NIST public full text Public Domain

NIST SP 800-234 ipd: High-Performance Computing (HPC) Security Overlay

Yang Guo (NIST); Jeremy Licata (NIST); Jeff Neel (Argonne National Laboratory); Gary Key (DoD HPCMP); James Waterman (DoD HPCMP); Ian Lee (Lawrence Livermore National Laboratory, ShorePoint); Catherine Hinton (Los Alamos National Laboratory); David Shrader (Los Alamos National Laboratory); Andrew Prout (MIT Lincoln Laboratory); Albert Reuther (MIT Lincoln Laboratory); Ted Bohrer (NASA); Katsutoshi Ishisoko (NASA); Kyle Earley (Ohio Supercomputer Center); Aron Warren (Sandia National Laboratories); Tony DeNardo (Sandia National Laboratories); Ian Czarnezki (University of Arkansas); Erik Deumens (University of Florida) · National Institute of Standards and Technology (NIST)

NIST · Standards · License: Public Domain

Open Source ↗

access-control computer-security cryptography cybersecurity identity incident-response nist privacy

Conceptio Open Archive

Analyze & explore related research in Conceptio

Connect this record directly into your research workflow or AI agent. Explore citations across open repositories, query full text, and export structured proof bundles.

Explore in Search →Connect via MCP / API ↗

Withdrawn Draft Warning Notice The attached draft document has been withdrawn and is provided solely for historical purposes. It has been followed by the document identified below. Withdrawal Date May 4, 2026 Original Release Date May 1, 2025

The attached draft document is followed by: Stage Final Series/Number NIST SP 800-234 Title High-Performance Computing (HPC) Security Overlay Publication Date May 2026 DOI https://doi.org/10.6028/NIST.SP.800-234 CSRC URL https://csrc.nist.gov/pubs/sp/800/234/final Additional Information

NIST Special Publication 800 NIST SP 800-234 ipd

High-Performance Computing (HPC) Security Overlay Initial Public Draft Yang Guo Jeremy Licata Jeff Neel Gary Key James Waterman Ian Lee Catherine Hinton David Shrader Andrew Prout Albert Reuther Ted Bohrer Katsutoshi Ishisoko Kyle Earley Aron Warren Tony DeNardo Ian Czarnezki Erik Deumens This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-234.ipd

NIST Special Publication 800 NIST SP 800-234 ipd

High-Performance Computing (HPC) Security Overlay Initial Public Draft Yang Guo Jeremy Licata

Computer Security Division Information Technology Laboratory

Jeff Neel

Argonne National Laboratory

Gary Key James Waterman DoD HPCMP

Ian Lee

Lawrence Livermore National Laboratory/ShorePoint, Inc.

Catherine Hinton David Shrader

Los Alamos National Laboratory

Andrew Prout Albert Reuther

MIT Lincoln Laboratory

Kyle Earley

Ohio Supercomputer Center

Aron Warren Tony DeNardo

Sandia National Laboratories

Ian Czarnezki

University of Arkansas

Erik Deumens

University of Florida

Ted Bohrer Katsutoshi Ishisoko NASA

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-234.ipd May 2025

U.S. Department of Commerce Howard Lutnick, Secretary National Institute of Standards and Technology Craig Burkhardt, Acting Under Secretary of Commerce for Standards and Technology and Acting NIST Director

NIST SP 800-234 ipd (Initial Public Draft) May 2025

High-Performance Computing Security Overlay

Certain equipment, instruments, software, or materials, commercial or non-commercial, are identified in this paper in order to specify the experimental procedure adequately. Such identification does not imply recommendation or endorsement of any product or service by NIST, nor does it imply that the materials or equipment identified are necessarily the best available for the purpose. There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may be used by federal agencies even before the completion of such companion publications. Thus, until each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning and transition purposes, federal agencies may wish to closely follow the development of these new publications by NIST. Organizations are encouraged to review all draft publications during public comment periods and provide feedback to NIST. Many NIST cybersecurity publications, other than the ones noted above, are available at https://csrc.nist.gov/publications. Authority This publication has been developed by NIST in accordance with its statutory responsibilities under the Federal Information Security Modernization Act (FISMA) of 2014, 44 U.S.C. § 3551 et seq., Public Law (P.L.) 113-283. NIST is responsible for developing information security standards and guidelines, including minimum requirements for federal information systems, but such standards and guidelines shall not apply to national security systems without the express approval of appropriate federal officials exercising policy authority over such systems. This guideline is consistent with the requirements of the Office of Management and Budget (OMB) Circular A-130. Nothing in this publication should be taken to contradict the standards and guidelines made mandatory and binding on federal agencies by the Secretary of Commerce under statutory authority. Nor should these guidelines be interpreted as altering or superseding the existing authorities of the Secretary of Commerce, Director of the OMB, or any other federal official. This publication may be used by nongovernmental organizations on a voluntary basis and is not subject to copyright in the United States. Attribution would, however, be appreciated by NIST. NIST Technical Series Policies Copyright, Use, and Licensing Statements NIST Technical Series Publication Identifier Syntax Publication History Approved by the NIST Editorial Review Board on YYYY-MM-DD [Will be added to final publication.] How to Cite this NIST Technical Series Publication Guo Y, Licata J, Neel J, Key G, Waterman J, Lee I, Hinton C, Shrader D, Prout A, Reuther A, Bohrer T, Ishisoko K, Earley K, Warren A, DeNardo T, Czarnezki I, Deumens E (2025) High-Performance Computing (HPC) Security Overlay. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) NIST SP 800-234 ipd. https://doi.org/10.6028/NIST.SP.800-234.ipd Author ORCID iDs Yang Guo: 0000-0002-3245-3069 Jeremy Licata: 0000-0001-8793-5471 Jeff Neel: 0009-0004-5003-9429 Ian Lee: 0000-0001-6952-2585 Catherine Hinton: 0000-0002-5230-2428 Andrew Prout: 0000-0002-4408-0247

NIST SP 800-234 ipd (Initial Public Draft) May 2025

High-Performance Computing Security Overlay

Albert Reuther: 0000-0002-3168-3663 Aron Warren: 0000-0002-5090-2198 Erik Deumens: 0000-0002-7398-3090 Public Comment Period May 1, 2025 – July 3, 2025 August 4, 2025 Submit Comments sp800-234-comments@nist.gov National Institute of Standards and Technology Attn: Computer Security Division, Information Technology Laboratory 100 Bureau Drive (Mail Stop 8930) Gaithersburg, MD 20899-8930 Additional Information Additional information about this publication is available at https://csrc.nist.gov/pubs/sp/800/234/ipd, including related content, potential updates, and document history. All comments are subject to release under the Freedom of Information Act (FOIA).

