Regulatory watch

Submit Your Feedback The public comment period is open through December 7, 2026, at 11:59 PM EST. We encourage you to use this comment template when preparing and submitting your response. About the Publication Enterprise information and communications technology risk management (ICTRM) spans and integrates a broad set of disciplines including cybersecurity, privacy, supply chain, operational technology, Internet of Things, and super intelligence. This publication promotes an integrated approach to ICT risk-aggregating and normalizing risk information across domains. Doing so allows organizations to identify, quantify, and communicate risk scenarios in financial, mission, and reputational terms comparable to non-technical enterprise risks, enabling executives to prudently allocate resources across competing risk types. Improving ICTRM in Alignment with NIST Cybersecurity Framework (CSF) 2.0 NIST SP 800-221r1 ipd helps organizations improve their ICTRM in alignment with established frameworks, including the CSF 2.0. Consistent with the CSF 2.0 Govern function, this publication emphasizes that cybersecurity governance should be central to all risk management activities, ensuring tha…

The initial public draft (ipd) of NIST Special Publication (SP) 800-100r1 (Revision 1), Information Security Handbook: A Guide for Executive Leadership, is now available for comment. Since the original version of SP 800-100 was released in 2006, the cybersecurity landscape, regulatory environment, and NIST's body of guidelines have changed substantially. This revision restructures the handbook to align with the general organization of the NIST Cybersecurity Framework (CSF) 2.0 and provides high-level summaries of key cybersecurity topics, including governance, risk management, information exchange, security awareness and training, contingency planning, configuration management, and incident response. It also discusses the relationships between these core concepts for executive leadership in both public- and private-sector organizations. The document points to other NIST publications throughout for more detailed technical implementation guidelines. The draft covers: An overview of key NIST frameworks and how they relate to one another Governance, including risk management fundamentals and enterprise risk management Topics organized under the CSF's Identify, Protect, and Detect/Resp…

Revision 1 introduces streaming interfaces for extendable-output function (XOF) computations, which allow applications to process input and request output incrementally without knowing the total input or output length in advance. From the Note to Reviewers (p. v): The Keccak-derived functions in this recommendation have been updated to describe a streaming mode of access that provides full XOF functionality. This involves calls to three functions: INIT, ABSORB, and SQUEEZE. Illustrative pseudocode is provided for the streaming interface, but the correct behavior of all streaming modes is defined in terms of the corresponding single-call interface to the functions. The single-call interfaces for these functions are equivalent to the functions defined in the previous version of this document. cSHAKE, KMAC, and ParallelHash use the ABSORB function to incrementally input data into the function so that ABSORB(𝑋1) followed by ABSORB(𝑋2) has the same effect as ABSORB(𝑋1 ∥ 𝑋2). TupleHash uses the absorb function somewhat differently in that each ABSORB call processes one complete tuple element. NIST invites comment on whether this different use of ABSORB might be confusing. The public…

This initial public draft details how the availability of inexpensive, off-the-shelf hardware and software tools allows attackers to mimic legitimate carrier equipment to intercept and disrupt cellular communications. The paper evaluates how 5G devices respond to six simulated false base station scenarios and examines protections available to mitigate risks. Background This white paper is part of the NCCoE's work to accelerate the adoption of 5G security features by demonstrating their implementation on NCCoE's operational 5G security testbed and providing actionable implementation guidelines to help network operators and other stakeholders enhance the cybersecurity and privacy of 5G systems and supporting infrastructures. A false (aka Rogue or Fake) Base Station (FBS) impersonates a real carrier radio access network. It transmits and receives radio signals that mimic a legitimate 5G cell and tricks unsuspecting User Equipment (UE) to connect to it. This can result in cybersecurity risks, including service degradation, privacy breaches, and location tracking for the user. Although 5G standards include greater security features than previous generations to protect subscribers, they…

This document corrects technical and typographical errors in the final rule that appeared in the Federal Register on August 4, 2026 titled "Medicare Program; Hospital Inpatient Prospective Payment Systems for Acute Care Hospitals (IPPS) and the Long-Term Care Hospital Prospective Payment System and Policy Changes and Fiscal Year (FY) 2027 Rates; Requirements for Quality Programs; Other Policy Changes; and Adoption of Updated Versions of Certain Health Information Technology Standards."

