Search CSRC

In order to perform FIPS 140 conformance testing, a laboratory must become an accredited CST laboratory under the National Voluntary Laboratory Accreditation Program (NVLAP). A list of current labs may be found by visiting National Voluntary Laboratory Accreditation Program (NVLAP) / Directory Search and under the "Program" drop-down select “ITST: Cryptographic and Security Testing”. Module testing results produced by an accredited CST laboratory can then be submitted to the CMVP in order to seek FIPS 140 module validation. CST labs and NIST each charge fees for their respective parts of the...

All questions regarding the implementation and/or use of any validated cryptographic module should first be directed to the appropriate VENDOR point of contact (listed for each entry).   SEARCH our database of validated modules. The validated modules search provides access to the official validation information of all cryptographic modules that have been tested and validated under the Cryptographic Module Validation Program as meeting requirements for FIPS 140-1, FIPS 140-2, and FIPS 140-3. The search results list all issued validation certificates that meet the supplied search criteria and...

DISCLAIMER: The Cryptographic Module Validation Program (CMVP) Modules In Process and Implementation Under Test (IUT) Lists are provided for information purposes only. Participation on the list is voluntary and is a joint decision by the vendor and Cryptographic Security and Testing Laboratory (CSTL). Modules are listed alphabetically by vendor name. Posting on the list does not imply guarantee of final validation. The status / state of each cryptographic module in the process is identified below with the current action in parenthesis.  Modules In Process List Cost Recovery (NIST Billing...

2023 [10-30-2023] Implementation Guidance for FIPS PUB 140-2 and the Cryptographic Module Validation Program has been updated. Updated Guidance   G.8 Revalidation Requirements – Added requirements in Scenario 3B for a table indicating which certificate fields have been updated. G.17 Remote Testing for Modules – Updated to be consistent with the FIPS 140-3 remote testing guidance. D.4 Requirements for Vendor Affirmation of SP 800-56B- Removed reference to the December 31, 2023 transition. D.9 Key Transport Methods – Updated the language on the December 31, 2023...

CMVP FIPS 140-2 Management Manual (updated 03-10-2023) The purpose of the CMVP Management Manual is to provide effective guidance for the management of the CMVP, and the conduct of activities necessary to ensure that the standards are fully met. The CMVP Management Manual describes the CMVP process and is applicable to the CMVP Validation Authorities, the CST Laboratories, and the vendors who participate in the program. Consumers who procure validated cryptographic modules may also be interested in the contents of this manual. This manual outlines the management activities and specific...

Below are the resources provided by the CMVP for use by testing laboratories and vendors. [10-22-2019]  IG G.19.2 Hardware Equivalency Table This table is used as an additional resource to IG G.19 Operational Equivalency Testing for HW Modules.    

FIPS 140-3 Logo Usage and Application What are the official FIPS 140-3 validated product logos?  or  For validated products, the logo must be accompanied by the "FIPS 140-3 Validated" and the certificate number. If a product has a FIPS 140-3 module internal to the product, "FIPS 140-3 Inside" and the certificate number must also accompany the logo. The FIPS 140-3 logo is a Certification Mark of NIST, which does not imply product endorsement by NIST, the U.S. or Canadian Governments. What are the guidelines for the use of the FIPS 140-3 logo?  Both phrases "FIPS 140-3 Validated" and...

2018 Notices [11-30-2018]  CMVP Validation Policy The CMVP has a long history of performing validations that show conformance to the FIPS 140-2 standard on any cryptographic module from anywhere in the world regardless of country of origin and/or company.  The US Government passed the National Defense Authorization Act (NDAA) for Fiscal Year 2019 on 13 Aug 2018, which contains language that restricts federal agencies from engaging in business with certain named companies.  US government agencies will be held accountable to ensure that they are not doing business with the companies...

Our Goal The Human-Centered Cybersecurity program within the NIST Human-Centered Technologies Group provides research evidence and guidance to policymakers, system engineers, organizational decision makers, and cybersecurity professionals so that they can make better decisions that consider the human element, thereby advancing cybersecurity adoption and empowering people to be active, informed partners in cybersecurity. Ideally, this guidance should: Have a basis in real empirical data Create solutions that are secure in practice, not just in theory Take stakeholders' needs and behaviors...

We are now actively conducting or have recently completed research in the following areas: Cybersecurity Adoption, Awareness, and Training Internet of Things Phishing Human-Centered Cybersecurity (General) User Perceptions & Behaviors  Voting  Youth Security & Privacy Historically, we have also explored the following topics: Authentication Cryptography Privacy 

NIST Special Publication 800-160, Volume 3 Systems Security Engineering Considerations for Software Assurance   NIST Special Publication 800-160, Volume 4 Systems Security Engineering Considerations for Hardware Assurance

July 18, 2024  Defense Acquisition University https://www.ndu.edu September 11, 2024  14th Annual ISSA-COS Peak Cyber Symposium https://www.peakcyberco.com  October 16, 2024  Virginia Tech National Cybersecurity Awareness Month Event https://www.vt.edu

Blogs… Cybersecurity Risk Management: Choosing the Right Approach to Get the Job Done, June 2023. Taking Measure Rethinking Cybersecurity from the Inside Out, R. Ross, November 2016.   Bulletins… ITL Bulletin Rethinking Security though Systems Security Engineering, R. Ross, L. Feldman, G. Witte, December 2016.   Videos… The Need for Systems Thinking in Cybersecurity, R. Ross, October 2021.

