[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Services Acquisition?

[Assistant]
According to Federal Cybersecurity Awareness Programs_ A Mixed Methods Research Study:

There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may  be  used  by  federal  agencies  even  before  the  completion  of  such  companion  publications. Thus,  until  each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning  and  transition  purposes,  federal  agencies  may  wish  to  closely  follow  the  development  of  these  new publications by NIST. The  Information  Technology  Laboratory  (ITL)  at  the  National  Institute  of  Standards  and Technology  (NIST)  promotes  the  U.S. economy  and  public  welfare  by  providing  technical leadership  for  the  Nation's  measurement  and  standards  infrastructure. ITL  develops  tests,  test methods, reference data, proof of concept implementations, and technical analyses to advance the development  and  productive  use  of  information  technology. ITL's  responsibilities  include  the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in federal information systems. Prior  industry  surveys  and  research  studies  have  revealed  that  organizational  cybersecurity awareness  (hereafter  shortened  to  'security  awareness')  programs  may  face  a  number  of challenges, including lack of: leadership support; resources; and staff with sufficient background and  skills  to  implement  an  effective  and  engaging  program. However,  no  prior  research  has explored security awareness programs specifically in the United States (U.S.) government (federal) sector.

Federal Cybersecurity Awareness Programs_ A Mixed Methods Research Study


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Audit and Accountability?

[Assistant]
According to Secure Software Development Practices for Generative AI and Dual-Use Foundation Models_ An SSDF Community Profile:

hey can be remediated more quickly in accordance with risk, reducing the window of opportunity for attackers. | and third-party components that the software uses, and investigate all credible reports.
|            | R2: Make the users of AI models aware of mechanisms for reporting potential security and performance issues. N1: In this context, 'users' refers to AI system producers and acquirers who are using an AI model. R3: Monitor vulnerability and incident databases for information on AI-related concerns, including the machine learning frameworks and libraries used to build AI models. | Measure 1.2, 2.4, 2.5, 2.7, 3.1, 3.2, 3.3; Manage 4.1 OWASP: LLM03-7a, LLM09, LLM10  |
| that they can be remediated more quickly in accordance with risk, reducing the window of opportunity for attackers. | RV.1.2: Review, analyze, and/or test the software's code to identify or confirm the presence of previously undetected vulnerabilities. | Medium     | R1: Scan and test AI models frequently to identify previously undetected vulnerabilities. R2: Rely mainly on automation for ongoing scanning and testing, and involve a human-in- the-loop as needed. R3: Conduct periodic audits of AI models. | AI RMF: Govern 4.3; Measure 1.3, 2.4, 2.7, 3.1; Manage 4.1 OWASP: LLM03-7b, LLM03-7d |
| that they can be remediated more quickly in accordance with risk, reducing the window of opportunity for attackers. | RV.1.3: Have a policy that addresses vulnerability disclosure and remediation, and implement the roles, responsibilities, and processes needed to support that policy. | Medium     | R1: Include AI model vulnerabilities in organization vulnerability disclosure and remediation policies. R2: Make users of AI models aware of their inherent limitations and how to report any cybersecurity problems that they encounter.

Secure Software Development Practices for Generative AI and Dual-Use Foundation Models_ An SSDF Community Profile


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Personnel Security?

[Assistant]
According to High-Performance Computing Security_ Architecture, Threat Analysis, and Security Posture:

ovide required technical support. - Insider threats: Insider threats come from people within the organization who have internal information and may have the privileges needed to access the HPC system.
Insider threats can be classified into accidental/unintentional threats and malicious/intentional threats. Unintentional threats come from the unintended side effects of normal actions and activity. In contrast, a malicious insider may intentionally upload malicious code into the HPC system.

High-Performance Computing Security_ Architecture, Threat Analysis, and Security Posture


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AT.L2-3.2.2 (NIST 3.2.2)?

[Assistant]
According to Secure Software Development Framework (SSDF) Version 1.1_ Recommendations for Mitigating the Risk of Software Vulnerabilities:

3.2.2, 3.

Secure Software Development Framework (SSDF) Version 1.1_ Recommendations for Mitigating the Risk of Software Vulnerabilities


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Analyzing Collusion Threats in the Semiconductor Supply Chain provide? (Part 7)

[Assistant]
nd sensitive data are loaded into the manufactured IC. Standard data are generic and mostly available open source, but the sensitive data are anything whose disclosure would compromise IP or security.
For example, keys of crypto modules or logic locking keys are sensitive data. 7. Deployment and Use: This stage includes delivering the IC to customers and using the IC. Many hardware vulnerabilities are exploited at this stage. 8. End of Life: End-of-life for an IC is the stage where the manufacturer no longer sells or manufactures IC [8]. This is often because of technological advancements when new ICs exhibiting better performance have been launched. When a chip reaches its end-of-life, the deployed chips are gradually replaced and discarded. These discarded chips are

often reused or recycled into new hardware compromising their quality and performance. ## 3. Framework for Supply Chain Threat Analysis

This work proposes a framework for analyzing different threats and how collusion among adversaries can affect the severity of threats. This analysis is divided into five distinct stages that discuss adversaries' intent, access, and resources, and how their collusion affects the severity of different threats. The framework is shown in Fig. 2. The framework incorporates threats across all stages of supply chain including insider threats. Fig. 2. Methodology for supply chain threat analysis

<!-- image -->

## 3.1. Identify the Intent of the Adversary

Supply chain security analysis begins with identifying the adversary's objectives. For example, an adversary may wish to disrupt a hardware's functionality or steal a designer's intellectual property (IP). This analysis describes the potential attacker, the resources that must be protected, and the semiconductor supply chain stage at which mitigation is best applied. ## 3.2. Identify Hardware Threats

The second step is identifying the threats associated with the adversary's intent.

Analyzing Collusion Threats in the Semiconductor Supply Chain

Audit and Accountability
System and Information Integrity
Security Assessment
Media Protection
Identification and Authentication
Awareness and Training
System and Communications Protection
Access Control
Planning
Incident Response
Risk Assessment
Personnel Security
System and Services Acquisition
Supply Chain Risk Management
Maintenance
Physical Protection
Configuration Management


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Profile of the IoT Core Baseline for Consumer IoT Products provide? (Part 4)

[Assistant]
related integrators and technical support firms serving the consumer and business sectors, and testing and certification bodies interested in establishing baselines of IoT cybersecurity capabilities.
## Patent Disclosure Notice

NOTICE: ITL has requested that holders of patent claims whose use may be required for compliance with the guidance or requirements of this publication disclose such patent claims to ITL. However, holders of patents are not obligated to respond to ITL calls for patents and ITL has not undertaken a patent search in order to identify which, if any, patents may apply to this publication. As of the date of publication and following call(s) for the identification of patent claims whose use may be required for compliance with the guidance or requirements of this publication, no such patent claims have been identified to ITL. No representation is made or implied by ITL that licenses are not required to avoid patent infringement in the use of this publication.

