Regulatory watch

Revision 1 introduces streaming interfaces for extendable-output function (XOF) computations, which allow applications to process input and request output incrementally without knowing the total input or output length in advance. From the Note to Reviewers (p. v): The Keccak-derived functions in this recommendation have been updated to describe a streaming mode of access that provides full XOF functionality. This involves calls to three functions: INIT, ABSORB, and SQUEEZE. Illustrative pseudocode is provided for the streaming interface, but the correct behavior of all streaming modes is defined in terms of the corresponding single-call interface to the functions. The single-call interfaces for these functions are equivalent to the functions defined in the previous version of this document. cSHAKE, KMAC, and ParallelHash use the ABSORB function to incrementally input data into the function so that ABSORB(𝑋1) followed by ABSORB(𝑋2) has the same effect as ABSORB(𝑋1 ∥ 𝑋2). TupleHash uses the absorb function somewhat differently in that each ABSORB call processes one complete tuple element. NIST invites comment on whether this different use of ABSORB might be confusing. The public…

This initial public draft details how the availability of inexpensive, off-the-shelf hardware and software tools allows attackers to mimic legitimate carrier equipment to intercept and disrupt cellular communications. The paper evaluates how 5G devices respond to six simulated false base station scenarios and examines protections available to mitigate risks. Background This white paper is part of the NCCoE's work to accelerate the adoption of 5G security features by demonstrating their implementation on NCCoE's operational 5G security testbed and providing actionable implementation guidelines to help network operators and other stakeholders enhance the cybersecurity and privacy of 5G systems and supporting infrastructures. A false (aka Rogue or Fake) Base Station (FBS) impersonates a real carrier radio access network. It transmits and receives radio signals that mimic a legitimate 5G cell and tricks unsuspecting User Equipment (UE) to connect to it. This can result in cybersecurity risks, including service degradation, privacy breaches, and location tracking for the user. Although 5G standards include greater security features than previous generations to protect subscribers, they…

This document corrects technical and typographical errors in the final rule that appeared in the Federal Register on August 4, 2026 titled "Medicare Program; Hospital Inpatient Prospective Payment Systems for Acute Care Hospitals (IPPS) and the Long-Term Care Hospital Prospective Payment System and Policy Changes and Fiscal Year (FY) 2027 Rates; Requirements for Quality Programs; Other Policy Changes; and Adoption of Updated Versions of Certain Health Information Technology Standards."

This report provides guidelines for improving the security of Operational Technology (OT) systems while addressing their unique performance, reliability, and safety requirements. OT encompasses a broad range of programmable systems or devices that interact with the physical environment (or manage devices that interact with the physical environment). These systems/devices detect or cause a direct change through the monitoring and/or control of devices, processes, and events. Examples include industrial control systems (ICS), building automation systems, transportation systems, physical access control systems, physical environment monitoring systems, and physical environment measurement systems. This fourth revision of SP 800-82 provides an overview of OT and typical system topologies, identifies common threats to organizational mission and business functions supported by OT, describes typical vulnerabilities in OT, and provides recommended security safeguards and countermeasures to manage the associated risks. Updates in this revision include: Expanded introduction to operational technology (OT) sectors to include Building Automation and Control Systems (BACS), Water and Wastewater…

Federal agencies that deploy an Open Radio Access Network (O-RAN) as part of their infrastructure must include that deployment in their risk management programs. This draft Cybersecurity Framework (CSF) 2.0 profile describes how components that conform to the security specifications produced by the O-RAN ALLIANCE support various CSF 2.0 outcomes. It also includes references to O-RAN ALLIANCE-produced documents and other relevant guidelines that may help federal agency cybersecurity managers.

Revision 1 updates the referenced specification to IEEE Std. 1619-2025 and clarifies NIST's requirements for the approved use of XTS-AES, including its scope of use, data-unit and key-scope limits, key requirements, and the ordering convention for ciphertext stealing. Rather than reproducing the XTS-AES specification, this recommendation incorporates IEEE Std. 1619-2025 by reference. To facilitate review of the draft SP, IEEE Std. 1619-2025 is publicly available during the public comment period. The public comment period is open through October 16, 2026. NOTE: A call for patent claims is included in this draft. For additional information, see the Information Technology Laboratory (ITL) Patent Policy - Inclusion of Patents in ITL Publications.

