Search CSRC

Human-centered cybersecurity (HCC) (also known as usable security) involves the social, organizational, and technological influences on people’s understanding of and interactions with cybersecurity. By taking a human-centered cybersecurity approach, we can both improve people's cybersecurity experiences and achieve better cybersecurity outcomes. This Google Group provides a forum for human-centered cybersecurity researchers, cybersecurity and IT practitioners, and human factors experts to share ideas, best practices, and potential engagement opportunities. Read the September 2024 NIST Blog...

Papers Weiss, A., Gautham, S., Jayakumar, A. V., Elks, C. R., Kuhn, D. R., Kacker, R. N., & Preusser, T. B. (2021). Understanding and fixing complex faults in embedded cyberphysical systems. Computer, 54(1), 49-60. Jayakumar, A. V., Gautham, S., Kuhn, R., Simons, B., Collins, A., Dirsch, T., ... & Elks, C. (2020, October). Systematic software testing of critical embedded digital devices in nuclear power applications. In 2020 IEEE International Symposium on Software Reliability Engineering Workshops (ISSREW) (pp. 85-90). IEEE. Elks, C., Jayakumar, A., Collins, A., Hite, R., Karles, T.,...

Current work in hardware and embedded systems test and evaluation includes: Physical unclonable functions vulnerabilities Embedded system faults and vulnerabilities

More complex cryptographic functions use other cryptographic primitives as building blocks to securely perform the desired operations. The Automated Cryptographic Validation Test System (ACVTS) testing of higher level cryptographic functions focuses on the algorithm itself and not the other algorithms that may also be used. This means it is required that prerequisite algorithms are tested separately in order to receive a cryptographic algorithm validation. The following tables outline the prerequisite requirements for ACVTS.   Symmetric Key Algorithm Mode...

Live at HIMSS: NIST’s Secure Data-Sharing Platform Provides a Trusted Gateway to Clinical Data | GovCIO Media & Research

The original SFDS proposal was a finalist in the NIST 2021 TMAP pitch competition.   Click here to read the article.

2022 FIPS 201 Rev. 3 Public Comments Special thanks to those who participated in the workshops and provided technical comments in shaping this standard. The commentators represented a wide range of government and industry organizations including the following (file is in .pdf format): 2020 Draft comments and dispositions   2012 FIPS 201 Rev. 2 Public Comments Special thanks to those who have participated in the workshops and provided valuable technical comments in shaping this standard. The commentators represented a wide range of government and industry organizations,...

A paper published in IEEE Reliability Magazine highlights some possible use cases of the SFDS.

Talks from Workshop on Combinatorial Testing for Artificial Intelligence-Enabled Systems September 4,  2024 Virginia Tech Research Center, Arlington, VA https://sites.google.com/vt.edu/ct-workshop Ongoing teaching workshops in this area may be found here.  The goal of this workshop was to provide practitioners and researchers with a foundational understanding of combinatorial testing techniques and applications to testing AI-enabled software systems (AIES).  Participants included staff from Cybersecurity and Infrastructure Security Agency (CISA), Office of Sec. of Defense, Director...

Official comments on the Second Round Candidates should be submitted using the "Submit Comment" link for the appropriate algorithm. Comments from the pqc-forum Google group subscribers will also be forwarded to the pqc-forum Google group list. We will periodically post and update the comments received to the appropriate algorithm. All relevant comments will be posted in their entirety and should not include PII information in the body of the email message. Please refrain from using OFFICIAL COMMENT to ask administrative questions, which should be sent to [email protected]. The rationale...

This page uses Google Forms. If the speaker request form does not load, please complete the pdf version of the C-SCRM Speaker Request Form and e-mail it to [email protected] with "C-SCRM Speaker Request" in the subject line.  The form is loading…

Assessment: The action of evaluating, estimating, or judging against defined criteria. Different types of assessment (i.e., qualitative, quantitative, and semi-quantitative) are used to assess risk. Some types of assessment yield measures.  Assessment Result(s): The output or outcome of an assessment. Measurement: The process of obtaining quantitative values using quantitative assessment. Measures: Quantifiable and objective values resulting from measurement. Metrics: Measures and assessment results designed to track progress, facilitate decision-making and improve performance with respect...

Comments Received on SP 800-172r3 (FPD) Below are comments received on the final public draft of SP 800-172r3, Enhanced Security Requirements for Protecting Controlled Unclassified Informa tion   The public comment period closed on January 16, 2026. All comments submitted during the public comment period for Draft NIST SP 800-172r3 will be posted below without change or redaction, so commenters should not include information they do not wish to be posted (e.g., personal or business information).    Date Received From 29 September 2025 Aboubacar Camara...

