All news with #nist sp 800 53 tag

🔐 The Cybersecurity and Infrastructure Security Agency (CISA) and the National Institute of Standards and Technology (NIST) published Interagency Report 8587 on September 15 to protect cloud identity tokens and assertions used in SSO, identity federation and API access. The guidance, which is voluntary, warns that adversaries are increasingly targeting tokens to move laterally and access sensitive data. It prescribes short token lifetimes, scoped key usage, hardware-backed key storage for moderate impact and above, and strict logging and audience validation rules.

🔒 The Trusted Computing Group (TCG) published guidance on August 24 to help organizations verify that trusted platform modules (TPMs) meet post-quantum cryptography (PQC) requirements. The guidance complements the TCG PC Client Platform TPM Profile (PTP) 1.07, developed with contributions from major vendors, and defines two readiness categories: TCG PQC-ready TPM and TCG PQC-upgradable TPM. TCG also plans to extend its certification programs to cover PQC readiness.

🔒 This guide explains regulatory timelines and a strategic playbook for CISOs and senior leaders to manage post-quantum cryptography (PQC) migrations across large organizations. It outlines the practical split between short‑lived protocol upgrades (like TLS) and long‑lived embedded devices, recommends centralized governance via a cryptography center of excellence, and emphasizes board-level framing, vendor engagement, and phased execution to meet compliance deadlines.

🆕 Research and Engineering Studio (RES) on AWS version 2025.12 is now available, introducing tag propagation for CloudFormation resources, enhanced Windows domain configuration options, and a default session scheduling capability. Administrators can disable automatic Windows domain joining to implement custom domain-join logic where required. The release also includes security improvements to help meet NIST 800-223 guidance and fixes a bug that caused some sessions to log out after two minutes when using a custom DNS domain.

🛡️ NIST and CISA released the initial draft of Interagency Report (IR) 8597, offering implementation guidance to protect identity tokens and assertions from forgery, theft, and misuse. The draft, open for public comment through January 30, 2026, targets federal agencies and cloud service providers. It reviews controls for IAM systems that rely on digitally signed tokens and calls on CSPs to adopt Secure by Design principles while prioritizing transparency, configurability, and interoperability. The report also urges agencies to understand CSP architectures and deployment models to align protections with their risk and threat environment.

⚠️A protected whistleblower alleges that the Department of Government Efficiency (DOGE) copied the Social Security Administration's NUMIDENT database to an unsecured Amazon Web Services test environment, bypassing mandated oversight and authorization. The complaint names several DOGE-affiliated hires and documents approvals and risk assessments dated June 12, June 25, and July 25, 2025. It alleges the move circumvented required FISMA authorization and NIST SP 800-53 controls, exposing sensitive personal data for more than 300 million people and potentially violating the Privacy Act and the CFAA.