NASA Cybersecurity Policy Reference (OCIO/CSET) as of 2026-09-15
AllFIPS DocumentsHandbooks and Standard Operating ProceduresMemorandaNASA Advisory Implementing Instructions (NAII)NASA Policy Directives (NPD) and NASA Procedural Requirements (NPR)NIST DocumentsOther DocumentsStandards
| Ref | Title | Text | |
|---|---|---|---|
| NPD 1382.17K | NASA Privacy Policy | Listed as NPD 1382.17K. Dated March 28, 2022. Expires March 28, 2027. | |
| NPD 1440.6I | NASA Records Management | Listed as NPD 1440.6I. Dated September 10, 2014. Expires May 23, 2030. | |
| NPD 2540.1K | Personal Use of Government Office Equipment Including Information Technology | Listed as NPD 2540.1K. Dated June 17, 2025. Expires August 11, 2027. | |
| NPD 2800.1F | Managing Information Technology | Listed as NPD 2800.1F. Dated January 11, 2025. Expires January 11, 2030. | |
| NPD 2810.1F | NASA Information Security Policy | Listed as NPD 2810.1F. Dated January 21, 2022. Expires January 21, 2027. | |
| NPD 2830.1D | NASA Enterprise Architecture | Listed as NPD 2830.1D. Dated November 17, 2020. Expires November 17, 2026. | |
| NPR 1382.1B | NASA Privacy Procedural Requirements | Listed as NPR 1382.1B. Dated July 26, 2022. Expires July 26, 2027. | |
| NPR 1441.1E | NASA Records Management Program Requirements | Listed as NPR 1441.1E. Dated January 29, 2015. Expires May 22, 2030. | |
| NPR 2810.1F | Security of Information and Information Systems | Listed as NPR 2810.1F. Dated January 3, 2022. Expires January 3, 2027. | |
| NPR 2810.2A | Possession and Use of NASA Information and Information Systems Outside of the United States | Listed as NPR 2810.2A. Dated October 2, 2024. Expires October 2, 2032. | |
| NPR 2810.7 | Controlled Unclassified Information | Listed as NPR 2810.7. Dated October 22, 2021. Expires October 22, 2026. | |
| NPR 2830.1A | NASA Enterprise Architecture Procedures | Listed as NPR 2830.1A. Dated December 19, 2013. Expires December 19, 2026. | |
| NPR 2841.1 | Identity, Credential, and Access Management | Listed as NPR 2841.1. Dated January 6, 2011. Expires January 6, 2027. | |
| NPR 7120.7A | NASA Information Technology Program and Project Management Requirements | Listed as NPR 7120.7A. Dated August 17, 2020. Expires August 17, 2030. | |
| NPR 7150.2D | NASA Software Engineering Requirements | Listed as NPR 7150.2D. Dated March 8, 2022. Expires March 8, 2027. | |
| NAII 2810.1 | Networks in NASA Internet Protocol (IP) Space or NASA Physical Space | Listed as NAII 2810.1. Dated June 12, 2020. | |
| NAII 2810.2 | Email Services | Listed as NAII 2810.2. Dated November 4, 2020. | |
| IT-HBK-1440.01-01 | Records Planning & Management: Records Management & Records Life Cycle - Overview | Listed as IT-HBK-1440.01-01. Dated July 2, 2014. Expires July 2, 2017. | |
| IT-HBK-1441.01-01 | Records Retention and Disposition: Overview | Listed as IT-HBK-1441.01-01. Dated July 2, 2014. Expires July 2, 2017. | |
| IT-HBK-2841.0-03A | Identity, Credential, and Access Management Services (ICAM) | Listed as IT-HBK-2841.0-03A. Dated June 11, 2020. | |
| ITS-HBK-1382.03-01 | Privacy – Collections, PTAs, and PIAs | Listed as ITS-HBK-1382.03-01. Dated January 20, 2026. Expires January 20, 2027. | |
| ITS-HBK-1382.03-02 | Privacy Annual Reporting Procedures: Reviewing and Reducing PII and Unnecessary Use of SSN | Listed as ITS-HBK-1382.03-02. Dated November 17, 2025. Expiry extended. | |
| ITS-HBK-1382.04-01 | Privacy and Cybersecurity: Supporting an Integrated Controls Framework | Listed as ITS-HBK-1382.04-01. Dated November 17, 2025. Expiry extended. | |
| ITS-HBK-1382.05-01 | Privacy Incident Response and Management: Breach Response Team Checklist | Listed as ITS-HBK-1382.05-01. Dated November 17, 2025. Expiry extended. | |
| ITS-HBK-1382.06-01 | Web Privacy Notices and Redress | Listed as ITS-HBK-1382.06-01. Dated January 21, 2026. Expires January 21, 2027. | |
| ITS-HBK-2810.04-01A | Risk Assessment, Vulnerability Scanning, Expedited Patching | Listed as ITS-HBK-2810.04-01A. Dated February 27, 2025. Expiry extended. | |
| ITS-HBK-2810.05-02B | System and Service Acquisition | Listed as ITS-HBK-2810.05-02B. Dated April 27, 2025. Expiry extended. | |
| ITS-HBK-2810.06-2B | Cybersecurity and Privacy Awareness, Training, and Education | Listed as ITS-HBK-2810.06-2B. Dated January 21, 2026. Expiry extended. | |
| ITS-HBK-2810.07-02B | Configuration Management | Listed as ITS-HBK-2810.07-02B. Dated February 27, 2025. Expiry extended. | |
| ITS-HBK-2810.08-1A | Contingency Planning | Listed as ITS-HBK-2810.08-1A. Dated February 27, 2025. Expiry extended. | |
| ITS-HBK-2810.09-01 | Incident Response and Management: Control Family | Listed as ITS-HBK-2810.09-01. Dated February 27, 2025. Expiry extended. | |