This report provides guidelines for improving the security of Operational Technology (OT) systems while addressing their unique performance, reliability, and safety requirements. OT encompasses a broad range of programmable systems or devices that interact with the physical environment (or manage devices that interact with the physical environment). These systems/devices detect or cause a direct change through the monitoring and/or control of devices, processes, and events. Examples include industrial control systems (ICS), building automation systems, transportation systems, physical access control systems, physical environment monitoring systems, and physical environment measurement systems. This fourth revision of SP 800-82 provides an overview of OT and typical system topologies, identifies common threats to organizational mission and business functions supported by OT, describes typical vulnerabilities in OT, and provides recommended security safeguards and countermeasures to manage the associated risks. Updates in this revision include: Expanded introduction to operational technology (OT) sectors to include Building Automation and Control Systems (BACS), Water and Wastewater…

Federal agencies that deploy an Open Radio Access Network (O-RAN) as part of their infrastructure must include that deployment in their risk management programs. This draft Cybersecurity Framework (CSF) 2.0 profile describes how components that conform to the security specifications produced by the O-RAN ALLIANCE support various CSF 2.0 outcomes. It also includes references to O-RAN ALLIANCE-produced documents and other relevant guidelines that may help federal agency cybersecurity managers.

Revision 1 updates the referenced specification to IEEE Std. 1619-2025 and clarifies NIST's requirements for the approved use of XTS-AES, including its scope of use, data-unit and key-scope limits, key requirements, and the ordering convention for ciphertext stealing. Rather than reproducing the XTS-AES specification, this recommendation incorporates IEEE Std. 1619-2025 by reference. To facilitate review of the draft SP, IEEE Std. 1619-2025 is publicly available during the public comment period. The public comment period is open through October 16, 2026. NOTE: A call for patent claims is included in this draft. For additional information, see the Information Technology Laboratory (ITL) Patent Policy - Inclusion of Patents in ITL Publications.

Following the publication of draft revision IoT Product Cybersecurity Guidelines for the Federal Government: Establishing IoT Product Cybersecurity Requirements, NIST SP 800-213 Rev. 1, NIST has initiated the process of revising the companion document IoT Device Cybersecurity Guidance for the Federal Government: IoT Device Cybersecurity Requirement Catalog, NIST SP 800-213A, to incorporate lessons learned, align with relevant NIST guidance (e.g., Cybersecurity Framework (CSF) 2.0, NIST SP 800-53 Rev. 5.2.0)-as well as IoT cybersecurity standards and practices, and address changes in the IoT threat landscape. We welcome any valuable perspectives on potential revisions to the current SP 800-213A to maximize the document's effectiveness, relevance, and usability in helping the community understand and manage cybersecurity risk. To help guide this input, NIST has included specific questions below, though reviewers are encouraged to address any, all, or additional topics in their comments. The public comment period is open through October 15, 2026. Submit comments via email to iotsecurity@nist.gov with the subject line “Comments on SP 800-213A.” Specifically, NIST asks for…

NIST Internal Report (IR) 8613 ipd (initial public draft), Multi-Cloud Architecture Challenges, identifies, categorizes, and analyzes the security and compliance challenges that are unique to or significantly amplified by multi-cloud architectures. This analysis by the NIST Multi-Cloud Security Public Working Group (MCSPWG) addresses security and Authorization to Operate (ATO) challenges and highlights areas where additional community research could meaningfully reduce risk. The MCSPWG identified 23 consolidated challenge areas that represent novel friction points and architectural misalignments that emerge when orchestrating control across autonomous cloud silos. The most significant structural challenge areas are: Security-significant differences in cloud-native services across providers Organizational logistics and staffing complexity across heterogeneous environments Difficulty in implementing centralized security capabilities across provider boundaries These structural gaps are most acute in five areas: (1) identity and access management, (2) telemetry and logging, (3) configuration and change management, (4) data protection, and (5) compliance and authorization. Submit Your…