Topic · nist

NIST (general)

General NIST publications and NCCoE practice guides — SP 1800-series, framework updates, AI/blockchain/post-quantum drafts that don't fit a specific SP 800-* number.

RSS feed ↗

trade-press
NIST admits crypto agility answers aren't clear yet
The post-quantum transition has an executive order deadline and boardroom urgency, but the guidance framework mapping agility to procurement, hardware, and embedded systems doesn't exist yet.
NIST official Bill Newhouse acknowledged the agency hasn't yet mapped cryptographic agility questions to the specific procurement language, hardware constraints, and architecture standards agencies and contractors need for the post-quantum cryptography transition. NIST finalized its crypto agility white paper (CSWP 39) in late 2025, but the implementation answers that would let acquisition officers and engineers actually act on it remain unresolved. The admission comes months after EO 14412 accelerated the PQC migration timeline and the NCCoE continues working with over 40 organizations to build the missing mapping.
YESTERDAY
trade-press
NIST Builds SBOM Use Cases for DevSecOps Pipelines
The NCCoE's example builds move beyond generating an SBOM to integrating cryptographic signing at each build stage and operationalizing vulnerability detection, bridging the June cyber EO's SSDF tasking to actual infrastructure.
NIST's National Cybersecurity Center of Excellence is publishing example builds that show how to use SBOMs for active supply-chain scanning and vulnerability management, rather than simply generating and storing them. The builds integrate cryptographic hashing and signing at each stage of the DevSecOps pipeline. The work responds to the Trump administration's June 6 cyber executive order directing NCCoE to demonstrate SSDF implementation practices. Michael Ogata, NCCoE computer scientist, described the efforts at the Billington Cybersecurity Summit, noting that two example builds have been published so far under the DevSecOps project, with more planned for vulnerability management workflows.
YESTERDAY
trade-press
G7 warns PQC migration lag puts encryption at risk
The working group's call to action lands alongside a Trump executive order that moved the federal migration deadline from 2035 to 2030, but most private-sector sectors outside finance and tech haven't started.
The G7 Cyber Security Working Group released a report urging governments and organizations to accelerate migration to post-quantum cryptography, warning that the quantum threat "remains off the radar for many organizations." The report, signed by CISA and its G7 counterparts, outlines five priorities: awareness, national strategies, R&D, public-private partnerships, and integrating PQC into procurement requirements. The Trump administration separately moved the federal civilian-network migration deadline from 2035 to 2030 via executive order. The gap between the accelerating federal timeline and lagging private-sector adoption outside finance and tech is widening, creating a two-speed migration that leaves supply chains exposed.
THU
regulator
CISA and G7 Issue Joint Call for PQC Transition
The quantum threat graduates from a NIST research track to a synchronized international priority, and the framework's procurement language gives agencies cover to write PQC into RFPs before formal rulemaking.
CISA and the G7 Cyber Security Working Group jointly released a post-quantum cryptography transition framework urging organizations and governments to begin migrating cryptographic systems now. The call to action sets out five priorities: awareness, national strategies, R&D, public-private partnerships, and integrating PQC into procurement requirements. It's the first time the quantum threat has been framed as a coordinated international demand rather than a single-nation research program. The framework doesn't impose mandates, but its procurement language arrives alongside CISA's January 2026 product-category list, which says agencies should acquire only PQC-capable products in categories where they're widely available.
THU
trade-press
DoD solicits software encryption for weapons systems
The software-only requirement sidesteps hardware swaps on platforms that can't be retrofitted, but it also means DoD is accepting the gap between what's deployable now and what post-quantum readiness actually requires.
The Defense Department issued an Aug. 27 RFI for data packet-protection software that works without replacing, modifying, or augmenting existing hardware, chips, radios, the works. It's an interim layer on the way to post-quantum cryptography, with responses due Sept. 27. The solicitation requires DoD-approved multifactor authentication, exclusion of unauthorized parties, and full government control of decryption keys. The department's June 2026 PQC strategy told the military to stop using legacy platforms that can't support advanced encryption, but this software bridge suggests the sunset won't be clean.
SEP 2
trade-press
The quantum attack surface is bigger than it seems
EO 14412 and M-26-15 prioritize high-value system migration, but the trust infrastructure that keeps federal networks authenticating, routing, and verifying software updates sits outside the mandate, and adversaries won't wait for separate guidance.
