Search CSRC

Forum Membership and Email List Information

Through virtual events and email list, the Forum provides our members: a venue to exchange information, share ideas and best practices, resources, and knowledge; an ongoing opportunity to leverage the work done in other organizations to reduce possible duplication of effort; and access to a community and network of cybersecurity and privacy professionals across the U.S. federal, state, and local government and at higher education organizations handling federal information. Virtual Events Refer to the Events Page for upcoming Forum meetings and registration information. Forum...

About the Forum

The NIST Cybersecurity & Privacy Professionals Forum is co-chaired by representatives of NIST's Information Technology Laboratory Computer Security Division (CSD) and Office of Information Systems Management (OISM). The Forum Secretariat provides the necessary administrative and logistical support for operations. The Forum serves as an important mechanism for NIST to: exchange information directly with cybersecurity and privacy professionals in U.S. federal, state, and local government, and higher education organizations handling federal information in fulfillment of its leadership...

Federal Cybersecurity and Privacy Professionals Forum

The Federal Cybersecurity and Privacy Professionals Forum is an informal group sponsored by the National Institute of Standards and Technology (NIST) to promote the sharing of cybersecurity and privacy knowledge, best practices, and resources among U.S. federal, state, and local government, and at higher education organizations handling federal information. The Federal Cybersecurity and Privacy Professionals Forum ("the Forum") maintains an extensive email list, and holds virtual events to discuss current issues and items of interest to those responsible for protecting non-national security...

Using AI for CSF 2.0 Analysis and Reporting—New Quick-Start Guide Available for Comment

NIST has released the initial public draft of Special Publication (SP) 1353, Quick-Start Guide for Using Artificial Intelligence (AI) for CSF Analysis and Reporting. The public comment period is open through October 15, 2026.

NIST Cybersecurity Framework 2.0: Quick-Start Guide for Using Artificial Intelligence (AI) for CSF Analysis and Reporting

Abstract:

Human-Centered Cybersecurity Community of Interest

Human-centered cybersecurity (HCC) (also known as usable security) involves the social, organizational, and technological influences on people’s understanding of and interactions with cybersecurity. By taking a human-centered cybersecurity approach, we can both improve people's cybersecurity experiences and achieve better cybersecurity outcomes. This Google Group provides a forum for human-centered cybersecurity researchers, cybersecurity and IT practitioners, and human factors experts to share ideas, best practices, and potential engagement opportunities. Read the September 2024 NIST Blog...

Human-Centered Cybersecurity Guidelines and Resources Concept Paper

Abstract: This concept paper introduces NIST’s goal to publish guidelines and resources to assist organizations and professionals in addressing the human aspects of cybersecurity, collectively known as human-centered cybersecurity.

Applying 5G Cybersecurity and Privacy Capabilities White Paper Series: Initial Non-Access Stratum (NAS) Message Security

The NIST National Cybersecurity Center of Excellence (NCCoE) has released the initial public draft Cybersecurity White Paper (CSWP) 36F, Initial Non-Access Stratum (NAS) Message Security, which describes a 5G security feature that protects sensitive information in the Initial Non-Access Stratum (NAS) Message and explains how organizations can verify these protections in deployed 5G networks.

Initial NAS Message Security: Applying 5G Cybersecurity and Privacy Capabilities

Abstract: This white paper is part of a series called Applying 5G Cybersecurity and Privacy Capabilities, which covers 5G cybersecurity- and privacy-supporting capabilities that were implemented as part of the 5G Cybersecurity testbed at the National Cybersecurity Center of Excellence (NCCoE). This white pape...

Post-Quantum Cryptography

Short URL: https://www.nist.gov/pqcrypto For a plain-language introduction to post-quantum cryptography, see What Is Post-Quantum Cryptography? PQC Standards | Migration to PQC | Ongoing PQC Standardization Process NIST’s Post-Quantum Cryptography (PQC) project leads the national and global effort to secure electronic information against the future threat of quantum computers—machines that may be years or decades away but could eventually break many of today’s widely used cryptographic systems. Through a multi-year international competition involving industry, academia, and...

Transit Cybersecurity Framework (CSF) Community Profile | NIST Publishes IR 8576

NIST's NCCoE announces the release of the final NIST Interagency Report (IR) 8576, Transit Cybersecurity Framework (CSF) Community Profile.

Transit Cybersecurity Framework Community Profile

Abstract: This document is a Cybersecurity Framework (CSF) Community Profile developed to support United States-based transit agencies. This “Transit Profile” is aligned with transit sector priorities and best practices and can be used as a guide for prioritizing cybersecurity activities and outco...

