[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for System and Communications Protection?

[Assistant]
According to Assessing Enhanced Security Requirements for Controlled Unclassified Information:

| ASSESSMENT PROCEDURES................................................................................................................
| 3   |
| 2.2                                                                                | ASSURANCE CASES.............................................................................................................................. | 4   |
| CHAPTER THREE THE PROCEDURES............................................................................................... | CHAPTER THREE THE PROCEDURES............................................................................................... | 7   |
| 3.1                                                                                | ACCESSCONTROL ............................................................................................................................... | 8   |
| 3.2                                                                                | AWARENESSANDTRAINING............................................................................................................... | 9   |
| 3.3                                                                                | AUDIT ANDACCOUNTABILITY........................................................................................................... | 10  |
| 3.4                                                                                | CONFIGURATION MANAGEMENT.....................................................................................................


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Ordered t-way Combinations for Testing State-based Systems provide? (Part 8)

[Assistant]
m modeled with a finite state machine diagram in Fig. 5, and tests are run in the order 1..6. If condition A = 'p1 ∧ p2' and condition B = 'p1 ∧ ~p2', then the error in state 2 will not be discovered.
The system returns to state 0 for tests 1 through 3, then enters state 1 with test 4 and moves to state 3 with test 5. Because the test array does not include the ordered combinations p1, p2 = 11 *→ p1, p2 = 10, the error is not exposed. However, if the tests are run in the order [1, 2, 4, 3, 5,  6],  then  the  error  in  state  2  will  be  discovered because the third test (row 4 in Fig. 4) leads to state 1,  the  fourth  test  (row  3)  causes  condition  B  to evaluate  to  true,  and  the  system  enters  state  2, exposing the error. Fig. 5. Example Finite State Machine. <!-- image -->

Note that the definition includes the repetition of a value  combination  in  the  OCC. The  possibility  of repeated  occurrences  of  a  value  combination  in  an order  is  allowed  based  on  the  assumption  that  a particular combination may occur in multiple tests, and this sequence may be relevant to the system or software under test (SUT). For example, a function call to create a new file ' f1 ' followed by a duplicate call to create ' f1 ' may trigger some behavior other than  an  expected  error  message. So  the  3-way combination (create, f1, 256 ) may be desirable to include more than once in a series of test inputs. Returning  to  the  example  in  Fig. 4  and  Fig. 5, suppose that a file system is being tested, where p 1 is function with values {0 = read, 1 = write}, and p 2 is rewind , which indicates if the pointer to the starting block is reset to 0 {0 = start from last position, 1 = start  from  block  0}. A  read  or  write  test  processes from the starting block indicated by p 2 and continues to the end of the file.

Ordered t-way Combinations for Testing State-based Systems

Audit and Accountability
System and Information Integrity
Security Assessment
Media Protection
Identification and Authentication
Awareness and Training
System and Communications Protection
Access Control
Planning
Incident Response
Risk Assessment
Personnel Security
System and Services Acquisition
Supply Chain Risk Management
Maintenance
Physical Protection
Configuration Management


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for Configuration Management?

[Assistant]
According to Protecting Controlled Unclassified Information (CUI)_ NIST Special Publication 800-171, Revision 3. Small Business Primer:

| Access Control                    | Maintenance         | Security Assessment and Monitoring   |
|-----------------------------------|---------------------|--------------------------------------|
| Awareness and Training            | Media Protection    | System and Communications Protection |
| Audit and Accountability          | Personnel Security  | System and Information Integrity     |
| Configuration Management          | Physical Protection | Planning                             |
| Identification and Authentication | Risk Assessment     | System and Services Acquisition      |
| Incident Response                 |                     | Supply Chain Risk Management         |

- Based on NIST SP 800-53, Revision 5 and the NIST SP 800-53B moderate impact control baseline.
- Applies updated tailoring criteria addressing stakeholder feedback (adding new, consolidating, and withdrawing requirements).
- Includes increased specificity in security requirements.
- Introduces organization-defined parameters (ODP) to increase flexibility to better manage organizationspecific risks.

Control Baseline: A set of controls you can implement to meet strategic, legal, regulatory, or contractual security and privacy requirements and manage risk.

Protecting Controlled Unclassified Information (CUI)_ NIST Special Publication 800-171, Revision 3. Small Business Primer


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Audit and Accountability?

Secure Software Development Framework (SSDF) Version 1.1_ Recommendations for Mitigating the Risk of Software Vulnerabilities


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice CM.L2-3.4.3 (NIST 3.4.3)?

[Assistant]
According to Automated Secure Configuration Guidance from the macOS Security Compliance Project (mSCP):

3.4.3. 3.4.3. 3.4.3).

Automated Secure Configuration Guidance from the macOS Security Compliance Project (mSCP)


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Proceedings of the Cybersecurity in Cyber-Physical Systems Workshop, April 23-24, 2012 provide? (Part 6)

[Assistant]
Introduction

Cyber-Physical Systems (CPS) are hybrid networked cyber and engineered physical elements codesigned to create adaptive and predictive systems for enhanced performance. 1, 2 These smart systems present a key opportunity to create a competitive advantage for U.S. industrial innovation and to improve the performance and reliability of new and existing systems. From smart manufacturing and the electric smart grid, to smart structures and transportation systems, CPS will pervasively impact the economy and society. Cybersecurity is a critical cross-cutting discipline that provides confidence that cyber-physical systems, their information, and supporting communications and information infrastructures are adequately safeguarded. CPS are increasingly being utilized in critical infrastructures and other settings. However, CPS have many unique characteristics, including the need for real-time response and extremely high availability, predictability, and reliability, which impacts cybersecurity decisions. NIST is currently working in several CPS areas, including the electric smart grid, smart manufacturing, smart buildings, and networked automobiles. This work is being led by the Engineering Laboratory (EL), but also includes the Physical Measurement Laboratory (PML) and the Information Technology Laboratory (ITL). ITL has a number of key areas of expertise that are important to the evolution of CPS -interoperability, usability, reliability, and security. Since 2009, NIST has been very active in the area of the smart grid. ITL has been very active, providing leadership and expertise in a number of relevant areas, including communication networks, timing, and cybersecurity. ITL's Computer Security Division (CSD) has provided leadership and expertise to the Smart Grid Interoperability Panel's Cyber Security Working Group.

Proceedings of the Cybersecurity in Cyber-Physical Systems Workshop, April 23-24, 2012


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What guidance does Guide for Developing Security Plans for Federal Information Systems provide?

[Assistant]
NIST Special Publication 800-18 Revision 1

<!-- image -->

## Guide for Developing Security Plans for Federal Information Systems

Marianne Swanson Joan Hash Pauline Bowen

## I N F O R M A T I O N     S  E  C  U  R  I  T  Y

Computer Security Division Information Technology Laboratory National Institute of Standards and Technology Gaithersburg, MD 20899-8930

February 2006

<!-- image -->

U.S. Department of Commerce Carlos M.Gutierrez, Secretary

National Institute of Standards and Technology William Jeffrey, Director

## Reports on Information Systems Technology

The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology promotes the United States economy and public welfare by providing technical leadership for the Nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof-of-concept implementations, and technical analyses to advance the development and productive use of information technology. ITL's responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of non-national-security-related information in federal information systems. This Special Publication 800 series reports on ITL's research, guidelines, and outreach efforts in information system security and its collaborative activities with industry, government, and academic organizations. ii

## Authority

This document has been developed by the National Institute of Standards and Technology (NIST) in furtherance of its statutory responsibilities under the Federal Information Security Management Act of 2002, Public Law 107-347. NIST is responsible for developing standards and guidelines, including minimum requirements, for providing adequate information security for all agency operations and assets, but such standards and guidelines shall not apply to national security systems.