The White House and OMB have set hard deadlines for migrating high-value and high-impact federal systems to post-quantum cryptography, key establishment by 2030, digital signatures by 2031. But the mandates are silent on the broader trust infrastructure those systems depend on: PKI, device identity, code-signing, network routing, and forensic logs. A cryptographically relevant quantum computer wouldn't need to crack the prioritized systems directly. It could forge certificates, redirect traffic, or push malware through trusted update channels, and the agencies that followed the mandate to the letter would still be exposed. With Google, Microsoft, and Cloudflare targeting 2029 for their own PQC migrations, the gap between what's mandated and what's actually protected is a vulnerability window measured in years.
SEP 1
trade-press
NIST opens SP 800-213A comment as scope question surfaces
Third IoT guidance revision in two years, and NIST still hasn't settled whether the catalog controls devices or products.
NIST opened a pre-draft comment period on SP 800-213A, the federal IoT device cybersecurity requirement catalog, with comments due October 15. The agency's explicitly asking whether the revised catalog should expand its scope from IoT devices to IoT products, bringing it in line with SP 800-213 Rev. 1, which made the same shift in June. For contractors and integrators supplying IoT products to federal agencies, this is the window to shape how the catalog defines compliance requirements. The alternative's inheriting definitions written without them.
SEP 1
trade-press
OMB Memo Mandates Login.gov as Universal Federal Sign-On
The binding memo closes the enforcement gap that let agencies maintain custom authentication stacks for decades, setting hard deadlines through 2027.
OMB Director Russell Vought issued a binding memo Monday making Login.gov the mandatory sign-on for federal public-facing websites that require authentication. Agencies have 60 days to inventory those sites, one year to adopt GSA's Login best practices, and two years to complete migration. The memo does not bar agencies from using other identity verification services alongside Login where Login can't meet specific needs, but the voluntary-adoption era is over. GSA must convene agency customers quarterly, publish implementation guidance within 180 days, and host an industry day for commercial identity providers. NIST gets 120 days to deliver a Digital Identity Risk Management resource.
AUG 31
trade-press
ONCD, CISA push agencies on post-quantum cryptography deadlines
The "trust now, forge later" threat makes PQC migration a present-day problem, not a future one, and CISA's quantum lead says if you haven't costed it yet, you're behind.
ONCD and CISA officials urged federal agencies to treat post-quantum cryptography migration as an immediate priority, not a long-range planning exercise. Trump's June 2025 executive order sets hard deadlines, PQC key establishment for high-value assets and high-impact systems by December 31, 2030, and digital signatures by December 31, 2031. CISA quantum security lead Patrick Manley told agencies that the "trust now, forge later" threat makes PQC readiness real today, and warned that organizations without a cost estimate for their most critical systems are already behind.
AUG 31
trade-press
Trump EO orders PQC migration for high-value assets by 2030, 31
Agencies face an Oct. 22 deadline for migration plans, and CISA is signaling that procurement language and cryptography bills-of-materials will become the enforcement mechanism for vendor compliance.
President Trump signed an executive order directing federal agencies to transition high-value assets and high-impact systems to post-quantum cryptographic key establishment by Dec. 31, 2030, and PQC digital signatures by Dec. 31, 2031. OMB followed with guidance requiring agencies to submit PQC migration plans by Oct. 22. The order builds on NIST's 2024 PQC standards and comes as CISA pushes agencies to write PQC requirements into acquisition documentation, a procurement lever that the prior administration's framework left largely untapped.
AUG 28
trade-press
NIST flags credential-sharing, HITL gaps in agentic AI push
Early agentic AI deployments are repeating the security-by-omission pattern of early cloud adoption, and NIST's NCCoE is surfacing the identity-and-authorization blind spots before the market locks in.
NIST's NCCoE is launching a project on identity and authorization controls for agentic AI, drawing on public comments and stakeholder engagement that surfaced three recurring problems: users sharing personal and enterprise credentials with AI agents, agents running under local user accounts with broadly scoped access, and reliance on human-in-the-loop controls that current deployments can saturate. The project aims to produce reference designs and an online resource hub showing how existing identity standards and best practices can reduce risk. No timeline or specific control recommendations have been released, and it's unclear whether eventual guidance will be advisory or mandatory for federal contractors and critical infrastructure operators.
AUG 28
trade-press
DoD RFI seeks software-only quantum-safe encryption
The Pentagon wants PQC migration without touching hardware, compressing the timeline for primes whose legacy systems weren't built for cryptographic agility.
