Topic · nist-800-172

NIST SP 800-172

RSS feed ↗

regulator
GovRAMP Policy Papers Push OMB-Led Reciprocity for Cybersecurity Frameworks
GovRAMP released two publications on April 16 calling for harmonization of overlapping federal and state cybersecurity frameworks built on NIST SP 800-53. The policy white paper identifies OMB-led reciprocity anchored in shared baselines as the highest-impact near-term action. State, local, tribal, and territorial governments are most affected by duplicated compliance efforts and delayed procurement. No rulemaking is proposed; the publications are recommendations intended to support coordinated execution under existing authority.
TODAY
trade-press
NIST to release AI cybersecurity framework draft this summer
NIST plans to publish a draft cybersecurity framework profile for AI systems this summer, according to Victoria Pillitteri, manager of NIST's Security Engineering and Risk Management Group. The guidance will include control overlays for predictive, agentic, and generative AI systems, with the predictive AI overlay arriving this summer and agentic guidance due in late summer to early fall. NIST aims to finalize all guidance by 2027. Organizations adopting AI should track the draft for baseline cybersecurity controls that may affect vendor and supply chain security requirements.
TODAY
trade-press
Draft executive order sets 2030-2031 PQC deadlines for federal agencies, contractors
A White House draft executive order would require federal agencies to migrate digital signatures for high-impact systems to post-quantum cryptography (PQC) by Dec. 31, 2031, and key establishment to PQC by Dec. 31, 2030, according to sections viewed by Nextgov/FCW. Covered contractors working with federal agencies face a 2030 deadline to comply with NIST-developed PQC standards. National security systems are excluded from the mandate. The order is expected to be released as soon as this week, a source told Nextgov/FCW.
TODAY
standards
Fortinet vulnerabilities allow arbitrary code execution across 16 products
CIS published an advisory on multiple vulnerabilities in Fortinet products including FortiOS, FortiManager, FortiAnalyzer, and FortiClientEMS. The most severe could let an attacker execute arbitrary code under the affected service account. Organizations covered under NIST SP 800-171 and 800-172 that use these products should apply patches and validate that affected systems are not out of compliance with security control requirements. CIS did not publish a specific CVE list or patch timeline in this advisory; further review of Fortinet security bulletins is advised.
TODAY

NIST SP 800-172

GovRAMP Policy Papers Push OMB-Led Reciprocity for Cybersecurity Frameworks

NIST to release AI cybersecurity framework draft this summer

Draft executive order sets 2030-2031 PQC deadlines for federal agencies, contractors

Fortinet vulnerabilities allow arbitrary code execution across 16 products