Project Pages
https://csrc.nist.gov/projects/cyber-supply-chain-risk-management/key-practices
The NIST Framework for Improving Critical Infrastructure Cybersecurity ("the Framework") released in February 2014 was published simultaneously with the companion Roadmap for Improving Critical Infrastructure Cybersecurity. The Roadmap identified Cyber Supply Chain Risk Management (Cyber SCRM) as an area for future focus. Since the release of the Framework and in support of the companion Roadmap, NIST has researched industry best practices in cyber supply chain risk management through engagement with industry leaders. In 2014 and 2015, NIST interviewed a diverse set of organizations and...
Project Pages
https://csrc.nist.gov/projects/cyber-supply-chain-risk-management/nist-sponsored-research
NIST regularly conducts and awards contracts, grants, or cooperative agreements to conduct research into cybersecurity supply chain risk management (C-SCRM) and related topics. The following are relevant research activities: Cyber Risk Analytics: A NIST and GSA-Sponsored grant from 2015-2017 examining the relationship between various risk management practices and publicly disclosed breaches. The Cyber Risk Predictive Analytics Project Cyber Risk Analytics Project Review Workshop (with video) Industry C-SCRM Best Practices: Ongoing work developing case studies exploring effective risk...
Events
July 23, 2024 - July 25, 2024
https://csrc.nist.gov/events/2024/nist-workshop-on-fmcp-2024
Full Workshop and Registration Details NIST will host the Workshop on Formal Methods within Certification Programs (FMCP 2024) on July 23-25, 2024, at the National Cybersecurity Center of Excellence in Rockville, Maryland. The goal of the workshop is to explore the use of formal methods within certification programs for cryptographic modules such as FIPS 140-3. Topics for discussion include: Software formal methods of different families: model checking, interactive proof, use of SMT and SAT solvers, static analysis How formal methods can fit within existing validation programs and...
Publications
SP 1314 (Final)
July 23, 2024
https://csrc.nist.gov/pubs/sp/1314/final
Abstract: For organizations of all sizes, managing risk (including information security and privacy risk), is critical for organizational resilience. This guide is designed to help small, under-resourced entities understand the value and core components of the NIST Risk Management Framework (RMF) and provide...
Publications
Conference Paper (Final)
July 13, 2024
https://csrc.nist.gov/pubs/conference/2024/07/13/alert-a-framework-for-efficient-extraction/final
Conference: 38th International IFIP Conference on Data and Application Security and Privacy (DBSEC 2024) Abstract: In the dynamic landscape of cybersecurity, curated knowledge plays a pivotal role in empowering security analysts to respond effectively to cyber threats. Cyber Threat Intelligence (CTI) reports offer valuable insights into adversary behavior, but their length, complexity, and inconsistent structure...
Project Pages
https://csrc.nist.gov/projects/systems-security-engineering-project/sse-blogs
Blogs… Cybersecurity Risk Management: Choosing the Right Approach to Get the Job Done, June 2023. Taking Measure Rethinking Cybersecurity from the Inside Out, R. Ross, November 2016. Bulletins… ITL Bulletin Rethinking Security though Systems Security Engineering, R. Ross, L. Feldman, G. Witte, December 2016. Videos… The Need for Systems Thinking in Cybersecurity, R. Ross, October 2021.
Events
June 20, 2024 - June 21, 2024
https://csrc.nist.gov/events/2024/accordion-cipher-mode-workshop-2024
On Demand Videos Day 1 - Thursday, June 20 Day 2 - Friday, June 21 NIST hosted a workshop on the development of a new block cipher mode of operation on June 20–21, 2024, at the National Cybersecurity Center of Excellence in Rockville, Maryland. NIST IR 8537, NIST Workshop on the Requirements for an Accordion Cipher Mode 2024 - Workshop Report, summarizes the participant feedback, key takeaways, and future directions discussed during the event. Important Dates Workshop: June 20-21, 2024 Submission deadline: May 1, 2024 Notification date: May 10, 2024 Last day to reserve hotel...
Events
May 21, 2024 - May 21, 2024
https://csrc.nist.gov/events/2024/federal-cybersecurity-privacy-professionals-forum
The Federal Cybersecurity and Privacy Professionals Forum is an informal group sponsored by the National Institute of Standards and Technology (NIST) to promote the sharing of system security and privacy information among federal, state, and local government, and higher education employees. The Forum maintains an extensive e-mail list and holds quarterly meetings to discuss current issues and items of interest to those responsible for protecting non-national security systems. For more information about the Forum and instructions on how to join, see: https://csrc.nist.gov/Projects/forum. View...
Publications
SP 800-229 (Final)
May 20, 2024
https://csrc.nist.gov/pubs/sp/800/229/final
Abstract: During Fiscal Year 2023 (FY 2023) – from October 1, 2022, through September 30, 2023 –the NIST Information Technology Laboratory (ITL) Cybersecurity and Privacy Program successfully responded to numerous challenges and opportunities in security and privacy. This Annual Report highlights the FY 2023...
Project Pages
https://csrc.nist.gov/projects/protecting-controlled-unclassified-information/sp-800-171
Security Requirements for Protecting CUI Purpose Recommended security requirements for protecting the confidentiality of CUI: (1) when the CUI is resident in a nonfederal system and organization; (2) when the nonfederal organization is not collecting or maintaining information on behalf of a federal agency or using or operating a system on behalf of an agency; and (3) where there are no specific safeguarding requirements for protecting the confidentiality of CUI prescribed by the authorizing law, regulation, or governmentwide policy for the CUI category listed in the CUI...
Project Pages
https://csrc.nist.gov/projects/olir/links5827586
/CSRC/media/Projects/olir/documents/submissions/WIP_Framework_v_1_1_to_800_53_Rev5.xlsx /CSRC/media/Projects/olir/documents/submissions/WIP_Framework_v_1_1_to_800_53_Rev5.xlsx /CSRC/media/Projects/olir/documents/submissions/SP800-82-Rev-2-to-SP800-53-Rev-4.xlsx /CSRC/media/Projects/olir/documents/submissions/WIP_Framework_v_1_1_to_800_53_Rev5.xlsx /CSRC/media/Projects/olir/documents/submissions/SP800-177-Rev-1-to-SP800-53-Rev-4.xlsx...
Project Pages
https://csrc.nist.gov/projects/software-identification-swid/guidelines
Completed Specifications and Guidelines The SWID Tag format, defined by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC) standard ISO/IEC 19770-2, is a structured metadata format for describing a software product. NIST recommends use of the latest version of this standard, ISO/IEC 19770-2:2015. A SWID Tag document is composed of a structured set of data elements that identify the software product, characterize the product's version, identify the organizations and individuals that had a role in the production and distribution of...
