[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Security Assessment?

[Assistant]
According to Guidelines for Media Sanitization:

- FIPS 199 [2] and SP 800-60r2, Guide for Mapping Types of Information and Systems to Security Categories [7] , provide guidance for establishing the security categorization for a system's confidentiality. This categorization will impact the level of assurance that an organization should require when making sanitization decisions. - FIPS 200, Minimum Security Requirements for Federal Information and Information Systems [3] , establishes baseline security requirements for organizations to have a media sanitization program. - FIPS 140-3, Security Requirements for Cryptographic Modules [1] , establishes a standard for cryptographic modules used by the U.S. Government. - SP 800-53r5 [5] provides minimum recommended security controls, including sanitization, for federal systems based on their overall system security categorization. - SP 800-53Ar5, Guide for Assessing the Security Controls in Federal Information Systems and Organizations: Building Effective Security Assessment Plans [6], provides guidelines for assessing security controls, including sanitization, for federal systems based on their overall system security categorization. - SP 800-111, Guide to Storage Encryption Technologies for End User Devices [10], provides guidelines for selecting and using storage encryption technologies. 8  Conformance testing for FIPS 140-3 is conducted within the framework of the Cryptographic Module Validation Program (CMVP) and the Cryptographic Algorithm Validation Program (CAVP). - Alignment of the organization's data classification scheme (e.g., low, medium, and high security categorizations) with minimum acceptable sanitization methods (i.e., clear, purge, and destroy)
- Requirements for the disposal and/or reuse of storage assets
- Expected outcomes from storage sanitization activities (e.g., identification of specific, acceptable sanitization techniques [13])
- Documentation or evidence associated with sanitization activities (see Sec.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Security Assessment?

[Assistant]
According to Status Report on the Fourth Round of the NIST Post-Quantum Cryptography Standardization Process:

NIST is selecting public-key cryptographic algorithms through a public, competition-like process to specify additional digital signature, public-key encryption, and key-establishment algorithms to supplement FIPS 186-5, SP 800-56Ar3, and SP 800-56Br2. These algorithms are intended to protect sensitive information well into the foreseeable future, including after the advent of quantum computers. In the fourth round of the Post-Quantum Cryptography Standardization Process, NIST selected four candidate algorithms for key establishment to be studied: BIKE, Classic McEliece, HQC, and SIKE. This report describes the evaluation and selection process of these fourth-round candidates based on public feedback and internal review. The report summarizes each of the candidate algorithms and identifies those selected for standardization. The only key-establishment algorithm that will be standardized is HQC, and NIST will develop a standard based on HQC to augment its key-establishment portfolio. | 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . | . . . | 1              |
|------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------|
| 1.1. | Purpose and Organization of This Document . . . . | 3              |
| 2. Evaluation Criteria and Selection Process . . | . . . . . . . . | 4              |
| 2.1. | Acceptance of the Fourth-Round Candidates . . . . | 4              |
| 2.2. | Evaluation Criteria . . . . . . . . . . . . . . . . . . . . | 4              |
|                                                                                | 2.2.1. Security . . . . . . . . . . . . . . . . . . . . . .

Status Report on the Fourth Round of the NIST Post-Quantum Cryptography Standardization Process


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Awareness and Training?

[Assistant]
According to Contingency Planning Guide for Federal Information Systems:

| | Introduction ....................................................................................................1 | | |-----------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------| | 1.1 | | Purpose.......................................................................................................................1 | | | 1.2 | | Scope..........................................................................................................................2 | | | 1.3 | | Audience.....................................................................................................................3 | | | 1.4 | Document | Structure....................................................................................................4 | | | Chapter 2.

Contingency Planning Guide for Federal Information Systems


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for Configuration Management?