| ITS-HBK-2810.09-02A | Incident Response and Management: NASA Information Security Incident Management | Listed as ITS-HBK-2810.09-02A. Dated September 04, 2024. Expiry extended. | |
| ITS-HBK-2810.09-04 | Incident Response and Management: Guidelines for Data Spillage & Sanitization Procedures | Listed as ITS-HBK-2810.09-04. Dated January 21, 2023. Expiry extended. | |
| ITS-HBK-2810.09-3A | Collection of Electronic Data | Listed as ITS-HBK-2810.09-3A. Dated November 14, 2025. Expiry extended. | |
| ITS-HBK-2810.10.02B | Maintenance | Listed as ITS-HBK-2810.10.02B. Dated February 27, 2025. Expiry extended. | |
| ITS-HBK-2810.11-2B | Media Protection and Sanitization | Listed as ITS-HBK-2810.11-2B. Dated February 14, 2023. Expiry extended. | |
| ITS-HBK-2810.12-2B | Physical and Environmental Protection | Listed as ITS-HBK-2810.12-2B. Dated February 27, 2025. Expiry extended. | |
| ITS-HBK-2810.13-1B | Personnel Security | Listed as ITS-HBK-2810.13-1B. Dated February 27, 2025. Expiry extended. | |
| ITS-HBK-2810.14-03C | System and Information Integrity | Listed as ITS-HBK-2810.14-03C. Dated February 27, 2025. Expiry extended. | |
| ITS-HBK-2810.15-1A | Access Control | Listed as ITS-HBK-2810.15-1A. Dated February 27, 2025. Expiry extended. | |
| ITS-HBK-2810.15-2A | Access Control: Managed Elevated Privileges | Listed as ITS-HBK-2810.15-2A. Dated November 17, 2025. Expiry extended. | |
| ITS-HBK-2810.16-02B | Audit and Accountability | Listed as ITS-HBK-2810.16-02B. Dated February 27, 2025. Expiry extended. | |
| ITS-HBK-2810.17-2B | Identification and Authentication | Listed as ITS-HBK-2810.17-2B. Dated February 27, 2025. Expiry extended. | |
| ITS-HBK-2810.18-2B | System and Communications Protection | Listed as ITS-HBK-2810.18-2B. Dated February 27, 2025. Expiry extended. | |
| ITS-HBK-2810.19-01 | Operational Technology | Listed as ITS-HBK-2810.19-01. Dated January 21, 2026. Expiry extended. | |
| ITS-HBK-AASTEP0.v2025-11 | Step 0: Prepare Policy | Listed as ITS-HBK-AASTEP0.v2025-11. Dated April 17, 2026. Expiry extended. | |
| ITS-HBK-AASTEP1.v2025-11 | Step 1: Categorize Policy | Listed as ITS-HBK-AASTEP1.v2025-11. Dated April 17, 2026. Expiry extended. | |
| ITS-HBK-AASTEP2.v2025-11 | Step 2: Select Policy | Listed as ITS-HBK-AASTEP2.v2025-11. Dated April 17, 2026. Expiry extended. | |
| ITS-HBK-AASTEP3.v2025-11 | Step 3: Implement Policy | Listed as ITS-HBK-AASTEP3.v2025-11. Dated April 17, 2026. Expiry extended. | |
| ITS-HBK-AASTEP4.v2025-11 | Step 4: Assess Policy | Listed as ITS-HBK-AASTEP4.v2025-11. Dated April 17, 2026. Expiry extended. | |
| ITS-HBK-AASTEP5.v2025-11 | Step 5: Authorize Policy | Listed as ITS-HBK-AASTEP5.v2025-11. Dated April 17, 2026. Expiry extended. | |
| ITS-HBK-AASTEP6.v2025-11 | Step 6: Monitor Policy | Listed as ITS-HBK-AASTEP6.v2025-11. Dated April 17, 2026. Expiry extended. | |
| ITS-HBK-SCRM.2810.v1.2.4 | Supply Chain Risk Management | Listed as ITS-HBK-SCRM.2810.v1.2.4. Dated November 17, 2025. Expires November 17, 2026. | |
| NASA-SPEC-2600 Version 6.0 | Enumeration of ASCS Cybersecurity Requirements | Listed as NASA-SPEC-2600 Version 6.0. Dated January 12, 2026. | |
| NASA-STD-2601.2.0.2 | Minimum Cybersecurity Requirements for Computing Systems | Listed as NASA-STD-2601.2.0.2. Dated June 14, 2023. | |
| NASA-STD-2602 | Minimum Information System Owner and End User Security for Data at Rest | Listed as NASA-STD-2602. Dated April 12, 2023. | |
| NASA-STD-2605 | Privileged Access for Computing Systems | Listed as NASA-STD-2605. Dated October 16, 2023. | |
| NASA-STD-2606 | Cloud Security | Listed as NASA-STD-2606. Dated April 12, 2023. | |
| NASA-STD-2607 | Network Security | Listed as NASA-STD-2607. Dated April 12, 2023. | |
| NASA-STD-2804 | Minimum Interoperability Software Suite | Listed as NASA-STD-2804. Dated June 13, 2023. | |
| NASA-STD-2805 | Minimum Hardware Configurations | Listed as NASA-STD-2805. Dated November 16, 2023. | |
| NASA-STD-8739.8B | Software Assurance and Software Safety Standard | Listed as NASA-STD-8739.8B. Dated September 8, 2022. | |
| Delegation of Authority for IT Acquisitions (Delegation) | Delegation of Authority for IT Acquisitions (Delegation) | Listed as Delegation of Authority for IT Acquisitions (Delegation). From NASA CIO. Dated September 30, 2024. | |
| Federal Source Code Framework | Federal Source Code Framework | Listed as Federal Source Code Framework. From NASA CIO. Dated November 7, 2016. | |
| Federal Source Code Framework Document for OMB M-16-21 | Federal Source Code Framework Document for OMB M-16-21 | Listed as Federal Source Code Framework Document for OMB M-16-21. From NASA OCIO. Dated November 15, 2016. | |
| Generative Artificial Intelligence Senior Leader’s Introduction | Generative Artificial Intelligence Senior Leader’s Introduction | Listed as Generative Artificial Intelligence Senior Leader’s Introduction. From NASA CIO. Dated May 19, 2023. | |
