NIST (National Institute of Standards and Technology) is a US government agency, part of the Department of Commerce, that develops measurement standards, reference data and technology guidelines. It is non-regulatory: it does not enforce anything, but its publications, such as the Cybersecurity Framework, the SP 800 security series, FIPS encryption standards and the SI unit guides, are used as the reference by governments and companies worldwide, including in India.
The official site is nist.gov. This page explains what NIST actually produces, which parts an engineering or computer science student is likely to use, and what changed in 2024 to 2026.
NIST at a glance
| Full form | National Institute of Standards and Technology |
|---|---|
| Founded | 1901, as the National Bureau of Standards (renamed NIST in 1988) |
| Parent | US Department of Commerce |
| Main campuses | Gaithersburg, Maryland and Boulder, Colorado |
| Director | Arvind Raman, 18th director, sworn in 30 June 2026 (previously dean of engineering at Purdue University) |
| Laboratories | Physical Measurement, Material Measurement, Engineering, Information Technology, Communications Technology |
| Nobel Prizes | Five, to NIST-connected physicists William Phillips, Eric Cornell, John Hall, David Wineland and Dan Shechtman (chemistry) |
| Mission | “To promote U.S. innovation and industrial competitiveness by advancing measurement science, standards, and technology” |
What does NIST do?
NIST’s work falls into four areas. Most people only know the cybersecurity part, but it started, and still spends much of its effort, on measurement.
- Measurement science (metrology). NIST maintains the US realisation of the SI units, runs atomic clocks that contribute to world time, and calibrates instruments so that a kilogram, a volt or a second means the same thing in every lab and factory.
- Reference materials and data. It sells certified Standard Reference Materials (for example, a steel sample with a certified carbon content) that labs use to check their instruments, and publishes free reference data such as the CODATA values of physical constants and the NIST Chemistry WebBook.
- Cybersecurity and cryptography standards. The Cybersecurity Framework, the SP 800 series, FIPS encryption standards, the post-quantum algorithms and the National Vulnerability Database.
- Emerging technology. Guidance on AI (the AI Risk Management Framework, and the Center for AI Standards and Innovation, renamed from the US AI Safety Institute in June 2025), quantum, advanced manufacturing and communications.
NIST publications an engineering student will actually use
NIST publishes thousands of documents. This table lists the ones that come up in coursework, projects, interviews and industry, grouped by branch.
| Publication / resource | What it is | Who uses it |
|---|---|---|
| Cybersecurity Framework (CSF) 2.0 | A high-level structure for managing cyber risk, organised into six functions | CS/IT, security teams, auditors, management |
| SP 800-53 Rev. 5 | Catalogue of security and privacy controls (access control, audit, incident response and more) | Security engineers, compliance teams |
| SP 800-63-4 (2025) | Digital identity guidelines, including modern password rules | Developers building login systems |
| SP 800-61, 800-115, 800-30 | Incident handling, security testing, and risk assessment guides | SOC analysts, penetration testers |
| SP 800-90A/B/C, SP 800-22 | Random bit generators and statistical tests for randomness | Cryptography and embedded developers |
| FIPS 197 (AES), FIPS 180-4 and 202 (SHA-2, SHA-3), FIPS 186-5 (signatures) | The encryption and hashing algorithms inside TLS, disk encryption and code signing | CS/IT, electronics (secure hardware) |
| FIPS 203, 204, 205 | Post-quantum encryption and signature standards (August 2024) | Anyone building long-lived secure systems |
| National Vulnerability Database (NVD) | Public database that adds severity scores and product data to published CVEs | Security and DevOps teams |
| AI RMF 1.0 and NIST AI 600-1 | Framework for managing AI risks, plus a generative-AI profile | AI/ML engineers, product teams |
| SP 811 (Guide for the Use of the SI) | How to write and use SI units correctly | Every branch, report writing |
| Handbook 44 | Specifications for commercial weighing and measuring devices in the US | Instrumentation, mechanical |
| CODATA constants, Chemistry WebBook | Authoritative values of constants and thermophysical data | Chemical, mechanical, physics labs |
| time.gov and NTP servers (time.nist.gov) | Official US time and public network time servers | Networking, embedded systems |
The “SP” prefix means Special Publication (guidance). “FIPS” means Federal Information Processing Standard, which is mandatory for US federal systems. “NIST IR” is an internal or interagency report, often a draft roadmap.
