Search CSRC

Date: August 18, 2006  Document version: 0.1 This is a draft report and does not represent an official position of The MITRE Corporation. Copyright © 2006, The MITRE Corporation. All rights reserved. Permission is granted to redistribute this document if this paragraph is not removed. This document is subject to change without notice. Table of Contents Summary and Purpose Content Decisions CD.1 Effect vs. Technical Mechanism (Basic CD) CD.2 One Effect/Multiple Technical Mechanisms (Combine) CD.3 One Effect/Multiple Parameter Values (Combine) CD.4 Single Object vs. Parameters...

CCE is industry-endorsed through the CCE Working Group, which includes members from industry, academia, and government. IMPORTANT: Activity on the CCE effort has been suspended Send comments or concerns to [email protected]. Participants American International Group, Inc. Application Security Inc. ArcSight, Inc. Belarc, Inc. Bentley College BlackStratus, Inc. Booz Allen Hamilton Center for Internet Security CERIAS/Purdue University Cisco Systems, Inc. Critical Watch Defense Information Systems Agency (DISA) Department of Homeland...

The following overlays are maintained for archival purposes only. They are either not based on the current security and privacy controls in NIST SP 800-53 or the overlay contact information is no longer accurate. Email Messaging Systems Overlay Name:  NIST SP 800-177, Rev. 1, Email Messaging Systems  Overlay Publication Date: February 19, 2019 Technology or System: Email Messaging Systems  Overlay Author: Scott Rose, NIST Overview: Overlay for email messaging systems using the SP 800-53, Revision 4 controls. Email system is taken to mean any system (as defined by FIPS 199), that...

Testing is roughly 50% of the cost of producing consumer software, and can be 90% or more of the cost for a critical application such as aviation.  Combinatorial methods can provide huge reductions in this cost.

Autonomous systems must function correctly in an enormous range of environments.  For example, self-driving cars must deal with lighting, rain, fog, pedestrians, animals, other vehicles, road markings, signs, etc.  How do we ensure that autonomous systems are safe in such complex and rapidly changing environments, when conventional test coverage and formal verification methods cannot be applied?   Achieving assured autonomy in any environment requires methods for measuring the input space, to show that the test environment adequately covers real-world conditions that may be encountered....

Combinatorial approach Case studies

These are current NIST research to identify meaningful metrics and measures in context to understand the effectiveness and resource needs of different cybersecurity technical measures.   Measuring Security Risk in Enterprise Networks Methodology to measure the overall system risk by combining the attack graph structure with the Common Vulnerability Scoring System (CVSS).   Cyber Risk Analytics and Measurement Research and prototype methods and tools to enable predictive risk analytics and identify cyber risk trends. Develop guidelines to improve the assessment and measurement of...

These are standard publications and guidelines that provide perspectives and frameworks to inform, measure, and manage cybersecurity vulnerabilities and exposures.   NIST SP 800-55 Vol. 1 Measurement Guide for Information Security: Volume 1 — Identifying and Selecting Measures Volume 1, Identifying and Selecting Measures, provides a flexible approach to the development, selection, and prioritization of information security measures. This volume explores both quantitative and qualitative assessment and provides basic guidance on data analysis techniques as well as impact and likelihood...

These are tools and utilities to assess the level of security risks and provide a mechanism to enhance automation for the cybersecurity information exchange.   Baldrige Cybersecurity Excellence Builder (BCEB) A self-assessment tool to help organizations better understand the effectiveness of their cybersecurity risk management efforts and identity improvement opportunities in the context of their overall organizational performance.   Common Vulnerability Scoring System (CVSS) An open framework for communicating the characteristics and severity of software vulnerabilities. CVSS is well...

These are reference sources for frameworks, algorithms validation, software assurance, testing, and other measurements related to information security.   Automated Combinatorial Testing for Software Combinatorial or t-way testing is a proven method for more effective software testing at lower cost.  The research toolkit can make sure that there are no simultaneous input combinations that might inadvertently cause a dangerous error.   Cryptographic Algorithm Validation Program (CAVP)  The NIST Cryptographic Algorithm Validation Program provides validation testing of Approved (i.e.,...

Official comments on the Third Round Candidate Algorithms should be submitted using the "Submit Comment" link for the appropriate algorithm. Comments from the pqc-forum Google group subscribers will also be forwarded to the pqc-forum Google group list. We will periodically post and update the comments received to the appropriate algorithm. All relevant comments will be posted in their entirety and should not include PII information in the body of the email message. Please refrain from using OFFICIAL COMMENT to ask administrative questions, which should be sent to [email protected] The...

Information about the CVP exam can be found here: https://home.pearsonvue.com/nist-cmvp The CVP exam is now available. Candidates (FIPS 140 testers) from one of the Cryptographic and Security Testing labs should have the lab’s CVP certification exam POC send an email to NIST CMVP ([email protected]) with the subject line "CVP Test Registration" and the Registration Spreadsheet Template (below) completed and attached. More than one candidate may be listed in the spreadsheet. Associated Documents: CVP Certification Guide PearsonVue ID Policy Candidate Information Spreadsheet...

Online Informative References Submissions We welcome your participation in the Online Informative Reference (OLIR) Program.  The NISTIR 8278Ar1 (Revision 1) National Online Informative References (OLIR) Program: Submission Guidance for OLIR Developers contains detailed participation requirements and all procedures involved during the life cycle. Developers of Informative References considering a submission are welcome to contact NIST with questions. Questions and draft Informative Reference documents should be directed to [email protected]. Submitting parties can expect to hear back from NIST...