[Assistant]
According to Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171:

............................................ 5                        |
| 2.1 DEVELOPMENTAPPROACH ......................................................................................................
| 5                                                                                |
| 2.2 ORGANIZATIONANDSTRUCTURE                                                                                | ............................................................................................. 7                                                  |
| 2.3 FLEXIBLE APPLICATION                                                                                | ............................................................................................................. 9                                  |
| CHAPTER THREE THE REQUIREMENTS......................................................................................... 11                       | CHAPTER THREE THE REQUIREMENTS......................................................................................... 11                       |
| 3.1 ACCESSCONTROL                                                                                | .................................................................................................................. 12                            |
| 3.2 AWARENESSANDTRAINING                                                                                | ...................................................................................................

Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Recommendation for Pair-Wise Key-Establishment Using Integer Factorization Cryptography provide? (Part 8)

[Assistant]
|
| 3.2 Symbols and Abbreviations................................................................................................
9                                                                                | 3.2 Symbols and Abbreviations................................................................................................ 9                                                                                | 3.2 Symbols and Abbreviations................................................................................................ 9                                                                                |
| Key-Establishment Schemes Overview............................................................................... 16                                                                                | Key-Establishment Schemes Overview............................................................................... 16                                                                                | Key-Establishment Schemes Overview...............................................................................

Recommendation for Pair-Wise Key-Establishment Using Integer Factorization Cryptography

Audit and Accountability
System and Information Integrity
Security Assessment
Media Protection
Identification and Authentication
Awareness and Training
System and Communications Protection
Access Control
Planning
Incident Response
Risk Assessment
Personnel Security
System and Services Acquisition
Supply Chain Risk Management
Maintenance
Physical Protection
Configuration Management


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Access Control?

[Assistant]
According to Summary of NIST SP 800-53, Revision 4_ Security and Privacy Controls for Federal Information Systems and Organizations:

The resulting tailored baseline set of security controls and the supporting rationale for the selection decisions (including any information system use restrictions required by organizations) are documented in system security plans. Documenting significant risk management decisions in the security control selection process is imperative so that authorizing officials have access to necessary information to make informed authorization decisions for organizational information systems, as demonstrated in Figure 3.

Summary of NIST SP 800-53, Revision 4_ Security and Privacy Controls for Federal Information Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Physical Protection?

[Assistant]
According to Digital Identity Guidelines_ Authentication and Authenticator Management:

The Information Technology Laboratory (ITL) at the National Institute of Standards and
Technology (NIST) promotes the U.S. economy and public welfare by providing technical
leadership for the Nation’s measurement and standards infrastructure. ITL develops
tests, test methods, reference data, proof of concept implementations, and technical
analyses to advance the development and productive use of information technology.
ITL’s responsibilities include the development of management, administrative, technical,
and physical standards and guidelines for the cost-effective security and privacy of other
than national security-related information in federal information systems. The Special
Publication 800-series reports on ITL’s research, guidelines, and outreach efforts in
information system security, and its collaborative activities with industry, government,
and academic organizations.

3.2.1. Physical Authenticators

This guideline applies to the digital authentication of subjects to systems over a network.
It also requires that verifiers and RPs participating in authentication protocols be
authenticated to claimants to assure the identity of the services with which they are
authenticating. It does not address the authentication of a person for physical access
(e.g., to a building).

Digital Identity Guidelines_ Authentication and Authenticator Management


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Cryptographic Module Validation Program (CMVP)-Approved Security Functions_ CMVP Validation Authority Updates to ISO_IEC 24759 provide? (Part 2)

[Assistant]
ts, guidelines, and procedures, where they exist, remain operative. For planning and transition purposes, federal agencies may wish to closely follow the development of these new publications by NIST.
Organizations are encouraged to review all draft publications during public comment periods and provide feedback to NIST. Many NIST cybersecurity publications, other than the ones noted above, are available at https://csrc.nist.gov/publications. ## Authority

