[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Access Control?

[Assistant]
According to The Federal Cybersecurity Awareness Workforce_ Professional Backgrounds, Knowledge, Skills, and Development Activities:

| EXECUTIVE SUMMARY........................................................................................................III                                                                                | EXECUTIVE SUMMARY........................................................................................................III                                                                                | EXECUTIVE SUMMARY........................................................................................................III                                                                                |
|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| 1 INTRODUCTION................................................................................................................. 1                                                                                | 1 INTRODUCTION.................................................................................................................


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Configuration Management?

[Assistant]
According to Assessing Security and Privacy Controls in Information Systems and Organizations:

NTROL ASSESSMENTS ..................................................... 30
3.4   ANALYZE ASSESSMENT REPORT RESULTS .....................................................................................
32
3.5   ASSESS SECURITY AND PRIVACY CAPABILITIES .............................................................................. 34
CHAPTER FOUR SECURITY AND PRIVACY ASSESSMENT PROCEDURES ................................................. 37
4.1   ACCESS CONTROL............................................................................................................................ 40
4.2   AWARENESS AND TRAINING ........................................................................................................ 118
4.3   AUDIT AND ACCOUNTABILITY ...................................................................................................... 128
4.4   ASSESSMENT, AUTHORIZATION, AND MONITORING ................................................................. 160
4.5   CONFIGURATION MANAGEMENT ................................................................................................ 177
4.6   CONTINGENCY PLANNING ............................................................................................................ 215
4.7   IDENTIFICATION AND AUTHENTICATION .................................................................................... 243
4.8   INCIDENT RESPONSE ............................................................................................................... 275
4.9   MAINTENANCE ........................................................................................................................ 298
4.10   MEDIA PROTECTION .............................................................................................................. 316
4.11   PHYSICAL AND ENVIRONMENTAL PROTECTION .......................................................................

Assessing Security and Privacy Controls in Information Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Report on the Design-A-Thon_ Designing Effective and Accessible Approaches for Digital Product Cybersecurity Education and Awareness provide? (Part 10)

[Assistant]
onally, materials should meet accessibility 1 standards and guidance (e.g., Americans with Disabilities Act (ADA) and Section 508 of the Rehabilitation Act of 1973) to support users with disabilities.
Since many users may not fully understand cybersecurity risks to their IoT products, education materials should clearly communicate the relevance of product cybersecurity features (what the features do and why these are of importance) and what actions are expected of the users (e.g., changing settings or physically safeguarding the product). Instructions for setting cybersecurity preferences should be clear, simple, and achievable for those without cybersecurity expertise. To support diverse users with different cybersecurity and technical needs, skills, and interests, a layered approach for education materials may also be helpful; first present basic information, then provide links to more detail for those who need or want it. 1

In this report the term 'accessibility' is used in the context of limiting or removing barriers for individuals with disabilities to use technology, access information and services, and participate in society generally. ## 3. Report from the Design-A-Thon

A 'Design-A-Thon' is an interactive event where individuals or teams are given a design task to work on within a given timeframe (generally several consecutive hours). It is closely related to the concept and approach of a Hack-A-Thon but isn't as focused on technical solutions or coding. As such, Design-A-Thons can be a useful tool to bring inter-disciplinary thinking with the aim of novel solutions to problems. NIST researchers planned the Design-A-Thon to target cybersecurity education and awareness for digital products.

Report on the Design-A-Thon_ Designing Effective and Accessible Approaches for Digital Product Cybersecurity Education and Awareness

Audit and Accountability
System and Information Integrity
Security Assessment
Media Protection
Identification and Authentication
Awareness and Training
System and Communications Protection
Access Control
Planning
Incident Response
Risk Assessment
Personnel Security
System and Services Acquisition
Supply Chain Risk Management
Maintenance
Physical Protection
Configuration Management


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Identification and Authentication?

[Assistant]
According to Digital Identity Guidelines_ Authentication and Authenticator Management:

Digital Identity Guidelines
Authentication and Authenticator Management

Digital Identity Guidelines
Authentication and Authenticator Management

Temoshok D, Fenton JL, Choong YY, Lefkovitz N, Regenscheid A, Galluzzo R, Richer JP
(2025) Digital Identity Guidelines: Authentication and Authenticator Management.
(National Institute of Standards and Technology, Gaithersburg, MD), NIST Special
Publication (SP) NIST SP 800-63B-4. https://doi.org/10.6028/NIST.SP.800-63B-4

Digital Identity Guidelines_ Authentication and Authenticator Management


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Physical Protection?

[Assistant]
According to Guide to Enterprise Patch Management Planning_ Preventive Maintenance for Technology:

of assets and software. A realistic goal is to maintain a close-to-comprehensive inventory by relying on automation to constantly discover new assets and collect up-to-date information on all assets.
Some vendors might also provide machineconsumable data on their assets' software composition, such as a software bill of materials (SBOM), which could be used to augment organization inventories.

Guide to Enterprise Patch Management Planning_ Preventive Maintenance for Technology


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice IA.L2-3.5.3 (NIST 3.5.3)?

[Assistant]
According to Digital Identity Guidelines:

3.5.3. 3.5.3.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Ordered t-way Combinations for Testing State-based Systems provide? (Part 3)

[Assistant]
same input. That is, the response of the process to a particular set of input values may depend on its current state, such as whether a communication protocol is in a listen or connection-open state.
The current state depends on the  order  of  input  values  that  were  contained  in previously received packets. The same sort of statedependent  behavior  occurs  in  many  other  types  of systems as well. Ensuring that inputs and system states in testing are sufficiently representative of what will be encountered  in  practice  is  critical  to  any  form  of effective software testing. The common practice for evaluating how thoroughly software has been tested is by using some sort of structural coverage metrics, such  as  statement  coverage,  branch  coverage,  or MC/DC  coverage  [13]  . Test  cases  selected  using only  structural  coverage  criteria  are  often  not  very effective as they are not designed to include corner cases with specific combinations of input values that may cause a failure. Looking beyond these commonly  used  metrics,  it  is  often  difficult  to determine if the code has been adequately tested and even more  difficult to ensure that a sufficient diversity of inputs has been achieved. This is particularly true of assertion-based testing or runtime verification, where program states and properties are monitored to verify correct processing. For runtime assertions to discover bugs, the software needs to be exercised with a set of values in a particular order that leads to the failure. Consequently, for strong software assurance, measures are needed to verify that combinations  of  input  values and combinations  of input orders in a test suite are sufficient. Combinatorial coverage measures provide an effective method for quantifying the thoroughness of test input values [26] . A number of measures have been defined for the coverage of (static) input value combinations.

Ordered t-way Combinations for Testing State-based Systems


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Personnel Security?

[Assistant]
According to NIST Cybersecurity Framework 2.0_ Quick-Start Guide for Cybersecurity Supply Chain Risk Management (C-SCRM):

☐ Include C-SCRM responsibilities and performance requirements in personnel descriptions to ensure clarity and improve accountability.

☐ Document performance goals for personnel with C-SCRM responsibilities, and periodically measure them to demonstrate and improve performance.

