIST has published Special Publication (SP) 800-208, "Recommendation for Stateful Hash-Based Signature Schemes."

Draft NISTIR 8202, Blockchain Technology Overview, is available for public comment through February 23, 2018.

Abstract: Ensuring the security of routers is crucial for safeguarding not only individuals’ data but also the integrity and availability of entire networks. With the increasing prevalence of smart home Internet of Things (IoT) devices and remote work setups, the significance of consumer-grade router cybersec...

Abstract: This document is the Cybersecurity Framework Profile developed for the Liquefied Natural Gas (LNG) industry and the subsidiary functions that support the overarching liquefaction process, transport, and distribution of LNG. The LNG Cybersecurity Framework Profile can be used by liquefaction faciliti...

Abstract: This document is the Cybersecurity Framework Profile developed for the Liquefied Natural Gas (LNG) industry and the subsidiary functions that support the overarching liquefaction process, transport, and distribution of LNG. The LNG Cybersecurity Framework Profile can be used by liquefaction faciliti...

Abstract: This Recommendation provides cryptographic key management guidance. It consists of three parts. Part 1 provides general guidance and best practices for the management of cryptographic keying material. Part 2 provides guidance on policy and security planning requirements for U.S. government agencies....

Abstract: Underlying Technical Models for Information Technology Security provides a description of the technical foundations, termed models, that underlie secure information technology (IT). The intent is to provide, in a concise form, the models that should be considered in the design and development of tec...

Abstract: This Telecommunication Security Guideline is intended to provide a security baseline for Network Elements (NEs) and Mediation Devices (MDs) that is based on commercial security needs. In addition, some National Security and Emergency Preparedness (NS/EP) security requirements will be integrated into...

Abstract: Cryptographic (crypto) agility refers to the capabilities needed to replace and adapt cryptographic algorithms in protocols, applications, software, hardware, firmware, and infrastructures while preserving security and ongoing operations. This white paper provides an in-depth survey of current appro...

Abstract: This bulletin focuses on NIST's combinatorial testing work. Combinatorial testing is a proven method for more effective software testing at lower cost. The key insight underlying combinatorial testing's effectiveness resulted from a series of studies by NIST from 1999 to 2004. NIST research showed...

Abstract: Voice over Internet Protocol (VOIP) refers to the transmission of speech across data-style networks. This form of transmission is conceptually superior to conventional circuit switched communication in many ways. However, a plethora of security issues are associated with still-evolving VOIP technolo...

NIST SP 800-209, "Security Guidelines for Storage Infrastructure," has been published.