Login Form

Some Reading Ideas

Risk Management Framework - RMF SP 800-37

Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy (nist.gov)

Prepare Essential activities to prepare the organization to manage security and privacy risks.

Implement the controls and document how controls are deployed.

Categorize the system and information processed, stored, and transmitted based on impact analysis. 

Assess to determine if the controls are in place, operating as intended, and producing the desired results. 

Select the set of NIST SP 800-53 controls to protect the system based on risk assessment(s)

Authorize: Senior official makes a risk-based decision to authorize the system (to operate).

Monitor: Continuously monitor control implementation and risks to the system. 
Table 1: RMF Steps Including Resources for Implementers and Supporting NIST Publications *Read More at Risk Management Framework (RMF) Overview - Risk Management | CSRC

Cybersecurity Framework

Cybersecurity Framework (CSF) Framework Core (nist.gov)

Identify –   Develop an organizational understanding to manage cybersecurity risk to systems, people, assets, data, and capabilities. The activities in the Identify Function are foundational for effective use of the Framework. Understanding the business context, the resources that support critical functions, and the related cybersecurity risks enables an organization to focus and prioritize its efforts, consistent with its risk management strategy and business needs. Examples of outcome Categories within this Function include Asset Management; Business Environment; Governance; Risk Assessment; and Risk Management Strategy.

Protect – Develop and implement appropriate safeguards to ensure delivery of critical services. The Protect Function supports the ability to limit or contain the impact of a potential cybersecurity event. Examples of outcome Categories within this Function include Identity Management and Access Control; Awareness and Training; Data Security; Information Protection Processes and Procedures; Maintenance; and Protective Technology.

Detect – Develop and implement appropriate activities to identify the occurrence of a cybersecurity event. The Detect Function enables the timely discovery of cybersecurity events. Examples of outcome Categories within this Function include Anomalies and Events; Security Continuous Monitoring; and Detection Processes. 

Respond – Develop and implement appropriate activities to take action regarding a detected cybersecurity incident. The Respond Function supports the ability to contain the impact of a potential cybersecurity incident. Examples of outcome Categories within this Function include Response Planning; Communications; Analysis; Mitigation; and Improvements.

Recover – Develop and implement appropriate activities to maintain plans for resilience and to restore any capabilities or services that were impaired due to a cybersecurity incident. The Recover Function supports timely recovery to normal operations to reduce the impact of a cybersecurity incident. Examples of outcome Categories within this Function include Recovery Planning; Improvements; and Communications. 

Read more about NIST Cybersecurity Framework CSF

Regulatory Compliance Standards and Frameworks

EXECUTIVE ORDER 14028, IMPROVING THE NATION'S CYBERSECURITY - NIST Content - Internet of Things (IoT) Devices and Software

Details
Written by: NIST
Parent Category: Resources
Category: Regulatory Compliance Standards and Frameworks

Article Index

Page 5 of 5

Cybersecurity Labeling for Consumers: Internet of Things (IoT) Devices and Software

The May 12, 2021, Presidential Executive Order on Improving the Nation’s Cybersecurity (14028) directs NIST to initiate two labeling programs on cybersecurity capabilities of Internet-of-Things (IoT) consumer devices and software development practices. The agency also received several other directives to enhance the security of the software supply chain.

Section 4 of the order directs NIST to take into account existing consumer product labeling programs as it considers efforts to educate the public on the cybersecurity capabilities of Internet-of-Things (IoT) devices and software development practices. NIST also is to consider ways to incentivize manufacturers and developers to participate in these programs.

By February 6, 2022, in coordination with the Federal Trade Commission (FTC) and other agencies, NIST is required to identify:

  • IoT cybersecurity criteria for a consumer labeling program and
  • secure software development practices or criteria for a consumer software labeling program.

NIST is relying heavily on information provided by diverse stakeholders as it carries out these directives. In October, NIST solicited public comments on draft criteria for consumer software cybersecurity and labeling. In August, the agency released for public comment a white paper suggesting a draft set of potential baseline security criteria for IoT devices. In November, NIST solicited public comments on draft criteria for consumer software cybersecurity and labeling.

