NIST SP 800-238 日本語訳

•Continued to advance post-quantum cryptography (PQC) standards by announcing a fifth PQC algorithm for standardization, Hamming Quasi-Cyclic (HQC), and working with industry and standards development organizations to facilitate PQC adoption in critical security technologies.

•Released a timeline for the migration to PQC standards, the deprecation of quantum-vulnerable algorithms after 2030, and the required use of quantum-resistant algorithms by 2035.

•Published the lightweight cryptography standard Ascon in SP 800-232 after a five-year global competition to provide strong, efficient, side-channel-resistant protection for billions of Internet of Things (IoT) and constrained devices for which traditional cryptography is too costly.

•Strengthened trust in the security of commercial cryptographic products through testing under the Cryptographic Module Validation Program with improved workflows and processes to reduce the time for validation for the 262 products tested in FY 2025.

•Expanded collaboration on the Migration to PQC Project, with 50+ organizations working to demonstrate practices to ease migration to NIST PQC standards. This included demonstrations of the functionality of some collaborator discovery and inventory tools (and how the tool outputs could be used to prioritize migration decisions). Collaborators also demonstrated the interoperability of PQC algorithms to prepare for their use in products and services. (NCCoE)

•Expanded automated cryptographic algorithm testing to deliver nearly 1 million test vectors and validate 1,598 implementations while facilitating the migration to PQC standards with 170 Module-Lattice-Based Digital Signature Algorithm (ML-DSA) (from FIPS 204) and Module-Lattice-Based Key Encapsulation Mechanism (ML-KEM) (from FIPS 203) validations.

•Published a concept paper and generated critical input for the Cybersecurity Framework Profile for AI through a workshop and multiple working meetings involving thousands of participants. (NCCoE)

•Released Adversarial Machine Learning: A Taxonomy and Terminology of Attacks and Mitigations, which is widely cited and discussed.

•Collected real-world data from experiments on a ‘smart road’ to accelerate the development of new-generation benchmark datasets to help improve the robustness of AI models used in self-driving cars. (NCCoE)

•Kicked off the Control Overlays for Securing AI Systems (COSAiS) project to develop a series of overlays for securing AI systems using NIST’s SP 800-53 controls, SP 800-218A, Draft AI 800-1, and AI 100-2e2025 to facilitate the responsible and secure adoption of AI technologies.

•Published an Institute of Electrical and Electronics Engineers (IEEE) Computer article describing a unified measurement and visualization framework that quantitatively characterizes the strength, weakness, transferability, and explainability of machine-learning training and testing datasets.

•Published findings about a model-agnostic dataset reduction method using Combinatorial Frequency Differencing to identify distinguishing feature values at a peer-reviewed conference.

•Published a paper in the Association for Computing Machinery Workshop on Computer Security on threat modeling for security analysis of machine learning systems.

•Published a paper on detecting hallucinations in a Conference on Data and Applications Security and Privacy proceedings, winning a “Best Paper Award.”

•Published a paper on automated program repair in IEEE Computer.

•Continued to develop and improve Dioptra, a software test platform for assessing various characteristics of AI systems. (NCCoE)

•NICE’s Community Coordinating Council released three new resources in support of the NICE Strategic Plan: a white paper on Empowering Organizations to Retain Skilled Cybersecurity Talent for Long-Term Success, information on Options for Entering the Cybersecurity Workforce, and information on Help Wanted: Cybersecurity Educators - How National Centers of Academic Excellence are Responding.

•Released additional resources in support of the NICE Strategic Plan, including information on Skills-Based Approaches to Cybersecurity Talent Management, Unlocking Cybersecurity Talent: The Power of Apprenticeships, and The Impact of Artificial Intelligence on the Cybersecurity Workforce.

•The Regional Alliances and Multistakeholder Partnerships to Stimulate (RAMPS) Cybersecurity Education and Workforce Development Program awarded 17 new cooperative agreements totaling over $3 million aimed at building the workforce needed to safeguard enterprises from cybersecurity risks. As of September 2025, NIST has funded 47 RAMPS communities established across 25 states.

•Several events were held throughout FY 2025, including the NICE Conference & Expo, NICE K12 Cybersecurity Education Conference, Regional Initiative for Cybersecurity Education and Training (RICET), Cybersecurity Career Week, NICE webinars, and the US Cyber Team Draft Day.

•NIST continued to support Federal Information Security Educators (FISSEA) engagement throughout FY 2025, including winter, spring, and fall forums.

•Established a Hardware Security Laboratory to enhance semiconductor security through measurements and metrics, including an electrical probing station, electromagnetic side-channel analysis equipment, test artifacts, and initiating experiment development.