Profile of the IoT Core Baseline for Consumer IoT Products


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Supply Chain Risk Management?

[Assistant]
According to Assessing Security and Privacy Controls in Information Systems and Organizations:

NTROL ASSESSMENTS ..................................................... 30
3.4   ANALYZE ASSESSMENT REPORT RESULTS .....................................................................................
32
3.5   ASSESS SECURITY AND PRIVACY CAPABILITIES .............................................................................. 34
CHAPTER FOUR SECURITY AND PRIVACY ASSESSMENT PROCEDURES ................................................. 37
4.1   ACCESS CONTROL............................................................................................................................ 40
4.2   AWARENESS AND TRAINING ........................................................................................................ 118
4.3   AUDIT AND ACCOUNTABILITY ...................................................................................................... 128
4.4   ASSESSMENT, AUTHORIZATION, AND MONITORING ................................................................. 160
4.5   CONFIGURATION MANAGEMENT ................................................................................................ 177
4.6   CONTINGENCY PLANNING ............................................................................................................ 215
4.7   IDENTIFICATION AND AUTHENTICATION .................................................................................... 243
4.8   INCIDENT RESPONSE ............................................................................................................... 275
4.9   MAINTENANCE ........................................................................................................................ 298
4.10   MEDIA PROTECTION .............................................................................................................. 316
4.11   PHYSICAL AND ENVIRONMENTAL PROTECTION .......................................................................

Assessing Security and Privacy Controls in Information Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What are the CMMC Level 1 requirements?

[Assistant]
According to Summary Report for “Workshop on Updating Manufacturer Guidance for Securable Connected Product Development”:

n Updating Manufacturer Guidance for Securable Connected Product Development' (National Institute of Standards and Technology, Gaithersburg, MD), NIST Interagency or Internal Report (IR) NIST IR 8562.
https://doi.org/10.6028/NIST.IR.8562

## Author ORCID iDs

Katerina Megas: 0000-0002-2815-5448 Michael Fagan: 0000-0002-1861-2609 Barbara Cuthill: 0000-0002-2588-6165

## Contact Information

iotsecurity@nist.gov

National Institute of Standards and Technology Attn: Applied Cybersecurity Division, Information Technology Laboratory 100 Bureau Drive (Mail Stop 2000) Gaithersburg, MD 20899-2000

## Abstract

This report summarizes the feedback received by the NIST Cybersecurity for the Internet of Things (IoT) program at the in-person and hybrid workshop on "Updating Manufacturer Guidance for Securable Connected Product Development" held in December 2024. The purpose of this workshop was to consider how to update Foundational Cybersecurity Activities for IoT Device Manufacturers (NIST Internal Report (IR) 8259) based on concepts in risk management, operational technology concerns, product end of life concerns and recent trends in IoT cybersecurity and privacy. Over time, the NIST volume of work has built upon the concepts introduced in NIST IR 8259,to add technical (NIST IR 8259A) and nontechnical (NIST IR 8259B) concepts to help manufacturers and customers consider the cybersecurity of IoT devices. The NIST IR 8259 series has been used to inform and develop subsequent publications that elaborate on IoT cybersecurity across sectors and use cases (e.g., federal agency uses cases reflected in NIST SP 800-213 and consumer use cases reflected in NIST IR 8425 and the U.S. Cyber Trust Mark). ## Keywords

cybersecurity baseline; Internet of Things (IoT); IoT products; manufacturing; privacy; risk management; securable products; security requirements; software development; threat modelling. ## Table of Contents

| 1.

Summary Report for “Workshop on Updating Manufacturer Guidance for Securable Connected Product Development”

Audit and Accountability
System and Information Integrity
Security Assessment
Media Protection
Identification and Authentication
Awareness and Training
System and Communications Protection
Access Control
Planning
Incident Response
Risk Assessment
Personnel Security
System and Services Acquisition
Maintenance
Physical Protection
Configuration Management


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice IR.L2-3.6.1 (NIST 3.6.1)?

[Assistant]
According to Audit and Evaluation of Computer Security II_ System Vulnerabilities and Controls:

3.6.1 Secure Host Operating System                                                                                | 3. 3.6.1 Secure Host Operating System; If one wishes to implement an unprivileged data management system atop an existing secure operating system which supports general usage it is important to note that the implementation cannot provide either more nor less security than that provided by the operating system's security policy.

Audit and Evaluation of Computer Security II_ System Vulnerabilities and Controls


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Physical Protection?

[Assistant]
According to Planning for a Zero Trust Architecture_ A Planning Guide for Federal Administrators:

- Policy Engine (PE): The 'brain' of a ZTA implementation and the components that ultimately evaluate resource access requests. The PE relies on information from the various data sources (access logs, threat intelligence, endpoint health, and network ID authentication, etc.)
- Policy Administrator (PA): The executor function of the PE. The PA's role is to establish, maintain and ultimately terminate sessions 1 in the data plane between the subject and the resource. The PA, PE and PEP communicate on a logically (or physically) separate set of channels called the control plane. The control plane is used to establish and configure the data plane channels used to send application traffic.
- Policy Enforcement Point (PEP): The component that applications, endpoints, etc. will interact with to be granted access permission to a resource. The PEP is responsible for gathering information for the PE and following the instructions issued by the PA to establish and terminate communication sessions.  All data plane communications between enterprise resources must be managed by a PEP.
- Information feeds (left and right ): Sometimes called policy information points (PIPs). These are not 'core' functional ZTA components themselves but used to support the PE. These feeds include the set of codified policies, identity and endpoint attributes, environmental factors and historical data used by the PE to generate resource access decisions.

Planning for a Zero Trust Architecture_ A Planning Guide for Federal Administrators


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 1 require for Personnel Security?

[Assistant]
According to IoT Non-Technical Supporting Capability Core Baseline:

| Non-Technical Supporting Capability | Common Actions | Rationale | IoT Reference Examples | |---------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------| | Documentation ( continued ) | 4.

IoT Non-Technical Supporting Capability Core Baseline


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Personnel Security?

[Assistant]
According to Guide to Enterprise Patch Management Planning_ Preventive Maintenance for Technology:

The primary audience for this publication is chief information officers, chief information security officers, cybersecurity directors and managers, and others who are responsible for managing organizational risk related to the use of software. Others with an interest in the topic, including business and mission owners, security engineers and architects, system administrators, and security operations personnel, may find portions of the publication to be informative.

- Security and technology management and leadership at all levels of the organization will gain a new understanding of the role of patching in enterprise risk management.
- The security/technology and business/mission sides of the organization will be able to communicate with each other more effectively regarding patch management and reach consensus on planning.
- Personnel from the security/technology and business/mission sides of the organization will be prepared to revamp their enterprise patching strategy throughout the entire patch management life cycle.