NIST SP 800-234 ipd (Initial Public Draft) May 2025

High-Performance Computing Security Overlay

Abstract

2 3 4 5 6 7 8 9 10 11 12

High-performance computing (HPC) systems provide fundamental computing infrastructure for large-scale artificial intelligence (AI) and machine learning (ML) model training, big data analysis, and complex simulations at exceptional speeds. Securing HPC systems is essential for safeguarding AI models, protecting sensitive data, and realizing the full benefits of HPC capabilities. This NIST Special Publication introduces an HPC security overlay that is designed to address the unique characteristics and requirements of HPC systems. Built upon the moderate baseline defined in SP 800-53B, the overlay tailors 60 security controls with supplemental guidance and/or discussions to enhance their applicability in HPC contexts. This overlay aims to provide practical, performance-conscious security guidance that can be readily adopted. For many organizations, it offers a robust foundation for securing HPC environments while also allowing for further customization to meet specific operational or mission needs.

Keywords

14 15

high-performance computing; HPC reference architecture; HPC security; moderate control baselines; security control; security overlay.

Reports on Computer Systems Technology

17 18 19 20 21 22 23 24 25 26

The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the Nation’s measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology. ITL’s responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in federal information systems. The Special Publication 800-series reports on ITL’s research, guidelines, and outreach efforts in information system security, and its collaborative activities with industry, government, and academic organizations.

NIST SP 800-234 ipd (Initial Public Draft) May 2025

High-Performance Computing Security Overlay

Call for Patent Claims

29 30 31 32 33 34 35

This public review includes a call for information on essential patent claims (claims whose use would be required for compliance with the guidance or requirements in this Information Technology Laboratory (ITL) draft publication). Such guidance and/or requirements may be directly stated in this ITL Publication or by reference to another publication. This call also includes disclosure, where known, of the existence of pending U.S. or foreign patent applications relating to this ITL draft publication and of any relevant unexpired U.S. or foreign patents.

36 37

ITL may require from the patent holder, or a party authorized to make assurances on its behalf, in written or electronic form, either:

38 39

a) assurance in the form of a general disclaimer to the effect that such party does not hold and does not currently intend holding any essential patent claim(s); or

40 41 42

b) assurance that a license to such essential patent claim(s) will be made available to applicants desiring to utilize the license for the purpose of complying with the guidance or requirements in this ITL draft publication either:

43 44

under reasonable terms and conditions that are demonstrably free of any unfair discrimination; or

45 46

ii.

without compensation and under reasonable terms and conditions that are demonstrably free of any unfair discrimination.

47 48 49 50 51

Such assurance shall indicate that the patent holder (or third party authorized to make assurances on its behalf) will include in any documents transferring ownership of patents subject to the assurance, provisions sufficient to ensure that the commitments in the assurance are binding on the transferee, and that the transferee will similarly include appropriate provisions in the event of future transfers with the goal of binding each successor-in-interest.

52 53

The assurance shall also indicate that it is intended to be binding on successors-in-interest regardless of whether such provisions are included in the relevant transfer documents.

Such statements should be addressed to: sp800-234-comments@nist.gov

NIST SP 800-234 ipd (Initial Public Draft) May 2025

High-Performance Computing Security Overlay

Table of Contents

1. Introduction ...................................................................................................................................1

2. HPC Security Overlay Summary.......................................................................................................3

3. Tailored Security Control Specifications ........................................................................................10

59 60 61 62 63 64 65 66 67 68 69 70 71 72 73

4. Summary .....................................................................................................................................23

References.......................................................................................................................................24

List of Tables

Table 1. A Summary of Security Controls in the HPC Control Overlay ...................................................3

List of Figures

Fig. 1. HPC system reference architecture ...........................................................................................1

iii

NIST SP 800-234 ipd (Initial Public Draft) May 2025

High-Performance Computing Security Overlay

1. Introduction

81 82 83 84 85

High-performance computing (HPC) systems provide fundamental computing infrastructure and play a pivotal role in economic competitiveness and scientific discovery. The capacity to train large-scale AI models, analyze big data, and rapidly conduct complex simulations is vital to the Nation’s vision for maintaining its global competitive edge. Therefore, it is essential to secure HPC systems to protect AI models, ensure data safety, and achieve the anticipated benefits.

86 87 88 89 90

This HPC security overlay was developed to provide supplemental guidance and discussions tailored to the unique characteristics of HPC systems. Its goal is to make the security overlay easy to implement in practice without sacrificing system performance. NIST Special Publication (SP) 800-223 [1] proposes a zone-based HPC reference architecture, as shown in Fig. 1.

91 92

Fig. 1. HPC system reference architecture

93 94 95 96

An HPC system is divided into four function zones: Access Zone, Management Zone, HighPerformance Computing Zone (or Computing Zone for brevity), and Data Storage Zone. Each zone offers distinct services with specific performance requirements, features unique architecture, and faces different threats.

97 98 99 100 101

While many security controls from SP 800-53r5 (Revision 5) [2] are applicable, some controls need to be tailored to suit the unique architecture and performance requirements of HPC systems. Additionally, different zones within the system face different threats, providing an opportunity to create customized guidance for each zone. Implementing fine-grained controls can effectively address security needs without compromising system performance.

NIST SP 800-234 ipd (Initial Public Draft) May 2025

High-Performance Computing Security Overlay

102 103 104 105 106 107 108 109

This HPC security overlay uses the moderate baseline outlined in SP 800-53B [3] as the basic security baseline. The tailoring and augmented discussions are conducted at five levels: the entire High-Performance Computing (HPC) system (i.e., All Zones), the Access Zone, the Management Zone, the Computing Zone, and the Data Storage Zone. The moderate-impact baseline makes the HPC security overlay applicable to a wide range of HPC systems. If necessary, operators have the flexibility to further customize this security framework to meet their specific needs. For instance, an HPC system that supports multi-tenancy may need its own security overlay that can be developed based on the overlay described in this document.

110

The rest of the document is organized as follows:

111 112

•

Section 2 provides a summary of the HPC security overlay, and readers can easily look up the tailored controls.

113

•

Section 3 provides detailed descriptions of each tailored security control.

114

•

Section 4 provides a summary of the document.