Guide for Developing Security Plans for Federal Information Systems


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Planning for a Zero Trust Architecture_ A Planning Guide for Federal Administrators provide? (Part 4)

[Assistant]
| 2.1 The Process....................................................................................................
5           |
| 3                                                                                | Conclusion ...........................................................................................................12        |
| References...................................................................................................................13 | References...................................................................................................................13 |

## 1 Zero Trust

Zero trust provides a collection of concepts designed to minimize uncertainty in enforcing accurate, least privilege per-request access decisions in information systems and services in the face of a network viewed as contested. That is, there may be a malicious actor on the network that can intercept or initiate communication. Zero trust is fundamentally comprised of a set of principles upon which information technology architectures are planned, deployed, and operated [1]. Zero trust uses a holistic view that considers potential risks to a given mission or business process and how they are mitigated. As such, there is no single specific zero trust infrastructure implementation or architecture. zero trust solutions depend on the workflow (i.e., part of the enterprise mission) being analyzed and the resources that are used in performing that workflow. zero trust strategic thinking can be used to plan and implement an enterprise IT infrastructure, this plan is called a zero trust architecture (ZTA). Enterprise administrators and system operators need to be involved in the planning and deployment for a ZTA to be successful.

Planning for a Zero Trust Architecture_ A Planning Guide for Federal Administrators


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Risk Assessment?

[Assistant]
According to Transitioning to the Security Content Automation Protocol (SCAP) Version 2:

architecture; configuration; endpoint; endpoint security; SCAP; security automation; security content automation; Security Content Automation Protocol; software identification; SWID; vulnerability

| 1                                                                                | Introduction ............................................................................................................1   |
|-------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------|
| 2 Gaps in SCAP                                                                                | v1....................................................................................................2                      |
| 3 SCAP                                                                                | v2..................................................................................................................3        |
| 3.1 Design Goals for SCAP v2.............................................................................. | 3                                                                                |
| 3.2 The SCAP v2                                                                                | Architecture.............................................................................. 4                                 |
| 3.3 Adoption of International Standards                                                                                | in SCAP v2 ............................................

Transitioning to the Security Content Automation Protocol (SCAP) Version 2


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Audit and Accountability?

[Assistant]
According to High-Performance Computing Security_ Architecture, Threat Analysis, and Security Posture:

ey can hide software. By decoupling operating system dependencies from the host system, a container image may contain unknown vulnerable or insecure software, which poses a software supply chain risk.
Additionally, container contents may not be observable by some security auditing tools. In a well-managed HPC system, most software has already been installed as a baseline system environment. The applications developed using native libraries often run faster than a container. Hence, training users to develop programs in the HPC programming environment is one way to reduce exposure to container vulnerabilities. Additionally, many container ecosystems include the ability to attest that a container and its dependencies are supplied by a trusted provider, and there are tools (e.g., Qualys [49], Anchore [50], etc.) designed to audit container contents that provide supply chain and software audit management for HPC applications. Containers, container runtimes, and container orchestrators all increase the security attack surface for HPC systems, but carefully implemented container environments may potentially improve the overall security posture. Vulnerable or poorly configured container runtimes or container orchestrators can lead to exploitable environments and, in some cases, even privilege

High-Performance Computing Security_ Architecture, Threat Analysis, and Security Posture


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Risk Assessment?

[Assistant]
According to Overview and Considerations of Access Control Based on Attribute Encryption:

| Executive Summary................................................................................................................. 1        | Executive Summary................................................................................................................. 1        | Executive Summary................................................................................................................. 1   |
|---------------------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------|
| 1. | Introduction ...................................................................................................................... | 2                                                                                |
| 2. | Fundamental Theories ..................................................................................................... | 4                                                                                |
| 2.1. | Elliptic Curve                                                                                | .............................................................................................................. 4                       |
| 2.2. | Elliptic-Curve Cryptography ........................................................................................ | 5                                                                                |
| 2.3.

Overview and Considerations of Access Control Based on Attribute Encryption


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 1 require for Physical Protection?

[Assistant]
According to IoT Device Cybersecurity Capability Core Baseline:

| Device Cybersecurity Capability | Common Elements | Rationale | IoT Reference Examples | |---------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | Device Identification : The IoT device can be uniquely identified logically and physically.

IoT Device Cybersecurity Capability Core Baseline


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Maintenance?

[Assistant]
According to Incident Response Recommendations and Considerations for Cybersecurity Risk Management_ A CSF 2.0 Community Profile:

cks. This guide addresses only adverse cybersecurity events . Additional analysis is often needed to determine whether adverse cybersecurity events indicate that a cybersecurity incident has occurred.
| CSF Element   | CSF Element Description                                                                                | Priority   | Recommendations, Considerations, Notes R2: Tune the continuous monitoring                                                                                |
|---------------|------------------------------------------------------------------------------------------------------------------------|------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| DE.CM-01      | Networks and network services are monitored to find potentially adverse events                                         | High       | false negatives to acceptable levels.

Incident Response Recommendations and Considerations for Cybersecurity Risk Management_ A CSF 2.0 Community Profile


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Maintenance?

[Assistant]
According to Guidelines for the Use of PIV Credentials in Facility Access:

15. https://doi.org/10.6028/NIST.SP.800-78-4. |
| [SP800-87]    | NIST Special Publication 800-87 Revision 2, Codes for the Identification of Federal and Federally-Assisted Organizations , April 2018.
https://doi.org/10.6028/NIST.SP.800-87r2 . |
| [TIG SCEPACS] | Technical Implementation Guidance: Smart Card Enabled Physical Access Control Systems, Version 2.3 , The Government Smart Card Interagency Advisory Board's Physical Security Interagency Interoperability Working Group, December 20, 2005. http://www.idmanagement.gov/tig_scepacs_v2-3/ [accessed 5/16/18]                                                                                |

Guidelines for the Use of PIV Credentials in Facility Access


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Security Assessment?

[Assistant]
According to Proceedings of the Cybersecurity in Cyber-Physical Systems Workshop, April 23-24, 2012:

Within the United States,  the  Food  and Drug  Administration (FDA) regulates the manufacturers, importers and resellers of these devices through the Center for Devices and Radiological  Health  (CDRH). A  review  of  a  sampling  of  FDA  testing guidance (e.g. for implantable cardiac pacemakers) reveals that the 'tests are designed to reasonably assure safe and effective functioning of the pacemaker in the patient, according to written  specifications  of  performance,  and  its  survival  under  expected environmental conditions in the body and during storage, shipping and handling' [1]. FDA testing guidelines do not appear to address the resistance and resilience of these devices in the face of cyber attacks. - [1] 'Implantable Pacemaker Testing Guidance,' found at http://www.fda.gov/downloads/MedicalDevices/DeviceRegulationandG uidance/GuidanceDocuments/UCM081382.pdf. - [2] D. Halperin, et al, 'Pacemakers and Implantable Cardiac Defibrillators: Software Radio Attacks and Zero-Power Defenses,' Proceedings of the 2008 IEEE Symposium on Security and Privacy, Oakland, CA, 2008. - [3] D. Halperin  et  al,  'Security  and  Privacy  for  Implantable  Medical Devices,' in Pervasive Computing, Vol. 7, No. 1, January-March 2008. - [4] S. Capkun,  'On  Secure  Access  to  Medical  Implants,'  Workshop  on Security and Privacy in Implantable Medical Devices, Lausanne, Switzerland, April, 2011. - [5] S. Cherukuri,  K. Venkatasubramanian,  and  S. Gupta,  'BioSec:  A Biometric  Based  Approach  for  Securing  Communication  in  Wireless Networks  of  Biosensors  Implanted  in  the  Human  Body,'  Proc. Int'l Conf. Parallel Processing (ICPP)Workshops, IEEE CS Press, 2003, pp. 432-439. - [6] T. Denning, et al 'Patients, pacemakers, and implantable defibrillators: human  values  and  security  for  wireless  implantable  medical  devices,' Proceedings  of  the  28th  international  conference  on  Human  factors  in computing systems, ACM New York, NY, USA, 2010, pp 917-926.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Organizational Views of NIST Cryptographic Standards and Testing and Validation Programs provide? (Part 9)

