NIST Immunization Test Suite 

Facilitates Exchange of 

Immunization Data

ITL’s Text REtrieval Conference

(TREC) Program Celebrates 25 

Years

ITL Collaborates on Timing 

Challenges in the Smart Grid

ITL Diversity Committee Hosts 

Speaker from the U.S. Access 

Board

Staff Accomplishments

Selected New Publications

Upcoming Technical 

Conferences

NIST Immunization Test Suite Facilitates 

Exchange of Immunization Data 

The NIST Immunization Test Suite was used recently by the American Immunization Registries 

Association (AIRA) to report on Nationwide Immunization Registry Interoperability. The NIST 

Immunization Test Suite, developed in collaboration with the Center for Disease Control and 

Prevention (CDC) and AIRA, is a cornerstone of the AIRA Interoperability Testing Project. 

AIRA formally assessed 21 state Immunization Information Systems (IIS) for conformance with the 

CDC “Transport Layer Protocol Recommendation Version 1.2” specification for transmitting and 

receiving patient immunization records. This was an initial baseline snapshot, and assessments 

were performed again in December 2016 and then every 6 months thereafter. The NIST 

Immunization Test Suite automates testing of systems to the CDC specification and provides 

a detailed report of detected conformance issues. States whose IIS were found to be 

noncompliant with all or part of the CDC specification were sent detailed reports and encouraged to 

correct the issues. IIS developers are also encouraged to utilize the NIST Immunization Test Suite 

as part of their development life cycle to ensure conformance with the CDC specification prior to 

deployment.

AIRA is also using the NIST Immunization Test Suite to test IIS for conformance with the CDC’s 

“Immunization Messaging Implementation Guide Release 1.5,” which is itself based on the Health 

Level Seven International (HL7) standard version 2.5.1. AIRA is using the NIST conformance 

tooling to assess these IIS for conformant message structure. The NIST tooling automates the 

testing of HL7-based query, response, and acknowledgement messages. In addition to AIRA, there 

are several IIS in development that are using the NIST Immunization Test Suite to self-check their 

own implementations of query and response for conformance with “Immunization Messaging 

Implementation Guide Release 1.5.”

ITL’s work promotes trust in the IIS by testing the interoperability between systems exchanging 

patient immunization records. This results in IIS that provide up-to-date immunization records to 

healthcare professionals, patients, and parents. IIS can also be used to identify under-immunized 

children and to monitor immunization rates for a community. ITL researchers Robert Snelick, Harold 

Affo, Sandra Martinez, Sheryl Taylor, and Michael Indovina contributed to this work.

Credit: Shutterstock
ITL’s Text REtrieval Conference (TREC) 

Program Celebrates 25 Years

ITL’s Text REtrieval Conference program focuses on 

building the infrastructure necessary for evaluating---and 

thus improving---the quality of search engines. The TREC 

2016 conference, held in November, marked the 25th 

anniversary of the annual event. Web search engines didn't 

even exist 25 years ago, so TREC has contributed to 

unprecedented growth in the search industry over its 

lifetime. ITL’s Ellen Voorhees leads the TREC program.

A one-day celebration was held prior to the TREC 2016 

conference to mark the 25th milestone. The celebration 

consisted of talks and panel discussions reflecting on past 

accomplishments and looking forward to new challenges. 

Susan Dumais, Deputy Director of Microsoft Research, 

gave the keynote talk for the celebration. Other talks 

recounted the ways in which TREC has influenced web 

search, legal e-discovery, biomedical applications, and the 

development of Watson, IBM's Jeopardy!-champion 

question answering system. An archive of the webcast of 

the event is available at http://trec.nist.gov/

celebration/25thcelebration.html.

ITL Collaborates on Timing Challenges 

in the Smart Grid

IEEE and three NIST laboratories recently co-hosted a 

workshop on “Timing Challenges in the Smart Grid.” 

Precision timing—such as one microsecond 

synchronization to a traceable time and frequency 

reference—is an issue of growing interest and concern to 

engineers and scientists working with the smart grid and 

other cyber-physical systems. The greatly expanded use of 

synchronous sensors for wide-area monitoring, along with 

the increasing need for fault detection and location as well 

as maintaining system stability in real-time using spatiotemporal and temporal-frequency analyses, all require 

precision timing. These new capabilities offer increased 

flexibility to grid operators, but they also raise time-related 

security concerns.

At the workshop, these opportunities and challenges were 

addressed in a unique forum composed of power system 

experts, timing experts, and communications experts. The 

diversity of attendees enabled the workshop to make 

progress in identifying and analyzing the practical 

challenges that are currently being experienced in widearea time synchronization in current measurement and 

control deployments. Attendees also discussed timingrelated barriers that prevent the power industry from 

realizing future measurement and control technologies.

The outcomes of the workshop will inform a NIST report 

summarizing the challenges and potential solutions for 

wide-area clock synchronization as well as prioritizing 

future R&D and standards efforts in precision timing for 

power systems and other domains. The webcast and 

presentations are archived on the workshop webpage.

