NIST SP 800-225 日本語訳

NIST Special Publication

Patrick O'Reilly, Editor
Computer Security Division
Information Technology Laboratory

Co-Editors:
Larry Feldman
Greg Witte
Huntington Ingalls Industries

Kristina Rigopoulos, Editor
Applied Cybersecurity Division
Information Technology Laboratory

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-225

May 2023

U.S. DEPARTMENT OF COMMERCE
Gina M. Raimondo, Secretary

NATIONAL INSTITUTE OF STANDARDS AND TECHNOLOGY

Laurie E. Locascio, NIST Director and Under Secretary of Commerce for Standards and Technology

NCCoE Summary 21

Opportunities to Engage 22

Nelson Mandela famously said, “Remember to celebrate milestones as you prepare for the road ahead.” This year, we celebrated a major milestone that we’re proud of: 50 years of cybersecurity at NIST. Over the last five decades, we have conducted research and developed guidance that has led to extraordinary advancements in cybersecurity.

Many of these advancements have taken on new life over the years as the world of cybersecurity shifts and adjusts. We look forward to outlining our accomplishments each year in these Annual Reports as we share how our dynamic projects help advance technology, cybersecurity and privacy standards and guidelines, and measurement science for all.

You’ll notice that this year’s Annual Report has a new look and feel. We are debuting a simpler format with less text and more pointers to our helpful and robust websites, and we organized the publication into seven key categories (see our table of contents for a list, and read about each one throughout this report).

This past year, NIST conducted research and demonstrated practical applications in several key priority areas, including Post Quantum Cryptography (and the selection of PQC algorithms for standardization); an update to the NIST Cybersecurity Framework (CSF 2.0), including new CSF profiles; software and supply chain cybersecurity; our Internet of Things (IoT) cybersecurity guidelines work; launching a new comment site for our security and privacy controls and baselines (so we can get our resources into the hands of practitioners faster and improve the user experience for our customers); and much more.

We are always learning, growing, and creating, so sometimes we forget to take a minute to reflect. This year, we enjoyed doing just that as we celebrated the very milestones that make us unique.

- Kevin Stine, NIST Chief Cybersecurity Advisor

How did we celebrate our 50th anniversary of cybersecurity this year?

• We launched a new NIST Cybersecurity Program History and Timeline tool, which provides an overview of NIST’s major cybersecurity research projects, programs, and – ultimately – history.
• We set up a dedicated anniversary website that has everything in one place – blog posts, event details, and resources.
• We shared and collaborated on our cybersecurity Twitter account using the hashtag #NISTcyber50th all year.

Cryptography is foundational to our security and data protection needs. The standards, guidelines, recommendations, and tools provided by NIST’s Cryptography priority area enable trustworthy assurance of integrity and confidentiality in all types of information and technology – now and in the future.

Learn more about this priority area

NIST is proud to have achieved the milestone of selecting the algorithms which will help protect our sensitive data against the possibility of future attacks from quantum computers.

- Dustin Moody, NIST PQC Project Lead

Image credit: Shutterstock

Energizing, promoting, and coordinating the workforce are key priorities for NIST. The National Initiative for Cybersecurity Education (NICE) supports a robust community that works together to advance an integrated ecosystem of cybersecurity education, training, and workforce development.

Learn more about these priority areas

As cybersecurity risks evolve, the need for a knowledgeable and skilled cybersecurity workforce remains constant.

- Rodney Petersen, Director of NICE at NIST

Image credit: Florida International University

Identity and Access Management (IAM) is the cornerstone of data protection, privacy, and security. NIST’s IAM priority area provides the research, guidance, and technology transition activities to help ensure that the right humans, devices, data, and processes have the right access to the right resources at the right time.

Learn more about this priority area

Image credit: Shutterstock

NIST’s Identity & Access Management Program is a cornerstone for government services. From Zero Trust to benefits distribution, some of the most critical aspects of government rely on our research and guidance….

- Ryan Galluzzo, NIST Digital Identity Program Lead

Privacy is integral to the trust that supports the growth of the digital economy and improves our quality of life. NIST has prioritized Privacy Engineering to support measurement science and system engineering principles through frameworks, risk models, and guidance that protect privacy and civil liberties.

Learn more about this priority area

Image credit: Shutterstock

Organizations must balance a rapidly evolving cybersecurity and privacy threat landscape with the need to fulfill enterprise mission and business requirements. This evolution increasingly calls for a collaborative approach to managing discipline-specific enterprise risks. Risk management is integrated into NIST standards and guidelines to help better understand, measure, manage, and reduce cybersecurity and privacy risk in a larger context.