☐ vet their employees and guard against insider threats

NIST Cybersecurity Framework 2.0_ Quick-Start Guide for Cybersecurity Supply Chain Risk Management (C-SCRM)


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for Audit and Accountability?

[Assistant]
According to Protecting Controlled Unclassified Information (CUI)_ NIST Special Publication 800-171, Revision 3. Small Business Primer:

d, communicated, understood, and enforced. Even if cybersecurity activities are outsourced to an external provider, someone within the business should still be designated to manage cybersecurity risk.
|
|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| It's not all technology. | An important point to emphasize is that many requirements in SP 800-171 do not need investments in technology or services to implement. Many requirements can be achieved through the creation of processes and procedures. |
| Implement the requirements and document implementation in a system security plan. | Satisfying the security requirements won't be accomplished overnight. Implement in phases based upon your resources (includin g time, expertise, budget, etc.), starting with understanding what security requirements you may have already satisfied and building from there.

Protecting Controlled Unclassified Information (CUI)_ NIST Special Publication 800-171, Revision 3. Small Business Primer


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Access Control?

[Assistant]
According to Addressing Visibility Challenges with TLS 1.3 within the Enterprise_ High-Level Document:

lity to deploy load balancing, Layer 7 application firewalls, SSO (for Active Directory [AD] ) , Azure AD, Lightweight Directory Access Protocol (LDAP), and enterprise -level virtual private networks.
F5's BIG -IP is available as a hardware product and a virtual machine (BIG -IP Virtual Edition) that is cloud-agnostic and can be deployed on-premises in a public and/or hybrid cloud environment.

Addressing Visibility Challenges with TLS 1.3 within the Enterprise_ High-Level Document


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] How does IoT Non-Technical Supporting Capability Core Baseline support CMMC certification?

[Assistant]
According to IoT Non-Technical Supporting Capability Core Baseline:

ory responsibilities. The information in this publication, including concepts and methodologies, may  be  used  by  federal  agencies  even  before  the  completion  of  such  companion  publications.
Thus,  until  each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning  and  transition  purposes,  federal  agencies  may  wish  to  closely  follow  the  development  of  these  new publications by NIST. Organizations are encouraged to review all draft publications during public comment periods and provide feedback to NIST. Many NIST cybersecurity publications, other than the ones noted above, are available at https://csrc.nist.gov/publications. ## Comments on this publication may be submitted to:

National Institute of Standards and Technology Attn: Applied Cybersecurity Division, Information Technology Laboratory 100 Bureau Drive (Mail Stop 2000) Gaithersburg, MD 20899-2000

Email: iotsecurity@nist.gov

All comments are subject to release under the Freedom of Information Act (FOIA). ## Reports on Computer Systems Technology

The  Information  Technology  Laboratory  (ITL)  at  the  National  Institute  of  Standards  and Technology  (NIST)  promotes  the  U.S. economy  and  public  welfare  by  providing  technical leadership  for  the  Nation's  measurement  and  standards  infrastructure. ITL  develops  tests,  test methods, reference data, proof of concept implementations, and technical analyses to advance the development  and  productive  use  of  information  technology. ITL's  responsibilities  include  the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in federal information systems. ## Abstract

Non-technical supporting capabilities are actions a manufacturer or third-party organization performs in support of the cybersecurity of an IoT device.

IoT Non-Technical Supporting Capability Core Baseline


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Services Acquisition?

[Assistant]
According to NIST Cybersecurity Framework 2.0_ Quick-Start Guide for Cybersecurity Supply Chain Risk Management (C-SCRM):

C-SCRM practitioners identify, assess, and mitigate cybersecurity risks throughout the supply chain at all levels of their organizations associated with information and communications technology (ICT) products and services. Potential risks include malicious functionality, counterfeit devices, or vulnerabilities derived from poor manufacturing and development practices within the supply chain.

- Risk Assessment: The authenticity and integrity of hardware and software are assessed prior to acquisition and use [ID.RA-09]; Critical suppliers are assessed prior to acquisition [ID.RA-10]
- Improvement: Improvements are identified from security tests and exercises, including those done in coordination with suppliers and relevant third parties [ID.IM-02]


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does IoT Non-Technical Supporting Capability Core Baseline provide? (Part 6)

[Assistant]
.................14            |

## 1 Introduction

Internet of Things (IoT) devices often lack built-in device cybersecurity capabilities, as well as non-technical support relevant to cybersecurity.
Customers can use this type of information to help mitigate cybersecurity risks related to the IoT devices and their use. The wide range of connectivity possible for IoT devices, and the ability for these devices to interact with the physical world, means securing these devices often becomes a priority; but it is a challenge for customers when they are not adequately supported. This publication should be used and understood within the context of NISTIR 8259, Foundational Cybersecurity Activities for IoT Device Manufacturers [1] and NISTIR 8259A, IoT Device Cybersecurity Capability Core Baseline [2]. NISTIR 8259 discusses considerations for manufacturers to help guide them in choosing and implementing the device cybersecurity capabilities their IoT devices will provide. 8259A discusses device technical cybersecurity capabilities, which are cybersecurity features or functions that devices provide through their own technical means (i.e., device hardware and software), and establishes a core baseline of device cybersecurity capabilities IoT device customers commonly need. To complement the core baseline from NISTIR 8259A, the IoT non-technical supporting capability core baseline is a set of actions performed by manufacturers and/or designated supporting third parties (called supporting parties ). These actions will help others (e.g., customers, end-users) use the cybersecurity capabilities of IoT devices, and support the on-going cybersecurity of the IoT device and the system and networks the device connects to (the digital ecosystem).


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations provide? (Part 7)

[Assistant]
..........30                      |
| 2.3.4. Level 3 -Operational................................................................................................................32           |
| 2.3.5.
C-SCRM PMO..............................................................................................................................33       |
| Critical Success Factors...................................................................................................................37           |
| 3. |
| 3.1.2. The Role of C-SCRM in the Acquisition Process .........................................................................40                        |
| 3.4.1. Foundational Practices ...............................................................................................................46         |

| 3.4.3. Enhancing Practices....................................................................................................................49      |                                                                                |
|-------------------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------|
| 3.5.1. Measuring C-SCRM Through Performance Measures................................................................52                                |                                                                                |
| References.........................................................................................................................................57 |                                                                                |
| Appendix A. C-SCRM Security Controls...............................................................................................

Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Awareness and Training?

[Assistant]
According to Audit and Evaluation of Computer Security II_ System Vulnerabilities and Controls:

THE NATIONAL MEASUREMENT LABORATORY provides the national system of physical and chemical and materials measurement; coordinates the system with measurement systems of other nations and furnishes essential services leading to accurate and uniform physical and chemical measurement throughout the Nation's scientific community, industry, and commerce; conducts materials research leading to improved methods of measurement, standards, and data on the properties of materials needed by industry, commerce, educational institutions, and Government; provides advisory and research services to other Government agencies; develops, produces, and distributes Standard Reference Materials; and provides calibration services. The Laboratory consists of the following centers:

| 3. | POLICY         | AND CONTROL STANDARDS                                                                                | 3-6       |
|------|----------------|-------------------------------------------------------------------------------------------------------|-----------|
|      | 3.1            | General                                                                                | 3-6       |
|      | 3.2            | Assessing Security Safeguards                                                                         | 3-6       |
|      | 3.3            | Establishing Control Standards                                                                        | 3-6       |
|      | 3.4            | Require a Plan to Implement Controls                                                                  | 3-7       |
|      | 3.5            | Establish Personnel Security Policies                                                                 | 3-7       |
| 4.

