Documents
hosted on this website:

Links
to other websites:

• FIPS 140-2
  • FIPS 140-2 Annex A — (Draft)
  • FIPS 140-2 Annex B — (Draft)
  • FIPS 140-2 Annex C — (Draft)
  • FIPS 140-2 Annex D — (Draft)

• NIST – The National Institute of Standards and Technology
  • NIST Cybersecurity Framework
  • NIST Computer Security Resource Center
  • NIST Software Tools Library
  • The National Vulnerability Database

• FIPS – Secure Hash Standard (FIPS PUB 180-4)

• FIPS – Federal Information Processing Standards

• NIST Special Publication 800-53 (revision 5) – Security and Privacy Controls for Information Systems and Organizations
• NIST Special Publication 800-122 – Guide to Protecting Personally Identifiable Information
• NIST Special Publication 800-39 – Managing Information Security Risk
• NIST Special Publication 800-145 – Definition of Cloud Computing

• CIS – The Center For Internet Security
  • CIS Controls
  • CIS Benchmarks
  • MS-ISAC (Multi-State Information Sharing and Analysis Center)

• IRS Pub-1075 – Tax Information Security Guidelines for Federal, State and Local Agencies

• The Department of Defense Cyber Crime Center (DC3)

• Federal Risk and Authorization Management Program (FedRAMP)

•  FedRamp Document Library

•  How Securing Recursive DNS Proactively Protects Your Network

• A listing of all common Port Numbers and their use.

• The National Cyber Security Framework Manual

•  Let’s Encrypt – Free SSL Certificates

• Advanced Encryption Algorithm – AES (SP 800-197)

• The “No More Ransom” Project

• Why AES-256 Encryption Cannot Be Cracked

• Microsoft’s Service Trust Portal

Online Sources
for Cyber-Security News:

• The Open Web Application Security Project (OWASP)

• SCMagazine.com

• SecureControlsFramework.com

• InfoSecurity-Magazine.com

•  Storing Protected Health Information in the Cloud

• Cyber-Security news on Wired.com

• UltimateWindowsSecurity.com

• Cyber-Security news on CNBC.com

• The Microsoft Malware Protection Center

• Cyber-Security news on Reuters.com

• Cyber-Security Information from Homeland Security

• ThreatPost.com

• Security Information from CIO.com

• Homeland Security News Wire

• Threat-Track Labs

• TheHackerNews.com

• Common Vulnerabilities and Exposures (CVE’s)

• Cyber-Security News Today

• USCert.gov – National Cybersecurity and Communications Integration Center (NCCIC)

• Dark Reading

• The Cloud Security Alliance

• SecurityMagazine.com

• The Security Ledger

Business Continuity &
Disaster Recovery:

Cyber-Security
Related Blogs:

• A great, FREE, easy to use RTO/RPO calculator

• Security Matters (on this website)

•  The International Disaster Recovery Institute

• Krebs on Security

•  Ready.Gov for Business (an official webpage from Homeland Security)

• Schneier on Security

• Federal Emergency Management Agency (FEMA)

• Errata Security Blog

Cyber-Security
Training & Certification
Resources for IT Professionals:

•  Naked Security

• Cybrary – One of the best Cybersecurity education resources available.

• The Akamai Blog

• (ISC)2 – The International Information System Security Certification Consortium

• A very good listing of 50 more Cyber Security related blogs

• The SANS Institute (Cyber-security training)

Audit and Compliance
Resources:

• Information Systems Security Association International

• ComplianceForge.com (A very robust repository of audit compliance templates)

• U.S. Department of Homeland Security Free Training Website

• Best Practices for Cyber-Security Compliance Audits

Cyber-Security Awareness &
Cyber-Hygiene Training for
Employees (and Everyone else):

• InfoSec’s I.T. Standards and Best Practices

• Free training from the Department of Health and Human Services.

• The PCI Security Standards Council Document Library

• Free cyber awareness training from ESET.com

• Cyber Security Awareness training focused on Small Businesses

• Some very entertaining SecureED training from Digital Defense.

• Cyber-Awareness training for C-Suite Executives

• Excellent and well produced cyber awareness training for Employees from KnowB4.

• Training from Phishline that focuses on Vishing (Phishing via Voice calls)

• Training from Phishline that focuses on Smishing (Phishing via Text Message)

• Simulated Phishing attacks from PhishME to help train your staff.