Tag: nist
-
NIST publishes cybersecurity guide for businesses too small to have IT staff
The National Institute of Standards and Technology (NIST) released cybersecurity guidance for small businesses with no paid employees other than their owners. These businesses … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/11/04/nist-small-business-cybersecurity-guide/
-
NIST Releases New Cybersecurity Guidelines to Protect Small Businesses From Phishing and Ransomware Attacks
Tags: attack, business, cyber, cybersecurity, framework, nist, phishing, ransomware, technology, threatThe National Institute of Standards and Technology (NIST) released new cybersecurity guidance to help solo business owners protect themselves against threats like phishing, ransomware, and account compromise. Published on November 2, 2026, NIST Cybersecurity White Paper 50 simplifies the Cybersecurity Framework 2.0 and offers practical actions for businesses with limited IT infrastructure. The publication, Small…
-
NIST Releases New Cybersecurity Guidelines to Protect Small Businesses From Phishing and Ransomware Attacks
Tags: attack, business, cyber, cybersecurity, framework, nist, phishing, ransomware, technology, threatThe National Institute of Standards and Technology (NIST) released new cybersecurity guidance to help solo business owners protect themselves against threats like phishing, ransomware, and account compromise. Published on November 2, 2026, NIST Cybersecurity White Paper 50 simplifies the Cybersecurity Framework 2.0 and offers practical actions for businesses with limited IT infrastructure. The publication, Small…
-
NIST Releases New Guidelines to Protect Encryption Against Future Quantum Computer Attacks
Tags: attack, computer, computing, cryptography, cyber, encryption, framework, nist, technology, threat, vulnerabilityThe National Institute of Standards and Technology (NIST) has released finalized guidance to assist organizations in replacing cryptography that is vulnerable to quantum computing before future quantum computers pose a threat to sensitive information. Published on October 27, 2026, the report establishes a framework for migration that includes cryptographic standards, federal deadlines, and implementation priorities.…
-
NIST Publishes Guidance to Meet Federal Post-Quantum Deadlines
Tags: nistThe guidance sets out how federal agencies can prioritize PQC adoption for the most sensitive systems, to meet the 2031 transition deadline First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/nist-guidance-post-quantum/
-
NIST starts the countdown to retire quantum-vulnerable encryption
The National Institute of Standards and Technology (NIST) has released a roadmap for moving to post-quantum cryptography (PQC), with earlier deadlines for certain sensitive … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/10/28/nist-post-quantum-cryptography-migration-roadmap/
-
NIST Outlines Phased, Hybrid Post-Quantum Migration
Federal Agencies May Combine Classical and Quantum-Resistant Algorithms. The National Institute of Standards and Technology outlined a phased transition to post-quantum cryptography, allowing temporary hybrid algorithms while prioritizing network encryption and setting a 2035 cutoff for quantum-vulnerable public-key algorithms under its standards. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/nist-outlines-phased-hybrid-post-quantum-migration-a-33225
-
When an AI Agent Is the Incident, the Identity Record Is the Evidence
A new NIST, CISA, and NSA guide treats runaway agents as incidents to be rehearsed. The hard part of the response is answering whose authority the agent used, and that answer has to exist before the incident does. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/when-an-ai-agent-is-the-incident-the-identity-record-is-the-evidence/
-
Marvell, Microsoft & Oracle Work to Standardize Data Center Hardware Security
The effort is aimed at standardizing a NIST FIPS 140-3 Level 3 integrated HSM for cloud and hyperscale data center infrastructure. First seen on darkreading.com Jump to article: www.darkreading.com/cloud-security/marvell-microsoft-oracle-standardize-data-center-hardware-security
-
NSA, NIST, CISA Issue Guidance on Rogue AI Agents
Federal Advisory Outlines Five Stages for Detecting and Containing AI Incidents. The NSA, NIST and CISA have issued voluntary guidance for detecting, containing and recovering from rogue AI agent incidents, urging frontier AI developers to strengthen monitoring, restrict access and treat dangerous near-misses as security events while leaving adversarial attacks outside its scope. First seen…
-
U.S. Agencies Warn AI Agents Could Exploit Security Flaws and Establish Hidden Backdoors
U.S. agencies have warned that advanced AI agents could exploit security flaws, break out of their assigned limits, and leave hidden backdoors behind. New guidance from NIST, the National Security Agency, and CISA urges AI developers to prepare for incidents in which agents take harmful actions without being told to do so. Released on October…
