Section
Standards & policy
RFCs, NIST drafts open for comment, agency guidance, framework releases and regulatory documents.
38 matching records (8 policy, 30 standard).
-
OpenSSF Newsletter – October 2026
October brought four new members and fresh CRA resources from Prague, a practical guide to finding and fixing vulnerabilities with AI, and a new Sandbox project. Next stop: Salt Lake City for Open Source SecurityCon on November 9.
-
New LF Research Survey Shows Generative AI Cuts Open Source Coding Time in Half, but 25% of Incoming Pull Requests are Considered AI Slop
While Generative AI boosts developer productivity and lowers barriers to entry, a new Linux Foundation Research report reveals it also increases maintainer workloads. With 25% of incoming pull requests now considered "AI slop,"…
-
Payment Security Resources for Merchants
Payment security doesn’t have to be complicated for merchants. Small, practical actions can make a meaningful difference in protecting payment data. PCI SSC provides practical resources to help merchants get started. With a…
-
Design Tenets for Agent Identity Management Systems
This is blog #2 in our series on agentic identity, authentication and authorization. Our other post can be found via Post #1. In our last blog post, we highlighted the essential nature of having fundamentally sound identity and…
-
Hazardous Materials: Harmonization With International Standards
PHMSA proposes to update the Hazardous Materials Regulations to adopt certain international regulations and standards related to proper shipping names, hazard classes, packing groups, special provisions, packaging authorizations…
-
Outbound Investment Security Program Regulations
This proposed rule sets forth regulations that would implement Subtitle C of the Comprehensive Outbound Investment National Security Act, which is codified at Title VIII of the Defense Production Act. The proposed rule would…
-
New OpenSSF Tech Talk: How Upstream Contribution Minimizes Technical Debt & Streamlines CRA Reporting
Maintaining private forks of open source software (OSS) comes with a hidden tax, costing organizations an average of 5,160 labor hours per release cycle in maintenance and engineering overhead. Beyond the accumulating technical…
-
Implementing the Guiding and Establishing National Innovation for U.S. Stablecoins Act for the Issuance of Stablecoins by Entities Subject to the Jurisdiction of the Office of the Comptroller of the Currency
The Office of the Comptroller of the Currency (OCC) is issuing regulations implementing the Guiding and Establishing National Innovation for U.S. Stablecoins Act regarding the issuance of payment stablecoins and certain related…
-
Who Checked It? Attestations, Gemara, and CRA Due Diligence
Discover how the OpenSSF Gemara project clarifies the complex world of security attestations, streamlines software supply chain evaluations, and helps organizations confidently meet EU Cyber Resilience Act (CRA) due diligence…
-
Drawbridge Operation Regulation; Manitowoc River, Manitowoc, WI
The Coast Guard is proposing to alter the operating schedule that governs the Eighth Street Bridge, mile 0.29 and the Tenth Street Bridge, mile 0.43, over the Manitowoc River, in the town of Manitowoc, Wisconsin. The City of…
-
SP 800-221 Rev. 1, Enterprise Impact of Information and Communications Technology Risk: Governing and Managing ICT Risk Programs Within an Enterprise Risk Portfolio: Initial Public Draft
Submit Your Feedback The public comment period is open through December 7, 2026, at 11:59 PM EST. We encourage you to use this comment template when preparing and submitting your response. About the Publication Enterprise…
-
SP 800-100 Rev. 1, Information Security Handbook: A Guide for Executive Leadership: Initial Public Draft
The initial public draft (ipd) of NIST Special Publication (SP) 800-100r1 (Revision 1), Information Security Handbook: A Guide for Executive Leadership , is now available for comment. Since the original version of SP 800-100 was…
-
Introducing the CVE Program Validation Library
CVE Record support vulnerability disclosure, security tools, and the organizations that use them to manage risk. Their value depends on information that CVE Numbering Authorities (CNAs) can publish reliably and that downstream…
-
“CNA Rules v4.2.1” Now in Effect
The CVE Numbering Authority (CNA) Operational Rules Version 4.2.1 took effect on October 20, 2026, after community input and review. The previous version, CNA Rules v4.2.0 , has been deprecated. CNAs are now required to comply…
-
New OpenSSF Guide: Finding and Fixing Vulnerabilities Using AI
AI has gotten good at finding software vulnerabilities, and attackers are already using it. For example, “AI-enabled adversaries increased attacks by 89% year-over-year” according to the CrowdStrike 2026 Global Threat Report. If…
-
The AI Exchange: Innovators in Payment Security Featuring AuditSafe
Welcome to the PCI Security Standards Council’s blog series, The AI Exchange: Innovators in Payment Security. This special, ongoing feature of our PCI Perspectives blog offers a resource for payment security industry stakeholders…
-
The Quantum Leap: Preparing for Post Quantum Cryptography Featuring Utimaco Inc.
Welcome to the PCI Security Standards Council’s blog series, The Quantum Leap: Preparing for Post Quantum Cryptography. This special, ongoing feature of our PCI Perspectives blog offers a resource for payment security industry…
-
Using TLS to protect data
Recommended profiles to securely configure TLS for the most common versions and scenarios, with additional guidance for managing older versions.
-
PCI SSC Celebrates World Standards Day and 20 Years of Securing Payment Data
Every year on 14 October, World Standards Day recognizes the people and organizations working together to develop standards that make our world safer, more connected, and more resilient. For the PCI Security Standards Council…
-
Kicking off Cybersecurity Career Week with NIST!
