Skip to main content
U.S. flag

An official website of the United States government

Official websites use .gov
A .gov website belongs to an official government organization in the United States.

Secure .gov websites use HTTPS
A lock ( ) or https:// means you’ve safely connected to the .gov website. Share sensitive information only on official, secure websites.

National Checklist Program for IT Products: Guidelines for Checklist Users and Developers

Published

Author(s)

Stephen D. Quinn, Murugiah P. Souppaya, Melanie R. Cook, Karen Scarfone

Abstract

A security configuration checklist is a document that contains instructions or procedures for configuring an information technology (IT) product to an operational environment, for verifying that the product has been configured properly, and/or for identifying unauthorized changes to the product. Using these checklists can minimize the attack surface, reduce vulnerabilities, lessen the impact of successful attacks, and identify changes that might otherwise go undetected. To facilitate development of checklists and to make checklists more organized and usable, NIST established the National Checklist Program (NCP). This publication explains how to use the NCP to find and retrieve checklists, and it also describes the policies, procedures, and general requirements for participation in the NCP.
Citation
Special Publication (NIST SP) - 800-70 Rev 3
Report Number
800-70 Rev 3

Keywords

change detection, checklist, information security, National Checklist Program (NCP), security configuration checklist, Security Content Automation Protocol (SCAP), software configuration, vulnerability

Citation

Quinn, S. , Souppaya, M. , Cook, M. and Scarfone, K. (2016), National Checklist Program for IT Products: Guidelines for Checklist Users and Developers, Special Publication (NIST SP), National Institute of Standards and Technology, Gaithersburg, MD, [online], https://doi.org/10.6028/NIST.SP.800-70r3 (Accessed March 18, 2024)
Created December 8, 2016, Updated May 4, 2021