[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does A Zero Trust Architecture Model for Access Control in Cloud-Native Applications in Multi-Cloud Environments provide? (Part 8)

[Assistant]
| .........................................................................................................
4                                                            |
|                                                                                | Organization of This Document .................................................................................. | 4                                                                                |
|                                                                                | The Enterprise Cloud-Native Platform and its Components......................................... | 5                                                                                |
|                                                                                | Enterprise Infrastructure Layer ...................................................................................

A Zero Trust Architecture Model for Access Control in Cloud-Native Applications in Multi-Cloud Environments


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Audit and Accountability?

[Assistant]
According to Data Integrity_ Detecting and Responding to Ransomware and Other Destructive Events:

- event detection
- integrity monitoring
- logging
- reporting
- mitigation and containment
- forensics/analytics

-  detect malicious and suspicious activity generated on the network, by users, or from applications that could indicate a DI event
-  mitigate and contain the effects of events that can cause a loss of DI
-  monitor the integrity of the enterprise for detection of events and after-the-fact analysis
-  utilize logging and reporting features to speed response time to DI events
-  analyze DI events for the scope of their impact on the network, enterprise devices, and enterprise data
-  analyze DI events to inform and improve the enterprise's defenses against future attacks

- logging
- reporting
- mitigation and containment
- forensics/analytics

Data Integrity_ Detecting and Responding to Ransomware and Other Destructive Events


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Guide for Developing Security Plans for Federal Information Systems provide? (Part 3)

[Assistant]
Plans for Information Technology System. The original document was used as the foundation for this revision. Additionally, thank you to all the NIST staff that reviewed and commented on the document.
iv

## Table of Contents

| EXECUTIVE SUMMARY.......................................................................................................... | VII                                                                                |
|--------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------|
| 1. INTRODUCTION ........................................................................................................................ | 1                                                                                |
| 1.1 BACKGROUND............................................................................................................................ | 1                                                                                |
| 1.2 TARGET AUDIENCE.................................................................................................................... | 1                                                                                |
| 1.3 ORGANIZATION OF DOCUMENT.................................................................................................. | 1                                                                                |
| 1.4 SYSTEMS INVENTORY AND FEDERAL INFORMATION PROCESSING STANDARDS (FIPS 199)                                                              | ......

Guide for Developing Security Plans for Federal Information Systems

Audit and Accountability
System and Information Integrity
Security Assessment
Media Protection
Identification and Authentication
Awareness and Training
System and Communications Protection
Access Control
Planning
Incident Response
Risk Assessment
Personnel Security
System and Services Acquisition
Supply Chain Risk Management
Maintenance
Physical Protection
Configuration Management


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Automated Secure Configuration Guidance from the macOS Security Compliance Project (mSCP) provide? (Part 2)

[Assistant]
ral agencies even before the completion of such companion publications. Thus, until each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative.
For planning and transition purposes, federal agencies may wish to closely follow the development of these new publications by NIST. Organizations are encouraged to review all draft publications during public comment periods and provide feedback to NIST. Many NIST cybersecurity publications, other than the ones noted above, are available at https://csrc.nist.gov/publications. ## Authority

This publication has been developed by NIST in accordance with its statutory responsibilities under the Federal Information Security Modernization Act (FISMA) of 2014, 44 U.S.C. § 3551 et seq., Public Law (P.L.) 113-283. NIST is responsible for developing information security standards and guidelines, including minimum requirements for federal information systems, but such standards and guidelines shall not apply to national security systems without the express approval of appropriate federal officials exercising policy authority over such systems. This guideline is consistent with the requirements of the Office of Management and Budget (OMB) Circular A-130. Nothing in this publication should be taken to contradict the standards and guidelines made mandatory and binding on federal agencies by the Secretary of Commerce under statutory authority. Nor should these guidelines be interpreted as altering or superseding the existing authorities of the Secretary of Commerce, Director of the OMB, or any other federal official. This publication may be used by nongovernmental organizations on a voluntary basis and is not subject to copyright in the United States. Attribution would, however, be appreciated by NIST.

Automated Secure Configuration Guidance from the macOS Security Compliance Project (mSCP)


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Physical Protection?

[Assistant]
According to Access Control on NoSQL Databases:

The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the Nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology. ITL's responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in federal information systems.

In reality, a federated community may be networked in a variety of architectures. The three basic services may be incorporated or simplified such that more than one service is managed or hosted in one physical system. However, these three services and their connections are assumed to be essential for any resource-sharing federation, and the resource-sharing protocols between them are composed by interlacing the following scenarios:


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Physical Protection?

[Assistant]
According to Secure Software Development Framework (SSDF) Version 1.1_ Recommendations for Mitigating the Risk of Software Vulnerabilities:

The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the Nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology. ITL's responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in federal information systems. The Special Publication 800-series reports on ITL's research, guidelines, and outreach efforts in information system security, and its collaborative activities with industry, government, and academic organizations. - Can be used by organizations in any sector or community, regardless of size or cybersecurity sophistication
- Can be applied to software developed to support information technology (IT), industrial control systems (ICS), cyber-physical systems (CPS), or the Internet of Things (IoT)
- Can be integrated into any existing software development workflow and automated toolchain; should not negatively affect organizations that already have robust secure software development practices in place
- Makes the practices broadly applicable, not specific to particular technologies, platforms, programming languages, SDLC models, development environments, operating environments, tools, etc.

Secure Software Development Framework (SSDF) Version 1.1_ Recommendations for Mitigating the Risk of Software Vulnerabilities


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Likely Exploited Vulnerabilities_ A Proposed Metric for Vulnerability Exploitation Probability provide? (Part 6)

[Assistant]
| List of Figures                                                                                |
| Fig. 1.
Cumulative distribution of LEV probabilities (3/6/2025)..........................................................16                         | Fig. 1. Cumulative distribution of LEV probabilities (3/6/2025)..........................................................16                         |
| Fig. 2. LEV distribution using binning ................................................................................................17           | Fig. 2. LEV distribution using binning ................................................................................................17           |
| Fig. 3. LEV Distribution using binning (excluding bins of less than 0.03)..............................................17                           | Fig. 3. LEV Distribution using binning (excluding bins of less than 0.03)..............................................17                           |
| Fig. 4. Recall measurements for LEV and CISA KEV ............................................................................19                     | Fig. 4. Recall measurements for LEV and CISA KEV ............................................................................19                     |
| Fig. 5. EPSS Performance, graph copied from [4] ...............................................................................23                   | Fig. 5. EPSS Performance, graph copied from [4] ...............................................................................23                   |

## 1. Introduction

This work provides a novel security metric to determine the likelihood that a vulnerability has been observed to be exploited. Only a small fraction of the tens of thousands of software and hardware vulnerabilities that are published every year will be exploited.

Likely Exploited Vulnerabilities_ A Proposed Metric for Vulnerability Exploitation Probability


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice IA.L2-3.5.1 (NIST 3.5.1)?