Following the publication of draft revision IoT Product Cybersecurity Guidelines for the Federal Government: Establishing IoT Product Cybersecurity Requirements, NIST SP 800-213 Rev. 1, NIST has initiated the process of revising the companion document IoT Device Cybersecurity Guidance for the Federal Government: IoT Device Cybersecurity Requirement Catalog, NIST SP 800-213A, to incorporate lessons learned, align with relevant NIST guidance (e.g., Cybersecurity Framework (CSF) 2.0, NIST SP 800-53 Rev. 5.2.0)-as well as IoT cybersecurity standards and practices, and address changes in the IoT threat landscape. We welcome any valuable perspectives on potential revisions to the current SP 800-213A to maximize the document's effectiveness, relevance, and usability in helping the community understand and manage cybersecurity risk. To help guide this input, NIST has included specific questions below, though reviewers are encouraged to address any, all, or additional topics in their comments. The public comment period is open through October 15, 2026. Submit comments via email to iotsecurity@nist.gov with the subject line “Comments on SP 800-213A.” Specifically, NIST asks for…

NIST Internal Report (IR) 8613 ipd (initial public draft), Multi-Cloud Architecture Challenges, identifies, categorizes, and analyzes the security and compliance challenges that are unique to or significantly amplified by multi-cloud architectures. This analysis by the NIST Multi-Cloud Security Public Working Group (MCSPWG) addresses security and Authorization to Operate (ATO) challenges and highlights areas where additional community research could meaningfully reduce risk. The MCSPWG identified 23 consolidated challenge areas that represent novel friction points and architectural misalignments that emerge when orchestrating control across autonomous cloud silos. The most significant structural challenge areas are: Security-significant differences in cloud-native services across providers Organizational logistics and staffing complexity across heterogeneous environments Difficulty in implementing centralized security capabilities across provider boundaries These structural gaps are most acute in five areas: (1) identity and access management, (2) telemetry and logging, (3) configuration and change management, (4) data protection, and (5) compliance and authorization. Submit Your…

Per the Sept. 29, 2026, Executive Order on Inaugurating the Era of Super Intelligence, NIST is working to update its communications to incorporate the term “super intelligence” as directed. This new quick-start guide illustrates practical and actionable ways AI could be used for analyzing, planning, implementing, and monitoring an organization's progress toward achieving CSF 2.0 outcomes. The document's purpose is to: Provide structured AI prompts as tools for practitioners to begin creating CSF-related artifacts in support of achieving CSF outcomes Identify current state of practice for AI prompt engineering in CSF implementation and analysis While the focus was not to write about AI best practices or to provide cybersecurity guidelines thereof, there are places where specific precautions are denoted with the /!\ notation. This guide includes three notional use cases, examples of prompts for structuring natural language inputs to produce specified CSF 2.0 outputs from a generative AI model, simulated organizational files for a fictitious company, tips for getting started, and more. USE CASE 1 illustrates the use of an AI-assisted review to evaluate organization cybers…

This final rule will revise the Medicare hospital inpatient prospective payment systems (IPPS) for operating and capital-related costs of acute care hospitals; make changes relating to Medicare graduate medical education (GME) for teaching hospitals; update the payment policies and the annual payment rates for the Medicare prospective payment system (PPS) for inpatient hospital services provided by long-term care hospitals (LTCHs); update and make changes to requirements for certain quality programs; and make other policy- related changes. ONC also adopts certain health information technology (health IT) standards and specifications on behalf of HHS.

Building upon established principles from high-performance computing (HPC) threat analyses and security overlays, this publication delivers a thorough threat and security gap analysis for purpose-built AI infrastructure used in model training, inference, and applications. By contrasting AI data centers with traditional HPC systems across architecture, hardware, software stacks, workflows, and storage systems, the publication pinpoints critical security threats and outlines possible solutions to safeguard next-generation AI environments. NOTE: A call for patent claims is included in this draft. For additional information, see the Information Technology Laboratory (ITL) Patent Policy--Inclusion of Patents in ITL Publications.