NIST SP 800-234 ipd (Initial Public Draft) May 2025

High-Performance Computing Security Overlay

115

2. HPC Security Overlay Summary

116 117 118 119 120

Table 1 summarizes the security controls in the HPC control overlay. It includes 287 controls that belong to the moderate control baseline, as defined in SP 800-53B [3]. Control AC-10 is not part of the moderate control baseline but has been deemed necessary and added to the HPC control overlay. This control is indicated by the letter “N” in the Moderate Baseline column. The symbols used in the table are:

121 122

•

The letter “G” indicates that the control is tailored with supplemental guidance for All Zones and/or individual zones. 1

123

•

The letter “D” indicates that a discussion is added for All Zones and/or individual zones. 2

124

•

Two dashes (i.e., “--”) indicate no additional supplemental guidance or discussion.

125 126

•

The letter “N” indicates that the control does not belong to the moderate control baseline but has been added to the HPC security overlay.

127

Table 1. A Summary of Security Controls in the HPC Control Overlay CONTROL AC-1 AC-2 AC-2(1) AC-2(2) AC-2(3) AC-2(4) AC-2(5) AC-2(13) AC-3 AC-4 AC-5 AC-6 AC-6(1) AC-6(2) AC-6(5) AC-6(7) AC-6(9) AC-6(10) AC-7 AC-8 AC-10 AC-11 AC-11(1) AC-12 AC-14 AC-17

Moderate Baseline

All Zones -D ----D -G G ----D -D ---

GD ------

Access Zone

Management Zone

Computing Zone

-G ----GD ----------------GD ---

-G -----------------GD -------

-G ----GD ------------GD ---GD ---

1 Supplemental guidance for All Zones automatically applies to each individual zone. 2 Discussions for All Zones automatically apply to each individual zone.

Data Storage Zone -GD -----------------GD -------

NIST SP 800-234 ipd (Initial Public Draft) May 2025 CONTROL AC-17(1) AC-17(2) AC-17(3) AC-17(4) AC-18 AC-18(1) AC-18(3) AC-19 AC-19(5) AC-20 AC-20(1) AC-20(2) AC-21 AC-22 AT-1 AT-2 AT-2(2) AT-2(3) AT-3 AT-4 AU-1 AU-2 AU-3 AU-3(1) AU-4 AU-5 AU-6 AU-6(1) AU-6(3) AU-7 AU-7(1) AU-8 AU-9 AU-9(4) AU-11 AU-12 CA-1 CA-2 CA-2(1) CA-3 CA-5 CA-6 CA-7 CA-7(1) CA-7(4) CA-9 CM-1 CM-2

Moderate Baseline

High-Performance Computing Security Overlay

All Zones

Access Zone

Management Zone

Computing Zone

--D -D ----D -D --D ---GD --GD D -D D --------D ---D ------D ---

-------------------------------------------------

---G ---------------------------------------------

-------------------------------------------------

Data Storage Zone -------------------------------------------------

NIST SP 800-234 ipd (Initial Public Draft) May 2025 CONTROL CM-2(2) CM-2(3) CM-2(7) CM-3 CM-3(2) CM-3(4) CM-4 CM-4(2) CM-5 CM-6 CM-7 CM-7(1) CM-7(2) CM-7(5) CM-8 CM-8(1) CM-8(3) CM-9 CM-10 CM-11 CM-12 CM-12(1) CP-1 CP-2 CP-2(1) CP-2(3) CP-2(8) CP-3 CP-4 CP-4(1) CP-6 CP-6(1) CP-6(3) CP-7 CP-7(1) CP-7(2) CP-7(3) CP-8 CP-8(1) CP-8(2) CP-9 CP-9(1) CP-9(8) CP-10 CP-10(2) IA-1 IA-2 IA-2(1)

Moderate Baseline

High-Performance Computing Security Overlay

All Zones

Access Zone

Management Zone

Computing Zone

D ---D -----D D ----D D ---D D -------D --D ------D ----GD -G

------------D G -----G -----------------------------

-------------------G -----------------------------

------------D G -----G -----------------------------

Data Storage Zone -------------------G -----------------------------

NIST SP 800-234 ipd (Initial Public Draft) May 2025 CONTROL IA-2(2) IA-2(8) IA-2(12) IA-3 IA-4 IA-4(4) IA-5 IA-5(1) IA-5(2) IA-5(6) IA-6 IA-7 IA-8 IA-8(1) IA-8(2) IA-8(4) IA-11 IA-12 IA-12(2) IA-12(3) IA-12(5) IR-1 IR-2 IR-3 IR-3(2) IR-4 IR-4(1) IR-5 IR-6 IR-6(1) IR-6(3) IR-7 IR-7(1) IR-8 MA-1 MA-2 MA-3 MA-3(1) MA-3(2) MA-3(3) MA-4 MA-5 MA-6 MP-1 MP-2 MP-3 MP-4 MP-5

Moderate Baseline

High-Performance Computing Security Overlay

All Zones

Access Zone

Management Zone

Computing Zone

G -GD -------------D -------------------------D ------

----------------GD --------------------------------

----------------D --------------------------------

----------------GD --------------------------------

Data Storage Zone ----------------GD --------------------------------

NIST SP 800-234 ipd (Initial Public Draft) May 2025 CONTROL MP-6 MP-7 PE-1 PE-2 PE-3 PE-4 PE-5 PE-6 PE-6(1) PE-8 PE-9 PE-10 PE-11 PE-12 PE-13 PE-13(1) PE-14 PE-15 PE-16 PE-17 PL-1 PL-2 PL-4 PL-4(1) PL-8 PL-10 PL-11 PS-1 PS-2 PS-3 PS-4 PS-5 PS-6 PS-7 PS-8 PS-9 RA-1 RA-2 RA-3 RA-3(1) RA-5 RA-5(2) RA-5(5) RA-5(11) RA-7 RA-9 SA-1 SA-2

Moderate Baseline

High-Performance Computing Security Overlay

All Zones

Access Zone

Management Zone

Computing Zone

-----------------D --------G -------------GD --------

-------------------------------------------------

------------GD ------------------------------------

Data Storage Zone -------------------------------------------------

NIST SP 800-234 ipd (Initial Public Draft) May 2025 CONTROL SA-3 SA-4 SA-4(1) SA-4(2) SA-4(9) SA-4(10) SA-5 SA-8 SA-9 SA-9(2) SA-10 SA-11 SA-15 SA-15(3) SA-22 SC-1 SC-2 SC-4 SC-5 SC-7 SC-7(3) SC-7(4) SC-7(5) SC-7(7) SC-7(8) SC-8 SC-8(1) SC-10 SC-12 SC-13 SC-15 SC-17 SC-18 SC-20 SC-21 SC-22 SC-23 SC-28 SC-28(1) SC-39 SI-1 SI-2 SI-2(2) SI-3 SI-4 SI-4(2) SI-4(4) SI-4(5)