[Assistant]
According to Audit and Evaluation of Computer Security:

3.5.1
3. 3.5.1

Select the Verification Techniques

In general, two approaches can be applied in verifying controls and

processing:

-Test of results:

Select one or more key files or outputs of pro-

cessing and confirm the results. 3.5.1 .

Audit and Evaluation of Computer Security


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for Maintenance?

[Assistant]
According to Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171:

| CHAPTERONE INTRODUCTION...................................................................................................... | CHAPTERONE INTRODUCTION...................................................................................................... |
|--------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------|
| 1.1 PURPOSEANDAPPLICABILITY                                                                                | ................................................................................................... 3                                            |
| 1.2 TARGET AUDIENCE                                                                                | .................................................................................................................. 4                             |
| 1.3 ORGANIZATIONOF THIS SPECIAL PUBLICATION                                                                                | .......................................................................... 4                                                                     |
| CHAPTERTWO THE FUNDAMENTALS............................................................................................ 5                        | CHAPTERTWO THE FUNDAMENTALS............................................................................................ 5                        |
| 2.1 DEVELOPMENTAPPROACH ......................................................................................................

Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AT.L2-3.2.3 (NIST 3.2.3)?

[Assistant]
According to High-Performance Computing Security_ Architecture, Threat Analysis, and Security Posture:

3.2.3. 3.2.3.

High-Performance Computing Security_ Architecture, Threat Analysis, and Security Posture


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations provide? (Part 3)

[Assistant]
l official. This publication may be used by nongovernmental organizations on a voluntary basis and is not subject to copyright in the United States. Attribution would, however, be appreciated by NIST.
## NIST Technical Series Policies

Copyright, Use, and Licensing Statements NIST Technical Series Publication Identifier Syntax

## Publication History

Approved by the NIST Editorial Review Board on 2024-09-25 Supersedes NIST Special Publication 800-161r1 (May 2022) https://doi.org/10.6028/NIST.SP.800-161r1

## How to Cite this NIST Technical Series Publication

Boyens J, Smith A, Bartol N, Winkler K, Holbrook A, Fallon M (2022) Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) NIST SP 800-161r1-upd1, Includes updates as of Novem ber 1, 2024. https://doi.org/10.6028/NIST.SP.800-161r1-upd1

## Author ORCID iDs

Jon Boyens: 0000-0002-5666-8750

## Contact Information

scrm-nist@nist.gov

National Institute of Standards and Technology Attn: Computer Security Division, Information Technology Laboratory 100 Bureau Drive (Mail Stop 8930) Gaithersburg, MD 20899-8930

## Additional Information

Additional information about this publication is available at https://csrc.nist.gov/pubs/sp/800/161/r1/upd1/final, including related content, potential updates, and document history. All comments are subject to release under the Freedom of Information Act (FOIA). ## Abstract

Organizations are concerned about the risks associated with products and services that may potentially contain malicious functionality, are counterfeit, or are vulnerable due to poor manufacturing and development practices within the supply chain.

Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Access Control?

[Assistant]
According to Federal Cybersecurity Awareness Programs_ A Mixed Methods Research Study:

|                                                                                | INTRODUCTION................................................................................................................. 1           | INTRODUCTION................................................................................................................. 1           |
|-------------------------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------|
| 2                                                                                | STUDY METHODOLOGY................................................................................................. 2                      | STUDY METHODOLOGY................................................................................................. 2                      |
| 2.1 FOCUS GROUP METHODOLOGY............................................................................................ 3                 | 2.1 FOCUS GROUP METHODOLOGY............................................................................................ 3                 | 2.1 FOCUS GROUP METHODOLOGY............................................................................................ 3                 |
| 2.1.1                                                                                | Focus Group Design...................................................................................................

Federal Cybersecurity Awareness Programs_ A Mixed Methods Research Study


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Summary of NIST SP 800-53, Revision 4_ Security and Privacy Controls for Federal Information Systems and Organizations provide? (Part 2)

[Assistant] ## Table of Contents | 1 | Introduction ............................................................................................................1 | |------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------| | 2 | NIST SP 800-53 Revision 4 and the Risk Management Framework (RMF)........2 | | 3 | Control Baselines and Tailoring ...........................................................................4 | | 4 | Documenting the Control Selection Process ......................................................5 | | 5 | Assurance...............................................................................................................6 | | 6 | Security Controls ...................................................................................................7 | | 7 | International Information Security Standards .....................................................8 | | 8 | Overlays..................................................................................................................9 | | 9 | Privacy ..................................................................................................................10 | | List of Figures | List of Figures | | Figure 1: Risk Management 3-Tiered Approach.........................................................2 | Figure 1: Risk Management 3-Tiered Approach.........................................................2 | | Figure 2: The Risk Management Framework ..............................................................3 | Figure 2: The Risk Management Framework ..............................................................3 | | Figure 3: Security Control Selection Process ............................................................5 | Figure 3: Security Control Selection Process ............................................................5 | ## 1 Introduction In April, 2013, NIST published an update, Revision 4, to NIST Special Publication 800-53, Security and Privacy Controls for Federal Information Systems and Organization .

Summary of NIST SP 800-53, Revision 4_ Security and Privacy Controls for Federal Information Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Planning?

[Assistant]
According to Access Control on NoSQL Databases:

There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may be used by federal agencies even before the completion of such companion publications. Thus, until each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning and transition purposes, federal agencies may wish to closely follow the development of these new publications by NIST.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What are the CMMC Level 3 requirements?

[Assistant]
According to Protecting Controlled Unclassified Information (CUI)_ NIST Special Publication 800-171, Revision 3. Small Business Primer:

<!-- image -->

<!-- image -->

Howard Lutnick, Secretary of Commerce

<!-- image -->

Protecting Controlled Unclassified Information (CUI): NIST Special Publication 800-171, Revision 3 Small Business Primer

## Purpose of this Primer

This guide provides small businesses with an overview of NIST Special Publication (SP) 800-171 Revision 3, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations . The following pages contain:

- An overview of foundational components of SP 800-171
- A list of frequently asked questions and their answers
- Tips for getting started
- Related resources

## What is Controlled Unclassified Information (CUI)?*

CUI is information the government creates or possesses, or that an entity creates or possesses on behalf of the government, that law, regulation, or governmentwide policy requires you to take technical and operational steps to protect. Systems that process, store, and transmit CUI often support government programs involving sensitive critical assets. As part of a contractual agreement with the federal government, or possibly with other organizations like municipal governments, prime contractors, universities, etc., you will likely be required to demonstrate you are taking adequate measures to protect CUI.

Protecting Controlled Unclassified Information (CUI)_ NIST Special Publication 800-171, Revision 3. Small Business Primer


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 2 require for Incident Response?

