244 results
NIST SP 800-147 (BIOS Protection Guidelines), explained
NIST SP 800-147 (April 2011, Final) — the authenticated BIOS update mechanism, optional secure local update, integrity protection and non-bypassability guidelines, plus the five-phase BIOS management lifecycle and how SP 800-193 later generalized the same model.
6 min read Updated
NIST SP 800-150: cyber threat information sharing, explained
NIST SP 800-150 (October 2016) — the five types of cyber threat information, how to stand up a sharing relationship, the Traffic Light Protocol sharing designations, and who you actually share with (ISACs, ISAOs, CSIRTs).
4 min read Updated
NIST SP 800-160: systems security engineering, explained
NIST SP 800-160's two volumes — Engineering Trustworthy Secure Systems (Vol. 1) and Developing Cyber-Resilient Systems (Vol. 2) — explained: what each covers, how they differ, and how they relate to SP 800-37 and SP 800-53.
4 min read Updated
NIST SP 800-161: Cybersecurity Supply Chain Risk Management (C-SCRM), explained
NIST SP 800-161 Rev. 1's three C-SCRM levels, its link to Executive Order 14028 and SP 800-53's supply chain control family, plus companion publications.
4 min read Updated
NIST SP 800-171 Rev. 3 and CMMC 2.0, explained
What NIST SP 800-171 Revision 3 actually requires to protect Controlled Unclassified Information, how the DoD's CMMC 2.0 program (32 CFR Part 170) builds on it, and the 2026 Phase II suspension.
6 min read Updated
NIST SP 800-171A Rev. 3 (assessing CUI security requirements), explained
NIST SP 800-171A Revision 3 (May 2024) — the examine/interview/test assessment methods, determination-statement numbering with ODPs, the four-step assessment process, and how it ties to SP 800-171's 17 requirement families.
6 min read Updated
NIST SP 800-172 Rev. 3 (enhanced security requirements for CUI), explained
NIST SP 800-172 Revision 3 (May 2026) — the 17 enhanced-requirement families, the E/T/S requirement types, the PRA/DLO/CRS protection strategy aimed at the APT, and how it layers on SP 800-171 and feeds CMMC Level 3.
5 min read Updated
NIST SP 800-172A Rev. 3 (assessing enhanced security requirements for CUI), explained
NIST SP 800-172A Revision 3 (May 2026) — the "E"-suffixed determination statements, the examine/interview/test methodology shared with SP 800-53A, and how it assesses the 103 active enhanced requirements in SP 800-172 against the advanced persistent threat.
5 min read Updated
NIST SP 800-193 (Platform Firmware Resiliency Guidelines), explained
NIST SP 800-193 (May 2018, Final) — the Protection, Detection and Recovery principles for platform firmware, the Protected/Recoverable/Resilient tiers, Roots of Trust, and the firmware update mechanisms the guidelines are built around.
6 min read Updated
NIST SP 800-207: Zero Trust Architecture, explained
NIST's Zero Trust Architecture standard (SP 800-207, August 2020): the seven tenets, the policy engine/administrator/enforcement-point model, the four deployment approaches, and how CISA's maturity model builds on it.
4 min read Updated
NIST SP 800-207A: zero trust for cloud-native, multi-cloud applications
NIST's model for applying zero trust access control to cloud-native applications across multi-cloud and hybrid environments — identity-tier vs. network-tier policies, gateways, sidecar proxies, and SPIFFE.
3 min read Updated
NIST SP 800-216 (federal vulnerability disclosure guidelines), explained
NIST SP 800-216 (May 2023) — the Federal Coordination Body (FCB) and Vulnerability Disclosure Program Office (VDPO) framework that implements the IoT Cybersecurity Improvement Act's disclosure mandate, built on ISO/IEC 29147 and 30111.
4 min read Updated
NIST SP 800-218A (generative AI SSDF profile), explained
NIST SP 800-218A (July 2024): the EO 14110 mandate behind it, its three audiences, the new AI-specific PS.1.2/PS.1.3/PW.3 practices, its High/Medium/Low priority tags, and the EO 14110 definition of a dual-use foundation model.
6 min read Updated
NIST SP 800-232: the Ascon lightweight cryptography standard, explained
What NIST SP 800-232 (August 2025) actually specifies: the four Ascon algorithms for constrained IoT, embedded and medical-implant devices, why they exist alongside AES-GCM and SHA-3, their security strengths, and the key-handling rules (R1-R7) implementers must follow.
6 min read Updated
NIST SP 800-30: the Guide for Conducting Risk Assessments, explained
NIST SP 800-30 Rev. 1's risk assessment process — the prepare/conduct/communicate/maintain steps, the threat-vulnerability-likelihood-impact risk model, and how it feeds SP 800-39 and the SP 800-37 Risk Management Framework.
5 min read Updated
NIST SP 800-34: Contingency Planning Guide, explained
NIST's Contingency Planning Guide for Federal Information Systems — the seven-step planning process, business impact analysis, alternate-site strategies, and how it differs from incident response.
4 min read Updated
NIST SP 800-37: the Risk Management Framework (RMF), explained
NIST SP 800-37 Rev. 2's Risk Management Framework — the Prepare/Categorize/Select/Implement/Assess/Authorize/Monitor steps, what Revision 2 added in 2018, and how RMF relates to SP 800-53, SP 800-30 and SP 800-39.
4 min read Updated
NIST SP 800-39 (managing information security risk), explained
NIST SP 800-39's three-tier risk management hierarchy (Organization, Mission/Business Process, Information System) and four-component process (Frame, Assess, Respond, Monitor), and how it relates to SP 800-37 and SP 800-30.
4 min read Updated
NIST SP 800-40 Rev. 4: enterprise patch management planning, explained
NIST SP 800-40 Revision 4's enterprise patch management framework: the four risk responses, the patching life cycle, four risk-response scenarios, maintenance groups, and what changed from Rev. 3.
6 min read Updated
NIST SP 800-53: the 20 security and privacy control families, explained
NIST SP 800-53 Rev. 5's control catalogue: the 20 control families, how SP 800-53B's low/moderate/high baselines and tailoring work, and how it relates to FISMA, the RMF and NIST CSF.
5 min read Updated
NIST SP 800-53A Rev. 5 (assessing security and privacy controls), explained
NIST SP 800-53A Revision 5 (January 2022) — the examine/interview/test assessment methods, depth and coverage attributes, the four-step assessment process, and how it ties SP 800-53's controls into the RMF's Assess and Monitor steps.
5 min read Updated
NIST SP 800-57 Part 1 Rev. 5 (key management recommendation), explained
NIST SP 800-57 Part 1 Revision 5 (May 2020) — the 19 cryptographic key types, cryptoperiods, the six key states and four key-management phases, and the security-strength table that says which algorithm/key-size combinations are still adequate.
6 min read Updated
NIST SP 800-61 Rev. 3, explained
NIST SP 800-61 Rev. 3 explained: why the 2012 Computer Security Incident Handling Guide was withdrawn, how the new CSF 2.0 Community Profile reframes incident response, and what changed for incident handlers.
5 min read Updated
NIST SP 800-63-4: Digital Identity Guidelines, explained
NIST's Digital Identity Guidelines (SP 800-63-4, July 2025): the three-volume A/B/C structure, Identity/Authenticator/Federation Assurance Levels, and what changed from the withdrawn SP 800-63-3.
3 min read Updated
Questions about this page?