---
title: NIST Standards for Data Security | Lattix
description: NIST publishes the standards US federal data security programs follow. Covers SP 800-207, SP 800-53 Rev 5, Cybersecurity Framework 2.0, and FIPS 203.
source: "https://lattix.io/blog/topics/nist/"
content-type: text/markdown
---

# NIST Standards for Data Security | Lattix

[Blog](https://lattix.io/blog/) [Topics](https://lattix.io/blog/topics/) NIST Standards and Guidance

Topic

# NIST Standards and Guidance

Reference hub on the NIST publications that define zero trust architecture, control baselines, AI risk practice, and post-quantum cryptography.

12posts

NIST, the National Institute of Standards and Technology, publishes the cryptographic standards and security guidance that United States federal systems follow and that many commercial programs adopt by choice. Its documents define zero trust architecture, control baselines, risk frameworks, and the algorithms that validated cryptographic modules implement.

NIST guidance describes architecture and outcomes; it does not specify products. NIST SP 800-207 names the policy decision point (PDP) and policy enforcement point (PEP) as logical components and leaves their placement to the implementer. Teams that read a control mapping as proof of enforcement miss that gap, since NIST SP 800-53 Rev 5 states what a control must achieve, not where it runs.

Posts under this hub cover NIST SP 800-207 and NIST SP 1800-35, the NIST Cybersecurity Framework 2.0, the NIST AI Risk Management Framework and NIST AI 600-1, NIST IR 8547 on post-quantum migration, and the FIPS 140-3 and FIPS 203 cryptographic standards. Several compare access models, including attribute-based access control (ABAC).

## Frequently asked questions

### What is the difference between a policy decision point and a policy enforcement point?

A policy decision point (PDP) evaluates a request against policy and returns a decision. A policy enforcement point (PEP) sits in the request path and carries that decision out, granting or blocking the access. NIST SP 800-207 defines both as logical components of a zero trust architecture. One product can host both roles, but the roles stay distinct.

### Does NIST SP 800-207 require object-level encryption?

No. NIST SP 800-207 describes a zero trust architecture in terms of components and decision flow: a policy decision point, a policy enforcement point, and per-request evaluation using subject, device, and environmental attributes. It treats data security as a required outcome and leaves the mechanism, including whether policy binds to individual data objects, to the implementer.

### What is FIPS 203?

FIPS 203 is the NIST standard for ML-KEM, a module-lattice post-quantum key encapsulation mechanism. It establishes shared secrets in a way that resists attack by a future cryptographically relevant quantum computer, taking over the role classical key exchange plays today. FIPS 203 covers key establishment only, since digital signature algorithms are standardized in separate publications.

### What changed in NIST Cybersecurity Framework 2.0?

NIST Cybersecurity Framework 2.0 added Govern as a sixth function alongside Identify, Protect, Detect, Respond, and Recover. It widened the stated audience beyond critical infrastructure to organizations of any size or sector, and expanded treatment of supply chain risk. The core structure of functions, categories, and subcategories carried over from the previous version.

## Reading on nist standards and guidance

[![Lattix branded cover for 30+ Days to FIPS 140-2 Sunset: The CMVP Validation Backlog Compounds the Calendar. Dark grid background, surgical yellow accent, IBM Plex Mono typography. Reference box reads CMVP MODULES IN PROCESS with the date 21 SEP 2026 and the figure 31 DAYS.](https://lattix.io/images/blog/fips-140-2-sunset-30-days-cmvp-backlog-cover.svg) 30+ Days to FIPS 140-2 Sunset: The CMVP Validation Backlog Compounds the Calendar August 21, 2026 Thirty-one days remain before FIPS 140-2 certificates move to historical status. The CMVP queue has already decided which modules make it. This post covers the queue math and what a program does with the modules that will not clear. Read More →](https://lattix.io/blog/fips-140-2-sunset-30-days-cmvp-backlog/)