Moderate Baseline

High-Performance Computing Security Overlay

All Zones

Access Zone

Management Zone

Computing Zone

------------------D ------D G D --D -D ----D ---D -GD D ----

-------------------------------------------------

-----------------G -------------------------------

Data Storage Zone -------------------------------------------------

NIST SP 800-234 ipd (Initial Public Draft) May 2025 CONTROL

128

SI-5 SI-7 SI-7(1) SI-7(7) SI-8 SI-8(2) SI-10 SI-11 SI-12 SI-16 SR-1 SR-2 SR-2(1) SR-3 SR-5 SR-6 SR-8 SR-10 SR-11 SR-11(1) SR-11(2) SR-12

Moderate Baseline

High-Performance Computing Security Overlay

All Zones

Access Zone

Management Zone

Computing Zone

D G ----D ----------------

-----------------------

Data Storage Zone -D ---------------------

NIST SP 800-234 ipd (Initial Public Draft) May 2025

High-Performance Computing Security Overlay

129

3. Tailored Security Control Specifications

130 131 132

The total 60 security controls are either supplemented with additional guidance and/or augmented with discussions. In this section, these tailored security controls are categorized into 14 groups and presented in subsections for easier comparison.

133

3.1. Role-Based Access Control

134

AC-2, Account Management

135 136

Discussion for All Zones: An account’s role should dictate its access to the HPC system and specific zones.

137 138

Supplemental Guidance for the Access Zone: This zone should be accessible to all authorized accounts, including users and system administrators.

139 140

Supplemental Guidance for the Management Zone: This zone is only accessible to system administrators.

141 142 143 144

Supplemental Guidance for the Computing Zone: This zone can be accessed by system administrators and user accounts that are authorized by the batch scheduler. Authorized users can only access high-performance computing nodes that have been assigned by the batch scheduler.

145 146

Supplemental Guidance for the Data Storage Zone: This zone is only accessible to system administrators.

147 148 149 150

Discussion for the Data Storage Zone: The data storage zone provides data service to the other zones. Users can access the data services via data service Application Programming Interfaces (APIs) but cannot log directly into the data storage servers/nodes. A good example of an API to the storage system is by using a mounted POSIX file system.

151

AC-3, Access Enforcement

152 153

Supplemental Guidance for All Zones: In HPC, the access privileges granted on one zone may not be automatically cascaded to another zone.

154

AC-6(5), Least Privilege | Privileged Accounts

155 156 157 158 159 160 161

Discussion for All Zones: In addition to the principle of least privilege, the privileges assigned to users and system administrators should be appropriate for their roles. The number of separate roles and accounts for system administrators should align with local policy. For instance, system administrators with root access should not — by policy — run user-type jobs in the computing zone. Rather, system administrators should have separate general user accounts for regular user tasks. System administrators may also schedule system maintenance jobs (e.g., performing rolling upgrades) with root privileges using a scheduler.

162

AC-17(4), Remote Access | Privileged Commands and Access

163 164

Supplemental Guidance for the Management Zone: There should be an organizationally defined and approved path to connect to the management zone, such as a gateway or bastion host.

NIST SP 800-234 ipd (Initial Public Draft) May 2025

High-Performance Computing Security Overlay

165 166 167

Access to the Management Zone from other zones should be restricted, and these access paths should not overlap with user access paths. For instance, separate networks or VLANs should be used for login access and API access to the Management Zone.

168

3.2. HPC Logging

169

AC-6(9), Least Privilege | Log Use of Privileged Functions

170 171 172 173

Discussion for All Zones: Reducing the logging of privileged functions may pose a more significant risk than summarizing or discarding other logging events. Organizations should carefully consider this risk when evaluating the need to reduce logging. See AU-2 for further discussion.

174

AU-2, Event Logging

175 176 177

Supplemental Guidance for All Zones: Organizations should examine logging events to ensure that there is no duplicate logging. They may also consider reducing the logging event set with tolerable risks to ensure HPC system performance.

178 179 180 181 182 183 184 185 186

Discussion for All Zones: Parallelization in HPC environments may result in duplicated logging of the same event, and the large logging volume may negatively impact HPC system performance. For further guidance, see Office of Management and Budget (OMB) Memorandum M-21-31 [4] and the Cybersecurity and Infrastructure Security Agency (CISA) guide [5] for its implementation. Following the CISA guidance, there should be prioritized and detailed logging in the Management Zone over the Access Zone, and a lower priority should be given to the Data Storage Zone and the Computing Zone. Increase logging based on the priority list, and allocate resources (e.g., storage, performance) according to the risks that need to be managed through logging.

187

AU-3, Content of Audit Records

188 189 190 191 192 193

Discussion for All Zones: For further guidance, see OMB M-21-31 [4] and the CISA guide [5] for its implementation. Following the CISA guidance, the level of detail in logging in the Management Zone should be prioritized over the Access Zone, followed by the Data Storage Zone and the Computing Zone at the lowest priority. Increase logging based on the priority list, and allocate resources (e.g., storage, performance) according to the risks that need to be managed through logging.

194

AU-4, Audit Log Storage Capacity

195 196 197 198 199

Discussion for All Zones: The volume of logging in HPC systems can grow rapidly and unexpectedly. Organizations should customize their logging practices across different zones to effectively manage the volume of log data while also considering future logging requirements during procurements. Centralized logging is recommended for improved log retention and management.

200

AU-5, Response to Audit Logging Process Failures

201 202

Discussion for All Zones: The volume of logging in HPC systems can increase rapidly and unexpectedly. Organizations must be alerted early and respond promptly to prevent their 11

NIST SP 800-234 ipd (Initial Public Draft) May 2025

High-Performance Computing Security Overlay

203 204 205 206

logging systems from overflowing and causing potential cascading failures. A swift response to logging failures is particularly essential for HPC systems that include diskless nodes, as these nodes do not have local persistent storage to help them endure an outage of the centralized logging service.

207

AU-11, Audit Record Retention

208 209 210

Discussion for All Zones: Due to the system’s size and complexity, the volume of HPC system log data can be enormous. Organizations are encouraged to consider different retention policies based on their log data’s sensitivity and usefulness for audit purposes.