Audit and Evaluation of Computer Security II_ System Vulnerabilities and Controls


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice CM.L2-3.4.5 (NIST 3.4.5)?

[Assistant]
According to Contingency Planning Guide for Federal Information Systems:

3.4.5                                                                                | Cost Considerations ... 3.4.5 Cost Considerations

The ISCP Coordinator should ensure that the strategy chosen can be implemented effectively with available personnel and financial resources.

Contingency Planning Guide for Federal Information Systems


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Supply Chain Risk Management?

[Assistant]
According to Strategies for the Integration of Software Supply Chain Security in DevSecOps CI_CD Pipelines:

## Strategies for the Integration of Software Supply Chain Security in DevSecOps CI/CD Pipelines

## Strategies for the Integration of Software Supply Chain Security in DevSecOps CI/CD Pipelines

Chandramouli R, Kautz F, Torres-Arias S (2024) Strategies for the Integration of Software Supply Chain Security in DevSecOps CI/CD Pipelines. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) NIST SP 800-204D. https://doi.org/10.6028/NIST.SP.800-204D

Strategies for the Integration of Software Supply Chain Security in DevSecOps CI_CD Pipelines


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AT.L2-3.2.9 (NIST 3.2.9)?

[Assistant]
According to Digital Identity Guidelines_ Authentication and Authenticator Management:

3.2.9. 3.2.9. 3.2.9, NIST may adjust the restricted status of out-of-band
authentication using the PSTN based on the evolution of the threat
landscape and the technical operation of the PSTN.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 2 require for System and Services Acquisition?

[Assistant]
According to Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations:

There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may be used by federal agencies even before the completion of such companion publications. Thus, until each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning and transition purposes, federal agencies may wish to closely follow the development of these new publications by NIST. The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the Nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology. ITL's responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in federal information systems. The Special Publication 800-series reports on ITL's research, guidelines, and outreach efforts in information system security, and its collaborative activities with industry, government, and academic organizations.

Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Identification and Authentication?

[Assistant]
According to Recommendations for Federal Vulnerability Disclosure Guidelines:

| Executive Summary................................................................................................................. | Executive Summary................................................................................................................. | Executive Summary................................................................................................................. |
|--------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------|
| U.S. Government Vulnerability Disclosure..................................................................... | 2                                                                                |                                                                                |
| Usage of Document Terminology................................................................................ | 5                                                                                |                                                                                |
| Federal Vulnerability Disclosure Coordination Body ....................................................

Recommendations for Federal Vulnerability Disclosure Guidelines


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Identification and Authentication?

[Assistant]
According to Recommendation for Pair-Wise Key-Establishment Schemes Using Discrete Logarithm Cryptography:

| 1. Introduction.............................................................................................................. 1   | 1. Introduction.............................................................................................................. 1   | 1. Introduction.............................................................................................................. 1     | 1. Introduction.............................................................................................................. 1   |
|-----------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------|
| 2. Scope and Purpose ................................................................................................. | 2. Scope and Purpose ................................................................................................. | 2. Scope and Purpose ................................................................................................. | 1                                                                                |
| 3. Definitions, Symbols and Abbreviations ............................................................... | 3. Definitions, Symbols and Abbreviations ............................................................... | 3. Definitions, Symbols and Abbreviations ...............................................................

Recommendation for Pair-Wise Key-Establishment Schemes Using Discrete Logarithm Cryptography


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AT.L2-3.2.3 (NIST 3.2.3)?

[Assistant]
According to Protecting Information and System Integrity in Industrial Control System Environments_ Cybersecurity for the Manufacturing Sector:

3.2.3 eyeSight

Forescout eyeSight is an appliance hosted on a 1U Dell R640 that is installed within a standard datacenter rack and connected to the network as described in the previous section.

Protecting Information and System Integrity in Industrial Control System Environments_ Cybersecurity for the Manufacturing Sector


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Summary Report for “Workshop on Updating Manufacturer Guidance for Securable Connected Product Development” provide? (Part 6)

[Assistant]
Baseline (NIST IR 8259A) and nontechnical, IoT Non-Technical Supporting Capability Core Baseline (NIST IR 8259B) concepts to help manufacturers and customers consider the cybersecurity of IoT devices.
The NIST IR 8259 series has been used to inform and develop subsequent publications that elaborate on IoT cybersecurity across sectors and use cases (e.g., federal agency uses cases reflected in IoT Device Cybersecurity Guidance for the Federal Government: Establishing IoT Device Cybersecurity Requirements (NIST SP 800-213) and consumer use cases reflected in Profile of the IoT Core Baseline for Consumer IoT Products (NIST IR 8425) and the U.S. Cyber Trust Mark). NIST IR 8259 serves as a foundational document for these publications -providing these a conceptual and contextual basis. But in the extension of the documents over time, these subsequent publications introduced new concepts which would benefit the broader community in the foundational NIST IR 8259 series. ## About the Workshop

The purpose of this workshop was to consider how to better align NIST IR 8259 with concepts introduced in later publications. For example, NIST IR 8425 explicitly discusses IoT products and the relationship among product components. NIST IR 8259 needs to align with these concepts. Additionally, some topics have consistently come up in discussions with the community that NIST considers as potential areas to add to a revision of NIST IR 8259, including:

- Broaden the discussions from a focus on the IoT system device component to considerations of entire IoT products (and connected products) to better reflect the wide variety of applications and use cases that exist. - Develop the relationship between risk assessment and threat modeling activities. - Address the different cybersecurity considerations among Information Technology (IT), Internet of Things (IoT), Operational Technology (OT), and Industrial Internet of Things (IIoT)
- Identify insights, considerations, approaches, etc.

Summary Report for “Workshop on Updating Manufacturer Guidance for Securable Connected Product Development”

Audit and Accountability
System and Information Integrity
Security Assessment
Media Protection
Identification and Authentication
Awareness and Training
System and Communications Protection
Access Control
Planning
Incident Response
Risk Assessment
Personnel Security
System and Services Acquisition
Maintenance
Physical Protection
Configuration Management


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Recommendation for Pair-Wise Key-Establishment Schemes Using Discrete Logarithm Cryptography provide? (Part 3)

[Assistant]
h  to  closely  follow  the  development  of  these  new publications by NIST. Organizations are encouraged to review all draft publications during public comment periods and provide feedback to NIST.
Many NIST cybersecurity publications, other than the ones noted above, are available at https://csrc.nist.gov/publications. ## Comments on this publication may be submitted to:

National Institute of Standards and Technology Attn: Computer Security Division, Information Technology Laboratory 100 Bureau Drive (Mail Stop 8930) Gaithersburg, MD 20899-8930 Email: SP800-56a\_comments@nist.gov

All comments are subject to release under the Freedom of Information Act (FOIA). ## Reports on Computer Systems Technology

The  Information  Technology  Laboratory  (ITL)  at  the  National  Institute  of  Standards  and  Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the Nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology. ITL's responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national securityrelated information in Federal information systems. The Special Publication 800-series reports on ITL's research, guidelines, and outreach efforts in information system security, and its collaborative activities with industry, government, and academic organizations. ## Abstract

This Recommendation specifies key-establishment schemes based on the discrete logarithm problem over finite fields and elliptic curves, including several variations of Diffie-Hellman and Menezes-Qu-Vanstone (MQV) key establishment schemes.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 2 require for Planning?

