Attachment L -ADL.pdf

Applicable Documents List

ATTACHMENT L

APPLICABLE DOCUMENTS LIST (ADL)

DRFP 80GSFC24R0027

UPDATED VERSION: 04/11/2024

CONTRACT TBD

SP 800-204A Building Secure Microservices-based Applications Using Service-Mesh Architecture

May, 2020

SP 800-204 Security Strategies for Microservices-based Application Systems

August, 2019

SP 800-202 Quick Start Guide for Populating Mobile Test Devices May, 2018 SP 800-193 Platform Firmware Resiliency Guidelines May, 2018 SP 800-192 Verification and Test Methods for Access Control

Policies/Models June, 2017

SP 800-190 Application Container Security Guide September, 2017 SP 800-189 Resilient Interdomain Traffic Exchange: BGP Security and

DDoS Mitigation December, 2019

SP 800-187 Guide to LTE Security December, 2017 SP 800-185 SHA-3 Derived Functions: cSHAKE, KMAC, TupleHash, and

ParallelHash December, 2016

SP 800-184 Guide for Cybersecurity Event Recovery December, 2016 SP 800-183 Networks of 'Things' July, 2016 SP 800-181 Rev. 1 Workforce Framework for Cybersecurity (NICE Framework) November, 2020 SP 800-178 A Comparison of Attribute Based Access Control (ABAC)

Standards for Data Service Applications: Extensible Access Control Markup Language (XACML) and Next Generation Access Control (NGAC)

October, 2016

SP 800-177 Rev. 1 Trustworthy Email February, 2019 SP 800-175B Rev. 1 Guideline for Using Cryptographic Standards in the Federal

Government: Cryptographic Mechanisms March, 2020

SP 800-175A Guideline for Using Cryptographic Standards in the Federal Government: Directives, Mandates and Policies

August, 2016

SP 800-172A Assessing Enhanced Security Requirements for Controlled Unclassified Information

March, 2022

SP 800-172 Enhanced Security Requirements for Protecting Controlled Unclassified Information: A Supplement to NIST Special Publication 800-171

February, 2021

SP 800-171 Rev. 2 Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations

January, 2021

SP 800-171A Assessing Security Requirements for Controlled Unclassified Information

June, 2018

SP 800-168 Approximate Matching: Definition and Terminology May, 2014 SP 800-167 Guide to Application Whitelisting October, 2015 SP 800-166 Derived PIV Application and Data Model Test Guidelines June, 2016 SP 800-163 Rev. 1 Vetting the Security of Mobile Applications April, 2019 SP 800-162 Guide to Attribute Based Access Control (ABAC) Definition and Considerations August, 2019

SP 800-161 Rev. 1 Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations

May, 2022

SP 800-160 Vol. 2 Rev. 1

Developing Cyber-Resilient Systems: A Systems Security Engineering Approach

December, 2021

SP 800-160 Vol. 1 Rev. 1

Systems Security Engineering: Considerations for a Multidisciplinary Approach in the Engineering of Trustworthy Secure Systems

November, 2022

SP 800-157 Guidelines for Derived Personal Identity Verification (PIV) Credentials

December, 2014

SP 800-156 Representation of PIV Chain-of-Trust for Import and Export May, 2016 SP 800-153 Guidelines for Securing Wireless Local Area Networks

(WLANs) February, 2012

SP 800-152 A Profile for U.S. Federal Cryptographic Key Management Systems (CKMS)

October, 2015

SP 800-150 Guide to Cyber Threat Information Sharing October, 2016 SP 800-147B BIOS Protection Guidelines for Servers August, 2014 SP 800-147 BIOS Protection Guidelines April, 2011 SP 800-146 Cloud Computing Synopsis and Recommendations May 29, 2012 SP 800-145 The NIST Definition of Cloud Computing September, 2011 SP 800-144 Guidelines on Security and Privacy in Public Cloud

Computing December, 2011

SP 800-142 Practical Combinatorial Testing October, 2010 SP 800-140F CMVP Approved Non-Invasive Attack Mitigation Test

