Search CSRC

See full details on our NIICS home page.

Credits: Ned Goren NED GOREN IT Specialist ITL/CSD/SSA NIST Nedim Goren (Ned) is a security researcher for the NIST Secure Systems and Applications Group. Prior to that Ned was a member of the RMF (FISMA) Team at NIST. Prior to joining NIST, he served as a security control assessor and lead ISSO at the Census Bureau. Ned started conducting security control assessments in 2005, first as a contractor and since 2009 as a federal employee. As lead ISSO, he managed the day-to-day operations of the consolidated Census Bureau ISSOs. At NIST Ned was also a...

MCSPWF subscribers to the MCSPWG (see the Overview page for subscribing to the mailing list) have access to documents uploaded on the PWG’s Google Drive (Public directory) when logged in with the subscribed email. PWG Google Drive: https://drive.google.com/drive/folders/1c9OV10sAQGFRMplsQALSrKNMtjqKx1CQ?usp=sharing 2025 - Plenary meetings: every 2 weeks Date Meeting Brief Agenda /Notes   01/23/2025 3 PM ET MCSPWG ZTA and ATO Focus Groups Merged Meeting Agenda   01/23/2025 3 PM ET MCSPWG ZTA and ATO Focus Groups Merged Meeting Summary...

I. Introduction NIST scientific or technical Public Working Groups bring together organizations actively engaged in the specific field of interest and consist of subject-matter experts who collaborate to determine best practices and to develop consensus standards. During the past decade, NIST has convened multi-disciplinary cloud computing working groups to take on specific challenges that impact the broad US Government adoption of complex cloud-based solutions that combine services from more than one cloud service provider (CSP). The change in technical operations and control dynamics for...

Title / Topic  Description Executive Order (EO) 14028 On Improving The Nation's Cybersecurity Executive Order 14028, “Improving the Nation’s Cybersecurity” marks a renewed commitment and prioritization of federal cybersecurity modernization and strategy. To keep pace with modern technological advancements and evolving threats, the Federal Government continues to migrate to the cloud. In support of these efforts, the Secretary of Homeland Security acting through the Director of the Cybersecurity and Infrastructure Security Agency...

Note: The following is archived information related to NIST SP 800-179. CSD’s macOS security configuration team is working to develop secure system configuration baselines supporting different operational environments for Apple macOS version 10.12, “Sierra.” These configuration guidelines will assist organizations with hardening macOS technologies and provide a basis for unified controls and settings for federal macOS workstation and mobile system security configurations. The configurations are based on a collection of resources, including the existing NIST macOS configuration guidance, the...

PEC tools include a variety of cryptographic primitives, protocols and techniques useful for enabling privacy. This page uses simplified illustrations of "ideal functionalities" to convey a brief intuition about some representative PEC tools. It should be noted that real protocols for these PEC tools use cryptographic techniques in place of the trusted party (\(\mathcal{F}\)) represented in the figures. Zero Knowledge Proof of Knowledge (ZKPoK) A ZKPoK allows a prover to prove knowledge of a secret \(\color{red}w\) (also called witness), without disclosing it to the verifier. The secret is...

The following NIST-authored publications are directly related to this project. NIST SP 800-232 (initial public draft), Ascon-Based Lightweight Cryptography Standards for Constrained Devices: Authenticated Encryption, Hash, and Extendable Output Functions Call for Algorithms:  Submission Requirements and Evaluation Criteria for the Lightweight Cryptography Standardization Process (August 27, 2018) Retired White Paper, Profiles for the Lightweight Cryptography Standardization Process (retired August 27, 2018) Federal Register Notice, Announcing Request for Nominations for Lightweight...

A generic application (app, for short) of beacon randomness is enabling public-verifiability of randomized procedures. For example, when randomly sampling for audits, auditors are prevented from biasing the selections (or being accused of it), and auditees are prevented from knowing the selections in advance (or being accused of it). An interesting randomness/determinism duality: although beacon applications relate to the use of randomness, their public auditability requires a well specified deterministic operation (which then uses as input the needed random values). The remainder of this...

Official comments on the Fourth Round Candidate Algorithms should be submitted using the "Submit Comment" link for the appropriate algorithm. Comments from the pqc-forum Google group subscribers will also be forwarded to the pqc-forum Google group list. We will periodically post and update the comments received to the appropriate algorithm. All relevant comments will be posted in their entirety and should not include PII information in the body of the email message. Please refrain from using OFFICIAL COMMENT to ask administrative questions, which should be sent to [email protected] The...

Official comments on the Selected Algorithms should be submitted using the "Submit Comment" link for the appropriate algorithm. Comments from the  pqc-forum Google group subscribers will also be forwarded to the pqc-forum Google group list. We will periodically post and update the comments received to the appropriate algorithm. All relevant comments will be posted in their entirety and should not include PII information in the body of the email message. Please refrain from using OFFICIAL COMMENT to ask administrative questions, which should be sent to [email protected] July 2022:  The...

Why are we doing this? NIST seeks to : Accelerate the adoption of our cybersecurity and privacy standards, guidelines, and frameworks by making it much easier for users of NIST products to identify, locate, compare, and customize content across NIST’s standards, guidelines, and practices. Add value to our existing reference datasets by delivering human- and machine-consumable reference datasets. The CPRT provides a centralized, standardized, and modernized mechanism for managing reference datasets, eventually creating the opportunity to correlate and establish relationships...