[Assistant]
oosing them? This NIST Internal Report (NISTIR) is a companion to the research paper 'We make it a big deal in the company': Security Mindsets in Organizations that Develop Cryptographic Products [6].
The paper explored one theme identified in the study (security mindsets) while describing findings related to the use, benefits, and challenges of cryptographic resources. Although descriptions of methodology and demographics are pulled from the research paper, this NISTIR is not meant to duplicate the findings and analysis previously presented. Instead, this report is more narrowly focused on enumerating (not interpreting) comments made specifically about NIST cryptographic products and testing/validation resources and programs, most frequently those associated with the Federal Information Processing Standards Publication (FIPS) 140-2 [7]. The target audience consists of those working on NIST cryptographic standards and testing/validation programs, but the results may also be useful to others outside of NIST that are developing related standards and programs. The purpose of this NISTIR is to inform the audience of the feedback and perceptions of NIST cryptographic standards and testing/validation programs from companies that develop cryptographic products. The feedback offers a lens into the organizational needs of consumers of NIST cryptographic standards and testing and validation programs and may help to inform future decisions concerning documentation and cryptographic efforts. ## Background: NIST Cryptographic Standards and Testing/Validation Programs

Cryptographic algorithm standards are developed by consensus of community stakeholders (e.g. vendors, researchers, governments) to foster compatibility, interoperability, and

minimum levels of security. These standards can be found in formal documents from organizations such as the Internet Engineering Task Force (IETF) [8], International Organization for Standardization (ISO) [9], and NIST [10].

Organizational Views of NIST Cryptographic Standards and Testing and Validation Programs


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Security Assessment?

[Assistant]
According to Validating the Integrity of Computing Devices:

7                                                                                |
|     |                                                                                | 3.2.2 Scenario 2:                                                                                | Verification of Components During Acceptance Testing........................... 7                                                                                |
|     |                                                                                | 3.2.3                                                                                | Scenario 3: Verification of Components During Use....................................................

Validating the Integrity of Computing Devices


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Planning?

[Assistant]
According to Guide to Enterprise Patch Management Planning_ Preventive Maintenance for Technology:

## Guide to Enterprise Patch Management Planning:

## Guide to Enterprise Patch Management Planning:

There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may  be  used  by  federal  agencies  even  before  the  completion  of  such  companion  publications.  Thus,  until  each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning  and  transition  purposes,  federal  agencies  may  wish  to  closely  follow  the  development  of  these  new publications by NIST.

Guide to Enterprise Patch Management Planning_ Preventive Maintenance for Technology


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Control Baselines for Information Systems and Organizations provide? (Part 4)

[Assistant]
three security control baselines (one for each system impact level-low-impact, moderate-impact, and high-impact), as well as a privacy baseline that is applied to systems irrespective of impact level.
In addition to the control baselines, this publication provides tailoring guidance and a set of working assumptions that help guide and inform the control selection process. Finally, this publication provides guidance on the development of overlays to facilitate control baseline customization for specific communities of interest, technologies, and environments of operation. ## Keywords

Assurance; impact level; privacy control; privacy control baseline; security control; security control baseline; tailoring; control selection; control overlays. \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

## Acknowledgements

This publication was developed by the Joint Task Force Interagency Working Group. The group includes representatives from the civil, defense, and intelligence communities. The National Institute of Standards and Technology wishes to acknowledge and thank the senior leaders from the Department of Commerce, Department of Defense, the Office of the Director of National Intelligence, the Committee on National Security Systems, and the members of the interagency working group whose dedicated efforts contributed significantly to this publication. ## Department of Defense

## Office of the Director of National Intelligence

Matthew A. Kozma Chief Information Officer

Dana Deasy

Chief Information Officer

John Sherman

Michael E. Waschull Deputy Chief Information Officer

Principal Deputy CIO

Mark Hakun

Clifford M.

Control Baselines for Information Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Media Protection?

[Assistant]
According to Risk Management Framework for Information Systems and Organizations_ A System Life Cycle Approach for Security and Privacy:

ging the risks to individuals associated with the creation, collection, use, processing, dissemination, storage, maintenance, disclosure, or disposal (collectively referred to as 'processing') of PII.
30 When preparing to execute the steps of the RMF, organizations consider how to best promote and institutionalize collaboration between the two programs to ensure that the objectives of both disciplines are met at every step of the process.

Risk Management Framework for Information Systems and Organizations_ A System Life Cycle Approach for Security and Privacy


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Incident Response?

[Assistant]
According to Addressing Visibility Challenges with TLS 1.3 within the Enterprise_ High-Level Document:

..................................................................... | 5.4 Specific Details ...........................................................................................................
| 29                                                                          |
|------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------|
| 6                                                                                | Functional Demonstrations...............................................................30                                         | Functional Demonstrations...............................................................30                                         | Functional Demonstrations...............................................................30                                         |                                                                             |
|                                                                                | 6.1                                                                                | Usage Scenarios Supported ....................................................................................... | Usage Scenarios Supported .......................................................................................

Addressing Visibility Challenges with TLS 1.3 within the Enterprise_ High-Level Document


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice IA.L2-3.5.2 (NIST 3.5.2)?

[Assistant]
According to Data Integrity_ Detecting and Responding to Ransomware and Other Destructive Events:

3.5.2 Resolution

The build provides several layers of defense against this use case.

Data Integrity_ Detecting and Responding to Ransomware and Other Destructive Events


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Protecting Information and System Integrity in Industrial Control System Environments_ Cybersecurity for the Manufacturing Sector provide? (Part 2)

[Assistant]
, Virginia

Matthew Zopf Strativia Largo, Maryland

FINAL

March 2022

<!-- image -->

U.S. Department of Commerce Gina M. Raimondo, Secretary

National Institute of Standards and Technology

James K.
Olthoff, Performing the Non-Exclusive Functions and Duties of the Under Secretary of Commerce for Standards and Technology & Director, National Institute of Standards and Technology

## NIST SPECIAL PUBLICATION 1800-10A

## Protecting Information and System Integrity in Industrial Control System Environments:

## Cybersecurity for the Manufacturing Sector

## Volume A:

Executive Summary

## Michael Powell

National Cybersecurity Center of Excellence National Institute of Standards and Technology

## Michael Pease Keith Stouffer CheeYee Tang Timothy Zimmerman

Engineering Laboratory National Institute of Standards and Technology

## Matthew Zopf

Strativia Largo, Maryland

FINAL

March 2022

This publication is available free of charge from https://doi.org/10.6028/NIST.SP.1800-10

The first draft of this publication is available free of charge from https://www.nccoe.nist.gov/publications/practice-guide/protecting-information-and-system-integrity- industrial-control-system-draft

<!-- image -->

Joseph Brule Chelsea Deane John Hoyt Mary Raguso Aslam Sherule Kangmin Zheng

The MITRE Corporation McLean, Virginia

## Executive Summary

Many manufacturing organizations rely on industrial control systems (ICS) to monitor and control their machinery, production lines, and other physical processes that produce goods. To stay competitive, manufacturing organizations are increasingly connecting their operational technology (OT) systems to their information technology (IT) systems to enable and expand enterprise-wide connectivity and remote access for enhanced business processes and capabilities.

