Guidance, practices and programmes
NIST Special Publications
Free, detailed NIST guides on specific topics: patching, incident response, supply chain risk, zero trust and more.
Official source Published by US National Institute of Standards and Technology. US government work in the public domain.
What it is
NIST Special Publications in the 800 series are free, detailed guides on specific security topics, written for US federal agencies but used widely. They cover areas such as incident response, patch management, supply chain risk, zero trust, secure software development and digital identity.
Who it applies to
- US federal agencies, for which many publications are required through federal policy
- US government contractors, notably SP 800-171 for protecting Controlled Unclassified Information
- Security practitioners anywhere who need detailed, free reference material on a topic
- Organisations building programmes for NIS2 or DORA that want practical method guidance
- Status
- US government guidance documents, each with its own revision and date. They are mandatory for federal agencies when required by law or policy and voluntary for others.
- Enforcement
- For agencies, compliance is checked through federal oversight and audits; contractors may be bound by contract clauses. For everyone else they are voluntary reference material.
Key points
- Check the revision: several key publications were updated recently and older copies circulate widely
- Drafts are published for public comment, so do not treat a draft as final
- SP 800-171 is the basis of CMMC Level 2 and is relevant to any supplier handling US CUI
- SP 800-63 is a common reference for password and authentication policy
- The SSDF (800-218) is a widely referenced baseline for secure software development
- The publications are in the public domain, so they can be reused and adapted freely
Where to start
- 1Identify the topic you need, for example incident response or supply chain, and find the current revision on the NIST CSRC site
- 2Use the publication to review your existing process rather than starting from scratch
- 3Map recommendations to your own control framework so they become owned requirements
- 4Watch NIST announcements for revisions to the publications you rely on
How it is structured
| SP 800-37 and 800-30 | Risk Management Framework and risk assessment guidance |
|---|---|
| SP 800-61 | Incident response, revised in 2025 to align with CSF 2.0 |
| SP 800-40 | Enterprise patch management planning |
| SP 800-161 | Cybersecurity supply chain risk management |
| SP 800-171 | Protecting Controlled Unclassified Information in non-federal systems |
| SP 800-207 and 800-218 | Zero trust architecture and the Secure Software Development Framework (SSDF) |
| SP 800-63 | Digital identity guidelines for authentication and identity proofing |
A plain-language overview to help you learn, written by ThreatNoir. The official source prevails; this is not legal advice.
Items explained (39)
Ordered by how often our lessons cite them.
- SP 800-40SP 800-40 Rev. 4: Guide to Enterprise Patch Management Planning: Preventive Maintenance for TechnologyCited 908 times in our lessons
- SP 800-161SP 800-161 Rev. 1: Cybersecurity Supply Chain Risk Management Practices for Systems and OrganizationsCited 800 times in our lessons
- SP 800-82SP 800-82 Rev. 3: Guide to Operational Technology (OT) SecurityCited 369 times in our lessons
- SP 800-218SP 800-218: Secure Software Development Framework (SSDF) Version 1.1Cited 338 times in our lessons
- SP 800-61SP 800-61 Rev. 3: Incident Response Recommendations and Considerations for Cybersecurity Risk ManagementCited 283 times in our lessons
- SP 800-63SP 800-63: Digital Identity GuidelinesCited 210 times in our lessons
- SP 800-124SP 800-124 Rev. 2: Guidelines for Managing the Security of Mobile Devices in the EnterpriseCited 110 times in our lessons
- SP 800-207SP 800-207: Zero Trust ArchitectureCited 81 times in our lessons
- SP 800-50SP 800-50 Rev. 1: Building a Cybersecurity and Privacy Learning ProgramCited 73 times in our lessons
- SP 800-137SP 800-137: Information Security Continuous Monitoring (ISCM) for Federal Information Systems and OrganizationsCited 44 times in our lessons
- SP 800-57SP 800-57: Recommendation for Key ManagementCited 34 times in our lessons
- SP 800-188SP 800-188: De-Identifying Government Datasets: Techniques and GovernanceCited 32 times in our lessons
- SP 800-171SP 800-171 Rev. 3: Protecting Controlled Unclassified Information in Nonfederal Systems and OrganizationsCited 29 times in our lessons
- SP 800-34SP 800-34 Rev. 1: Contingency Planning Guide for Federal Information SystemsCited 26 times in our lessons
- SP 800-190SP 800-190: Application Container Security GuideCited 24 times in our lessons
- SP 800-208SP 800-208: Recommendation for Stateful Hash-Based Signature SchemesCited 24 times in our lessons
- SP 800-177SP 800-177 Rev. 1: Trustworthy EmailCited 24 times in our lessons
- SP 800-193SP 800-193: Platform Firmware Resiliency GuidelinesCited 23 times in our lessons
- SP 800-213SP 800-213: IoT Device Cybersecurity Guidance for the Federal Government: Establishing IoT Device Cybersecurity RequirementsCited 20 times in our lessons
- SP 800-83SP 800-83 Rev. 1: Guide to Malware Incident Prevention and Handling for Desktops and LaptopsCited 17 times in our lessons
- SP 800-66SP 800-66 Rev. 2: Implementing the HIPAA Security Rule: A Cybersecurity Resource GuideCited 17 times in our lessons
- SP 800-115SP 800-115: Technical Guide to Information Security Testing and AssessmentCited 16 times in our lessons
- SP 800-184SP 800-184: Guide for Cybersecurity Event RecoveryCited 14 times in our lessons
- SP 800-30SP 800-30 Rev. 1: Guide for Conducting Risk AssessmentsCited 11 times in our lessons
- SP 800-204SP 800-204: Security Strategies for Microservices-based Application SystemsCited 11 times in our lessons
- SP 800-122SP 800-122: Guide to Protecting the Confidentiality of Personally Identifiable Information (PII)Cited 11 times in our lessons
- SP 800-41SP 800-41 Rev. 1: Guidelines on Firewalls and Firewall PolicyCited 10 times in our lessons
- SP 800-150SP 800-150: Guide to Cyber Threat Information SharingCited 10 times in our lessons
- SP 800-111SP 800-111: Guide to Storage Encryption Technologies for End User DevicesCited 8 times in our lessons
- SP 800-131SP 800-131A Rev. 2: Transitioning the Use of Cryptographic Algorithms and Key LengthsCited 7 times in our lessons
- SP 800-155SP 800-155: BIOS Integrity Measurement Guidelines (Draft)Cited 7 times in our lessons
- SP 800-128SP 800-128: Guide for Security-Focused Configuration Management of Information SystemsCited 7 times in our lessons
- SP 800-90SP 800-90A Rev. 1: Recommendation for Random Number Generation Using Deterministic Random Bit GeneratorsCited 7 times in our lessons
- SP 800-163SP 800-163 Rev. 1: Vetting the Security of Mobile ApplicationsCited 7 times in our lessons
- SP 800-187SP 800-187: Guide to LTE SecurityCited 5 times in our lessons
- SP 800-125SP 800-125: Guide to Security for Full Virtualization TechnologiesCited 5 times in our lessons
- SP 800-147SP 800-147: BIOS Protection GuidelinesCited 5 times in our lessons
- SP 800-216SP 800-216: Recommendations for Federal Vulnerability Disclosure GuidelinesCited 5 times in our lessons
- SP 800-167SP 800-167: Guide to Application WhitelistingCited once in our lessons