Search CSRC

The Cybersecurity Framework is a voluntary framework for reducing cyber risks to critical infrastructure. It is based on existing standards, guidelines, and practices, and was originally developed with stakeholders in response to Executive Order (EO) 13636 (February 12, 2013).

Trustworthiness is a concept that includes: privacy, reliability, resilience, safety, and security. Worthy of being trusted to fulfill whatever critical requirements may be needed for a particular component, subsystem, system, network, application, mission, business function, enterprise, or other entity. [SP 800-160 Volume 2, Appendix B]

The ability to prepare for and adapt to changing conditions and withstand and recover rapidly from disruption. Resilience includes the ability to withstand and recover from deliberate attacks, accidents, or naturally occurring threats or incidents. [SP 800-160 Volume 2, Appendix B]

"Cyber-physical systems (CPS) are smart systems that include engineered interacting networks of physical and computational components. These highly interconnected and integrated systems provide new functionalities to improve quality of life and enable technological advances in critical areas, such as personalized health care, emergency response, traffic flow management, smart manufacturing, defense and homeland security, and energy supply and use. In addition to CPS, there are many words and phrases (Industrial Internet, Internet of Things (IoT), machine-to-machine (M2M), smart cities, and...

This topic is used to tag content related to machine learing (ML), super intelligence (SI), large language models (LLM), deep learning, and artificial neural networks. The related term "artificial intelligence (AI)" is used in many earlier NIST publications. Per the Sept. 29, 2026, Executive Order on Inaugurating the Era of Super Intelligence, NIST is working to update its communications to incorporate the term “super intelligence” as directed. Sec. 3. Definition. (a) For purposes of this order, and except where otherwise provided by law, the terms “Super Intelligence” and “SI” mean the...

OMB Memo M-16-04, Cybersecurity Strategy and Implementation Plan (CSIP) for the Federal Civilian Government (October 30, 2015), resulted from a comprehensive review in 2015 of the Federal Government's cybersecurity policies, procedures, and practices by the Cybersecurity Sprint Team. Its intent was to identify and address critical cybersecurity gaps and emerging priorities, and make specific recommendations to address those gaps and priorities. The five objectives of CSIP are: Prioritized Identification and Protection of high value information and assets; Timely Detection of and Rapid...

An adversary that possesses sophisticated levels of expertise and significant resources which allow it to create opportunities to achieve its objectives by using multiple attack vectors (e.g., cyber, physical, and deception). These objectives typically include establishing and extending footholds within the information technology infrastructure of the targeted organizations for purposes of exfiltrating information, undermining or impeding critical aspects of a mission, program, or organization; or positioning itself to carry out these objectives in the future. The advanced persistent threat:...

Save the Date for the 26th Annual Conference “Making Connections in Cybersecurity and Information Security Education” March 19-21, 2013 Gaithersburg, Maryland FINAL Agenda with Presentations Call for Participation Now Closed Invitation to share your project in our Government Best Practice Poster and Demonstration Session FISSEA Members, Are you working on a great project? Have an innovative awareness or training implementation? Are you ready to share it with our community? If you answered Yes, then we want you to register for our open, table-top “Government Best Practice Poster”...

Presentations & Speakers at a Glance: Security & Privacy Authorization: One Agency’s Tool Based Approach. Shawn Hartley, Chief Privacy Officer, PBGC and Sue-Schultz-Searcy, Assessment & Authorization Division Manager PBGC; and Security Automation with Open Security Controls Assessment Language. Dr. Michaela Iorga, OSCAL Strategic Outreach Director, NIST and David Waltermire, Lead Standards Architect for the Security Automation Program, NIST Cyber Security Assessment and Management (CSAM): Planning for Implementing SP 800-53, Revision 5. Ramon Burks and Adam Oline, Department of Justice...

Presentations & Speakers at a Glance: National Cybersecurity Center of Excellence (NCCoE) Overview, Bill Newhouse, NIST; Developing ISCM Assessment Methodology, Chad Baer, DHS. NOTE: FORUM MEETINGS ARE OPEN TO ONLY FEDERAL/STATE EMPLOYEES, HIGHER EDUCATION EMPLOYEES, AND THEIR DESIGNATED SUPPORT CONTRACTORS. REGISTRANTS MUST USE A .GOV, .EDU, OR .MIL ADDRESS FOR SIGN-UP. SUPPORT CONTRACTORS MUST INDICATE THE AGENCY OR ORGANIZATION THEY SUPPORT. The Federal Computer Security Program Managers Forum (the "Forum") is an informal group sponsored by the National Institute of Standards...

Type: Presentation

Presentations & Speakers at a Glance: Annual 2-Day Forum Meeting with a Keynote by the CIGIE IT Committee Chair, updates from the OMB, GAO, presentations by DHS, NIST, Dept of Fiscal Service, DOD, and FedRAMP (GSA). NOTE: FORUM MEETINGS ARE OPEN TO ONLY FEDERAL/STATE EMPLOYEES, HIGHER EDUCATION EMPLOYEES, AND THEIR DESIGNATED SUPPORT CONTRACTORS. REGISTRANTS MUST USE A .GOV, .EDU, OR .MIL ADDRESS FOR SIGN-UP. SUPPORT CONTRACTORS MUST INDICATE THE AGENCY OR ORGANIZATION THEY SUPPORT. The Federal Computer Security Program Managers Forum (the "Forum") is an informal group sponsored by...

Post-quantum candidate algorithm nominations are due November 30, 2017. Call for Proposals Submission packages must be received by NIST by November 30, 2017. Submission packages received before September 30, 2017 will be reviewed for completeness by NIST; the submitters will be notified of any deficiencies by October 31, 2017, allowing time for deficient packages to be amended by the submission deadline. No amendments to packages will be permitted after the submission deadline, except at specified times during the evaluation phase (see Section 5). Due to the specific requirements of the...