ITL Diversity Committee Hosts Speaker 

from the U.S. Access Board

The ITL Diversity Committee recently presented a talk on 

accessibility for the ITL staff. William R. Botten, 

Accessibility Specialist, Office of Technical and Information 

Services, U.S. Access Board, gave an inspiring 

presentation on the progress made in making all places in 

America accessible to people with physical disabilities. His 

talk was entitled “Accessibility – 25 Years after the Passing 

of the Americans with Disabilities Act (ADA).” Botten 

described the work of the U.S. Access Board and noted 

that while much progress has been made since the passing 

of the legislation in 1990, much remains to be done to 

ensure that all Americans can access the nation’s public 

buildings and open spaces.

Staff Accomplishments

Ronald Boisvert, Chief of ITL’s Applied and 

Computational Mathematics Division, was selected to be a 

2016 Fellow by the American Association for the 

Advancement of Science (AAAS). The award recognizes 

Boisvert’s distinguished contributions to the fields of 

mathematical software and computational science, 

excellence in public administration of science, and service 

to the computing profession. 

Ram D. Sriram, Chief of ITL’s Software and Systems 

Division, has been named an Institute of Electrical and 

Electronics Engineers (IEEE) Fellow, effective January 1, 

2017, for leadership in developing computational tools for 

healthcare enterprises. The IEEE grade of Fellow is 

conferred by the IEEE Board of Directors upon a person 

with an outstanding record of accomplishments in any of 

the IEEE fields of interest. 

Elham Tabassi, an electrical engineer in the 

Information Access Division, was one of four winners for 

the 2016 Women in Biometrics Award, which was 

presented by SecureIDNews and the Security Industry 

Association. She was selected from more than 100 

nominees and eight finalists. Finalists were selected based 

on contributions in one or more of the following areas to 

industry: leadership, participation, innovation, or mentoring. 

2
Selected New Publications

National Checklist Program for IT Products: 

Guidelines for Checklist Users and 

Developers

By Stephen D. Quinn, Murugiah Souppaya, 

Melanie Cook, and Karen Scarfone

NIST Special Publication 800-70, Revision 3

November 2015 (includes updates as of 12/8/2016, see 

Appendix G)

A security configuration checklist is a document that 

contains instructions or procedures for configuring an 

information technology (IT) product to an operational 

environment, for verifying that the product has been 

configured properly, and/or for identifying unauthorized 

changes to the product. To facilitate development of 

checklists and to make checklists more organized and 

usable, NIST established the National Checklist Program 

(NCP). This publication explains how to use the NCP to 

find and retrieve checklists, and it also describes the 

policies, procedures, and general requirements for 

participation in the NCP.

Protecting Controlled Unclassified Information in 

Nonfederal Systems and Organizations

By Ron Ross, Patrick Viscuso, Gary Guissanie, Kelley 

Dempsey, and Mark Riddle

NIST Special Publication 800-171 Revision 1

December 2016

The protection of Controlled Unclassified Information (CUI) 

resident in nonfederal systems and organizations is of 

paramount importance to federal agencies. This 

publication provides federal agencies with a set of 

recommended security requirements for protecting the 

confidentiality of CUI when such information is resident in 

nonfederal systems and organizations; when the 

nonfederal organization is not collecting or maintaining 

information on behalf of a federal agency or using or 

operating a system on behalf of an agency. 

Guide to Securing Apple OS X 10.10 Systems for IT 

Professionals: A NIST Security Configuration ChecklistBy 

Mark Badger, Murugiah Souppaya, Mark Trapnell, Eric 

Trapnell, Dylan Yaga, and Karen Scarfone

NIST Special Publication 800-179

December 2016

This publication assists IT professionals in securing Apple 

OS X 10.10 desktop and laptop systems within various 

environments. It provides detailed information about the 

security features of OS X 10.10 and security configuration 

guidelines. The publication recommends and explains 

tested, secure settings with the objective of simplifying the 

administrative burden of improving the security of OS X 

10.10 systems in three types of environments: Standalone, 

Managed, and Specialized Security-Limited Functionality.

Small Business Information Security: The Fundamentals

By Patricia Toth and Celia Paulsen

NISTIR 7621 Revision 1

November 2016

It is vitally important that each small business understand 

and manage the risk to information, systems, and networks 

that support their business. This document presents the 

fundamentals of a small business information security 

program in nontechnical language.

Dramatically Reducing Software Vulnerabilities: Report to 

the White House Office of Science and Technology Policy

By Paul E. Black, Lee Badger, Barbara Guttman, and 

Elizabeth Fong

NISTIR 8151

December 2016

The goal of this report is to present a list of specific 

technical approaches that have the potential to make a 

dramatic difference in reducing software vulnerabilities by 

stopping them before they occur, by finding them before 

they are exploited, or by reducing their impact.

