Please follow
https://csrc.nist.gov/Projects/risk-management/faqs#F1qf
.