211

3.3. User Sessions

212

AC-2(5), Account Management | Inactivity Logout

213 214 215

Discussion for All Zones: While it is best practice to log out whenever possible, a logout may negatively impact ongoing work. In such scenarios, consider implementing compensatory measures to regulate access to the login session.

216 217 218 219 220

Supplemental Guidance for the Access Zone: The recommended logout time should align with the security policy for managing HPC user inactivity in the Access Zone. In HPC systems, it is crucial to distinguish a login session from the running processes that it controls. If it is feasible to log out of a session after inactivity without terminating the running process it controls, then the inactivity logout control can be implemented in HPC systems.

221 222 223 224

Discussion for the Access Zone: If the processes that run under the login session are separated from the remote login session, then the controlling remote session can be terminated without negatively affecting the running processes. Organizations can educate their users on utilizing tools such as GNU Screen [6] or tmux [7] to enable the separation.

225 226 227 228

Supplemental Guidance for the Computing Zone: The recommended logout time frame should conform to the security policy regarding user inactivity in the Computing Zone. Users who have active running jobs or processes should not be logged out. Access to compute nodes should only be terminated when the compute jobs are completed.

229 230 231

Discussion for the Computing Zone: User inactivity may occur while waiting for companion computing nodes to finish their tasks. Automatic user logout could lead to hanging jobs in the Computing Zone.

232

AC-10, Concurrent Session Control 3

233 234 235

Supplemental Guidance for All Zones: The maximum number of allowed concurrent sessions in an HPC system may be set at a greater value at the organization’s discretion. The maximum number of allowed concurrent sessions in different HPC zones may be set at different values.

236 237 238

Discussion for All Zones: Here, concurrent sessions refer to interactive concurrent sessions. Due to its scale and the number of interactive jobs that it supports, an HPC system generally requires more concurrent sessions than a typical enterprise system. Organizations are 3 This control does not belong to the moderate security control baseline.

NIST SP 800-234 ipd (Initial Public Draft) May 2025

High-Performance Computing Security Overlay

239 240

encouraged to conduct a proper risk assessment when choosing the maximum concurrent session threshold.

241

AC-12, Session Termination

242 243 244

Supplemental Guidance for the Access Zone: The selected session termination threshold should reflect the security policy for handling HPC user inactivity in the Access Zone. In general, the session termination threshold is set at a higher value than in typical enterprise systems.

245 246 247 248 249 250

Discussion for the Access Zone: Session termination terminates the user’s interactive job and causes the user to lose their place in the scheduling queue. If the endpoints from which connections to the HPC system are made can be controlled, then a screen lock on the endpoint mitigates the risk of lengthening the termination threshold. Also, consider using tools that allow running processes to be disconnected from login sessions. In that case, the termination of the login session does not impact the running process.

251 252 253

Supplemental Guidance for the Computing Zone: The selected session termination threshold should reflect the security policy for handling HPC user inactivity in the Computing Zone. Sessions with current running jobs should not be terminated automatically in this zone.

254 255 256

Discussion for the Computing Zone: User inactivity may be caused by waiting for a companion compute node to finish processing the data. Terminating the session will lead to hanging jobs in the Computing Zone.

257

SC-10, Network Disconnect

258 259 260 261 262

Discussion for All Zones: Most HPC jobs can continue running even if the network connection is lost. This includes interactive debugging sessions, which may run for a long time. The debugging session should be managed using a tool that allows the running process to be temporarily disconnected from the login session. If the connection to that session is terminated, the user can still reconnect later.

263

3.4. HPC Backup

264

CP-1, Policy and Procedures

265 266 267 268 269 270 271 272 273

Discussion for All Zones: The contingency plan, policy, and procedures are heavily influenced by the mission of the HPC systems. For instance, research HPC systems may not be as critical as business support systems and may tolerate a longer outage period. Due to the cost of HPC systems, having a fully functional alternate site is often cost-prohibitive, and funds may be better spent making the primary site a more powerful system. Full data backup may also be prohibitive given the volume of the data and the fact that the intermediate results often change and have little innate value. Accordingly, HPC contingency plans may focus on reconstitution, reloading user input data from external authoritative sources, and ensuring that users are trained to promptly copy their output data (i.e., computational results) to external archives.

274

CP-6, Alternate Storage Site

275 276

Discussion for All Zones: It may not be feasible to back up all of the data in HPC systems. Configuration data and critical project information should be prioritized for backup at the 13

NIST SP 800-234 ipd (Initial Public Draft) May 2025

High-Performance Computing Security Overlay

277 278 279 280

alternate site to ensure that the HPC system can be restored to a functional state. The organization should identify critical data (e.g., user home directories, configuration management files) to be backed up at the alternate site. User training and contingency plans should clearly specify which data is backed up at the alternate site and which is not.

281

CP-7, Alternate Processing Site

282 283 284 285 286 287

Discussion for All Zones: Based on its needs and mission requirements, an organization may be unable to fund an alternate HPC system. Alternate processing sites may include processing sites at similar institutions via a Memorandum of Understanding (MOU) or utilizing the capabilities offered by cloud HPC service providers. An alternate processing site’s architecture and capabilities may be different from the primary site as long as it satisfies the organization’s mission requirements.

288

CP-9, System Backup

289 290 291 292 293

Discussion for All Zones: HPC systems typically have multiple data storage systems, some of which are designated as temporary or “scratch” and explicitly not backed up. Given the large volume of data in HPC systems, it may not be feasible to back up all data. Priority should be given to configuration data and critical project data to ensure that the HPC system can be restored to a functional state.

294

3.5. HPC Network Connections

295

AC-4, Information Flow Enforcement

296 297 298 299 300 301 302

Supplemental Guidance for All Zones: End-user access connections between external systems and the HPC system should be routed through the Access Zone. Such connections may need to support large data flows while following proper flow enforcement rules. The performance impact on the data flow due to security measures (e.g., firewall packet inspection, intrusion detection and prevention systems) may need to be accounted for and sometimes mitigated by doing the inspection on the replicated data flow while leaving the original flow unimpeded. The controlled interfaces within an HPC system should enforce the internal information flow rules.

303

CA-9, Internal System Connections

304 305 306 307 308

Discussion for All Zones: In this control, an HPC system with four zones is considered one unified system component. Communication connections between zones are outlined in SP 800-223 [3]. Within the Computing Zone, user jobs may set up connections between authorized processes that run on different nodes. These connections are confined to the Computing Zone and can be classified as authorized internal connections.