[Redirect to www.nist.gov/cyberframework]

Research tools to support combinatorial testing. No license is required and there are no restrictions on distribution or use. All software is provided free of charge and will remain free in the future. NIST is an agency of the US Government, so this software is public domain. You are free to include it and redistribute it in commercial products if desired. ACTS is in Java, and will run on any platform with the latest Java release (Java free download is at java.com).  There are many users running current Windows, Mac OS, and Linux systems.  ACTS Basic version download Java .jar file. No...

Dataworks 2025 short course PPT

Machine learning (ML) systems are more and more widely deployed in multiple sectors. Autonomous driving cars are using object detection systems to process the images/videos from the cameras to understand the traffic signals and real time traffic around them. ML has been used to translate text from one language to another in several systems. At the same time, ML systems also introduce new security threats that are not seen in traditional software and network systems. For example, data poisoning and adversarial examples attacks generate incorrect output; membership and denial of service attacks...

The SP 800-90 series on random bit generation may not immediately be updated following the addition of new cryptographic algorithms to NIST’s portfolio. In the time between an algorithm’s approval and the next revision of a 90 series standard, questions often arise regarding the applicability of existing guidelines to the new algorithms. This page provides information and updates on the use of approved algorithms in the NIST random bit generation standards. For the latest implementation guidance from the Cryptographic Module Validation Program (CMVP) see the FIPS 140-3 Implementation Guidance...

COSAiS leverages a newly launched NIST Overlays for Securing AI Systems Slack Channel, a hub for the cybersecurity and AI communities to hold discussions related to the development of these overlays. Slack channel members get updates, engage in facilitated discussions with the NIST principal investigators and other subgroup members, share ideas, provide real-time feedback, and contribute to the development of the overlays! All interested parties are welcomed. Join the Slack channel Submit your request using the Google form. By joining the Slack channel, users agree to the rules outlined...

The security of AI systems is closely intertwined with the security of the IT infrastructure on which they run and operate. Many organizations are already implementing SP 800-53 controls and have the institutional processes in place to plan control implementations for their organizations, missions, and systems and to assess the effectiveness of the controls for meeting organizational risk management requirements. Control overlays offer organizations or communities of interest ways to further customize the controls (or control baselines) for a specific technology or type of system, mission...

Validation Number: 148 Vendor: HCL Technologies Ltd. Product Name: HCL BigFix Product Major Version: 11 Product Version Tested: 11.0.2.125 Tested Platforms: Microsoft Windows 10 SP0 64-bit Red Hat Enterprise Linux 7 64-bit SCAP 1.3 Capabilities: Authenticated Configuration Scanner Validated Product Vendor Provided SCAP Information   Dates Tested: 09/12/2024 - 05/29/2025 Report Submitted: 08/19/2025 DTR Version: Security...

How Can We Help?   The most common reasons users contact the NIST Cybersecurity Supply Chain Risk Management (C-SCRM) team are to:   Request more information about C-SCRM technical documents (e.g., clarifying a concept from a Special Publication (SP) such as Cybersecurity Supply Chain Risk Management for Systems and Organizations [SP 800-161 Revision 1]).   Questions and comments about Cybersecurity Supply Chain Risk Management (C-SCRM) are always welcome and can be directed to [email protected].   Join a C-SCRM E-mail Listserv. The following Listservs are available: Federal C-SCRM...

Shortcut URL: https://csrc.nist.gov/bcm/authentication-for-confidentiality-modes Authenticity is a goal that includes two types of assurance for data: its integrity (i.e., that the data is unaltered from its original form) and origin (i.e., that the data was in fact generated at its purported source). Authentication is a process (e.g., a cryptographic technique) for providing assurance of authenticity. Cryptographic authentication implies some form of data expansion (i.e., an increase in the size of the protected data). Authenticity is a critical requirement for most information technology...

SCAP 1.4 is the current final release of the Security Content Automation Protocol (SCAP). This page lists the publications, schemas, tools, component specifications, identification schemes, metrics, and integrity specifications that comprise SCAP version 1.4. SCAP 1.4 final release Status: Final · Version: 1.4 Publications: NIST Special Publication (SP) 800-126 Rev. 4 and NIST Special Publication (SP) 800-126A Rev. 4. Protocol SCAP: Security Content Automation Protocol Version: 1.4 Status: Final Specification: NIST Special Publication (SP) 800-126 Rev. 4 Specification Annex: NIST...