NIST Updates Privacy Framework, Tying It to Recent Cybersecurity Guidelines
Credit: N. Hanacek/NIST How can society benefit from the use of personal data while also protecting individual privacy? Five years after debuting guidelines that can help organizations balance these goals, the National Institute of Standards and Technology (NIST) has drafted a new version of the NIST Privacy Framework intended to address current privacy risk management needs, […]
defense-in-depth – Glossary | CSRC
Information security strategy integrating people, technology, and operations capabilities to establish variable barriers across multiple layers and missions of the organization.Sources: CNSSI 4009-2015 NIST SP 800-172 NIST SP 800-172A NIST SP 800-30 Rev. 1 under Defense-in-Depth from CNSSI 4009 NIST SP 800-39 under Defense-in-Depth from CNSSI 4009 An information security strategy that integrates people, technology, […]
computer network defense (CND) – Glossary
Actions taken within protected cyberspace to defeat specific threats that have breached or are threatening to breach cyberspace security measures and include actions to detect, characterize, counter, and mitigate threats, including malware or the unauthorized activities of users, and to restore the system to a secure configuration.Sources: CNSSI 4009-2015 under cyberspace defense from DoDI 8500.01 […]
State and Local Cybersecurity Grant Program Fact Sheet
In Fiscal Year (FY) 2024, through the Infrastructure Investment and Jobs Act, the Department of Homeland Security (DHS) is providing $279.9 million to address cybersecurity risks and threats to information systems owned or operated by, or on behalf of, state, local, and territorial governments. Overview The goal of the State and Local Cybersecurity Grant Program (SLCGP) […]
Known Exploited Vulnerabilities Catalog | CISA
CVE-2025-2783 Google Chromium Mojo Sandbox Escape Vulnerability: Google Chromium Mojo on Windows contains a sandbox escape vulnerability caused by a logic error, which results from an incorrect handle being provided in unspecified circumstances. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. Known […]
IR 8286B, Prioritizing Cybersecurity Risk for Enterprise Risk Management
Publications Documentation Topics Date Published: February 2025 Supersedes: IR 8286B (02/10/2022) Author(s) Stephen Quinn (NIST), Nahla Ivy (NIST), Matthew Barrett (CyberESI Consulting Group), Gregory Witte (Huntington Ingalls Industries), Robert Gardner (New World Technology Partners) This document is the second in a series that supplements NIST Interagency Report (IR) 8286, Integrating Cybersecurity and Enterprise […]
Healthcare and Public Health Cybersecurity
Introduction With its focus on caring for people, the Healthcare and Public Health (HPH) sector touches each of our lives in powerful ways. Today, much of the work the HPH sector carries out is based in the digital world, leveraging technology to store patient and medical information, carrying out medical procedures, communicating with patients, and […]
SP 1308, NIST Cybersecurity Framework 2.0: Cybersecurity, Enterprise Risk Management, and Workforce Management Quick Start Guide
Publications Documentation Topics Date Published: March 12, 2025Comments Due: Email Comments to: Author(s) National Institute of Standards and Technology Announcement This document shows how the Workforce Framework for Cybersecurity (NICE Framework) and the Cybersecurity Framework (CSF) 2.0 can be used together to address cybersecurity risk. It is the newest of the CSF 2.0 […]
#StopRansomware: Medusa Ransomware | CISA
Summary Note: This joint Cybersecurity Advisory is part of an ongoing #StopRansomware effort to publish advisories for network defenders detailing various ransomware variants and ransomware threat actors. These #StopRansomware advisories include recently and historically observed tactics, techniques, and procedures (TTPs) and indicators of compromise (IOCs) to help organizations protect against ransomware. Visit stopransomware.gov to see […]
IR 8286A Rev. 1, Identifying and Estimating Cybersecurity Risk for Enterprise Risk Management
Publications Documentation Topics Date Published: February 26, 2025Comments Due: Email Comments to: Author(s) Stephen Quinn (NIST), Nahla Ivy (NIST), Matthew Barrett (CyberESI Consulting Group), Larry Feldman (Huntington Ingalls Industries), Gregory Witte (Huntington Ingalls Industries), Robert Gardner (New World Technology Partners) Announcement The NIST Interagency Report (IR) 8286 series of publications helps practitioners better […]