[Assistant]
According to Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations:

......95                       |
| Table 7. Configuration Management (CM).................................................................................................96                |
| Table 8.
Contingency Planning (CP) ............................................................................................................96        |
| Table 9. Identification and Authentication (IA) ..........................................................................................97             |
| Table 10. Incident Response (IR).................................................................................................................98      |
| Table 11. Maintenance (MA) ......................................................................................................................98      |
| Table 12. Media Protection (MP)................................................................................................................99        |
| Table 13. Physical and Environmental Protection (PE)...............................................................................99                    |
| Table 14. Planning (PL)..............................................................................................................................100 |
| Table 15. Program Management (PM) .....................................................................................................100               |
| Table 16. Personnel Security (PS) .............................................................................................................101       |
| Table 17. PII Processing and Transparency (PT) .......................................................................................102                |
| Table 18. Risk Assessment (RA) ................................................................................................................102       |
| Table 19.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Secure Software Development Practices for Generative AI and Dual-Use Foundation Models_ An SSDF Community Profile provide? (Part 7)

[Assistant]
t claims have been identified to ITL. No representation is made or implied by ITL that licenses are not required to avoid patent infringement in the use of this publication. ## Table of Contents

| 1.
Introduction...................................................................................................................................1   |
|-------------------------------------------------------------------------------------------------------------------------------------------------------|
| 2. Using the SSDF Community Profile..................................................................................................4                |
| 3. SSDF Community Profile for AI Model Development .......................................................................6                           |
| References.......................................................................................................................................20   |
| Appendix A. Glossary .......................................................................................................................22        |
| List of Tables                                                                                |
| Table 1. SSDF Community Profile for AI Model Development ..............................................................8                              |

## 1. Introduction

Section 4.1.a of Executive Order (EO) 14110, Safe, Secure, and Trustworthy Development and Use of Artificial Intelligence [1], tasked NIST with 'developing a companion resource to the Secure Software Development Framework to incorporate secure development practices for generative AI and for dual-use foundation models.' This document is that companion resource. The software development and use of AI models and AI systems inherit much of the same risk as any other digital system.

Secure Software Development Practices for Generative AI and Dual-Use Foundation Models_ An SSDF Community Profile


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice MA.L2-3.7.3 (NIST 3.7.3)?

[Assistant]
According to Data Integrity_ Detecting and Responding to Ransomware and Other Destructive Events:

3.7.3 Other Considerations

The use of the event detection capability to detect largely assumes that the update has been reported as vulnerable, either through a well-known history of being vulnerable or through intelligence-sharing channels.

Data Integrity_ Detecting and Responding to Ransomware and Other Destructive Events


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Guide to a Secure Enterprise Network Landscape provide? (Part 5)

[Assistant]
However, holders of patents are not obligated to respond to ITL calls for patents and ITL has not undertaken a patent search in order to identify which, if any, patents may apply to this publication.
As of the date of publication and following call(s) for the identification of patent claims whose use may be required for compliance with the guidance or requirements of this publication, no such patent claims have been identified to ITL. No representation is made or implied by ITL that licenses are not required to avoid patent infringement in the use of this publication.

Guide to a Secure Enterprise Network Landscape


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Audit and Accountability?

[Assistant]
According to Multi-Factor Authentication for Criminal Justice Information Systems_ Implementation Considerations for Protecting Criminal Justice Information:

This document is intended to aid agencies in their MFA implementations; it does not guarantee that their implementation will meet CJIS Security Policy requirements or will pass a CJIS audit. All questions about how a specific MFA implementation can meet the CJIS Security Policy should be directed to the CJIS Information Security Officer (ISO) team at iso@fbi.gov.

## 3.3. Phased MFA Deployment

state message switch, as described in Sec. 3.1.3. Instead, identity information (which might be needed downstream for auditing and logging) could be passed to the message switch using identity federation protocols such as SAML or OpenID Connect.

Multi-Factor Authentication for Criminal Justice Information Systems_ Implementation Considerations for Protecting Criminal Justice Information


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What guidance does Contingency Planning Guide for Federal Information Systems provide?

[Assistant]
## NIST Special Publication 800-34 Rev. 1

## Contingency Planning Guide for Federal Information Systems

Marianne Swanson Pauline Bowen Amy Wohl Phillips Dean Gallup David Lynes

<!-- image -->

## NIST Special Publication 800-34 Rev. 1

## Contingency Planning Guide for Federal Information Systems

Marianne Swanson Pauline Bowen Amy Wohl Phillips Dean Gallup David Lynes

May 2010

<!-- image -->

U.S. Department of Commerce Gary Locke, Secretary

National Institute of Standards and Technology Patrick D. Gallagher, Director

Certain commercial entities, equipment, or materials may be identified in this document in order to describe an experimental procedure or concept adequately. Such identification is not intended to imply recommendation or endorsement by the National Institute of Standards and Technology, nor is it intended to imply that the entities, materials, or equipment are necessarily the best available for the purpose. There are references in this publication to documents currently under development by NIST in accordance with responsibilities assigned to NIST under the Federal Information Security Management Act of 2002. The methodologies in this document may be used even before the completion of such companion documents. Thus, until such time as each document is completed, current requirements, guidelines, and procedures (where they exist) remain operative. For planning and transition purposes, federal agencies may wish to closely follow the development of these new documents by NIST. Individuals are also encouraged to review the public draft documents and offer their comments to NIST. All NIST documents mentioned in this publication, other than the ones noted above, are available at http://csrc.nist.gov/publications. National Institute of Standards and Technology Special Publication 800-34 Natl. Inst. Stand. Technol. Spec. Publ.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Audit and Accountability?

[Assistant]
According to Control Baselines for Information Systems and Organizations:

| CHAPTERONE INTRODUCTION...................................................................................................... 1               | CHAPTERONE INTRODUCTION...................................................................................................... 1               | CHAPTERONE INTRODUCTION...................................................................................................... 1   |
|-----------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------|
| 1.1                                                                                | PURPOSEANDAPPLICABILITY ................................................................................................... | 1                                                                                |
| 1.2                                                                                | TARGET AUDIENCE .................................................................................................................. | 2                                                                                |
| 1.3                                                                                | ORGANIZATIONAL RESPONSIBILITIES .........................................................................................

Control Baselines for Information Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Access Control?

[Assistant]
According to Report on the Design-A-Thon_ Designing Effective and Accessible Approaches for Digital Product Cybersecurity Education and Awareness:

Cybersecurity education and awareness can provide critical support for the cybersecurity of digital products. Notably, the capability can inform and educate users about other cybersecurity capabilities, particularly technical capabilities. For example, cybersecurity education and awareness can guide users on creating strong access control credentials and permissions for products where such features are supported. Other information can be delivered using this capability as well, such as expectations for use of the product and other cybersecurity expectations, which can reduce the possibility of a risk being missed or otherwise unaddressed when the product is deployed.