Metrics: CMVP Validation Authority Updates to ISO/IEC 24759

March, 2020

SP 800-140E CMVP Approved Authentication Mechanisms: CMVP Validation Authority Requirements for ISO/IEC 19790 Annex E and ISO/IEC 24579 Section 6.17

March, 2020

SP 800-140D Rev. 2 CMVP Approved Sensitive Parameter Generation and Establishment Methods: CMVP Validation Authority Updates to ISO/IEC 24759

July, 2023

SP 800-140C Rev. 2 CMVP Approved Security Functions: CMVP Validation Authority Updates to ISO/IEC 24759

July, 2023

SP 800-140B Rev.1 CMVP Security Policy Requirements: CMVP Validation Authority Updates to ISO/IEC 24759 and ISO/IEC 19790 Annex B

November, 2023

SP 800-140A CMVP Documentation Requirements: CMVP Validation Authority Updates to ISO/IEC 24759

March, 2020

SP 800-140 FIPS 140-3 Derived Test Requirements (DTR): CMVP Validation Authority Updates to ISO/IEC 24759

March, 2020

SP 800-137A Assessing Information Security Continuous Monitoring (ISCM) Programs: Developing an ISCM Program Assessment

May, 2020

SP 800-137 Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations

September, 2011

SP 800-135 Rev. 1 Recommendation for Existing Application-Specific Key Derivation Functions

December, 2011

SP 800-133 Rev. 2 Recommendation for Cryptographic Key Generation June, 2020 SP 800-132 Recommendation for Password-Based Key Derivation: Part 1:

Storage Applications December, 2010

SP 800-131A Rev. 2 Transitioning the Use of Cryptographic Algorithms and Key Lengths

March, 2019

SP 800-130 A Framework for Designing Cryptographic Key Management Systems

August, 2013

SP 800-128 Guide for Security-Focused Configuration Management of Information Systems

October, 2019

SP 800-126 Rev. 3 The Technical Specification for the Security Content Automation Protocol (SCAP): SCAP Version 1.3

February, 2018

SP 800-126 Rev. 2 The Technical Specification for the Security Content Automation Protocol (SCAP): SCAP Version 1.2

March, 2012

SP 800-126A SCAP 1.3 Component Specification Version Updates: An Annex to NIST Special Publication 800-126 Revision 3

February, 2018

SP 800-126 Rev. 1 The Technical Specification for the Security Content Automation Protocol (SCAP): SCAP Version 1.1

February, 2011

SP 800-125B Secure Virtual Network Configuration for Virtual Machine (VM) Protection

March, 2016

SP 800-125A Rev. 1 Security Recommendations for Server-based Hypervisor Platforms

June, 2018

SP 800-125 Guide to Security for Full Virtualization Technologies January, 2011 SP 800-124 Rev. 1 Guidelines for Managing the Security of Mobile Devices in the Enterprise June, 2013

SP 800-123 Guide to General Server Security July, 2008 SP 800-122 Guide to Protecting the Confidentiality of Personally

Identifiable Information (PII) April, 2010

SP 800-121 Rev. 2 Guide to Bluetooth Security January, 2022 SP 800-119 Guidelines for the Secure Deployment of IPv6 December, 2010 SP 800-116 Rev. 1 Guidelines for the Use of PIV Credentials in Facility Access June 29, 2018 SP 800-115 Technical Guide to Information Security Testing and

Assessment September, 2008

SP 800-114 Rev. 1 User's Guide to Telework and Bring Your Own Device (BYOD) Security

July, 2016

SP 800-113 Guide to SSL VPNs July, 2008 SP 800-111 Guide to Storage Encryption Technologies for End User

Devices November, 2007

SP 800-108 Rev. 1 Recommendation for Key Derivation Using Pseudorandom Functions (include updates as of 02-02-24)

August, 2022

SP 800-107 Rev. 1 Recommendation for Applications Using Approved Hash Algorithms

August, 2012

SP 800-106 Randomized Hashing for Digital Signatures (withdrawn on 12/15/2022)

February, 2009

SP 800-102 Recommendation for Digital Signature Timeliness September, 2009 SP 800-101 Rev. 1 Guidelines on Mobile Device Forensics May, 2014 SP 800-98 Guidelines for Securing Radio Frequency Identification