NIST is identifying key elements of labeling programs in terms of minimum requirements and desirable attributes – rather than establishing its own programs; NIST will specify desired outcomes, allowing providers and customers to choose best solutions for their devices and environments. One size may not fit all, and multiple solutions might be offered by label providers.

Labeling should:

  • Encourage innovation in manufacturers’ consumer oriented IoT and software security efforts, leaving room for changes in technologies and the security landscape.
  • Be practical and not be burdensome to manufacturers and distributors.
  • Factor in usability as a key consideration.
  • Build on national and international experience.
  • Allow for diversity of approaches and solutions across industries, verticals, and use cases – so long as they are deemed useful and effective for consumers.

On September 14-15, 2021, NIST hosted a virtual public workshop on these consumer education-oriented efforts. The workshop included facilitated panel discussions and presentations based on the preliminary feedback on the draft IoT criteria and the consumer software labeling position papers submitted to NIST and on preliminary feedback on potential IoT baseline security criteria. On December 2, 2021, taking public feedback into account, NIST released a further discussion paper: Consumer Cybersecurity Labeling for IoT Products: Discussion Draft on the Path Forward. This paper will be discussed at the upcoming workshop Cybersecurity Labeling for Consumer IoT and Software: Executive Order Update and Discussion - December 9, 2021.

Questions about NIST’s activities related to these efforts should be directed to This email address is being protected from spambots. You need JavaScript enabled to view it..

Information technology, Cybersecurity and Internet of Things (IoT) Information technology and Cybersecurity

Workshops on Cybersecurity Labeling of Consumer Products

IoT Product Criteria

As part of its assignment under the Presidential Executive Order on Improving the Nation’s Cybersecurity (14028) issued on May 12, 2021, NIST is responsible for a multi-faceted initiative related to cybersecurity labeling for consumers. That includes labeling for Internet of Things (IoT) products. Under the Executive Order, NIST is to publish details about the IoT labeling effort by February 6, 2022. NIST will identify key elements of IoT labeling programs in terms of minimum requirements and desirable attributes – rather than establishing its own program, it will specify desired outcomes, allowing providers and customers to choose best solutions for their products and environments. One size may not fit all, and multiple solutions might be offered by label providers. 

On August 31, 2021, NIST released a white paper with draft criteria for a labeling program on cybersecurity capabilities of Internet of Things (IoT) devices. NIST sought comments on the draft criteria, which suggested a set of potential baseline security criteria for IoT devices. Comments on the draft white paper were due no later than October 18, 2021. Those comments are available here.

On December 2, 2021, taking public feedback into account, NIST released a further discussion paper: Consumer Cybersecurity Labeling for IoT Products: Discussion Draft on the Path Forward. This paper will be discussed at the upcoming workshop Cybersecurity Labeling for Consumer IoT and Software: Executive Order Update and Discussion - December 9, 2021.

Consumer Cybersecurity Labeling for IoT Products: Discussion Draft on the Path Forward

Draft white paper with draft criteria for a labeling program on cybersecurity capabilities of Internet-of-Things (IoT) devices

For questions, contact: This email address is being protected from spambots. You need JavaScript enabled to view it.

Information technology, Cybersecurity, and Internet of Things (IoT)

Consumer Software Criteria

As part of its assignment under the Presidential Executive Order on Improving the Nation’s Cybersecurity (14028) issued on May 12, 2021, NIST has released a white paper with draft criteria for consumer software cybersecurity labeling. This is one part of a multi-faceted initiative under the executive order related to cybersecurity labeling for consumers. NIST is seeking comments on the draft criteria, which suggests a set of potential baseline security criteria for consumer software.

Comments on the draft white paper are due no later than December 16, 2021. Under the Executive Order, NIST is to publish details about the consumer software labeling effort by February 6, 2022.

