[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Physical Protection?

[Assistant]
According to Guide for Developing Security Plans for Federal Information Systems:

ance that the shared resources, i.e., networks, communications, and physical access within the whole general support system or major application, are protected adequately for the highest impact level.
Having the ability to isolate the high impact systems will not only result in more secure systems, but will also reduce the amount of resources required to secure many applications/systems that do not require that level of security. NIST SP 800-53 provides three security control baselines, i.e., low, moderate, and high, that are associated with the three FIPS 199 impact levels; as the impact level increases, so do the minimum assurance requirements. For reporting purposes, i.e., FISMA annual report, when an information system has varying FIPS 199 impact levels, that system is categorized at the highest impact level on that information system.

Guide for Developing Security Plans for Federal Information Systems


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AT.L2-3.2.3 (NIST 3.2.3)?

[Assistant]
According to Contingency Planning Guide for Federal Information Systems:

3.2.3                                                                                | Identify System Resource Recovery Priorities ... 3.2.3 Identify System Resource Recovery Priorities

Developing recovery priorities is the last step of the BIA process.

Contingency Planning Guide for Federal Information Systems


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Guide to a Secure Enterprise Network Landscape provide? (Part 4)

[Assistant]
NA]), and the evolving wide area network (WAN) infrastructure to provide a comprehensive set of security services for the modern enterprise network landscape (e.g., secure access service edge [SASE]).
## Keywords

cloud access security broker (CASB); firewall; microsegmentation; secure access service edge (SASE); secure web gateway (SWG); security orchestration, automation, and response (SOAR); software-defined perimeter (SDP); software-defined wide area network (SD-WAN); virtual private network (VPN); zero trust network access (ZTNA). ## Reports on Computer Systems Technology

The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the Nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology. ITL's responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in federal information systems. The Special Publication 800-series reports on ITL's research, guidelines, and outreach efforts in information system security, and its collaborative activities with industry, government, and academic organizations. ## Patent Disclosure Notice

NOTICE: ITL has requested that holders of patent claims whose use may be required for compliance with the guidance or requirements of this publication disclose such patent claims to ITL. However, holders of patents are not obligated to respond to ITL calls for patents and ITL has not undertaken a patent search in order to identify which, if any, patents may apply to this publication.

Guide to a Secure Enterprise Network Landscape

Audit and Accountability
System and Information Integrity
Security Assessment
Media Protection
Identification and Authentication
Awareness and Training
System and Communications Protection
Access Control
Planning
Incident Response
Risk Assessment
Personnel Security
System and Services Acquisition
Supply Chain Risk Management
Maintenance
Physical Protection
Configuration Management


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Incident Response?

[Assistant]
According to NIST Cybersecurity Framework 2.0_ Quick-Start Guide for Cybersecurity Supply Chain Risk Management (C-SCRM):

- Incident Management: Incidents are escalated or elevated as needed [RS.MA-04]
- Incident Response Reporting and Communication: Internal and external stakeholders are notified of incidents [RS.CO-02]

NIST Cybersecurity Framework 2.0_ Quick-Start Guide for Cybersecurity Supply Chain Risk Management (C-SCRM)


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Access Control?

[Assistant]
According to Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations:

| 1. Introduction.....................................................................................................................................1   |
|---------------------------------------------------------------------------------------------------------------------------------------------------------|
| 1.4.1. Enterprise Risk Management and C-SCRM Owners and Operators.............................................5                                         |
| 1.4.2. Enterprise, Agency, and Mission and Business Process Owners and Operators .........................5                                             |
| 1.4.3. Acquisition and Procurement Owners and Operators.................................................................6                               |
| 1.4.4. Information Security, Privacy, or Cybersecurity Operators .........................................................6                             |
| 1.4.5. System Development, System Engineering, and System Implementation Personnel.................7                                                    |
| 1.5.1. Enterprise's Supply Chain.............................................................................................................9          |
| 1.5.2. Supplier Relationships Within Enterprises .................................................................................10                    |
| 2. Integration of C-SCRM Into Enterprise-Wide Risk Management...................................................... 18                                  |
| 2.3.1. Roles and Responsibilities Across the Three Levels ...................................................................24                         |
| 2.3.2. Level 1 -Enterprise...................................................................................................................27         |
| 2.3.3.

Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Assessing Security Requirements for Controlled Unclassified Information provide? (Part 10)

[Assistant]
Parameters
- Appendix E: Change Log

The contents of this publication can be used for many different assessment-related purposes to determine organizational compliance with the security requirements.
The broad range of potential  assessment methods and objects listed in this publication does not necessarily reflect  and  should  not  be  directly  associated  with  actual  compliance  or  noncompliance. Rather, the selection of specific assessment methods and objects from the list provided can help generate a picture of overall compliance with the security requirements. There is no expectation about the number of methods or objects needed to determine compliance with the security requirements. Moreover, the entire list of potential assessment objects should not be viewed as required artifacts needed to determine compliance. Organizations have the flexibility to determine the specific methods and objects sufficient to obtain the needed evidence to support any claims of compliance. ## 2. The Fundamentals

The process used by organizations and assessors to assess the security requirements in SP 800171 [3] includes (1) preparing for the assessment, (2) developing a security assessment plan, (3) conducting the assessment, and (4) documenting, analyzing, and reporting the assessment results. 2 The remainder of this section describes the structure and content of the procedures used to assess the security requirements and the importance of assurance cases in providing the evidence necessary to determine compliance with the requirements. ## 2.1. Assessment Procedures

The security requirements in SP 800-171 are organized into 17 families, as illustrated in Table 1. The assessment procedures in Sec. 3 are grouped by similar family designations to ensure the completeness and consistency of assessments. The procedures have been derived from the assessment procedures in SP 800-53A [5]. Table 1.

Assessing Security Requirements for Controlled Unclassified Information


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What guidance does Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171 provide?

[Assistant]
## NIST Special Publication 800-172

## Enhanced Security Requirements for Protecting Controlled Unclassified Information

A Supplement to NIST Special Publication 800-171

RON ROSS VICTORIA PILLITTERI GARY GUISSANIE RYAN WAGNER RICHARD GRAUBART

DEB BODEAU

This publication is available free of charge from:

https://doi.org/10.6028/NIST.SP.800-172

<!-- image -->

## NIST Special Publication 800-172

## Enhanced Security Requirements for Protecting Controlled Unclassified Information

A Supplement to NIST Special Publication 800-171

## RON ROSS VICTORIA PILLITTERI

Computer Security Division

National Institute of Standards and Technology

## GARY GUISSANIE RYAN WAGNER

Institute for Defense Analyses

RICHARD GRAUBART DEB BODEAU

The MITRE Corporation

This publication is available free of charge from:

https://doi.org/10.6028/NIST.SP.800-172

## February 2021

<!-- image -->

U.S. Department of Commerce Wynn Coggins, Acting Secretary

National Institute of Standards and Technology James K. Olthoff, Performing the Non-Exclusive Functions and Duties of the Under Secretary of Commerce for Standards and Technology & Director, National Institute of Standards and Technology

\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

## Authority

This publication has been developed by NIST to further its statutory responsibilities under the Federal Information Security Modernization Act (FISMA), 44 U.S.C. § 3551 et seq. , Public Law (P.L.) 113-283. NIST is responsible for developing information security standards and guidelines, including minimum requirements for federal information systems, but such standards and guidelines shall not apply to national security systems without the express approval of the appropriate federal officials exercising policy authority over such systems.

Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Awareness and Training?

[Assistant]
According to High-Performance Computing Security_ Architecture, Threat Analysis, and Security Posture:

| 1. Introduction...................................................................................................................................1     |
|---------------------------------------------------------------------------------------------------------------------------------------------------------|
| 2. HPC System Reference Architecture and Main Components ............................................................2                                  |
| 2.1.1. Components of the High-Performance Computing Zone.............................................................3                                  |
| 2.1.2. Components of the Data Storage Zone........................................................................................4                     |
| 2.1.3. Parallel File System.......................................................................................................................4     |
| 2.1.4. Archival and Campaign Storage....................................................................................................5               |
| 2.1.5. Burst Buffer ..................................................................................................................................5 |
| 2.1.6. Components of the Access Zone..................................................................................................6                 |
| 2.1.7. Components of the Management Zone.......................................................................................6                        |
| 2.1.8. General Architecture and Characteristics ....................................................................................6                   |
| 2.1.9. Basic Services................................................................................................................................7  |
| 2.1.10.

High-Performance Computing Security_ Architecture, Threat Analysis, and Security Posture


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What guidance does Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule_ A Cybersecurity Resource Guide provide?

[Assistant]
<!-- image -->

## NIST Special Publication 800 NIST SP 800-66r2

## Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule

A Cybersecurity Resource Guide

Jeffrey A. Marron

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-66r2

<!-- image -->

## NIST Special Publication 800 NIST SP 800-66r2

## Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule

A Cybersecurity Resource Guide

Jeffrey A. Marron Applied Cybersecurity Division Information Technology Laboratory

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-66r2

February 2024

<!-- image -->

U.S. Department of Commerce Gina M. Raimondo, Secretary

National Institute of Standards and Technology

Certain commercial equipment, instruments, software, or materials, commercial or non-commercial, are identified in this paper in order to specify the experimental procedure adequately. Such identification does not imply recommendation or endorsement of any product or service by NIST, nor does it imply that the materials or equipment identified are necessarily the best available for the purpose. There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may be used by federal agencies even before the completion of such companion publications. Thus, until each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning and transition purposes, federal agencies may wish to closely follow the development of these new publications by NIST. Organizations are encouraged to review all draft publications during public comment periods and provide feedback to NIST.

Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule_ A Cybersecurity Resource Guide


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What guidance does NIST Cybersecurity Framework 2.0_ Quick-Start Guide for Cybersecurity Supply Chain Risk Management (C-SCRM) provide?

[Assistant]
<!-- image -->

<!-- image -->

## NIST Cybersecurity Framework 2.0:

Quick-Start Guide for Cybersecurity Supply Chain Risk Management (C-SCRM)

<!-- image -->

Laurie E. Locascio, NIST Director and Under Secretary of Commerce for Standards and

NIST Special Publication NIST SP 1305

https://doi.org/10.6028/NIST.SP.1305 Please send your comments to cyberframework@nist.gov. ## NIST CSF 2.0: CYBERSECURITY SUPPLY CHAIN RISK MANAGEMENT (C-SCRM)

A QUICK-START GUIDE

## INTRODUCTION TO C-SCRM

## Use the CSF to Improve Your C-SCRM Processes

The CSF can help an organization become a smart acquirer and supplier of technology products and services. This guide focuses on two ways the CSF can help you:

1. Use the CSF's GV.SC Category to establish and operate a C-SCRM capability. 2. Define and communicate supplier requirements using the CSF . ## What is the supply chain ecosystem? The supply chain ecosystem is composed of public and private sector entities - including acquirers, suppliers, developers, system integrators, external system service providers, and other technology-related service providers - that interact to research, develop, design, manufacture, acquire, deliver, integrate, operate, maintain, dispose of, and otherwise utilize or manage technology products and services. Consider a laptop with hardware subcomponents (like the graphics processor, random-access memory, or network interface card) sourced from different countries and third-party manufacturers, and subject to distinct supply chain interactions. That laptop also contains software (and firmware) developed by different companies and people. How do we manage risk for complex ICT devices with multiple components? In today's interconnected world, the supply chain ecosystem includes other third parties such as business partners and various data and digital service providers. Practices in this QSG can be applied to manage cybersecurity risks from such relationships as well.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Access Control?

[Assistant]
According to Summary of NIST SP 800-53, Revision 4_ Security and Privacy Controls for Federal Information Systems and Organizations:

The resulting tailored baseline set of security controls and the supporting rationale for the selection decisions (including any information system use restrictions required by organizations) are documented in system security plans. Documenting significant risk management decisions in the security control selection process is imperative so that authorizing officials have access to necessary information to make informed authorization decisions for organizational information systems, as demonstrated in Figure 3.

Summary of NIST SP 800-53, Revision 4_ Security and Privacy Controls for Federal Information Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Configuration Management?

[Assistant]
According to High-Performance Computing Security_ Architecture, Threat Analysis, and Security Posture:

.............6                   |
| 2.1.9. Basic Services................................................................................................................................7  |
| 2.1.10.
Configuration Management.......................................................................................................7                |
| 2.1.11. HPC Scheduler and Workflow Management..............................................................................7                            |
| 2.1.12. HPC Software..............................................................................................................................8     |
| 2.1.13. User Software.............................................................................................................................8     |
| 2.1.14. Site-Provided Software and Vendor Software ...........................................................................8                         |
| 2.1.15. Containerized Software in HPC ..................................................................................................9               |
| 3. HPC Threat Analysis......................................................................................................................10          |
| 3.2.1. Access Zone Threats...................................................................................................................11         |
| 3.2.2. Management Zone Threats........................................................................................................11                |
| 3.2.3. High-Performance Computing Zone Threats..............................................................................12                          |
| 3.2.4. Data Storage Zone Threats.........................................................................................................12             |
| 4.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Security Assessment?

[Assistant]
According to Summary of NIST SP 800-53, Revision 4_ Security and Privacy Controls for Federal Information Systems and Organizations:

SP 800-53 Revision 4 has been updated to reflect the evolving technology and threat space. Example areas include issues particular to mobile and cloud computing; insider threats; applications security; supply chain risks; advanced persistent threat; and trustworthiness, assurance, and resilience of information systems. The revision also contains a new appendix of privacy controls, and related implementation guidance (Appendix J), based on the Fair Information Practice Principles (FIPPs), a widely accepted framework of defining principles to be used in the evaluation and consideration of systems, processes, or programs that affect individual privacy. Many organizations use well-known international information security standards as the basis or as a supplemental source of security controls for risk management. To aid in selection and comparison, SP 800-53 Rev. 4 provides mapping tables to provide organizations with a general indication of security control coverage with respect to ISO/IEC 27001, Information technologySecurity techniques-Information security management systems-Requirements and ISO/IEC 15408, Information technology -- Security techniques -- Evaluation criteria for IT security . ISO/IEC 27001 applies to all types of organizations and specifies requirements for establishing, implementing, operating, monitoring, reviewing, maintaining, and improving a documented information security management system (ISMS) within the context of business risks. ISO/IEC 15408 (also known as the Common Criteria) provides functionality and assurance requirements for developers of information systems and information system components (i.e., information technology products).


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for System and Information Integrity?