The Defense Department released a request for information Thursday seeking software-only post-quantum cryptography solutions that require zero hardware changes. Vendors must describe products aligned with a PQC migration strategy scheduled on or before Dec. 31, 2029, with the broader DoD mandate that every system employ PQC by Dec. 31, 2031 unless excepted. The RFI is one of the first concrete procurement signals following the June PQC strategy and the White House quantum executive orders, it asks industry to show what's possible before the department locks in acquisition paths.
AUG 28
trade-press
DOD to shift CMMC to NIST 800-171 Rev. 3 with expanded assessment scope
The control count drops from 110 to 97, but assessment objectives jump past 420 and new supply-chain risk management requirements push compliance beyond IT's walls.
DOD is planning an interim final rule to transition CMMC Level 2 compliance from NIST SP 800-171 Revision 2 to Revision 3, reducing controls from 110 to 97 while expanding assessment objectives from 320 to roughly 420 and adding supply-chain risk management requirements. Presenters at an Aug. 25 NDIA webinar warned that supply-chain risk management isn't an IT function and that contractors treating 800-171 compliance as a security-team problem will find Rev. 3 especially punishing. No effective date has been set; the CMMC Reform Task Force delivers recommendations in mid-September, and DOD must still issue guidance on organization-defined parameters before contractors can fully align.
AUG 27
trade-press
NIST IR 8613 maps multi-cloud security seams
The draft catalogues exactly where single-provider ATO frameworks break when agencies run workloads across AWS, Azure, and GCP, and the comment period signals this isn't staying theoretical.
NIST published draft IR 8613 on August 21, cataloguing security and authorization-to-operate challenges unique to multi-cloud environments. The report, produced by NIST's Multi-Cloud Security Public Working Group, identifies five structural gaps where alignment is most urgent: identity and access management, telemetry and logging, configuration and change management, data protection, and compliance and authorization. Comments close October 5. The publication validates what practitioners have long known (that ATO processes built for a single provider don't survive contact with a second one) and tees up potential guidance or standards work to follow.
AUG 25
trade-press
GSA, Treasury begin quantum-safe migration as OMB deadline nears
GSA's PACS lab expansion will shape what vendors can sell to the government; Treasury's new task force is still convening.
The General Services Administration and Treasury Department launched separate post-quantum cryptography initiatives Tuesday, both flowing from President Trump's June 22 executive order on quantum cybersecurity. GSA is updating the Federal Identity, Credential and Access Management (FICAM) architecture and expanding its PACS lab to test quantum-resistant physical access control products, work that feeds directly into GSA's approved products list. Treasury stood up a Quantum-Readiness Task Force with workstreams spanning sector alignment and vendor readiness alongside digital asset risks. Agencies have about 30 days left to submit PQC Migration Plans to OMB and ONCD.
AUG 25
trade-press
GSA updates FICAM, PACS for post-quantum migration
The framework and lab updates are planning-stage moves; fielded quantum-resistant systems are still years away.
GSA announced Monday it will update the Federal Identity, Credential and Access Management framework to incorporate quantum-resilient algorithms and expand its FIPS 201 Physical Access Control System lab to test quantum-resistant solutions for federal building access. The moves follow a June executive order mandating post-quantum cryptography migration. Both announcements concern planning and testing infrastructure, not fielded systems. Agencies and contractors won't see operational changes until standards and procurement vehicles catch up.
AUG 25
trade-press
NIST drafts AI guide for monitoring CSF 2.0 progress
The draft guide marks NIST's first formal treatment of AI as a compliance tool rather than a compliance target, providing CO-STAR prompt templates for three self-assessment use cases.
NIST released a draft quick-start guide on using AI to monitor progress toward CSF 2.0 outcomes, with comments due October 15. The guide walks through three use cases (policy and governance review, current-state profiling, and target-state profiling) using the CO-STAR prompt engineering framework to show how organizations can prompt AI systems for each task. Supplemental prompt materials accompany each use case in the release package.
AUG 25
trade-press
After eight years, White House revamps cyber supply chain risk data calls
The metrics agencies use to report supply chain risk haven't been updated since the SECURE Technology Act passed in 2018, leaving shared adversary threats invisible to systematic detection across government.
The White House Office of the Federal Chief Information Officer is reviewing all practices tied to NIST's cyber supply chain risk management guidelines, with a revamped data-collection process expected "in the near term." Senior advisor Cheri Benedict, speaking at an INSA webinar Tuesday, said the review will emphasize shared risk and adversarial threats, aiming for a "left of boom" posture that flags risky vendors before they're embedded in agency systems. The existing framework hasn't been updated since the SECURE Technology Act of 2018; the FASC created by that law took nearly seven years to issue its first exclusion order.