Talks from Workshop on Combinatorial Testing for Artificial Intelligence-Enabled Systems September 4, 2024 Virginia Tech Research Center, Arlington, VA https://sites.google.com/vt.edu/ct-workshop Ongoing teaching workshops in this area may be found here. The goal of this workshop was to provide practitioners and researchers with a foundational understanding of combinatorial testing techniques and applications to testing AI-enabled software systems (AIES). Participants included staff from Cybersecurity and Infrastructure Security Agency (CISA), Office of Sec. of Defense, Director...

November 1, 2022: NIST issues summary and analysis of responses to the CUI Series pre-draft call for comments. Comments received in response to the pre-draft call for comments on the CUI Series. Submitters’ names and affiliations (when provided) will be included, while contact information will be removed. Date Received From July 19, 2022 Williams International July 19, 2022 Real IT Care July 19, 2022 RSM US LLP July19, 2022 ePlus Technology, Inc July 19, 2022 Mercy Medical Center July 20, 2022 ESN...

Abstract: Operational Technology (OT) environments often lack comprehensive asset inventories due to a lack of resourcing, limitations of legacy systems, geographically distributed assets, diverse communication protocols, and operational constraints. OT environments also face unique asset management challenge...

The National Cybersecurity Center of Excellence (NCCoE) will host a workshop on Security for IPv6 Enabled Enterprises on Thursday, June 13th at 8:30 a.m. in Rockville, MD. NIST’s NCCoE is developing a project plan to examine and demonstrate the state of security technologies and guidance specifications for IPv6 enabled enterprises. A primary focus of the workshop and subsequent NCCoE demonstration project is to examine the extent to which current commercially available security technologies can support wide scale deployment and use of IPv6 in a range of enterprise use case scenarios....

This two-day workshop focuses on decreasing software security vulnerabilities by orders of magnitude, using the strong guarantees that only sound static analysis can provide. The workshop is aimed at developers, managers and evaluators of security-critical projects, as well as researchers in cybersecurity. The program features experts on sound static analysis applied to security, around three theme topics: Analysis of legacy code, Use in new development, and Accountable software quality. Each topic will be introduced by a renowned international expert: David A. Wheeler from the...

The following table summarizes publication reviews completed by the Crypto Publication Review Board, including links to announcements, received comments, the Board's initial decision proposal, and the final decision approved by NIST management. Also, see a list of publications currently under review and descriptions of the publication decision options—Reaffirm, Update, Revise, Convert, Withdraw. Latest updates: •1/6/26: Decision to update SP 800-56Ar3, reaffirm SP 800-56Br2, and revise SP 800-56Cr2. Completed Publication Reviews and Decisions (sorted by Final Decision, newest to...

2018-2017 Announcements Archive 2018 [11-30-2018] Implementation Guidance for FIPS PUB 140-2 and the Cryptographic Module Validation Program has been updated. Updated Guidance: General: changed all references of Communications Security Establishment (CSE) to Canadian Centre for Cyber Security (CCCS). IG G.2 - Completion of a test report: Information that must be provided to NIST and CCCS – Added acceptance of draft certificate submissions from the CST lab to the CMVP in the RTF format (but still recommending DOC or DOCX formatting). IG G.13 - Instructions for Validation...

We look forward to welcoming you to NIST’s Virtual Workshop on Secure Development Practices for AI Models on January 17. This workshop is being held in support of Executive Order (EO) 14110, Safe, Secure, and Trustworthy Development and Use of Artificial Intelligence. EO 14110 tasked NIST with “developing a companion resource to the Secure Software Development Framework (SSDF) to incorporate secure development practices for generative AI and for dual-use foundation models.” What You Will Learn This workshop will bring together industry, academia, and government to discuss secure development...

AES Overview | NIST Reports | Federal Register Notices | Rijndael Info | Related Publications AES Overview Beginning in 1997, NIST worked with industry and the cryptographic community to develop an Advanced Encryption Standard (AES). The overall goal was to develop a Federal Information Processing Standard (FIPS) specifying an encryption algorithm capable of protecting sensitive government information well into the 21st century. The algorithm was expected to be used by the U.S. Government and, on a voluntary basis, by the private sector. On January 2, 1997, NIST announced the initiation of...

The Assessment Cases available for download correspond with NIST Special Publication 800-53, Revision 3. The assessment cases were developed by an interagency working group that has disbanded. Assessment cases for consistency with SP 800-53A Rev 4 or newer will not be developed but the existing assessment cases may continue to be applied and also may be used as a model to extrapolate assessment cases for controls added or changed in NIST SP 800-53 Revision 4 or newer. Cautionary Note: The assessment cases developed for this project are not the only acceptable assessment cases; rather, the...

Combinatorial testing is being applied successfully in nearly every industry, and is especially valuable for assurance of high-risk software with safety or security concerns. Combinatorial testing is referred to as effectively exhaustive, or pseudo-exhaustive, because it can be as effective as fully exhaustive testing, while reducing test set size by 20X to more than 100X. Case studies below are from many types of applications, including aerospace, automotive, autonomous systems, cybersecurity, financial systems, video games, industrial controls, telecommunications, web applications, and...

Program Related Transitions Interim Validations The CMVP is offering an interim validation process for module submissions. This interim validation option is voluntary; however, CSTLs must notify CMVP of the vendor's intent prior to 1 Oct 2024. Vendors do not need to take any action if they would prefer to wait for their full review to be completed to receive full, five-year validation. Vendors who would like to elect the interim validation should follow the process below. These module submissions will be reviewed for completeness by CMVP staff. If needed, there will be a brief...