Search CSRC

Executive Order 14028

Improving the Nation's Cybersecurity (May 12, 2021). For more information, see this other NIST site.

NIST Genomic Data Cybersecurity and Privacy Publications | Comment Period Open

The second public draft of NIST Internal Report (IR) 8467, "Genomic Data Cybersecurity and Privacy Frameworks Community Profile" and the initial public draft of NIST Cybersecurity White Paper (CSWP) 35, "Cybersecurity Threat Modeling the Genomic Data Sequencing Workflow" are open for public comment through January 30, 2025.

Cybersecurity Threat Modeling the Genomic Data Sequencing Workflow: An example threat model implementation for genomic data sequencing and analysis

Abstract:

Genomic Data Cybersecurity and Privacy Frameworks Community Profile

Abstract: Advancements in genomic sequencing technologies are accelerating the speed and volume of data collection, sequencing, and analysis. However, this progress also heightens cybersecurity and privacy risks. This Genomic Data Cybersecurity and Privacy Frameworks Community Profile (“Genomic Data Profile”)...

Requesting Public Comment | NIST Guidance on Implementing a Zero Trust Architecture (ZTA)

The NIST National Cybersecurity Center of Excellence (NCCoE) has released the draft of the practice guide, Implementing a Zero Trust Architecture (NIST SP 1800-35), for public comment. The public comment period is open through January 31, 2025.

Standards/Guidelines

These are standard publications and guidelines that provide perspectives and frameworks to inform, measure, and manage cybersecurity vulnerabilities and exposures. NIST SP 800-55 Vol. 1 Measurement Guide for Information Security: Volume 1 — Identifying and Selecting Measures Volume 1, Identifying and Selecting Measures, provides a flexible approach to the development, selection, and prioritization of information security measures. This volume explores both quantitative and qualitative assessment and provides basic guidance on data analysis techniques as well as impact and likelihood...

Tools

These are tools and utilities to assess the level of security risks and provide a mechanism to enhance automation for the cybersecurity information exchange. Baldrige Cybersecurity Excellence Builder (BCEB) A self-assessment tool to help organizations better understand the effectiveness of their cybersecurity risk management efforts and identity improvement opportunities in the context of their overall organizational performance. Common Vulnerability Scoring System (CVSS) An open framework for communicating the characteristics and severity of software vulnerabilities. CVSS is well...

Reference Sources

These are reference sources for frameworks, algorithms validation, software assurance, testing, and other measurements related to information security. Automated Combinatorial Testing for Software Combinatorial or t-way testing is a proven method for more effective software testing at lower cost. The research toolkit can make sure that there are no simultaneous input combinations that might inadvertently cause a dangerous error. Cryptographic Algorithm Validation Program (CAVP) The NIST Cryptographic Algorithm Validation Program provides validation testing of Approved (i.e.,...

NIST Report on the 2024 Accordion Cipher Mode Workshop

NIST releases NIST IR 8537, NIST Workshop on the Requirements for an Accordion Cipher Mode 2024: Workshop Report.

NIST Privacy Workforce Taxonomy

Abstract: This document provides a taxonomy of Task, Knowledge, and Skill (TKS) Statements aligned with the NIST Privacy Framework, Version 1.0 and the NICE Workforce Framework for Cybersecurity model of TKS Statement building blocks. It contains a mapping of the Taxonomy’s TKS Statements to the NIST Privacy...

NIST Workshop on the Requirements for an Accordion Cipher Mode 2024: Workshop Report

Abstract: NIST hosted the NIST Workshop on the Requirements for an Accordion Cipher Mode 2024 on June 20--21, 2024, at the National Cybersecurity Center of Excellence in Rockville, Maryland. This report summarizes the participant feedback, key takeaways, and future directions discussed during the event.

OSCAL Mini Workshop Series - Event #30: Leveraging OSCAL to support cybersecurity lifecycle management

Type: Presentation

Forum Meeting - November 19, 2024

The Federal Cybersecurity and Privacy Professionals Forum is an informal group sponsored by the National Institute of Standards and Technology (NIST) to promote the sharing of system security and privacy information among federal, state, and local government, and higher education employees. The Forum maintains an extensive e-mail list and holds quarterly meetings to discuss current issues and items of interest to those responsible for protecting non-national security systems. For more information about the Forum and instructions on how to join, see: https://csrc.nist.gov/Projects/forum....

Welcome and Announcements

Type: Opening Remarks

NIST Cybersecurity Measurement and Assessment

Type: Presentation

Comment Now! NIST Cybersecurity White Paper: Mitigating Cybersecurity and Privacy Risks in Telehealth Smart Home Integration

The NCCoE has released for public comment the draft of NIST Cybersecurity White Paper (CSWP) 34, Mitigating Cybersecurity and Privacy Risks in Telehealth Smart Home Integration. The comment period for the draft is now open through January 21, 2025.

NCCoE Released NIST CSWP 36C, Reallocation of Temporary Identities - Applying 5G Cybersecurity and Privacy Capabilities White Paper Series for Public Comment

Draft CSWP 36C, Reallocation of Temporary Identities - Applying 5G Cybersecurity & Privacy Capabilities White Paper Series for Public Comment. The public comment period is open through December 6, 2024.

NIST Cybersecurity Framework 2.0 Overview & Updates

Type: Presentation

NIST Small Business Cybersecurity Program

Type: Presentation

Reallocation of Temporary Identities: Applying 5G Cybersecurity and Privacy Capabilities

Abstract: This white paper is part of a series called Applying 5G Cybersecurity and Privacy Capabilities, which covers 5G cybersecurity- and privacy-supporting capabilities that were implemented as part of the 5G Cybersecurity project at the National Cybersecurity Center of Excellence (NCCoE). This white pape...

NEW | NIST Releases Errata Update for Cybersecurity Supply Chain Risk Management Guidance

NIST has released an errata update to its foundational publication on managing cybersecurity risks in supply chains.

cybersecurity supply chain risk assessment

cybersecurity outcome

Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations

Abstract: Organizations are concerned about the risks associated with products and services that may potentially contain malicious functionality, are counterfeit, or are vulnerable due to poor manufacturing and development practices within the supply chain. These risks are associated with an enterprise’s decr...

Automation of the NIST Cryptographic Module Validation Program: September 2024 Status Report

A draft of NIST Cybersecurity White Paper (CSWP) 37, "Automation of the NIST Cryptographic Module Validation Program: September 2024 Status Report," is now available for public comment through December 4, 2024.