Search CSRC

Official comments on the First Round Signatures should be submitted using the "Submit Comment" link for the appropriate algorithm. Comments from the pqc-forum Google group subscribers will also be forwarded to the pqc-forum Google group list. We will periodically post and update the comments received to the appropriate algorithm. All relevant comments will be posted in their entirety and should not include PII information in the body of the email message. Please refrain from using OFFICIAL COMMENT to ask administrative questions, which should be sent to [email protected] The Round 1...

Combinatorial methods make it possible to detect a significant proportion of faults without a conventional test oracle.  This seemingly impossible task is achieved using two layers of covering arrays with equivalence classes. Oracle-free Testing with Two-layer Covering Arrays (NSF Research Experience for Undergraduates presentation, 2015) Kuhn, D. R., Kacker, R. N., Lei, Y., & Torres-Jimenez, J. (2015, April). Equivalence Class Verification and Oracle-free Testing Using Two-layer Covering Arrays. In Software Testing, Verification and Validation Workshops (ICSTW), 2015 IEEE Eighth...

Automated test generation is of little value if it only generates data, without the expected results for each set of inputs.  The methods described below can generate both inputs and expected outputs.  Kuhn DR, D Yaga, Hu, V, Kacker RN, Lei Y. Pseudo-Exhaustive Testing of Rule Based Systems, 30th Intl Conference on Software Engineering and Knowledge Engineering, Redwood City, CA July 1-3, 2018. Kuhn DR, Hu V, Ferraiolo DF, Kacker RN, Lei Y. Pseudo-Exhaustive Testing of Attribute Based Access Control Rules. In2016 IEEE Ninth International Conference on Software Testing, Verification...

Protecting Controlled Unclassified Information (CUI) in nonfederal systems and organizations is critical to federal agencies. The suite of guidance (NIST Special Publication (SP) 800-171, SP 800-171A, SP 800-172, and SP 800-172A) focuses on protecting the confidentiality of CUI and recommends specific security requirements to achieve that objective. Comments Received SP 800-171 Revision 3 (Final Public Draft) and SP 800-171A Revision 3 (Initial Public Draft) February 21, 2024: NIST issues summary and analysis of comments received in response to SP 800-171 Revision 3 (final public...

Short URL: https://csrc.nist.gov/projects/cmvp/sp800-140b This page provides information related to preparing, submitting, coordinating, and finalizing a module for the CMVP. These are the how-to processes and procedures used at the point a CMVP lab has completed testing and is ready to create and submit the package.   Module Package Creation Module Information Structure (MIS) Resources To facilitate automated verification and processing of the modules, much of the information needs to be submitted in a structured and organized format. The CMVP uses JSON as the submission format to...

Welcome to the Computer Forensics Tool Testing (CFTT) Project Web Site. There is a critical need in the law enforcement community to ensure the reliability of computer forensic tools. The goal of the Computer Forensic Tool Testing (CFTT) project at the National Institute of Standards and Technology (NIST) is to establish a methodology for testing computer forensic software tools by development of general tool specifications, test procedures, test criteria, test sets, and test hardware. The results provide the information necessary for toolmakers to improve tools, for users to make informed...

The Computer Forensic Reference DataSet Portal (CFReDS) is a gateway to documented digital forensic image datasets. These datasets can assist in a variety of tasks including tool testing, developing familiarity with tool behavior for given tasks, general practitioner training and other unforeseen uses that the user of the datasets can devise. Most datasets have a description of the type and locations of significant artifacts present in the dataset. There are descriptions and finding aides to help you locate datasets by the year produced, by author, or by attributes of the dataset. All of the...

The Federated Testing project is an expansion of the Computer Forensics Tool Testing (CFTT) Program to provide digital forensics investigators and labs with test suites for tool testing and to support shared test reports. The goal of Federated Testing is to help digital forensics investigators to test the tools that they use in their labs and to enable sharing of tool test results within the digital forensics community. Shared Test Suites  CFTT has developed test suites that will help you test your forensic tool. The test suites are packaged together in a live Linux .iso file. To test your...

The primary goal of the Tool Catalog is to provide an easily searchable catalog of forensic tools. This enables practitioners to find tools that meet their specific technical needs. The Catalog provides the ability to search by technical parameters based on specific digital forensics functions, such as disk imaging or deleted file recovery. Note: tool information is provided by the vendor. Any mention of commercial or non-commercial products is for information only and does not imply that a product has been tested. https://toolcatalog.nist.gov/

Our team often writes articles or provides presentations that discuss and provide information about human-centered cybersecurity to various audiences, for example, cybersecurity practitioners or fellow researchers. We are co-hosting the Human-Centered Cybersecurity Series for the Redefining Cybersecurity Podcast (see General Human-Centered Cybersecurity -> Podcasts below). Currently, we are conducting a multi-phased research project to understand the interactions between human-centered cybersecurity researchers and practitioners. We hope the results will lead to the creation of mutually...