Enterprise patch management has been a contentious issue for decades, with personnel from the security and business/mission sides of organizations often having conflicting opinions. For example, many organizations have struggled with balancing the trade-offs between earlier deployment and more testing. Deploying patches more quickly reduces the window of opportunity for attackers but increases the risk of operational disruption because of the lack of testing. Conversely, testing patches before deployment decreases the risk of operational disruption but increases the window of opportunity for attackers. Testing can also consume considerable staff resources, and it still might miss problems.

Guide to Enterprise Patch Management Planning_ Preventive Maintenance for Technology


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Services Acquisition?

[Assistant]
According to Workshop on Enhancing Security of Devices and Components Across the Supply Chain:

There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may be used by federal agencies even before the completion of such companion publications. Thus, until each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning and transition purposes, federal agencies may wish to closely follow the development of these new publications by NIST. The National Institute of Standards and Technology (NIST) hosted an in-person, all-day workshop on February 27, 2024, to discuss existing and emerging cybersecurity threats and mitigation techniques for semiconductors throughout their life cycle. The workshop obtained valuable feedback from industry, academia, and government to inform NIST's development of cybersecurity and supply chain standards, guidance, and recommended practices. The discussion focused on semiconductor development and highlighted cybersecurity measurements and metrics that utilize reference data sets to facilitate the testing, attestation, certification, verification, and validation of semiconductor components. It also emphasized the use of automated cybersecurity tools and techniques to secure manufacturing environments throughout the development life cycle. This report summarizes the content that was presented and discussed at the workshop. The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the US economy and public welfare by providing technical leadership for the Nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology.

Workshop on Enhancing Security of Devices and Components Across the Supply Chain


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice CM.L2-3.4.3 (NIST 3.4.3)?

[Assistant]
According to Data Integrity_ Detecting and Responding to Ransomware and Other Destructive Events:

3.4.3 Other Considerations

Another defense that can partially prevent this use case is detection of the email as spam.

Data Integrity_ Detecting and Responding to Ransomware and Other Destructive Events


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Information Integrity?

[Assistant]
According to Incident Response Recommendations and Considerations for Cybersecurity Risk Management_ A CSF 2.0 Community Profile:

[FISMA2014] | CSF Element | CSF Element Description | Priority | Recommendations, Considerations, Notes | |---------------|-----------------------------------------------------------------------------------|------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | ID.RA-01 | Vulnerabilities in assets are identified, validated, and recorded | Medium | on cybersecurity risk assessment.

Incident Response Recommendations and Considerations for Cybersecurity Risk Management_ A CSF 2.0 Community Profile


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Guide to a Secure Enterprise Network Landscape provide? (Part 3)

[Assistant]
cation History

Approved by the NIST Editorial Review Board on 2022-11-10

## How to Cite this NIST Technical Series Publication:

Chandramouli R (2022) Guide to a Secure Enterprise Network Landscape.
(National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) NIST SP 800-215. https://doi.org/10.6028/NIST.SP.800-215

## Author ORCID iDs

Ramaswamy Chandramouli: 0000-0002-7387-5858

## Contact Information

sp800-215-comments@nist.gov

National Institute of Standards and Technology Attn: Computer Security Division, Information Technology Laboratory 100 Bureau Drive (Mail Stop 8930) Gaithersburg, MD 20899-8930

All comments are subject to release under the Freedom of Information Act (FOIA). ## Abstract

Access to multiple cloud services, the geographic spread of enterprise Information Technology (IT) resources (including multiple data centers), and the emergence of microservices-based applications (as opposed to monolithic ones) have significantly altered the enterprise network landscape. This document is meant to provide guidance to this new enterprise network landscape from a secure operations perspective. Hence, it starts by examining the security limitations of current network access solutions to the enterprise network. It then considers security feature enhancements to traditional network appliances in the form of point security solutions, network configurations for various security functions (e.g., application/services security, cloud services access security, device or endpoint security), security frameworks that integrate these individual network configurations (e.g., zero trust network access [ZTNA]), and the evolving wide area network (WAN) infrastructure to provide a comprehensive set of security services for the modern enterprise network landscape (e.g., secure access service edge [SASE]).

Guide to a Secure Enterprise Network Landscape


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AU.L2-3.3.1 (NIST 3.3.1)?

[Assistant]
According to Digital Identity Guidelines:

3.3.1. 3.3.1) to
identify the corresponding set of baseline digital identity controls from the requirements
and guidelines in the companion volumes [SP800-63A], [SP800-63B], and [SP800-63C]. 3.3.1.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Identification and Authentication?

[Assistant]
According to Guide to Malware Incident Prevention and Handling for Desktops and Laptops:

| Executive Summary................................................................................................................vii   | Executive Summary................................................................................................................vii                                                                                | Executive Summary................................................................................................................vii                                                                                |                                                                                |
|----------------------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------|
| 1. Introduction ...................................................................................................................... | 1. Introduction ...................................................................................................................... | 1. Introduction ......................................................................................................................

Guide to Malware Incident Prevention and Handling for Desktops and Laptops


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Access Control?

[Assistant]
According to Security and Privacy Controls for Information Systems and Organizations:

.................................................................. 1
1.1   PURPOSE AND APPLICABILITY ...................................................................................................
2
1.2   TARGET AUDIENCE .................................................................................................................. 3
1.3   ORGANIZATIONAL RESPONSIBILITIES......................................................................................... 3
1.4   RELATIONSHIP TO OTHER PUBLICATIONS ................................................................................... 5
1.5   REVISIONS AND EXTENSIONS .................................................................................................... 5
1.6   PUBLICATION ORGANIZATION .................................................................................................. 5
CHAPTER TWO   THE FUNDAMENTALS ............................................................................................ 7
2.1   REQUIREMENTS AND CONTROLS .............................................................................................. 7
2.2   CONTROL STRUCTURE AND ORGANIZATION .............................................................................. 8
2.3   CONTROL IMPLEMENTATION APPROACHES ............................................................................. 11
2.4   SECURITY AND PRIVACY CONTROLS ......................................................................................... 13
2.5   TRUSTWORTHINESS AND ASSURANCE ..................................................................................... 14
CHAPTER THREE   THE CONTROLS ................................................................................................. 16
3.1   ACCESS CONTROL ..................................................................................................................