| Immediate Use of OCOP Performance Management Policy | Immediate Use of OCOP Performance Management Policy | Listed as Immediate Use of OCOP Performance Management Policy. From NASA OCIO. Dated May 5, 2022. | |
| IPv6 Implementation | IPv6 Implementation | Listed as IPv6 Implementation. From NASA CIO. Dated May 11, 2021. | |
| Section 508 Compliance and Digital Accessibility | Section 508 Compliance and Digital Accessibility | Listed as Section 508 Compliance and Digital Accessibility. From NASA CIO. Dated March 8, 2024. | |
| Transfer of Liability of Phone Numbers to a Different Phone Carrier | Transfer of Liability of Phone Numbers to a Different Phone Carrier | Listed as Transfer of Liability of Phone Numbers to a Different Phone Carrier. From NASA CIO. Dated February 13, 2023. | |
| Use of Software with Automated Reporting Features | Use of Software with Automated Reporting Features | Listed as Use of Software with Automated Reporting Features. From NASA CIO. Dated June 18, 2024. | |
| 44 U.S.C. 101 | Federal Information Security Modernization Act of 2014 | Listed as 44 U.S.C. 101. Dated December 18, 2014. | |
| BOD 22-01 | Reducing the Significant Risk of Known Exploited Vulnerabilities | Listed as BOD 22-01. Dated November 3, 2021. | |
| Executive Order | Ensuring American Space Superiority | Listed as Executive Order. Dated December 18, 2025. | |
| Executive Order 13526 | Classified National Security Information | Listed as Executive Order 13526. Dated December 29, 2009. | |
| Executive Order 13556 | Controlled Unclassified Information (CUI) | Listed as Executive Order 13556. Dated November 9, 2010. | |
| Executive Order 13800 | Strengthening the Cybersecurity of Federal Networks and Critical Infrastructure | Listed as Executive Order 13800. Dated May 11, 2017. | |
| Executive Order 14028 | Improving the Nation’s Cybersecurity | Listed as Executive Order 14028. Dated May 12, 2021. | |
| National Defense Authorization Act (NDAA) Section 889 | Prohibition On Certain Telecommunications and Video Surveillance Services or Equipment | Listed as National Defense Authorization Act (NDAA) Section 889. Dated October 26, 2020. | |
| OMB Circular A-108 | Federal Agency Responsibilities for Review, Reporting, and Publication under the Privacy Act | Listed as OMB Circular A-108. Dated December 23, 2016. | |
| OMB Circular A-11 | Preparation, Submission, and Execution of the Budget | Listed as OMB Circular A-11. Dated August 29, 2025. | |
| OMB Circular A-123 | Management’s Responsibility for Internal Control | Listed as OMB Circular A-123. Dated March 10, 2026. | |
| OMB Circular A-130 | Managing Federal Information as a Strategic Resource | Listed as OMB Circular A-130. Dated July 28, 2016. | |
| OMB M-01-05 | Guidance on Inter-Agency Sharing of Personal Data - Protecting Personal Privacy | Listed as OMB M-01-05. Dated December 20, 2000. | |
| OMB M-02-01 | Guidance for Preparing and Submitting Security Plans of Actions and Milestones | Listed as OMB M-02-01. Dated October 17, 2001. | |
| OMB M-03-22 | OMB Guidance for Implementing the Privacy Provisions of the E-Government Act of 2002 | Listed as OMB M-03-22. Dated September 26, 2003. | |
| OMB M-05-08 | Designation of Senior Agency Officials for Privacy | Listed as OMB M-05-08. Dated February 11, 2005. | |
| OMB M-05-24 | Implementation of Homeland Security Directive (HSPD) 12 | Listed as OMB M-05-24. Dated August 5, 2005. | |
| OMB M-10-23 | Guidance for Agency Use of Third-Party Websites and Applications | Listed as OMB M-10-23. Dated June 25, 2010. | |
| OMB M-13-10 | Antideficiency Act Implications of Certain Online Terms of Service Agreements | Listed as OMB M-13-10. Dated April 4, 2013. | |
| OMB M-15-13 | Policy to require Secure Connections across Federal Websites and Web Services | Listed as OMB M-15-13. Dated June 8, 2015. | |
| OMB M-17-12 | Preparing for and Responding to a Breach of Personally Identifiable Information | Listed as OMB M-17-12. Dated January 03, 2017. | |
| OMB M-18-23 | Shifting from Low-Value to High-Value Work | Listed as OMB M-18-23. Dated August 27, 2018. | |
| OMB M-19-17 | Enabling Mission Delivery through Improved Identity, Credential, and Access Management | Listed as OMB M-19-17. Dated May 21, 2019. | |
| OMB M-19-26 | Update to the Trusted Internet Connection (TIC) Initiative | Listed as OMB M-19-26. Dated September 12, 2019. | |
| OMB M-21-07 | Completing the Transition to Internet Protocol version 6 (IPv6) | Listed as OMB M-21-07. Dated November 19, 2020. | |
| OMB M-21-30 | Software Supply Chain Security | Listed as OMB M-21-30. Dated August 10, 2021. | |
| OMB M-21-31 | Event Security Logging | Listed as OMB M-21-31. Dated August 27, 2021. | |
