An official website of the United States government
Here’s how you know
Official websites use .gov
A .gov website belongs to an official government organization in the United States.
Secure .gov websites use HTTPS
A lock (
) or https:// means you’ve safely connected to the .gov website. Share sensitive information only on official, secure websites.
Amy Mahn, Daniel Topper, Stephen Quinn, Jeffrey Marron
This document intends to provide direction and guidance to those organizations – in any sector or community – seeking to improve cybersecurity risk management via utilization of the NIST Framework for Improving Critical Infrastructure Cybersecurity
Nicole D. Keller, Stephen Quinn, Karen Scarfone, Matthew Smith, Vincent Johnson
This Program is a NIST effort to facilitate subject matter experts in defining standardized Online Informative References (OLIRs), which are relationships between elements of their documents and elements of other documents like the NIST Cybersecurity
Matthew P. Barrett, Nicole D. Keller, Stephen Quinn, Matthew Smith, Karen Scarfone
This Program is a NIST effort to facilitate subject matter experts in defining standardized Online Informative References (OLIRs), which are relationships between elements of their documents and elements of other documents like the NIST Cybersecurity
Kevin M. Stine, Stephen D. Quinn, Gregory A. Witte, Robert Gardner
The increasing frequency, creativity, and severity of cybersecurity attacks means that all enterprises should ensure that cybersecurity risk is receiving appropriate attention within their enterprise risk management (ERM) programs. This document is
Matthew P. Barrett, Nicole D. Keller, Stephen Quinn, Matthew Smith
This document provides instructions and definitions for completing the Cybersecurity Framework (CSF) Online Informative References (OLIR) spreadsheet template available for download at https://www.nist.gov/cyberframework/informative-references. This
Matthew P. Barrett, Nicole D. Keller, Stephen Quinn, Matthew Smith
This document provides instructions and definitions for completing the Cybersecurity Framework (CSF) Online Informative References (OLIR) spreadsheet template available for download at https://www.nist.gov/cyberframework/informative-references. This
Matthew P. Barrett, Nicole D. Keller, Stephen D. Quinn, Matthew C. Smith
[Superseded by NISTIR 8204 (May 2019): https://doi.org/10.6028/NIST.IR.8204] This document provides instructions and definitions for completing the Cybersecurity Framework (CSF) Online Informative References (OLIR) spreadsheet template available for
Melanie Cook, Dragos Prisaca, Stephen D. Quinn, David A. Waltermire
This report defines the requirements and associated test procedures necessary for products or modules to achieve one or more Security Content Automation Protocol (SCAP) validations. Validation is awarded based on a defined set of SCAP capabilities by
Stephen Quinn, Murugiah Souppaya, Melanie R. Cook, Karen A. Scarfone
A security configuration checklist is a document that contains instructions or procedures for configuring an information technology (IT) product to an operational environment, for verifying that the product has been configured properly, and/or for
Harold Booth, David A. Waltermire, Mark L. Badger, Melanie R. Cook, Stephen Quinn, Karen Scarfone
The Security Content Automation Protocol (SCAP) is a multi-purpose framework of component specifications that support automated configuration, vulnerability, and patch checking, security measurement, and technical control compliance activities. The SCAP
David A. Waltermire, Stephen D. Quinn, Harold Booth, Karen Scarfone, Dragos Prisaca
The Security Content Automation Protocol (SCAP) is a suite of specifications that standardize the format and nomenclature by which software flaw and security configuration information is communicated, both to machines and humans. This publication, along
Stephen D. Quinn, Murugiah P. Souppaya, Melanie R. Cook, Karen Scarfone
A security configuration checklist is a document that contains instructions or procedures for configuring an information technology (IT) product to an operational environment, for verifying that the product has been configured properly, and/or for