309

SC-8, Transmission Confidentiality and Integrity

310 311 312 313 314

Discussion for All Zones: An HPC system resides on an enterprise network. External connections include both the connections from the external internet to the HPC Access Zone and the connections from the enterprise network to the HPC Access Zone. Internal connections refer to connections inside the HPC boundary, as defined in SP 800-223 [3]. If this control cannot be effectively implemented in practice, compensating controls may serve as an alternative. For

NIST SP 800-234 ipd (Initial Public Draft) May 2025

High-Performance Computing Security Overlay

315 316 317 318

instance, encrypting traffic over internal connections may not be practical at this time. Compensating controls may use private, non-routable networks (e.g., for Message Passing Interface [4] jobs). Internal traffic encryption may become feasible in the future as hardware and software capabilities evolve.

319

SC-8(1), Transmission Confidentiality and Integrity | Cryptographic Protection

320 321 322

Supplemental Guidance for All Zones: No additional guidance is needed for transmissions over external connections. However, due to the nature of HPC, cryptographic protection may not be feasible for internal transmissions. See the discussions in SC-8 regarding alternative controls.

323

3.6. Identification and Authentication

324

IA-1, Policy and Procedures

325 326

Supplemental Guidance for All Zones: When developing policies and procedures, the unique requirements for accessing HPC systems should be properly considered and addressed.

327 328 329

Discussion for All Zones: HPC systems often have unique access requirements for the different zones. Organizations should consider accesses within the HPC system as single sign-on wherever appropriate.

330 331

IA-2(1), Identification and Authentication (Organizational Users) | Multi-Factor Authentication to Privileged Accounts

332 333 334 335 336

Supplemental Guidance for All Zones: Multi-factor authentication (MFA) should be required for access to the HPC system. However, once access is acquired, non-MFA connections among nodes within the HPC system may be permitted using the same identity. Changing identities within the system should also require MFA. Based on an organization’s policy, different zones may require MFA again.

337 338

IA-2(2), Identification and Authentication (Organizational Users) | Multi-Factor Authentication to Non-Privileged Accounts

339 340 341 342

Supplemental Guidance for All Zones: MFA should be required for access to the HPC system. However, once access is acquired, non-MFA connections among nodes within the HPC system may be permitted using the same identity. Changing identities within the system should also require MFA. Based on an organization’s policy, different zones may require MFA again.

343 344

IA-2(12), Identification and Authentication (Organizational Users) | Acceptance of PIV Credentials

345 346 347

Supplemental Guidance for All Zones: If Personal Identity Verification (PIV) is used to grant access to the HPC Access Zone, it should not be required again for internal access within the system. See IA-2(2).

348 349 350

Discussion for All Zones: Due to the large and diverse user base of HPC systems, organizations that require PIV as access identification (ID) may also consider accepting alternate forms of MFA for external users.

NIST SP 800-234 ipd (Initial Public Draft) May 2025

High-Performance Computing Security Overlay

351

IA-11, Re-Authentication

352 353 354 355 356

Discussion for All Zones: Re-authentication could disrupt HPC user operations (e.g., interactive visualization, interactive debugging, multiple file downloading) and is often problematic due to the long-lived connections that exist in and between zones. This control is often tailored, and the time to re-authenticate is often set to infinity. Compensating controls (e.g., screen lock) can be introduced to mitigate the risks.

357 358

Supplemental Guidance for the Access Zone: This control should be carefully considered. See Sec. 3.3.

359

Discussion for the Access Zone: Login nodes often need to support long-lived sessions.

360 361

Discussion for the Management Zone: Management Zone access is typically limited to system administrators, and normal re-authentication should be enforced.

362 363

Supplemental Guidance for the Computing Zone: This control should be carefully considered. See Sec. 3.3.

364 365

Discussion for the Computing Zone: High-performance computing nodes need to support longrunning jobs. Re-authentication will disrupt job execution.

366 367

Supplemental Guidance for the Data Storage Zone: This control must be enforced to ensure proper access for system administrators.

368 369 370 371 372

Discussion for the Data Storage Zone: HPC users access data, metadata, and file folders in the Data Storage Zone via file system clients, which make API calls to their corresponding file system servers for data retrieval. Users are not typically authorized to log into the Data Storage Zone directly and instead achieve access through service components. No additional authorization should be required once a user acquires initial access to the HPC system.

373

3.7. Emergency Handling

374

PE-11, Emergency Power

375 376

Supplemental Guidance for the Computing Zone: Depending on the HPC system’s mission requirements, this control can either be enforced or tailored.

377 378 379

Discussion for the Computing Zone: The Computing Zone consumes a large volume of power. Hence, providing emergency power requires a significant investment. A job that is terminated due to a power interruption can restart, and the correctness of the job is not affected.

380

PE-15, Water Damage Protection

381 382 383 384

Discussion for All Zones: In addition to water being used in fire suppression systems, other cooling technologies may involve liquids that can damage equipment. The risks should be evaluated in the context of costs and potential damage, and a mitigation plan should be developed.

NIST SP 800-234 ipd (Initial Public Draft) May 2025

High-Performance Computing Security Overlay

385

3.8. User-Developed Software

386

CM-7, Least Functionality

387 388 389 390 391 392

Discussion for All Zones: Many HPC systems support broad missions and often allow users to develop and run their own software. The least functionality can be difficult to achieve due to diverse user cases. User isolation technologies should be used to limit the effect of adverse software. This includes limiting user activities to and within the Access Zone and Computing Zone, thereby separating user activity from the more privileged and protected Data Storage Zone and Management Zone.

393

CM-7(1), Least Functionality | Periodic Review

394 395 396 397

Discussion for All Zones: Users should understand the different functionalities of each zone. The time period for conducting the least functionality control review should not exceed one year. Due to the sensitivity of and frequent changes in the Access Zone and Management Zone, a more frequent review (e.g., a quarterly review) should be considered.

398

CM-7(2), Least Functionality | Prevent Program Execution

399 400 401 402 403

Discussion for the Access Zone and Computing Zone: Many HPC systems cater to a variety of missions and often allow users to develop and run their own software. However, additional guidance and compensating controls may be necessary. For example, users should run their self-developed software in non-privileged mode, and it is important to consider implementing segregation among different programs and projects.

404

CM-7(5), Least Functionality | Authorized Software — Allow-by-Exception

405 406 407 408 409

Supplemental Guidance for the Access Zone and Computing Zones: Depending on the mission of an HPC system, a user’s self-developed software may be allowed to run. It may be impractical to maintain a list of explicitly allowed software when the mission of the HPC system allows users to bring in, develop, or compile software, as the list would need to be updated continuously to track user actions.