[Assistant]
According to Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171:

This publication is a supplement to NIST Special Publication 800-171 [SP 800-171]. It contains recommendations  for  enhanced  security  requirements  to  provide  additional  protection  for Controlled Unclassified Information (CUI) in nonfederal systems and organizations when such information is  associated  with critical  programs  or  high  value  assets. The  enhanced  security requirements are designed to respond to the advanced persistent threat (APT) and supplement the basic and derived security requirements in [SP 800-171]. While the security requirements in [SP 800-171] focus primarily on confidentiality protection, the enhanced security requirements in this publication address confidentiality, integrity, and availability protection. The enhanced security requirements are implemented in addition to the basic and derived requirements since those requirements are not designed to address the APT. The enhanced security requirements apply to those components of nonfederal systems that process, store, or transmit CUI or that provide protection for such components. In addition to protecting CUI from unauthorized disclosure, the enhanced security requirements have been designed to protect the integrity and availability of CUI. This is achieved by promoting penetration-resistant architectures, damage-limiting operations, and designs to help achieve cyber resiliency and survivability. | CHAPTERONE INTRODUCTION...................................................................................................... | CHAPTERONE INTRODUCTION......................................................................................................


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Protecting Controlled Unclassified Information (CUI)_ NIST Special Publication 800-171, Revision 3. Small Business Primer provide? (Part 7)

[Assistant]
171A. |
| What products, vendors, or solutions are 'NIST SP 800 -171 compliant' or 'CMMC - certified'? | NIST does not identify or track implementation of or compliance with the security requirements.
|
| What is the relationship between NIST and CMMC? | The Cybersecurity Maturity Model Certification (CMMC) is a DOD program that references the security requirements in NIST SP 800-171 and SP 800-172. NIST is not involved in the design, development, or implementation of the CMMCmodel, accreditation body, or certification process. It is important to note that CMMCis currently based on SP 800-171, Revision 2. Contractors should check for specific requirements in their contracts to understand which version they are required to use. |

<!-- image -->

View more FAQs here. If you still have a question after reviewing all our FAQs , send your question to: sec-cert@nist.gov. ht ps:/

csrc.nist.gov/projects/protecting-control ed-unclas ified-information

<!-- image -->

<!-- image -->

## Additional Resources

## Online Introductory Courses Available for the NIST SP 800-53 Series

<!-- image -->

SP 800-171 requirements are focused on protecting confidentiality and are based on a subset of controls found in SP 800-53, which is a catalog of security and privacy controls for systems and organizations. With that in mind, it is important to have a basic understanding of the SP 800-53 series. To assist, NIST has released three self-guided online introductory courses to provide a high-level overview of foundational security and privacy risk management concepts. The online introductory courses are between 45-60 minutes, are available at no cost, and registration is not required. Access the courses. ## Roles of Different Federal Agencies

- The National Archives and Records Administration (NARA) , per 32 CFR Part 2002 "Controlled Unclassified Information," determines what CUI is and lists CUI types at archives.gov/cui.

Protecting Controlled Unclassified Information (CUI)_ NIST Special Publication 800-171, Revision 3. Small Business Primer


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Information Integrity?

[Assistant]
According to Risk Management Framework for Information Systems and Organizations_ A System Life Cycle Approach for Security and Privacy:

reover, adversaries are using the supply chain as an attack vector and effective means of penetrating our systems, compromising the integrity of system elements, and gaining access to critical assets.
- To provide closer linkage and communication between the risk management processes and activities at the C-suite or governance level of the organization and the individuals, processes, and activities at the system and operational level of the organization;
- To institutionalize critical risk management preparatory activities at all risk management levels to facilitate a more effective, efficient, and cost-effective execution of the RMF;
- To demonstrate how the NIST Cybersecurity Framework [NIST CSF] can be aligned with the RMF and implemented using established NIST risk management processes;
- To integrate privacy risk management processes into the RMF to better support the privacy protection needs for which privacy programs are responsible;
- To promote the development of trustworthy secure software and systems by aligning life cycle-based systems engineering processes in NIST Special Publication 800-160, Volume 1 [SP 800-160 v1], with the relevant tasks in the RMF;
- To integrate security-related, supply chain risk management (SCRM) concepts into the RMF to address untrustworthy suppliers, insertion of counterfeits, tampering, unauthorized production, theft, insertion of malicious code, and poor manufacturing and development practices throughout the SDLC; and
- To allow for an organization-generated control selection approach to complement the traditional baseline control selection approach and support the use of the consolidated control catalog in NIST Special Publication 800-53, Revision 5.

Risk Management Framework for Information Systems and Organizations_ A System Life Cycle Approach for Security and Privacy


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for Awareness and Training?

[Assistant]
According to Assessing Enhanced Security Requirements for Controlled Unclassified Information:

| CHAPTERONE INTRODUCTION...................................................................................................... | CHAPTERONE INTRODUCTION...................................................................................................... | 1   |
|-----------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------|-----|
| 1.1                                                                                | PURPOSEANDAPPLICABILITY............................................................................................................. 1        | 2   |
| 1.2                                                                                | TARGET AUDIENCE.............................................................................................................................. |     |
| 1.3                                                                                | ORGANIZATIONOF THIS SPECIAL PUBLICATION................................................................................. | 2   |
| CHAPTERTWO THE FUNDAMENTALS............................................................................................ | CHAPTERTWO THE FUNDAMENTALS............................................................................................ | 3   |
| 2.1                                                                                | ASSESSMENT PROCEDURES................................................................................................................

Assessing Enhanced Security Requirements for Controlled Unclassified Information


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for Maintenance?

[Assistant]
According to Protecting Controlled Unclassified Information (CUI)_ NIST Special Publication 800-171, Revision 3. Small Business Primer:

| Access Control                    | Maintenance         | Security Assessment and Monitoring   |
|-----------------------------------|---------------------|--------------------------------------|
| Awareness and Training            | Media Protection    | System and Communications Protection |
| Audit and Accountability          | Personnel Security  | System and Information Integrity     |
| Configuration Management          | Physical Protection | Planning                             |
| Identification and Authentication | Risk Assessment     | System and Services Acquisition      |
| Incident Response                 |                     | Supply Chain Risk Management         |

## Updates to the Security Requirements and Families

- It is important to identify permitted and prohibited actions regarding software installation when users have the ability to install software on organizational systems. Permitted software installations could include updates and security patches to existing software and downloading new applications from organizationapproved 'app stores.' Companies might prohibit employees from downloading certain programs, services, software versions, etc .


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Media Protection?

[Assistant]
According to Data Integrity_ Detecting and Responding to Ransomware and Other Destructive Events:

Instead, to achieve the goal of routing email through Glasswall, we redirect local mail exchange (MX) records to Glasswall FileTrust. We implemented it this way because of limitations of the lab environment, but organizations should consult with the vendor for the best solution to route email through the email sanitization component, as other options may be available depending on the enterprise.

Data Integrity_ Detecting and Responding to Ransomware and Other Destructive Events


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Incident Response?

[Assistant]
According to Federal Cybersecurity Awareness Programs_ A Mixed Methods Research Study:

□ Malware, including viruses, ransomware, etc.

□ Cybersecurity incident response

Federal Cybersecurity Awareness Programs_ A Mixed Methods Research Study


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Access Control?

[Assistant]
According to Proceedings of the Cybersecurity in Cyber-Physical Systems Workshop, April 23-24, 2012:

sential for patient safety in emergency conditions from patient personally identifiable information/data to allow different authentication and access control mechanisms to apply to each group of data.
Alternately,  identifying  different  modes  of  operation (such  as  home  health  setting  versus  open  environment  versus emergency situation) to allow the IMD to apply different authentication and access control mechanisms in different modes.