ARCHIVED PROJECT: This project is no longer being supported. The content is no longer being updated, and the information may be outdated.   The following references provide historical background and important details about RBAC.   RBAC Book Role-Based Access Control, 2nd edition (2007) by David Ferraiolo, Ramaswamy Chandramouli, and D. Richard Kuhn   Select a heading to expand/collapse the view. Early Papers D.F. Ferraiolo and D.R. Kuhn (1992), Role-Based Access Controls, 15th National Computer Security Conference. The original RBAC paper; introduced...

ARCHIVED PROJECT: This project is no longer being supported. The content is no longer being updated, and the information may be outdated.   Many organizations are in the process of moving to role based access control. The process of developing an RBAC structure for an organization has become known as "role engineering.". Role engineering can be a complex undertaking, For example, in implementing RBAC for a large European bank with over 50,000 employees and 1400 branches serving more than 6 million customers, approximately 1300 roles were discovered. In view of the complexities, RBAC is...

ARCHIVED PROJECT: This project is no longer being supported. The content is no longer being updated, and the information may be outdated.   The Sarbanes-Oxley Act establishes a set of requirements for financial systems, to deter fraud and increase corporate accountability.  For information technology systems, regulators may need to know who used a system, when they logged in and out, what accesses or modifications were made to what files, and what authorizations were in effect.  IT vendors responding to Sarbanes-Oxley (SOX) requirements have adopted RBAC as central to compliance...

ARCHIVED PROJECT: This project is no longer being supported. The content is no longer being updated, and the information may be outdated.   The following RBAC case studies and experience reports may be useful in planning for RBAC implementations. We will add to this collection as more reports become available. (Please note that the authors and organizations below are not affiliated with NIST or any other agency of the US Government, unless otherwise noted, and NIST cannot endorse or comment on these publications.) Submit comments or suggestions on this collection to the Project...

Publications: Daniel Borbor, Lingyu Wang, Sushil Jajodia, Anoop Singhal,"Securing Networks Against Unpatchable and Unknown Vulnerabilities Using Hetrogeneous Hardening Options", 31st IFIP Conference on Data and Application Security and Privacy (DBSEC 2017), Philadelphia, Pennsylvania, July 19-21, 2017. Xiaoyan Sun, Anoop Singhal, Peng Liu,"Towards Actionable Mission Impact Assessment in the Context of Cloud Computing", 31st IFIP Conference on Data and Application Security and Privacy (DBSEC 2017), Philadelphia, Pennsylvania, July 19-21, 2017. Changwei Liu, Anoop Singhal, Duminda...

An essential type of security risk analysis is to determine the level of compromise possible for important hosts in a network from a given starting location. This is a complex task as it depends on the network topology, security policy in the network as determined by the placement of firewalls, routers and switches and on vulnerabilities in hosts and communication protocols. Traditionally, this type of analysis is performed by a red team of computer security professionals who actively test the network by running exploits that compromise the system. Red team exercises are effective,  however...

The suite of NIST information security risk management standards and guidelines is not a "FISMA Compliance checklist." Federal agencies, contractors, and other sources that use or operate a federal information system use the suite of NIST Risk Management standards and guidelines to develop and implement a risk-based approach to manage information security risk. FISMA emphasizes the importance of risk management. Compliance with applicable laws, regulations, executive orders, directives, etc. is a byproduct of implementing a robust, risk-based information security program. The NIST Risk...

A Comprehensive, Flexible, Risk-Based Approach The Risk Management Framework (RMF) provides a process that integrates security, privacy, and cyber supply chain risk management activities into the system development life cycle. The risk-based approach to control selection and specification considers effectiveness, efficiency, and constraints due to applicable laws, directives, Executive Orders, policies, standards, or regulations. Managing organizational risk is paramount to effective information security and privacy programs; the RMF approach can be applied to new and legacy systems, any type...

Join the NIST Risk Management Framework (FISMA Implementation Project) Email List NIST will inform our stakeholders immediately when updates to the emerging set of security standards and guidelines are available, or when there are important project-related events scheduled. Please note that only mailing list administrators are able to send messages on this email list.    Join the NIST RMF Email List     Troubleshooting If your organization's firewall is preventing you from joining via the NIST Risk Management Framework Email List, please send an email to [email protected]. A NIST...

The purpose of these courses is to provide those new to risk management with an introduction to key publications associated with the NIST Risk Management Framework (RMF) methodology for managing cybersecurity and privacy risk. The RMF Online Introductory Courses are developed by NIST and available on-demand, and free of charge.  Please refer first to the FAQ below for questions about course logistics, topics and content, initial troubleshooting of issues, and certificate of completion and course credit before reaching out to the team with questions.   Select a course below to learn...

As part of a holistic risk management strategy and applying the information security concept of defense-in-depth, organizations should employ appropriate configuration settings on commercial information technology products that compose their organizational systems. These products include, for example, mainframe computers, workstations, portable and mobile devices, and network components. Requirements to establish mandatory configuration settings derive from the Federal Information Security Management Act as implemented by FIPS 200 and NIST Special Publication 800-53 (Control CM-6,...

ARCHIVED PROJECT: This project is no longer being supported. The content is no longer being updated, and the information may be outdated.   The Program Review for Information Security Assistance (PRISMA) project was last updated in 2007; NIST Interagency Report (IR) 7358 and the corresponding PRISMA tool continue to serve as useful resources for high-level guidance and as a general framework, but may not be fully consistent with changes to requirements, standards and guidelines for securing systems. Option one of a PRISMA review focuses on the strategic aspects of the overall...