Authority 49
This publication has been developed by NIST in accordance with its statutory responsibilities under the 50
Federal Information Security Modernization Act (FISMA) of 2014, 44 U.S.C. § 3551 et seq., Public Law 51
(P.L.) 113-283. NIST is responsible for developing information security standards and guidelines, including 52
minimum requirements for federal information systems, but such standards and guidelines shall not apply 53
to national security systems without the express approval of appropriate federal officials exercising policy 54
authority over such systems. This guideline is consistent with the requirements of the Office of Management 55
and Budget (OMB) Circular A-130. 56
Nothing in this publication should be taken to contradict the standards and guidelines made mandatory and 57
binding on federal agencies by the Secretary of Commerce under statutory authority. Nor should these 58
guidelines be interpreted as altering or superseding the existing authorities of the Secretary of Commerce, 59
Director of the OMB, or any other federal official. This publication may be used by nongovernmental 60
organizations on a voluntary basis and is not subject to copyright in the United States. Attribution would, 61
however, be appreciated by NIST. 62
National Institute of Standards and Technology Special Publication 800-52 Revision 2 63
Natl. Inst. Stand. Technol. Spec. Publ. 800-52 Rev. 2, 71 pages (October 2018) 64
CODEN: NSPUE2 65
Certain commercial entities, equipment, or materials may be identified in this document in order to describe an 66
experimental procedure or concept adequately. Such identification is not intended to imply recommendation or 67
endorsement by NIST, nor is it intended to imply that the entities, materials, or equipment are necessarily the best 68
available for the purpose. 69
There may be references in this publication to other publications currently under development by NIST in accordance 70
with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, 71
may be used by federal agencies even before the completion of such companion publications. Thus, until each 72
publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For 73
planning and transition purposes, federal agencies may wish to closely follow the development of these new 74
publications by NIST. 75
Organizations are encouraged to review all draft publications during public comment periods and provide feedback to 76
NIST. Many NIST cybersecurity publications, other than the ones noted above, are available at 77
https://csrc.nist.gov/publications. 78
79
Public comment period: October 15, 2018 through November 16, 2018 80
National Institute of Standards and Technology 81
Attn: Computer Security Division, Information Technology Laboratory 82
100 Bureau Drive (Mail Stop 8930) Gaithersburg, MD 20899-8930 83
Email: sp80052-comments@nist.gov 84
All comments are subject to release under the Freedom of Information Act (FOIA). 85