This page contains resources referenced in the FIPS 140-3 Management Manual Equivalency Regression Test Table It is possible, under certain conditions, for a vendor to list multiple hardware modules under the same certificate.   Some of the conditions are defined by the equivalency categories based on the technologies types and difference between the modules within the equivalency categories.  For more information regarding equivalency categories and testing level scenarios/categories and usage of the equivalency regression test table presented below, refer to the Management Manual...

Top Level  Special Publications Process Flow Abstracts   Documentation and Governance for the FIPS 140-3 Cryptographic Module Validation Program Federal Information Processing Standards Publication (FIPS) 140-3 became effective September 22, 2019, permitting CMVP to begin accepting validation submissions under the new scheme beginning September 2020. The FIPS 140-3 standard introduces some significant changes in the management over the previous standard. Rather than encompassing the module requirements directly, FIPS 140-3...

FIPS 140-2 (ending Sept-22-2021) Security Requirements for Cryptographic Modules NVLAP accredited Cryptographic and Security Testing (CST) Laboratories perform conformance testing of cryptographic modules. Cryptographic modules are tested against requirements found in FIPS 140-2, Security Requirements for Cryptographic Modules [ PDF ]. Security requirements cover 11 areas related to the design and implementation of a cryptographic module. For each area, a cryptographic module receives a security level rating (1-4, from lowest to highest) depending on what requirements are met. An overall...

FIPS 140-3 Management Manual - Latest Version (04-09-2026) The purpose of the CMVP Management Manual is to provide effective management guidance for the CMVP, CST labs, and the vendors who participate in the program. Consumers who procure validated cryptographic modules may also be interested in the contents of this manual. This manual outlines the management activities, processes, and responsibilities that have been assigned to the various participating groups. This manual includes administrative guidance. For technical aspects of the requirements of the referenced...

RFGs and CMVP Resolutions - Link to Cryptographic Module User Forum (CMUF) webpage where CMVP posts the latest Request For Guidance (RFG) and CMVP Resolutions   FIPS 140-3 IG (August 19, 2026) - Latest version of FIPS 140-3 Implementation Guidance (IG)   IG Change Summary & Archived Versions [08-19-2026] New Guidance: 1.B Clarifications on the Definition and Requirements of Hybrid Modules Updated Guidance: 2.3.C Processor Algorithm Accelerators (PAA) and Processor Algorithm Implementation (PAI) – (Admin update) Added an...

Program Related Transitions Interim Validations The CMVP is offering an interim validation process for module submissions. This interim validation option is voluntary; however, CSTLs must notify CMVP of the vendor's intent prior to 1 Oct 2024.  Vendors do not need to take any action if they would prefer to wait for their full review to be completed to receive full, five-year validation.  Vendors who would like to elect the interim validation should follow the process below.  These module submissions will be reviewed for completeness by CMVP staff.  If needed, there will be a brief...

2026 Fees [Updated 01-05-2026] Cost recovery fees are collected for NIST CMVP report review of new module or entropy submissions, modified module or entropy submissions, and for report reviews that require additional time due to complexity or quality. These fees are referred to as Cost Recovery (CR) and Extended Cost Recovery (ECR). Modules and entropy sources are not validated unless all applicable fees have been collected by NIST Billing. Please see the CMVP FIPS 140-2 Management Manual or CMVP FIPS 140-3 Management Manual for further information. For FIPS 140-2 Currently the CR...

If you would like to participate in the Online Informative Reference (OLIR) Program please consult NISTIR 8278A Rev. 1 National Online Informative References (OLIR) Program: Submission Guidance for OLIR Developers document and become familiar with the requirements and all procedures involved during the life cycle. Developers of Informative References considering a submission are welcome to contact NIST with questions before completing the entire Informative Reference submission package. Questions and draft Informative Reference documents may be directed to [email protected]. Submitting parties can...

The NIST PQC team will host talks -- open to the public -- relating to the 3rd Round of the NIST PQC standardization process. Date Speaker Title Media March 26, 2021 11:00am - 12:00pm* Prasanna Ravi  Temasek Labs, Nanyang Technological University Sujoy Sinha Roy Graz University of Technology Side-Channel Analysis of Lattice-based PQC Candidates Presentation Video February 23, 2021 11:00am - 12:00pm David Jao University of Waterloo Implementation of isogeny-based cryptography Presentation Video...

Go to our Stateful Hash-Based Signatures project.

The NIST NCCoE has launched a new project, Software Supply Chain and DevOps Security Practices. In early 2023, the project team will be publishing a Federal Register Notice based on the final project description to solicit collaborators to work with the NCCoE on the project. NIST held a virtual workshop in January 2021 on improving the security of DevOps practices; you can access the workshop recording and materials here. A second virtual workshop was held in September 2022 on the planned NCCoE DevSecOps project; the workshop recording and presentations are posted. NIST will leverage existing...

Combinatorial coverage measures are used in industry for high assurance software used in critical applications.  Industry examples include the following: Kuhn, D. R., Raunak, M. S., & Kacker, R. N. (2021). Combinatorial Frequency Differencing. NIST Cybersecurity Whitepaper. - Describes measures of the frequency of combination coverage and difference between Class and Non-class elements in machine learning classification problems.  Illustrates application of these methods for identifying weaknesses in physical unclonable function implementations.  Kuhn, D. R., Raunak, M. S., & Kacker, R. N....