AUG 25
trade-press
NIST flags human blind spot in its own cyber frameworks
The concept paper concedes existing frameworks treat humans as vulnerabilities, not partners, and asks how to fix that.
NIST published a concept paper seeking stakeholder feedback through September 30 on human-centered cybersecurity guidance. The paper, part of a program launched in 2024, acknowledges that existing frameworks "tend to focus on technical controls and seldom explicitly call out HCC practices," leaving organizations unsure how to take a human-centered approach. NIST asks for input organized under three buckets: scope, ensuring the guidance is actionable, and what evidence should underpin it.
AUG 25
trade-press
Treasury Launches Financial Sector's Quantum-Readiness Task Force
The first government task force to treat harvest-now-decrypt-later as present-day risk control: financial-sector technology vendors now face near-term cryptographic inventory demands from every downstream customer.
The Treasury Department established a Quantum-Readiness Task Force to coordinate the financial sector's migration to post-quantum cryptography, operationalizing President Trump's June executive order and the G7 Cyber Expert Group's January roadmap. The group will assess technology vendor readiness and identify critical dependencies across three work streams: sector-wide PQC coordination, third-party assessment, and digital-asset risk. For primes, subcontractors, and managed service providers in the financial supply chain, cryptographic inventory and migration planning are now near-term expectations: the task force treats harvest-now-decrypt-later as present-day risk control, not a 2035 planning exercise.
AUG 24
trade-press
CISA ships K-12 cyber resource package aligned to NIST framework
The getting-started guide is for administrators who don't know what MFA is; the 57-page implementation guide is for the practitioner who has to build the program. That split is the quiet concession that most districts still lack dedicated cybersecurity staff.
CISA released a K-12 Cybersecurity Foundations Resource Package on Aug. 12, bundling a getting-started guide for non-technical school administrators, a 57-page implementation guide for practitioners, and companion videos. The package maps its eight cybersecurity objectives to CISA's cross-sector Cybersecurity Performance Goals and the NIST cybersecurity framework, and advances Executive Order 14239 on state and local preparedness. It builds on the agency's 2023 K-12 report and toolkit, which were developed under the 2021 K-12 Cybersecurity Act, a statutory lineage that acknowledges what CISA has been saying since 2023: K-12 is target-rich and cyber-poor.
AUG 13
trade-press
Aspen Digital launches quantum-readiness project under Trump EO
The eight-month effort signals that NIST algorithm publication was the starting gun, not the finish line, and that contractors have a logistics problem they're not yet equipped to solve.
Aspen Digital launched an eight-month, Hewlett Foundation-funded project to map post-quantum cryptography risks and migration strategies across sectors, responding to the Trump administration's June 22 executive order accelerating federal PQC timelines. The project will produce consolidated migration guidance for public and private sector stakeholders and a "break glass" emergency playbook for scenarios where a cryptographically relevant quantum computer arrives sooner than expected. The effort's explicit focus on hidden sector dependencies and emergency planning signals that even the project's architects see NIST's algorithm publication as only the first step in a transition most organizations are not structured to execute.
AUG 12
trade-press
EO 14409 forces agencies to harden systems before AI scales
The coordinated policy push (EO 14409, GSA's AI ToS, and NIST's Cyber AI Profile) signals agencies must prove DevSecOps maturity before scaling AI, or watch audit liability compound at the speed unvalidated code ships.
Executive Order 14409, GSA's proposed AI Terms of Service, and NIST's new Cyber AI Profile have established the first coordinated federal policy framework treating AI as a security risk multiplier. The framework requires agencies to harden systems against AI-enabled threats while adopting AI tools safely, a two-track demand that exposes gaps in DevSecOps maturity and policy-as-code automation, along with undefined AI governance ownership at most civilian agencies. For CISOs, state IT leaders, and C3PAOs, the question is whether AI-generated code can be validated before reaching production and whether agentic AI access stays within a single classification boundary.
AUG 11
regulator
CISA Releases Zero Trust Maturity Model Version 2
Agencies with existing v1 roadmaps now face the question of what, if anything, needs revisiting, the update adds an "Initial" maturity stage and aligns with OMB M-22-09.
CISA published Zero Trust Maturity Model version 2 on April 11, 2023, replacing the September 2021 original. The update incorporates public comment feedback, adds a new "Initial" maturity stage below the existing "Traditional" baseline, and aligns the model with OMB M-22-09. The five-pillar structure (Identity, Devices, Networks, Applications and Workloads, Data) remains intact. Federal agencies are the primary audience, but CISA recommends the guidance for state, local, and private-sector adoption as well. Contractors supporting federal zero-trust migrations should treat v2 as the reference architecture going forward.