[Assistant]
According to Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations:

| Table 1. Security Requirement Families .......................................................................................................4          |
|----------------------------------------------------------------------------------------------------------------------------------------------------------|
| Table 2. Security Control Tailoring Criteria.................................................................................................93          |
| Table 3. Access Control (AC) .......................................................................................................................93   |
| Table 4. Awareness and Training (AT).........................................................................................................94          |
| Table 5. Audit and Accountability (AU).......................................................................................................95          |
| Table 6. Assessment, Authorization, and Monitoring (CA).........................................................................95                       |
| Table 7. Configuration Management (CM).................................................................................................96                |
| Table 8. Contingency Planning (CP) ............................................................................................................96        |
| Table 9. Identification and Authentication (IA) ..........................................................................................97             |
| Table 10. Incident Response (IR).................................................................................................................98      |
| Table 11. Maintenance (MA) ......................................................................................................................98      |
| Table 12.

Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Status Report on the First Round of the Additional Digital Signature Schemes for the NIST Post-Quantum Cryptography Standardization Process provide? (Part 10)

[Assistant]
s that might cause some concern. This report focuses on the reasons why candidate algorithms were selected rather than
providing detailed justifications for why candidate algorithms were not selected.
Section 4 describes the next steps in the Additional Digital Signatures for the NIST PQC
Standardization Process, including provisions for allowable modifications to the second-
round candidates and the evaluation process for selecting finalists. 2

NIST IR 8528
October 2024

Additional Digital Signatures
First Round Status Report

2. Evaluation Criteria and the Selection Process

2.1. Acceptance of the First-Round Candidates

NIST received 50 candidate algorithm submission packages by the entry deadline of June
1, 2023. Of these, NIST accepted 40 first-round candidates that met both the submission
requirements and the minimum acceptability criteria for being “complete and proper sub-
missions,” as defined in [2]. Table 2. First-round digital signature candidates organized by category, with the
candidates selected to advance to the second round bolded and in blue. The starred
signature schemes MIRA and MiRitH merged to form a new candidate Mirath. Code-Based
CROSS
 Enhanced pqsigRM
 FuLeeca
LESS
 MEDS
 WAVE

Lattice-Based
 EagleSign
 EHTv4
 HAETAE
HAWK
 HuFu
 Raccoon
 SQUIRRELS

Other
 ALTEQ
 eMLE-Sig 2.0
 KAZ-SIGN
 PREON
 Xifrat1-Sign.I

Symmetric-Based
 AIMer
 Ascon-Sign
FAEST
 SPHINCS-alpha

MPC-in-the-Head Multivariate

 Biscuit
MIRA*
MiRitH*
MQOM
PERK
RYDE
SDitH

Isogeny-Based
SQIsign

 3WISE
 DME-Sign
 HPPC
MAYO
 PROV
QR-UOV
SNOVA
 TUOV
UOV
 VOX

The criteria for determining the first round candidates included provisions for reference
and optimized C code implementations, known-answer tests, a written specification, and
required intellectual property statements. These were the sole criteria used to judge the
submission packages.

Status Report on the First Round of the Additional Digital Signature Schemes for the NIST Post-Quantum Cryptography Standardization Process


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Automated Secure Configuration Guidance from the macOS Security Compliance Project (mSCP) provide? (Part 9)

[Assistant]
| ...............................................................................................
9                                     |
|                                                                                | Configuration Profiles and Scripts............................................................................... | 9                                                                                |
|                                                                                | Content Generation Scripts........................................................................................10                        |                                                                                |
| 3.4.1. | Generate Baseline Script.......................................................................................10                           |                                                                                |
| 3.4.2. | Generate Guidance Script .....................................................................................10                            |                                                                                |
| 3.4.3. | macOS Security Compliance Tool .........................................................................11                                  |                                                                                |
| 3.4.4.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AT.L2-3.2.1 (NIST 3.2.1)?

[Assistant]
According to High-Performance Computing Security_ Architecture, Threat Analysis, and Security Posture:

3.2.1. 3.2.1.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What are the CMMC Level 1 requirements?

[Assistant]
According to Summary Report for “Workshop on Updating Manufacturer Guidance for Securable Connected Product Development”:

<!-- image -->

## NIST Interagency Report NIST IR 8562

## Summary Report for ' Workshop on Updating Manufacturer Guidance for Securable Connected Product Development '

Katerina N. Megas Michael Fagan Barbara Cuthill Brad Hoehn Evie Petrella

This publication is available free of charge from:

https://doi.org/10.6028/NIST.IR.8562

<!-- image -->

## NIST Interagency Report NIST IR 8562

## Summary Report for ' Workshop on Updating Manufacturer Guidance for Securable Connected Product Development '

Katerina N. Megas Michael Fagan Barbara Cuthill

Applied Cybersecurity Division Information Technology Laboratory

Brad Hoehn HII

Evie Petrella Electrosoft Services, Inc. This publication is available free of charge from: https://doi.org/10.6028/NIST.IR.8562

April 2025

<!-- image -->

U.S. Department of Commerce Howard Lutnick, Secretary

National Institute of Standards and Technology

Craig S. Burkhardt, Acting NIST Director and Under Secretary of Commerce for Standards and Technology

Certain equipment, instruments, software, or materials, commercial or non-commercial, are identified in this paper in order to specify the experimental procedure adequately. Such identification does not imply recommendation or endorsement of any product or service by NIST, nor does it imply that the materials or equipment identified are necessarily the best available for the purpose. ## NIST Technical Series Policies

Copyright, Use, and Licensing Statements NIST Technical Series Publication Identifier Syntax

## Publication History

Approved by the NIST Editorial Review Board on 2025-03-21

## How to Cite this NIST Technical Series Publication

Megas K, Fagan M, Cuthill B, Hoehn N, and Petrella E  (2025) Summary Report for 'Workshop on Updating Manufacturer Guidance for Securable Connected Product Development' (National Institute of Standards and Technology, Gaithersburg, MD), NIST Interagency or Internal Report (IR) NIST IR 8562.

Summary Report for “Workshop on Updating Manufacturer Guidance for Securable Connected Product Development”

Audit and Accountability
System and Information Integrity
Security Assessment
Media Protection
Identification and Authentication
Awareness and Training
System and Communications Protection
Access Control
Planning
Incident Response
Risk Assessment
Personnel Security
System and Services Acquisition
Maintenance
Physical Protection
Configuration Management


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Blockchain for Access Control Systems provide? (Part 8)

[Assistant] blockchain system ....................8 | | Figure 5 - Example 4 of access control function points implemented in blockchain systems......................9 | Figure 5 - Example 4 of access control function points implemented in blockchain systems......................9 | | Figure 7 - Examples of Figure 2d with attribute source options.................................................................10 | Figure 7 - Examples of Figure 2d with attribute source options.................................................................10 | | Figure 6 - Attribute source is out of the chain ............................................................................................10 | Figure 6 - Attribute source is out of the chain ............................................................................................10 | | List of Tables | List of Tables | | 1 - Comparison of IoT AC system capabilities for general access control requirements by | 1 - Comparison of IoT AC system capabilities for general access control requirements by | | Table | Table | ## 1 Introduction Access control (AC) is concerned with determining the allowed activities of legitimate users and mediating every attempt by a user to access a resource in the system.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Awareness and Training?