Usability Testing of a Contactless Fingerprint Device: Part 

1

By Brian Stanton, Mary Theofanos, Susanne Furman, 

John M. Libert, Shahram Orandi, and John Grantham; 

NISTIR 8158; December 2016

Usability Testing of a Contactless Fingerprint Device: Part 

2

By Brian Stanton, Mary Theofanos, Susanne Furman, and 

Patrick Grother; NISTIR 8159; December 2016

The use of biometrics to identify individuals has become 

an important component of efforts to ensure U.S. national 

security, and has also grown rapidly. Biometrics are, for 

example, an integral part of the United States Visitor and 

Immigrant Status Indicator Technology (US-VISIT) 

program. To address contagion and speed issues, the 

Department of Homeland Security Science and 

Technology program commissioned and funded a project 

to research technologies that could be used to acquire 

fingerprints without physical contact. Overall, the 

contactless scanner took longer to acquire the prints, 

acquired fewer prints under the no instruction and video 

instructional conditions, and was preferred less than the 

contact scanner.

3
The Information Technology Laboratory (ITL) is a major research component of the National Institute of 

Standards and Technology (NIST). As a world-class measurement and testing laboratory encompassing a wide 

range of areas of computer science, mathematics, statistics, and systems engineering, our research program 

supports NIST’s mission to promote U.S. innovation and industrial competitiveness by advancing measurement 

science, standards, and technology in ways that enhance economic security and improve our quality of life. ITL 

cybersecurity experts collaborate to develop cybersecurity standards, guidelines, and associated methods and 

techniques for federal agencies and industry. Our mathematicians and statisticians collaborate with 

measurement scientists across NIST to help ensure that NIST maintains and delivers the world’s leading 

measurement capability. ITL computer scientists and other research staff provide technical expertise and 

development that underpins national priorities such as cloud computing, the Smart Grid, homeland security, 

information technology for improved healthcare, and electronic voting. We invite you to learn more about 

how ITL is enabling the future of the nation’s measurement and standards infrastructure for information 

technology by visiting our website at http://www.itl.nist.gov.

ITL Editor: Elizabeth B. Lennon

National Institute of Standards and Technology

100 Bureau Drive, Stop 8900

Gaithersburg, MD 20899-8900

Phone: (301) 975-2832

Fax: (301) 975-2378

Email: elizabeth.lennon@nist.gov

TO SUBSCRIBE TO THE

ELECTRONIC EDITION OF THE

ITL NEWSLETTER, GO TO

ITL HOMEPAGE

Upcoming Technical 

Conferences

NSCI Seminar: New Directions for Energy-Efficient 

Computing Systems: From Sensing and Design to 

Runtime Management

Date: January 17, 2017

Place: NIST, Gaithersburg, Maryland

Sponsor: National Strategy Computing Initiative (NSCI) 

Committee

Cost: None

Power consumption is one of the major barriers towards 

improving the performance of computing systems. The exascale road map calls for exa-scale performance within a 

power budget of 20 - 40 MW, which requires much higher 

energy efficiency compared to those of existing computing 

systems. This talk reviews our laboratory's efforts to 

improve the energy efficiency of computing systems on 

three fronts that span measurements, design, and runtime 

management.

NIST contact: Barry Schneider, barry.schneider@nist.gov

NSCI Seminar: HPC in the Small: Current Results, 

Lessons Learned, and Future Work

Date: January 31, 2017

Place: NIST, Gaithersburg, Maryland

Sponsor: National Strategy Computing Initiative (NSCI) 

Committee

Cost: None

“HPC in the Small” has been successfully used to 

accelerate various computations by 2-4 orders of 

magnitude. In this talk, “HPC in the Small” will be defined, 

some of the results that have currently been achieved will 

be reviewed, and future directions of the work and how it 

fits within the context of NSCI will be discussed.

NIST contact: Barry Schneider, barry.schneider@nist.gov

30th Annual Federal Information Systems Security 

Educators’ Association (FISSEA) Conference

Dates: March 14-15, 2017

Place: NIST, Gaithersburg, Maryland

Sponsors: NIST and FISSEA

Cost: TBD

The theme of this year’s conference is Securing the Future 

to Infinity and Beyond: 30 Years of Improving Cybersecurity 

through Awareness, Training, and Education. The audience 

will consist of managers responsible for information 

systems security training programs in federal agencies, 

contractors providing awareness and training support, and 

faculty members of accredited educational institutions who 

are involved in information security training and education. 

FISSEA serves as a forum for the exchange of information 

about information security awareness, training, education, 

and certification.

NIST contact: Peggy Himes, peggy.himes@nist.gov

Disclaimer: Any mention of commercial products or reference to 

commercial organizations is for information only; it does not imply 

recommendation or endorsement by the National Institute of 

Standards and Technology nor does it imply that the products 

mentioned are necessarily the best available for the purpose.

The NIST campus at Gaithersburg, MD.

Credit: NIST

4