This proposed rule addresses: changes to the physician fee schedule (PFS); other changes to Medicare Part B payment policies to ensure that payment systems are updated to reflect changes in medical practice, relative value of services, and changes in the statute; codification of establishment of new policies for: the Medicare Prescription Drug Inflation Rebate Program under the Inflation Reduction Act of 2022; the Ambulatory Specialty Model; updates to drugs and biological products paid under Part B; Medicare Shared Savings Program requirements; updates to the Quality Payment Program; updates to policies for Rural Health Clinics and Federally Qualified Health Centers; update to the Ambulance Fee Schedule regulations; codification of the Inflation Reduction Act and Consolidated Appropriations Act, 2026 provisions; updates to Clinical Laboratory Fee Schedule regulations; updates to the Medicare Promoting Interoperability Program.

Clinical laboratory testing technology has advanced significantly since the Clinical Laboratory Improvement Amendments of 1988 (CLIA) regulations were implemented in 1992. This request for information (RFI) seeks input from the public regarding various topics related to the CLIA regulations, including: breath testing; laboratory processes and procedures; emergency preparedness, biosafety and biosecurity, and cybersecurity; and specialty testing areas. Responses to this RFI may be used to help inform CMS and the CDC as to what types of action, if any, should be taken to update the existing CLIA regulations through future notice and comment rulemaking.

NIST has released initial working drafts of proposed updates to the Personal Identity Verification (PIV) standards to support the use of post-quantum cryptography (PQC). The drafts identify the changes expected to be needed to use the ML-DSA digital signature algorithm and the ML-KEM key-encapsulation mechanism with PIV. The current draft set comprises: SP 800-73 Part 1: PIV Card Application Namespace, Data Model, and Representation SP 800-73 Part 2: PIV Card Application Card Command Interface SP 800-78: Cryptographic Algorithms and Key Sizes for PIV A supporting PQC Overview accompanies the drafts to present a working gap analysis of the specification changes needed across the PIV algorithm profile, command interface, and data model, and outline the general approach under consideration. This approach centers on a dual-stack model that preserves existing classical PIV keys and data objects; adds new key references, certificate containers, and data objects for PQC credentials; and supports backward compatibility and incremental deployment during the transition. These are preliminary working materials, not formal public drafts. By collaborating with implementers and users to develop…

NIST has released initial working drafts of proposed updates to the Personal Identity Verification (PIV) standards to support the use of post-quantum cryptography (PQC). The drafts identify the changes expected to be needed to use the ML-DSA digital signature algorithm and the ML-KEM key-encapsulation mechanism with PIV. The current draft set comprises: SP 800-73 Part 1: PIV Card Application Namespace, Data Model, and Representation SP 800-73 Part 2: PIV Card Application Card Command Interface SP 800-78: Cryptographic Algorithms and Key Sizes for PIV A supporting PQC Overview accompanies the drafts to present a working gap analysis of the specification changes needed across the PIV algorithm profile, command interface, and data model, and outline the general approach under consideration. This approach centers on a dual-stack model that preserves existing classical PIV keys and data objects; adds new key references, certificate containers, and data objects for PQC credentials; and supports backward compatibility and incremental deployment during the transition. These are preliminary working materials, not formal public drafts. By collaborating with implementers and users to develop…

NIST has released initial working drafts of proposed updates to the Personal Identity Verification (PIV) standards to support the use of post-quantum cryptography (PQC). The drafts identify the changes expected to be needed to use the ML-DSA digital signature algorithm and the ML-KEM key-encapsulation mechanism with PIV. The current draft set comprises: SP 800-73 Part 1: PIV Card Application Namespace, Data Model, and Representation SP 800-73 Part 2: PIV Card Application Card Command Interface SP 800-78: Cryptographic Algorithms and Key Sizes for PIV A supporting PQC Overview accompanies the drafts to present a working gap analysis of the specification changes needed across the PIV algorithm profile, command interface, and data model, and outline the general approach under consideration. This approach centers on a dual-stack model that preserves existing classical PIV keys and data objects; adds new key references, certificate containers, and data objects for PQC credentials; and supports backward compatibility and incremental deployment during the transition. These are preliminary working materials, not formal public drafts. By collaborating with implementers and users to develop…

