Search CSRC

Includes advisory boards, committees, communities of interest, forums, and working groups that are sponsored or managed by NIST's cybersecurity and privacy program. Also see information on joining one or more of the National Cybersecurity Center of Excellence's (NCCoE) many Communities of Interest.

CHIPS and Science Act of 2022 (Public Law 117-167; August 9, 2022)

Quick-Start Guides are intended to give users an easy starting point for understanding relevant NIST technical publications and resources. 

See the NIST semiconductors page for additional NIST resources, including a semiconductor glossary and information about the CHIPS Act.  

Vulnerabilities are "weaknesses in an information system, system security procedures, internal controls, or implementation that could be exploited or triggered by a threat source." [SP 800-37 Rev. 2, Appendix B]

See the Protecting Controlled Unclassified Information project for more information, as well as the National Archives' CUI Registry.

Sustaining Select Efforts To Strengthen the Nation's Cybersecurity and Amending Executive Order 13694 and Executive Order 14144 (June 6, 2025)

Office of Management and Budget (OMB) Memorandum M-26-15, Execution of the Migration to Post-Quantum Cryptography (June 24, 2026).

Securing the Nation Against Advanced Cryptographic Attacks (June 22, 2026)

The following NIST documents were created to brief a blue ribbon Committee of Visitors (COV) charged with reviewing the agency’s cryptographic standards and guidelines program by NIST’s primary independent advisory panel, the Visiting Committee on Advanced Technology (VCAT).  The VCAT held a public meeting on July 14, 2014 to discuss the recommendations from the COV members and finalize a report detailing recommendations to NIST on steps to strengthen its cryptographic standards and guidelines program. The VCAT's report, along with the individual recommendations of the COV members, are...

07/01/2018 The CMVP's symmetric key wrapping transition plan to comply to NIST SP 800-38F (as specified in SP 800-131A) has been completed (see 12/20/17 Notice)  As a result, the NIST PIV Validation Program has updated its PIV Card Application Validation List by moving affected modules with PIV Card Applications to the Removed Product’s List. 06/30/2018 The two 1-year extensions to continue issue PIV Cards with RNG rather than with DRBG ended June 30th 2018. As a result, the NIST PIV Validation Program has removed listings of PIV Card with RNG implementation from the PIV Card Application...

NPIVP maintains validation lists for validated PIV Card Applications and PIV Middleware. The PIV Card Application validation list is updated as new PIV Card Applications receive validation certificates from the NPIVP. The PIV Middleware Validation is discontinued beginning with SP 800-73-5 specifications since smart card support is natively supported by most endpoint devices -without the need of PIV middleware. To be listed on the NPIVP validated product list, a product must be tested in a NPIVP Test Facility using approved test methods and test tools.   PIV Card Application Validation...

NPIVP maintains pre-validation lists for PIV Card Applications and PIV Middleware. Participation on the lists is voluntary and is a joint decision by the vendor and the NPIVP test facility. Products are listed alphabetically by vendor name. Posting on the list does not imply guarantee of final validation. PIV Card Application Pre-Validation List PIV Middleware Pre-Validation List

All NPIVP test facilities are third-party laboratories accredited by the National Voluntary Laboratory Accreditation Program (NVLAP) under the Cryptographic and Security Testing (CST) Laboratory Accreditation Program (LAP) to conduct testing for PIV card application and PIV middleware test methods. atsec information security corporation  9130 Jollyville Road Suite 260 Austin, TX 78759 USA  Lab Director: Yi Mao TEL: 512-615-7300 FAX: 512-615-7301 NVLAP Lab Code 200658-0 EWA - Canada IT Security Evaluation & Test Facility 55 Metcalfe Street, Suite 1600 Ottawa, Ontario K1P 6L5 Canada Lab...

Software Download (last updated February 13, 2020): SP 800-73-4 Test Runner for PIV Card Applications, Middleware and Data Model       Note: File is a zipped (.zip) file & is 12.4 MB in size.       Depending on Internet speed, this software download may take little time to download to several minutes.   Please send an e-mail to [email protected] to request for a password to unzip the Test Runner file and/or for any questions you may have.

The CSOR has allocated the following registration branch for cryptographic algorithm objects: nistAlgorithms OBJECT IDENTIFIER ::= { joint-iso-ccitt(2) country(16) us(840) organization(1) gov(101) csor(3) nistAlgorithm(4) } The CSOR only registers NIST-approved cryptographic algorithms. When an algorithm has already been externally assigned an object identifier (e.g., for EdDSA digital signature), no new OID will be assigned in the CSOR arc. Information about externally assigned OIDs is provided toward the end of the page. Registered Objects ASN.1 Modules AES Secure Hash Algorithms...

The CSOR has allocated the following registration branch for objects defined under the ARPA/Air Force-sponsored Information Object Security (IOS) project: {joint-iso-ccitt(2) country(16) us(840) organization(1) gov(101) csor(3) iosp(3)}. The IOS project was a multi-year effort to investigate and develop advanced security services to the Internet sponsored by the Advanced Research Project Agency (ARPA) and the Air Force. The architecture developed consists of sequences of components specified in ASN.1. Each component, and subsequent sub-type, carries an object identifier. Most of the...

The CSOR has allocated the following registration branch for Public Key Infrastructure (PKI) objects: csor-pki ::= {joint-iso-ccitt(2) country(16) us(840) organization(1) gov(101) csor(3) pki(2)} Policies OIDs are allocated in the following arc: csor-certpolicy ::= { csor-pki 1 } For agencies requesting a new policy OID, please send email with OID name, associated document and point of contact information. Additional information on Federal PKI activities is available at:  https://www.idmanagement.gov/fpki ACES Registered Objects August 2020: The ACES project is no longer...

The NIST Framework for Improving Critical Infrastructure Cybersecurity ("the Framework") released in February 2014 was published simultaneously with the companion Roadmap for Improving Critical Infrastructure Cybersecurity. The Roadmap identified Cyber Supply Chain Risk Management (Cyber SCRM) as an area for future focus. Since the release of the Framework and in support of the companion Roadmap, NIST has researched industry best practices in cyber supply chain risk management through engagement with industry leaders.  In 2014 and 2015, NIST interviewed a diverse set of organizations and...

NIST regularly conducts and awards contracts, grants, or cooperative agreements to conduct research into cybersecurity supply chain risk management (C-SCRM) and related topics. The following are relevant research activities:   Cyber Risk Analytics: A NIST and GSA-Sponsored grant from 2015-2017 examining the relationship between various risk management practices and publicly disclosed breaches. The Cyber Risk Predictive Analytics Project Cyber Risk Analytics Project Review Workshop (with video) Industry C-SCRM Best Practices: Ongoing work developing case studies exploring effective risk...

ABOUT Next Forum | Past Forums Cyber risk has become a topic of core strategic concern for business and government leaders worldwide and is an essential component of an enterprise risk management strategy. The Software and Supply Chain Assurance (SSCA) Forum provides a venue for government, industry, and academic participants from around the world to share their knowledge and expertise regarding software and supply chain risks, effective practices and mitigation strategies, tools and technologies, and any gaps related to the people, processes, or technologies involved. The effort...