Protecting Information and System Integrity in Industrial Control System Environments_ Cybersecurity for the Manufacturing Sector


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does The Federal Cybersecurity Awareness Workforce_ Professional Backgrounds, Knowledge, Skills, and Development Activities provide? (Part 8)

[Assistant]
---------------------------------------------------------------------|
| 1 INTRODUCTION.................................................................................................................
1                                                                                | 1 INTRODUCTION................................................................................................................. 1                                                                                | 1 INTRODUCTION................................................................................................................. 1                                                                                |
| 2 REPORTING CONVENTIONS.......................................................................................... 2                                                                                | 2 REPORTING CONVENTIONS.......................................................................................... 2                                                                                | 2 REPORTING CONVENTIONS.......................................................................................... 2                                                                                |
| 3 PROFESSIONAL DEMOGRAPHICS............................................................................... 3                                                                                | 3 PROFESSIONAL DEMOGRAPHICS...............................................................................

The Federal Cybersecurity Awareness Workforce_ Professional Backgrounds, Knowledge, Skills, and Development Activities

Audit and Accountability
System and Information Integrity
Media Protection
Identification and Authentication
Awareness and Training
System and Communications Protection
Access Control
Planning
Incident Response
Risk Assessment
Personnel Security
System and Services Acquisition
Supply Chain Risk Management
Maintenance
Physical Protection
Security Assessment


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Likely Exploited Vulnerabilities_ A Proposed Metric for Vulnerability Exploitation Probability provide? (Part 4)

[Assistant]
-------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------|
| 11.
Conclusion .................................................................................................................................26  | 11. Conclusion .................................................................................................................................26  |
| References.......................................................................................................................................27 | References.......................................................................................................................................27 |
| Appendix A. EPSS Documentation ....................................................................................................28               | Appendix A. EPSS Documentation ....................................................................................................28               |
| Appendix B. List of Abbreviations and Acronyms ..............................................................................30                     | Appendix B. List of Abbreviations and Acronyms ..............................................................................30                     |
| List of Tables                                                                                | List of Tables                                                                                |
| Table 1. Variables for the Expected_Exploited() Equation....................................................................5                       | Table 1.

Likely Exploited Vulnerabilities_ A Proposed Metric for Vulnerability Exploitation Probability


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Risk Assessment?

[Assistant]
According to Automated Secure Configuration Guidance from the macOS Security Compliance Project (mSCP):

mSCP content can also be used to generate Security Content Automation Protocol (SCAP) content for automated security compliance scans. The SCAP generated follows the SCAP 1.3 specification [10]. The generation of SCAP content uses an Extensible Stylesheet Language Transformations (XSLT) file to create an Extensible Configuration Checklist Description Format (XCCDF) checklist document with an accompanying Open Vulnerability and Assessment Language (OVAL) document.

Open Vulnerability and Assessment Language

Automated Secure Configuration Guidance from the macOS Security Compliance Project (mSCP)


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171 provide? (Part 5)

[Assistant]
quirements in NIST Special Publication 800-171 and are intended for use by federal agencies in contractual vehicles or other agreements established between those agencies and nonfederal organizations.
## Keywords

Advanced Persistent Threat; Basic Security Requirement; Contractor Systems; Controlled Unclassified Information; CUI Registry; Derived Security Requirement; Enhanced Security Requirement; Executive Order 13556; FIPS Publication 199; FIPS Publication 200; FISMA; NIST Special Publication 800-53; Nonfederal Organizations; Nonfederal Systems; Security Assessment; Security Control; Security Requirement. \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

## Acknowledgements

The authors also wish to recognize the scientists, engineers, and research staff from the NIST Computer Security and the Applied Cybersecurity Divisions for their exceptional contributions in helping to improve the content of the publication. A special note of thanks to Pat O'Reilly, Jim Foti, Jeff Brewer, Chris Enloe, Ned Goren, and the entire NIST web team for their outstanding administrative support. Finally, the authors also gratefully acknowledge the contributions from individuals and organizations in the public and private sectors, nationally and internationally, whose thoughtful and constructive comments improved the overall quality, thoroughness, and usefulness of this publication. \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

## Patent Disclosure Notice

NOTICE: The Information Technology Laboratory (ITL) has requested that holders of patent claims whose use may be required for compliance with the guidance or requirements of this publication disclose such patent claims to ITL.

Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Information Integrity?

[Assistant]
According to Guide for Developing Security Plans for Federal Information Systems:

FIPS 199 defines security categories for information systems based on potential impact on organizations, assets, or individuals should there be a breach of security-that is, a loss of confidentiality, integrity, or availability. FIPS 199 security categories can play an important part in defining information system boundaries by partitioning the agency's information systems according to the criticality or sensitivity of the information and information systems and the importance of those systems in accomplishing the agency's mission. This is particularly important when there are various FIPS 199 impact levels contained in one information system. The FIPS 199 requirement to secure an information

FIPS 200 provides seventeen minimum security requirements for federal information and information systems. The requirements represent a broad-based, balanced information security program that addresses the management, operational, and technical aspects of protecting the confidentiality, integrity, and availability of federal information and information systems. An agency must meet the minimum security requirements in this standard by applying security controls selected in accordance with NIST SP 800-53 and the designated impact levels of the information systems. An agency has the flexibility to tailor the security control baseline in accordance with the terms and conditions set forth in the standard. Tailoring activities include: (i) the application of scoping guidance; (ii) the specification of compensating controls; and (iii) the specification of agency-defined parameters in the security controls, where allowed. The system security plan should document all tailoring activities.

Guide for Developing Security Plans for Federal Information Systems


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Security Assessment?

[Assistant]
According to Digital Identity Guidelines_ Authentication and Authenticator Management:

3.2.3.2. Presentation Attack Detection
The biometric system  SHOULD  implement PAD for iris and fingerprint modalities and
SHALL  implement PAD for facial recognition. Biometric comparison based on voice
SHALL NOT  be used. Testing the biometric system for deployment  SHOULD  demonstrate
an impostor attack presentation accept rate (IAPAR) of less than 0.07. Presentation
attack resistance  SHOULD  be tested in accordance with Clause 13 of [ISO/IEC30107-3]
following security evaluation methodologies in [ISO/IEC19792] or [ISO/IEC19989-1] and
[ISO/IEC19989-3]. The PAD decision  MAY  be made either locally on the claimant’s device
or by a central verifier.