-
Anthropic’s Claude AI Uncovers Origins of NSA-Provided Cryptographic Keys After 25 Years
Anthropic says an internal Claude research model reconstructed how the National Security Agency generated seeds for five NIST elliptic curves in under 30 minutes, addressing a cryptographic mystery spanning roughly 25 years. Its October 16 report attributes the seeds to a standard C pseudorandom number generator initialized with Unix timestamps, rather than secret passphrases. Despite…
-
Why CMMC Contractors Should Plan for NIST Revision 3 Now
Use the CMMC Phase II Suspension to Map the Gaps Before Rev. 3 Reaches Contracts The suspension of CMMC Phase II may sound like a reduction in urgency for the defense industrial base. In practice, it may raise the stakes. NIST SP 800-171 Revision 3 is now NIST’s current standard, and contractors that wait for…
-
Why CMMC Contractors Should Plan for NIST Revision 3 Now
Use the CMMC Phase II Suspension to Map the Gaps Before Rev. 3 Reaches Contracts The suspension of CMMC Phase II may sound like a reduction in urgency for the defense industrial base. In practice, it may raise the stakes. NIST SP 800-171 Revision 3 is now NIST’s current standard, and contractors that wait for…
-
Der Q-Day rückt näher: Wie Unternehmen ihre Kryptografie jetzt zukunftsfähig machen
Der Q-Day hat kein verlässliches Datum die Migrationszeit dagegen läuft bereits. Wer sensible Daten über Jahre schützen muss, sollte nicht auf den ersten kryptografisch relevanten Quantencomputer warten. NIST hat 2024 die ersten drei zentralen Post-Quanten-Standards veröffentlicht; die EU-Roadmap zielt für Hochrisiko-Anwendungen auf eine Migration bis 2030. Entscheidend sind deshalb jetzt ein vollständiges Krypto-Inventar, klare… First…
-
Post-Quantum Security und Krypto-Migration bis 2030: Was Geschäftsführung und CIO jetzt entscheiden müssen
Management Summary Das Risiko ist bereits real: »Harvest Now, Decrypt Later« gefährdet Daten, die noch über Jahre geschützt bleiben müssen. Die Technik ist verfügbar: NIST hat 2024 die ersten drei PQC-Standards finalisiert; Unternehmen können mit der Migration beginnen. Inventarisierung hat Vorrang: Ohne Transparenz über Algorithmen, Schlüssel, Zertifikate, Protokolle und Lieferanten fehlt die Grundlage für Prioritäten……
-
CISA and NIST Issue Guidance to Protect Cloud Identity Tokens
CISA and NIST issued final guidance to help protect cloud identity tokens and assertions First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/cisa-nist-cloud-identity-token/
-
Google Patches Pixel Modem Flaw Amid Signs of Limited Targeted Exploitation
Google has disclosed that a high-severity security flaw in its Pixel Cellular Modem has come under exploitation in the wild.The vulnerability, tracked as CVE-2026-58704 (CVSS score: 8.0), is a privilege escalation flaw.”In Cellular Modem, there is a possible permission bypass due to a logic error in the code,” according to a description of the bug…
-
NIST and CISA finalize playbook to stop token theft and forgery
NIST and CISA have finalized guidelines to help federal agencies and cloud service providers (CSPs) protect identity and access tokens from forgery, theft, and misuse. The … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/09/16/nist-cisa-cloud-token-security-guidance/
-
NIST Issues New Guidance to Protect SSO and API Tokens From Theft and Forgery
The National Institute of Standards and Technology (NIST) has published new implementation guidance to safeguard identity tokens, access tokens, and assertions used in single sign-on, cloud federation, and application programming interface (API) environments. Released on September 15, 2026, NIST Internal Report 8587, titled >>Protecting Tokens and Assertions from Forgery, Theft, and Misuse: Implementation Recommendations for…
-
Why Post-Quantum Cryptography Should Matter to Every Organization
Ken Russman, Director, Strategy and Risk September 15, 2026 “PQC is a business resilience issue, not just a technology upgrade.” Key Takeaways NIST has finalized its first post-quantum cryptography standards, and organizations should begin a phased migration to quantum-resistant cryptography. … First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/09/why-post-quantum-cryptography-should-matter-to-every-organization/
-
Mapping NIST CSF to ISO 27001 in practice
Mapping NIST CSF to ISO 27001 in practice For many UK SMEs, NIST CSF and ISO 27001 are not competing choices. They solve different problems, but they overlap enough that a well-designed mapping can reduce duplication, improve governance, and make… First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/09/mapping-nist-csf-to-iso-27001-in-practice/
-
Is Silent Network Authentication a Restricted Authenticator Under SP 800-63-4?