[Assistant]
According to Ascon-Based Lightweight Cryptography Standards for Constrained Devices_ Authenticated Encryption, Hash, and Extendable Output Functions:

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . |  15 |
| 4.2. Implementation Options . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . |  18 |
| 4.2.1. Truncation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . |  18 |
| 4.2.2. Nonce Masking . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . |  18 |
| 4.3. AEAD Requirements.............................................................. |  19 |
| 4.4. Security Properties . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . |  20 |
| 4.4.1. Single-Key Setting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . |  20 |
| 4.4.2. Multi-Key Setting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . |  20 |
| 4.4.3. Nonce-Misuse Setting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . |  21 |
| 5. Hash and eXtendable-Output Functions (XOFs) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . |  23 |
| 5.1. Specification of Ascon-Hash256 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . |  23 |
| 5.2. Specification of Ascon-XOF128 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . |  25 |
| 5.3. Specification of Ascon-CXOF128 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . |  28 |
| 5.4. Streaming API for XOF............................................................ |  30 |
| 5.5. Security Strengths . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Ascon-Based Lightweight Cryptography Standards for Constrained Devices_ Authenticated Encryption, Hash, and Extendable Output Functions


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Access Control?

[Assistant]
According to Addressing Visibility Challenges with TLS 1.3 within the Enterprise_ High-Level Document:

DigiCert's CertCentral web -based platform allows provisioning and managing publicly trusted X.509 certificates for TLS and code signing and a variety of other purposes. After establishing an account, clients can log in, request, renew, and revoke certificates via a browser. Multiple roles can be assigned within an account, and a discovery tool can inventory all certificates within the enterprise. In addition to certificatespecific features, the platform offers baseline enterprise SaaS capabilities, includi ng rolebased access control (RBAC), Security Assertion Markup Language (SAML), single sign -on (SSO), and security policy management and enforcement. All account features are fully compatible with the web portal and a publicly available API. Learn more about DigiCert at https://www.digicert.com. F5, Inc. is a publicly-held American technology company specializing in application security , multi -cloud management, online fraud prevention, application delivery networking, application availability & performance, network security, and access & authorization. F5 is headquartered in Seattle, Washington, with an additional 75 offices in 43 countries , focusing on account management, global services support, product development, manufacturing, and software engineering. F5 offers application delivery controller technology, application layer automation, multi -cloud, and security services. The company offe rs modules on its proprietary operating system, TMOS (Traffic Management Operating System), including Local Traffic Manager, Advanced Web Application Firewall, Domain Name Service, and Access Policy Manager. The modules offer the ability to deploy load balancing, Layer 7 application firewalls, SSO (for Active Directory [AD] ) , Azure AD, Lightweight Directory Access Protocol (LDAP), and enterprise -level virtual private networks.

Addressing Visibility Challenges with TLS 1.3 within the Enterprise_ High-Level Document


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Maintenance?

[Assistant]
According to Guide to Auditing for Controls and Security_ A System Development Life Cycle Approach:

| | 2.5.1.2 | 2.5.1.2 | Differences in Audit Approach | 34 | |-------------------------------------------|---------------------------------------------------------------|---------------------------------------------------------------|---------------------------------------------------------------|-----------| | | 2.5.2 Off-The-Shelf SoftwareATurnkey Systems | 2.5.2 Off-The-Shelf SoftwareATurnkey Systems | 2.5.2 Off-The-Shelf SoftwareATurnkey Systems | 35 | | | 2.5.2.1 | 2.5.2.1 | Differences from the AIS Life Cycle Matrix | 36 | | | 2.5.2.2 | 2.5.2.2 | Differences in Audit Approach | 37 | | | AIS | AIS | AIS | | | 2.6 | LIFE CYCLE DOCUMENTATION | LIFE CYCLE DOCUMENTATION | LIFE CYCLE DOCUMENTATION | 37 | | | 2.6.1 Needs Statement | 2.6.1 Needs Statement | 2.6.1 Needs Statement | 38 | | | 2.6.2 | Feasibility Study Document | Feasibility Study Document | 38 | | | 2.6.3 | Risk Analysis | Risk Analysis | 38 | | | 2.6.4 | Cost/Benefit Analysis | Cost/Benefit Analysis | 40 | | | 2.6.5 | System Decision Paper | System Decision Paper | 40 | | | 2.6.6 | Audit Plan | Audit Plan | 40 | | | 2.6.7 | Project Plan | Project Plan | 41 | | | 2.6.8 | Requirements Documents | Requirements Documents | 41 | | | | Functional Requirements Document | Functional

Guide to Auditing for Controls and Security_ A System Development Life Cycle Approach


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Maintenance?

[Assistant]
According to Incident Response Recommendations and Considerations for Cybersecurity Risk Management_ A CSF 2.0 Community Profile:

Additional information about this publication is available at https://csrc.nist.gov/pubs/sp/800/61/r3/final, including related content, potential updates, and document history. Within this document, an event is any observable occurrence that involves computing assets, including physical and virtual platforms, networks, services, and cloud environments. Examples of events are user login attempts, the installation of software updates, and an application responding to a transaction request. Many events focus on security or have security implications. Adverse events are any events associated with a negative consequence regardless of cause, including natural disasters, power failures, or cybersecurity attacks. This guide addresses only adverse cybersecurity events . Additional analysis is often needed to determine whether adverse cybersecurity events indicate that a cybersecurity incident has occurred.

Incident Response Recommendations and Considerations for Cybersecurity Risk Management_ A CSF 2.0 Community Profile


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule_ A Cybersecurity Resource Guide provide? (Part 8)

[Assistant]
----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| 5.3.1.
Access Control (§ 164.312(a)).....................................................................................................65                                                                                |
| 5.3.2. Audit Controls (§ 164.312(b)).....................................................................................................69                                                                                |
| 5.3.3. Integrity (§ 164.312(c))...............................................................................................................71                                                                                |
| 5.3.4. Person or Entity Authentication (§ 164.312(d)).........................................................................73                                                                                |
| 5.3.5. Transmission Security (§ 164.312(e)(1)).....................................................................................75                                                                                |
| 5.4.1. Business Associate Contracts or Other Arrangements (§ 164.314(a)).......................................77                                                                                |
| 5.4.2. Requirements for Group Health Plans (§ 164.314(b))................................................................79                                                                                |
| 5.5.1.

Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule_ A Cybersecurity Resource Guide


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Security Assessment?

