What it covers. Part of the NIST SP 800-90 series on random bit generation. SP 800-90A specifies approved deterministic random bit generator mechanisms; SP 800-90B covers entropy sources and SP 800-90C covers how to construct complete random bit generators. Revision 1 of 800-90A removed the Dual_EC_DRBG mechanism.
In practice. Organisations rely on validated cryptographic modules and operating system random number generators that implement these mechanisms, rather than writing their own. Developers use cryptographically secure APIs for keys, tokens and nonces. Evidence includes use of validated modules and code review showing secure random functions.
Common gaps. Common gaps are use of non-cryptographic random functions for security tokens and poor entropy in embedded or virtual environments. Cloned virtual machines that share random generator state are a further known risk.