| OMB M-22-01 | Endpoint Detection and Response | Listed as OMB M-22-01. Dated October 8, 2021. | |
| OMB M-22-09 | Zero Trust Strategy | Listed as OMB M-22-09. Dated January 26, 2022. | |
| OMB M-25-21 | Accelerating Federal Use of AI through Innovation, Governance, and Public Trust | Listed as OMB M-25-21. Dated April 3, 2025. | |
| OMB M-25-22 | Driving Efficient Acquisition of Artificial Intelligence in Government | Listed as OMB M-25-22. Dated April 3, 2025. | |
| OMB M-26-04 | Increasing Public Trust in Artificial Intelligence Through Unbiased AI Principles | Listed as OMB M-26-04. Dated December 11, 2025. | |
| TIC 3.0 Vol.2 | Cloud TIC Core Guidance: Reference Architecture | Listed as TIC 3.0 Vol.2. Dated July 2, 2025. | |
| FIPS 140-2 | Security Requirements for Cryptographic Modules | Listed as FIPS 140-2. Dated December 3, 2002. | |
| FIPS 140-3 | Security Requirements for Cryptographic Modules | Listed as FIPS 140-3. Dated March 22, 2019. | |
| FIPS 180-4 | Secure Hash Standard (SHS) | Listed as FIPS 180-4. Dated August 4, 2015. | |
| FIPS 186-5 | Digital Signature Standard (DSS) | Listed as FIPS 186-5. Dated February 3, 2023. | |
| FIPS 197 | Advanced Encryption Standard (AES) | Listed as FIPS 197. Dated May 9, 2023. | |
| FIPS 198-1 | The Keyed-Hash Message Authentication Code (HMAC) | Listed as FIPS 198-1. Dated July 16, 2008. | |
| FIPS 199 | Standards for Security Categorization of Federal Information and Information Systems | Listed as FIPS 199. Dated February 1, 2004. | |
| FIPS 200 | Minimum Security Requirements for Federal Information and Information Systems | Listed as FIPS 200. Dated March 1, 2006. | |
| FIPS 201-3 | Personal Identity Verification (PIV) of Federal Employees and Contractors | Listed as FIPS 201-3. Dated January 24, 2022. | |
| FIPS 202 | SHA-3 Standard: Permutation-Based Hash and Extendable-Output Functions | Listed as FIPS 202. Dated August 4, 2015. | |
| FIPS140-3 IG | Cryptographic Module Validation Program | Listed as FIPS140-3 IG. Dated April 9, 2026. | |
| IEEE 802.11 | WiFi Security Standards | Listed as IEEE 802.11. Dated September 26, 2025. | |
| SP 800-224 | Keyed-Hash Message Authentication Code (HMAC): Specification of HMAC and Recommendations for Message Authentication | Listed as SP 800-224. Dated June 28, 2004. | |
| SP 1800-10 | Protecting Information and System Integrity in Industrial Control System Environments: Cybersecurity for the Manufacturing Sector | Listed as SP 1800-10. Dated March 16, 2022. | |
| SP 800-101 Rev. 1 | Guidelines on Mobile Device Forensics | Listed as SP 800-101 Rev. 1. Dated May 15, 2014. | |
| SP 800-108 Rev. 1 | Recommendation for Key Derivation Using Pseudorandom Functions | Listed as SP 800-108 Rev. 1. Dated February 2, 2024. | |
| SP 800-111 | Guide to Storage Encryption Technologies for End User Devices | Listed as SP 800-111. Dated November 15, 2007. | |
| SP 800-113 | Guide to SSL VPNs | Listed as SP 800-113. Dated July 1, 2008. | |
| SP 800-114 Rev. 1 | User's Guide to Telework and Bring Your Own Device (BYOD) Security | Listed as SP 800-114 Rev. 1. Dated July 29, 2016. | |
| SP 800-115 | Technical Guide to Information Security Testing and Assessment | Listed as SP 800-115. Dated September 3, 2008. | |
| SP 800-116 Rev. 1 | Guidelines for the Use of PIV Credentials in Facility Access | Listed as SP 800-116 Rev. 1. Dated June 29, 2018. | |
| SP 800-119 | Guidelines for the Secure Deployment of IPv6 | Listed as SP 800-119. Dated December 29, 2010. | |
| SP 800-12 Rev. 1 | An Introduction to Information Security | Listed as SP 800-12 Rev. 1. Dated June 22, 2017. | |
| SP 800-121 Rev. 2 | Guide to Bluetooth Security | Listed as SP 800-121 Rev. 2. Dated January 19, 2022. | |
| SP 800-122 | Guide to Protecting the Confidentiality of Personally Identifiable Information (PII) | Listed as SP 800-122. Dated April 6, 2010. | |
| SP 800-123 | Guide to General Server Security | Listed as SP 800-123. Dated July 25, 2008. | |
| SP 800-124 Rev. 2 | Guidelines for Managing the Security of Mobile Devices in the Enterprise | Listed as SP 800-124 Rev. 2. Dated May 17, 2023. | |
| SP 800-125 | Guide to Security for Full Virtualization Technologies | Listed as SP 800-125. Dated January 28, 2011. | |
| SP 800-125A Rev. 1 | Security Recommendations for Server-based Hypervisor Platforms | Listed as SP 800-125A Rev. 1. Dated June 7, 2018. | |
| SP 800-125B | Secure Virtual Network Configuration for Virtual Machine (VM) Protection | Listed as SP 800-125B. Dated March 7, 2016. | |
| SP 800-126 Rev. 3 | The Technical Specification for the Security Content Automation Protocol (SCAP): SCAP Version 1.3 | Listed as SP 800-126 Rev. 3. Dated February 14, 2018. | |
| SP 800-126A | SCAP 1.3 Component Specification Version Updates: An Annex to NIST Special Publication 800-126 Revision 3 | Listed as SP 800-126A. Dated February 14, 2018. | |