[Assistant]
According to Guide to Auditing for Controls and Security_ A System Development Life Cycle Approach:

The Institute consists of the following Divisions: | 2.1 | BACKGROUND | BACKGROUND | BACKGROUND | 16 | |-------|------------------------------------------------------------|------------------------------------------------------------|------------------------------------------------------------|------| | | 2.1.1 | PCIE - EDP Systems Review and Security Work Group | PCIE - EDP Systems Review and Security Work Group | 16 | | | 2.1.2 | System Development Life Cycle | System Development Life Cycle | 16 | | 2.2 | OPERATING ENVIRONMENT | OPERATING ENVIRONMENT | OPERATING ENVIRONMENT | 17 | | | 2.2.1 IRM Planning and Implementation of Policy Guidelines | 2.2.1 IRM Planning and Implementation of Policy Guidelines | 2.2.1 IRM Planning and Implementation of Policy Guidelines | 17 | | | 2.2.1.1 IRM Planning | 2.2.1.1 IRM Planning | 2.2.1.1 IRM Planning | 17 | | | 2.2.1.2 Using Policy/Procedures/Standards | 2.2.1.2 Using Policy/Procedures/Standards | 2.2.1.2 Using Policy/Procedures/Standards | 18 | | | 2.2.1.2.1 | 2.2.1.2.1 | References Used by the Life Cycle Matrix | 19 | | | 2.2.1.2.2 | 2.2.1.2.2 | Major GSA References | 21 | | | 2.2.2 AIS Development Methodologies | 2.2.2 AIS Development Methodologies | 2.2.2 AIS Development Methodologies | 21 | | | 2.2.3 Project Administration and Control | 2.2.3 Project Administration and Control | 2.2.3


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Access Control?

[Assistant]
According to Recommendations for Federal Vulnerability Disclosure Guidelines:

|
| Federal Vulnerability Disclosure Coordination Body ....................................................
| 6                                                                                |                                                                                |
| Preparation................................................................................................................. | 7                                                                                |                                                                                |
| 2.1.1. Create Source Vulnerability                                                                                | Report Receipt Capability............................................. 7                                                             |                                                                                |
| 2.1.2. Determine Scope and Obtain Contacts .................................................................... | 8                                                                                |                                                                                |
| 2.1.3. Develop Technical Analysis Capability .....................................................................

Recommendations for Federal Vulnerability Disclosure Guidelines


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Physical Protection?

[Assistant]
According to Addressing Visibility Challenges with TLS 1.3 within the Enterprise_ High-Level Document:

y' and 'need not' indicate a course of ac�on permissible within the limits of the publica�on. The terms 'can' and 'cannot' indicate a possibility and capability, whether material, physical, or causal.
| 1   | Executive Summary.............................................................................1                                                                                | Executive Summary.............................................................................1                                                                                |
|-----|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| 2   | Introduction........................................................................................2                                                                                | Introduction........................................................................................2                                                                                |
|     | 2.1                                                                                | Audience ......................................................................................................................


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice CM.L2-3.4.6 (NIST 3.4.6)?

[Assistant]
According to Contingency Planning Guide for Federal Information Systems:

3.4.6 Roles and Responsibilities ... 3.4.6 Roles and Responsibilities ... 3.4.6.

Contingency Planning Guide for Federal Information Systems


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Supply Chain Risk Management?

[Assistant]
According to Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations:

## Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations

## Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations

Boyens J, Smith A, Bartol N, Winkler K, Holbrook A, Fallon M (2022) Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) NIST SP 800-161r1-upd1, Includes updates as of Novem ber 1, 2024. https://doi.org/10.6028/NIST.SP.800-161r1-upd1


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Summary Report for “Workshop on Updating Manufacturer Guidance for Securable Connected Product Development” provide? (Part 2)

[Assistant]
n Updating Manufacturer Guidance for Securable Connected Product Development' (National Institute of Standards and Technology, Gaithersburg, MD), NIST Interagency or Internal Report (IR) NIST IR 8562.
https://doi.org/10.6028/NIST.IR.8562

## Author ORCID iDs

Katerina Megas: 0000-0002-2815-5448 Michael Fagan: 0000-0002-1861-2609 Barbara Cuthill: 0000-0002-2588-6165

## Contact Information

iotsecurity@nist.gov

National Institute of Standards and Technology Attn: Applied Cybersecurity Division, Information Technology Laboratory 100 Bureau Drive (Mail Stop 2000) Gaithersburg, MD 20899-2000

## Abstract

This report summarizes the feedback received by the NIST Cybersecurity for the Internet of Things (IoT) program at the in-person and hybrid workshop on "Updating Manufacturer Guidance for Securable Connected Product Development" held in December 2024. The purpose of this workshop was to consider how to update Foundational Cybersecurity Activities for IoT Device Manufacturers (NIST Internal Report (IR) 8259) based on concepts in risk management, operational technology concerns, product end of life concerns and recent trends in IoT cybersecurity and privacy. Over time, the NIST volume of work has built upon the concepts introduced in NIST IR 8259,to add technical (NIST IR 8259A) and nontechnical (NIST IR 8259B) concepts to help manufacturers and customers consider the cybersecurity of IoT devices. The NIST IR 8259 series has been used to inform and develop subsequent publications that elaborate on IoT cybersecurity across sectors and use cases (e.g., federal agency uses cases reflected in NIST SP 800-213 and consumer use cases reflected in NIST IR 8425 and the U.S. Cyber Trust Mark). ## Keywords

cybersecurity baseline; Internet of Things (IoT); IoT products; manufacturing; privacy; risk management; securable products; security requirements; software development; threat modelling. ## Table of Contents

| 1.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AU.L2-3.3.2 (NIST 3.3.2)?

[Assistant]
According to The Federal Cybersecurity Awareness Workforce_ Professional Backgrounds, Knowledge, Skills, and Development Activities:

3.3.2 Job Experience

## Focus Groups

In the focus group demographic survey, we asked participants how many years they had worked as government employees, in their current organization, and in a cybersecurity role.

The Federal Cybersecurity Awareness Workforce_ Professional Backgrounds, Knowledge, Skills, and Development Activities


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Incident Response?

[Assistant]
According to Control Baselines for Information Systems and Organizations:

| ORGANIZATIONAL RESPONSIBILITIES .........................................................................................
| 2                                                                                |
| 1.4                                                                                | RELATIONSHIPTOOTHERPUBLICATIONS ................................................................................... | 3                                                                                |
| 1.5                                                                                | REVISIONSANDEXTENSIONS .................................................................................................... | 3                                                                                |
| 1.6                                                                                | PUBLICATIONORGANIZATION .................................................................................................. | 3                                                                                |
| CHAPTERTWO THE FUNDAMENTALS............................................................................................ 5                     | CHAPTERTWO THE FUNDAMENTALS............................................................................................ 5                     | CHAPTERTWO THE FUNDAMENTALS............................................................................................

Control Baselines for Information Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for Media Protection?

Assessing Enhanced Security Requirements for Controlled Unclassified Information


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 2 require for Security Assessment?

