NIST Special Publication 800-144 - Cloud computing can and does mean different things to different people. The common characteristics most interpretations share are on-demand scalability of highly available and reliable pooled computing resources, secure access to metered services from nearly anywhere, and displacement of data and services from inside to outside the organization. While aspects of these characteristics have been realized to a certain extent, cloud computing remains a work in progress. This publication provides an overview of the security and privacy challenges pertinent to public cloud computing and points out considerations organizations should take when outsourcing data, applications, and infrastructure to a public cloud environment.~

/pdf/guidelines-on-security-and-privacy-in-public-cloud-computing-2x2n11uw6u.pdf

Guidelines on Security and Privacy in Public Cloud Computing

This Recommendation provides cryptographic key management guidance. It consists of three parts. Part 1 provides general guidance and best practices for the management of cryptographic keying material. Part 2 provides guidance on policy and security planning requirements for U.S. government agencies. Finally, Part 3 provides guidance when using the cryptographic features of current systems.

/pdf/recommendation-for-key-management-part-1-general-revision-3-1l1d32pzxc.pdf

Recommendation for Key Management, Part 1: General (Revision 3)

/pdf/recommendation-for-key-management-part-1-general-geoyt3gkn6.pdf

Recommendation for Key Management - Part 1 General

This recommendation provides technical guidelines for Federal agencies implementing electronic authentication and is not intended to constrain the development or use of standards outside of this purpose. The recommendation covers remote authentication of users (such as employees, contractors, or private individuals) interacting with government IT systems over open networks. It defines technical requirements for each of four levels of assurance in the areas of identity proofing, registration, tokens, management processes, authentication protocols and related assertions. This publication supersedes NIST SP 800-63-1.

/pdf/electronic-authentication-guideline-2yk80fse48.pdf

Annabelle Lee

Papers

Guideline for Implementing Cryptography in the Federal Government | NIST