| SP 800-128 | Guide for Security-Focused Configuration Management of Information Systems (Update 1) | Listed as SP 800-128. Dated October 10, 2019. | |
| SP 800-130 | A Framework for Designing Cryptographic Key Management Systems | Listed as SP 800-130. Dated August 15, 2013. | |
| SP 800-131A Rev. 2 | Transitioning the Use of Cryptographic Algorithms and Key Lengths | Listed as SP 800-131A Rev. 2. Dated March 21, 2019. | |
| SP 800-132 | Recommendation for Password-Based Key Derivation: Part 1: Storage Applications | Listed as SP 800-132. Dated December 22, 2010. | |
| SP 800-133 Rev. 2 | Recommendation for Cryptographic Key Generation | Listed as SP 800-133 Rev. 2. Dated June 4, 2020. | |
| SP 800-135 Rev. 1 | Recommendation for Existing Application-Specific Key Derivation Functions | Listed as SP 800-135 Rev. 1. Dated December 23, 2011. | |
| SP 800-137 | Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations | Listed as SP 800-137. Dated September 30, 2011. | |
| SP 800-137A | Assessing Information Security Continuous Monitoring (ISCM) Programs: Developing an ISCM Program Assessment | Listed as SP 800-137A. Dated May 21, 2020. | |
| SP 800-140 | FIPS 140-3 Derived Test Requirements (DTR): CMVP Validation Authority Updates to ISO/IEC 24759 | Listed as SP 800-140. Dated March 20, 2020. | |
| SP 800-140A | CMVP Documentation Requirements: CMVP Validation Authority Updates to ISO/IEC 24759 | Listed as SP 800-140A. Dated March 20, 2020. | |
| SP 800-140B Rev.1 | CMVP Security Policy Requirements: CMVP Validation Authority Updates to ISO/IEC 24759 and ISO/IEC 19790 Annex B | Listed as SP 800-140B Rev.1. Dated November 17, 2023. | |
| SP 800-140C Rev. 2 | CMVP Approved Security Functions: CMVP Validation Authority Updates to ISO/IEC 24759 | Listed as SP 800-140C Rev. 2. Dated July 25, 2023. | |
| SP 800-140D Rev. 2 | CMVP Approved Sensitive Parameter Generation and Establishment Methods: CMVP Validation Authority Updates to ISO/IEC 24759 | Listed as SP 800-140D Rev. 2. Dated July 25, 2023. | |
| SP 800-140E | CMVP Approved Authentication Mechanisms: CMVP Validation Authority Requirements for ISO/IEC 19790 Annex E and ISO/IEC 24579 Section 6.17 | Listed as SP 800-140E. Dated March 20, 2020. | |
| SP 800-140F | CMVP Approved Non-Invasive Attack Mitigation Test Metrics: CMVP Validation Authority Updates to ISO/IEC 24759 | Listed as SP 800-140F. Dated March 20, 2020. | |
| SP 800-142 | Practical Combinatorial Testing | Listed as SP 800-142. Dated October 7, 2010. | |
| SP 800-144 | Guidelines on Security and Privacy in Public Cloud Computing | Listed as SP 800-144. Dated December 9, 2011. | |
| SP 800-145 | The NIST Definition of Cloud Computing | Listed as SP 800-145. Dated September 28, 2011. | |
| SP 800-146 | Cloud Computing Synopsis and Recommendations | Listed as SP 800-146. Dated May 29, 2012. | |
| SP 800-147 | BIOS Protection Guidelines | Listed as SP 800-147. Dated April 29, 2011. | |
| SP 800-147B | BIOS Protection Guidelines for Servers | Listed as SP 800-147B. Dated August 28, 2014. | |
| SP 800-150 | Guide to Cyber Threat Information Sharing | Listed as SP 800-150. Dated October 4, 2016. | |
| SP 800-152 | A Profile for U.S. Federal Cryptographic Key Management Systems (CKMS) | Listed as SP 800-152. Dated October 28, 2015. | |
| SP 800-153 | Guidelines for Securing Wireless Local Area Networks (WLANs) | Listed as SP 800-153. Dated February 21, 2012. | |
| SP 800-156 | Representation of PIV Chain-of-Trust for Import and Export | Listed as SP 800-156. Dated May 20, 2016. | |
| SP 800-157 | Guidelines for Derived Personal Identity Verification (PIV) Credentials | Listed as SP 800-157. Dated December 19, 2014. | |
| SP 800-160 Vol. 1 Rev. 1 | Engineering of Trustworthy Secure Systems | Listed as SP 800-160 Vol. 1 Rev. 1. Dated November 16, 2022. | |
| SP 800-160 Vol. 2 Rev. 1 | Developing Cyber-Resilient Systems: A Systems Security Engineering Approach | Listed as SP 800-160 Vol. 2 Rev. 1. Dated December 9, 2021. | |
| SP 800-161 Rev. 1 | Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations | Listed as SP 800-161 Rev. 1. Dated November 1, 2024. | |
| SP 800-162 | Guide to Attribute Based Access Control (ABAC) Definition and Considerations | Listed as SP 800-162. Dated August 2, 2019. | |
| SP 800-163 Rev. 1 | Vetting the Security of Mobile Applications | Listed as SP 800-163 Rev. 1. Dated April 19, 2019. | |
| SP 800-166 | Derived PIV Application and Data Model Test Guidelines | Listed as SP 800-166. Dated June 6, 2016. | |
| SP 800-167 | Guide to Application Whitelisting | Listed as SP 800-167. Dated October 28, 2015. | |
| SP 800-168 | Approximate Matching: Definition and Terminology | Listed as SP 800-168. Dated July 2, 2014. | |