•Held a workshop with industry, government, and academia to identify priorities, challenges, and solutions for semiconductor supply chain trust and provenance. Panel discussions and breakouts assessed concerns, approaches, verification needs, and collaboration barriers and outlined actions for a shared roadmap.

•Gathered feedback during a workshop for the Semiconductor Manufacturing Profile and released Draft IR 8546 to establish Cybersecurity Framework (CSF) 2.0–aligned guidelines for enhancing security in semiconductor manufacturing.

•Led the development of advanced security measurement techniques and analytical frameworks that evaluate hardware security failure scenarios, quantify vulnerabilities, assess collusion-based supply chain threats, and determine benchmark mitigation effectiveness for semiconductor devices.

•Demonstrated emerging attack surfaces through multimodel probing of advanced packaging, vulnerability metrics, and defense strategies in the article, “Toward Standardized Vulnerability Assessment of Advanced Packaging Against Probing Attacks” in IEEE’s Design & Test issue.

•Launched the Secure Software Development, Security, and Operations (DevSecOps) Practices Project, established an industry consortium to improve secure software development, and published a preliminary draft of SP 1800-44A. (NCCoE)

•The National Checklist Program added ~216 new and updated automated checklists for securely configuring and patching common applications and operating systems used by organizations to secure millions of computer systems.

•Published Guidelines for API Protection for Cloud-Native Systems and Service Mesh Proxy Models for Cloud-Native Applications, which recommend practical security controls and a risk-based approach to API protection.

•Published the CSF 2.0 Manufacturing Profile, which provides a voluntary, risk-based approach for managing activities and reducing cyber risks. (NCCoE)

•The 5G Cybersecurity project published several white papers on potential concerns and mitigations for 5G systems: CSWP 36C, CSWP 36D, and CSWP 36E. (NCCoE)

•The High-Performance Computing (HPC) Security Working Group released SP 800-223 and Draft SP 800-234 to enhance communication on HPC security, facilitate security compliance, and enable guided system designs globally.

•Updated Draft IR 8259 (Rev 1), which recommends cybersecurity activities for manufacturers. (NCCoE)

•The Cybersecurity for the Manufacturing Sector Consortium project is currently under review. (NCCoE)

•Participated in the third-generation partnership project (3GPP) SA3 to ensure appropriate input into cybersecurity for cellular standards, including the use of NIST Cryptographic Algorithm standards in 5G and 6G cellular networks.

•The Trusted Internet of Things (IoT) Device Network-Layer Onboarding and Lifecycle Management project hosted an open house for collaborating organizations to demonstrate their solutions. (NCCoE)

•Convened bi-monthly Cooperative Research and Development Agreement partner meetings to engage with water sector stakeholders, present findings at conferences and meetings, and establish NIST’s role as an advocate for cybersecurity best practices in the water sector. (NCCoE)

•Advanced the adoption of the Cybersecurity Framework 2.0 (CSF 2.0) by releasing quick-start guides, adding informative references to the CSF 2.0 Tool in the Online Informative References, launching a Webinar Series, publishing translations of resources, and updating the NIST IR 8286 series.

•Published 7 community profiles and resources across sectors. (NCCoE)

•Released SP 800-55 Vols. 1 and 2 on identifying and selecting security measures and developing an information security measurement program.

•Updated the enhanced security requirements for protecting CUI and assessment procedures and issued a small business primer.

•In response to Executive Order (EO) 14306, issued updates to the Security and Privacy Control Catalog (SP 800-53 Release 5.2.0) and Assessment Procedures (SP 800-53A Release 5.2.0) for secure and reliable software updates and patches.

•Drove the adoption of Cybersecurity Supply Chain Risk Management best practices by leading the Software and Supply Chain Assurance Forum and supporting the Federal Acquisition Security Council.

•Published draft Privacy Framework 1.1, which received 250+ comments from 31 stakeholders and was downloaded 25,000+ times.

•The Open Security Controls Assessment Language (OSCAL) continued to increase security program automation. The CAPORDINO tool was released, which converts reference datasets managed by the Cybersecurity and Privacy Reference Tool into OSCAL formats.

•Released Revision 4 of the Digital Identity Guidelines, delivered resources on Mobile Driver’s Licenses for opening accounts and high-risk transactions, contributed to ISO/IEC TS 18013-7:2025 (an international, interoperable protocol to securely present important identity documents), and developed a reference implementation of an International Organization for Standardization (ISO) standard. (NCCoE)

•NICE Workforce Framework Version 2.2.0 was issued, featuring a new Operational Technology Cybersecurity Engineering Work Role.