NIST has released initial working drafts of proposed updates to the Personal Identity Verification (PIV) standards to support the use of post-quantum cryptography (PQC). The drafts identify the changes expected to be needed to use the ML-DSA digital signature algorithm and the ML-KEM key-encapsulation mechanism with PIV.
The current draft set comprises:
A supporting PQC Overview accompanies the drafts to present a working gap analysis of the specification changes needed across the PIV algorithm profile, command interface, and data model, and outline the general approach under consideration. This approach centers on a dual-stack model that preserves existing classical PIV keys and data objects; adds new key references, certificate containers, and data objects for PQC credentials; and supports backward compatibility and incremental deployment during the transition.
These are preliminary working materials, not formal public drafts. By collaborating with implementers and users to develop these guidelines and specifications, NIST hopes to accelerate the standardization and implementation of PQC in PIV credentials.
NIST welcomes feedback throughout the development process. Interested parties can follow the work and participate by:
NIST has released initial working drafts of proposed updates to the Personal Identity Verification (PIV) standards to support the use of post-quantum cryptography (PQC). The drafts identify the changes expected to be needed to use the ML-DSA digital signature algorithm and the ML-KEM key-encapsulation mechanism with PIV.
The current draft set comprises:
A supporting PQC Overview accompanies the drafts to present a working gap analysis of the specification changes needed across the PIV algorithm profile, command interface, and data model, and outline the general approach under consideration. This approach centers on a dual-stack model that preserves existing classical PIV keys and data objects; adds new key references, certificate containers, and data objects for PQC credentials; and supports backward compatibility and incremental deployment during the transition.
These are preliminary working materials, not formal public drafts. By collaborating with implementers and users to develop these guidelines and specifications, NIST hopes to accelerate the standardization and implementation of PQC in PIV credentials.
NIST welcomes feedback throughout the development process. Interested parties can follow the work and participate by:
NIST has released initial working drafts of proposed updates to the Personal Identity Verification (PIV) standards to support the use of post-quantum cryptography (PQC). The drafts identify the changes expected to be needed to use the ML-DSA digital signature algorithm and the ML-KEM key-encapsulation mechanism with PIV.
The current draft set comprises:
A supporting PQC Overview accompanies the drafts to present a working gap analysis of the specification changes needed across the PIV algorithm profile, command interface, and data model, and outline the general approach under consideration. This approach centers on a dual-stack model that preserves existing classical PIV keys and data objects; adds new key references, certificate containers, and data objects for PQC credentials; and supports backward compatibility and incremental deployment during the transition.
These are preliminary working materials, not formal public drafts. By collaborating with implementers and users to develop these guidelines and specifications, NIST hopes to accelerate the standardization and implementation of PQC in PIV credentials.
NIST welcomes feedback throughout the development process. Interested parties can follow the work and participate by:
This initial public draft details how the availability of inexpensive, off-the-shelf hardware and software tools allows attackers to mimic legitimate carrier equipment to intercept and disrupt cellular communications. The paper evaluates how 5G devices respond to six simulated false base station scenarios and examines protections available to mitigate risks.
This white paper is part of the NCCoE’s work to accelerate the adoption of 5G security features by demonstrating their implementation on NCCoE’s operational 5G security testbed and providing actionable implementation guidelines to help network operators and other stakeholders enhance the cybersecurity and privacy of 5G systems and supporting infrastructures.
A false (aka Rogue or Fake) Base Station (FBS) impersonates a real carrier radio access network. It transmits and receives radio signals that mimic a legitimate 5G cell and tricks unsuspecting User Equipment (UE) to connect to it. This can result in cybersecurity risks, including service degradation, privacy breaches, and location tracking for the user. Although 5G standards include greater security features than previous generations to protect subscribers, they are still susceptible to Denial-of-Service (DoS) attacks.
This white paper evaluates six FBS scenarios (simulated in the NCCoE’s 5G Security lab) to assess how the tested 5G devices respond to FBS attacks and identify areas for improvement in standards and available device-configurable protections.
By demonstrating security features on our operational 5G Testbed, we aim to deliver real-world implementation insights to advance 5G security and inform the next generation of wireless security technologies and standards.
NIST is particularly interested in your feedback on the following questions:
This white paper is available for public comment through October 30, 2026. Visit the NCCoE project page to learn more and download the white paper today!
Federal agencies that deploy an Open Radio Access Network (O-RAN) as part of their infrastructure must include that deployment in their risk management programs. This draft Cybersecurity Framework (CSF) 2.0 profile describes how components that conform to the security specifications produced by the O-RAN ALLIANCE support various CSF 2.0 outcomes. It also includes references to O-RAN ALLIANCE-produced documents and other relevant guidelines that may help federal agency cybersecurity managers.