| SP 800-171 Rev. 3 | Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations | Listed as SP 800-171 Rev. 3. Dated May 14, 2024. | |
| SP 800-172 | Enhanced Security Requirements for Protecting Controlled Unclassified Information: A Supplement to NIST Special Publication 800-171 | Listed as SP 800-172. Dated February 2, 2021. | |
| SP 800-172A | Assessing Enhanced Security Requirements for Controlled Unclassified Information | Listed as SP 800-172A. Dated March 15, 2022. | |
| SP 800-175A | Guideline for Using Cryptographic Standards in the Federal Government: Directives, Mandates and Policies | Listed as SP 800-175A. Dated August 22, 2016. | |
| SP 800-175B Rev. 1 | Guideline for Using Cryptographic Standards in the Federal Government: Cryptographic Mechanisms | Listed as SP 800-175B Rev. 1. Dated March 31, 2020. | |
| SP 800-177 Rev. 1 | Trustworthy Email | Listed as SP 800-177 Rev. 1. Dated February 26, 2019. | |
| SP 800-178 | A Comparison of Attribute Based Access Control (ABAC) Standards for Data Service Applications: Extensible Access Control Markup Language (XACML) and Next Generation Access Control (NGAC) | Listed as SP 800-178. Dated October 3, 2016. | |
| SP 800-18 Rev. 2 | Guide for Developing Security Plans for Federal Information Systems | Listed as SP 800-18 Rev. 2. Dated June 30, 2026. | |
| SP 800-181 Rev. 1 | Workforce Framework for Cybersecurity (NICE Framework) | Listed as SP 800-181 Rev. 1. Dated November 16, 2020. | |
| SP 800-183 | Networks of 'Things' | Listed as SP 800-183. Dated July 28, 2016. | |
| SP 800-184 | Guide for Cybersecurity Event Recovery | Listed as SP 800-184. Dated December 22, 2016. | |
| SP 800-185 | SHA-3 Derived Functions: cSHAKE, KMAC, TupleHash, and ParallelHash | Listed as SP 800-185. Dated December 22, 2016. | |
| SP 800-187 | Guide to LTE Security | Listed as SP 800-187. Dated December 21, 2017. | |
| SP 800-189 | Resilient Interdomain Traffic Exchange: BGP Security and DDoS Mitigation | Listed as SP 800-189. Dated December 17, 2019. | |
| SP 800-190 | Application Container Security Guide | Listed as SP 800-190. Dated September 25, 2017. | |
| SP 800-192 | Verification and Test Methods for Access Control Policies/Models | Listed as SP 800-192. Dated June 27, 2017. | |
| SP 800-193 | Platform Firmware Resiliency Guidelines | Listed as SP 800-193. Dated May 4, 2018. | |
| SP 800-202 | Quick Start Guide for Populating Mobile Test Devices | Listed as SP 800-202. Dated May 10, 2018. | |
| SP 800-204 | Security Strategies for Microservices-based Application Systems | Listed as SP 800-204. Dated August 7, 2019. | |
| SP 800-204A | Building Secure Microservices-based Applications Using Service-Mesh Architecture | Listed as SP 800-204A. Dated May 27, 2020. | |
| SP 800-204B | Attribute-based Access Control for Microservices-based Applications using a Service Mesh | Listed as SP 800-204B. Dated August 6, 2021. | |
| SP 800-204C | Implementation of DevSecOps for a Microservices-based Application with Service Mesh | Listed as SP 800-204C. Dated March 8, 2022. | |
| SP 800-205 | Attribute Considerations for Access Control Systems | Listed as SP 800-205. Dated June 18, 2019. | |
| SP 800-207 | Zero Trust Architecture | Listed as SP 800-207. Dated August 11, 2020. | |
| SP 800-208 | Recommendation for Stateful Hash-Based Signature Schemes | Listed as SP 800-208. Dated October 29, 2020. | |
| SP 800-209 Rev. 1 | Security Guidelines for Storage Infrastructure | Listed as SP 800-209 Rev. 1. Dated October 29, 2020. | |
| SP 800-210 | General Access Control Guidance for Cloud Systems | Listed as SP 800-210. Dated July 31, 2020. | |
| SP 800-213 | IoT Device Cybersecurity Guidance for the Federal Government: Establishing IoT Device Cybersecurity Requirements | Listed as SP 800-213. Dated November 29, 2021. | |
| SP 800-213A | IoT Device Cybersecurity Guidance for the Federal Government: IoT Device Cybersecurity Requirement Catalog | Listed as SP 800-213A. Dated November 29, 2021. | |
| SP 800-218 | Secure Software Development Framework (SSDF) Version 1.1: Recommendations for Mitigating the Risk of Software Vulnerabilities | Listed as SP 800-218. Dated February 3, 2022. | |
| SP 800-219 Rev. 2 | Automated Secure Configuration Guidance from the macOS Security Compliance Project (mSCP) | Listed as SP 800-219 Rev. 2. Dated July 21, 2023. | |
| SP 800-22 Rev. 1 | A Statistical Test Suite for Random and Pseudorandom Number Generators for Cryptographic Applications | Listed as SP 800-22 Rev. 1. Dated April 30, 2010. | |
| SP 800-220 | Fiscal Year 2021 Cybersecurity and Privacy Annual Report | Listed as SP 800-220. Dated September 26, 2022. | |
| SP 800-28 Version 2 | Guidelines on Active Content and Mobile Code | Listed as SP 800-28 Version 2. Dated March 7, 2008. | |