Report on the Design-A-Thon_ Designing Effective and Accessible Approaches for Digital Product Cybersecurity Education and Awareness


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] How does Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171 support CMMC certification?

[Assistant]
According to Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171:

## NIST Special Publication 800-172

## Enhanced Security Requirements for Protecting Controlled Unclassified Information

A Supplement to NIST Special Publication 800-171

RON ROSS VICTORIA PILLITTERI GARY GUISSANIE RYAN WAGNER RICHARD GRAUBART

DEB BODEAU

This publication is available free of charge from:

https://doi.org/10.6028/NIST.SP.800-172

<!-- image -->

## NIST Special Publication 800-172

## Enhanced Security Requirements for Protecting Controlled Unclassified Information

A Supplement to NIST Special Publication 800-171

## RON ROSS VICTORIA PILLITTERI

Computer Security Division

National Institute of Standards and Technology

## GARY GUISSANIE RYAN WAGNER

Institute for Defense Analyses

RICHARD GRAUBART DEB BODEAU

The MITRE Corporation

This publication is available free of charge from:

https://doi.org/10.6028/NIST.SP.800-172

## February 2021

<!-- image -->

U.S. Department of Commerce Wynn Coggins, Acting Secretary

National Institute of Standards and Technology James K. Olthoff, Performing the Non-Exclusive Functions and Duties of the Under Secretary of Commerce for Standards and Technology & Director, National Institute of Standards and Technology

\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

## Authority

This publication has been developed by NIST to further its statutory responsibilities under the Federal Information Security Modernization Act (FISMA), 44 U.S.C. § 3551 et seq. , Public Law (P.L.) 113-283. NIST is responsible for developing information security standards and guidelines, including minimum requirements for federal information systems, but such standards and guidelines shall not apply to national security systems without the express approval of the appropriate federal officials exercising policy authority over such systems.

Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Identification and Authentication?

[Assistant]
According to Proceedings of the Cybersecurity in Cyber-Physical Systems Workshop, April 23-24, 2012:

Some of the threats to wireless IMDs include device reprogramming,  data  extraction,  data  tampering,  repeated  access attempts  and  data  flooding. Vulnerabilities  include  unsecured communication channels, inadequate authentication and access control,  weak  audit  mechanisms  and  meager  storage. The  resulting risks include patient safety compromise resulting from firmware malfunction or therapy misconfiguration, device unavailability due to battery power depletion, patient privacy loss due to data leakage to unauthorized parties, and inappropriate medical follow-up due to tampering of patient readings. While some cyber threats may be unintentional, various motivations exist  for  deliberate  cyber  attacks,  such  as  patient  information gathering, negative impact to patient health status, ego satisfaction of the attacker, as well as gaining competitive advantage over another vendor through negative press. ## C. Authentication and Access Control Mechanisms

For each type of data identified, the authentication and access control mechanisms applicable for extracting or updating the data type need to be reviewed to determine adequacy of the protection  mechanisms  while  balancing  the  needs  of  patient safety in emergency situations and the utility of the IMD within a patient's environment. This is a non-trivial exercise since the security and privacy requirements for IMDs frequently conflict with  the  requirements  stemming  from  emergency  access  to patient  data  and  device  utility  in  hospital  and  home  settings. Creative approaches may be devised to decouple data essential for patient safety in emergency conditions from patient personally identifiable information/data to allow different authentication and access control mechanisms to apply to each group of data.

Proceedings of the Cybersecurity in Cyber-Physical Systems Workshop, April 23-24, 2012


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What guidance does Security and Privacy Controls for Information Systems and Organizations provide?

[Assistant]
NIST Special Publication 800-53
Revision 5

Security and Privacy Controls for
Information Systems and Organizations

JOINT TASK FORCE

This publication is available free of charge from:
https://doi.org/10.6028/NIST.SP.800-53r5

NIST Special Publication 800-53
Revision 5

 Security and Privacy Controls for

Information Systems and Organizations

JOINT TASK FORCE

This publication is available free of charge from:
https://doi.org/10.6028/NIST.SP.800-53r5

September 2020
INCLUDES UPDATES AS OF 12-10-2020; SEE PAGE XVII

National Institute of Standards and Technology
      Walter Copan, NIST Director and Under Secretary of Commerce for Standards and Technology

U.S. Department of Commerce
Wilbur L. Ross, Jr., Secretary

T
h
s

i

p
u
b

l
i

c
a

t
i

o
n

i

s

a
v
a

i
l

l

a
b
e
f
r
e
e
o
f

c
h
a
r
g
e
f
r
o
m

:

h
t
t
p
s
:
/
/
d
o
i
. o
r
g
/
1
0
. 6
0
2
8
/
N
S
T
S
P
. 8
0
0
-
5
3
r
5

. I

NIST SP 800-53, REV. 5                                                                                SECURITY AND PRIVACY CONTROLS FOR INFORMATION SYSTEMS AND ORGANIZATIONS
_________________________________________________________________________________________________

Authority

This publication has been developed by NIST to further its statutory responsibilities under the
Federal Information Security Modernization Act (FISMA), 44 U.S.C. § 3551 et seq., Public Law
(P.L.) 113-283. NIST is responsible for developing information security standards and guidelines,
including minimum requirements for federal information systems. Such information security
standards and guidelines shall not apply to national security systems without the express
approval of the appropriate federal officials exercising policy authority over such systems. This
guideline is consistent with the requirements of the Office of Management and Budget (OMB)
Circular A-130.

Security and Privacy Controls for Information Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice CM.L2-3.4.3 (NIST 3.4.3)?

[Assistant]
According to Digital Identity Guidelines:

3.4.3. 3.4.3), or both. 3.4.3.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Approaches and Challenges of Federal Cybersecurity Awareness Programs provide? (Part 4)

[Assistant]
grams face a number of challenges, including lack of resources, difficulty measuring the impact of the program, and perceptions among the workforce that training is a boring, 'check-the-box' activity.
However, it is unclear if these challenges also apply to security awareness programs in the United States (U.S.) government. To better understand the needs, challenges, practices, and necessary competencies of federal security awareness teams and programs, we conducted a 'mixed methods' research study that leveraged both qualitative and quantitative methodologies. We first conducted eight focus groups of federal employees who had security awareness duties or were managers or executives who oversaw the programs within their organizations. The focus groups then informed an online survey completed by 96 federal employees with security awareness responsibilities. The research background and methodologies for these two phases are described in detail in NISTIR 8420 'Federal Cybersecurity Awareness Programs: A Mixed Methods Research Study.' This companion document reports on a subset of results focused on the approaches and challenges of federal security awareness programs. The following is a high-level overview of these results, with cited statistics from the survey. ## Required Annual Security Awareness Training

- Two-thirds of survey participants said they develop at least some required security awareness training content in-house, with 80% updating content at least once a year. Focus group participants expressed frustration that each organization had to acquire or create their own training. Instead, they desired standardized government training and guidance that allow customization for the unique needs of each organization. - Automation was viewed as essential for efficient tracking of employees' completion of training.

