NOTICE: Due to a lapse in annual appropriations, most of this website is not being updated. Learn more.

Form submissions will still be accepted but will not receive responses at this time. Sections of this site for programs using non-appropriated funds (such as NVLAP) or those that are excepted from the shutdown (such as CHIPS and NVD) will continue to be updated.

U.S. flag

An official website of the United States government

Official websites use .gov
A .gov website belongs to an official government organization in the United States.

Secure .gov websites use HTTPS
A lock ( ) or https:// means you’ve safely connected to the .gov website. Share sensitive information only on official, secure websites.

Information Technology

Cybersecurity and privacy

Search Publications

Search Title, Abstract, Conference, Citation, Keyword or Author
  • Published Date
Displaying 51 - 75 of 1504

Hardware Security Failure Scenarios

November 13, 2024
Author(s)
Peter Mell, Irena Bojanova
Historically, hardware has been assumed to be inherently secure. However, chips are both created with software and contain complex encodings (e.g., circuit designs and firmware). This leads to bugs, some of which compromise security. This publication

The NIST Cybersecurity Framework (CSF) 2.0 (Polish translation)

November 12, 2024
Author(s)
Cherilyn Pascoe, Stephen Quinn, Karen Scarfone
The NIST Cybersecurity Framework (CSF) 2.0 provides guidance to industry, government agencies, and other organizations to manage cybersecurity risks. It offers a taxonomy of high-level cybersecurity outcomes that can be used by any organization —

Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations

November 1, 2024
Author(s)
Jon Boyens, Angela Smith, Nadya Bartol, Kris Winkler, Alex Holbrook, Matthew Fallon
Organizations are concerned about the risks associated with products and services that may potentially contain malicious functionality, are counterfeit, or are vulnerable due to poor manufacturing and development practices within the supply chain. These

Base de referencia de las capacidades de apoyo no tecnicas del IoT

October 30, 2024
Author(s)
Michael Fagan, Katerina Megas, Jeffrey Marron, Kevin Brady, Barbara Cuthill, Rebecca Herold
Las capacidades de apoyo no técnicas son acciones que realiza un fabricante o una organización de terceros en apoyo de la seguridad cibernética de un dispositivo de Internet de las cosas (IoT, por sus siglas en inglés). Esta publicación define una línea

Base Principal da Capacidade de Suporte Nao Tecnico da IoT

October 30, 2024
Author(s)
Katerina Megas, Michael Fagan, Jeffrey Marron, Kevin Brady, Barbara Cuthill, Rebbecca Herold
Recursos de suporte não técnicos são ações que um fabricante ou organização terceirizada executa em apoio à segurança cibernética de um dispositivo IoT. Esta publicação define a base principal de recursos de suporte não técnico dos fabricantes de

A graph-theoretic approach to analyzing decoding failures of BIKE

October 25, 2024
Author(s)
Sarah Arpin, Tyler Raven Billingsley, Daniel Rayor Hast, Jun Bo Lau, Ray Perlner, Angela Robinson
We present experimental findings on the decoding failure rate (DFR) of BIKE, a fourth-round candidate in the NIST Post-Quantum Standardization process, at the 20-bit security level using graph-theoretic approaches. We select parameters according to BIKE

NIST Cybersecurity Framework 2.0: Enterprise Risk Management Quick-Start Guide

October 21, 2024
Author(s)
Stephen Quinn, Victoria Pillitteri, Matthew Barrett, Matthew Smith, Gregory Witte
This guide provides an introduction to using the NIST Cybersecurity Framework (CSF) 2.0 for planning and integrating an enterprise-wide process for integrating cybersecurity risk management information, as a subset of information and communications

NIST Cybersecurity Framework 2.0: Quick-Start Guide for Using the CSF Tiers

October 21, 2024
Author(s)
Stephen Quinn, Cherilyn Pascoe, Matthew Barrett, Karen Scarfone, Gregory Witte
This Quick-Start Guide describes how to apply the CSF 2.0 Tiers. CSF Tiers can be applied to CSF Organizational Profiles to characterize the rigor of an organization's cybersecurity risk governance and management outcomes. This can help provide context on

Building a Cybersecurity and Privacy Learning Program

September 12, 2024
Author(s)
Marian Merritt, SUSAN HANSCHE, BRENDA ELLIS, Julie Nethery Snyder, KEVIN SANCHEZ-CHERRY, DONALD WALDEN
This publication provides guidance for federal agencies and organizations to develop and manage a life cycle approach to building a Cybersecurity and Privacy Learning Program (CPLP). The approach is intended to address the needs of large and small

Recommended Cybersecurity Requirements for Consumer-Grade Router Products

September 10, 2024
Author(s)
Michael Fagan, Katerina Megas, Paul Watrobski, Jeffrey Marron, Barbara Bell Cuthill, David Lemire, Brad Hoehn, Christopher Evans
Ensuring the security of routers is crucial for safeguarding not only individuals' data but also the integrity and availability of entire networks. With the increasing prevalence of smart home IoT devices and remote work setups, the significance of

NIST Risk Management Framework (RMF) Small Enterprise Quick Start Guide

July 23, 2024
Author(s)
Daniel Eliot
For organizations of all sizes, managing risk (including information security and privacy risk), is critical for organizational resilience. This guide is designed to help small, under-resourced entities understand the value and core components of the NIST

Assessing the Benefits and Risks of Quantum Computers

July 17, 2024
Author(s)
Travis Scholten, Carl Williams, Dustin Moody, Michele Mosca, William Hurley, William J. Zeng, Matthias Troyer, Jay Gambetta
Quantum computing is an emerging technology with potentially far-reaching implications for national prosperity and security. Understanding the timeframes over which economic benefits and national security risks may manifest themselves is vital for ensuring

Cryptographic Algorithms and Key Sizes for Personal Identity Verification

July 15, 2024
Author(s)
Hildegard Ferraiolo, Andrew Regenscheid
Federal Information Processing Standard 201-3 (FIPS 201-3) defines the requirements for Personal Identity Verification (PIV) life cycle activities, including identity proofing, registration, PIV Card issuance, and PIV Card usage. FIPS 201-3 also defines

Measuring the Exploitation of Weaknesses in the Wild

June 26, 2024
Author(s)
Peter Mell, Irena Bojanova, Carlos Eduardo Cardoso Galhardo
Identifying the software weaknesses exploited by attacks supports efforts to reduce developer introduction of vulnerabilities and to guide security code review efforts. A weakness is a bug or fault type that can be exploited through an operation that
Was this page helpful?