Proceedings of the Cybersecurity in Cyber-Physical Systems Workshop, April 23-24, 2012


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 1 require for Configuration Management?

[Assistant]
According to Summary Report for “Workshop on Updating Manufacturer Guidance for Securable Connected Product Development”:

cybersecurity baseline; Internet of Things (IoT); IoT products; manufacturing; privacy; risk management; securable products; security requirements; software development; threat modelling. Over time, the NIST volume of work has built upon the concepts introduced in the NIST IR 8259 series to introduce technical, IoT Device Cybersecurity Capability Core Baseline (NIST IR 8259A) and nontechnical, IoT Non-Technical Supporting Capability Core Baseline (NIST IR 8259B) concepts to help manufacturers and customers consider the cybersecurity of IoT devices. The NIST IR 8259 series has been used to inform and develop subsequent publications that elaborate on IoT cybersecurity across sectors and use cases (e.g., federal agency uses cases reflected in IoT Device Cybersecurity Guidance for the Federal Government: Establishing IoT Device Cybersecurity Requirements (NIST SP 800-213) and consumer use cases reflected in Profile of the IoT Core Baseline for Consumer IoT Products (NIST IR 8425) and the U.S. Cyber Trust Mark). Privacy is a complex and evolving concept that safeguards important values like human autonomy and dignity. It reflects various factors and individual preferences and is highly context-specific, differing between public and private activities. Effective privacy risk management must consider these contexts and the various ways to achieve privacy, such as seclusion, limiting observation, and controlling facets of identity. Gilbert emphasized that privacy could drive innovation and serve as a market differentiator. However, organizations need to have honest and risk-informed discussions about how best to balance optimizing data utility while protecting individuals' privacy, particularly in cases where privacy risk interacts with other risk domains such as cybersecurity. The NIST Privacy Framework helps organizations understand the relationship between privacy and cybersecurity risks in the context of the Internet of Things (IoT).

Summary Report for “Workshop on Updating Manufacturer Guidance for Securable Connected Product Development”


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AT.L2-3.2.4 (NIST 3.2.4)?

[Assistant]
According to Validating the Integrity of Computing Devices:

3.2.4. 3.2.4 Create an Authorized Service Token

1.

Validating the Integrity of Computing Devices


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Personnel Security?

[Assistant]
According to Strategies for the Integration of Software Supply Chain Security in DevSecOps CI_CD Pipelines:

- External attackers who seek privileged access to an SSC
- Disgruntled employees or contractors who perpetuate insider threats

applications. This paradigm consists of a series of stages that takes code from variously sourced In this document, the term 'artifacts' denotes source code as well as the things generated from it, such as builds and packages. Each of the artifacts is associated with an owner. The logical containers that hold these artifacts are called repositories. The build process is based on application logic-driven dependencies and generates builds using many individual source-code artifacts that are stored in build repositories. The build artifacts are tested and used to generate packages whose artifacts are then stored in designated repositories and scanned before being deployed in testing or production environments. These stages and the various tasks performed at each stage are collectively called CI/CD pipelines. In other words, CI/CD pipelines use processes called workflows to transform source artifacts to deployable packages in production environments. A common approach to SSC security in all of these workflows is to generate as much provenance data as possible. Provenance data are associated with the chronology of the origin, development, ownership, location, and changes to a system or system component, including the personnel and processes that enabled those changes or modifications. The generation of these data should be accompanied by corresponding mechanisms to validate, authenticate, and leverage them in policy decisions. From the above description of CI/CD pipelines and associated activities, one can identify the set of security assurance measures that need to be added:

- SAST and DAST tools (covering all languages used in development) should be run in CI/CD pipelines with code coverage reports being provided to developers and security personnel.

Strategies for the Integration of Software Supply Chain Security in DevSecOps CI_CD Pipelines


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What guidance does NIST provide for CMMC Level 2?

[Assistant]
According to Profile of the IoT Core Baseline for Consumer IoT Products:

<!-- image -->

## NIST Internal Report NIST IR 8425

## Profile of the IoT Core Baseline for Consumer IoT Products

Michael Fagan Katerina Megas Paul Watrobski Jeffery Marron Barbara Cuthill

This publication is available free of charge from: https://doi.org/10.6028/NIST.IR.8425

<!-- image -->

## NIST Internal Report NIST IR 8425

## Profile of the IoT Core Baseline for Consumer IoT Products

Michael Fagan Katerina N. Megas Paul Watrobski Jeffrey Marron Barbara B. Cuthill

Applied Cybersecurity Division Information Technology Laboratory

This publication is available free of charge from: https://doi.org/10.6028/NIST.IR.8425

September 2022

<!-- image -->

U.S. Department of Commerce Gina M. Raimondo, Secretary

National Institute of Standards and Technology Laurie E. Locascio, NIST Director and Under Secretary of Commerce for Standards and Technology

Certain commercial entities, equipment, or materials may be identified in this document in order to describe an experimental procedure or concept adequately. Such identification is not intended to imply recommendation or endorsement by the National Institute of Standards and Technology (NIST), nor is it intended to imply that the entities, materials, or equipment are necessarily the best available for the purpose. There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may be used by federal agencies even before the completion of such companion publications. Thus, until each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning and transition purposes, federal agencies may wish to closely follow the development of these new publications by NIST. Organizations are encouraged to review all draft publications during public comment periods and provide feedback to NIST.

Profile of the IoT Core Baseline for Consumer IoT Products


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AC.L2-3.1.2 (NIST 3.1.2)?

[Assistant]
According to Federal Cybersecurity Awareness Programs_ A Mixed Methods Research Study:

3.1.2                                                                                | Time Spent on Security Awareness ... 3.1.2 Time Spent on Security Awareness

## Focus Groups

The focus group demographic survey asked what percentage of time participants spend on their security awareness duties.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Planning?

[Assistant]
According to Secure Software Development Practices for Generative AI and Dual-Use Foundation Models_ An SSDF Community Profile:

There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may be used by federal agencies even before the completion of such companion publications. Thus, until each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning and transition purposes, federal agencies may wish to closely follow the development of these new publications by NIST. AI model producers, AI system producers, AI system acquirers, and others can use the SSDF to foster their communications regarding secure AI model development throughout the software development life cycle. 2  Following SSDF practices should help AI model producers reduce the number of vulnerabilities in their AI models, reduce the potential impacts of the exploitation of undetected or unaddressed vulnerabilities, and address the root causes of vulnerabilities to prevent recurrences. AI system producers can use the SSDF's common vocabulary when communicating with AI model producers regarding their security practices for AI model development and when integrating AI models into the software they are developing. AI system acquirers can also use SSDF terms to better communicate their cybersecurity requirements and needs to AI model producers and AI system producers, such as during acquisition processes. The SSDF Community Profile is not a checklist to follow, but rather a starting point for planning and implementing a risk-based approach to adopting secure software development practices involving AI models. The contents of the Profile are meant to be adapted and customized, as not all practices and tasks are applicable to all use cases.

