diff --git a/nrd.conf.sample b/nrd.conf.sample
new file mode 100644
index 0000000..35b162f
--- /dev/null
+++ b/nrd.conf.sample
@@ -0,0 +1,70 @@
+security
+{
+  ; Security section defines the trust model that NRD should use. It consists of rules and
+  ; trust-anchors, which are briefly defined in this file. For more details please see the
+  ; following wiki:
+  ; http://redmine.named-data.net/projects/ndn-cpp-dev/wiki/CommandValidatorConf
+  ;
+  ; A trust-anchor is a pre-trusted certificate. It is usually stored in a file in the
+  ; same directory as this config file. You can download the NDN testbed root certificate as the
+  ; trust anchor, or you can dump an existing certificate from your system as a trust anchor:
+  ;   $ ndnsec cert-dump /example/certificate/name > trust-anchor.cert
+  ; or you can generate a self-signed certificate as a trust anchor:
+  ;   $ ndnsec key-gen /example/identity/name > trust-anchor.cert
+  ; See comments in trust-anchor section for configuration details.
+  ;
+  ; A rule defines conditions a valid packet MUST have. A packet must satisfy one of the rules defined
+  ; here. A rule can be broken into two parts: matching & checking. A packet will be matched against
+  ; rules from the first to the last until a matched rule is encountered. The matched rule will be
+  ; used to check the packet. If a packet does not match any rule, it will be treated as invalid.
+  ; The matching part of a rule consists of `for` and `filter` sections. They collectively define
+  ; which packets can be checked with this rule. `for` defines packet type (data or interest),
+  ; while `filter` defines conditions on other properties of a packet. Right now, you can only
+  ; define conditions on packet name, and you can only specify ONLY ONE filter for packet name.
+  ; The checking part of a rule consists of `checker`, which defines the conditions that a VALID
+  ; packet MUST have. See comments in checker section for more details.
+
+  rule
+  {
+    id "NRD Prefix Registration Command Rule" ; rule id
+    for interest                              ; this rule is used to validate interests
+    filter
+    {
+      type name                               ; condition on interest name (w/o signature)
+      regex ^[<localhop><localhost>]<nrd>[<register><unregister>]<>{3}$
+    }
+    checker
+    {
+      type customized
+      sig-type rsa-sha256                     ; interest must have a rsa-sha256 signature
+      key-locator
+      {
+        type name                             ; key locator must be the certificate name of
+                                              ; the signing key
+        regex ^[^<KEY>]*<KEY><>*<ksk-.*><ID-CERT>$
+      }
+    }
+  }
+  rule
+  {
+    id "Testbed Hierarchy Rule"               ; rule id
+    for data                                  ; this rule is used to validate data
+    filter
+    {
+      type name                               ; condition on data name
+      regex ^[^<KEY>]*<KEY><>*<ksk-.*><ID-CERT><>$
+    }
+    checker
+    {
+      type hierarchical                       ; the certificate name of the signing key and
+                                              ; the data name must follow the hierarchical model
+      sig-type rsa-sha256                     ; data must have a rsa-sha256 signature
+    }
+  }
+  trust-anchor
+  {
+    type file                     ; trust anchor is stored in a file
+    file-name "trust-anchor.cert" ; the file name, by default this file should be placed in the
+                                  ; same folder as this config file.
+  }
+}