(RFID) Systems April, 2007

SP 800-97 Establishing Wireless Robust Security Networks: A Guide to IEEE 802.11i

February, 2007

SP 800-96 PIV Card to Reader Interoperability Guidelines September, 2006 SP 800-95 Guide to Secure Web Services August, 2007

SP 800-94 Guide to Intrusion Detection and Prevention Systems (IDPS) February, 2007 SP 800-92 Guide to Computer Security Log Management September, 2006 SP 800-90B Recommendation for the Entropy Sources Used for Random

Bit Generation January, 2018

SP 800-90A Rev. 1 Recommendation for Random Number Generation Using Deterministic Random Bit Generators

June, 2015

SP 800-89 Recommendation for Obtaining Assurances for Digital Signature Applications

November, 2006

SP 800-88 Rev. 1 Guidelines for Media Sanitization December, 2014 SP 800-87 Rev. 2 Codes for Identification of Federal and Federally-Assisted

Organizations April, 2018

SP 800-86 Guide to Integrating Forensic Techniques into Incident Response

August, 2006

SP 800-85B PIV Data Model Test Guidelines July, 2006 SP 800-85A-4 PIV Card Application and Middleware Interface Test

Guidelines (SP 800-73-4 Compliance) April, 2016

SP 800-84 Guide to Test, Training, and Exercise Programs for IT Plans and Capabilities

September, 2006

SP 800-83 Rev. 1 Guide to Malware Incident Prevention and Handling for Desktops and Laptops

July, 2013

SP 800-82 Rev. 3 Guide to Operational Technology (OT) Security (superseded SP 800-82 Rev.2 (06-03-2015) Guide to Industrial Control Systems (ICS) Security)

September, 2023

SP 800-81-2 Secure Domain Name System (DNS) Deployment Guide September, 2013 SP 800-79-2 Guidelines for the Authorization of Personal Identity

Verification Card Issuers (PCI) and Derived PIV Credential Issuers (DPCI)

July, 2015

SP 800-78-4 Cryptographic Algorithms and Key Sizes for Personal Identity Verification

May, 2015

SP 800-77 Rev. 1 Guide to IPsec VPNs June, 2020 SP 800-76-2 Biometric Specifications for Personal Identity Verification July, 2013 SP 800-73-4 Interfaces for Personal Identity Verification (includes updates made on 02-08-2016) May, 2015

SP 800-72 Guidelines on PDA Forensics November, 2004 SP 800-70 Rev. 4 National Checklist Program for IT Products: Guidelines for

Checklist Users and Developers February, 2018

SP 800-67 Rev. 2 Recommendation for the Triple Data Encryption Algorithm (TDEA) Block Cipher (This publication was withdrawn on 01-01-2024).

November 17, 2017

SP 800-66 Rev. 2 An Introductory Resource Guide for Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule (superseded SP 800-66 Rev.1)

February, 2024

SP 800-63-3 Digital Identity Guidelines (include updates up to 03-02-20) June 2017 SP 800-63C Digital Identity Guidelines: Federation and Assertions

(include updates up to 03-02-20) June 2017

SP 800-63B Digital Identity Guidelines: Authentication and Lifecycle Management (include updates up to 03-02-20)

June 2017

SP 800-63A Digital Identity Guidelines: Enrollment and Identity Proofing (include updates up to 03-02-20)

June 2017

SP 800-61 Rev. 2 Computer Security Incident Handling Guide August, 2012 SP 800-60 Vol. 2 Rev. 1

Guide for Mapping Types of Information and Information Systems to Security Categories: Appendices

August, 2008

SP 800-60 Vol. 1 Rev. 1

Guide for Mapping Types of Information and Information Systems to Security Categories

August, 2008

SP 800-59 Guideline for Identifying an Information System as a National Security System

August, 2003

SP 800-58 Security Considerations for Voice Over IP Systems January, 2005 SP 800-57 Part 3 Rev. 1

Recommendation for Key Management, Part 3: Application- Specific Key Management Guidance

January, 2015

SP 800-57 Part 2 Rev. 1

Recommendation for Key Management: Part 2 – Best Practices for Key Management Organizations