Secure Software Development Practices for Generative AI and Dual-Use Foundation Models_ An SSDF Community Profile


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Summary of NIST SP 800-53, Revision 4_ Security and Privacy Controls for Federal Information Systems and Organizations provide? (Part 6)

[Assistant]
following components: (i) a control section; (ii) a supplemental guidance section; (iii) a control enhancements section; (iv) a references section; and (v) a priority and baseline allocation section.
Figure 2: The Risk Management Framework

<!-- image -->

## 3 Control Baselines and Tailoring

To assist organizations in making the appropriate selection of security controls for information systems, the concept of security control baselines is introduced. Security control baselines are the starting point for the security control selection process and are chosen based on the security category and associated impact level of information systems determined in accordance with FIPS Publication 199 and FIPS Publication 200, respectively (Step One of the RMF). SP 800-53 Rev. 4 states that 'the security controls and control enhancements listed in the initial baselines are not a minimum- but rather a proposed starting point from which controls and controls enhancements may be removed or added.' Appendix D provides a listing of baseline security controls corresponding to the low-impact, moderate-impact, and high-impact information systems, using the high water mark defined in FIPS Publication 200. The security control baselines address the security needs of a broad and diverse set of constituencies, and are developed based on a number of general assumptions, including common environmental, operational, and functional considerations. The baselines also assume typical threats facing common information systems. Articulating the underlying assumptions is a key element in the initial risk framing step of the risk management process described in NIST SP 800-39. To ensure that an appropriate set of controls is identified to provide security commensurate with risk, organizations tailor the controls to align with specific security needs.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice MA.L2-3.7.2 (NIST 3.7.2)?

[Assistant]
According to Guide to Auditing for Controls and Security_ A System Development Life Cycle Approach:

3.7.2                                                            | Methods for Overcoming Difficulties                              | Methods for Overcoming Difficulties                              | 64        |
| 3.

Guide to Auditing for Controls and Security_ A System Development Life Cycle Approach


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice IR.L2-3.6.2 (NIST 3.6.2)?

[Assistant]
According to Data Integrity_ Detecting and Responding to Ransomware and Other Destructive Events:

3.6.2 Resolution

The build has several layers of defense against this use case.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Audit and Evaluation of Computer Security II_ System Vulnerabilities and Controls provide? (Part 2)

[Assistant]
ation services. The Laboratory consists of the following centers:

Absolute Physical Quantities' - Radiation Research - Thermodynamics and Molecular Science - Analytical Chemistry - Materials Science.
THE NATIONAL ENGINEERING LABORATORY provides technology and technical services to the public and private sectors to address national needs and to solve national problems; conducts research in engineering and applied science in support of these efforts; builds and maintains competence in the necessary disciplines required to carry out this research and technical service; develops engineering data and measurement capabilities; provides engineering measurement traceability services; develops test methods and proposes engineering standards and code changes; develops and proposes new engineering practices; and develops and improves mechanisms to transfer results of its research to the ultimate user. The Laboratory consists of the following centers:

Applied Mathematics - Electronics and Electrical Engineering- Mechanical Engineering and Process Technology' - Building Technology - Fire Research Consumer Product Technology - Field Methods. THE INSTITUTE FOR COMPUTER SCIENCES AND TECHNOLOGY conducts research and provides scientific and technical services to aid Federal agencies in the selection, acquisition, application, and use of computer technology to improve effectiveness and economy in Government operations in accordance with Public Law 89-306 (40 U.S.C. 759), relevant Executive Orders, and other directives; carries out this mission by managing the Federal Information Processing Standards Program, developing Federal ADP standards guidelines, and managing Federal participation in ADP voluntary standardization activities; provides scientific and technological advisory services and assistance to Federal agencies; and provides the technical foundation for computer-related policies of the Federal Government.

Audit and Evaluation of Computer Security II_ System Vulnerabilities and Controls


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Multi-Factor Authentication for Criminal Justice Information Systems_ Implementation Considerations for Protecting Criminal Justice Information provide? (Part 3)

[Assistant]
ilable at https://csrc.nist.gov/pubs/ir/8523/final, including related content, potential updates, and document history. All comments are subject to release under the Freedom of Information Act (FOIA).
## Abstract

Most recent cybersecurity breaches have involved compromised credentials. Migrating from single-factor to multi-factor authentication (MFA) reduces the risk of compromised credentials and unauthorized access. Both criminal and noncriminal justice agencies need to access criminal justice information (CJI); to reduce the risk of unauthorized access, the Criminal Justice Information Services (CJIS) Security Policy now requires the use of MFA when accessing CJI. This document provides practical information to agencies that are implementing MFA, reflecting on lessons learned from agencies around the country and from CJI-related technology vendors. ## Keywords

authentication; credentials; criminal justice information (CJI); identity; identity federation; law enforcement; multi-factor authentication (MFA); single sign-on (SSO). ## Reports on Computer Systems Technology

The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the Nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology. ITL's responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of information other than national security-related information in federal information systems.

Multi-Factor Authentication for Criminal Justice Information Systems_ Implementation Considerations for Protecting Criminal Justice Information


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice CM.L2-3.4.1 (NIST 3.4.1)?

[Assistant]
According to Approaches and Challenges of Federal Cybersecurity Awareness Programs:

3.4.1 Frequency of phishing simulations... 3.4.1 Frequency of phishing simulations... 3.4.1 Frequency of phishing simulations

Participants indicated how often their organizations conducted phishing simulations.

Approaches and Challenges of Federal Cybersecurity Awareness Programs


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Audit and Accountability?

[Assistant]
According to Ascon-Based Lightweight Cryptography Standards for Constrained Devices_ Authenticated Encryption, Hash, and Extendable Output Functions:

| 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . |   1 |
|-----------------------------------------------------------------------------------------------------------------------------------------------------------------|-----|
| 2. Preliminaries.......................................................................... |   3 |
| 2.1. Auxiliary Functions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . |   7 |
| 3. Ascon Permutations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . |   8 |
| 3.1. Internal State . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . |   8 |
| 3.2. Constant-Addition Layer 𝑝 𝐶 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . |   8 |
| 3.3. Substitution Layer 𝑝 𝑆 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . |   9 |
| 3.4. Linear Diffusion Layer 𝑝 𝐿 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . |  10 |
| 4. Authenticated Encryption Scheme: Ascon-AEAD128 . . . . . . . . . . . . . . . . . . . . . . . . . . . . |  11 |
| 4.1. Specification of Ascon-AEAD128 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . |  11 |
| 4.1.1. Encryption . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . |  11 |
| 4.1.2. Decryption . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . |  15 |
| 4.2. Implementation Options . . . . . . . . . . . . . . . . . . . . . . . . . .

Ascon-Based Lightweight Cryptography Standards for Constrained Devices_ Authenticated Encryption, Hash, and Extendable Output Functions


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Communications Protection?

[Assistant]
According to Guide to Enterprise Patch Management Planning_ Preventive Maintenance for Technology:

ers? 6. When a vulnerability in your software becomes public but a patch, update, or upgrade is not available, how do you recommend that customers protect their computing assets running your software?
Will you provide an emergency mitigation to prevent vulnerability exploitation while maintaining most or all software functionality? 7. When your software is patched or updated, how disruptive will that be to the operating software? For instance, will it require restarting the software, rebooting the asset on which the software is running, etc.? 8. How do you test your patches before release? How often do customers experience significant issues with your patches? Do you provide rollback capabilities for uninstalling patches?

Guide to Enterprise Patch Management Planning_ Preventive Maintenance for Technology


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Maintenance?

[Assistant]
According to Report on the Design-A-Thon_ Designing Effective and Accessible Approaches for Digital Product Cybersecurity Education and Awareness:

Additional information about this publication is available at https://csrc.nist.gov/pubs/ir/8558/final, including related content, potential updates, and document history.