NIST seeks to accelerate the adoption of our cybersecurity and privacy standards, guidelines, and frameworks by making it much easier for users of NIST products to identify, locate, compare, and customize content across NIST’s standards, guidelines, and practices. This will also add value to our existing NIST guidance by delivering human- and machine-consumable information. What is the Cybersecurity and Privacy Reference Tool (CPRT)? The CPRT provides a centralized, standardized, and modernized mechanism for managing reference datasets (and offers a consistent format for accessing reference...

What have we been up to? Here are some of the latest updates… We are currently in Phase 1 of updating the CPRT roadmap tool. Stay tuned as NIST adds reference data from other publications to this tool and develops features to interact with the data in new ways in the future. Recent CPRT Additions: 02/19/2026 | NIST AI 100-2 E2025, Adversarial Machine Learning: A Taxonomy and Terminology of Attacks and Mitigations 02/19/2026 | AI RMF 1.0, Artificial Intelligence Risk Management Framework 02/19/2026 | NIST SP 800-60 Vol. 2 Rev. 1, Guide for Mapping Types of Information and Information...

CPRT Roadmap Explore the CPRT Project Roadmap, a strategic guide delineating our three crucial phases.    Mappings to NIST Documents Explore the process for developing and submitting standardized mappings that involve NIST cybersecurity and privacy publications. Cross-Reference Comparison Report Tool Browse and compare the mappings and crosswalks of industry standards and frameworks to existing NIST Publications. JSON and CSV downloadable content is available for additional customization of the generated reports.

We are always eager to collaborate, hear your feedback, and work alongside you. Please reach out to us anytime and let us know your thoughts.   Map with us!  Do you want to submit your mappings to NIST documents and have them displayed on our site?  Please follow the details below or email [email protected] if you have any questions. Submission Guidelines Learn more about OLIR by visiting their website.   Contact Information Questions, comments, or feedback? Email us at [email protected]. Follow us on X! Subscribe to our GovDelivery list so you get future email updates!

The following training videos are providing the OSCAL Team with guidance. 1. Reviewing and approving a PR opened by the dependabot.

Blockchain-based Secure Software Assets Management (BloSS@M) demonstrates continuous ATO with OSCAL. This site contains team's resources. 1. Bloss@m's network overview.

While the public comment period on SP 800-171 and SP 800-171A continues, the SP 800-172 update has begun. Here’s what you can expect. The enhanced security requirements for protecting CUI will be modified to match the structure of the requirements in SP 800-171, Revision 3. The enhanced security requirements will align with the structure and content of the controls and control enhancements in SP 800-53, Revision 5. Enhanced security requirements will be added to address new threats and vulnerabilities. Changes to the enhanced security requirements will support the future development of...

TBD

TBD

A module validation caveat may warn a user of specific stipulations, conditions, or limitations of a module, to assist in making a risk determination on its usage. The examples below list the potential caveats for a FIPS 140-3 validation (for a list of FIPS 140-2 caveats, see Implementation Guidance G.13 #4). A caveat may be added, modified or expanded by the CMVP during the validation process. Interim Validation Caveats Interim validation                 The module: Has been fully tested, evaluated for conformance to FIPS 140-3, and recommended for validation by an accredited CST...

The following are selected examples of additional resources supporting incident response preparation. General Incident Response Programs, Policies, and Plans Carnegie Mellon University, Incident Management (includes plan, policy, and reporting templates, and incident declaration criteria) Computer Crime & Intellectual Property Section (CCIPS), U.S. Department of Justice, Best Practices for Victim Response and Reporting of Cyber Incidents Cybersecurity & Infrastructure Security Agency (CISA), Incident Response Plan (IRP) Basics NIST, Guide for Cybersecurity Event Recovery (SP...

The following are selected examples of additional resources supporting the incident response life cycle. Vulnerability and Threat Information CISA, Automated Indicator Sharing (AIS) CISA, CISA Cyber Threat Indicator and Defensive Measure Submission System CISA, Cybersecurity Alerts & Advisories CISA, Cybersecurity Directives CISA, Ransomware Vulnerability Warning Pilot (RVWP) The MITRE Corporation, MITRE ATT&CK National Council of ISACs (NCI) NIST, Guide to Cyber Threat Information Sharing (SP 800-150) NIST, National Vulnerability Database (NVD) NIST, Recommendations for...

Tutorial (English or Espanol) on combinatorial methods for software testing (pdf)  ACTS User Guide - how to use the ACTS test generation tool (pdf) ACTS API manual - how to invoke ACTS functions from other code (zip) Combinatorial Coverage Measurement - explains various coverage measurements and how to use the tool for computing these.  There is also a manual for the command line version of the CCM tool.  Fault ID user manual - for tool that helps identify likely fault-triggering combinations in failing tests PEV tool user manual - testing rule-based expert systems or business rule...