Search CSRC

Abstract: This report summarizes the discussion at the second “Cyber AI Profile Workshop,” in January 2026 during which focused on the Preliminary Draft of the NIST Cybersecurity Framework Profile for Artificial Intelligence (Cyber AI Profile). The workshop gathered input across government, i...

Abstract: The architecture of high-performance computing (HPC) systems has significantly influenced the development of artificial intelligence (AI) data centers, which are purpose-built for model training, inference, and applications. This publication conducts a threat and security gap analysis of AI data cen...

Abstract: Storage technology has evolved in two primary directions: increased media storage capacity and architectural changes that provide a software-based abstraction over all forms of background storage technologies. However, this architectural shift has increased management complexity and the probability...

Abstract: Cooperative perception enables autonomous vehicles (AVs) to improve situational awareness by aggregating detection outputs from multiple agents and sensing platforms, often via a shared fusion service in multi-vendor deployments. However, sharing such outputs at inference time exposes ...

Abstract: Due diligence research is the investigative process of researching all available, pertinent information about a given supplier or product so that informed decisions can be made on new acquisitions or existing systems. This Quick-Start Guide provides cybersecurity supply chain risk management (C-SCRM...

Abstract: The system security plan, system privacy plan, and cybersecurity supply chain risk management plan are collectively referred to as system plans. They describe the purpose of the system, the operational status of the controls selected and allocated for meeting risk management requirements, and the re...

Abstract: Cryptographic (crypto) agility refers to the capabilities needed to replace and adapt cryptographic algorithms in protocols, applications, software, hardware, firmware, and infrastructures while preserving security and ongoing operations. This white paper provides an in-depth survey of current appro...

Abstract: Operational Technology (OT) environments often lack comprehensive asset inventories due to a lack of resourcing, limitations of legacy systems, geographically distributed assets, diverse communication protocols, and operational constraints. OT environments also face unique asset management challenge...

Abstract: Organizations increasingly use Internet of Things (IoT) products for the mission benefits they can offer, but care must be taken in the acquisition and implementation of this equipment. Understanding that an IoT product is a system element facilitates an understanding of how the IoT product must be...

Abstract: The Water and Wastewater Systems (WWS) sector plays an important role in our national critical infrastructure. It is important that these utilities are equipped with resources to help them address and reduce their cybersecurity risks. Through the Cybersecurity for the Water and Wastewater Sector pro...

Conference: Great Lakes Symposium on VLSI (GLSVLSI) 2026 Abstract: Autonomous Navigation Systems (ANS) incorporate many safety-critical functions, such as collision avoidance. Recent studies have shown how remote clock/voltage glitch injections pose an imminent threat to mission-sensitive modules in the autonomous navigation domain: timing/power perturbations in th...

Abstract: The macOS Security Compliance Project (mSCP) provides resources that enable system administrators, security professionals, security policy authors, information security officers, and auditors to secure and assess macOS desktop and laptop, iOS, and visionOS system security in an automated way. This p...

Abstract: Operational Technology (OT) backups are vital for recovery from reliability or cyber incidents. Effective backup management in an OT environment involves integrating backups into the change management process, creating them regularly, testing them, and reviewing them during recovery exercises.

Abstract: This report summarizes the presentations and feedback received by the NIST Cybersecurity for the Internet of Things (IoT) Program at the hybrid workshop on "Cybersecurity for IoT Workshop: Future Directions” held March 31 – April 1, 2026. The purpose of this workshop was to consider emer...

Abstract:

Abstract:

Abstract:

Abstract: Ransomware is a type of malicious attack where attackers encrypt an organization’s data and demand payment to restore access. Attackers may also steal an organization’s information and demand an additional payment in return for not disclosing the information to authorities, competitors,...

Abstract: The Security Content Automation Protocol (SCAP) is a suite of specifications that standardize the format and nomenclature by which software flaw and security configuration information is communicated, both to machines and humans. This publication, along with its annex (NIST Special Publication 800-1...

Abstract: The Security Content Automation Protocol (SCAP) is a multi-purpose framework of component specifications that support automated configuration, vulnerability, patch checking, security measurement, and technical control compliance activities. The SCAP version 1.4 specification is defined by the combin...

Journal: IEEE Security & Privacy Abstract: Three cybersecurity experts from academia and industry discuss the reasons why many phishing training programs fail to change behavior, the importance of meaningful measures of effectiveness, and strategies for improving organizational resilience against current and future phishing threats.

Abstract: N/A

Abstract: Confidential computing addresses data security and privacy concerns for organizations that move sensitive workloads to the cloud. It is a critical advancement that enables the encryption of data both while it is being processed in memory and in active use. As cloud adoption continues to grow, confid...

Conference: 27th International Symposium on Quality Electronic Design (ISQED 2026) Abstract: Resource isolation plays a crucial role in ensuring the security of hardware systems. Existing hardware security verification measures can identify improper isolation of hardware resources, but coverage is incomplete. As the search space increases with hardware size, the chances of an integrity flaw...

Abstract: Throughout Fiscal Year 2025 (FY 2025) — from October 1, 2024, through September 30, 2025 — the NIST Information Technology Laboratory (ITL) Cybersecurity and Privacy Program successfully responded to numerous challenges and opportunities in security and privacy. This Annual Report highli...