NIST has released initial working drafts of proposed updates to the Personal Identity Verification (PIV) standards to support the use of post-quantum cryptography (PQC). The drafts identify the changes expected to be needed to use the ML-DSA digital signature algorithm and the ML-KEM key-encapsulation mechanism with PIV.
The current draft set comprises:
A supporting PQC Overview accompanies the drafts to present a working gap analysis of the specification changes needed across the PIV algorithm profile, command interface, and data model, and outline the general approach under consideration. This approach centers on a dual-stack model that preserves existing classical PIV keys and data objects; adds new key references, certificate containers, and data objects for PQC credentials; and supports backward compatibility and incremental deployment during the transition.
These are preliminary working materials, not formal public drafts. By collaborating with implementers and users to develop these guidelines and specifications, NIST hopes to accelerate the standardization and implementation of PQC in PIV credentials.
NIST welcomes feedback throughout the development process. Interested parties can follow the work and participate by:
NIST has released initial working drafts of proposed updates to the Personal Identity Verification (PIV) standards to support the use of post-quantum cryptography (PQC). The drafts identify the changes expected to be needed to use the ML-DSA digital signature algorithm and the ML-KEM key-encapsulation mechanism with PIV.
The current draft set comprises:
A supporting PQC Overview accompanies the drafts to present a working gap analysis of the specification changes needed across the PIV algorithm profile, command interface, and data model, and outline the general approach under consideration. This approach centers on a dual-stack model that preserves existing classical PIV keys and data objects; adds new key references, certificate containers, and data objects for PQC credentials; and supports backward compatibility and incremental deployment during the transition.
These are preliminary working materials, not formal public drafts. By collaborating with implementers and users to develop these guidelines and specifications, NIST hopes to accelerate the standardization and implementation of PQC in PIV credentials.
NIST welcomes feedback throughout the development process. Interested parties can follow the work and participate by:
NIST has released initial working drafts of proposed updates to the Personal Identity Verification (PIV) standards to support the use of post-quantum cryptography (PQC). The drafts identify the changes expected to be needed to use the ML-DSA digital signature algorithm and the ML-KEM key-encapsulation mechanism with PIV.
The current draft set comprises:
A supporting PQC Overview accompanies the drafts to present a working gap analysis of the specification changes needed across the PIV algorithm profile, command interface, and data model, and outline the general approach under consideration. This approach centers on a dual-stack model that preserves existing classical PIV keys and data objects; adds new key references, certificate containers, and data objects for PQC credentials; and supports backward compatibility and incremental deployment during the transition.
These are preliminary working materials, not formal public drafts. By collaborating with implementers and users to develop these guidelines and specifications, NIST hopes to accelerate the standardization and implementation of PQC in PIV credentials.
NIST welcomes feedback throughout the development process. Interested parties can follow the work and participate by:
\n\nPer the Sept. 29, 2026, Executive Order on Inaugurating the Era of Super Intelligence, NIST is working to update its communications to incorporate the term “super intelligence” as directed.
\n
This new quick-start guide illustrates practical and actionable ways AI could be used for analyzing, planning, implementing, and monitoring an organization’s progress toward achieving CSF 2.0 outcomes.
The document’s purpose is to:
While the focus was not to write about AI best practices or to provide cybersecurity guidelines thereof, there are places where specific precautions are denoted with the /!\\ notation.
This guide includes three notional use cases, examples of prompts for structuring natural language inputs to produce specified CSF 2.0 outputs from a generative AI model, simulated organizational files for a fictitious company, tips for getting started, and more.
Use case examples illustrate a possible approach and are not prescriptive assessment or assurance methodologies.
\nSubmit Your Comments:
The comment period is open through October 15, 2026, at 11:59 PM. Email comments to: csf@nist.gov.
Note: NIST is only seeking comments on the quick-start guide and supplied AI prompts. NIST is not seeking comment on the fictional organizational documents. Those are for illustrative purposes only.
This publication is the most recent within a portfolio of CSF 2.0 quick-start guides released by the CSF 2.0 project team since February 26, 2024. These resources offer tailored pathways for different audiences to engage with the CSF 2.0, making the Framework easier to implement. View all CSF 2.0 quick-start guides.
\nFollowing the publication of draft revision IoT Product Cybersecurity Guidelines for the Federal Government: Establishing IoT Product Cybersecurity Requirements, NIST SP 800-213 Rev. 1, NIST has initiated the process of revising the companion document IoT Device Cybersecurity Guidance for the Federal Government: IoT Device Cybersecurity Requirement Catalog, NIST SP 800-213A, to incorporate lessons learned, align with relevant NIST guidance (e.g., Cybersecurity Framework (CSF) 2.0, NIST SP 800-53 Rev. 5.2.0)—as well as IoT cybersecurity standards and practices, and address changes in the IoT threat landscape.
We welcome any valuable perspectives on potential revisions to the current SP 800-213A to maximize the document’s effectiveness, relevance, and usability in helping the community understand and manage cybersecurity risk. To help guide this input, NIST has included specific questions below, though reviewers are encouraged to address any, all, or additional topics in their comments.
\nThe public comment period is open through October 15, 2026. Submit comments via email to iotsecurity@nist.gov with the subject line “Comments on SP 800-213A.”
Specifically, NIST asks for input on the following questions to help us plan and produce an initial revision of NIST SP 800-213A:
Submitted comments, including attachments and other supporting materials, will become part of the public record and are subject to public disclosure. Personally identifiable information and confidential business information should not be included (e.g., account numbers, Social Security numbers, names of other individuals). Comments that contain profanity, vulgarity, threats, or other inappropriate language will not be posted or considered.