The team identified that firmware updates are critical to the cybersecurity of a smart teddy bear. Team participants also noted that privacy was also noted as a critical concern. The team envisioned utilizing videos and physical manuals to communicate with customers and users. They developed two manuals: one for parents and another for children, allowing for a more targeted audience approach. The adult manual was detailed and focused on salient tips and direct, easy access to resources. The child manual was designed around the idea that the child could help drive cybersecurity and that the product could help teach good cyber hygiene. For example, the eyes of the bear can glow red when an update is needed, prompting the child to seek help, as the team describes in their mock-up of the story book in Fig. 2.

Report on the Design-A-Thon_ Designing Effective and Accessible Approaches for Digital Product Cybersecurity Education and Awareness


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AT.L2-3.2.1 (NIST 3.2.1)?

[Assistant]
According to Data Integrity_ Detecting and Responding to Ransomware and Other Destructive Events:

3.2.1 Scenario

The following scenario was simulated to test the architecture's defense against destructive malware.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Planning?

[Assistant]
According to Machine Learning for Access Control Policy Verification:

There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may  be  used  by  federal  agencies  even  before  the  completion  of  such  companion  publications.  Thus,  until  each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning  and  transition  purposes,  federal  agencies  may  wish  to  closely  follow  the  development  of  these  new publications by NIST.

Machine Learning for Access Control Policy Verification


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What guidance does The Federal Cybersecurity Awareness Workforce_ Professional Backgrounds, Knowledge, Skills, and Development Activities provide?

[Assistant]
## NISTIR 8420B

## The Federal Cybersecurity Awareness Workforce

Professional Backgrounds, Knowledge, Skills, and Development Activities

Julie Haney Jody Jacobs Susanne Furman Fernando Barrientos

This publication is available free of charge from: https://doi.org/10.6028/NIST.IR.8420B

<!-- image -->

## NISTIR 8420B

## The Federal Cybersecurity Awareness Workforce

Professional Backgrounds, Knowledge, Skills, and Development Activities

Julie Haney Jody Jacobs Susanne Furman Fernando Barrientos Information Access Division Information Technology Laboratory

This publication is available free of charge from:

https://doi.org/10.6028/NIST.IR.8420B

March 2022

<!-- image -->

U.S. Department of Commerce Gina M. Raimondo, Secretary

National Institute of Standards and Technology James K. Olthoff, Performing the Non-Exclusive Functions and Duties of the Under Secretary of Commerce for Standards and Technology & Director, National Institute of Standards and Technology

## National Institute of Standards and Technology Interagency or Internal Report 8420B 36 pages (March 2022)

## This publication is available free of charge from: https://doi.org/10.6028/NIST.IR.8420B

Certain  commercial  entities,  equipment,  or  materials  may  be  identified  in  this  document  in  order  to  describe  an experimental  procedure  or  concept  adequately. Such  identification  is  not  intended  to  imply  recommendation  or endorsement by NIST, nor is it intended to imply that the entities, materials, or equipment are necessarily the best available for the purpose. There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may  be  used  by  federal  agencies  even  before  the  completion  of  such  companion  publications.

The Federal Cybersecurity Awareness Workforce_ Professional Backgrounds, Knowledge, Skills, and Development Activities

Audit and Accountability
System and Information Integrity
Media Protection
Identification and Authentication
Awareness and Training
System and Communications Protection
Access Control
Planning
Incident Response
Risk Assessment
Personnel Security
System and Services Acquisition
Supply Chain Risk Management
Maintenance
Physical Protection
Security Assessment


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Validating the Integrity of Computing Devices provide? (Part 8)

[Assistant]
ose. ## NIST SPECIAL PUBLICATION 1800-34B

## Validating the Integrity of Computing Devices

## Volume B:

Approach, Architecture, and Security Characteristics

Tyler Diamond* Nakia Grayson William T.
Polk Andrew Regenscheid Murugiah Souppaya

National Institute of Standards and Technology Information Technology Laboratory

## Christopher Brown

The MITRE Corporation McLean, Virginia

## Karen Scarfone

Scarfone Cybersecurity Clifton, Virginia

*Former employee; all work for this publication was done while at employer

## December 2022

FINAL

This publication is available free of charge from https://doi.org/10.6028/NIST.SP.1800-34

<!-- image -->

## DISCLAIMER

Certain commercial entities, equipment, products, or materials may be identified by name or company logo or other insignia in order to acknowledge their participation in this collaboration or to describe an experimental procedure or concept adequately. Such identification is not intended to imply special status or relationship with NIST or recommendation or endorsement by NIST or NCCoE; neither is it intended to imply that the entities, equipment, products, or materials are necessarily the best available for the purpose. National Institute of Standards and Technology Special Publication 1800-34B, Natl. Inst. Stand. Technol. Spec. Publ. 1800-34B, 72 pages, (December 2022), CODEN: NSPUE2

## FEEDBACK

As a private-public partnership, we are always seeking feedback on our practice guides. We are particularly interested in seeing how businesses apply NCCoE reference designs in the real world. If you have implemented the reference design, or have questions about applying it in your environment, please email us at supplychain-nccoe@nist.gov. All comments are subject to release under the Freedom of Information Act.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for Physical Protection?

[Assistant]
According to Protecting Controlled Unclassified Information (CUI)_ NIST Special Publication 800-171, Revision 3. Small Business Primer:

| Access Control                    | Maintenance         | Security Assessment and Monitoring   |
|-----------------------------------|---------------------|--------------------------------------|
| Awareness and Training            | Media Protection    | System and Communications Protection |
| Audit and Accountability          | Personnel Security  | System and Information Integrity     |
| Configuration Management          | Physical Protection | Planning                             |
| Identification and Authentication | Risk Assessment     | System and Services Acquisition      |
| Incident Response                 |                     | Supply Chain Risk Management         |

Scope and Applicability of SP 800-171. The security requirements in NIST SP 800-171 are only applicable to components of nonfederal systems that process, store, or transmit CUI or that provide protection for such components. Appropriately scoping requirements is an important factor in determining protection-related investment decisions and managing security risks for your business. You may limit the scope of the security requirements by isolating the system components in a separate security domain. Isolation can be achieved by implementing subnetworks with firewalls or other boundary protection devices. Security domains may employ physical separation, logical separation, or a combination of both. This approach can provide adequate security for CUI and avoid increasing the organization's security posture beyond what it requires for protecting its missions, operations, and assets.

- Permit only qualified and authorized individuals to access the system for the purpose of initiating changes. Access restrictions include physical and logical access controls, software libraries, workflow automation, media libraries, abstract layers (i.e., changes implemented into external interfaces rather than directly into the system), and change windows (i.e., changes occur only during specified times).

Protecting Controlled Unclassified Information (CUI)_ NIST Special Publication 800-171, Revision 3. Small Business Primer


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Audit and Accountability?

[Assistant]
According to Digital Identity Guidelines_ Authentication and Authenticator Management:

2.3.3. Reauthentication . . . . . . . . . . . . . . . . . . . . . . . . . .

2.3.3. Reauthentication
Periodic reauthentication of subscriber sessions  SHALL  be performed, as described in
Sec. 5.2. At AAL3, the overall timeout for reauthentication  SHALL  be no more than 12
hours. The inactivity timeout  SHOULD  be no more than 15 minutes. Unlike AAL2, AAL3
reauthentication requirements are the same as for initial authentication at AAL3.