AUG 11
trade-press
NIST seeks NVD overhaul as AI outpaces vulnerability management
The RFI marks the first federal admission that periodic scanning and manual triage can't keep up with AI-driven threat discovery, and the first structural push to replace them.
NIST published an RFI seeking input on restructuring the National Vulnerability Database to handle AI-accelerated vulnerability discovery and near-real-time threat enrichment. The RFI directly states that "traditional vulnerability management approaches, which center on periodic scanning, static prioritization, and manual remediation, are increasingly inadequate." Organizations relying on NVD for prioritization and remediation would face a fundamentally altered information flow under continuous, automated enrichment. It's the first federal admission that the old model is structurally obsolete.
AUG 11
trade-press
NIST issues remote-access guide for water system OT
The guidance is the first federal document to treat water utilities' operational realities (unmanned sites, vendor remote support, 15-to-20-year equipment lifecycles) as the design constraint, not an afterthought.
NIST published a guide laying out three reference architectures for securing remote access to operational technology at water and wastewater systems. The publication addresses unauthorized access to unmanned control sites (the threat vector NIST engineer CheeYee Tang identified as the water sector's top survey-ranked concern) and aims to serve smaller utilities that lack in-house cybersecurity expertise. One architecture uses a cloud-based model to lower the cost and skill barrier for budget-constrained operators. NIST says the approaches apply to other critical-infrastructure OT environments facing the same vendor-support and equipment-longevity constraints.
AUG 7
trade-press
NIST finalizes transit CSF 2.0 profile with OT guidance
The first CSF 2.0 sector profile to explicitly fold operational technology alongside IT reflects broadening regulatory attention to converged infrastructure risks in critical infrastructure.
NIST published the final Transit Cybersecurity Framework Community Profile (IR 8576) on August 5, expanding CSF 2.0 guidance to cover operational technology systems (not just IT) that transit agencies own and operate. The voluntary profile targets public transit owners and operators plus the federal, state, and municipal entities that oversee or fund them. It's the first CSF 2.0 sector profile to explicitly center OT/IT convergence, arriving as digitized and networked operations widen transit agencies' attack surfaces. NIST hosts a September 1 webinar to walk through the final version.
AUG 6
vendor
AWS Load Balancers Add RFC 9151 CNSA Policies
Defense contractors can now enforce NSA-grade TLS at the load-balancer layer, no custom termination required.
AWS Application Load Balancer and Network Load Balancer now support TLS security policies compliant with RFC 9151, the CNSA 1.0 cryptographic requirements defined by the NSA. Available in GovCloud and all commercial regions at no added cost. The policies come in two flavors: strict RFC 9151 enforcement, and interoperability policies that default to CNSA while accommodating non-CNSA clients during transition. For defense contractors running GovCloud workloads, this removes the friction of DIY TLS termination to meet NSA cipher mandates.
AUG 4
trade-press
NIST Cyber AI Profile pushes agencies toward operational choices
The guidance tackles what framework-level documents don't, the non-deterministic behavior of generative AI systems and the post-deployment monitoring federal buyers need to budget for.
NIST's Cyber AI Profile aims to bridge the gap between high-level AI guidance and the procurement and deployment decisions federal agencies make every day. Built on the Cybersecurity Framework (CSF 2.0), the profile organizes AI risk around three focus areas: securing AI systems, AI-enabled cyber defense, and thwarting AI-enabled cyberattacks. The unspoken challenge driving the work, according to NIST program manager Kat Megas, is that generative AI systems don't behave like traditional software, they drift over time, and pre-deployment testing alone won't catch it.
JUL 31
trade-press
White House quantum orders push PQC into procurement pipeline
The quantum threat just stopped being a research conversation and started being a contract-compliance one, with DIB suppliers facing end-of-decade deadlines for cryptographic infrastructure redesign tied to federal eligibility.
The White House's June quantum executive orders accelerate post-quantum cryptography migration timelines across federal agencies, pulling the 2035 planning target forward to 2030, 2031 for high-value and high-impact systems. The Defense Department has followed with its own PQC Strategy establishing binding compliance deadlines for defense industrial base suppliers. This is the first major cryptographic infrastructure migration requirement pegged to contract performance rather than advisory guidance, primes and subs now face procurement-level consequences for non-compliance, not just best-practice nudges. The "harvest now, decrypt later" threat window is already open for defense, healthcare, and infrastructure data with long operational lifespans.