This report provides guidelines for improving the security of Operational Technology (OT) systems while addressing their unique performance, reliability, and safety requirements.
OT encompasses a broad range of programmable systems or devices that interact with the physical environment (or manage devices that interact with the physical environment). These systems/devices detect or cause a direct change through the monitoring and/or control of devices, processes, and events. Examples include industrial control systems (ICS), building automation systems, transportation systems, physical access control systems, physical environment monitoring systems, and physical environment measurement systems.
This fourth revision of SP 800-82 provides an overview of OT and typical system topologies, identifies common threats to organizational mission and business functions supported by OT, describes typical vulnerabilities in OT, and provides recommended security safeguards and countermeasures to manage the associated risks.
Updates in this revision include:
The comment period on this initial public draft is open through November 30, 2026. We encourage you to use this comment template when preparing your comments.
NOTE: A call for patent claims is included in this draft. For additional information, see the Information Technology Laboratory (ITL) Patent Policy – Inclusion of Patents in ITL Publications.
The initial public draft (ipd) of NIST Special Publication (SP) 800-100r1 (Revision 1), Information Security Handbook: A Guide for Executive Leadership, is now available for comment.
Since the original version of SP 800-100 was released in 2006, the cybersecurity landscape, regulatory environment, and NIST’s body of guidelines have changed substantially. This revision restructures the handbook to align with the general organization of the NIST Cybersecurity Framework (CSF) 2.0 and provides high-level summaries of key cybersecurity topics, including governance, risk management, information exchange, security awareness and training, contingency planning, configuration management, and incident response. It also discusses the relationships between these core concepts for executive leadership in both public- and private-sector organizations. The document points to other NIST publications throughout for more detailed technical implementation guidelines.
The draft covers:
A public comment review period is open from October 12 to December 4, 2026. Commenters are encouraged to use the comment template and submit feedback to sp800-100-comments@nist.gov.
NOTE: A call for patent claims is included on page iv of this draft. For additional information, see the Information Technology Laboratory (ITL) Patent Policy – Inclusion of Patents in ITL Publications.
Revision 1 introduces streaming interfaces for extendable-output function (XOF) computations, which allow applications to process input and request output incrementally without knowing the total input or output length in advance.
From the Note to Reviewers (p. v):
\nThe public comment period is open through December 7, 2026.
\nNOTE: A call for patent claims is included in this draft. For additional information, see the Information Technology Laboratory (ITL) Patent Policy – Inclusion of Patents in ITL Publications.
", "published": "2026-10-08T00:00:00", "updated": "2026-10-08T00:00:00", "link": "https://csrc.nist.gov/pubs/sp/800/185/r1/ipd", "content": "Comments Due 12/07/2026" }, { "id": "https://csrc.nist.gov/pubs/sp/800/221/r1/ipd", "title": "SP 800-221 Rev. 1, Enterprise Impact of Information and Communications Technology Risk: Governing and Managing ICT Risk Programs Within an Enterprise Risk PortfolioInitial Public Draft", "summary": "The public comment period is open through December 7, 2026, at 11:59 PM EST. We encourage you to use this comment template when preparing and submitting your response.
\nEnterprise information and communications technology risk management (ICTRM) spans and integrates a broad set of disciplines including cybersecurity, privacy, supply chain, operational technology, Internet of Things, and super intelligence. This publication promotes an integrated approach to ICT risk—aggregating and normalizing risk information across domains. Doing so allows organizations to identify, quantify, and communicate risk scenarios in financial, mission, and reputational terms comparable to non-technical enterprise risks, enabling executives to prudently allocate resources across competing risk types.
\nNIST SP 800-221r1 ipd helps organizations improve their ICTRM in alignment with established frameworks, including the CSF 2.0. Consistent with the CSF 2.0 Govern function, this publication emphasizes that cybersecurity governance should be central to all risk management activities, ensuring that ICTRM aligns with enterprise strategy and receives appropriate oversight and resources from senior leadership. The document supports organizations of all sizes and sectors in implementing governance outcomes that connect ICT risk management with the six-core CSF 2.0 functions: Govern, Identify, Protect, Detect, Respond, and Recover.
NOTE: A call for patent claims is included in this draft. For additional information, see the Information Technology Laboratory (ITL) Patent Policy – Inclusion of Patents in ITL Publications.
", "published": "2026-10-22T00:00:00", "updated": "2026-10-22T00:00:00", "link": "https://csrc.nist.gov/pubs/sp/800/221/r1/ipd", "content": "Comments Due 12/07/2026" } ] }