[Assistant]
According to Profile of the IoT Core Baseline for Consumer IoT Products:

The intended audience for this report consists of manufacturers of consumer products, especially product security officers, retailers and related integrators and technical support firms serving the consumer and business sectors, and testing and certification bodies interested in establishing baselines of IoT cybersecurity capabilities. - create the IoT product (i.e., used to create each product component). - ii. IoT platform used in the development and operation of the IoT product, its product components, including related documentation. - iii. Trustworthiness and protection of software and hardware elements implemented to create the IoT product and its product components (e.g., secure boot, hardware root of trust, and secure enclave). - iv. Consideration for the known risks related to the IoT product and known potential misuses. - v. Secure software development and supply chain practices used. - vi. Accreditation, certification, and/or evaluation results for cybersecurity-related practices. - vii. The ease of installation and maintenance of the IoT product by a customer (i.e., the usability of the product [ISO9241]). - e. Maintenance requirements for the IoT product, for example :
- i. Cybersecurity maintenance expectations and associated instructions or procedures (e.g., vulnerability/patch management plan). - ii. How the IoT product developer identifies authorized supporting parties who can perform maintenance activities (e.g., authorized repair centers). - iii. Cybersecurity considerations of the maintenance process (e.g., how customer data unrelated to the maintenance process remain confidential even from maintainers). - f. The secure system lifecycle policies and processes associated with the IoT product, including:
- i. Steps taken during development to ensure the IoT product and its product components are free of any known, exploitable vulnerabilities. - ii.

Profile of the IoT Core Baseline for Consumer IoT Products


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for Risk Assessment?

[Assistant]
According to Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171:

Advanced Persistent Threat; Basic Security Requirement; Contractor Systems; Controlled Unclassified Information; CUI Registry; Derived Security Requirement; Enhanced Security Requirement; Executive Order 13556; FIPS Publication 199; FIPS Publication 200; FISMA; NIST Special Publication 800-53; Nonfederal Organizations; Nonfederal Systems; Security Assessment; Security Control; Security Requirement. This publication is a supplement to NIST Special Publication 800-171 [SP 800-171]. It contains recommendations  for  enhanced  security  requirements  to  provide  additional  protection  for Controlled Unclassified Information (CUI) in nonfederal systems and organizations when such information is  associated  with critical  programs  or  high  value  assets. The  enhanced  security requirements are designed to respond to the advanced persistent threat (APT) and supplement the basic and derived security requirements in [SP 800-171]. While the security requirements in [SP 800-171] focus primarily on confidentiality protection, the enhanced security requirements in this publication address confidentiality, integrity, and availability protection. The enhanced security requirements are implemented in addition to the basic and derived requirements since those requirements are not designed to address the APT. The enhanced security requirements apply to those components of nonfederal systems that process, store, or transmit CUI or that provide protection for such components. There is no expectation that all of the enhanced security requirements will be selected by federal agencies implementing this guidance. The decision to select a particular set of enhanced security requirements will be based on the mission and business needs of federal agencies and guided and informed by ongoing risk assessments.

Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 1 require for Audit and Accountability?

[Assistant]
According to Summary Report for “Workshop on Updating Manufacturer Guidance for Securable Connected Product Development”:

Security is a collective responsibility involving manufacturers, integrators, and asset owners and operators. CISA helps clarify security roles and ensures all parties uphold their responsibilities. The key component of secure by design is seeing where manufacturers can embed cyber security from the start to make it more difficult or impossible for an integrator or asset owner to open a cyber security risk. Current US critical infrastructure contains legacy systems without security functionality that inherently complicate adding security today. Infrastructure improvement options include the present 'Bubble Boy' method, which segments all traffic, ta rgeted improvements, and the 'rip and replace' method. Secure operational technology (OT) devices need to be available to provide that defense in depth, so that any failures in segmentation do not result in total data protection. It emphasizes open standards and autonomy at the asset and operator level. Resilience features should resemble those in the enterprise space, including secure compromise. Secure-by-design for OT considers threat categories like vulnerability handling and communications, resilience, logging, and end-device capabilities. Stacey Higginbotham of Consumer Reports noted that connected devices establish an ongoing relationship between the buyer,  seller, and manufacturer. The lifetime of a connected product is often separate from its physical state. While physical products fail in visible ways, software degrades more quickly, often without consumer awareness. The industry also lacks adequate support for maintenance. Stacey's discussion highli ghted three key areas: zombie hordes of end of life devices, supported devices with unsupportive owners, and herd immunity against malicious actors. ' Zombie devices ' are those that no longer receive software support and security updates. Higginbotham noted that unsupportive owners can neglect cybersecurity issues, leading to vulnerabilities.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for Audit and Accountability?

[Assistant]
According to Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171:

............................................ 5                        |
| 2.1 DEVELOPMENTAPPROACH ......................................................................................................
| 5                                                                                |
| 2.2 ORGANIZATIONANDSTRUCTURE                                                                                | ............................................................................................. 7                                                  |
| 2.3 FLEXIBLE APPLICATION                                                                                | ............................................................................................................. 9                                  |
| CHAPTER THREE THE REQUIREMENTS......................................................................................... 11                       | CHAPTER THREE THE REQUIREMENTS......................................................................................... 11                       |
| 3.1 ACCESSCONTROL                                                                                | .................................................................................................................. 12                            |
| 3.2 AWARENESSANDTRAINING                                                                                | ...................................................................................................


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Risk Management Framework for Information Systems and Organizations_ A System Life Cycle Approach for Security and Privacy provide? (Part 7)

[Assistant] Romine Thomas Michelli Director, Information Technology Laboratory Chair-Defense Community Donna Dodson Susan Dorr-Intelligence Community Co-Chair Cybersecurity Advisor, Information Technology Laboratory Matt Scholl Vicki Michetti Tri-Chair-Defense Community Chief, Computer Security Division Kevin Stine Chris Johnson Chief, Applied Cybersecurity Division Tri-Chair-Intelligence Community Ron Ross Paul Cunningham FISMA Implementation Project Leader Tri-Chair-Civil Agencies ## Joint Task Force Working Group | Ron Ross | Kevin Dulany | Peter Duspiva | Kelley Dempsey | |--------------------|----------------------------------|------------------------------------|----------------------| | NIST, JTF Leader | DoD | Intelligence Community | NIST | | Taylor Roberts OMB | Ellen Nadeau NIST | Victoria Pillitteri NIST | Naomi Lefkovitz NIST | | Jordan Burris OMB | Charles Cutshall OMB | Kevin Herms OMB | Carol Bales OMB | | Jeff Marron NIST | Kaitlin Boeckl NIST | Kirsten Moncada OMB | Jon Boyens NIST | | Dorian Pappas CNSS | Dominic Cussatt Veterans Affairs | Esten Porter The MITRE Corporation | Celia Paulsen NIST | | | Christina Sames | Julie Snyder | Martin Stanley | | Daniel Faigin | | | | | The Aerospace | The MITRE Corporation | The MITRE | Homeland Security | | Corporation | | Corporation | | \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ The authors also wish to recognize Matt

Risk Management Framework for Information Systems and Organizations_ A System Life Cycle Approach for Security and Privacy


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Cryptographic Module Validation Program (CMVP)-Approved Sensitive Security Parameter Generation and Establishment Methods_ CMVP Validation Authority U provide? (Part 10)

[Assistant]
n and establishment methods

For the current list of CMVP-approved sensitive security parameter generation and establishment methods, see https://csrc.nist.gov/projects/cmvp/sp800-140d. ## Appendix A.
Document Revisions

| Edition         | Date      | Change                                                                                |
|-----------------|-----------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Revision 1 (r1) | May 2022  | 6.1 Purpose Added language on CMVP-approved security functions. 6.2 Sensitive security parameter generation and establishment methods Added/Modified: Security function subsection headers. 6.2.1 Transitions Removed: SP 800-131A Rev.