JUL 30
trade-press
NIST adds AI roles, prioritization to upcoming cyber profile draft
NIST shifts from framework abstraction to implementer toolkit mode, signaling contractor feedback on role ownership and agentic AI gaps has real weight.
NIST's upcoming initial public draft of the Cyber AI Profile will add AI roles drawn from the AI RMF's Actor Tasks, prioritization guidance, and expanded treatment of agentic AI, zero trust, and supply-chain risk. The additions directly address contractor complaints that the December 2025 preliminary draft was too abstract to implement and signal NIST is shifting from framework abstraction to implementer toolkit mode with concrete accountability structures for who owns AI-related cybersecurity activities. No release date beyond "pretty soon."
JUL 29
trade-press
VA drops pre-award FedRAMP requirement for cloud contracts
VA is betting that post-award security outcomes matter more than pre-award paperwork, but the 60-day ATO clock will decide whether the bet holds.
The Department of Veterans Affairs will no longer require cloud service providers to hold FedRAMP certification at contract award, per a memo from Principal Deputy Assistant Secretary Zack Schwartz obtained by FedScoop. Contractors must instead achieve a VA Authorization to Operate within 60 days of award, meeting NIST standards and VA security requirements before any system goes live. The policy opens the door for primes, subs, and ISVs that lack pre-existing FedRAMP status. But it shifts the authorization burden to post-award, where timeline risk now lives.
JUL 29
regulator
CISA Issues First SBOM Baseline Update Since 2021
The multi-agency update reflects five years of tooling maturity and stakeholder input but leaves open whether existing SBOMs must be rebuilt to the new floor.
CISA, the NSA, the FBI, and international partners released the 2026 Minimum Elements for a Software Bill of Materials, replacing the 2021 NTIA baseline that governed SBOM expectations for five years. The update incorporates feedback from a 2025 public comment period and reflects current SBOM tooling while preserving the original document's core principles. AI systems and SaaS products, the guidance notes, may require elements beyond the minimum. For software producers and federal suppliers, this is the new reference point for what a conforming SBOM contains. The guidance is silent on whether existing SBOMs must be retroactively updated.
JUL 29
trade-press
Claude Mythos finds weakness in NIST's HAWK PQC scheme
Neither weakness threatens deployed systems, but the HAWK finding underscores that NIST's post-quantum portfolio isn't settled until it's published.
Anthropic researchers used Claude Mythos Preview to find a mathematical weakness in HAWK, a digital signature scheme under NIST review for post-quantum cryptography. The shortcut cuts HAWK's effective key strength in half; key sizes would need to double, erasing much of what made the scheme appealing. Mythos also invented a theoretical shortcut against a weakened seven-round version of AES, making the strongest known attack 200 to 800 times faster, though it requires over 400 octillion messages and can't touch real-world 10-round encryption. Neither flaw threatens any deployed system.
JUL 28
trade-press
NIST SP 800-239 Tackles AI Data Center Security
SP 800-239 reframes AI security as an infrastructure challenge: hardware failures and orchestration gaps sit alongside adversarial threats for the first time in NIST guidance.
NIST released draft SP 800-239 on July 27, its first guidance dedicated to AI data center security rather than model-level AI risk. The publication maps a threat landscape, proposes mitigations, and lays out a reference architecture; comments close September 25. The draft treats hardware failures and orchestration gaps as security problems on par with adversarial threats, a reframing that primes, MSPs, and anyone operating AI data centers will need to track as the emerging federal baseline.
JUL 28
trade-press
Wyden demands two-year deadline to purge federal VPNs
Five years after EO 14028 ordered a zero-trust migration, a Senate Intelligence member puts a clock on removing the legacy VPNs that keep getting breached.
Sen. Ron Wyden (D-OR) urged CISA, OMB, and NIST on Monday to set a two-year deadline for federal civilian agencies to purge internet-facing legacy VPNs and replace them with zero-trust architecture. He also called on NSA to order a parallel purge across military and intelligence networks. The Senate Intelligence Committee member cited breaches of Cisco, Fortinet, Ivanti, and Check Point products by foreign adversaries. The letter carries no enforcement power, it asks three agencies to issue directives they haven't yet written.
JUL 27
trade-press
Cyber AB town hall convenes amid CMMC phase two pause
The Cyber AB called the pause surprising; Tuesday's town hall is its first chance to argue the assessment infrastructure it accredited is worth preserving.