| SP 800-30 Rev. 1 | Guide for Conducting Risk Assessments | Listed as SP 800-30 Rev. 1. Dated September 17, 2012. | |
| SP 800-34 Rev. 1 | Contingency Planning Guide for Federal Information Systems | Listed as SP 800-34 Rev. 1. Dated November 11, 2010. | |
| SP 800-35 | Guide to Information Technology Security Services | Listed as SP 800-35. Dated October 9, 2003. | |
| SP 800-37 Rev. 2 | Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy | Listed as SP 800-37 Rev. 2. Dated December 10, 2018. | |
| SP 800-38A | Recommendation for Block Cipher Modes of Operation: Methods and Techniques | Listed as SP 800-38A. Dated December 1, 2001. | |
| SP 800-38A Addendum | Recommendation for Block Cipher Modes of Operation: Three Variants of Ciphertext Stealing for CBC Mode | Listed as SP 800-38A Addendum. Dated October 21, 2010. | |
| SP 800-38B | Recommendation for Block Cipher Modes of Operation: the CMAC Mode for Authentication | Listed as SP 800-38B. Dated October 6, 2016. | |
| SP 800-38C | Recommendation for Block Cipher Modes of Operation: the CCM Mode for Authentication and Confidentiality | Listed as SP 800-38C. Dated July 20, 2007. | |
| SP 800-38D Rev.1 | Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC | Listed as SP 800-38D Rev.1. Dated November 28, 2007. | |
| SP 800-38E | Recommendation for Block Cipher Modes of Operation: the XTS-AES Mode for Confidentiality on Storage Devices | Listed as SP 800-38E. Dated January 18, 2010. | |
| SP 800-38F | Recommendation for Block Cipher Modes of Operation: Methods for Key Wrapping | Listed as SP 800-38F. Dated December 13, 2012. | |
| SP 800-38G | Recommendation for Block Cipher Modes of Operation: Methods for Format-Preserving Encryption | Listed as SP 800-38G. Dated August 4, 2016. | |
| SP 800-39 | Managing Information Security Risk: Organization, Mission, and Information System View | Listed as SP 800-39. Dated March 1, 2011. | |
| SP 800-40 Rev. 4 | Guide to Enterprise Patch Management Planning: Preventive Maintenance for Technology | Listed as SP 800-40 Rev. 4. Dated April 6, 2022. | |
| SP 800-41 Rev. 1 | Guidelines on Firewalls and Firewall Policy | Listed as SP 800-41 Rev. 1. Dated September 28, 2009. | |
| SP 800-44 Version 2 | Guidelines on Securing Public Web Servers | Listed as SP 800-44 Version 2. Dated October 9, 2007. | |
| SP 800-45 Version 2 | Guidelines on Electronic Mail Security | Listed as SP 800-45 Version 2. Dated February 20, 2007. | |
| SP 800-46 Rev. 2 | Guide to Enterprise Telework, Remote Access, and Bring Your Own Device (BYOD) Security | Listed as SP 800-46 Rev. 2. Dated July 29, 2016. | |
| SP 800-47 Rev. 1 | Managing the Security of Information Exchanges | Listed as SP 800-47 Rev. 1. Dated July 20, 2021. | |
| SP 800-49 | Federal S/MIME V3 Client Profile | Listed as SP 800-49. Dated November 5, 2002. | |
| SP 800-50 Rev.1 | Building a Cybersecurity and Privacy Learning Program | Listed as SP 800-50 Rev.1. Dated September 12, 2024. | |
| SP 800-51 Rev. 1 | Guide to Using Vulnerability Naming Schemes | Listed as SP 800-51 Rev. 1. Dated February 25, 2011. | |
| SP 800-52 Rev. 2 | Guidelines for the Selection, Configuration, and Use of Transport Layer Security (TLS) Implementations | Listed as SP 800-52 Rev. 2. Dated August 29, 2019. | |
| SP 800-53 Rev. 5 | Security and Privacy Controls for Information Systems and Organizations | Listed as SP 800-53 Rev. 5. Dated December 10, 2020. | |
| SP 800-53A Rev. 5 | Assessing Security and Privacy Controls in Information Systems and Organizations | Listed as SP 800-53A Rev. 5. Dated January 25, 2022. | |
| SP 800-53B | Control Baselines for Information Systems and Organizations | Listed as SP 800-53B. Dated December 10, 2020. | |
| SP 800-55 Vol. 1 | Measurement Guide for Information Security: Volume 1 — Identifying and Selecting Measures | Listed as SP 800-55 Vol. 1. Dated December 4, 2024. | |
| SP 800-55 Vol 2 | Measurement Guide for Information Security: Volume 2 — Developing an Information Security Measurement Program | Listed as SP 800-55 Vol 2. Dated December 4, 2024. | |
| SP 800-56A Rev. 3 | Recommendation for Pair-Wise Key-Establishment Schemes Using Discrete Logarithm Cryptography | Listed as SP 800-56A Rev. 3. Dated April 16, 2018. | |
| SP 800-56B Rev. 2 | Recommendation for Pair-Wise Key-Establishment Using Integer Factorization Cryptography | Listed as SP 800-56B Rev. 2. Dated March 21, 2019. | |
| SP 800-56C Rev. 2 | Recommendation for Key-Derivation Methods in Key-Establishment Schemes | Listed as SP 800-56C Rev. 2. Dated August 18, 2020. | |
| SP 800-57 Part 1 Rev. 5 | Recommendation for Key Management: Part 1 – General | Listed as SP 800-57 Part 1 Rev. 5. Dated May 4, 2020. | |
| SP 800-57 Part 2 Rev. 1 | Recommendation for Key Management: Part 2 – Best Practices for Key Management Organizations | Listed as SP 800-57 Part 2 Rev. 1. Dated May 23, 2019. | |
