Skip to content

Security / NIST comments

Public comments to NIST

Comments to NIST

Public comments I’ve filed on draft NIST cybersecurity publications, as sent. Each page has my original attachments and a short summary.

Sent Oct 12, 2026

SP 1353 ipd: AI for CSF analysis

NIST Cybersecurity Framework 2.0: Quick-Start Guide for Using Artificial Intelligence (AI) for CSF Analysis and Reporting

Swiss cheese for hallucinations, model choice, and why the CSF is for communication, not vulnerability hunting.
Sent Jan 30, 2026

SP 800-218r1: SSDF v1.2

SP 800-218 Rev. 1, Secure Software Development Framework (SSDF) Version 1.2: Recommendations for Mitigating the Risk of Software Vulnerabilities

Developers need the who, why and how, not just outcomes.
Sent Jan 16, 2026

SP 800-70r5: National Checklist Program

SP 800-70 Rev. 5, National Checklist Program for IT Products: Guidelines for Checklist Users and Developers

macOS hardening checklists, tried for real, and what they need to be usable.
Sent Jan 13, 2026

CSWP 53: OSCAL

Charting the Course for NIST OSCAL

Separate OSCAL’s conceptual model from its file formats, and lead with the three layers.