The Cyber AB holds its July town hall Tuesday, the first public forum since the Pentagon paused CMMC phase two on July 13. CEO Matthew Travis called the decision "surprising and disappointing" and pledged cooperation with the newly formed CMMC Reform Task Force. The pause halts the planned November rollout of third-party assessment requirements in solicitations and caught C3PAOs off guard. They'd spent years building the assessment ecosystem.
JUL 27
trade-press
NIST and CISA Converge: Agentic AI Is an Identity Problem
Both agencies conclude agentic AI intensifies existing governance gaps rather than requiring a new security discipline.
NIST's NCCoE published a concept paper in February on applying identity standards to AI agents; CISA followed in May with joint international guidance on secure adoption of agentic AI. Both reach the same conclusion: autonomous agents that independently choose tools, call APIs, and initiate transactions don't need a novel security architecture. They need the identity governance agencies were already supposed to have, unified visibility across human and non-human identities, least-privilege enforcement, and lifecycle management. Agencies with identity governance already tight absorb less new risk. The rest face a prerequisite they haven't finished.
JUL 27
regulator
Arizona Retires AZRAMP for GovRAMP NIST 800-53
The migration makes Arizona the third state to abandon a proprietary cloud security program for the national GovRAMP framework, with hard compliance deadlines beginning July 2025 for new contracts.
Arizona is sunsetting its AZRAMP cloud security program and migrating all vendor authorizations to GovRAMP, requiring NIST 800-53-based assessments for new state contracts starting July 1, 2025, and for renewals by July 1, 2026. Existing AZRAMP authorizations remain valid until they expire, but there will be no further AZRAMP renewals. At expiration, vendors must hold GovRAMP or FedRAMP status. Arizona becomes the third state to fold its homegrown assessment regime into the GovRAMP umbrella, accelerating the consolidation away from state-by-state cloud security programs.
JUL 26
regulator
Nevada Mandates GovRAMP Core for Cloud Contracts
Nevada's new cloud security mandate requires GovRAMP Core. SOC 2, ISO 27001, TXRAMP, and HITRUST won't cut it.
Starting July 1, 2026, all new Nevada executive-branch cloud contracts must include GovRAMP Core certification at minimum, the state's Government Technology Office announced. The mandate, built on NIST SP 800-53 Rev 5, covers all three cloud service models. Vendors get a 12-month on-ramp from contract execution to achieve Core; FedRAMP Rev 5 holders can use a Fast Track process. As of July 1, 2028, the on-ramp disappears. Nevada explicitly rejects TXRAMP, SOC 2, ISO 27001, and HITRUST as substitutes.
JUL 26
trade-press
OT coalition urges ISA/IEC 62443 as unified ICS standard
CIRCIA's harmonization exception lets entities skip duplicate reporting, but without a shared OT baseline to measure "substantially similar" against, the exception can't deliver what it promises.
The Operational Technology Cybersecurity Coalition released a July 23 position paper urging federal policymakers to adopt ISA/IEC 62443 as a single horizontal standard for industrial control system security. Operators currently navigate overlapping mandates (the paper cites TSA pipeline security directives and NERC Critical Infrastructure Protection standards as examples) with no shared technical baseline across sectors. Coalition executive director Tatyana Bolton told Inside Cybersecurity that CIRCIA's proposed harmonization exception, which lets entities skip duplicate reporting under a "substantially similar" framework, can't function cleanly for OT until regulators agree on a common standard to measure similarity against.
JUL 24
trade-press
NIST targets AI agent identity as perimeter model fades
The NCCoE's six AI-cyber projects and its agent identity concept paper are building the governance framework for a perimeter-less world that most agencies still haven't acknowledged they're living in.
NIST's NCCoE is running six projects at the AI-cybersecurity intersection, and the agency's February concept paper on software and AI agent identity and authorization laid out the scaffolding for governing what AI agents can access and do. The argument that perimeter-based federal security is obsolete isn't new, but NIST's standards work confirms the government's own technical body is building the replacement. The gap isn't diagnosis; it's whether agency CISOs have moved their architectures to match.
JUL 23
trade-press
NIST opens public comment on first storage-infrastructure security guide update since 2020
The draft adds new control families for storage-specific threats, closing a four-year gap in the guidance covering the least-secured pillar of IT infrastructure.
NIST released an initial public draft of SP 800-209 Revision 1, updating its storage infrastructure security guidelines for the first time since 2020. The revision adds new security control families and expands threat modeling to address platform compromise and data resilience risks specific to storage systems. Assessors, C3PAOs, contractors, and MSPs that manage storage infrastructure will need to evaluate revised criteria. Comments close September 8.