This publication has been developed by NIST in accordance with its statutory responsibilities under the Federal Information Security Modernization Act (FISMA) of 2014, 44 U.S.C. § 3551 et seq., Public Law (P.L.) 113-283. NIST is responsible for developing information security standards and guidelines, including minimum requirements for federal information systems, but such standards and guidelines shall not apply to national security systems without the express approval of appropriate federal officials exercising policy authority over such systems. This guideline is consistent with the requirements of the Office of Management and Budget (OMB) Circular A-130. Nothing in this publication should be taken to contradict the standards and guidelines made mandatory and binding on federal agencies by the Secretary of Commerce under statutory authority. Nor should these guidelines be interpreted as altering or superseding the existing authorities of the Secretary of Commerce, Director of the OMB, or any other federal official. This publication may be used by nongovernmental organizations on a voluntary basis and is not subject to copyright in the United States. Attribution would, however, be appreciated by NIST.

Cryptographic Module Validation Program (CMVP)-Approved Security Functions_ CMVP Validation Authority Updates to ISO_IEC 24759


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] How does Assessing Security Requirements for Controlled Unclassified Information support CMMC certification?

[Assistant]
According to Assessing Security Requirements for Controlled Unclassified Information:

other than the ones noted above, are available at

Organizations are encouraged to review all draft publications during public comment periods and provide feedback https://csrc.nist.gov/publications.
## Authority

This publication has been developed by NIST in accordance with its statutory responsibilities under the Federal Information Security Modernization Act (FISMA) of 2014, 44 U.S.C. § 3551 et seq., Public Law (P.L.) 113-283 [1]. NIST is responsible for developing information security standards and guidelines, including minimum requirements for federal information systems, but such standards and guidelines shall not apply to national security systems without the express approval of appropriate federal officials exercising policy authority over such systems. This guideline is consistent with the requirements of the Office of Management and Budget (OMB) Circular A-130 [2]. Nothing in this publication should be taken to contradict the standards and guidelines made mandatory and binding on federal agencies by the Secretary of Commerce under statutory authority. Nor should these guidelines be interpreted as altering or superseding the existing authorities of the Secretary of Commerce, Director of the OMB, or any other federal official. This publication may be used by nongovernmental organizations on a voluntary basis and is not subject to copyright in the United States. Attribution would, however, be appreciated by NIST. ## NIST Technical Series Policies

Copyright, Use, and Licensing Statements NIST Technical Series Publication Identifier Syntax

## Publication History

Approved by the NIST Editorial Review Board on 2024-04-23 Supersedes NIST Special Publication 800-171A (June 2018) https://doi.org/10.6028/NIST.SP.800-171A

## How to Cite this NIST Technical Series Publication:

Ross R, Pillitteri V (2024) Assessing Security Requirements for Controlled Unclassified Information and Organizations.

Assessing Security Requirements for Controlled Unclassified Information


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Audit and Accountability?

[Assistant]
According to Recommendation for Pair-Wise Key-Establishment Schemes Using Discrete Logarithm Cryptography:

|                                                                                | 6.3.2                                                                                | (Cofactor) Static Unified Model, C(0e, 2s, ECC CDH) Scheme..................... 105                                                                                |
|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
|                                                                                | 6.3.3                                                                                | Incorporating Key Confirmation into a C(0e, 2s) Scheme ..............................

Recommendation for Pair-Wise Key-Establishment Schemes Using Discrete Logarithm Cryptography


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Supply Chain Risk Management?

[Assistant]
According to Analyzing Collusion Threats in the Semiconductor Supply Chain:

## Analyzing Collusion Threats in the Semiconductor Supply Chain

Rekhi S, Amberiadis K, Akib AA, Srivastava A (2025) Analyzing Collusion Threats in the Semiconductor Supply Chain. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Cybersecurity White Paper (CSWP) NIST CSWP 46. https://doi.org/10.6028/NIST.CSWP.46

This work proposes a framework for analyzing threats related to the semiconductor supply chain. The framework introduces a metric that quantifies the severity of different threats subjected to a collusion of adversaries from different stages of the supply chain. Two different case studies are provided to describe the real-life application of the framework. The metrics and analysis aim to guide security efforts and optimize the trade-offs of hardware security and costs.