XLSX: All CPRT data and queries can be downloaded in XLSX format. This is the common format used by Microsoft Excel. JSON: All CPRT data uses a common format. Therefore, every document, and query, within the CPRT can use the same JSON schema. This schema provides a machine readable view into the CPRT for users to interact with the data in a repeatable and predictable way. The schema is flat, containing only 4 top level elements (documents, elements, relationships, relationship_types). This structure allows users to quickly iterate through the data and build any data structure that suits...

Our initial planning for the CPRT project comprises three phases: Phase 1: Free the Data We are currently in Phase 1, which involves developing the data format and freeing the data from a selection of our guidelines and frameworks with broad impact. This data is typically locked into publications. By moving it into a shared repository using a newly-developed unified data format, we will now be able to offer new ways to interact with and download the data. Phase 1 offers only basic tools for interacting within each reference datasets. Phase 2: Manage the Data Phase 2 in late 2023 will...

In January 2022, the George Mason University Cryptographic Engineering Research Group (CERG) team published three calls to assist in evaluating protected implementations of the finalists: Call for Protected Hardware Implementations, targeting low-cost modern FPGAs Call for Protected Software Implementations, targeting low-cost modern embedded processors Call for Side-Channel Security Evaluation Labs The NIST team encourages submitters and third parties to contribute to this initiative.  Performance benchmarking results are provided in the following pages: Microcontroller...

Date Event July 20-21, 2015  First Lightweight Cryptography Workshop at NIST  August 11, 2016  (Draft) NIST IR 8114 is published.  October 17-18, 2016 Second Lightweight Cryptography Workshop at NIST    October 31, 2016  End of public comment period to Draft NISTIR 8114  Public comments received (August 11 - October 31,2016)  March 28, 2017  NIST IR 8114, Report on Lightweight Cryptography is published.  April 26, 2017 (Draft) Profiles for Lightweight cryptography standardization process is...

Validation Number: 146 Vendor: BMC Product Name: BMC Client Management Product Major Version: 21 Product Version Tested: 21.02.03 Tested Platforms: Microsoft Windows 7 SP1 64-bit Microsoft Windows 8.1 SP0 64-bit Microsoft Windows 10 SP0 64-bit Microsoft Windows Server 2012 R2 SP0 64-bit Red Hat Enterprise Linux 6 64-bit Red Hat Enterprise Linux 7 64-bit SCAP 1.3 Capabilities: Authenticated Configuration Scanner Common Vulnerabilities and Exposures (CVE) Option Validated...

Security Requirements for Protecting CUI Purpose Recommended security requirements for protecting the confidentiality of CUI:      (1) when the CUI is resident in a nonfederal system and organization;      (2) when the nonfederal organization is not collecting or maintaining information on behalf of a federal agency or using or operating a system on behalf of an agency; and      (3) where there are no specific safeguarding requirements for protecting the confidentiality of CUI prescribed by the authorizing law, regulation, or governmentwide policy for the CUI category listed in the CUI...

Enhanced Security Requirements for Protecting Controlled Unclassified Information: A Supplement to NIST Special Publication 800-171 Purpose Enhanced security requirements to help protect the confidentiality, integrity, and availability of Controlled Unclassified Information (CUI) associated with critical programs or high value assets from the advanced persistent threat (APT). Scope The enhanced security requirements in NIST SP 800-172 are supplemental and do not impact the basic and derived security requirements contained in NIST SP 800-171, nor the scope of the implementation of the NIST...

Assessing Security Requirements for Controlled Unclassified Information Purpose Assessment procedures and a methodology that can be employed to conduct assessments of the CUI security requirements in NIST SP 800-171. Scope A system security plan describes how the SP 800-171 security requirements are met. The plan describes the system boundary; the environment in which the system operates; how the requirements are implemented; and the relationships with or connections to other systems. The scope of the assessments conducted using the procedures described in SP 800-171A are guided and...

Accessing Enhanced Security Requirements for Controlled Unclassified Information Purpose Assessment procedures and a methodology that can be employed to conduct assessments of the enhanced security requirements in NIST Special Publication 800-172. Scope Assessments conducted using the SP 800-172A procedures are guided and informed by the system security plans for the organizational systems processing, storing, or transmitting CUI. The assessments focus on the overall effectiveness of the security safeguards intended to satisfy the SP 800-172 enhanced security requirements. Download the SP...

November 1, 2022: NIST issues summary and analysis of responses to the CUI Series pre-draft call for comments. Comments received in response to the pre-draft call for comments on the CUI Series. Submitters’ names and affiliations (when provided) will be included, while contact information will be removed. Date  Received From July 19, 2022 Williams International July 19, 2022 Real IT Care July 19, 2022 RSM US LLP July19, 2022 ePlus Technology, Inc July 19, 2022 Mercy Medical Center July 20, 2022 ESN...

Examples of combinatorial coverage achieved by real-world test suites in various application domains.  The test suites studied in these examples were designed using conventional methods, i.e., they were not developed using ACTS or another covering array tool.   Application Config t = 2 t = 3 t = 4 t = 5 t = 6 Reference Spacecraft control 132754262 0.940 0.831 0.668 0.536   Maximoff, J. R., Kuhn, D. R., Trela, M. D., &...

Call for Additional Digital Signature Schemes for the Post-Quantum Cryptography Standardization Process (PDF) Closed June 1, 2023 The Round 2 candidates were announced October 24, 2024. NIST IR 8528, Status Report on the First Round of the Additional Digital Signature Schemes for the NIST Post-Quantum Cryptography Standardization Process is now available. NIST announced that the PQC standardization process is continuing with a fourth round, with the following KEMs still under consideration: BIKE, Classic McEliece, HQC, and SIKE. However, there are no remaining digital signature candidates...