The NIST Special Publication 1800 series is a set of cybersecurity practice guides from the US National Institute of Standards and Technology. They are produced by NIST’s National Cybersecurity Center of Excellence (NCCoE), which works with technology companies and other collaborators to build example solutions to specific security problems in a lab, using commercially available products. Each guide documents the problem, the reference architecture, how the example was built and how it maps to standards such as the NIST Cybersecurity Framework (NIST CSF) and the SP 800 series. They are practical examples, not requirements.
At a glance
- SP 1800 guides show how to build a solution; SP 800 publications describe what to achieve.
- Each guide is built with commercial products from collaborators, and NIST does not endorse those products.
- Topics include mobile device security, such as SP 1800-21 for corporate-owned, personally enabled (COPE) devices and SP 1800-22 for BYOD.
- SP 1800-35, published in 2025, documents 19 example zero trust implementations.
- Guides map their builds to NIST and other standards, which helps when checking a vendor design.
What problem it solves
Standards and control catalogs tell an organization what outcomes to reach, but they stop short of showing how the pieces fit together with real products. Buyers end up relying on vendor reference architectures, which naturally favor the vendor’s own portfolio.
The 1800 series fills that gap with independent, documented builds. A guide shows which capabilities were needed, how products from several vendors were integrated, what worked, what was hard and how the result maps back to standards. For a mid-sized organization planning a mobile, identity or zero trust project, that is a neutral starting point for its own design and a way to test whether a vendor proposal covers the same ground.
How it works
Project selection. The NCCoE picks a practical problem, often with input from industry, and publishes a project description.
Collaboration. Technology companies and other organizations join under cooperative research agreements and contribute products and expertise to a lab build.
Build and document. The team builds one or more example solutions and writes up the architecture, security characteristics and configuration. Guides typically cover the problem and approach, the architecture, and how-to detail for building it; some are split into separate parts for different readers.
Map to standards. Guides map the security capabilities of the build to frameworks and controls, so readers can trace a design choice back to a requirement.
Draft, comment, final. Like other NIST publications, guides are released as drafts for public comment before the final version.
Example guides
The series has no levels or certifications. Its structure is a growing list of individual guides, each for a specific problem. A few that buyers often meet:
| Guide | Problem it addresses | What it provides | How buyers use it |
|---|---|---|---|
| SP 1800-21, Mobile Device Security: Corporate-Owned Personally-Enabled (COPE) | Securing company-owned phones and tablets that employees also use personally | Reference architecture integrating mobile management and mobile security technologies | Benchmark for a COPE rollout and mobile device management design |
| SP 1800-22, Mobile Device Security: Bring Your Own Device (BYOD) | Securing personally owned Android and Apple devices used for work, while protecting employee privacy | Example solution for BYOD deployments | Benchmark for BYOD policy and tooling |
| SP 1800-35, Implementing a Zero Trust Architecture | Putting zero trust principles into practice across on-premises and cloud resources | 19 example implementations built in line with NIST SP 800-207 | Checking a zero trust roadmap or vendor design against independent builds |
Check NIST’s site for the current status of any guide; some are revised or replaced over time.
When it matters for buyers
- When designing a mobile device program. The COPE and BYOD guides show how management, threat protection and privacy controls fit together.
- When planning zero trust. SP 1800-35 shows several ways to combine identity, device, network and policy products.
- When comparing vendor architectures. A guide gives a neutral benchmark for what capabilities a solution should cover.
- When an auditor or customer asks how a design maps to standards. The guides’ mappings are a useful reference.
- When writing an RFP. The capabilities a guide lists can become requirements without naming products.
Our unified endpoint management overview covers the platforms used to manage and secure COPE and BYOD devices.
Questions to ask vendors
- Did your product take part in an NCCoE practice guide build, and which guide and role?
- How does your proposed design compare with the architecture in the relevant SP 1800 guide?
- Which capabilities from the guide does your solution cover, and which would need other products?
- For mobile devices: how does your platform separate work and personal data on COPE and BYOD devices, and what can administrators see?
- Can you map your design to the same standards the guide references?
How it differs from the NIST SP 800 series
The NIST SP 800 series contains NIST’s computer and information security guidance, such as control catalogs, risk management methods and specific technical guidelines. It describes what organizations should do and why. The SP 1800 series shows how to do it: each practice guide documents a working build with commercial products and maps it back to SP 800 publications and other standards. Neither series is a certification, and the products used in a practice guide are examples, not endorsements.
Problems this helps with
- We know what the standards say but not how to build it with real products
- Need a reference architecture for securing mobile devices or zero trust
- Want to check a vendor's design against an independent example