Learn more about this priority area

Image credit: Shutterstock

Each of us relies on the hardware, software, and networks that form the fabric of our digital ecosystems. NIST’s Trustworthy Networks and Trustworthy Platforms priority areas support research and practical implementation guidance to ensure secure, reliable, and resilient technology across industry sectors.

Learn more about the Trustworthy Networks and Platforms priority areas

Image credit: Shutterstock

The mission of the Usable Cybersecurity priority area is to “champion the human in cybersecurity.” Through human-centered research and projects, the usability team seeks to better understand and improve users’ cybersecurity interactions and empower people to be active, informed participants in cybersecurity.

Learn more about this priority area

We amplify the voices and needs of people within a field that is most often viewed through a technology-dominant lens.

- Julie Haney, NIST Usable Cybersecurity Program Lead

Image credit: Shutterstock

The NCCoE brings together members of industry, government, and academia to address the real-world needs of securing complex systems and protecting the Nation’s critical infrastructure.

Collaborators and researchers are the driving force behind NIST’s programs. NIST depends on developers, providers, and everyday users of cybersecurity and privacy technologies and information to guide our priorities.

• Details on engaging with NIST on cybersecurity and privacy are available here.
• Many NIST projects are supported by guest researchers, both foreign and domestic.
• The Pathways Program supports federal internships for students and recent graduates.
• NIST funds industrial and academic research in several ways:
  • The Small Business Innovation Research Program (SBIR) funds research and development proposals.
  • NIST offers grants to encourage work in the fields of precision measurement, fire research, and materials science. For general information on NIST’s grant programs, please contact Mr. Christopher Hunton via grants@nist.gov.

Image credit: Canva

This publication has been developed by NIST in accordance with its statutory responsibilities under the Federal Information Security Modernization Act (FISMA) of 2014, 44 U.S.C. § 3551 et seq., Public Law (P.L.) 113-283. NIST is responsible for developing information security standards and guidelines, including minimum requirements for federal information systems, but such standards and guidelines shall not apply to national security systems without the express approval of appropriate federal officials exercising policy authority over such systems. This guideline is consistent with the requirements of the Office of Management and Budget (OMB) Circular A-130.

Nothing in this publication should be taken to contradict the standards and guidelines made mandatory and binding on federal agencies by the Secretary of Commerce under statutory authority. Nor should these guidelines be interpreted as altering or superseding the existing authorities of the Secretary of Commerce, Director of the OMB, or any other federal official. This publication may be used by nongovernmental organizations on a voluntary basis and is not subject to copyright in the United States. Attribution would, however, be appreciated by NIST.

O'Reilly PD, II, Rigopoulos KG, Feldman L, Witte GA (2023) Fiscal Year 2022 Cybersecurity and Privacy Annual Report. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) NIST SP 800-225. https://doi.org/10.6028/NIST.SP.800-225.

Any mention of commercial products or organizations is for informational purposes only; it is not intended to imply recommendation or endorsement by the National Institute of Standards and Technology, nor is it intended to imply that the products identified are necessarily the best available for the purpose.

The editors would like to thank their NIST colleagues by extending special recognition and appreciation for Victoria Yan Pillitteri, Isabel Van Wyk, Jeffrey Marron, Matthew Scholl, Kevin Stine, Sara Kerman, Sheryl Taylor, and Jim Foti for reviewing and providing valuable feedback, writing input, and administrative support for this Annual Report.

All names are trademarks or registered trademarks of their respective owners.

During Fiscal Year 2022 (FY 2022) – from October 1, 2021, through September 30, 2022 – the NIST Information Technology Laboratory (ITL) Cybersecurity and Privacy Program successfully responded to numerous challenges and opportunities in security and privacy. This Annual Report highlights the FY 2022 research activities for the ITL Cybersecurity and Privacy Program, including: the ongoing participation and development of international standards; research and practical applications in several key priority areas (e.g., Post Quantum Cryptography, updating the NIST Cybersecurity Framework (CSF 2.0) and some new CSF profiles); accomplishments in the area of improving software and supply chain cybersecurity; IoT cybersecurity guidelines work; National Cybersecurity Center of Excellence (NCCoE) projects, and setting up a new comment site for NIST’s Risk Management Framework work. NIST also celebrated a 50th anniversary in cybersecurity and the NCCoE celebrated a 10-year anniversary since inception.

annual report; cybersecurity; cybersecurity program; Federal Information Security Management Act; FISMA; privacy; program highlights; information security; Information Technology Laboratory; ITL; program accomplishments.

The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the Nation’s measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology. ITL’s responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in federal information systems. The Special Publication 800-series reports on ITL’s research, guidelines, and outreach efforts in information system security, and its collaborative activities with industry, government, and academic organizations.