Security and Privacy Controls for Information Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Guidelines for the Use of PIV Credentials in Facility Access provide? (Part 5)

[Assistant]
cal access control systems (PACS). Information in this document is also useful to government contractors and physical security vendors that provide HSPD-12 systems, products, and integration services.
It is expected that readers have a general knowledge of PIV standards, including [FIPS 201-2], [SP800-73], and [SP800-78]. ## Executive Summary

Homeland Security Presidential Directive-12 [HSPD-12] sets a clear goal to improve federal facility access through the use of government-wide identity standards. These goals are reflected in the Office of Management and Budget (OMB) Circular A-130, which references SP 800-116 to ensure continued deployment and use of the identity credentials accessing Federal facilities. 1

Federal Information Processing Standard 201 [FIPS201] defines characteristics of the identity credential that can be interoperable government-wide. In the context of [HSPD-12], the term interoperability means the ability to use any Personal Identity Verification (PIV) Card with any application performing one or more PIV authentication mechanisms. [FIPS201] also defines authentication mechanisms at four assurance levels (LITTLE or NO, SOME, HIGH, and VERY HIGH). These levels provide for the risk based approach as directed in HSPD-12 to ' include graduated criteria, from least secure to most secure, to ensure flexibility in selecting the appropriate level of security for each application.'

The risk-based approach for facility access is stipulated via the designation of 'Controlled, Limited, Exclusion' areas (see Section 4.3). Specifically, this document recommends PIV authentication mechanisms for 'Controlled, Limited, Exclusion' in terms of authentication factors as shown in Table ES-1. Some agencies may have different names for their security areas, however each agency should establish their criteria to implement authentication consistent with this document.

Guidelines for the Use of PIV Credentials in Facility Access


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AU.L2-3.3.5 (NIST 3.3.5)?

[Assistant]
According to Audit and Evaluation of Computer Security:

3.3.5

Remote Computing

Security controls in a remote computing or inter-

active environment are important because physical locks
and keys alone may not provide for adequate accountability
The minimum controls to be
or deter unauthorized access.

Audit and Evaluation of Computer Security


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Audit and Accountability?

[Assistant]
According to Strategies for the Integration of Software Supply Chain Security in DevSecOps CI_CD Pipelines:

- Patch management
- Dependency management
- Authentication and authorization
- Malware protection
- Secure SDLC
- Data protection
- Physical security
- Audit and monitoring
- Adherence to applicable security standards (e.g., regulatory requirements)

Organizations can implement various controls to mitigate risks to their SDLC environment, including regular patch management, robust authentication, granular authorization, malware protection, secure SDLC practices, data protection measures, physical security controls, and auditing and monitoring tools. They should regularly assess their security posture, identify potential weaknesses and vulnerabilities, and implement appropriate defensive measures to address them. Organizational network policies that account for and actively block maliciously known content-serving domains can reduce the use of software from non-curated or undesired locations. Another integral part of SSC security involves capturing the dependencies (e.g., package name, version) of the artifacts in a central repository. Organizations should also ensure that their SDLC environment remains compliant with various security and other relevant standards, such as the Open Worldwide Application Security Project (OWASP) Top Ten, SP 80053, Health Insurance Portability and Accountability Act ( HIPAA), and Payment Card Industry Data Security Standard ( PCI DSS). - The security team should establish a policy for trusted sources of OSS (e.g., allow lists) that includes reviewing minimum coding requirements, reputational standards, and distributing source code in a digitally signed package. - The security team should approve the merging of unverified sources of OSS. - Developers should download OSS as source code rather than pre-compiled libraries or binaries, when available.

Strategies for the Integration of Software Supply Chain Security in DevSecOps CI_CD Pipelines


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Cryptographic Module Validation Program (CMVP) Security Policy Requirements_ CMVP Validation Authority Updates to ISO_IEC 24759 and ISO_IEC 19790 Anne provide? (Part 5)

[Assistant]
ion technology - Security techniques - Security requirements for cryptographic modules , and ISO/IEC 24759, Information technology - Security techniques - Test requirements for cryptographic modules .
## Table of Contents

|                                                                                | Introduction ...................................................................................................................... 1   |
|------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------|
|                                                                                | Scope......................................................................................................................... 1        |
|                                                                                | Normative References................................................................................................ 1                  |
|                                                                                | Document Organization................................................................................................... 2              |
|                                                                                | General.......................................................................................................................

Cryptographic Module Validation Program (CMVP) Security Policy Requirements_ CMVP Validation Authority Updates to ISO_IEC 24759 and ISO_IEC 19790 Anne


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AC.L2-3.1.1 (NIST 3.1.1)?

[Assistant]
According to The Federal Cybersecurity Awareness Workforce_ Professional Backgrounds, Knowledge, Skills, and Development Activities:

3.1.1 Security Awareness Roles and Percentage of Time... 3.1.1 Security Awareness Roles and Percentage of Time... 3.1.1 Security Awareness Roles and Percentage of Time...

The Federal Cybersecurity Awareness Workforce_ Professional Backgrounds, Knowledge, Skills, and Development Activities


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Cryptographic Module Validation Program (CMVP)-Approved Security Functions_ CMVP Validation Authority Updates to ISO_IEC 24759 provide? (Part 5)

[Assistant]
................................................................................. 1

Symbols and abbreviated terms......................................................................................
1

Document organization  .................................................................................................... 1

General....................................................................................................................... 1

Modification ................................................................................................................ 2

CMVP-approved security function requirements  ........................................................... 2

Purpose ...................................................................................................................... 2

Approved security functions  ........................................................................................ 2

Appendix A. Document Revisions  ....................................................................................... 3

## Scope

This document specifies the Cryptographic Module Validation Program (CMVP)-approved security functions and supersedes those specified in International Organization for Standardization/International Electrotechnical Commission (ISO/IEC) 19790 Annex C and ISO/IEC 24759 paragraph 6.15. This document also supersedes SP 800-140Cr1. ## Normative references

This section identifies the normative references cited as ISO/IEC 19790 and ISO/IEC 24759. The specific editions to be used are ISO/IEC 19790:2012 and ISO/IEC 24759:2017. Please note that the version 19790:2012 referenced here includes the corrections made in 2015. National Institute of Standards and Technology (2019) Security Requirements for Cryptographic Modules . (U.S. Department of Commerce, Washington, DC), Federal Information Processing Standards Publication (FIPS) 140-3.

Cryptographic Module Validation Program (CMVP)-Approved Security Functions_ CMVP Validation Authority Updates to ISO_IEC 24759


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Security Assessment?

[Assistant]
According to Status Report on the First Round of the Additional Digital Signature Schemes for the NIST Post-Quantum Cryptography Standardization Process:

NIST is  in  the process of evaluating public-key digital signature algorithms for potential
standardization to protect sensitive information into the foreseeable future, including after
the advent of quantum computers. Any signature scheme that is eventually selected would
augment FIPS 204, Module-Lattice-Based Digital Signature Standard;  FIPS 205, Stateless
Hash-Based Digital Signature Standard; FIPS 186-5, Digital Signature Standard (DSS); and
SP 800-208, Recommendation for Stateful Hash-Based Signature Schemes. This report de-
scribes the evaluation criteria and selection process of the First Round of the Additional
Digital Signatures for the NIST Post-Quantum Cryptography (PQC) Standardization Process.
Based on public feedback and internal reviews of the first-round candidates, NIST selected
14 candidate algorithms to move forward to the second round of evaluation: CROSS, FAEST,
HAWK, LESS, MAYO, Mirath (merger of MIRA/MiRitH), MQOM, PERK, QR-UOV, RYDE, SDitH,
SNOVA, SQIsign, and UOV.