JUL 23
trade-press
Secure AI Development Act would mandate NSA frontier-model testing
The proposal turns frontier-model review from voluntary benchmarking into a federal release gate, with the definition doing most of the work.
Sen. Mark Warner introduced a six-bill AI framework that includes the Secure AI Development Act, which would require National Security Agency pre-deployment testing of frontier AI models and add AI-specific risk tracking through CISA’s Common Vulnerabilities and Exposures program and NIST’s National Vulnerability Database. ISVs, contractors, executives and C3PAOs would face a new compliance checkpoint if the bill passes. The unresolved question is the load-bearing one: which models count as “frontier,” and whether work already underway gets pulled into the gate.
JUL 22
trade-press
NIST SP 800-63-4 moves identity into continuous risk management
Agencies now need evidence that proofing, authentication and automated fraud controls keep working after rollout.
The National Institute of Standards and Technology (NIST) SP 800-63-4 moves identity programs into a Digital Identity Risk Management lifecycle, with raised Identity Assurance Level (IAL) expectations and phishing-resistant authentication offered at Authentication Assurance Level (AAL) 2 and mandated at AAL3. Agencies carry the direct rebuild; contractors, assessors and Cybersecurity Maturity Model Certification (CMMC) Third-Party Assessment Organizations (C3PAOs) inherit the evidence problem. The missing piece is schedule: the source does not identify a transition deadline from SP 800-63-3 or alignment with Executive Order 13681.
JUL 20
trade-press
FCC weighs covered-list hardware ban as NIST convenes AI data center workshop
The useful signal is provenance: certification filings and AI facilities now share a supply-chain security problem.
Inside Cybersecurity reports that the Federal Communications Commission will consider a Wednesday order barring authorization for devices with logic-bearing hardware components made by entities on the FCC’s covered list. An attached notice would propose requiring Software Bill of Materials or Hardware Bill of Materials filings at certification. NIST also holds a two-day AI data center workshop on architecture, training, security posture, supply-chain issues and emerging standards. The common demand is evidence about what is inside the stack before anyone calls it secure.
JUL 20
trade-press
NSPM-12 pushes agencies toward NSA-centered cyber assessments
The memo may reduce self-graded security theater, if agencies can reconcile it with the assessment regimes already claiming the field.
A MeriTalk contributed piece from Armis by ServiceNow says National Security Presidential Memorandum 12 elevates federal cybersecurity by putting security assessments and recommendations under the National Manager for National Security Systems, operating under the NSA director. The directive also requires agencies to maintain and annually update inventories of national security systems and urges consistency across civilian and defense organizations. The hard part is not the slogan. It is avoiding another assessment lane agencies must satisfy without clearer criteria.
JUL 10
trade-press
Commentary pitches AI training for federal cyber defenders
The useful point is practical: AI policy does not train incident responders, forensic analysts, or network defenders by itself.
A Federal News Network commentary argues federal agencies need continuing, performance-based cyber training as AI-assisted phishing, reconnaissance and vulnerability analysis reshape federal network defense. It cites Trump administration AI and cyber directives, DoD 8140 and NIST’s NICE Workforce Framework for Cybersecurity, but the operational ask is familiar: train practitioners on realistic scenarios, not just concepts.
JUL 9
trade-press
NIST finalizes SP 800-161 supplier due-diligence guide
SBOM analysis is moving from procurement nice-to-have into the minimum research NIST expects before supplier selection.
Inside Cybersecurity reports that NIST finalized its fourth SP 800-161 quick-start guide, this one for supplier due-diligence assessments. The final guide adds SBOM analytical findings, replaces the draft “Stability” category with “Resilience,” and organizes reviews around five research categories for primes, contractors, subs and assessors. The unresolved question is whether any SBOM clears the foundational-practice bar, or whether format and maturity will matter.
JUL 9
trade-press
DoD fast-tracks CMMC shift to NIST 800-171 Rev. 3
DoD is trying to avoid another CMMC comment-cycle drag, leaving contractors to price work against an unnamed clock.
Inside Cybersecurity reports that the Defense Department’s 2026 unified agenda, published July 3, places an interim final rule in motion to move the Cybersecurity Maturity Model Certification program from National Institute of Standards and Technology Special Publication 800-171 Revision 2 to Revision 3 for controlled unclassified information. Primes, subcontractors and certified third-party assessment organizations get the practical problem: Rev. 2 assessments and contract planning now have an approaching shelf life, but DoD has not said when the clock starts or what happens after it expires.
JUL 8