Search CSRC

Requesting Public Comment | NIST Guidance on Implementing a Zero Trust Architecture (ZTA)

The NIST National Cybersecurity Center of Excellence (NCCoE) has released the draft of the practice guide, Implementing a Zero Trust Architecture (NIST SP 1800-35), for public comment. The public comment period is open through January 31, 2025.

Standards/Guidelines

These are standard publications and guidelines that provide perspectives and frameworks to inform, measure, and manage cybersecurity vulnerabilities and exposures. NIST SP 800-55 Vol. 1 Measurement Guide for Information Security: Volume 1 — Identifying and Selecting Measures Volume 1, Identifying and Selecting Measures, provides a flexible approach to the development, selection, and prioritization of information security measures. This volume explores both quantitative and qualitative assessment and provides basic guidance on data analysis techniques as well as impact and likelihood...

Tools

These are tools and utilities to assess the level of security risks and provide a mechanism to enhance automation for the cybersecurity information exchange. Baldrige Cybersecurity Excellence Builder (BCEB) A self-assessment tool to help organizations better understand the effectiveness of their cybersecurity risk management efforts and identity improvement opportunities in the context of their overall organizational performance. Common Vulnerability Scoring System (CVSS) An open framework for communicating the characteristics and severity of software vulnerabilities. CVSS is well...

Reference Sources

These are reference sources for frameworks, algorithms validation, software assurance, testing, and other measurements related to information security. Automated Combinatorial Testing for Software Combinatorial or t-way testing is a proven method for more effective software testing at lower cost. The research toolkit can make sure that there are no simultaneous input combinations that might inadvertently cause a dangerous error. Cryptographic Algorithm Validation Program (CAVP) The NIST Cryptographic Algorithm Validation Program provides validation testing of Approved (i.e.,...

Implementing a Zero Trust Architecture

Abstract: A zero trust architecture (ZTA) enables secure authorized access to enterprise resources that are distributed across on-premises and multiple cloud environments, while enabling a hybrid workforce and partners to access resources from anywhere, at any time, from any device in support of the organizat...

External References

***Disclaimer: Items in the following lists are provided for research purposes, and do not imply endorsement by NIST.*** U.S. Government Activities / Initiatives Related Standards / Best Practices C-SCRM Research / References Involved Standards Organizations / Associations U.S. Government Activities / Initiatives Committee on National Security Systems Directive (CNSSD) 505 - "...provides the guidance for organizations that own, operate, or maintain [National Security Systems (NSS)] to address supply chain risk and implement and sustain SCRM capabilities". Comprehensive National...

NIST Report on the 2024 Accordion Cipher Mode Workshop

NIST releases NIST IR 8537, NIST Workshop on the Requirements for an Accordion Cipher Mode 2024: Workshop Report.

NIST Privacy Workforce Taxonomy

Abstract: This document provides a taxonomy of Task, Knowledge, and Skill (TKS) Statements aligned with the NIST Privacy Framework, Version 1.0 and the NICE Workforce Framework for Cybersecurity model of TKS Statement building blocks. It contains a mapping of the Taxonomy’s TKS Statements to the NIST Privacy...

NIST Workshop on the Requirements for an Accordion Cipher Mode 2024: Workshop Report

Abstract: NIST hosted the NIST Workshop on the Requirements for an Accordion Cipher Mode 2024 on June 20--21, 2024, at the National Cybersecurity Center of Excellence in Rockville, Maryland. This report summarizes the participant feedback, key takeaways, and future directions discussed during the event.

OSCAL Mini Workshop Series - Event #30: Leveraging OSCAL to support cybersecurity lifecycle management

Type: Presentation

Forum Meeting - November 19, 2024

The Federal Cybersecurity and Privacy Professionals Forum is an informal group sponsored by the National Institute of Standards and Technology (NIST) to promote the sharing of system security and privacy information among federal, state, and local government, and higher education employees. The Forum maintains an extensive e-mail list and holds quarterly meetings to discuss current issues and items of interest to those responsible for protecting non-national security systems. For more information about the Forum and instructions on how to join, see: https://csrc.nist.gov/Projects/forum....

Welcome and Announcements

Type: Opening Remarks

NIST Cybersecurity Measurement and Assessment

Type: Presentation

Comment Now! NIST Cybersecurity White Paper: Mitigating Cybersecurity and Privacy Risks in Telehealth Smart Home Integration

The NCCoE has released for public comment the draft of NIST Cybersecurity White Paper (CSWP) 34, Mitigating Cybersecurity and Privacy Risks in Telehealth Smart Home Integration. The comment period for the draft is now open through January 21, 2025.

NCCoE Released NIST CSWP 36C, Reallocation of Temporary Identities - Applying 5G Cybersecurity and Privacy Capabilities White Paper Series for Public Comment

Draft CSWP 36C, Reallocation of Temporary Identities - Applying 5G Cybersecurity & Privacy Capabilities White Paper Series for Public Comment. The public comment period is open through December 6, 2024.

NIST Cybersecurity Framework 2.0 Overview & Updates

Type: Presentation

NIST Small Business Cybersecurity Program

Type: Presentation

Mitigating Cybersecurity and Privacy Risks in Telehealth Smart Home Integration: Healthcare and Public Health Sector Risk Management Approaches

Abstract: In-patient service demands have increased during a time when patients have experienced reduced access to hospital care. Hospital-at-Home (HaH) solutions provide an in-patient care experience for patients, which may result in reduced costs and improved outcomes. While these are desirable benefits, Ha...

Reallocation of Temporary Identities: Applying 5G Cybersecurity and Privacy Capabilities

Abstract: This white paper is part of a series called Applying 5G Cybersecurity and Privacy Capabilities, which covers 5G cybersecurity- and privacy-supporting capabilities that were implemented as part of the 5G Cybersecurity project at the National Cybersecurity Center of Excellence (NCCoE). This white pape...

NEW | NIST Releases Errata Update for Cybersecurity Supply Chain Risk Management Guidance

NIST has released an errata update to its foundational publication on managing cybersecurity risks in supply chains.

cybersecurity supply chain risk assessment

cybersecurity outcome

Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations

Abstract: Organizations are concerned about the risks associated with products and services that may potentially contain malicious functionality, are counterfeit, or are vulnerable due to poor manufacturing and development practices within the supply chain. These risks are associated with an enterprise’s decr...

Automation of the NIST Cryptographic Module Validation Program: September 2024 Status Report

A draft of NIST Cybersecurity White Paper (CSWP) 37, "Automation of the NIST Cryptographic Module Validation Program: September 2024 Status Report," is now available for public comment through December 4, 2024.

Automation of the NIST Cryptographic Module Validation Program: September 2024 Status Report

Abstract: The Cryptographic Module Validation Program (CMVP) validates third-party assertions that cryptographic module implementations satisfy the requirements of Federal Information Processing Standards (FIPS) Publication 140-3, Security Requirements for Cryptographic Modules. The NIST National Cybersecurit...