• First- or third-party testing against biometric performance standards

To be considered non-exportable, an authenticator  SHALL  either be a separate piece of
hardware or an embedded processor or execution environment (e.g., secure element,
TEE, TPM). These hardware authenticators and embedded processors are separate
from a host processor, such as the CPU on a laptop or mobile device. A non-exportable
authenticator  SHALL  be designed to prohibit the export of the authentication secret
to the host processor and  SHALL NOT  be capable of being reprogrammed by the host
processor to allow the secret to be extracted. The authenticator is subject to applicable
[FIPS140] requirements. Organizations  SHOULD  employ authenticators that have
undergone independent security testing, such as authenticators validated to [FIPS140]
security level 2 overall with level 3 physical security6 or evaluated against relevant
Common Criteria Protection Profiles.

Digital Identity Guidelines_ Authentication and Authenticator Management


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Access Control?

[Assistant]
According to Guide to Malware Incident Prevention and Handling for Desktops and Laptops:

In terms of security configurations, organizations should use sound host hardening principles. For example, organizations should follow the principle of least privilege, which refers to configuring hosts to provide only the minimum necessary rights to the appropriate users, processes, and hosts. Least privilege can be helpful in preventing malware incidents, because malware often requires administrator-level privileges to exploit vulnerabilities successfully. If an incident does occur, prior application of least privilege might minimize the amount of damage that the malware can cause. Organizations should also implement other host hardening measures that can further reduce the possibility of malware incidents, such as the following:

and what data sources might record the information. For example, a host's current IP address is typically needed for remote actions; of course, a host's physical location is needed for local actions. One piece of information can often be used to determine others, such as mapping an IP address to a media access control (MAC) address, which could then be mapped to a switch serving a particular group of offices. If an IP address can be mapped to a host owner or user-for example, by recording the mapping during network login-the owner or user can be contacted to provide the host's location. The difficulty in identifying the physical location of an infected host depends on several factors. In a managed environment, identifying a host's location is often relatively easy because of the standardized manner in which things are done. For example, host names might contain the user's ID or office number, or the host's serial number (which can be tied to a user ID). Also, asset inventory management tools might contain current information on host characteristics. In other environments, especially those in which users have full control over their hosts and network management is not centralized, it might be challenging to link a machine to a location.

Guide to Malware Incident Prevention and Handling for Desktops and Laptops


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Addressing Visibility Challenges with TLS 1.3 within the Enterprise_ High-Level Document provide? (Part 3)

[Assistant]
tandards and Technology (NIST), is a collabora�ve hub where industry organiza�ons, government agencies, and academic ins�tu�ons work together to address businesses' most pressing cybersecurity issues.
This public -private partnership enables the crea�on of prac�cal cybersecurity solu�ons for specific industries, as well as for broad, cross -sector technology challenges. Through consor�a under Coopera�ve Research and Development Agreements (CRADAs), including technology partners-from Fortune 50 market leaders to smaller companies specializing in informa�on technology securitythe NCCoE applies standards and best prac�ces to develop modular, adaptable example cybersecurity solu�ons using commercially available technology. The NCCoE documents these example solu�ons in the NIST Special Publica�on 1800 series, which maps capabili�es to the NIST Cyber security Framework and details the steps needed for another en�ty to re -create the example solu�on. The NCCoE was established in 2012 by NIST in partnership with the State of Maryland and Montgomery County, M aryland . To learn more about the NCCoE, visi t htps://www.nccoe.nist.gov/. To learn more about NIST, visit htps://www.nist.gov. ## NIST CYBERSECURITY PRACTICE GUIDES

NIST Cybersecurity Prac�ce Guides (Special Publica�on 1800 series ) target specific cybersecurity challenges in the public and private sectors. They are prac�cal, user -friendly guides that facilitate the adop�on of standards -based approaches to cybersecurity. They show members of the informa�on security community how to implement example solu�ons that help them align with relevant standards and best prac�ces, and provide users with the materials lists, configura�on files, and other informa�on they need to implement a similar approach. The documents in this series describe example implementa�ons of cybersecurity prac�ces that businesses and other organiza�ons may voluntarily adopt.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AT.L2-3.2.2 (NIST 3.2.2)?

[Assistant]
According to The Federal Cybersecurity Awareness Workforce_ Professional Backgrounds, Knowledge, Skills, and Development Activities:

3.2.2 NICE Framework Work Roles ... 3.2.2 NICE Framework Work Roles ... 3.2.2 NICE Framework Work Roles ...


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Protecting Controlled Unclassified Information (CUI)_ NIST Special Publication 800-171, Revision 3. Small Business Primer provide? (Part 3)

[Assistant]
| help you take |

1  For more information on types of CUI and markings, visit the National Archives and Records Administration (NARA) https://www.archives.gov/cui.
ht ps:/

csrc.nist.gov/projects/protecting-control ed-unclas ified-information

## Overview

## Audience

<!-- image -->

<!-- image -->

Pages 2-6 provide a general overview of SP 800-171, R3 -helpful to business leaders or those new to SP 800-171. Pages 7-27 are for those who are tasked with managing the implementation SP 800-171. It is not all-encompassing, but it does provide tips and resources to help with getting started. This section serves as a bridge to the larger SP 800-171 publication. ## Key Term: Confidentiality

<!-- image -->

Confidentiality refers to the protection of information from unauthorized access and disclosure . *Definitions in this document are intended as plain language. View the official definition within 32 CFR Part 2002 "Controlled Unclassified Information."

## A Suite of Guidance

NIST's suite of CUI guidance (shown in the table below) focuses on protecting the confidentiality 2 of CUI in nonfederal systems and organizations and recommends specific security requirements to achieve that objective. This guide will focus on SP 800-171, Revision 3 . <!-- image -->

<!-- image -->

<!-- image -->

NIST SP 800-171, Protecting Controlled Unclassified Information in Nonfederal Systems is a set of recommended security requirements for protecting the confidentiality of CUI. NIST SP 800-171A, Assessing Security Requirements for Controlled Unclassified Information provides assessment procedures and a methodology to conduct assessments of the CUI security requirements in SP 800-171.

Protecting Controlled Unclassified Information (CUI)_ NIST Special Publication 800-171, Revision 3. Small Business Primer


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice IA.L2-3.5.3 (NIST 3.5.3)?

[Assistant]
According to Contingency Planning Guide for Federal Information Systems:

3.5.3 3. 3.5.3 Exercises

NIST SP 800-84 identifies the following types of exercises widely used in information system TT&E programs by single organizations:

-  Tabletop Exercises.

Contingency Planning Guide for Federal Information Systems


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for Audit and Accountability?

[Assistant]
According to Protecting Controlled Unclassified Information (CUI)_ NIST Special Publication 800-171, Revision 3. Small Business Primer:

| Access Control                    | Maintenance         | Security Assessment and Monitoring   |
|-----------------------------------|---------------------|--------------------------------------|
| Awareness and Training            | Media Protection    | System and Communications Protection |
| Audit and Accountability          | Personnel Security  | System and Information Integrity     |
| Configuration Management          | Physical Protection | Planning                             |
| Identification and Authentication | Risk Assessment     | System and Services Acquisition      |
| Incident Response                 |                     | Supply Chain Risk Management         |

| Identify the role(s) responsible for security and provide the necessary resources. | Whether it is just one person or multiple people within the business, ensure roles, responsibilities, and authorities related to cybersecurity risk management are established, communicated, understood, and enforced. Even if cybersecurity activities are outsourced to an external provider, someone within the business should still be designated to manage cybersecurity risk.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for Risk Assessment?