2. Evaluation Criteria and the Selection Process . . . . . . . . . . . . . . . . . . . . . .

Evaluation Criteria . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Status Report on the First Round of the Additional Digital Signature Schemes for the NIST Post-Quantum Cryptography Standardization Process


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AC.L2-3.1.2 (NIST 3.1.2)?

[Assistant]
According to Guidelines for Media Sanitization:

3.1.2. 3.1.2), and destroy (see Sec. 3.1.2) or destroy (see Sec.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Recommendation for Pair-Wise Key-Establishment Schemes Using Discrete Logarithm Cryptography provide? (Part 10)

[Assistant]
.................................................................... | Nonce............................................................................................................................
| 21                                                                                |
| 5.5                                                                                | Domain Parameters........................................................................................................ | Domain Parameters........................................................................................................ | 23                                                                                |
|                                                                                | 5.5.1                                                                                | Domain-Parameter Selection/Generation .......................................................... | 23                                                                                |
|                                                                                |                                                                                | 5.5.1.1 FFC Domain Parameter Selection/Generation....................................

Recommendation for Pair-Wise Key-Establishment Schemes Using Discrete Logarithm Cryptography


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 2 require for Configuration Management?

[Assistant]
According to Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations:

| Table 1. Security Requirement Families .......................................................................................................4          |
|----------------------------------------------------------------------------------------------------------------------------------------------------------|
| Table 2. Security Control Tailoring Criteria.................................................................................................93          |
| Table 3. Access Control (AC) .......................................................................................................................93   |
| Table 4. Awareness and Training (AT).........................................................................................................94          |
| Table 5. Audit and Accountability (AU).......................................................................................................95          |
| Table 6. Assessment, Authorization, and Monitoring (CA).........................................................................95                       |
| Table 7. Configuration Management (CM).................................................................................................96                |
| Table 8. Contingency Planning (CP) ............................................................................................................96        |
| Table 9. Identification and Authentication (IA) ..........................................................................................97             |
| Table 10. Incident Response (IR).................................................................................................................98      |
| Table 11. Maintenance (MA) ......................................................................................................................98      |
| Table 12.

Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Audit and Accountability?

[Assistant]
According to Organizational Views of NIST Cryptographic Standards and Testing and Validation Programs:

2 | Background: NIST Cryptographic Standards and Testing/Validation Programs ... 1 Methodology..........................................................................................................
2 |
| Study                                                                                | Study                                                                                | 2                                                                                |
| 3.2. Data Collection............................................................................................................ | 3.2. Data Collection............................................................................................................ | ................................................................................................................. 3                                                                                |
| 3.3. Data Analysis                                                                                | 3.3. Data Analysis                                                                                | .............................................................................................................. 3                                                                                |
|                                                                                | Participant and Organization Demographics...............................................................

Organizational Views of NIST Cryptographic Standards and Testing and Validation Programs


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Personnel Security?

[Assistant]
According to Analyzing Collusion Threats in the Semiconductor Supply Chain:

This implies that threat analysis must consider both the type of threat and the various phases of the supply chain in which the threat is most effective. Moreover, one or more adversaries from different stages of supply chain can collaborate to compromise a hardware, which increases the severity of threats. Such insider threats are called collusion threats [6]. This work proposes a framework for analyzing different threats and how collusion among adversaries can affect the severity of threats. This analysis is divided into five distinct stages that discuss adversaries' intent, access, and resources, and how their collusion affects the severity of different threats. The framework is shown in Fig. 2. The framework incorporates threats across all stages of supply chain including insider threats. - [1] DARPA (2020) DARPA Selects Teams to Increase Security of Semiconductor Supply Chain. Available at https://www.darpa.mil/news/2020/semiconductor-supply-chainsecurity
- [2] DARPA (2021) Expanding Domestic Manufacturing of Secure, Custom Chips for Defense Needs. Available at https://www.darpa.mil/news-events/2021-03-18
- [3] NSWC Crane Corporate Communications (2019) NSWC Crane leverages OTA to ensure that the U.S. Government has access to secure state-of-the-art design, assembly, packaging and test for state-of-the-art microelectronics. Available at https://www.navsea.navy.mil/Media/News/Article/2005099/nswc-crane-leverages-otato-ensure-that-the-us-government-has-access-to-secure/
- [4] Institute for Systems Research (2020) AFRL-Northrop Grumman: Locked Electronics for Assured Design (LEAD): Delay Locking ASIC IP Blocks to Protect Functionality. Available at https://isr.umd.edu/research-funding/afrl-northrop-grumman-locked-electronicsassured-design-lead-delay-locking-asic-ip
- [5] Wolfe F (2020) Aether Spy Next-Generation Multi-Function Radar to Advance, Northrop Grumman Says. Defense Daily .

Analyzing Collusion Threats in the Semiconductor Supply Chain


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Maintenance?

[Assistant]
According to Control Baselines for Information Systems and Organizations:

| ORGANIZATIONAL RESPONSIBILITIES .........................................................................................
| 2                                                                                |
| 1.4                                                                                | RELATIONSHIPTOOTHERPUBLICATIONS ................................................................................... | 3                                                                                |
| 1.5                                                                                | REVISIONSANDEXTENSIONS .................................................................................................... | 3                                                                                |
| 1.6                                                                                | PUBLICATIONORGANIZATION .................................................................................................. | 3                                                                                |
| CHAPTERTWO THE FUNDAMENTALS............................................................................................ 5                     | CHAPTERTWO THE FUNDAMENTALS............................................................................................ 5                     | CHAPTERTWO THE FUNDAMENTALS............................................................................................

Control Baselines for Information Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Guide to Malware Incident Prevention and Handling for Desktops and Laptops provide? (Part 7)

[Assistant] | 1 | | 1.1 | | Purpose and Scope...................................................................................................1 | | | | 1.2 | Audience ...................................................................................................................1 | | | | 1.3 | Document Structure | ..................................................................................................1 | | 2.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Planning?

[Assistant]
According to High-Performance Computing Security_ Architecture, Threat Analysis, and Security Posture:

There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may be used by federal agencies even before the completion of such companion publications. Thus, until each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning and transition purposes, federal agencies may wish to closely follow the development of these new publications by NIST.

HPC file systems in the data storage zone provide superior data access speed and much larger storage capacity compared to average enterprise file systems. Hard disk failure is a threat due to the large number of disks deployed in the data storage zone. Incident response and contingency planning controls may not be easy to implement, and file backup, recovery, and forensic imaging may become infeasible. The security measures that can be implemented on the enterprise file systems may take an unacceptably long time and degrade HPC file system performance in an unacceptable way.