410

CM-11, User-Installed Software

411 412 413 414 415 416 417 418 419 420 421

Supplemental Guidance for the Access Zone and Computing Zones: User software is only accessible to individual users and their collaborators, while system-wide software can be used by all authorized users of a system. Additionally, software that requires special privileges to execute (e.g., software that needs access to privileged ports) is different from software that does not require any additional privileges. This control specifically pertains to non-privileged software that is used by a limited group of users. Users may be allowed to install and develop software that is necessary for their mission. They should create and manage this software in user space and regulate access for other users. Software that is installed system-wide is generally accessible to all users through a default path, while user-installed software is often accessed via specific paths. Users should not install software in the default path of any zone unless it complies with approved organizational policies.

422 423

Supplemental Guidance for the Management Zone and Storage Zone: Unprivileged user software should not be allowed in these zones.

NIST SP 800-234 ipd (Initial Public Draft) May 2025

High-Performance Computing Security Overlay

424

SI-10, Information Input Validation

425 426 427 428

Discussion for All Zones: Users may be allowed to develop and run their own software on HPC systems that are designed to support a wide range of missions. For software created by users, it is crucial to follow safe and secure coding practices, adhere to acceptable use agreements, and implement security measures (e.g., input validation).

429

3.9. Impact on HPC Performance and Scalability

430

AC-8, System Use Notification

431 432 433

Supplemental Guidance for the Computing Zone, Management Zone, and Data Storage Zone: System use notifications (e.g., message of the day, legal banners) may be omitted at the organization’s discretion to improve job output efficiency.

434 435 436 437 438

Discussion for the Computing Zone, Management Zone, and Data Storage Zone: Displaying system use notifications (e.g., message of the day, legal banners) adds an additional burden on users because they need to remove these messages from job output. In an HPC system, once users have accepted a system’s use notification, further display in the other zones may be skipped at the organization’s discretion.

439

SI-3, Malicious Code Protection

440 441

Supplemental Guidance for All Zones: This control may need to be tailored for different zones if it negatively impacts HPC performance or poses risks to the system’s mission.

442 443 444 445 446 447

Discussion for All Zones: Real-time process scanning is the most effective approach for this control. Periodically scanning large file systems is often infeasible and negatively impacts storage system performance. Scanning shared resources from multiple compute nodes may also cause duplicate scans of the same data. The endpoints used by authorized users to access the HPC system are covered by organizational policies and are required to have malicious code protection installed to ensure that data is scanned prior to reaching the HPC system.

448

SI-4, System Monitoring

449 450 451 452 453

Discussion for All Zones: In HPC environments, there are often large, high-speed data flows to and from the Access Zone. These flows can overwhelm standard enterprise network monitoring tools. Internal networking may also require special consideration to collect the necessary information without negatively affecting the HPC system’s performance or mission. See AU-2 for additional information.

454

SI-7, Software, Firmware, and Information Integrity

455 456 457 458

Supplemental Guidance for All Zones: This control is limited to system software, firmware, and information rather than user-installed software or user-managed information. System-wide installed software is accessible through the default path of all users, and software within specific domains is often accessed through specific paths. See CM-11.

NIST SP 800-234 ipd (Initial Public Draft) May 2025

High-Performance Computing Security Overlay

459 460 461

Discussion for the Data Storage Zone: The parallel file systems in the Data Storage Zone often contain vast amounts of data and software, making it infeasible to conduct regular integrity checks on the entire file system.

462

CM-8(3), System Component Inventory | Automated Unauthorized Component Detection

463 464 465 466

Discussion for All Zones: Due to the size and complexity of HPC systems, automated inventory management scanning by enterprise tools from outside the HPC environment may lead to undesirable performance penalties and/or incorrect results. Out-of-band or idle-time assessment of the hardware components should be considered as alternatives.

467

CM-12(1), Information Location | Automated Tools to Support Information Location

468 469

Discussion for All Zones: While no additional guidance is needed, unintended impacts on the cost and performance of HPC systems should be considered during the control implementation.

470

RA-5, Vulnerability Monitoring and Scanning

471 472 473

Supplemental Guidance for All Zones: Due to the size and complexity of HPC systems, strategies should be developed to minimize the scanning overhead and possible scanning impacts on HPC processes and operations.

474 475 476 477 478 479

Discussion for All Zones: Scanning policies can be customized for different zones. Shared filesystems should avoid repeated scanning by multiple nodes. Given the filesystem size, data change rate, and/or scanning system load, scanning shared filesystems may not be feasible. HPC systems may also contain identical computing and data storage nodes. Scanning one node may be sufficient in this scenario. If a diskless system is employed, scanning one copy of the image is also sufficient.

480

3.10. Inapplicable to HPC

481

SC-15, Collaborative Computing Devices and Applications

482

Discussion for All Zones: This control is generally not applicable to HPC systems.

483

SC-18, Mobile Code

484

Discussion for All Zones: The use of mobile code is usually not found in HPC environments.

485

3.11. Shared GPUs and Accelerators

486

SC-4, Information in Shared System Resources

487 488 489

Supplemental Guidance for the Computing Zone: Computer systems that are equipped with accelerators (e.g., GPUs) should ensure that user data in the accelerator is cleared before being reassigned to the next user.

NIST SP 800-234 ipd (Initial Public Draft) May 2025

High-Performance Computing Security Overlay

490

3.12. HPC-Specific Training and Security Overlay Tailoring

491

PL-11, Baseline Tailoring

492 493

Supplemental Guidance for All Zones: Using this overlay implies tailoring the selected baseline. Additional tailoring is possible as governed by organizational requirements.

494

AT-1, Policy and Procedures

495 496

Discussion for All Zones: Organizations are encouraged to develop HPC-specific documentation and training that captures their HPC system’s unique characteristics.

497

AT-3, Role-Based Training

498 499

Supplemental Guidance for All Zones: HPC users and system administrators should receive HPCspecific training that is suitable for their roles.

500 501 502

Discussion for All Zones: The complexity and scale of HPC systems require skilled administrators and users. Users, administrators, and other organizational roles require additional training to facilitate communication between these specialized roles.

503

CA-2(1), Control Assessments | Independent Assessors

504 505

Discussion for All Zones: Due to the unique characteristics of HPC systems, assessors who are familiar with these systems will yield more effective assessment results.