Considering a career in cybersecurity? Cybersecurity Career Week (CCW), a campaign led by the NICE Program at NIST from October 19-24, 2026, aims to raise public awareness and help people find their path to #ChooseCyber. During…
-
Removal of Automatic Extensions for Certain Employment Authorization Documents
On October 30, 2025, DHS published an interim final rule (IFR) that amended DHS regulations to end the practice of automatically extending the validity of employment authorization documents (Forms I- 766 or EADs) for aliens who…
-
RFC 10055: Configuring UDP Sockets for Explicit Congestion Notification (ECN) for Common Platforms
Explicit Congestion Notification (ECN) applies to all transport protocols in principle. However, it had limited deployment for UDP until QUIC became widely adopted. As a result, documentation of UDP socket APIs for ECN on various…
-
ATT&CK v20: Critical Infrastructure Campaigns, Adversary Use and Abuse of AI, & Iranian Cyber
ATT&CK v20: Critical Infrastructure Campaigns, Adversary Use and Abuse of AI, & Iranian Cyber Espionage ATT&CK v20 brings more critical infrastructure and cross-domain activity into the framework, with Campaigns for attacks on…
-
Introducing Privateer: AI-Assisted Security & Compliance Evaluation Framework Joins the OpenSSF Sandbox
Discover Privateer, a new plugin-based, AI-assisted security and compliance evaluation framework that has officially joined the OpenSSF Sandbox under the ORBIT Working Group.
-
The CVE Search API: A New Way to Access CVE Records
The CVE™ Program is introducing a new CVE Search API designed to make vulnerability information easier to find, easier to reuse, and easier to integrate into automated workflows. CVE Record information is already available for…
-
Regulation Crypto Asset Transactions and Regulation Crypto Asset Markets
The Commodity Futures Trading Commission ("Commission" or "CFTC") is issuing an advanced notice of proposed rulemaking regarding section 2(c)(2)(D) of the Commodity Exchange Act ("CEA" or "Act") to provide notice and seek public…
-
SP 800-185 Rev. 1, SHA-3 Derived Functions: cSHAKE, KMAC, TupleHash, and ParallelHash: Initial Public Draft
Revision 1 introduces streaming interfaces for extendable-output function (XOF) computations, which allow applications to process input and request output incrementally without knowing the total input or output length in advance.…
-
CVE Program Data Registry: Automating Federated Management
Over the past decade, the CVE™ Program has expanded globally to include more than 550 collaborating organizations, with CVE Record publication increasingly federated across this community. Participation is expected to continue to…
-
Vulnerability Data Enrichment for CVE Records: 281 CNAs on the Enrichment Recognition List for…
Vulnerability Data Enrichment for CVE Records: 281 CNAs on the Enrichment Recognition List for October 5, 2026 The “ CNA Enrichment Recognition List ” for October 5, 2026, is now available with 281 CNAs listed. Published monthly…
-
RFC 10065: A YANG Data Model and RADIUS Extension for Policy-Based Network Access Control
This document defines a YANG data model for policy-based network access control, which enables enforcement of network access control policies based on group identity. This YANG data model extends Access Control Lists (ACLs) with…
-
Adviser and Regulated Fund Custody Rules; Crypto Custody Rules
The Securities and Exchange Commission (the "Commission" or the "SEC") is proposing new custody rules under the Investment Company Act of 1940 (the "Investment Company Act") and amendments to related reporting and recordkeeping…
-
OpenSSF Shares Expanded Membership and New Global Policy Resources During Community Day Europe
The OpenSSF announced expanded membership during its Community Day Europe, welcoming four new members: A-Team Systems, Emphere, DACHS IT GMBH, and JetBrains. The Foundation also released significant CRA resources to deepen Cyber…
-
RFC 10054: Computing-Aware Traffic Steering (CATS) Problem Statement, Use Cases, and Requirements
Distributed computing enhances service response time and energy efficiency by utilizing diverse computing facilities for compute-intensive and delay-sensitive services. To optimize throughput and response time, Computing-Aware…
-
RFC 10053: A Framework for Computing-Aware Traffic Steering (CATS)
This document describes a framework for Computing-Aware Traffic Steering (CATS). Specifically, the document identifies a set of CATS functional components, describes their interactions, and provides illustrative workflows of the…
-
The AI Exchange: Innovators in Payment Security Featuring Coalfire
Welcome to the PCI Security Standards Council’s blog series, The AI Exchange: Innovators in Payment Security. This special, ongoing feature of our PCI Perspectives blog offers a resource for payment security industry stakeholders…
-
Introducing the New Small Business Cybersecurity Support Program Finder
For small businesses who are often confronted with limited resources, knowing how to get started and where to find support with planning, implementing, or evaluating a cybersecurity risk management strategy can be challenging —…
-
Proposal of Special Measure Prohibiting the Transmittal of Funds Regarding Transactions Involving the A7 Network's Sub-Agents
FinCEN is issuing a finding and notice of proposed rulemaking, pursuant to section 9714(a) of the Combating Russian Money Laundering Act (Public Law 116-283), as amended by section 6106(b) of the National Defense Authorization…
-
RFC 10049: Roughtime: A Protocol for Rough Time Synchronization
This document describes Roughtime, an experimental protocol that aims to achieve two things: secure, rough time synchronization (even for clients without any idea of what time it is) and a format for clients to report any…
Reuse this view
Same filters as JSON: /api/items?category=standards%2Cpolicy&window=30d&sort=newest&limit=100. RSS for this section: feed.xml.