# NIST Standards

The U.S. National Institute of Standards and Technology establishes standards for a wide range of things. Some of the standards most important to network security are discussed in this section.

## **NIST SP 800-14**

Special Publication 800-14, Generally Accepted Principles and Practices for Securing Information Technology Systems, describes common security principles that should be addressed within security policies. The purpose of this document is to describe 8 principles and 14 practices that can be used to develop security policies. This standard is based on 8 principles, which are:

1\. Computer security supports the mission of the organisation.

2\. Computer security is an integral element of sound management.

3\. Computer security should be cost-effective.

4\. System owners have security responsibilities outside their own organisations.

5\. Computer security responsibilities and accountability should be made explicit.

6\. Computer security requires a comprehensive and integrated approach.

7\. Computer security should be periodically reassessed.

8\. Computer is security is constrained by societal factors.

## **NIST SP 800-35**

NIST SP 800-35, Guide to Information Technology Security Services, is an overview of information security. In this standard six phases of the IT security life cycle are defined:

* **Phase 1: Initiation.** At this point the organisation is looking into implementing some IT security service, device, or process.
* **Phase 2: Assessment.** This phase involves determining and describing the organisation’s current security posture. It is recommended that this phase use quantifiable metrics.
* **Phase 3: Solution.** This is where various solutions are evaluated and one or more are selected.
* **Phase 4: Implementation.** In this phase the IT security service, device, or process is implemented.
* **Phase 5: Operations.** Phase 5 is the ongoing operation and maintenance of the security service, device, or process that was implemented in phase 4.
* **Phase 6: Closeout.** At some point, whatever was implemented in phase 4 will be concluded. Often this is when a system is replaced by a newer and better system.

## **NIST SP 800-30 Rev. 1**

NIST SP 800-30 Rev. 1, Guide for Conducting Risk Assessments, is a standard for conducting risk assessments. Risk assessments were discussed in a previous chapter. This standard provides guidance to how to conduct such an assessment. There are nine steps in the process:

**STEP 1.** System Characterization

**STEP 2.** Threat Identification

**STEP 3.** Vulnerability Identification

**STEP 4.** Control Analysis

**STEP 5.** Likelihood Determination

**STEP 6.** Impact Analysis

**STEP 7.** Risk Determination

**STEP 8.** Control Recommendations

**STEP 9.** Results documentation<br>