506

3.13. HPC Management, Operation, and Maintenance

507

MA-6, Timely Maintenance

508 509 510

Discussion for All Zones: The time period threshold parameters defined by the organization may vary based on the criticality and impact of maintenance on the components in HPC systems, including software.

511

SI-2, Flaw Remediation

512 513 514 515 516

Discussion for All Zones: The organization-defined timing of fixing flaws may need special consideration for different HPC zones. For example, applying patches may be limited by vendor update schedules and the timing of integrating dependency patches from third-party sources. Additionally, both the Computing Zone and Data Storage Zone support long-running jobs that may exceed the organization-specified patch window, which requires special handling.

517

SI-5, Security Alerts, Advisories, and Directives

518 519 520

Discussion for All Zones: HPC-specific alerts may not be widely disseminated by default. HPC operators should subscribe to vendor-specific channels to receive relevant alerts about their systems.

521

CM-2(2), Baseline Configuration | Automation Support for Accuracy and Currency

522 523

Discussion for All Zones: Due to the complexity of HPC systems, baseline configuration automation support is important and may require professional resolution support.

NIST SP 800-234 ipd (Initial Public Draft) May 2025

High-Performance Computing Security Overlay

524

CM-3(2), Configuration Change Control | Testing, Validation, and Documentation of Changes

525 526 527 528 529 530 531

Discussion for All Zones: Testing should be specific to the requirements of individual zones. For example, the Computing Zone should emphasize performance; the Access Zone should emphasize authentication and authorization; the Management Zone should emphasize a continuous monitoring capability; and the Data Storage Zone should emphasize data security and access performance. While a testing environment is important, it is often impractical to have a testing environment at the same scale as the production system or with the same specialized hardware components.

532

CM-9, Configuration Management Plan

533 534 535

Discussion for All Zones: The system configuration of a large-scale, complex HPC system is essential. A detailed system configuration plan is needed to describe the tight dependence among the zones and the components of the HPC system.

536

SC-5, Denial-of-Service Protection

537 538 539 540 541

Discussion for All Zones: Denial-of-service (DoS) detection methods for the nodes in the Access Zone are crucial. A denial of service can be caused by malicious attacks or a user erroneously using a system. Proper guidance and training should be provided to users to raise their awareness of the potential impacts of incorrect system usage. HPC system operators are encouraged to monitor the system and provide feedback to users.

542

SC-28, Protection of Information at Rest

543 544 545

Discussion for All Zones: For HPC systems, different protection approaches may be employed for various storage systems in different zones, accounting for performance impacts and security risks.

546

3.14. Access to HPC

547

AC-17(3), Remote Access | Managed Access Control Points

548 549 550 551

Discussion for All Zones: Due to their size and scale, HPC systems may quickly overwhelm the planned internet connection capacity. Organizations with Trusted Internet Connection (TIC) requirements should work closely with their TIC Access Provider (TICAP) to address the significant strains that HPC systems can place on organizational services.

552

AC-18, Wireless Access

553 554

Discussion for All Zones: Although users may wirelessly connect to the Access Zone, wireless access is not typically part of the HPC system.

555

AC-20, Use of External Systems

556 557 558 559

Discussion for All Zones: HPC systems typically have a far more permissive posture and descriptive process regarding the use of external systems than other systems in the organization. This control is often delegated to a team that is responsible for the organizational infrastructure and external connectivity. Organizations should prepare for detailed

NIST SP 800-234 ipd (Initial Public Draft) May 2025

High-Performance Computing Security Overlay

560 561

implementation of this control and corresponding enhancement controls to account for user trust, permissions, roles, and risks.

562

AC-20(2), Use of External Systems | Portable Storage Devices — Restricted Use

563 564 565

Discussion for All Zones: HPC systems typically have data transfer systems, which are preferred over portable storage devices. When required, connecting portable storage devices to HPC systems must follow organization-approved processes.

566

NIST SP 800-234 ipd (Initial Public Draft) May 2025

High-Performance Computing Security Overlay

567

4. Summary

568 569 570

This HPC security overlay is based on the moderate security baseline in SP 800-53 with one additional control. The overlay has a total of 288 security controls, and 60 of them are tailored with supplemental guidance and/or discussion.

571 572

For many users, this overlay can serve as a starting point for securing their HPC systems. If necessary, users can further customize this security framework to meet their specific needs.

573

NIST SP 800-234 ipd (Initial Public Draft) May 2025

574

References

575 576 577 578 579 580 581 582 583 584 585 586 587 588 589 590 591 592 593 594 595 596 597 598 599 600 601

[1]

[2] [3] [4]

[5]

[6] [7]

High-Performance Computing Security Overlay

Guo Y, Chandramouli R, Wofford L, Gregg R, Key G, Clark A, Hinton C, Prout A, Reuther A, Adamson R, Warren A, Bangalore P, Deumens E, Farkas C (2024) High-Performance Computing Security: Architecture, Threat Analysis, and Security Posture. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) NIST SP 800-223. https://doi.org/10.6028/NIST.SP.800-223 Joint Task Force (2020) Security and Privacy Controls for Information Systems and Organizations. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) NIST SP 800-53r5. https://doi.org/10.6028/NIST.SP.800-53r5 Joint Task Force (2020) Control Baselines for Information Systems and Organizations. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) NIST SP 800-53B. https://doi.org/10.6028/NIST.SP.800-53B Office of Management and Budget (2021) Improving the Federal Government’s Investigative and Remediation Capabilities Related to Cybersecurity Incident. (The White House, Washington, DC), OMB Memorandum M-21-31, August 27, 2021. Available at https://bidenwhitehouse.archives.gov/wp-content/uploads/2021/08/M-21-31Improving-the-Federal-Governments-Investigative-and-Remediation-CapabilitiesRelated-to-Cybersecurity-Incidents.pdf Cybersecurity and Infrastructure Security Agency (2022) Guidance for Implementing M21-31: Improving the Federal Government’s Investigative and Remediation Capabilities. Available at https://www.cisa.gov/sites/default/files/2023-02/TLP%20CLEAR%20%20Guidance%20for%20Implementing%20M-2131_Improving%20the%20Federal%20Governments%20Investigative%20and%20Remedi ation%20Capabilities_.pdf Free Software Foundation (2010) GNU Screen. Available at https://www.gnu.org/software/screen/ tmux. Available at https://github.com/tmux/tmux/wiki

NIST SP 800-234 ipd: High-Performance Computing (HPC) Security Overlay

Analyze & explore related research in Conceptio

Related documents