Cryptographic Module Validation Program (CMVP)-Approved Sensitive Security Parameter Generation and Establishment Methods_ CMVP Validation Authority U


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Proceedings of the Cybersecurity in Cyber-Physical Systems Workshop, April 23-24, 2012 provide? (Part 8)

[Assistant]
inted National Coordinator for Smart Grid Interoperability at in April 2009. He has been responsible for leading the development of standards underpinning the nation's Smart Grid. In October 2011, Dr.
Arnold added an additional role as Director of Cyber Physical Systems within NIST's Engineering Laboratory (EL). Anticipating and meeting the measurement science and standards needs for technology-intensive manufacturing construction, and cyber-physical systems in ways that enhance economic prosperity and improve the quality of life , EL promotes U.S. innovation and industrial competitiveness in areas of critical national priority. Dr. Arnold served as Chairman of the Board of the American National Standards Institute (ANSI), a private, non-profit organization that coordinates the U.S. voluntary standardization and conformity assessment system, from 2003 to 2005. He served as President of the IEEE Standards Association in 2007-2008 and as Vice President-Policy for the International Organization for Standardization (ISO) from 2006-2009 where he was responsible for guiding ISO's strategic plan. Dr. Arnold previously served as a Vice-President at Lucent Technologies Bell Laboratories where he directed the company's global standards efforts. His organization played a leading role in the development of international standards for Intelligent Networks and IP-based Next Generation Networks. In previous assignments at AT&T Bell Laboratories he had responsibilities in network planning, systems engineering, and application of information technology to automate operations and maintenance of the nationwide telecommunications network. Dr. Arnold received a Doctor of Engineering Science degree in Electrical Engineering and Computer Science from Columbia University in 1978. He is a Fellow of the IEEE. <!-- image -->

<!-- image -->

<!-- image -->

<!-- image -->

<!-- image -->

<!-- image -->

<!-- image -->

## 3.

Proceedings of the Cybersecurity in Cyber-Physical Systems Workshop, April 23-24, 2012


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Access Control on NoSQL Databases provide? (Part 2)

[Assistant]
aft publications during public comment periods and provide feedback to NIST. Many NIST cybersecurity publications, other than the ones noted above, are available at https://csrc.nist.gov/publications.
## NIST Technical Series Policies

Copyright, Use, and Licensing Statements NIST Technical Series Publication Identifier Syntax

## Publication History

Approved by the NIST Editorial Review Board on 2024-05-01

## How to Cite this NIST Technical Series Publication:

Hu VC (2024) Access Control on NoSQL Databases. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Interagency or Internal Report (IR) NIST IR 8504. https://doi.org/10.6028/NIST.IR.8504

## Author ORCID iDs

Vincent C. Hu: 0000-0002-1648-0584

## Contact Information

ir8504-comments@nist.gov

National Institute of Standards and Technology Attn: Computer Security Division, Information Technology Laboratory 100 Bureau Drive (Mail Stop 8930) Gaithersburg, MD 20899-8930

## Additional Information

Additional information about this publication is available at https://csrc.nist.gov/pubs/ir/8504/final, including related content, potential updates, and document history. All comments are subject to release under the Freedom of Information Act (FOIA). ## Abstract

NoSQL database systems and data stores often outperform traditional RDBMS in various aspects, such as data analysis efficiency, system performance, ease of deployment, flexibility/scalability of data management, and users' availability. However, with an increasing number of people storing sensitive data in NoSQL databases, security issues have become critical concerns. NoSQL databases suffer from vulnerabilities, particularly due to the lack of effective support for data protection, including weak authorization mechanisms. As access control is a fundamental data protection requirement of any database management system DBMS, this document focuses on access control on NoSQL database systems.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 2 require for Awareness and Training?

[Assistant]
According to Profile of the IoT Core Baseline for Consumer IoT Products:

The profile builds on the NISTIR 8259 series by extending the IoT core baseline for consumer IoT products. NISTIR 8259, Foundational Cybersecurity Activities for IoT Device Manufacturers [IR8259], provides foundational guidance for IoT device manufacturers pertaining to developing IoT devices that can be used securely by customers. NISTIR 8259 does not target any specific IoT sector but discusses how manufacturers can approach cybersecurity for IoT devices in general. NISTIR 8259A, IoT Device Cybersecurity Capability Core Baseline [IR8259A] and NISTIR 8295B, IoT Non-Technical Supporting Capability Core Baseline [IR259B] define the IoT device cybersecurity capability core baseline (also referred to as the core baseline). The core baseline is a starting point for manufacturers to use in identifying the cybersecurity capabilities their customers may expect from the IoT devices they create. NISTIR 8259A discusses device cybersecurity capabilities, which are functions or features implemented by the device through its own hardware and software. For example, NISTIR 8259A discusses concepts such as data protection, access control, and software update, among others. NISTIR 8259B discusses non-technical supporting capabilities, which are actions taken by organizations to support the cybersecurity of the device. For example, NISTIR 8259B discusses concepts such as education and awareness, and information and query reception (e.g., by manufacturers/developers).

## Cybersecurity State Awareness

## Product Education and Awareness


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Awareness and Training?

[Assistant]
According to Automated Secure Configuration Guidance from the macOS Security Compliance Project (mSCP):

|                                                                                | Introduction ...................................................................................................................... | Introduction ...................................................................................................................... |
|---------------------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------|
|                                                                                | Purpose and Scope.................................................................................................... | 1                                                                                |
|                                                                                | Audience .................................................................................................................... | 1                                                                                |
|                                                                                | Relevance to NIST SP 800-70 and the National Checklist Program ...........................

Automated Secure Configuration Guidance from the macOS Security Compliance Project (mSCP)


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for System and Information Integrity?