| SP 800-57 Part 3 Rev. 1 | Recommendation for Key Management, Part 3: Application-Specific Key Management Guidance | Listed as SP 800-57 Part 3 Rev. 1. Dated January 22, 2015. | |
| SP 800-58 | Security Considerations for Voice Over IP Systems | Listed as SP 800-58. Dated January 1, 2005. | |
| SP 800-59 | Guideline for Identifying an Information System as a National Security System | Listed as SP 800-59. Dated August 20, 2003. | |
| SP 800-60 Vol. 1 Rev. 1 | Guide for Mapping Types of Information and Information Systems to Security Categories | Listed as SP 800-60 Vol. 1 Rev. 1. Dated August 1, 2008. | |
| SP 800-60 Vol. 2 Rev. 1 | Guide for Mapping Types of Information and Information Systems to Security Categories: Appendices | Listed as SP 800-60 Vol. 2 Rev. 1. Dated August 1, 2008. | |
| SP 800-61 Rev. 3 | Incident Response Recommendations and Considerations for Cybersecurity Risk Management: A CSF 2.0 Community Profile | Listed as SP 800-61 Rev. 3. Dated April 3, 2025. | |
| SP 800-63A | Digital Identity Guidelines: Identity Proofing and Enrollment | Listed as SP 800-63A. Dated July 31, 2025. | |
| SP 800-63B-4 | Digital Identity Guidelines: Authentication and Authenticator Management | Listed as SP 800-63B-4. Dated July 31, 2025. | |
| SP 800-63C-4 | Digital Identity Guidelines: Federation and Assertions | Listed as SP 800-63C-4. Dated July 31, 2025. | |
| SP 800-66 Rev. 2 | An Introductory Resource Guide for Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule | Listed as SP 800-66 Rev. 2. Dated February 14, 2024. | |
| SP 800-70 Rev. 5 | National Checklist Program for IT Products: Guidelines for Checklist Users and Developers | Listed as SP 800-70 Rev. 5. Dated May 8, 2026. | |
| SP 800-72 | Guidelines on PDA Forensics | Listed as SP 800-72. Dated November 1, 2004. | |
| SP 800-73-5 | Interfaces for Personal Identity Verification: Part 1 – PIV Card Application Namespace, Data Model, and Representation | Listed as SP 800-73-5. Dated July 15, 2024. | |
| SP 800-76-2 | Biometric Specifications for Personal Identity Verification | Listed as SP 800-76-2. Dated July 11, 2013. | |
| SP 800-77 Rev. 1 | Guide to IPsec VPNs | Listed as SP 800-77 Rev. 1. Dated June 30, 2020. | |
| SP 800-78-5 | Cryptographic Algorithms and Key Sizes for Personal Identity Verification | Listed as SP 800-78-5. Dated July 15, 2024. | |
| SP 800-79-2 | Guidelines for the Authorization of Personal Identity Verification Card Issuers (PCI) and Derived PIV Credential Issuers (DPCI) | Listed as SP 800-79-2. Dated July 30, 2015. | |
| SP 800-81 Rev. 3 | Secure Domain Name System (DNS) Deployment Guide | Listed as SP 800-81 Rev. 3. Dated March 19, 2026. | |
| SP 800-82 Rev. 3 | Guide to Operational Technology (OT) Security | Listed as SP 800-82 Rev. 3. Dated September 28, 2023. | |
| SP 800-83 Rev. 1 | Guide to Malware Incident Prevention and Handling for Desktops and Laptops | Listed as SP 800-83 Rev. 1. Dated July 22, 2013. | |
| SP 800-84 | Guide to Test, Training, and Exercise Programs for IT Plans and Capabilities | Listed as SP 800-84. Dated September 21, 2006. | |
| SP 800-85A-4 | PIV Card Application and Middleware Interface Test Guidelines (SP 800-73-4 Compliance) | Listed as SP 800-85A-4. Dated April 13, 2016. | |
| SP 800-85B | PIV Data Model Test Guidelines | Listed as SP 800-85B. Dated July 31, 2006. | |
| SP 800-86 | Guide to Integrating Forensic Techniques into Incident Response | Listed as SP 800-86. Dated September 1, 2006. | |
| SP 800-87 Rev. 2 | Codes for Identification of Federal and Federally-Assisted Organizations | Listed as SP 800-87 Rev. 2. Dated April 19, 2018. | |
| SP 800-88 Rev. 2 | Guidelines for Media Sanitization | Listed as SP 800-88 Rev. 2. Dated September 26, 2025. | |
| SP 800-89 | Recommendation for Obtaining Assurances for Digital Signature Applications | Listed as SP 800-89. Dated November 30, 2006. | |
| SP 800-90A Rev. 1 | Recommendation for Random Number Generation Using Deterministic Random Bit Generators | Listed as SP 800-90A Rev. 1. Dated June 24, 2015. | |
| SP 800-90B | Recommendation for the Entropy Sources Used for Random Bit Generation | Listed as SP 800-90B. Dated January 10, 2018. | |
| SP 800-92 | Guide to Computer Security Log Management | Listed as SP 800-92. Dated September 13, 2006. | |
| SP 800-94 | Guide to Intrusion Detection and Prevention Systems (IDPS) | Listed as SP 800-94. Dated February 20, 2007. | |
| SP 800-95 | Guide to Secure Web Services | Listed as SP 800-95. Dated August 29, 2007. | |
| SP 800-96 | PIV Card to Reader Interoperability Guidelines | Listed as SP 800-96. Dated December 29, 2006. | |
| SP 800-98 | Guidelines for Securing Radio Frequency Identification (RFID) Systems | Listed as SP 800-98. Dated April 6, 2007. |
271 of 271.