Approaches and Challenges of Federal Cybersecurity Awareness Programs


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AC.L2-3.1.4 (NIST 3.1.4)?

[Assistant]
According to Multi-Factor Authentication for Criminal Justice Information Systems_ Implementation Considerations for Protecting Criminal Justice Information:

3.1.4. 3.1.4. 3.1.4)
- When an agency is choosing its approach to MFA implementation, it should do the following (from Sec.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Protecting Controlled Unclassified Information (CUI)_ NIST Special Publication 800-171, Revision 3. Small Business Primer provide? (Part 6)

[Assistant]
ents in SP 800-171. If you have questions regarding requirements to protect CUI or other regulatory requirements, please contact your prime contractor and/or federal point of contact for the contract.
|
|----------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| How do I know if I have CUI? | It is the responsibility of the federal agency to ensure that requirements to protect CUI are identified in applicable contracts or agreements, and CUI is marked by the federal agency. |
| How do I get a 'NIST SP 800 -171 Assessment'? | The term 'NIST Assessment' and 'NIST SP 800 - 171 Assessment' is frequently used to describe the Department of Defense (DOD) proce ss used to complete its NIST SP 800-171 Assessment Module through the Supplier Performance Risk System (SPRS). NIST develops the underlying technical guidelines (SP 800-171, SP 800-171A, SP 800-172, and SP 800- 172A) on which the 'NIST Assessment' is based, but NIST does not have a role in DOD's implementation of its programs . For additional guidance on NIST's methodology to plan, prepare for, and conduct security requirement assessments, refer to SP 800-171A. |
| What products, vendors, or solutions are 'NIST SP 800 -171 compliant' or 'CMMC - certified'? | NIST does not identify or track implementation of or compliance with the security requirements.

Protecting Controlled Unclassified Information (CUI)_ NIST Special Publication 800-171, Revision 3. Small Business Primer


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Services Acquisition?

[Assistant]
According to Protecting Information and System Integrity in Industrial Control System Environments_ Cybersecurity for the Manufacturing Sector:

Collaborators participating in this project submitted their capabilities in response to an open call in the Federal Register for all sources of relevant security capabilities from academia and industry (vendors and integrators). Those respondents with relevant capabilities or product components signed a Cooperative Research and Development Agreement (CRADA) to collaborate with NIST in a consortium to build this example solution. The National Cybersecurity Center of Excellence (NCCoE), a part of the National Institute of Standards and Technology (NIST), is a collaborative hub where industry organizations, government agencies, and academic institutions work together to address businesses' most pressing cybersecurity issues. This public-private partnership enables the creation of practical cybersecurity solutions for specific industries, as well as for broad, cross-sector technology challenges. Through consortia under Cooperative Research and Development Agreements (CRADAs), including technology partners-from Fortune 50 market leaders to smaller companies specializing in information technology security-the NCCoE applies standards and best practices to develop modular, easily adaptable example cybersecurity solutions using commercially available technology. The NCCoE documents these example solutions in the NIST Special Publication 1800 series, which maps capabilities to the NIST Cybersecurity Framework (CSF) and details the steps needed for another entity to re-create the example solution. The NCCoE was established in 2012 by NIST in partnership with the State of Maryland and Montgomery County, Maryland. The Technology Partners/Collaborators who participated in this build submitted their capabilities in response to a notice in the Federal Register.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AC.L2-3.1.2 (NIST 3.1.2)?

[Assistant]
According to Audit and Evaluation of Computer Security II_ System Vulnerabilities and Controls:

3.1.2 Policies and Procedures in Functional Areas                                                     | 4-10      |
|      |                | Particular 3. 3.1.2 3. 3.1.2 System Extensibility                                                                                | 3.

Audit and Evaluation of Computer Security II_ System Vulnerabilities and Controls


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 2 require for Maintenance?

[Assistant]
According to Profile of the IoT Core Baseline for Consumer IoT Products:

Cybersecurity utility: The ability to identify IoT products and their components is necessary to support such activities as asset management for updates, data protection, and digital forensics capabilities for incident response. 1. Each IoT product component can receive, verify, and apply verified software updates. 2. The IoT product implements measures to keep software on IoT product components up to date (i.e., automatic application of updates or consistent customer notification of available updates via the IoT product). 1. Throughout the development lifecycle, the IoT product developer creates or gathers and stores information relevant to the cybersecurity of the IoT product and its product components, including :
- a. Assumptions made during the development process and other expectations related to the IoT product, including :
- i. Expected customers and use cases. - ii. Physical use and characteristics, including security of the location of the IoT product and its product components (e.g., a camera for use inside the home that has an off switch on the device vs. a security camera for use outside the home that does not have an off switch on the device). - iii. Network access and requirements (e.g., bandwidth requirements). - iv. Data created and handled by the IoT product. - v. Any expected data inputs and outputs (including error codes, frequency, type/form, range of acceptable values, etc.). - vi. The IoT product developer's assumed cybersecurity requirements for the IoT product. - vii. Any laws and regulations with which the IoT product and related support activities comply. - viii. Expected lifespan and anticipated cybersecurity costs related to the IoT product (e.g., price of maintenance) and length and terms of support. - b. All IoT components, including but not limited to the IoT device, that are part of the IoT product. - c.

Profile of the IoT Core Baseline for Consumer IoT Products


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Information Integrity?

[Assistant]
According to Guide for Developing Security Plans for Federal Information Systems:

ification of compensating controls; and (iii) the specification of agency-defined parameters in the security controls, where allowed. The system security plan should document all tailoring activities.
- -Security controls that uniquely support the confidentiality, integrity, or availability security objectives can be downgraded to the corresponding control in a lower baseline (or appropriately modified or eliminated if not defined in a lower baseline) if, and only if, the downgrading action: (i) is consistent with the FIPS 199 security categorization for the corresponding security objectives of confidentiality, integrity, or availability before moving to the high watermark; 14 (ii) is supported by an agency's assessment of risk; and (iii) does not affect the security-relevant information within the information system. 15

Guide for Developing Security Plans for Federal Information Systems


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What guidance does Zero Trust Architecture provide?