The NIST Cybersecurity Framework 2.0
The NIST Cybersecurity Framework (CSF) is a voluntary framework that helps any organisation, of any size, understand and reduce its cybersecurity risk. Version 2.0 was published in February 2024 and replaced version 1.1 from 2018. Its core is six functions:
| Function | Question it answers | Example outcomes |
|---|---|---|
| Govern (GV) (new in 2.0) | Who is accountable, and what is our risk strategy? | Roles and responsibilities, risk appetite, policy, supply-chain risk management |
| Identify (ID) | What do we have and what are the risks? | Asset inventory, risk assessment, improvement plans |
| Protect (PR) | How do we prevent incidents? | Identity and access control, training, data security, patching |
| Detect (DE) | How do we spot attacks? | Continuous monitoring, analysis of anomalies |
| Respond (RS) | What do we do during an incident? | Incident management, analysis, communication, containment |
| Recover (RC) | How do we get back to normal? | Restoring systems and data, communicating recovery |
Many articles still describe “the five functions of the NIST framework”. That was version 1.1. CSF 2.0 added Govern, which sits across the other five and makes cybersecurity a leadership responsibility rather than only an IT one. It also widened the scope from critical infrastructure to all organisations.
The framework has two other parts. Profiles describe an organisation’s current and target state against the outcomes (the gap between them becomes the action plan). Tiers (Partial, Risk Informed, Repeatable, Adaptive) describe how mature and rigorous its practices are.
NIST password rules (SP 800-63B-4, 2025)
These rules surprise people because they reverse old habits. Under the 2025 revision:
- Passwords used as the only factor must be at least 15 characters; passwords used with a second factor must be at least 8.
- Systems should allow at least 64 characters and accept spaces and all printable characters.
- Systems must not impose composition rules such as “one capital, one number, one symbol”.
- Systems must not force periodic password changes; change only when there is evidence of compromise.
- New passwords should be checked against lists of breached and common passwords.
The reasoning is that length adds far more guessing resistance than forced symbols, and forced changes push people into predictable patterns such as Summer2026! becoming Autumn2026!.
Post-quantum cryptography: NIST’s biggest recent change
A large enough quantum computer could break RSA and elliptic-curve cryptography, which protect almost all internet traffic today. Data recorded now could be decrypted later (“harvest now, decrypt later”), so NIST ran an open competition from 2016 and published the first three post-quantum standards on 13 August 2024.
| Standard | Algorithm | Based on | Purpose | Status (Sept 2026) |
|---|---|---|---|---|
| FIPS 203 | ML-KEM | CRYSTALS-Kyber | Key establishment (encryption) | Final, August 2024 |
| FIPS 204 | ML-DSA | CRYSTALS-Dilithium | Digital signatures (main choice) | Final, August 2024 |
| FIPS 205 | SLH-DSA | SPHINCS+ | Hash-based signatures (backup) | Final, August 2024 |
| FIPS 206 (draft) | FN-DSA | FALCON | Compact signatures | Draft; final expected late 2026 or 2027 |
| (to be assigned) | HQC | Code-based | Backup key establishment | Selected March 2025; standard in preparation |
NIST’s draft transition roadmap, NIST IR 8547 (November 2024), proposes that RSA and elliptic-curve algorithms at the 112-bit security level be deprecated after 2030 and that all RSA and ECC be disallowed after 2035. The document was still a draft in mid-2026, but many organisations already plan to those dates.
NIST and vulnerabilities: the NVD and the 2026 change
The National Vulnerability Database (NVD), run by NIST, takes each published CVE (a publicly known vulnerability) and “enriches” it with a CVSS severity score, the list of affected products (CPE) and a weakness type (CWE). Scanners and patch tools depend on this data.
CVE volumes grew 263% between 2020 and 2025, and NIST could not keep up. On 15 April 2026, NIST announced that it now enriches with priority only three groups: CVEs in CISA’s Known Exploited Vulnerabilities catalogue, CVEs in software used by the US federal government, and CVEs in software designated critical under Executive Order 14028. Other CVEs are still listed but marked “Lowest Priority”, and NIST no longer adds its own score when the organisation that published the CVE has already scored it. Backlogged CVEs published before 1 March 2026 were moved to “Not Scheduled”.