High-Performance Computing Security_ Architecture, Threat Analysis, and Security Posture


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice CM.L2-3.4.4 (NIST 3.4.4)?

[Assistant]
According to Digital Identity Guidelines:

3.4.4. 3.4.4). 3.4.4)
with a defined and implementable set of assurance levels and a final set of
controls for the online service.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Ascon-Based Lightweight Cryptography Standards for Constrained Devices_ Authenticated Encryption, Hash, and Extendable Output Functions provide? (Part 5)

[Assistant]
However, holders of patents are not obligated to respond to ITL calls for patents and ITL has not undertaken a patent search in order to identify which, if any, patents may apply to this publication.
As of the date of publication and following call(s) for the identification of patent claims whose use may be required for compliance with the guidance or requirements of this publication, no such patent claims have been identified to ITL. No representation is made or implied by ITL that licenses are not required to avoid patent infringement in the use of this publication. ## Table of Contents

| 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . |   1 |
|-----------------------------------------------------------------------------------------------------------------------------------------------------------------|-----|
| 2. Preliminaries.......................................................................... |   3 |
| 2.1. Auxiliary Functions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . |   7 |
| 3. Ascon Permutations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . |   8 |
| 3.1. Internal State . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . |   8 |
| 3.2. Constant-Addition Layer 𝑝 𝐶 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . |   8 |
| 3.3. Substitution Layer 𝑝 𝑆 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . |   9 |
| 3.4. Linear Diffusion Layer 𝑝 𝐿 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . |  10 |
| 4.

Ascon-Based Lightweight Cryptography Standards for Constrained Devices_ Authenticated Encryption, Hash, and Extendable Output Functions


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Awareness and Training?

[Assistant]
According to Guide to Auditing for Controls and Security_ A System Development Life Cycle Approach:

| 2.1 | BACKGROUND | BACKGROUND | BACKGROUND | 16 | |-------|------------------------------------------------------------|------------------------------------------------------------|------------------------------------------------------------|------| | | 2.1.1 | PCIE - EDP Systems Review and Security Work Group | PCIE - EDP Systems Review and Security Work Group | 16 | | | 2.1.2 | System Development Life Cycle | System Development Life Cycle | 16 | | 2.2 | OPERATING ENVIRONMENT | OPERATING ENVIRONMENT | OPERATING ENVIRONMENT | 17 | | | 2.2.1 IRM Planning and Implementation of Policy Guidelines | 2.2.1 IRM Planning and Implementation of Policy Guidelines | 2.2.1 IRM Planning and Implementation of Policy Guidelines | 17 | | | 2.2.1.1 IRM Planning | 2.2.1.1 IRM Planning | 2.2.1.1 IRM Planning | 17 | | | 2.2.1.2 Using Policy/Procedures/Standards | 2.2.1.2 Using Policy/Procedures/Standards | 2.2.1.2 Using Policy/Procedures/Standards | 18 | | | 2.2.1.2.1 | 2.2.1.2.1 | References Used by the Life Cycle Matrix | 19 | | | 2.2.1.2.2 | 2.2.1.2.2 | Major GSA References | 21 | | | 2.2.2 AIS Development Methodologies | 2.2.2 AIS Development Methodologies | 2.2.2 AIS Development Methodologies | 21 | | | 2.2.3 Project Administration and Control | 2.2.3 Project Administration and Control | 2.2.3 Project Administration and Control | 23 |

Guide to Auditing for Controls and Security_ A System Development Life Cycle Approach


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for Identification and Authentication?

[Assistant]
According to Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171:

| CHAPTERONE INTRODUCTION...................................................................................................... | CHAPTERONE INTRODUCTION...................................................................................................... |
|--------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------|
| 1.1 PURPOSEANDAPPLICABILITY                                                                                | ................................................................................................... 3                                            |
| 1.2 TARGET AUDIENCE                                                                                | .................................................................................................................. 4                             |
| 1.3 ORGANIZATIONOF THIS SPECIAL PUBLICATION                                                                                | .......................................................................... 4                                                                     |
| CHAPTERTWO THE FUNDAMENTALS............................................................................................ 5                        | CHAPTERTWO THE FUNDAMENTALS............................................................................................ 5                        |
| 2.1 DEVELOPMENTAPPROACH ......................................................................................................

Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Information Integrity?

[Assistant]
According to Planning for a Zero Trust Architecture_ A Planning Guide for Federal Administrators:

l enterprise resources is granted on a per -session basis. In an ideal zero trust architecture, every unique operation would undergo authentication and authorization before the operation is performed.
For example, a delete operation following a read operation to a database should trigger an additional authentication and authorization check. This level of granularity may not always possible and other mitigating solutions such as logging and backups, may be needed to detect and recover from unauthorized operations. Enterprise administrators will need to plan how to enforce fine grain access policies on individual resources. If the security tools used by

Planning for a Zero Trust Architecture_ A Planning Guide for Federal Administrators


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Personnel Security?

[Assistant]
According to Audit and Evaluation of Computer Security:

that plans are made for controls against theft and error, appropriate
audit trails, conformity with management objectives and with the law,
sufficient documentation, appropriate design approval mechanisms, and
general efficiency and economy.
dit would check that the application conforms to standards and the la-
test design specifications, and that the internal controls and reliabil
ity of data are sound.
area, audit would verify that the organization structure, the physical
facilities, the personnel management, the back-up capability, and the
software/hardware controls all help meet management's objectives.

4. Management controls to ensure that security objectives are
achieved fit into three categories— policies that are formulated
at the top, procedures for administrative, physical, and technical
security measures, and practices for the standard management ac-
tivities .
5. ADP security controls should include a) administrative safe-
guards in the form of contingency plans, security documentation,
authorization control lists, program access controls, personnel
rules; b) physical security safeguards such as area restrictions,
disaster back-up, storage libraries, disposal procedures; and c)
technical security in the form of a security system to handle data
and files, program libraries, operating system(s), teleprocessing,
and encryption.
6. Training is needed for systems people as well as users.

Administrative Services at the American In-
stitute of Certified Public Accountants, with
responsibility for internal applications of
the computer as well as development of its
use in the accounting and auditing practices
His administrative responsibil-
of members.
ities include Personnel, Purchasing, Office
Management, Printing and Shipping.
member of AICPA, he has served on a number of
its committees in the computer area, in-
cluding the chairmanship of the EDP Auditing
He is a former member of the
Committee.
Computer Committee of the New York State
Society of CPA's.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 1 require for Incident Response?

[Assistant]
According to IoT Non-Technical Supporting Capability Core Baseline:

| Non-Technical Supporting Capability | Common Actions | Rationale | IoT Reference Examples | |---------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------| | Documentation ( continued ) | 4.