The out-of-band device  SHOULD  be uniquely addressable by the verifier. Communication
over the secondary channel  SHALL  use approved encryption unless sent via the public
switched telephone network (PSTN). For additional authenticator requirements that are
specific to using the PSTN for out-of-band authentication, see Sec. 3.1.3.3.

Digital Identity Guidelines_ Authentication and Authenticator Management


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Supply Chain Risk Management?

[Assistant]
According to Guide to Enterprise Patch Management Planning_ Preventive Maintenance for Technology:

Another reason for monitoring the deployed patches is to see if the patched software's behavior changes after patching. As part of a layered security approach to mitigating supply chain risk, this might be helpful at detecting, responding to, and recovering from situations where the installed patch was itself compromised.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice MA.L2-3.7.1 (NIST 3.7.1)?

[Assistant]
According to Audit and Evaluation of Computer Security II_ System Vulnerabilities and Controls:

3.7.1 Global                                                                                | 3. 3.7.1 Global by Data Base ; In this scheme, each data base is assigned a classification equal to that of the most sensitive data it contains.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AC.L2-3.1.2 (NIST 3.1.2)?

[Assistant]
According to Secure Software Development Framework (SSDF) Version 1.1_ Recommendations for Mitigating the Risk of Software Vulnerabilities:

3.1.2, 3. 3.1.2, 3. 3.1.2 SP800161 : SA-4, SA-9, SA-9(1), SA-9(3), SA-10, SA-10(1), SA-15, SR-3, SR-4, SR-5 SP800181 : T0203, T0415; K0039; S0374; A0056, A0161                                                                                |
| Implement Roles and Responsibilities (PO.

Secure Software Development Framework (SSDF) Version 1.1_ Recommendations for Mitigating the Risk of Software Vulnerabilities


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule_ A Cybersecurity Resource Guide provide? (Part 4)

[Assistant]
cation provides practical guidance and resources that can be used by regulated entities of all sizes to safeguard ePHI and better understand the security concepts discussed in the HIPAA Security Rule.
## Keywords

administrative safeguards; Health Insurance Portability and Accountability Act; implementation specification; physical safeguards; risk assessment; risk management; Security Rule; standards; technical safeguards. ## Reports on Computer Systems Technology

The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the Nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology. ITL's responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in federal information systems. The Special Publication 800-series reports on ITL's research, guidelines, and outreach efforts in information system security, and its collaborative activities with industry, government, and academic organizations. ## Document Conventions

The terms 'should' and 'should not' indicate that, among several possibilities, one is recommended as particularly suitable without mentioning or excluding others, that a certain course of action is preferred but not necessarily required, or that (in the negative form) a certain possibility or course of action is discouraged but not prohibited. The terms 'may' and 'need not' indicate a course of action permissible within the limits of the publication. The terms 'can' and 'cannot' indicate a possibility and capability, whether material, physical, or causal.

Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule_ A Cybersecurity Resource Guide


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Security and Privacy Controls for Information Systems and Organizations provide? (Part 10)

[Assistant]
s

i

p
u
b

l
i

c
a

t
i

o
n

i

s

a
v
a

i
l

l

a
b
e
f
r
e
e
o
f

c
h
a
r
g
e
f
r
o
m

:

h
t
t
p
s
:
/
/
d
o
i
. o
r
g
/
1
0
. 6
0
2
8
/
N
S
T
S
P
. 8
0
0
-
5
3
r
5

. I

NIST SP 800-53, REV.
5                                                                                SECURITY AND PRIVACY CONTROLS FOR INFORMATION SYSTEMS AND ORGANIZATIONS
_________________________________________________________________________________________________

RISK MANAGEMENT

Organizations must exercise due diligence in managing information security and privacy risk. This
is accomplished, in part, by establishing a comprehensive risk management program that uses
the flexibility inherent in NIST publications to categorize systems, select and implement security
and  privacy  controls  that  meet  mission  and  business  needs,  assess  the  effectiveness  of  the
controls, authorize the systems for operation, and continuously monitor the systems. Exercising
due diligence and implementing robust and comprehensive information security and privacy risk
management  programs  can  facilitate  compliance  with  applicable  laws,  regulations,  executive
orders,  and  governmentwide  policies. Risk  management  frameworks  and  risk  management
processes are essential in developing, implementing, and maintaining the protection measures
necessary to address stakeholder needs and the current threats to organizational operations
and  assets,  individuals,  other  organizations,  and  the  Nation. Employing  effective  risk-based
processes,  procedures,  methods,  and  technologies  ensures  that  information  systems  and
organizations have the necessary trustworthiness and resiliency to support essential mission and
business functions, the U.S. critical infrastructure, and continuity of government. vi

T
h
s

i

p
u
b

l
i

c
a

t
i

o
n

i

s

a
v
a

i
l

l

a
b
e
f
r
e
e
o
f

c
h
a
r
g
e
f
r
o
m

:

h
t
t
p
s
:
/
/
d
o
i
. o
r
g
/
1
0
. 6
0
2
8
/
N
S
T
S
P
. 8
0
0
-
5
3
r
5

.

Security and Privacy Controls for Information Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What guidance does NIST provide for CMMC Level 1?

[Assistant]
According to Summary Report for “Workshop on Updating Manufacturer Guidance for Securable Connected Product Development”:

<!-- image -->

## NIST Interagency Report NIST IR 8562

## Summary Report for ' Workshop on Updating Manufacturer Guidance for Securable Connected Product Development '

Katerina N. Megas Michael Fagan Barbara Cuthill Brad Hoehn Evie Petrella

This publication is available free of charge from:

https://doi.org/10.6028/NIST.IR.8562

<!-- image -->

## NIST Interagency Report NIST IR 8562

## Summary Report for ' Workshop on Updating Manufacturer Guidance for Securable Connected Product Development '

Katerina N. Megas Michael Fagan Barbara Cuthill

Applied Cybersecurity Division Information Technology Laboratory

Brad Hoehn HII

Evie Petrella Electrosoft Services, Inc. This publication is available free of charge from: https://doi.org/10.6028/NIST.IR.8562

April 2025

<!-- image -->

U.S. Department of Commerce Howard Lutnick, Secretary

National Institute of Standards and Technology

Craig S. Burkhardt, Acting NIST Director and Under Secretary of Commerce for Standards and Technology

Certain equipment, instruments, software, or materials, commercial or non-commercial, are identified in this paper in order to specify the experimental procedure adequately. Such identification does not imply recommendation or endorsement of any product or service by NIST, nor does it imply that the materials or equipment identified are necessarily the best available for the purpose. ## NIST Technical Series Policies

Copyright, Use, and Licensing Statements NIST Technical Series Publication Identifier Syntax

## Publication History

Approved by the NIST Editorial Review Board on 2025-03-21

## How to Cite this NIST Technical Series Publication

Megas K, Fagan M, Cuthill B, Hoehn N, and Petrella E  (2025) Summary Report for 'Workshop on Updating Manufacturer Guidance for Securable Connected Product Development' (National Institute of Standards and Technology, Gaithersburg, MD), NIST Interagency or Internal Report (IR) NIST IR 8562.

Summary Report for “Workshop on Updating Manufacturer Guidance for Securable Connected Product Development”

Audit and Accountability
System and Information Integrity
Security Assessment
Media Protection
Identification and Authentication
Awareness and Training
System and Communications Protection
Access Control
Planning
Incident Response
Risk Assessment
Personnel Security
System and Services Acquisition
Maintenance
Physical Protection
Configuration Management


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What guidance does NIST provide for CMMC Level 2?