May, 2019

SP 800-57 Part 1 Rev. 5

Recommendation for Key Management: Part 1 – General May, 2020

SP 800-56C Rev. 2 Recommendation for Key-Derivation Methods in Key- Establishment Schemes

August, 2020

SP 800-56B Rev. 2 Recommendation for Pair-Wise Key-Establishment Using Integer Factorization Cryptography

March, 2019

SP 800-56A Rev. 3 Recommendation for Pair-Wise Key-Establishment Schemes Using Discrete Logarithm Cryptography

April, 2018

SP 800-55 Rev. 1 Performance Measurement Guide for Information Security July, 2008 SP 800-53 Rev. 5 Security and Privacy Controls for Information Systems and

Organizations (include updates up to 09-03-2020) September, 2020

SP 800-53B Control Baselines for Information Systems and Organizations (includes updates up to 12-10-2020)

September, 2020

SP 800-53A Rev. 5 Assessing Security and Privacy Controls in Information Systems and Organizations

January, 2022

SP 800-53A Rev. 4 Assessing Security and Privacy Controls in Federal Information Systems and Organizations: Building Effective Assessment Plans (withdrawn on 01-25-2023)

December 18, 2014

SP 800-52 Rev. 2 Guidelines for the Selection, Configuration, and Use of Transport Layer Security (TLS) Implementations

August, 2019

SP 800-51 Rev. 1 Guide to Using Vulnerability Naming Schemes February, 2011 SP 800-50 Building an Information Technology Security Awareness and

Training Program October , 2003

SP 800-49 Federal S/MIME V3 Client Profile November, 2002 SP 800-47 Rev. 1 Managing the Security of Information Exchanges July, 2021 SP 800-46 Rev. 2 Guide to Enterprise Telework, Remote Access, and Bring

Your Own Device (BYOD) Security July, 2016

SP 800-45 Version 2 Guidelines on Electronic Mail Security February, 2007 SP 800-44 Version 2 Guidelines on Securing Public Web Servers September, 2007 SP 800-41 Rev. 1 Guidelines on Firewalls and Firewall Policy September, 2009 SP 800-40 Rev. 4 Guide to Enterprise Patch Management Planning: Preventive

Maintenance for Technology April, 2022

SP 800-39 Managing Information Security Risk: Organization, Mission, and Information System View

March, 2011

SP 800-38G Recommendation for Block Cipher Modes of Operation:

Methods for Format-Preserving Encryption (update August 4, 2016)

March, 2016

SP 800-38F Recommendation for Block Cipher Modes of Operation:

Methods for Key Wrapping

December, 2012

SP 800-38E Recommendation for Block Cipher Modes of Operation: the XTS-AES Mode for Confidentiality on Storage Devices

January, 2010

SP 800-38D Recommendation for Block Cipher Modes of Operation:

Galois/Counter Mode (GCM) and GMAC

November, 2007

SP 800-38C Recommendation for Block Cipher Modes of Operation: the CCM Mode for Authentication and Confidentiality (Updated 07-20-2007)

May, 2004

SP 800-38B Recommendation for Block Cipher Modes of Operation: the CMAC Mode for Authentication (Updated 10-06-2016)

May, 2005

SP 800-38A

Addendum

Recommendation for Block Cipher Modes of Operation:

Three Variants of Ciphertext Stealing for CBC Mode

October, 2010

SP 800-38A Recommendation for Block Cipher Modes of Operation:

Methods and Techniques

December, 2001

SP 800-37 Rev. 2 Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy

December, 2018

SP 800-35 Guide to Information Technology Security Services October, 2003 SP 800-34 Rev. 1 Contingency Planning Guide for Federal Information Systems November, 2010 SP 800-30 Rev. 1 Guide for Conducting Risk Assessments September, 2012 SP 800-28 Version 2 Guidelines on Active Content and Mobile Code March, 2008 SP 800-22 Rev. 1a A Statistical Test Suite for Random and Pseudorandom

Number Generators for Cryptographic Applications April, 2010

SP 800-18 Rev. 1 Guide for Developing Security Plans for Federal Information Systems

February, 2006

SP 800-16 Information Technology Security Training Requirements: A Role- and Performance-Based Model

April,1998

SP 800-12 Rev. 1 An Introduction to Information Security June, 2017