Cultivating Trust through NIST’s 

Cybersecurity and Privacy Program

Kevin Stine, Chief of the Applied Cybersecurity Division, 

Information Technology Laboratory

VCAT

October 26, 2021
We cultivate trust by advancing 

cybersecurity and privacy standards 

and guidelines, technology, and 

measurement science.

Mission
What we do...

Fundamental 

Research

Applied 

Research

Standards, 

Guidelines, and 

Practices

Transition to 

Practice

Image Credit: wsj.com
Work in an open, transparent, and 

collaborative way

Enlist best expertise from around the 

world

Share solutions

Listen

How we do it.... 
Current Priority Areas

• Cryptography

• Education, Training, and Workforce 

Development

• Emerging Technologies

• Identity and Access Management

• Privacy

• Risk Management and 

Measurement

• Trustworthy Networks and 

Platforms

Image Credit: Pixabay
National Cybersecurity Center of Excellence

Accelerate adoption of secure 

technologies: collaborate with 

innovators to provide real-world, 

standards-based cybersecurity 

capabilities that address business needs
Current NCCoE Projects Include...

• Crypto Agility: Considerations for 

Migrating to Post-Quantum 

Crypto Algorithms

• Implementing a Zero Trust 

Architecture

• 5G Cybersecurity

• Ransomware Risk Management

• Supply Chain Assurance: 

Validating the Integrity of 

Computing Devices

• Securing the Industrial Internet of 

Things: Cybersecurity for 

Distributed Energy Resources

• Cybersecurity for Genomics Data
Current Mandates

• National Defense Authorization Act of 2021

Including the DIGIT, LEAP, and HACKED Acts

• Internet of Things Cybersecurity Improvement Act

• Executive Order (EO) 14028, Improving the Nation’s Cybersecurity

• National Security Memorandum on Improving Cybersecurity of 

Critical Infrastructure Control Systems

• National Strategy to Secure 5G

• ...
EO 14028 issued

Day 0 –

May 12, 2021

Solicit input from 

stakeholders (4b)

Day 30 –

June 11, 2021

Publish definition of 

“critical software” (4g)

Day 45 –

June 26, 2021

Publish guidance outlining 

security measures for 

critical software (4i)

Publish guidelines 

recommending minimum 

standards for vendor 

testing of SW source code 

(4r)

Day 60 –

July 11, 2021

Publish preliminary 

guidelines for enhancing 

SW SC security (4c)

Day 180 –

Nov 8, 2021

Issue guidance identifying 

practices that enhance 

security of SW SC (4e)

Initiate pilot programs, 

identifying IoT cyber & 

secure SW development 

practices or criteria for 

consumer labeling 

programs (4s, 4t, 4u)

Day 270 –

Feb 6, 2022

Publish additional 

guidelines, including 

review/update 

procedures (4d)

Day 360 –

May 8, 2022

Review & submit summary 

report of pilot programs 

(4w)

Day 365 –

May 13, 2022

NIST’s EO 14028 Timeline
Ways We Engage...

• Participate with others in developing 

standards,

• Coordinate and conduct joint activities with 

federal agencies, 

• Take part in international initiatives and 

information sharing, 

• Convene special topic forums and workshops, 

• Collaborate via research with industry and 

academia, 

• Solicit and receive comments on publications, 

and 

• Listen closely.
Discussion