[Assistant]
## NIST Publicación especial 800-207

## Arquitectura de confianza cero

Scott Rose Oliver Borchert Stu Mitchell Sean Connelly

Esta publicación se encuentra disponible en inglés de forma gratuita en https://doi.org/10.6028/NIST.SP.800-207

## S  E  G  U  R  I  D  A  D    I  N  F  O  R  M  Á  T  I  C  A

## NIST

National Institute of Standards and Technologies U. S. Department of Commerce

## NIST Publicación especial 800-207

## Arquitectura de confianza cero

Scott Rose Oliver Borchert

División de Tecnologías Avanzadas de Red Laboratorio de Tecnologías de la Información

Stu Mitchell Stu2Labs Stafford, VA

Sean Connelly

Agencia de Ciberseguridad y Seguridad de las Infraestructuras Departamento de Seguridad Nacional

Esta publicación se encuentra disponible en inglés de forma gratuita en: https://doi.org/10.6028/NIST.SP.800-207

Traducción al español Dreamlab Technologies Chile Yanina Ángela Bettati (2023)

Traducido con permiso por cortesía del Instituto Nacional de Estándares y Tecnología (NIST). No es una traducción oficial del Gobierno de los Estados Unidos. Todos los derechos reservados. Secretaría de Comercio de EE. UU. Departamento de Comercio de EE. UU. Wilbur L. Ross, Jr., Secretario

Instituto Nacional de Normas y Tecnología Walter Copan, Director del NIST y Subsecretario de Comercio para Normas y Tecnología

## Autoridad

Esta publicación ha sido desarrollada por NIST de conformidad con sus responsabilidades estatutarias en virtud de la Ley Federal de Modernización de la Seguridad de la Información (FISMA) de 2014, 44 U.S.C. § 3551 y siguientes, Ley Pública (P.L.) 113-283. NIST es responsable de desarrollar normas y directrices de seguridad de la información, incluidos los requisitos mínimos para los sistemas de información federales, pero dichas normas y directrices no se aplicarán a los sistemas de seguridad nacional sin la aprobación expresa de los funcionarios federales apropiados que ejercen la autoridad política sobre dichos sistemas.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for System and Services Acquisition?

[Assistant]
According to Protecting Controlled Unclassified Information (CUI)_ NIST Special Publication 800-171, Revision 3. Small Business Primer:

ource code. | CUI//SP-CTI   |
| General Proprietary  | e.g., financial information, trade secrets, product research and development, existing and future product designs and performance specifications.
| CUI//PROPIN   |
| Business Information | you do not handle CUI, implementing the security requirements in SP 800-171 will                                                                                | help you take |

| Access Control                    | Maintenance         | Security Assessment and Monitoring   |
|-----------------------------------|---------------------|--------------------------------------|
| Awareness and Training            | Media Protection    | System and Communications Protection |
| Audit and Accountability          | Personnel Security  | System and Information Integrity     |
| Configuration Management          | Physical Protection | Planning                             |
| Identification and Authentication | Risk Assessment     | System and Services Acquisition      |
| Incident Response                 |                     | Supply Chain Risk Management         |


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Services Acquisition?

[Assistant]
According to Federal Cybersecurity Role-Based Training Approaches, Successes, and Challenges:

Most United States federal government organizations are required to conduct cybersecurity role-based training for federal government personnel and supporting contractors who are assigned roles having security and privacy responsibilities. Despite the training mandate, there has been little prior effort to look broadly across federal organizations to see how they are implementing these training activities and what issues they are experiencing. This lack of understanding may be hindering the development of improvements and resources for training activities. To address this gap, the Usable Cybersecurity team at the National Institute of Standards and Technology conducted a research study consisting of focus groups and a survey to gain insights into the approaches of and challenges faced by federal organizations when implementing role-based training activities. This paper reports the results of the study and suggests actions that organizations can take to improve federal role-based training activities. Despite the training mandate, there has been little prior effort to look broadly across federal organizations to see how they are implementing RBT activities and what issues they are experiencing. This lack of understanding may be hindering the development of improvements and resources for federal RBT activities. To address this gap, we - the Usable Cybersecurity team at the National Institute of Standards and Technology (NIST) conducted a research study to gain insights into the approaches of and challenges faced by organizations when implementing RBT activities. We conducted a prior study that explored federal security awareness programs through focus groups and a survey [IR8420][IR8420A] [IR8420B]. In the focus groups, we found that security awareness professionals were often also assigned responsibilities for role-based training activities, for which they identified significant challenges.

Federal Cybersecurity Role-Based Training Approaches, Successes, and Challenges


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Incident Response?

[Assistant]
According to Control Baselines for Information Systems and Organizations:

| CHAPTERONE INTRODUCTION...................................................................................................... 1               | CHAPTERONE INTRODUCTION...................................................................................................... 1               | CHAPTERONE INTRODUCTION...................................................................................................... 1   |
|-----------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------|
| 1.1                                                                                | PURPOSEANDAPPLICABILITY ................................................................................................... | 1                                                                                |
| 1.2                                                                                | TARGET AUDIENCE .................................................................................................................. | 2                                                                                |
| 1.3                                                                                | ORGANIZATIONAL RESPONSIBILITIES .........................................................................................


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What guidance does NIST provide for CMMC Level 1?

[Assistant]
According to IoT Non-Technical Supporting Capability Core Baseline:

## NISTIR 8259B

## IoT Non-Technical Supporting Capability Core Baseline

Michael Fagan Jeffrey Marron Kevin G. Brady, Jr. Barbara B. Cuthill Katerina N. Megas Rebecca Herold

This publication is available free of charge from:

https://doi.org/10.6028/NIST.IR.8259B

<!-- image -->

## NISTIR 8259B

## Internet of Things Non-Technical Supporting Capability Core Baseline

Michael Fagan Jeffrey Marron Kevin G. Brady, Jr. Barbara B. Cuthill Katerina N. Megas

Applied Cybersecurity Division Information Technology Laboratory

Rebecca Herold

The Privacy Professor

Des Moines, IA

This publication is available free of charge from: https://doi.org/10.6028/NIST.IR.8259B

August 2021

<!-- image -->

U.S. Department of Commerce Gina M. Raimondo, Secretary

National Institute of Standards and Technology James K. Olthoff, Performing the Non-Exclusive Functions and Duties of the Under Secretary of Commerce for Standards and Technology & Director, National Institute of Standards and Technology

## National Institute of Standards and Technology Interagency or Internal Report 8259B 21 pages (August 2021)

## This publication is available free of charge from: https://doi.org/10.6028/NIST.IR.8259B

Certain  commercial  entities,  equipment,  or  materials  may  be  identified  in  this  document  in  order  to  describe  an experimental  procedure  or  concept  adequately. Such  identification  is  not  intended  to  imply  recommendation  or endorsement by NIST, nor is it intended to imply that the entities, materials, or equipment are necessarily the best available for the purpose. There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may  be  used  by  federal  agencies  even  before  the  completion  of  such  companion  publications.

IoT Non-Technical Supporting Capability Core Baseline


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What are the CMMC Level 3 requirements?

[Assistant]
According to Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171:

## NIST Special Publication 800-172

## Enhanced Security Requirements for Protecting Controlled Unclassified Information

A Supplement to NIST Special Publication 800-171

RON ROSS VICTORIA PILLITTERI GARY GUISSANIE RYAN WAGNER RICHARD GRAUBART

DEB BODEAU

This publication is available free of charge from:

https://doi.org/10.6028/NIST.SP.800-172

<!-- image -->

## NIST Special Publication 800-172

## Enhanced Security Requirements for Protecting Controlled Unclassified Information

A Supplement to NIST Special Publication 800-171

## RON ROSS VICTORIA PILLITTERI

Computer Security Division

National Institute of Standards and Technology

## GARY GUISSANIE RYAN WAGNER

Institute for Defense Analyses

RICHARD GRAUBART DEB BODEAU

The MITRE Corporation

This publication is available free of charge from:

https://doi.org/10.6028/NIST.SP.800-172

## February 2021

<!-- image -->

U.S. Department of Commerce Wynn Coggins, Acting Secretary

National Institute of Standards and Technology James K. Olthoff, Performing the Non-Exclusive Functions and Duties of the Under Secretary of Commerce for Standards and Technology & Director, National Institute of Standards and Technology

\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

## Authority

This publication has been developed by NIST to further its statutory responsibilities under the Federal Information Security Modernization Act (FISMA), 44 U.S.C. § 3551 et seq. , Public Law (P.L.) 113-283. NIST is responsible for developing information security standards and guidelines, including minimum requirements for federal information systems, but such standards and guidelines shall not apply to national security systems without the express approval of the appropriate federal officials exercising policy authority over such systems.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AU.L2-3.3.1 (NIST 3.3.1)?