[Assistant]
According to Assessing Enhanced Security Requirements for Controlled Unclassified Information:

| CHAPTERONE INTRODUCTION...................................................................................................... | CHAPTERONE INTRODUCTION...................................................................................................... | 1   |
|-----------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------|-----|
| 1.1                                                                                | PURPOSEANDAPPLICABILITY............................................................................................................. 1        | 2   |
| 1.2                                                                                | TARGET AUDIENCE.............................................................................................................................. |     |
| 1.3                                                                                | ORGANIZATIONOF THIS SPECIAL PUBLICATION................................................................................. | 2   |
| CHAPTERTWO THE FUNDAMENTALS............................................................................................ | CHAPTERTWO THE FUNDAMENTALS............................................................................................ | 3   |
| 2.1                                                                                | ASSESSMENT PROCEDURES................................................................................................................

Assessing Enhanced Security Requirements for Controlled Unclassified Information


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Physical Protection?

[Assistant]
According to Addressing Visibility Challenges with TLS 1.3 within the Enterprise_ High-Level Document:

The terms 'shall' and 'shall not' indicate requirements to be followed strictly to conform to the publica�on and from which no devia�on is permited. The terms 'should' and 'should not' indicate that among several possibili�es, one is recommended as par�cularly suitable without men�oning or excluding others, or that a certain course of ac�on is preferred but not necessarily required, or that (in the nega�ve form) a certain possibility or course of ac�on is discouraged but not prohibited. The terms 'may' and 'need not' indicate a course of ac�on permissible within the limits of the publica�on. The terms 'can' and 'cannot' indicate a possibility and capability, whether material, physical, or causal.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Communications Protection?

[Assistant]
According to Data Integrity_ Detecting and Responding to Ransomware and Other Destructive Events:

ar files to /lib/security/Unlimited/ and /lib/security/Limited in the Java installation directory. 6. Run install-server-windows-amd64. 7. Select the Java runtime that was just installed. 8. Click OK.
| AD    | Active Directory                                  |
|-------|---------------------------------------------------|
| AMP   | Advanced Malware Protection                       |
| API   | Application Programming Interface                 |
| CEF   | Common Event Format                               |
| CSR   | Certificate Signing Request                       |
| CSV   | Comma-Separated Values                            |
| DNS   | Domain Name System                                |
| DSP   | Directory Services Protector                      |
| ESM   | Enterprise Security Manager                       |
| ICA   | Information Centric Analytics                     |
| IIS   | Internet Information Services                     |
| ISAPI | Internet Server Application Programming Interface |
| ISE   | Identity Services Engine                          |
| IT    | Information Technology                            |
| JCE   | Java Cryptography Extension                       |
| JRE   | Java Runtime Environment                          |
| MAC   | Media Access Control                              |
| MMC   | Microsoft Management Console                      |
| MSSQL | Microsoft Structured Query Language               |
| MX    | Mail Exchange                                     |


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice CM.L2-3.4.4 (NIST 3.4.4)?

[Assistant]
According to Protecting Information and System Integrity in Industrial Control System Environments_ Cybersecurity for the Manufacturing Sector:

3.4.4, which maps the security characteristics of the example solutions to cybersecurity standards and best practices

IT and OT professionals who want to implement an approach like this will find the whole practice guide useful, particularly the how-to portion, NIST SP 1800-10C, which provides step-by-step details to replicate all, or parts of the example solutions created in our lab. 3.4.4 Security Control Map

Implementation of cybersecurity architectures is most effective when executed in the context of an overall cybersecurity framework.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 1 require for Physical Protection?

[Assistant]
According to Summary Report for “Workshop on Updating Manufacturer Guidance for Securable Connected Product Development”:

ding proactive notification to consumers, retailers, and third parties. Companies should track devices to address critical vulnerabilities and create structured options for off-ramping zombie devices.
Higginbotham emphasized that company priorities often overlook device security. Manufacturers should implement vulnerability disclosure programs, track issues, conduct comprehensive security audits, and allocate budgets for security maintenance. Buyers must keep products updated or segmented, and legislation should clarify responsibility to ensure herd immunity. Companies should have a dedicated point of contact for security researchers and consider recalls for insecure devices. Stacey also addressed secure repairs, both before and after end of life. Good hardware should not end up in landfills, but unpatched zombie devices pose risks. Consumer Reports advocates for designing products for longevity, including features like hardware upgrades, crypto agility, and increased memory.

Summary Report for “Workshop on Updating Manufacturer Guidance for Securable Connected Product Development”


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Audit and Evaluation of Computer Security provide? (Part 9)

[Assistant]
ordinators Robert V. Jacobson, John Panagacos, and Thomas C. Lowe
for making things run smoothly while the Workshop was taking place; and
Dennis K. Branstad for photographing scenes from the Workshop.
THE EDITORS

vi

TABLE OF CONTENTS

FOREWORD

PREFACE

EXECUTIVE SUMMARY

PART I:

INTRODUCTION

1. 2. HOST WELCOMING ADDRESS
EDITORS' COMMENTS ON THE SESSIONS AND THE REPORTS ... 2.1
2.2
2.3

Some Definitions of Terms
Observations
Reading the Proceedings

PART II:

KEYNOTE ADDRESS

1. 2. 3. INTRODUCTION
AN APPROACH TO THE WORKSHOP
COMMENTS ON PROPOSED TOPICS
3.1
3.2
3.3
3.4

........ .... Internal Audit Standards
Qualifications and Training ............ ..... Security Administration
Audit Considerations in Various System
..... Environments
Administrative and Physical Controls ....... ..... Program Integrity
Data Integrity
Communications
Post-Processing Audit Tools and Techniques .... Interactive Audit Tools and Techniques

3.5
3.6
3.7
3.8
3.9
3.10

PART III:

...... EDITORS' NOTE ....................... INTERNAL AUDIT STANDARDS

Supplemental Standards for Internal Auditor's Expanded
Role in Reviewing Computer Systems and Their Development . . 1. INTRODUCTION
1.1
1.2
1.3

Automated Systems Effect on Environment ...... Computer Security Defined ............. Discussion of Audit Involvement in Computer
Changing Auditor Requirement ........... 1.4

iii

iv

xix

1-1

1-1
1-3
1-3
1-4
1-4

2-1

2-2
2-2
2-3
2-3
2-3
2-4

2-4
2-4
2-4
2-4
2-5
2-5
2-5

3-1
3-2

3-3

3-3
3-3
3-3

3-5

vi i

. ,

. . . . . o

. . ,

. o

. o

. . . 2. „

o

. Commentary

SUPPLEMENTAL STANDARDS FOR COMPUTER INTERNAL AUDIT
WORK
2.1
2.2

General
Supplemental Standard for Systems Development . 2. 2 J
Supplemental Standard for Operational Systems
(Application Controls)
2.3.1
Supplemental Standard for Physical Security and
General Controls
Commentary
2o4.1
Other Audit Requirements

2.3

2.4

2e5

Commentary

. o

. . o

. »

„

. =

. „

o

3. RECOMMENDED COURSE OF ACTION

o

4.

Audit and Evaluation of Computer Security


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Identification and Authentication?

