Federal Information Processing Standards

Federal Information Processing Standards. These are a series of publicly announced standards and guidelines developed by the National Institute of Standards and Technology for use across all non-military agencies of the United States federal government. Mandated by statutes such as the Federal Information Security Management Act and the Computer Security Act of 1987, they establish critical requirements for ensuring the security and interoperability of federal information systems. While primarily compulsory for government entities, their technical rigor has led to widespread voluntary adoption by private industry and international organizations, influencing global information technology practices.

Overview

The primary purpose is to provide a uniform framework for protecting sensitive but unclassified information within federal computer systems, as directed by Congress and the Secretary of Commerce. These publications cover a broad spectrum of technical areas, including cryptographic modules, data encryption algorithms, and personal identity verification protocols. They are developed through a public process involving industry, academic, and government stakeholders, and are published by NIST after a period of draft review and comment. Compliance is often a prerequisite for contractors doing business with agencies like the Department of Defense or the Department of Homeland Security.

History and development

The genesis can be traced to the Brooks Act of 1965, which assigned responsibility for automatic data processing standards to the National Bureau of Standards, the predecessor to NIST. A pivotal moment occurred with the passage of the Computer Security Act of 1987, which formally mandated the establishment of standards for the security of sensitive information in federal systems. This legislative action led to the creation of the Computer Systems Laboratory within NIST, which became the primary developer. Over decades, specific standards have been created, revised, or withdrawn in response to technological evolution and security threats, such as the retirement of the Data Encryption Standard following advancements in cryptanalysis.

Key standards and impact

Among the most influential publications is FIPS 140, which specifies security requirements for cryptographic modules used across commercial and government sectors worldwide. The Advanced Encryption Standard, established via a global competition and formalized, revolutionized data protection and is used in countless applications from Internet banking to secure messaging. The Secure Hash Algorithm family, including SHA-256, is fundamental to blockchain technologies like Bitcoin and digital signature schemes. These specific standards have transcended their government origins to become foundational pillars of global cybersecurity infrastructure and modern public-key cryptography.

Implementation and compliance

Implementation is enforced through federal acquisition regulations and directives from the Office of Management and Budget, requiring agencies to incorporate applicable standards into their information security programs. Validation of compliance, particularly for cryptographic modules under FIPS 140, is conducted through independent, accredited Cryptographic Module Validation Program testing laboratories. The Government Accountability Office often audits agency adherence as part of broader information security reviews. Non-compliance can result in systems being denied authority to operate, impacting critical functions at institutions like the Social Security Administration or the Internal Revenue Service.

Relationship to other standards

These standards frequently align with or influence international technical norms, such as those published by the International Organization for Standardization and the International Electrotechnical Commission. For instance, the Advanced Encryption Standard is also published as ISO/IEC 18033-3. They exist alongside other U.S. government frameworks like the National Security Agency's Suite B cryptography and guidelines from the Committee on National Security Systems. While they govern unclassified systems, they often inform the development of stricter protocols for classified networks managed by the Department of Defense and the Intelligence Community.

Category:Computer security standards Category:United States federal information technology Category:National Institute of Standards and Technology