IoT Non-Technical Supporting Capability Core Baseline


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Audit and Accountability?

[Assistant]
According to Protecting Information and System Integrity in Industrial Control System Environments_ Cybersecurity for the Manufacturing Sector:

| 5.2.1   | Scenario 1: Protect Host from Malware Infection via USB..................................... | 37     |
|---------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------|
| 5.2.2   | Scenario 2: Protect Host from Malware Infection via Network Vector.................. | 37     |
| 5.2.3   | Scenario 3: Protect Host from Malware via Remote Access Connections ............. | 39     |
| 5.2.4   | Scenario 4: Protect Host from Unauthorized Application Installation ................... | 40     |
| 5.2.5   | Scenario 5: Protect from Unauthorized Addition of a Device ................................ | 42     |
| 5.2.6   | Scenario 6: Detect Unauthorized Device-to-Device Communications................... | 43     |
| 5.2.7   | Scenario 7: Protect from Unauthorized Deletion of Files....................................... | 43     |
| 5.2.8   | Scenario 8: Detect Unauthorized Modification of PLC Logic.................................. | 45     |
| 5.2.9   | Scenario 9: Protect from Modification of Historian Data....................................... | 46     |
| 5.3.1   | PR.AC-1: Identities and Credentials are Issued, Managed, Verified, Revoked, and Audited for Authorized Devices, Users, and Processes........................ | 50     |
| 5.3.2   | PR.AC-3: Remote Access is Managed ..................................................................... | 50     |
| 5.3.3   | PR.AC-4: Access Permissions and Authorizations are Managed, Incorporating the Principles of Least Privilege and Separation of Duties .........................

Protecting Information and System Integrity in Industrial Control System Environments_ Cybersecurity for the Manufacturing Sector


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Awareness and Training?

[Assistant]
According to Digital Identity Guidelines_ Authentication and Authenticator Management:

2.3.2. Authenticator and Verifier Requirements . . . . . . . . . . . . .

3.2. General Authenticator Requirements . . . . . . . . . . . . . . . . . . .

3.2.1. Physical Authenticators

Digital Identity Guidelines_ Authentication and Authenticator Management


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Transitioning to the Security Content Automation Protocol (SCAP) Version 2 provide? (Part 8)

[Assistant]
hed in 2009. Since this initial version, there have been three SCAP v1 revisions. The current revision, SCAP 1.3, was released in February 2018 as NIST Special Publication (SP) 800-126 Revision 3 [2].
Over its lifetime, a few critical gaps have been identified in SCAP v1 that need to be addressed to provide a more robust solution:

Limited Coverage of Endpoint Types: Maintaining an adequate level of security for enterprise managed endpoints requires up-to-date knowledge of the posture of those devices. SCAP v1 has focused largely on desktops, laptops, and servers, leaving network (i.e., routers, switches, firewalls), mobile, and Internet of Things (IoT) devices lacking in support or not supported. In today's network, these under-supported devices are an increasing area of security risk that must be managed and protected. Stale Security Posture Information: Many SCAP v1 implementations use a periodic scanning approach when collecting and evaluating endpoint posture. Relying on periodic scanning allows critical security-relevant events to go unnoticed for lengthy periods of time. Even worse, attackers can clean up after themselves between collections, preventing detection. This reduces visibility of security-relevant changes and can create a false sense of security for enterprises. No Component-level Interoperability: SCAP v1 products that support different use cases often require similar information, such as software inventory and configuration information. While SCAP v1 supports data interoperability, control of collected posture information and evaluation remains with each tool. The lack of standardized interfaces between tools prevents transport layer interoperability, forces redundant posture information collection and evaluation that adds to system and network load, reduces modularity of solutions, and increases integration costs.

Transitioning to the Security Content Automation Protocol (SCAP) Version 2


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Audit and Accountability?

[Assistant]
According to NIST Cybersecurity Framework 2.0_ Quick-Start Guide for Cybersecurity Supply Chain Risk Management (C-SCRM):

☐ Include C-SCRM responsibilities and performance requirements in personnel descriptions to ensure clarity and improve accountability.

NIST Cybersecurity Framework 2.0_ Quick-Start Guide for Cybersecurity Supply Chain Risk Management (C-SCRM)


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Communications Protection?

[Assistant]
According to Recommendation for Pair-Wise Key-Establishment Schemes Using Discrete Logarithm Cryptography:

## Recommendation for Pair-Wise Key-Establishment Schemes Using Discrete Logarithm Cryptography

## Establishment Schemes Using Discrete Logarithm Cryptography

Diffie-Hellman; elliptic curve cryptography; finite field cryptography; key agreement; key confirmation; key derivation; key establishment; MQV.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Physical Protection?

[Assistant]
According to Cryptographic Module Validation Program (CMVP) Security Policy Requirements_ CMVP Validation Authority Updates to ISO_IEC 24759 and ISO_IEC 19790 Anne:

learly defined and
- o The interactions of the logical object of the software or firmware module with the operating system and other supporting applications resident within the cryptographic boundary.
- o Tested Operational Environment's Physical Perimeter (TOEPP) - The location of the cryptographic module with respect to the TOEPP that is part of the module's tested configuration but may be outside of the module's cryptographic boundary so that all of the logical and physical layers between the cryptographic module and the TOEPP are clearly defined. This also includes a description and components list of the TOEPP. - Precise definition of the module's physical TOEPP and cryptographic boundariesy

Cryptographic Module Validation Program (CMVP) Security Policy Requirements_ CMVP Validation Authority Updates to ISO_IEC 24759 and ISO_IEC 19790 Anne


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Services Acquisition?

[Assistant]
According to Guide to a Secure Enterprise Network Landscape:

There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may be used by federal agencies even before the completion of such companion publications. Thus, until each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning and transition purposes, federal agencies may wish to closely follow the development of these new publications by NIST. The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the Nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology. ITL's responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in federal information systems. The Special Publication 800-series reports on ITL's research, guidelines, and outreach efforts in information system security, and its collaborative activities with industry, government, and academic organizations.

Guide to a Secure Enterprise Network Landscape


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Maintenance?

[Assistant]
According to Strategies for the Integration of Software Supply Chain Security in DevSecOps CI_CD Pipelines:

..................................9 |
| 3.1.4. Attack Targets (Assets).................................................................................................................9      |
| 3.1.5.
Types of Exploits.........................................................................................................................10   |
| 3.2.1. Baseline Security ........................................................................................................................11   |
| 3.2.2. Controls for Interacting With SCM Systems...............................................................................12                     |
| 4. CI/CD Pipelines -Background, Security Goals, and Entities to be Trusted .....................................13                                    |
| 5. Integrating SSC Security Into CI/CD Pipelines.................................................................................15                   |
| 5.1.1. Secure Build................................................................................................................................16 |
| 5.1.2. Secure Pull-Push Operations on Repositories............................................................................17                      |
| 5.1.3. Integrity of Evidence Generation During Software Updates......................................................18                               |
| 5.1.4. Secure Code Commits ................................................................................................................19         |

Strategies for the Integration of Software Supply Chain Security in DevSecOps CI_CD Pipelines


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice IA.L2-3.5.1 (NIST 3.5.1)?