[Assistant]
According to Recommendation for Pair-Wise Key-Establishment Schemes Using Discrete Logarithm Cryptography:

3.3.1 C(0e, 2s) Scheme with Unilateral Key Confirmation Provided by Party             |
|                                                                                | 6. 3.3.1 C(0e, 2s) Scheme with Unilateral Key Confirmation Provided by Party U to Party V

Figure\_15 depicts a typical flow for a C(0e, 2s) scheme with unilateral key confirmation from party U to party V. 3.3.1.

Recommendation for Pair-Wise Key-Establishment Schemes Using Discrete Logarithm Cryptography


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Security Assessment?

[Assistant]
According to Recommendation for Pair-Wise Key-Establishment Schemes Using Discrete Logarithm Cryptography:

| 5.6.1.2.2 Key Pair Generation by Testing Candidates........................
|   31 |
| 5.6.2 Required Assurances.......................................................................................... | 5.6.2 Required Assurances.......................................................................................... |   32 |
| 5.6.2.1                                                                                | Assurances Required by the Key Pair Owner..................................... |   33 |
|                                                                                | 5.6.2.1.1 Owner Assurance of Correct Generation............................. |   35 |
|                                                                                | 5.6.2.1.2 Owner Assurance of Private-Key Validity .......................... |   35 |
|                                                                                | 5.6.2.1.3 Owner Assurance of Public-Key Validity ........................... |   36 |
|                                                                                | 5.6.2.1.4 Owner Assurance of Pair-wise Consistency........................ |   36 |
|                                                                                | 5.6.2.1.5 Owner Assurance of Possession of the Private Key............ |   37 |
| 5.6.2.2                                                                                | Assurances Required by a Public Key Recipient................................


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice PL.L2-3.15.1 (NIST 3.15.1)?

[Assistant]
According to Digital Identity Guidelines_ Identity Proofing and Enrollment:

3.15.1. 3.15.1. 3.15.1.

Digital Identity Guidelines_ Identity Proofing and Enrollment


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Incident Response?

[Assistant]
According to Guidelines for Media Sanitization:

| Executive Summary............................................................................................................................1      |
|-----------------------------------------------------------------------------------------------------------------------------------------------------|
| 1. Introduction...................................................................................................................................2 |
| 2. Background....................................................................................................................................5  |
| 3. Summary of Sanitization Methods..................................................................................................8               |
| 3.1.1. Clear Sanitization Method............................................................................................................8       |
| 3.1.2. Purge Sanitization Method.........................................................................................................10         |
| 3.1.3. Destroy Sanitization Method......................................................................................................11          |
| 3.2.1. Strength of Cryptography for CE ................................................................................................12           |
| 3.2.2. Applicability of CE.......................................................................................................................13 |
| 3.2.3. Sanitization of Keys ....................................................................................................................13  |
| 3.2.4. Quality of Cryptographic Implementations................................................................................15                   |
| 3.2.5.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What guidance does Analyzing Collusion Threats in the Semiconductor Supply Chain provide?

[Assistant]
## NIST Cybersecurity White Paper NIST CSWP 46

## Analyzing Collusion Threats in the Semiconductor Supply Chain

Sanjay (Jay) Rekhi Kostas Amberiadis Computer Security Information Technology Laboratory

Abir Ahsan Akib Ankur Srivastava Electrical and Computer Engineering University of Maryland, College Park

This publication is available free of charge from:

https://doi.org/10.6028/NIST.CSWP.46

June 30, 2025

<!-- image -->

<!-- image -->

Certain equipment, instruments, software, or materials, commercial or non-commercial, are identified in this paper in order to specify the experimental procedure adequately. Such identification does not imply recommendation or endorsement of any product or service by NIST, nor does it imply that the materials or equipment identified are necessarily the best available for the purpose. ## NIST Technical Series Policies

Copyright, Use, and Licensing Statements

NIST Technical Series Publication Identifier Syntax

## Publication History

Approved by the NIST Editorial Review Board on 2025-01-30

## How to Cite this NIST Technical Series Publication:

Rekhi S, Amberiadis K, Akib AA, Srivastava A (2025) Analyzing Collusion Threats in the Semiconductor Supply Chain. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Cybersecurity White Paper (CSWP) NIST CSWP 46. https://doi.org/10.6028/NIST.CSWP.46

## Author ORCID iDs

Sanjay (Jay) Rekhi: 0009-0008-8711-4030

Kostas Amberiadis: 0009-0000-7771-5002

Abir Ahsan Akib: 0000-0002-1455-6662

Ankur Srivastava: 0000-0002-5445-904X

## Contact Information

hwsec@nist.gov

National Institute of Standards and Technology Attn: Computer Security Division, Information Technology Laboratory 100 Bureau Drive (Mail Stop 8930) Gaithersburg, MD 20899-8930

## Additional Information

Additional information about this publication is available at https://csrc.nist.gov/publications/cswp, including related content, potential updates, and document history.

Analyzing Collusion Threats in the Semiconductor Supply Chain


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Risk Assessment?

[Assistant]
According to Summary of NIST SP 800-53, Revision 4_ Security and Privacy Controls for Federal Information Systems and Organizations:

SP 800-53 Revision 4 has been updated to reflect the evolving technology and threat space. Example areas include issues particular to mobile and cloud computing; insider threats; applications security; supply chain risks; advanced persistent threat; and trustworthiness, assurance, and resilience of information systems. The revision also contains a new appendix of privacy controls, and related implementation guidance (Appendix J), based on the Fair Information Practice Principles (FIPPs), a widely accepted framework of defining principles to be used in the evaluation and consideration of systems, processes, or programs that affect individual privacy. The security control baselines address the security needs of a broad and diverse set of constituencies, and are developed based on a number of general assumptions, including common environmental, operational, and functional considerations. The baselines also assume typical threats facing common information systems. Articulating the underlying assumptions is a key element in the initial risk framing step of the risk management process described in NIST SP 800-39. To ensure that an appropriate set of controls is identified to provide security commensurate with risk, organizations tailor the controls to align with specific security needs. Organizations may perform tailoring at the organization level for all information systems, in support of a particular line of business or mission/business process, at the individual information system level, or by using a combination of the above. The tailoring process is comprised of several steps, as described in SP 800-53 Rev. 4 Section 3.2. These actions include:

- Identifying and designating common controls - controls that may be inherited by one or more information systems. If an information system inherits a common control, such as environmental controls within a data center, that system does not need to explicitly implement that control.

Summary of NIST SP 800-53, Revision 4_ Security and Privacy Controls for Federal Information Systems and Organizations