[Assistant]
According to Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations:

<!-- image -->

## NIST Special Publication 800 NIST SP 800-171r3

## Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations

Ron Ross Victoria Pillitteri

This publication is available free of charge from:

https://doi.org/10.6028/NIST.SP.800-171r3

<!-- image -->

## NIST Special Publication 800 NIST SP 800-171r3

## Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations

Ron Ross Victoria Pillitteri Computer Security Division

Information Technology Laboratory

This publication is available free of charge from:

https://doi.org/10.6028/NIST.SP.800-171r3

May 2024

<!-- image -->

U.S. Department of Commerce Gina M. Raimondo, Secretary

Certain equipment, instruments, software, or materials, commercial or non-commercial, are identified in this paper in order to specify the experimental procedure adequately. Such identification does not imply recommendation or endorsement of any product or service by NIST, nor does it imply that the materials or equipment identified are necessarily the best available for the purpose. There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may be used by federal agencies even before the completion of such companion publications. Thus, until each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning and transition purposes, federal agencies may wish to closely follow the development of these new publications by NIST. Organizations are encouraged to review all draft publications during public comment periods and provide feedback to NIST. Many NIST cybersecurity publications, other than the ones noted above, are available at https://csrc.nist.gov/publications.

Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice CM.L2-3.4.2 (NIST 3.4.2)?

[Assistant]
According to Guide to Auditing for Controls and Security_ A System Development Life Cycle Approach:

3.4.2                                                            | Audit Planning/Prioritization Process                            | Audit Planning/Prioritization Process                            | 51        |
|           | 3. 3.4.2 Interview Key Participants Customize                                              | Audit Objectives                                                                            | 83   |
|       | 4. 3.4.2                                                                                | Contracting/Purchase Audit Considerations                                                   | 85   |
|       | 4.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Data Integrity_ Detecting and Responding to Ransomware and Other Destructive Events provide? (Part 6)

[Assistant]
forming the processes associated with implementing this guide. To provide comments or to learn more by arranging a demonstration of this example implementation, contact the NCCoE at ds-nccoe@nist.gov.
## TECHNOLOGY PARTNERS/COLLABORATORS

Organizations participating in this project submitted their capabilities in response to an open call in the Federal Register for all sources of relevant security capabilities from academia and industry (vendors and integrators). The following respondents with relevant capabilities or product components (identified as 'Technology Partners/Collaborators' herein) signed a Cooperative Research and Development Agreement (CRADA) to collaborate with NIST in a consortium to build this example solution. <!-- image -->

<!-- image -->

<!-- image -->

<!-- image -->

<!-- image -->

<!-- image -->

Certain commercial entities, equipment, products, or materials may be identified by name or company logo or other insignia in order to acknowledge their participation in this collaboration or to describe an experimental procedure or concept adequately. Such identification is not intended to imply special status or relationship with NIST or recommendation or endorsement by NIST or NCCoE; neither is it

intended to imply that the entities, equipment, products, or materials are necessarily the best available for the purpose. The National Cybersecurity Center of Excellence (NCCoE), a part of the  National  Institute  of  Standards  and  Technology  (NIST),  is  a collaborative hub where industry organizations, government agencies,  and  academic  institutions  work  together  to  address businesses'  most  pressing  cybersecurity  challenges. Through  this collaboration,  the  NCCoE  develops  modular,  adaptable  example cybersecurity solutions demonstrating how to apply standards and best practices using commercially available technology.

Data Integrity_ Detecting and Responding to Ransomware and Other Destructive Events


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Protecting Controlled Unclassified Information (CUI)_ NIST Special Publication 800-171, Revision 3. Small Business Primer provide? (Part 8)

[Assistant]
ederal Agencies

- The National Archives and Records Administration (NARA) , per 32 CFR Part 2002 "Controlled Unclassified Information," determines what CUI is and lists CUI types at archives.gov/cui.
- NIST is responsible for developing and publishing the security requirements for the protection of CUI. How requirements are mandated, and any compliance issues related to nonfederal implementation of SP 800-171, are the responsibility of the federal agency requiring its use , as expressed in a specific contract or agreement. ## Additional NIST Resources

- NIST's Protecting CUI Frequently Asked Questions
- Changes Between SP 800-171 Rev. 2 and Rev. 3 (.xlsx)
- The NIST Cybersecurity and Privacy Reference Tool (CPRT) provides online, interactive versions of the updated security requirements in SP 800-171, Revision 3 and the updated assessment procedures in SP 800-171A, Revision 3
- Event Recording: ' CUI Security Requirements Workshop ,' which provides a general overview of SP 800 -171 and SP 800-171A
- NIST Small Business Cybersecurity Corner

ht ps:/

csrc.nist.gov/projects/protecting-control ed-unclas ified-information

<!-- image -->

## What to Expect

The following pages delve deeper into the SP 800-171 R3 publication to provide more details for those responsible for implementing the requirements 3 . The following pages cover:

<!-- image -->

Page 8: Key differences between SP 800-171 R2 and R3. Pages 9-10: General tips for getting started. Pages 11-28: Tips for getting started, broken out by Control Family. 3 We provide links to non-NIST sites throughout this publication because they may have information of interest to readers. NIST does not necessarily endorse the views expressed or the facts presented on those sites. Further, NIST does not endorse any commercial products that may be advertised or available on these sites.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Planning?

[Assistant]
According to Digital Identity Guidelines_ Authentication and Authenticator Management:

There may be references in this publication to other publications currently under
development by NIST in accordance with its assigned statutory responsibilities. The
information in this publication, including concepts and methodologies, may be used by
federal agencies even before the completion of such companion publications. Thus, until
each publication is completed, current requirements, guidelines, and procedures, where
they exist, remain operative. For planning and transition purposes, federal agencies may
wish to closely follow the development of these new publications by NIST.

The overall and inactivity timeout expiration limits depend on several factors, including
the AAL of the session, the environment in which the session is conducted (e.g., whether
the subscriber is in a restricted area), the type of endpoint being used (e.g., mobile
application, web-based), whether the endpoint is a managed device,7 and the nature
of the application itself. The limits  MAY  also be extended when higher security session
maintenance technologies (e.g., device-bound mechanisms) are used. Agencies  SHALL
establish and document the inactivity and overall time limits being enforced in a system
security plan, such as that described in [SP800-39]. Detailed requirements for each AAL
are given in Sec. 2.1.3, Sec. 2.2.3, and Sec. 2.3.3.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Maintenance?

[Assistant]
According to Guide for Developing Security Plans for Federal Information Systems:

| 3.14 MINIMUM SECURITY CONTROLS............................................................................................ | 24                                                                                |
|-----------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------|
| 3.15 COMPLETION AND APPROVAL DATES .................................................................................... | 26                                                                                |
| 3.16 ONGOING SYSTEM SECURITY PLAN MAINTENANCE .............................................................. | 26                                                                                |
| APPENDIX A: SAMPLE INFORMATION SYSTEM SECURITY PLAN TEMPLATE...... 27                                                             | APPENDIX A: SAMPLE INFORMATION SYSTEM SECURITY PLAN TEMPLATE...... 27                                                             |
| APPENDIX B: GLOSSARY.......................................................................................................... 31 | APPENDIX B: GLOSSARY.......................................................................................................... 31 |
| APPENDIX C: REFERENCES..................................................................................................... 41    | APPENDIX C: REFERENCES.....................................................................................................

Guide for Developing Security Plans for Federal Information Systems