Comments should be submitted to: This email address is being protected from spambots. You need JavaScript enabled to view it.. Receipt of submissions will be acknowledged via email. All comments will be published on this website. Please submit comments only and include your name and organization’s name (if any) and cite “Draft Consumer Software Labeling Criteria.” Personally identifiable information (PII), such as street addresses, phone numbers, account numbers, or Social Security numbers, or names of other individuals, should not be included. Do not submit confidential business information or otherwise sensitive or protected information. 

NIST will identify key elements of labeling programs in terms of minimum requirements and desirable attributes – rather than establishing its own programs; it will specify desired outcomes, allowing providers and customers to choose best solutions for their devices and environments. One size may not fit all, and multiple solutions might be offered by label providers. 

November 1, 2021 - Draft white paper with draft criteria for a labeling program on consumer software

Information technology, Cybersecurity, and Internet of Things (IoT)

Cybersecurity Labeling for Consumers: Internet of Things (IoT) Devices and Software - News & Updates

Information technology, Cybersecurity, and Internet of Things (IoT)

Hits: 1610
Main Menu

FIPS PUB 200 Minimum Security Requirements

FIPS PUB 200 Minimum Security Requirements - Visit FIPS 200, Minimum Security Requirements for Federal Info and Info Systems | CSRC (nist.gov)
  • Access Control (AC)
  • Awareness and Training (AT)
  • Audit and Accountability (AU)
  • Certification, Accreditation, and Security Assessments (CA)
  • Configuration Management (CM)
  • Contingency Planning (CP)
  • Identification and Authentication (IA)
  • Incident Response (IR)

Read FIPS PUB 200 Minimum Security Requirements
  • Maintenance (MA)
  • Media Protection (MP)
  • Physical and Environmental Protection (PE)
  • Planning (PL)
  • Personnel Security (PS)
  • Risk Assessment (RA)
  • System and Services Acquisition (SA)
  • System and Communications Protection (SC)
  • System and Information Integrity (SI)

Standards.gov | NIST

Standards.gov | NIST
Documentary Standards can specify the definition of terms; classifications of components; delineation of procedures; specification of dimensions, materials, processes, products, systems, services, or practices; test methods and sampling procedures; or descriptions of fit and measurements of size or strength. Under the National Technology Transfer and Advancement Act (NTTAA), NIST is assigned the responsibility to coordinate federal, state, and local documentary standards and conformity assessment activities.
Standards.gov | Federal Use of Standards | Standards Incorporated by Reference (SIBR) | Industry Standards | International Standards | Military Standards | Standards Issued or Adopted by Federal Agencies | Standards Search Engines | Voluntary Product Standards

NIST Reading

Whether you're preparing for Cybersecurity certification, working with government standards, or simply starting your career in compliance, these are the NIST Federal Information Processing Standards (FIPS), Special Publication (SP), and Interagency Report (IR) topics you need to know. (The Perils of Mount Must Read™ Confessions of a Cliff Note Junky) These resources go onto the "Mountain of Must Read". If you don't recognize the standard reference, you've missed critical understanding. As of 2022, this is the minimum NIST alphabet. All of these documents are found at https://csrc.nist.gov/publications/ Be very careful about static content. Look at links before you launch them. Never use alternate sites for the Computer Security Resource Center. Get the full list here <NIST Reading Extended>

FIPS Publication 140-2 Security Requirements for Cryptographic Modules [FIPS 140-2]
FIPS Publication 199 Standards for Security Categorization of Federal Information and Information Systems [FIPS 199]
FIPS Publication 200 Minimum Security Requirements for Federal Information and Information Systems [FIPS 200]
FIPS Publication 201-1 Personal Identity Verification (PIV) of Federal Employees and Contractors [FIPS 201-1]		 NISTIR 8212 ISCMA: An Information Security Continuous Monitoring Program Assessment
NIST SP 800-18 Guide for Developing Security Plans for Federal Information Systems [SP 800-18]
NIST SP 800-30 Risk Management Guide for Information Technology Systems [NIST SP 800-30]
NIST SP 800-34 Contingency Planning Guide for Federal Information Systems [SP 800-34]

US Cert CISA Tweets