NIST publishes new information security guidelines.

NIST recently released five new information security guidelines as NIST special publications (SPs):

* NIST SP 800-35: Guide to Information Technology Security Services. The guide provides assistance with the selection, implementation, and management of IT security services by guiding organizations through the various phases of the IT security services life cycle. The factors to be considered when selecting, implementing, and managing IT security services include the type of service arrangement; service provider qualifications, operational requirements and capabilities, experience, and viability; trustworthiness of service provider employees; and the service provider's capability to deliver adequate protection for the organization systems, applications, and information.

* NIST SP 800-36: Guide to Selecting Information Security Products. The selection of IT security products is an integral part of the design, development, and maintenance of an IT security infrastructure. The guide defines broad security product categories, specifies product types within those categories, and provides a list of general characteristics and questions an organization can ask when selecting a product.

* NIST SP 800-42: Guideline on Network Security Testing. The guide stresses the need for an effective security testing program within federal agencies. It identifies network testing requirements, discusses how to prioritize testing activities with limited resources, and describes several network security testing techniques and tools. Also presented is a framework for incorporating security into the information system development life cycle (SDLC) process. The guide seeks to help organizations select and acquire cost-effective security controls by explaining how to include information system security requirements in the SDLC.

* NIST SP 800-50: Building an Information Technology Security Awareness and Training Program. The publication provides detailed guidance on designing, developing, implementing, and maintaining a comprehensive awareness and training program as part of an organization's IT security program. It provides guidelines that can help federal agencies meet their security training responsibilities as contained in the Federal Information Security Management Act and Office of Management and Budget guidelines.

* NIST SP 800-64: Security Considerations in the Information System Development Life Cycle. The guide presents a framework for incorporating security into the information system development life cycle (SDLC) process. It seeks to help organizations select and acquire cost-effective security controls by explaining how to include information system security requirements in the SDLC.

The five security guidelines are available for down-load at http://csrc.nist.gov/publications/nistpubs/index.html.

CONTACT: Edward Roback, [phone]; [e-mail].