Workshop Summary Report for “Cyber AI Profile” Hybrid Workshop #1

Abstract: This report summarizes the discussion at the first “Cyber AI Profile Workshop” in April 2025 during which NIST sought feedback toward the development of a NIST Cybersecurity Framework Community Profile for AI. The Cyber AI Profile will provide guidelines for managing cybersecurity risks...

Workshop Summary Report for “Cyber AI Profile” Hybrid Workshop #2

Abstract: This report summarizes the discussion at the second “Cyber AI Profile Workshop,” in January 2026 during which focused on the Preliminary Draft of the NIST Cybersecurity Framework Profile for Artificial Intelligence (Cyber AI Profile). The workshop gathered input across government, i...

Multi-Cloud Security Public Working Group

Cloud computing has become the core accelerator of the US Government's digital business transformation. NIST is establishing a Multi-Cloud Security Public Working Group (MCSPWG) to research best practices for securing complex cloud solutions involving multiple service providers and multiple clouds. The White House Executive Order on Improving the Nation's Cybersecurity highlights that “the Federal Government needs to make bold changes and significant investments in order to defend the vital institutions that underpin the American way of life” by focusing “the full scope of its authorities...

Federal Cyber Supply Chain Risk Management Forum

About: The Federal Cybersecurity Supply Chain Risk Management (C-SCRM) Forum fosters collaboration and the exchange of C-SCRM information among federal organizations to improve the security of federal supply chains. Through periodic meetings and informal exchanges, the Forum offers all agencies that depend upon or guide C-SCRM an opportunity to discuss issues of interest with – and to inform – many of those leading C-SCRM efforts in the federal ecosystem, including the Office of Management and Budget (OMB), the Department of Defense (DOD), the Cybersecurity and Infrastructure Security...

Federal C-SCRM Forum Participation and Email Listserv Information

Participating in Federal C-SCRM Forum Participation in the Forum, including events and online exchanges, is open to: federal C-SCRM program managers federal personnel who have a dedicated and recurring responsibility for performing C-SCRM functions federal contractors who provide direct C-SCRM support (upon request by their federal sponsor and approval by the Forum co-hosts). The Forum may establish working groups or study groups and welcomes all suggestions to the co-hosts. NIST is hosting the Forum as part of its mandate under the SECURE Technology Act and the Federal...

Automotive Cybersecurity Community of Interest (COI)

The automotive industry is facing significant challenges from increased cybersecurity risk and adoption of AI and opportunities from rapid technological innovations. NIST is setting up this community of interest (COI) to allow the industry, academia, and government to discuss, comment, and provide input on the potential work that NIST is doing which will affect the automotive industry. Topics of interest include, but are not limited to: Cryptography Cryptographic agility Migration to secure algorithms, e.g., quantum resistant cryptography Supply chain Code integrity and...

NIST releases the finalized C-SCRM Due Diligence Assessment Quick-Start Guide

This Quick-Start Guide based on the widely adopted content in NIST SP 800-161r1 proposes an implementation-ready approach to conducting the minimum amount of reasonable research and investigative rigor on potential suppliers.

NIST Cybersecurity Supply Chain Risk Management: Due Diligence Assessment Quick-Start Guide

Abstract: Due diligence research is the investigative process of researching all available, pertinent information about a given supplier or product so that informed decisions can be made on new acquisitions or existing systems. This Quick-Start Guide provides cybersecurity supply chain risk management (C-SCRM...

cybersecurity supply chain risk management plan

Security, Privacy, and C-SCRM Risk Management Plans: NIST Releases SP 800-18r2

NIST has released Special Publication (SP) 800-18r2 (Revision 2), Developing Security, Privacy, and Cybersecurity Supply Chain Risk Management Plans for Systems. This revision broadens the scope of system planning to encompass three interconnected plan types that are collectively referred to as "system plans". Essential system plan elements are correlated with the steps and tasks of the NIST Risk Management Framework (RMF) to provide a streamlined approach to system plan development.

Developing Security, Privacy, and Cybersecurity Supply Chain Risk Management Plans for Systems

Abstract: The system security plan, system privacy plan, and cybersecurity supply chain risk management plan are collectively referred to as system plans. They describe the purpose of the system, the operational status of the controls selected and allocated for meeting risk management requirements, and the re...

NCCoE Project Description Focused on Operational Technology (OT) Asset Management

The NCCoE is seeking feedback on the draft Project Description Asset Management as a Foundation for OT Cybersecurity , outlining the proposed scope, challenges, and technical approach for the project.

Asset Management as a Foundation for Operational Technology Cybersecurity

Abstract: Operational Technology (OT) environments often lack comprehensive asset inventories due to a lack of resourcing, limitations of legacy systems, geographically distributed assets, diverse communication protocols, and operational constraints. OT environments also face unique asset management challenge...