Topic
NIST Standards and Guidance
Reference hub on the NIST publications that define zero trust architecture, control baselines, AI risk practice, and post-quantum cryptography.
12 posts
NIST, the National Institute of Standards and Technology, publishes the cryptographic standards and security guidance that United States federal systems follow and that many commercial programs adopt by choice. Its documents define zero trust architecture, control baselines, risk frameworks, and the algorithms that validated cryptographic modules implement.
NIST guidance describes architecture and outcomes; it does not specify products. NIST SP 800-207 names the policy decision point (PDP) and policy enforcement point (PEP) as logical components and leaves their placement to the implementer. Teams that read a control mapping as proof of enforcement miss that gap, since NIST SP 800-53 Rev 5 states what a control must achieve, not where it runs.
Posts under this hub cover NIST SP 800-207 and NIST SP 1800-35, the NIST Cybersecurity Framework 2.0, the NIST AI Risk Management Framework and NIST AI 600-1, NIST IR 8547 on post-quantum migration, and the FIPS 140-3 and FIPS 203 cryptographic standards. Several compare access models, including attribute-based access control (ABAC).
Frequently asked questions
What is the difference between a policy decision point and a policy enforcement point?
A policy decision point (PDP) evaluates a request against policy and returns a decision. A policy enforcement point (PEP) sits in the request path and carries that decision out, granting or blocking the access. NIST SP 800-207 defines both as logical components of a zero trust architecture. One product can host both roles, but the roles stay distinct.
Does NIST SP 800-207 require object-level encryption?
No. NIST SP 800-207 describes a zero trust architecture in terms of components and decision flow: a policy decision point, a policy enforcement point, and per-request evaluation using subject, device, and environmental attributes. It treats data security as a required outcome and leaves the mechanism, including whether policy binds to individual data objects, to the implementer.
What is FIPS 203?
FIPS 203 is the NIST standard for ML-KEM, a module-lattice post-quantum key encapsulation mechanism. It establishes shared secrets in a way that resists attack by a future cryptographically relevant quantum computer, taking over the role classical key exchange plays today. FIPS 203 covers key establishment only, since digital signature algorithms are standardized in separate publications.
What changed in NIST Cybersecurity Framework 2.0?
NIST Cybersecurity Framework 2.0 added Govern as a sixth function alongside Identify, Protect, Detect, Respond, and Recover. It widened the stated audience beyond critical infrastructure to organizations of any size or sector, and expanded treatment of supply chain risk. The core structure of functions, categories, and subcategories carried over from the previous version.