[Assistant]
According to Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171:

........................................................................ | CHAPTERONE INTRODUCTION......................................................................................................
|
|--------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------|
| 1.1 PURPOSEANDAPPLICABILITY                                                                                | ................................................................................................... 3                                            |
| 1.2 TARGET AUDIENCE                                                                                | .................................................................................................................. 4                             |
| 1.3 ORGANIZATIONOF THIS SPECIAL PUBLICATION                                                                                | .......................................................................... 4                                                                     |
| CHAPTERTWO THE FUNDAMENTALS............................................................................................ 5                        | CHAPTERTWO THE FUNDAMENTALS............................................................................................ 5                        |
| 2.1 DEVELOPMENTAPPROACH ......................................................................................................


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Services Acquisition?

[Assistant]
According to Secure Software Development Framework (SSDF) Version 1.1_ Recommendations for Mitigating the Risk of Software Vulnerabilities:

## Secure Software Development Framework (SSDF) Version 1.1:

## Secure Software Development Framework (SSDF) Version 1.1:

There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may  be  used  by  federal  agencies  even  before  the  completion  of  such  companion  publications.  Thus,  until  each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning  and  transition  purposes,  federal  agencies  may  wish  to  closely  follow  the  development  of  these  new publications by NIST.

Secure Software Development Framework (SSDF) Version 1.1_ Recommendations for Mitigating the Risk of Software Vulnerabilities


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice MP.L2-3.8.1 (NIST 3.8.1)?

[Assistant]
According to Guide to Auditing for Controls and Security_ A System Development Life Cycle Approach:

3.8.1                                                            | The Audit Organization                                           | The Audit Organization                                           | 65        |
|           | 3. 3.8.1 The Audit Organization

The NBS/PCIE workshop attendees came up with a number of recommendations for further activity by ADP Audit/Computer Security Organizations.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Services Acquisition?

[Assistant]
According to Digital Identity Guidelines_ Identity Proofing and Enrollment:

There may be references in this publication to other publications currently under
development by NIST in accordance with its assigned statutory responsibilities. The
information in this publication, including concepts and methodologies, may be used by
federal agencies even before the completion of such companion publications. Thus, until
each publication is completed, current requirements, guidelines, and procedures, where
they exist, remain operative. For planning and transition purposes, federal agencies may
wish to closely follow the development of these new publications by NIST. This guideline focuses on identity proofing and enrollment for use in digital
authentication. During the process of identity proofing, an applicant provides evidence
to a credential service provider (CSP) reliably identifying themselves, thereby allowing
the CSP to assert that identification at a useful identity assurance level. This document
defines technical requirements for each of three identity assurance levels. The guidelines
are not intended to constrain the development or use of standards outside of this
purpose. This publication supersedes NIST Special Publication (SP) 800-63A. The Information Technology Laboratory (ITL) at the National Institute of Standards and
Technology (NIST) promotes the U.S. economy and public welfare by providing technical
leadership for the Nation’s measurement and standards infrastructure. ITL develops
tests, test methods, reference data, proof of concept implementations, and technical
analyses to advance the development and productive use of information technology. ITL’s responsibilities include the development of management, administrative, technical,
and physical standards and guidelines for the cost-effective security and privacy of other
than national security-related information in federal information systems.

Digital Identity Guidelines_ Identity Proofing and Enrollment


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does IoT Device Cybersecurity Capability Core Baseline provide? (Part 4)

[Assistant] ## Table of Contents | 1 | Introduction ............................................................................................................1 | |------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | 2 | IoT Device Cybersecurity Capability Core Baseline Definition..........................3 | | References...................................................................................................................11 | References...................................................................................................................11 | | Appendix A-Understanding the IoT Device Cybersecurity Capability Core Baseline in the Context of Customer Needs and Goals...........................................14 | Appendix A-Understanding the IoT Device Cybersecurity Capability Core Baseline in the Context of Customer Needs and Goals...........................................14 | | Appendix B-Glossary ..............................................................................................16 | Appendix B-Glossary ..............................................................................................16 | ## Patent Disclosure Notice NOTICE: ITL has requested that holders of patent claims whose use may be required for compliance with the guidance or requirements of this publication disclose such patent claims to ITL.

IoT Device Cybersecurity Capability Core Baseline


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Personnel Security?

[Assistant]
According to Secure Software Development Practices for Generative AI and Dual-Use Foundation Models_ An SSDF Community Profile:

| PO.2.1: Create new roles and alter responsibilities for existing roles as needed to encompass all parts of the SDLC. Periodically review and maintain the defined roles and responsibilities, updating them as needed. | High       | R1: Include AI model development security in SDLC-related roles and responsibilities throughout the SDLC. The roles and responsibilities should include, but are not limited to, AI model development, AI model operations, and data science. N1: Roles and responsibilities involving AI system producers, AI model producers, and other third-party providers can be documented in agreements. | AI RMF: Govern 2.1                                        |
| Implement Roles and Responsibilities (PO.2): Ensure that everyone inside and outside of the organization involved in the SDLC is prepared to perform their SDLC-related roles and responsibilities throughout the SDLC. | PO.2.2: Provide role-based training for all personnel with responsibilities that contribute to secure development. Periodically review personnel proficiency and role-based training, and update the training as needed. | High       | R1: Role-based training should include understanding cybersecurity vulnerabilities and threats to AI models and their possible mitigations. | AI RMF: Govern 2.2 OWASP: LLM04-7                         |
| Implement Roles and Responsibilities (PO.2): Ensure that everyone inside and outside of the organization involved in the SDLC is prepared to perform their SDLC-related roles and responsibilities throughout the SDLC. | PO.2.3: Obtain upper management or authorizing official commitment to secure development, and convey that commitment to all with development- related roles and responsibilities. | Medium     | R1: Leadership should commit to secure development practices involving AI models.

Secure Software Development Practices for Generative AI and Dual-Use Foundation Models_ An SSDF Community Profile


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Identification and Authentication?

[Assistant]
According to Security and Privacy Controls for Information Systems and Organizations:

............................................................. 16
3.1   ACCESS CONTROL ..................................................................................................................
18
3.2   AWARENESS AND TRAINING ................................................................................................... 59
3.3   AUDIT AND ACCOUNTABILITY ................................................................................................. 65
3.4   ASSESSMENT, AUTHORIZATION, AND MONITORING ................................................................. 83
3.5   CONFIGURATION MANAGEMENT ........................................................................................... 96
3.6   CONTINGENCY PLANNING .................................................................................................... 115
3.7   IDENTIFICATION AND AUTHENTICATION ............................................................................... 131
3.8   INCIDENT RESPONSE ............................................................................................................ 149
3.9   MAINTENANCE .................................................................................................................... 162
3.10   MEDIA PROTECTION .......................................................................................................... 171
3.11   PHYSICAL AND ENVIRONMENTAL PROTECTION .................................................................... 179
3.12   PLANNING ........................................................................................................................ 194
3.13   PROGRAM MANAGEMENT ................................................................................................. 203
3.14   PERSONNEL SECURITY ........................................................................................................ 222
3.15   PERSONALLY IDENTIFIABLE INFORMATION PROCESSING AND TRANSPARENCY .......................

Security and Privacy Controls for Information Systems and Organizations