\n\n", "published": "2026-08-31T00:00:00", "updated": "2026-08-31T00:00:00", "link": "https://csrc.nist.gov/pubs/sp/800/213/a/r1/iprd", "content": "Comments Due 10/15/2026" }, { "id": "https://csrc.nist.gov/pubs/sp/800/38/e/r1/ipd", "title": "SP 800-38E Rev. 1, Recommendation for Block Cipher Modes of Operation: XTS-AES Mode for Confidentiality on Storage DevicesInitial Public Draft", "summary": "Revision 1 updates the referenced specification to IEEE Std. 1619-2025 and clarifies NIST’s requirements for the approved use of XTS-AES, including its scope of use, data-unit and key-scope limits, key requirements, and the ordering convention for ciphertext stealing.
Rather than reproducing the XTS-AES specification, this recommendation incorporates IEEE Std. 1619-2025 by reference. To facilitate review of the draft SP, IEEE Std. 1619-2025 is publicly available during the public comment period.
The public comment period is open through October 16, 2026.
NOTE: A call for patent claims is included in this draft. For additional information, see the Information Technology Laboratory (ITL) Patent Policy – Inclusion of Patents in ITL Publications.
\n", "published": "2026-09-03T00:00:00", "updated": "2026-09-03T00:00:00", "link": "https://csrc.nist.gov/pubs/sp/800/38/e/r1/ipd", "content": "Comments Due 10/16/2026" }, { "id": "https://csrc.nist.gov/pubs/cswp/36/g/false-base-station-applying-5g-cybersecurity-and-p/ipd", "title": "CSWP 36G, False Base Station: Applying 5G Cybersecurity and Privacy CapabilitiesInitial Public Draft", "summary": "This initial public draft details how the availability of inexpensive, off-the-shelf hardware and software tools allows attackers to mimic legitimate carrier equipment to intercept and disrupt cellular communications. The paper evaluates how 5G devices respond to six simulated false base station scenarios and examines protections available to mitigate risks.
This white paper is part of the NCCoE’s work to accelerate the adoption of 5G security features by demonstrating their implementation on NCCoE’s operational 5G security testbed and providing actionable implementation guidelines to help network operators and other stakeholders enhance the cybersecurity and privacy of 5G systems and supporting infrastructures.
A false (aka Rogue or Fake) Base Station (FBS) impersonates a real carrier radio access network. It transmits and receives radio signals that mimic a legitimate 5G cell and tricks unsuspecting User Equipment (UE) to connect to it. This can result in cybersecurity risks, including service degradation, privacy breaches, and location tracking for the user. Although 5G standards include greater security features than previous generations to protect subscribers, they are still susceptible to Denial-of-Service (DoS) attacks.
This white paper evaluates six FBS scenarios (simulated in the NCCoE’s 5G Security lab) to assess how the tested 5G devices respond to FBS attacks and identify areas for improvement in standards and available device-configurable protections.
By demonstrating security features on our operational 5G Testbed, we aim to deliver real-world implementation insights to advance 5G security and inform the next generation of wireless security technologies and standards.
NIST is particularly interested in your feedback on the following questions:
This white paper is available for public comment through October 30, 2026. Visit the NCCoE project page to learn more and download the white paper today!
Federal agencies that deploy an Open Radio Access Network (O-RAN) as part of their infrastructure must include that deployment in their risk management programs. This draft Cybersecurity Framework (CSF) 2.0 profile describes how components that conform to the security specifications produced by the O-RAN ALLIANCE support various CSF 2.0 outcomes. It also includes references to O-RAN ALLIANCE-produced documents and other relevant guidelines that may help federal agency cybersecurity managers.
This report provides guidelines for improving the security of Operational Technology (OT) systems while addressing their unique performance, reliability, and safety requirements.
OT encompasses a broad range of programmable systems or devices that interact with the physical environment (or manage devices that interact with the physical environment). These systems/devices detect or cause a direct change through the monitoring and/or control of devices, processes, and events. Examples include industrial control systems (ICS), building automation systems, transportation systems, physical access control systems, physical environment monitoring systems, and physical environment measurement systems.
This fourth revision of SP 800-82 provides an overview of OT and typical system topologies, identifies common threats to organizational mission and business functions supported by OT, describes typical vulnerabilities in OT, and provides recommended security safeguards and countermeasures to manage the associated risks.
Updates in this revision include:
The comment period on this initial public draft is open through November 30, 2026. We encourage you to use this comment template when preparing your comments.
NOTE: A call for patent claims is included in this draft. For additional information, see the Information Technology Laboratory (ITL) Patent Policy – Inclusion of Patents in ITL Publications.
Revision 1 introduces streaming interfaces for extendable-output function (XOF) computations, which allow applications to process input and request output incrementally without knowing the total input or output length in advance.
From the Note to Reviewers (p. v):
\nThe public comment period is open through December 7, 2026.
\nNOTE: A call for patent claims is included in this draft. For additional information, see the Information Technology Laboratory (ITL) Patent Policy – Inclusion of Patents in ITL Publications.
", "published": "2026-10-08T00:00:00", "updated": "2026-10-08T00:00:00", "link": "https://csrc.nist.gov/pubs/sp/800/185/r1/ipd", "content": "Comments Due 12/07/2026" } ] }