[Assistant]
According to Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations:

| 1. Introduction.....................................................................................................................................1   |
|---------------------------------------------------------------------------------------------------------------------------------------------------------|
| 1.4.1. Enterprise Risk Management and C-SCRM Owners and Operators.............................................5                                         |
| 1.4.2. Enterprise, Agency, and Mission and Business Process Owners and Operators .........................5                                             |
| 1.4.3. Acquisition and Procurement Owners and Operators.................................................................6                               |
| 1.4.4. Information Security, Privacy, or Cybersecurity Operators .........................................................6                             |
| 1.4.5. System Development, System Engineering, and System Implementation Personnel.................7                                                    |
| 1.5.1. Enterprise's Supply Chain.............................................................................................................9          |
| 1.5.2. Supplier Relationships Within Enterprises .................................................................................10                    |
| 2. Integration of C-SCRM Into Enterprise-Wide Risk Management...................................................... 18                                  |
| 2.3.1. Roles and Responsibilities Across the Three Levels ...................................................................24                         |
| 2.3.2. Level 1 -Enterprise...................................................................................................................27         |
| 2.3.3.

Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Digital Identity Guidelines_ Identity Proofing and Enrollment provide? (Part 6)

[Assistant]
. . . . . . . . . . . . . . . . . . . . . . . . . . . 2.1.2. Identity Proofing Roles . . . . . . . . . . . . . . . . . . . . . . . 2.1.3. Identity Proofing Types

. . . . . . . . . . . . . . . . . . .
. . . Core Attributes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Identity Resolution . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Identity Evidence and Attributes . . . . . . . . . . . . . . . . . . . . . . 2.2. 2.3. 2.4. 2.4.1. Evidence Strength Requirements

. . . . . . . . . . . . . . . . . 2.4.2. Identity Evidence and Attribute Validation . . . . . . . . . . . . 2.5. Identity Verification . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2.5.1. Identity Verification Methods . . . . . . . . . . . . . . . . . . . 3. Identity Proofing Requirements . . . . . . . . . . . . . . . . . . . . . . . . . 3.1. 3.2. Identity Service Documentation and Records . . . . . . . . . . . . . . . Fraud Management

. . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.2.1. CSP Fraud Management . . . . . . . . . . . . . . . . . . . . . . 3.2.2. RP Fraud Management . . . . . . . . . . . . . . . . . . . . . . . 3.2.3. Treatment of Fraud Check Failures

. . . . . . . . . . . . . . . . 3.3. General Privacy Requirements . . . . . . . . . . . . . . . . . . . . . . . 3.3.1. Privacy Risk Assessment . . . . . . . . . . . . . . . . . . . . . . 3.3.2. Additional Privacy Protective Measures . . . . . . . . . . . . . . 3.4. General Customer Experience Requirements . . . . . . . . . . . . . . . 3.5. General Security Requirements

. . . . . . . . . . . . . . . . . . . . . . 3.6. Redress Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . 1

1

2

3

3

5

5

6

7

8

9

9

9

10

12

14

14

16

16

17

18

20

21

21

21

22

23

23

24

iii

NIST SP 800-63A-4
July 2025

Digital Identity Guidelines
Identity Proofing and Enrollment

3.7. Additional Requirements for Federal Agencies

. . . . . . . . . . . . . . 3.8. 3.9.

Digital Identity Guidelines_ Identity Proofing and Enrollment


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Information Integrity?

[Assistant]
According to Access Control on NoSQL Databases:

Despite their advantages, NoSQL databases lack a mechanism for handling and managing data consistency and maintaining integrity constraints (e.g., using foreign keys). Additionally, they often have limited support for security at the database level [OG]. NoSQL database systems offer promising features, such as flexible data models, horizontal scaling, and fast queries that allow for data analysis efficiency, improved system performance, ease of deployment, flexibility/scalability of data management, and users' availability when compared with RDBMS. However, despite these advantages, NoSQL databases lack a mechanism for handling and managing data consistency and maintaining integrity constraints. Additionally, they often have limited support for security at the database level. With an increasing number of people storing sensitive data in NoSQL databases, security issues are becoming critical concerns. Since access control is a fundamental data protection requirement for any database management system, this document discusses access control on NoSQL database systems by illustrating the NoSQL database types along with their support for access control models and describing considerations from the perspective of access control. 1. Resource providers (RPs) store information for sharing with federated members. The information is managed locally by the resource contributors or administrators of the RP. The availability and integrity of the resource is the central operation goal. 2. Resource managers (RMs) are responsible for locating the resources in response to the access request from a resource consumer. The security and accessibility of communications between the RPs and their connected resource consumers are the primary concerns of an RM. 3. Resource consumers (RCs) are client applications that accept user requests for resources and forward those requests to an RM.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Personnel Security?

[Assistant]
According to Recommendations for Federal Vulnerability Disclosure Guidelines:

A VDPO may be an office with its own dedicated personnel or a virtual office with duties and roles assumed by members of the operating unit's ITSO. At a minimum, it will consist of staff who perform coordination and oversight duties and engagement with vulnerability disclosure reporters. However, the VDPO may extend to provide technical services to system owners to support their efforts in verifying and remediating vulnerabilities. In this case, the VDPO may include more technically oriented developers or systems administrators with security expertise.

Each VDPO should develop the ability to communicate and coordinate with their FCB member to resolve vulnerability reports, which requires the development of both technical and personnel/procedural capabilities. If the FCB member provides technical mechanisms to streamline this process, the VDPO should use the provided mechanisms. It is also possible to procure commercial VDP services, particularly for reporting, tracking, and researcher communications.

Recommendations for Federal Vulnerability Disclosure Guidelines


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Risk Assessment?

[Assistant]
According to Recommendation for Pair-Wise Key-Establishment Schemes Using Discrete Logarithm Cryptography:

Similarly, assurance of forward secrecy (FS), as defined in this Recommendation, does not address problems that may arise from sources other than the compromise of static private  key-agreement  keys.  There  can  be,  of  course,  other  threats  to  the  security  of derived keying material, such as the use of derived keys in cryptographic algorithms or devices that have been compromised. Improper storage or transport of keying material, the failure to prevent the leakage of sensitive information during computations involving the derived keys, and/or inadequate methods for the timely destruction of sensitive data (including  ephemeral  private  keys  and  the  derived  keys  themselves)  are  just  a  few examples of problems that could lead to an eventual compromise of keying material derived during a particular transaction.

Recommendation for Pair-Wise Key-Establishment Schemes Using Discrete Logarithm Cryptography


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What guidance does Guidelines for the Use of PIV Credentials in Facility Access provide?

[Assistant]
## NIST Special Publication 800-116 Revision 1

## Guidelines for the Use of PIV Credentials in Facility Access

Hildegard Ferraiolo Ketan Mehta Nabil Ghadiali Jason Mohler Vincent Johnson Steven Brady

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-116r1

## I  N  F  O  R  M  A  T  I  O  N      S  E  C  U  R  I  T  Y

<!-- image -->

## NIST Special Publication 800-116

## Revision 1

## Guidelines for the Use of PIV Credentials in Facility Access

Hildegard Ferraiolo Ketan Mehta Computer Security Division Information Technology Laboratory

Nabil Ghadiali National Gallery of Art Washington, DC

Jason Mohler Vincent Johnson Steven Brady Electrosoft Services, Inc. Reston, Virginia

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-116r1

June 2018

<!-- image -->

U.S. Department of Commerce Wilbur L. Ross, Jr., Secretary

National Institute of Standards and Technology

## Authority

This publication has been developed by NIST in accordance with its statutory responsibilities under the Federal Information Security Modernization Act (FISMA) of 2014, 44 U.S.C. § 3551 et seq. , Public Law (P.L.)  113-283. NIST  is  responsible  for  developing  information  security  standards  and  guidelines, including minimum requirements for federal information systems, but such standards and guidelines shall not  apply  to  national  security  systems  without  the  express  approval  of  appropriate  federal  officials exercising policy authority over such systems. This guideline is consistent with the requirements of the Office of Management and Budget (OMB) Circular A-130. Nothing in this publication should be taken to contradict the standards and guidelines made mandatory and binding on federal agencies by the Secretary of Commerce under statutory authority.