No. Silent network authentication is not a restricted authenticator under NIST SP 800-63B-4, and the reason is not that it passed a test. SP 800-63B-4 names exactly one restricted authenticator, “the use of the PSTN for out-of-band authentication,” and… First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/09/is-silent-network-authentication-a-restricted-authenticator-under-sp-800-63-4/
-
NIST CSF 2.0 Governance: Map Controls with Expert Assessments
Tags: compliance, control, csf, cybersecurity, framework, governance, lazarus, nist, risk, risk-managementIn 2026, organizations face mounting pressure to align strategic oversight with technical controls under the NIST Cybersecurity Framework 2.0. Governance emerges as the critical function that transforms scattered compliance activities into cohesive risk management programs. Lazarus Alliance has developed proprietary mapping methodologies that connect CSF 2.0 governance outcomes directly to controls in NIST SP 800-53,”¦…
-
Top 5 Cross-Mapping Standards for Risk Management at Continuum GRC
Cross-mapping standards has emerged as a critical strategy for organizations navigating overlapping regulatory requirements in 2026. By aligning controls across frameworks such as NIST SP 800-171 Rev 3 and CMMC 2.0, compliance officers can reduce redundant efforts while strengthening risk management programs. Continuum GRC specializes in these integrated approaches to help CISOs achieve efficiency without”¦…
-
NIST Warns of Unique Security Risks in Multi-Cloud Environments
NIST has set out 23 novel challenges that arise in multi-cloud environments and has encouraged the cyber community to find solutions First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/nist-risks-multi-cloud/
-
ISO 42001 AI Certification Audits by Lazarus Alliance Experts
Tags: ai, compliance, control, defense, finance, framework, governance, healthcare, lazarus, nist, risk, serviceIn 2026, forward-thinking organizations recognize that ISO 42001 certification transcends checkbox compliance, emerging as the strategic convergence point where AI governance meets rigorous multi-framework risk management. Lazarus Alliance experts observe that AI systems now underpin critical operations across defense, healthcare, and financial services, demanding controls that simultaneously satisfy ISO 42001, NIST 800-53, CMMC, and FedRAMP”¦…
-
CMMC Compliance Assessments: 6 Key Steps by Continuum GRC
CMMC compliance assessments represent a critical evolution in protecting controlled unclassified information (CUI) across the defense industrial base. As organizations navigate CMMC 2.0 requirements in 2026, understanding the nuanced differences between self-attestation and third-party assessments becomes essential for CISOs and compliance officers managing NIST SP 800-171 Rev 3 controls. Recent regulatory emphasis on rigorous cybersecurity”¦…
-
6 NIST Software Criteria for Financial Institutions
Tags: compliance, cyber, cybersecurity, dora, finance, framework, nist, regulation, software, threat<div cla Financial institutions face overlapping requirements from SEC cyber disclosure rules, NYDFS cybersecurity regulations, and sector-specific mandates like DORA in Europe. When your compliance team juggles multiple frameworks while your security operations center monitors threats in real time, the gap between technical findings and boardroom reporting grows wider by the day. First seen on…
-
PCI DSS v4.0 Deadline: 5-Step Gap Assessments Now
Organizations handling cardholder data face an urgent imperative in 2026: transitioning to PCI DSS v4.0 requires immediate, structured gap assessments rather than reactive remediation. Lazarus Alliance brings first-hand audit experience across high-stakes sectors to highlight why a proprietary 5-step methodology outperforms traditional checklists, integrating risk management with cross-framework alignment to CMMC, NIST 800-53, and ISO”¦…