[Assistant]
According to Digital Identity Guidelines:

3.5.1. 3.5.1.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Access Control?

[Assistant]
According to Guide to Malware Incident Prevention and Handling for Desktops and Laptops:

teristics. In other environments, especially those in which users have full control over their hosts and network management is not centralized, it might be challenging to link a machine to a location.
For example, an administrator might know that the host at address 10.3.1.70 appears to be infected but not have any idea where that machine resides or who uses it. Administrators might need to track down an infected host through network devices. For example, a switch port mapper can poll switches for a particular IP address and identify the switch port number and host name associated with that IP address. If the infected host is several switches away, it can take hours to track down a single machine; if the infected host is not directly switched, the administrator might still need to manually trace connectivity through various wiring closets and network devices. An alternative is to pull the network cable or shut down the switch port for an apparently infected host and wait for a user to report an outage. This approach can inadvertently cause a loss of connectivity for small numbers of uninfected hosts, but if performed carefully as a last-resort identification and containment method, it can be quite effective.

Guide to Malware Incident Prevention and Handling for Desktops and Laptops


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Assessing Enhanced Security Requirements for Controlled Unclassified Information provide? (Part 4)

[Assistant]
ederal systems and organizations is important to federal agencies and can directly impact the ability of the Federal Government to successfully carry out its assigned missions and business operations.
This publication provides federal agencies and nonfederal organizations with assessment procedures that can be used to carry out assessments of the requirements in NIST Special Publication 800172, Enhanced Security Requirements for Protecting Controlled Unclassified Information: A Supplement to NIST Special Publication 800-171 . The assessment procedures are flexible and can be tailored to the needs of organizations and assessors. Assessments can be conducted as 1) self-assessments; 2) independent, third-party assessments; or 3) government-sponsored assessments. The assessments can be conducted with varying degrees of rigor based on customer-defined depth and coverage attributes. The findings and evidence produced during the assessments can be used to facilitate risk-based decisions by organizations related to the CUI enhanced security requirements. ## Keywords

assessment; assessment method; assessment object; assessment procedure; assurance; enhanced security requirement; enhanced security requirement assessment; Controlled Unclassified Information; coverage; CUI Registry; depth; Executive Order 13556; FISMA; NIST Special Publication 800-53; NIST Special Publication 800-53A; NIST Special Publication 800-171; NIST Special Publication 800-172; NIST Special Publication 800-172A; nonfederal organization; nonfederal system; security assessment; security control.

Assessing Enhanced Security Requirements for Controlled Unclassified Information


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Risk Assessment?

[Assistant]
According to Federal Cybersecurity Role-Based Training Approaches, Successes, and Challenges:

activities. In addition to federal personnel, RBT applies to contractors providing services to federal organizations. 'Training for a 'new in role' and 'refresher training' needs are quite different.
'New in role' training needs to establish foundations for success not just a lecture on responsibilities. 'Refresher training' needs to focus on recent changes (e.g., in guidance, threat categories) and how to remain effective in the role. Nothing loses the audience faster than providing 'new in role' training to people that have been doing this for years.' (Q23)

Federal Cybersecurity Role-Based Training Approaches, Successes, and Challenges


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 1 require for Incident Response?

[Assistant]
According to IoT Non-Technical Supporting Capability Core Baseline:

Document maintenance requirements for the IoT device, such as: a. Cybersecurity maintenance expectations and associated instructions or procedures for the customer (e.g., account management, local and/or remote maintenance activities, and vulnerability/patch management plan) b. When maintenance will be performed by supporting parties that will need access (remote or onsite) to customer's IoT devices and their information security contract requirements c. Cybersecurity considerations of the maintenance process (e.g., how does customer data unrelated to the maintenance process remain confidential even to maintainers) | • Documentation of cybersecurity information enables better understanding of the potential risks related to the IoT device, which can inform customers and others in the IoT device ecosystem and guide on- going risk mitigation support. • Documentation helps personnel with the responsibility of securing IoT devices within the system understand the implementation and operation of controls and prevent misuse and compromise by unauthorized entities. • Documentation may be used to supply information about and support the management of supply chain risk, incident response, and other critical cybersecurity functions. | ( see above)             |


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Cryptographic Module Validation Program (CMVP)-Approved Security Functions_ CMVP Validation Authority Updates to ISO_IEC 24759 provide? (Part 6)

[Assistant]
e of Standards and Technology (2019) Security Requirements for Cryptographic Modules . (U.S. Department of Commerce, Washington, DC), Federal Information Processing Standards Publication (FIPS) 140-3.
https://doi.org/10.6028/NIST.FIPS.140-3

## Terms and definitions

The following terms and definitions supersede or are in addition to ISO/IEC 19790. None at this time

## Symbols and abbreviated terms

The following symbols and abbreviated terms supersede or are in addition to ISO/IEC 19790 and ISO/IEC 24759 throughout this document:

## CMVP

Cryptographic Module Validation Program

## FIPS

Federal Information Processing Standard

## ISO/IEC

International Organization for Standardization/International Electrotechnical Commission

## Document organization

## General

Section 6 of this document replaces the approved security functions of ISO/IEC 19790 Annex C and ISO/IEC 24759 paragraph 6.15. This document also supersedes SP 800-140Cr1. ## Modification

This publication is a complete replacement of the approved security functions of ISO/IEC 19790 Annex C and ISO/IEC 24759 paragraph 6.15. There are no other modifications, additions, or deletions. ## CMVP-approved security function requirements

## Purpose

This document identifies CMVP-approved security functions. It precludes the use of all other security functions. ## Approved security functions

For the current list of CMVP-approved security functions, see https://csrc.nist.gov/projects/cmvp/sp800-140c. ## Appendix A.

Cryptographic Module Validation Program (CMVP)-Approved Security Functions_ CMVP Validation Authority Updates to ISO_IEC 24759


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Services Acquisition?

[Assistant]
According to Incident Response Recommendations and Considerations for Cybersecurity Risk Management_ A CSF 2.0 Community Profile:

| CSF Element | CSF Element Description | Priority | Recommendations, Considerations, Notes assist with maintaining cross-references | |---------------------|-----------------------------------------------------------------------------------------------------------------------------------------------|------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | ID.RA-09 | The authenticity and integrity of hardware and software are assessed prior to acquisition and use | Medium | N1: See the notes for ID.RA.

Incident Response Recommendations and Considerations for Cybersecurity Risk Management_ A CSF 2.0 Community Profile