In practice, security teams can no longer assume every CVE in the NVD has a NIST score. They now combine vendor and CNA scores, the CISA KEV list and exploit-probability scores. Our guide to vulnerability assessment walks through how to prioritise with those sources.
NIST and measurement: why it matters beyond computers
- Traceability. A calibration certificate that says “traceable to NIST” means the instrument was compared, through an unbroken chain of calibrations, against NIST’s standards. Indian labs usually state traceability to CSIR-NPL instead, and both chains meet at the international SI level.
- The 2019 SI redefinition. NIST’s Kibble balance helped measure the Planck constant precisely enough to redefine the kilogram in 2019, ending the use of a physical metal cylinder as the world’s mass standard. The metric conversion guide lists all seven SI base-unit definitions.
- Time. NIST’s caesium fountain clocks help set Coordinated Universal Time, and its radio station WWVB sets millions of “atomic” wall clocks in North America.
- Materials and fire research. NIST led the technical investigation of the World Trade Center collapses, which fed into later building-code changes on fire resistance and evacuation.
NIST vs ISO vs BIS vs CERT-In: who does what?
| Body | Country | Type | Typical output | Binding? |
|---|---|---|---|---|
| NIST | USA | Government measurement and standards lab | CSF 2.0, SP 800, FIPS, reference data | FIPS are binding on US federal systems; the rest is voluntary |
| ISO / IEC | International | Standards organisation of national bodies | ISO/IEC 27001 (security management), ISO 9001 | Voluntary; certification is often a contract requirement |
| BIS | India | National standards body | IS codes (IS 456, IS 800), ISI mark | Mandatory where notified (e.g. many products under QCOs) |
| CSIR-NPL | India | National metrology institute (India’s counterpart to NIST’s measurement role) | National standards of SI units, Indian Standard Time | Basis for legal metrology |
| CERT-In | India | National cybersecurity agency under MeitY | Incident reporting directions, audit guidelines, advisories | Its directions are binding on covered entities |
Is NIST compliance required in India?
No Indian law requires NIST compliance as such. Indian organisations follow CERT-In’s directions and guidelines, sector regulators such as RBI and SEBI, and often ISO/IEC 27001 certification. In practice, NIST documents are still everywhere in Indian industry: SEBI’s Cybersecurity and Cyber Resilience Framework (August 2024) draws on the NIST CSF structure, multinational clients ask Indian IT vendors to map their controls to NIST SP 800-53 or CSF, and companies selling to the US government must meet NIST SP 800-171. Knowing the NIST vocabulary is a practical advantage in security and IT interviews.
Frequently asked questions
What is the full form of NIST?
NIST stands for National Institute of Standards and Technology. It is a US federal agency under the Department of Commerce, founded in 1901 as the National Bureau of Standards.
What are the six functions of the NIST Cybersecurity Framework?
Govern, Identify, Protect, Detect, Respond and Recover. Govern was added in CSF 2.0 in February 2024; the earlier version 1.1 had only the other five.
Is NIST a regulatory agency?
No. NIST is non-regulatory and cannot fine or enforce. Its standards become binding only when a law, regulator or contract requires them, such as FIPS for US federal systems or SP 800-171 for US defence contractors.
What is the difference between NIST CSF and ISO 27001?
NIST CSF is a free, voluntary framework of outcomes that helps you organise and communicate cyber risk. ISO/IEC 27001 is a certifiable management-system standard with formal requirements and external audits. Many organisations use CSF to plan and ISO 27001 to certify.
Which NIST standard covers encryption?
FIPS 197 defines AES, the standard symmetric cipher. Hashing is covered by FIPS 180-4 (SHA-2) and FIPS 202 (SHA-3), digital signatures by FIPS 186-5, and post-quantum algorithms by FIPS 203, 204 and 205.
Related on EngineeringHulk: vulnerability assessment guide · how to become a cyber security engineer · intrusion prevention systems · random number generator · ISO standards and certification