[![Lattix branded cover for the NIST round three additional post-quantum signature schemes analysis. /28 section number, IBM Plex Mono on dark grid background, the May 14 2026 round-three date, nine advancing schemes with HAWK struck out after its July 29 2026 withdrawal, and a lineage strip showing signature agility at the policy enforcement point highlighted in surgical yellow.](https://lattix.io/images/blog/nist-round-3-additional-pqc-signatures-lineage-agility-cover.svg) NIST's Round-Three Signature Field Lost HAWK. Lineage Needs the Agility. August 21, 2026 NIST advanced nine signature candidates to round three on May 14, 2026. One, HAWK, was withdrawn on July 29 after a key-recovery attack. The signature track is the data provenance problem, and agility is now demonstrated rather than theoretical. Read More →](https://lattix.io/blog/nist-round-3-additional-pqc-signatures-lineage-agility/)

[![Lattix branded cover for Zero Trust Data Security in 2026: The Standards Map. /45 section number, dark grid background with surgical yellow accent rules, IBM Plex Mono typography, a reference box grouping the standards by the question each one settles, and a strip naming architecture, implementation, measurement, sequencing, cryptographic floor and AI systems.](https://lattix.io/images/blog/zero-trust-data-security-2026-standards-map-cover.svg) Zero Trust Data Security in 2026: The Standards Map August 21, 2026 Nine documents govern zero trust data security in 2026, and each settles a different question. This is the map of which standard answers what, and the one question none of them answers for you. Read More →](https://lattix.io/blog/zero-trust-data-security-2026-standards-map/)

[![Lattix branded cover for Data-Centric Security vs Zero Trust: How the Two Relate. Dark grid background, surgical yellow accent, IBM Plex Mono typography, with a reference box showing five zero trust pillars and a bound policy sitting inside the data pillar.](https://lattix.io/images/blog/data-centric-security-vs-zero-trust-cover.svg) Data-Centric Security vs Zero Trust: How the Two Relate August 20, 2026 Zero trust is the framework. Data-centric security is how its data pillar gets built. Zero trust governs identity, devices, networks, applications and data; data-centric security governs the last of those at the object rather than at the path. Read More →](https://lattix.io/blog/data-centric-security-vs-zero-trust/)

[![Lattix branded cover for What Is a Policy Decision Point. Dark grid background, surgical yellow accent, IBM Plex Mono typography, with a reference box showing a request arriving at a decision component and a signed allow or deny answer returning to an enforcement component in the request path.](https://lattix.io/images/blog/what-is-a-policy-decision-point-cover.svg) What Is a Policy Decision Point August 20, 2026 A policy decision point evaluates an access request against policy and returns allow or deny. NIST SP 800-207 splits it from the enforcement point, and that split is what makes real-time authorization possible. Read More →](https://lattix.io/blog/what-is-a-policy-decision-point/)

[![Lattix branded cover for ABAC, RBAC and ReBAC: Which Model Answers Which Question. Dark grid background, surgical yellow accent, IBM Plex Mono typography, with a reference box showing three policy models side by side above a single data object that each one describes differently.](https://lattix.io/images/blog/abac-rbac-rebac-compared-cover.svg) ABAC, RBAC and ReBAC: Which Model Answers Which Question August 19, 2026 RBAC grants by role, ABAC evaluates attributes at request time, ReBAC traverses relationships between subjects and objects. All three decide who may act. None of them decides whether a specific object should open under current conditions. Read More →](https://lattix.io/blog/abac-rbac-rebac-compared/)

[![Lattix branded cover for How to Give an AI Agent Access to Sensitive Data Safely. Dark grid background, surgical yellow accent, IBM Plex Mono typography, with a reference box showing an agent issuing repeated tool calls, each one hitting a separate authorization decision before any object opens.](https://lattix.io/images/blog/how-to-give-an-ai-agent-access-to-sensitive-data-cover.svg) How to Give an AI Agent Access to Sensitive Data Safely August 14, 2026 Give an AI agent a distinct identity, authorize each action rather than each session, require purpose as an asserted attribute, and enforce at the data object so derived artifacts stay governed. Read More →](https://lattix.io/blog/how-to-give-an-ai-agent-access-to-sensitive-data/)