These proposals are intended to improve the electronic exchange of health care data and streamline processes related to prior authorization by increasing the interoperability of systems used across the health care industry. We are proposing new requirements for Medicare Advantage (MA) organizations, state Medicaid fee-for-service (FFS) programs, state Children's Health Insurance Program (CHIP) FFS programs, Medicaid managed care plans, CHIP managed care entities, and Qualified Health Plan (QHP) issuers on the Federally-facilitated Exchanges (FFEs), including issuers that offer small group market QHPs on the Federally-facilitated Small Business Health Options Program (FF- SHOP) Exchanges (hereinafter referred to as "small group market QHP issuers on the FF-SHOPs") (collectively "impacted payers"), to make available electronic prior authorization for drugs. We are also proposing to extend many existing interoperability requirements for the prior authorization of non-drug items and services to include prior authorizations for drugs to further reduce patient and provider burden. We are also proposing to require impacted payers to report their application programming interfaces (API) en

This final rule implements requirements of the Administrative Simplification subtitle of the Health Insurance Portability and Accountability Act of 1996 (HIPAA), and the Patient Protection and Affordable Care Act, as amended by the Health Care and Education Reconciliation Act of 2010, enacted on March 30, 2010--collectively, the Affordable Care Act. Specifically, this final rule adopts standards for health care claims attachments transactions, which will support health care claims transactions, and a standard for electronic signatures to be used in conjunction with health care claims attachments transactions.

The U.S. Department of Health and Human Services will conduct a virtual Tribal consultation on the proposed rule "Modifications to the HIPAA Privacy Rule to Support, and Remove Barriers to, Coordinated Care and Individual Engagement."

This proposed rule focuses on deregulatory actions identified in HHS regulations regarding Health information technology standards, implementation specifications, and certification criteria and certification programs for health information technology, and information blocking. This proposed rule seeks to reduce burden, offer flexibility to both developers and providers, and support innovation through the removal and revisions of certain certification criteria and regulatory provisions. This proposed rule also seeks to address reported misuse and abuse of information blocking definitions and exceptions.

ASTP/ONC published in the Federal Register on August 5, 2024, a proposed rule, titled "Health Data, Technology, and Interoperability: Patient Engagement, Information Sharing, and Public Health Interoperability" (HTI-2), in which it proposed updating and adding regulations regarding health information technology, information blocking, and the Trusted Exchange Framework and the Common Agreement. The comment period closed on October 4, 2024. ASTP/ONC is withdrawing the remaining proposals that have not been finalized from the HTI-2 Proposed Rule.

In accordance with section 205 of the Health Insurance Portability and Accountability Act of 1996 (HIPAA), this annual notification solicits proposals and recommendations for developing new, or modifying existing, safe harbor provisions under section 1128B(b) of the Social Security Act (the Act), the Federal anti-kickback statute, as well as developing new OIG Special Fraud Alerts.

This major final rule addresses: changes to the physician fee schedule (PFS); other changes to Medicare Part B payment policies to ensure that payment systems are updated to reflect changes in medical practice, relative value of services, and changes in the statute; codification of establishment of new policies for: the Medicare Prescription Drug Inflation Rebate Program under the Inflation Reduction Act of 2022; the Ambulatory Specialty Model; updates to the Medicare Diabetes Prevention Program expanded model; updates to drugs and biological products paid under Part B; Medicare Shared Savings Program requirements; updates to the Quality Payment Program; updates to policies for Rural Health Clinics and Federally Qualified Health Centers; update to the Ambulance Fee Schedule regulations; codification of the Inflation Reduction Act and Consolidated Appropriations Act, 2023 provisions; updates to the Medicare Promoting Interoperability Program.

This document updates compliance and other dates presented in the final rule that appeared in the December 13, 2024 Federal Register titled "Administrative Simplification: Modifications of Health Insurance Portability and Accountability Act of 1996 (HIPAA) National Council for Prescription Drug Programs (NCPDP) Retail Pharmacy Standards; and Modification of the Medicaid Pharmacy Subrogation Standard" to conform with the subsequent final rule that appeared in the February 11, 2025 Federal Register.