Guidelines for the Use of PIV Credentials in Facility Access


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Supply Chain Risk Management?

[Assistant]
According to Validating the Integrity of Computing Devices:

The supply chains of information and communications technologies are increasingly at risk of compromise. Additional risks causing supply chain disruptions include counterfeiting, unauthorized production, tampering, theft, and insertion of unexpected software and hardware. Managing these risks requires ensuring the integrity of the supply chain and its products and services. This project demonstrates how organizations can verify that the internal components and system firmware of the computing devices they acquire are genuine and have not been unexpectedly altered during manufacturing, distribution, or operational use. Technologies today rely on complex, globally distributed and interconnected supply chain ecosystems to provide highly refined, cost-effective, and reusable solutions. Most organizations' security processes consider only the visible state of computing devices. The provenance and integrity of a delivered device and its components are typically accepted without validating through technology that there were no unexpected modifications. A delivered device has integrity if it is genuine and all changes to the device were authorized and expected. Provenance is the comprehensive history of a device throughout the entire life cycle from creation to ownership, including changes made within the device or its components. Assuming without verification that all acquired computing devices are genuine and unmodified increases the risk that a compromise will affect products in an organization's supply chain and go unnoticed at the time, which in turn increases risks to customers and end users. Organizations currently lack the ability to cost effectively distinguish trustworthy products from others, meaning they are genuine and have not been inappropriately altered. Having this ability is a critical foundation of cyber supply chain risk management (C-SCRM).

Validating the Integrity of Computing Devices


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Analyzing Collusion Threats in the Semiconductor Supply Chain provide? (Part 8)

[Assistant]
ted, and the semiconductor supply chain stage at which mitigation is best applied. ## 3.2. Identify Hardware Threats

The second step is identifying the threats associated with the adversary's intent.
For example, if the intent is IP theft, then the IP to be protected must be identified. In this context, an attack on logic obfuscation can be characterized as a threat. Similarly, if the adversary intends to infiltrate hardware, then hardware Trojan insertion may need to be examined. ## 3.3. Analyze Stages of Hardware Development Life Cycle for Exploitability of the Threat

At this point, one or more significant hardware threats have been identified. The following stage involves determining which stage of the semiconductor supply chain the threat can be exploited. Questions such as how much threat an adversary in the manufacturing stage poses to logic obfuscation, or whether an adversary in the provisioning stage offers threats to hardware Trojan insertion, are raised. In light of a threat, this step determines the semiconductor supply chain's security-critical phases. In addition, this step determines if a threat is unexploitable at a specific point in the supply chain. ## 3.4. Analyze the Effect of Collusion Among Adversaries in Different Stages

Since every stage of the semiconductor supply chain is distinct, adversaries have varying degrees of access to and knowledge of the system at different stages of the semiconductor

supply chain. The effectiveness of an attack depends largely on the adversary's knowledge of the system and their level of access. Different adversaries possess varying degrees of both. For example, a manufacturer may have detailed design knowledge, while an end user typically has limited access and little insight into a system's internal functions. As a result, their capabilities differ significantly.

Analyzing Collusion Threats in the Semiconductor Supply Chain


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Status Report on the Fourth Round of the NIST Post-Quantum Cryptography Standardization Process provide? (Part 9)

[Assistant]
ms of the unbroken fourth-round candidates were invited to present updates for their candidate algorithms at the Fifth NIST PQC Standardization Conference in Rockville, Maryland, on April 10-12, 2024.
The submitters participated in a joint panel to discuss the candidates' merits, and several researchers presented work that was relevant to the PQC standardization process. Throughout the fourth round, NIST received valuable feedback from the cryptographic community. Based on this feedback and internal reviews of the fourth-round candidates, NIST announced the selection of HQC in March 2025 for standardization. Table 1 shows a timeline of major events with respect to the NIST PQC Standardization Process to date. Table 1.

Status Report on the Fourth Round of the NIST Post-Quantum Cryptography Standardization Process


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AT.L2-3.2.3 (NIST 3.2.3)?

[Assistant]
According to Audit and Evaluation of Computer Security II_ System Vulnerabilities and Controls:

3.2.3 Library Operation                                                                               | 4-10 4-10 |
|      |                |                                                                                | 4-11      |
|      |                | 3. 3.2.3 Library Operation .

Audit and Evaluation of Computer Security II_ System Vulnerabilities and Controls


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Access Control?

[Assistant]
According to Digital Identity Guidelines:

1.3.1. Security, Fraud, and Threat Prevention . . . . . . . . . . . . . .

2.3.1. Authenticators . . . . . . . . . . . . . . . . . . . . . . . . . . .

3.1. Define the Online Service . . . . . . . . . . . . . . . . . . . . . . . . .


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for Media Protection?

[Assistant]
According to Protecting Controlled Unclassified Information (CUI)_ NIST Special Publication 800-171, Revision 3. Small Business Primer:

| Access Control                    | Maintenance         | Security Assessment and Monitoring   |
|-----------------------------------|---------------------|--------------------------------------|
| Awareness and Training            | Media Protection    | System and Communications Protection |
| Audit and Accountability          | Personnel Security  | System and Information Integrity     |
| Configuration Management          | Physical Protection | Planning                             |
| Identification and Authentication | Risk Assessment     | System and Services Acquisition      |
| Incident Response                 |                     | Supply Chain Risk Management         |

## Family: Media Protection

Description: Protect system media, both paper and digital; limiting access to data on system media to authorized users; and sanitizing or destroying system media before disposal or release for reuse.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Information Integrity?

[Assistant]
According to Automated Secure Configuration Guidance from the macOS Security Compliance Project (mSCP):

- The SP 800-53, Revision 5 low baseline is a defined map of controls to secure a system defined as a low-impact information system. The loss of confidentiality, integrity, or availability could be expected to have a limited adverse effect on organizational operations, organizational assets, or individuals. - The SP 800-53, Revision 5 moderate baseline is a defined map of controls to secure a system defined as a moderate-impact information system. The loss of confidentiality, integrity, or availability could be expected to have a serious adverse effect on organizational operations, organizational assets, or individuals. - The SP 800-53, Revision 5 high baseline is a defined map of controls to secure a system defined as a high-impact information system. The loss of confidentiality, integrity, or availability could be expected to have a severe or catastrophic adverse effect on organizational operations, organizational assets, or individuals. offer a convenient, Apple-supported mechanism for applying security settings to a macOS environment. Additionally, they can be cryptographically signed to ensure integrity and authenticity. These factors make configuration profiles the preferred vehicle for configuration delivery. However, mobileconfig files cannot modify all macOS settings, so a configuration script is needed for those settings that are not supported. See the developer documentation page for an example configuration profile and brief descriptions of its properties. This example is for Tenable, Inc. They automated the conversion of mSCP YAML rules into their . audit format using Python and YAML libraries. Programmatically approaching this conversion allows for faster future releases and greater consistency, and it also maintains the integrity of the source content. Because the YAML content is all command-driven, it is converted to Tenable's CMD\_EXEC check type for use with the Unix plugin.

Automated Secure Configuration Guidance from the macOS Security Compliance Project (mSCP)