NIST sets guides on infosec buys

NIST Special Publication 800-23

The National Institute of Standards and Technology has released its final

guidelines on how civilian agencies should procure information security

products.

Under the new guidelines, NIST Special Publication 800-23, released

Sept. 8, NIST recommends that agencies acquire security products that have

undergone independent testing and evaluation.

"Federal agencies should give substantial consideration in IT procurement

and deployment for IT products that have been evaluated and tested by independent

accredited laboratories against appropriate security specifications and

requirements," the guide states.

The main type of testing recommended by the publication is the international

Common Criteria Evaluation and Validation Program, overseen in the United

States by the National Information Assurance Partnership under NIST and

the National Security Agency.

Using the Common Criteria Evaluation, agencies can be assured that the

security products will perform the way a vendor promises. The products are

tested by private-sector laboratories accredited by the National Information

Assurance Partnership.

NIST cautions, however, that agencies still need to ensure that a security

product fits into their overall architectures and meets their needs because

a Common Criteria-tested product may not be the best security product.

"It is important to note that purchasing an evaluated product just because

it is evaluated, and without due consideration of applicable functional

and assurance requirements, may be neither useful nor cost-effective," the

guide states.

Featured

  • Defense
    Ryan D. McCarthy being sworn in as Army Secretary Oct. 10, 2019. (Photo credit: Sgt. Dana Clarke/U.S. Army)

    Army wants to spend nearly $1B on cloud, data by 2025

    Army Secretary Ryan McCarthy said lack of funding or a potential delay in the JEDI cloud bid "strikes to the heart of our concern."

  • Congress
    Rep. Jim Langevin (D-R.I.) at the Hack the Capitol conference Sept. 20, 2018

    Jim Langevin's view from the Hill

    As chairman of of the Intelligence and Emerging Threats and Capabilities subcommittee of the House Armed Services Committe and a member of the House Homeland Security Committee, Rhode Island Democrat Jim Langevin is one of the most influential voices on cybersecurity in Congress.

Stay Connected

FCW INSIDER

Sign up for our newsletter.

I agree to this site's Privacy Policy.