NIST: coverage, rules and key facts

The US National Institute of Standards and Technology publishes the Digital Identity Guidelines, the Cybersecurity Framework and the National Vulnerability Database.

Coverage

Explainer · Authentication & MFA

SMS one-time passcodes are “restricted” under NIST’s new guidelines. Here’s what that means for US banks

Revision 4 keeps SMS codes on the permitted list, with strings attached, and adds synced passkeys as a phishing-resistant alternative. The strings read like a migration plan.

[Editor Name] · Sep 24, 2026