[![Lattix branded cover for What Is Crypto Agility. Dark grid background, surgical yellow accent, IBM Plex Mono typography, with a reference box showing an algorithm identifier being swapped beneath an unchanged application interface while the protected object stays in place.](https://lattix.io/images/blog/what-is-crypto-agility-cover.svg) What Is Crypto Agility August 14, 2026 Crypto agility is the capability to replace cryptographic algorithms in systems already running, without rewriting the applications that depend on them. It is the property that makes post-quantum migration a configuration change rather than a rebuild. Read More →](https://lattix.io/blog/what-is-crypto-agility/)

[![Lattix branded cover for Data-Centric Security for Defense: A Reference Architecture. Dark grid background, surgical yellow accent, IBM Plex Mono typography, with a reference box showing seven stacked pillars and a labelled data object bound to a policy decision.](https://lattix.io/images/blog/data-centric-security-for-defense-reference-cover.svg) Data-Centric Security for Defense: A Reference Architecture August 13, 2026 Data-centric security for defense protects the data object itself rather than the network around it. This reference architecture maps the DoD Zero Trust Strategy data pillar to NIST SP 800-53 controls and to the NSA implementation phases. Read More →](https://lattix.io/blog/data-centric-security-for-defense-reference/)

[![Lattix branded cover for NIST AI 600-1 GenAI Profile Maps Cleanly to Data-Centric Controls. /28 section number, GAI risk-to-control mapping table, IBM Plex Mono on dark grid background, yellow accent on the data-pillar controls that satisfy multiple GAI risk categories from one primitive.](https://lattix.io/images/blog/nist-ai-600-1-genai-profile-data-centric-controls-cover.svg) NIST AI 600-1 GenAI Profile Maps Cleanly to Data-Centric Controls June 12, 2026 NIST AI 600-1 names the unique risks of foundation models. The mitigations the profile recommends, training data provenance, output attribution, access governance over model artifacts, are evidence categories that process attestation cannot supply. Data-centric architecture supplies them by construction. Read More →](https://lattix.io/blog/nist-ai-600-1-genai-profile-data-centric-controls/)

[![Lattix branded cover for NIST IR 8547 Sets the PQC Migration Floor. /26 section number, 2027 binding window date, federal civilian migration cohort statistic, IBM Plex Mono on dark grid background, surgical yellow accent on the migration milestone in a timeline strip.](https://lattix.io/images/blog/nist-ir-8547-pqc-migration-mid-2026-status-cover.svg) NIST IR 8547 Sets the PQC Migration Floor. The Calendar Bites in 2027. June 9, 2026 NIST IR 8547 establishes the federal post-quantum migration timeline. Mid-2026 progress data shows the schedule is tighter than most program offices have modeled. FIPS 140-3 module validation backlog compounds the risk. Cryptographic agility patterns are the schedule mitigation. Read More →](https://lattix.io/blog/nist-ir-8547-pqc-migration-mid-2026-status/)

[![Lattix branded cover for NIST's Critical Infrastructure AI RMF Profile Turns Trustworthy AI Into System Requirements. /16 section number, AI RMF four function diagram, IBM Plex Mono on dark grid background, surgical yellow accent.](https://lattix.io/images/blog/nist-critical-infrastructure-ai-rmf-profile-system-requirements-cover.svg) NIST's Critical Infrastructure AI RMF Profile Turns Trustworthy AI Into System Requirements May 12, 2026 NIST published the concept note for a Trustworthy AI in Critical Infrastructure Profile on April 7, 2026. The profile turns the AI RMF Govern, Map, Measure, Manage functions into system requirements for energy, water, and transportation operators. Data provenance and lineage map directly to the profile controls. Read More →](https://lattix.io/blog/nist-critical-infrastructure-ai-rmf-profile-system-requirements/)

## Related topics

- [Zero Trust Architecture](https://lattix.io/blog/topics/zero-trust/)
- [Data Security](https://lattix.io/blog/topics/data-security/)
- [Zero Trust Data Format](https://lattix.io/blog/topics/ztdf/)
- [Access Control](https://lattix.io/blog/topics/access-control/)
- [AI Security](https://lattix.io/blog/topics/ai-security/)
- [Post-Quantum Cryptography](https://lattix.io/blog/topics/post-quantum-cryptography/)

[All topics →](https://lattix.io/blog/topics/)