Projects
https://csrc.nist.gov/projects/combinatorial-testing-for-ai-enabled-systems
*NEW* Short course from the Defense and Aerospace Test and Analysis Workshop 2025 (Dataworks 2025) - complete course presentation here. The goal of this project is to provide practitioners and researchers with a foundational understanding of combinatorial testing techniques and applications to testing AI-enabled software systems (AIES). Resources are being developed in these areas: Combinatorial testing (CT), applying CT to test traditional software systems, including real-world examples and case studies. How Test and Evaluation (T&E) of AIES differ from traditional software systems...
Project Pages
https://csrc.nist.gov/projects/human-centered-cybersecurity/research-areas/cybersecurity-adoption
People and organizations often fail to adopt and effectively use cybersecurity best practices and technologies for a variety of reasons, including lack of knowledge/skills. Those professionals tasked with educating others may likewise face a number of challenges, including lack of resources, support, and skills needed to be effective security communicators. We conduct research to better understand the approaches and challenges with cybersecurity awareness and role-based training through the eyes of training professionals within the U.S. government. In the recent past, we also explored...
Project Pages
https://csrc.nist.gov/projects/human-centered-cybersecurity/research-areas/human-centered-cybersecurity-general
Our team often writes articles or provides presentations that discuss and provide information about human-centered cybersecurity to various audiences, for example, cybersecurity practitioners or fellow researchers. We are co-hosting the Human-Centered Cybersecurity Series for the Redefining Cybersecurity Podcast (see General Human-Centered Cybersecurity -> Podcasts below). Currently, we are conducting a multi-phased research project to understand the interactions between human-centered cybersecurity researchers and practitioners. We hope the results will lead to the creation of mutually...
Project Pages
https://csrc.nist.gov/projects/human-centered-cybersecurity/research-areas/phishing
Short URL: https://csrc.nist.gov/phishing Phishing continues to be an escalating cyber threat facing organizations of all types and sizes, including industry, academia, and government. Our team performs research to understand phishing within an operational (real-world) context by examining user behaviors during phishing awareness training exercises. Our projects provide insights into users’ rationale and role in early detection, and how these might be scaffolded with technological solutions. Recent efforts have focused on the NIST Phish Scale, a method for rating the human detection...
Updates
September 9, 2026
https://csrc.nist.gov/news/2026/nccoe-releases-nist-ir-8536
To help strengthen the security and resilience of global supply chains, the NIST National Cybersecurity Center of Excellence (NCCoE) has released the finalized version of NIST Internal Report 8536, Supply Chain Traceability Principles: A Manufacturing Meta-Framework, which provides an interoperable, industry-neutral framework to securely exchange and verify traceability information across supply chains while enabling organizations to continue using existing industry standards.
Updates
August 31, 2026
https://csrc.nist.gov/news/2026/nist-s-sp-800-213a-released-for-comments
NIST is initiating a revision of Special Publication (SP) 800-213A, Internet of Things (IoT) Device Cybersecurity Guidance for the Federal Government: IoT Device Cybersecurity Requirement Catalog, and has posted a Pre-Draft Call for Comments. This update aims to incorporate lessons learned, align with recent frameworks like CSF 2.0 and SP 800-53 Rev. 5.2.0, and address the evolving IoT threat landscape. This follows the draft update to SP 800-213 Rev. 1.
Publications
SP 1347 (Final)
August 25, 2026
https://csrc.nist.gov/pubs/sp/1347/final
Abstract: Informative References identify relationships between elements of different source documents and can be consumed in human- or machine-readable formats. For example, within the CSF 2.0, each informative reference indicates one or more parts of another document in which readers can find additional inf...
Updates
August 21, 2026
https://csrc.nist.gov/news/2026/nist-releases-ir-8613-ipd-for-comments
NIST IR 8613 ipd, Multi-Cloud Architecture Challenges, identifies, categorizes, and analyzes the security and compliance challenges that are unique to or significantly amplified by multi-cloud architectures. This analysis addresses security and ATO challenges and highlights areas where additional community research could meaningfully reduce risk.
Publications
IR 8613 (Initial Public Draft)
August 21, 2026
https://csrc.nist.gov/pubs/ir/8613/ipd
Abstract: Working group participants submitted challenges, which were aggregated and reviewed. The challenges were first categorized as either security- or authorization-related, and then as functional or technical. Multi-cloud environments present unique security challenges arising from using multiple CSPs a...
Project Pages
https://csrc.nist.gov/projects/ispab/ispab-work-plan
Topics of Interest In accordance with 15 U.S.C. 278g-4, the duties of the Information Security and Privacy Advisory Board are to identify emerging managerial, technical, administrative, and physical safeguard issues relative to information security and privacy. The focus of the Board's work for FY 2015-2016 includes the following areas: Quantum (physics, pre-shared keys, quantum key distribution, block chains) Cybersecurity Office of Management and Budget OMB Circular A-130 Revised Cyber-marathon CyberStats Measuring outcomes for cybersecurity Cybersecurity protections in...
Project Pages
https://csrc.nist.gov/projects/ispab/documentation
ISPAB Charter: ISPAB Charter for 2026-2028. Annual Reports: ISPAB Annual Report for Fiscal Year 2025 ISPAB Annual Report for Fiscal Year 2024 ISPAB Annual Report for Fiscal Year 2023 ISPAB Annual Report for Fiscal Year 2022 ISPAB Annual Report for Fiscal Year 2021 ISPAB Annual Report for Fiscal Year 2020 ISPAB Annual Report for Fiscal Year 2019 Annual reports for 1995 - 2018 are found on the GSA web page at: Federal Advisory Committee Act (FACA) . When you reach the site, please select “The Annual Report of the President on Federal Advisory Committees – 1972-1998.”...