Analyzing Collusion Threats in the Semiconductor Supply Chain


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Validating the Integrity of Computing Devices provide? (Part 10)

[Assistant]
://www.nist.gov. ## NIST CYBERSECURITY PRACTICE GUIDES

NIST Cybersecurity Practice Guides (Special Publication 1800 series) target specific cybersecurity challenges in the public and private sectors.
They are practical, user-friendly guides that facilitate the adoption of standards-based approaches to cybersecurity. They show members of the information security community how to implement example solutions that help them align with relevant standards and best practices, and provide users with the materials lists, configuration files, and other information they need to implement a similar approach. The documents in this series describe example implementations of cybersecurity practices that businesses and other organizations may voluntarily adopt. These documents do not describe regulations or mandatory practices, nor do they carry statutory authority. ## ABSTRACT

Organizations are increasingly at risk of cyber supply chain compromise, whether intentional or unintentional. Cyber supply chain risks include counterfeiting, unauthorized production, tampering, theft, and insertion of unexpected software and hardware. Managing these risks requires ensuring the integrity of the cyber supply chain and its products and services. This project demonstrates how organizations can verify that the internal components of the computing devices they acquire, whether laptops or servers, are genuine and have not been tampered with. This solution relies on device vendors storing information within each device, and organizations using a combination of commercial off-theshelf and open-source tools that work together to validate the stored information. This NIST Cybersecurity Practice Guide describes the work performed to build and test the full solution. ## KEYWORDS

computing devices; cyber supply chain; cyber supply chain risk management (C-SCRM); hardware root of trust; integrity; provenance; supply chain; tampering .

Validating the Integrity of Computing Devices


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice CM.L2-3.4.3 (NIST 3.4.3)?

[Assistant]
According to Validating the Integrity of Computing Devices:

3.4.3                                                                                | Risk... 3.4.3 Risk

SP 800-161 Revision 1 [3] provides an analysis framework for organizations to assess supply chain risk by creating a threat scenario -a summary of potential consequences of the successful exploitation of a specific vulnerability or vulnerabilities by a threat agent. 3.4.3.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations provide? (Part 5)

[Assistant]
blication 800-series reports on ITL's research, guidelines, and outreach efforts in information system security, and its collaborative activities with industry, government, and academic organizations.
## Audience

This publication serves a diverse group of individuals and organizations in the public and private sectors, including:

- Federal agencies responsible for managing and protecting CUI
- Nonfederal organizations responsible for protecting CUI
- Individuals with system development life cycle responsibilities (e.g., program managers, mission/business owners, information owners/stewards, system designers and developers, system/security engineers, systems integrators)
- Individuals with acquisition or procurement responsibilities (e.g., contracting officers)
- Individuals with system, security, or risk management and oversight responsibilities (e.g., authorizing officials, chief information officers, chief information security officers, system owners, information security managers)
- Individuals with security assessment and monitoring responsibilities (e.g., auditors, system evaluators, assessors, analysts, independent verifiers and validators)

The above roles and responsibilities can be viewed from two perspectives:

- Federal perspective : The entity establishing and conveying the security requirements in contractual vehicles or other types of agreements
- Nonfederal perspective : The entity responding to and complying with the security requirements set forth in contracts or agreements

## Patent Disclosure Notice

NOTICE: ITL has requested that holders of patent claims whose use may be required for compliance with the guidance or requirements of this publication disclose such patent claims to ITL. However, holders of patents are not obligated to respond to ITL calls for patents and ITL has not undertaken a patent search in order to identify which, if any, patents may apply to this publication.

Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Services Acquisition?

[Assistant]
According to Workshop on Enhancing Security of Devices and Components Across the Supply Chain:

ards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology.
ITL's responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in federal information systems.

Workshop on Enhancing Security of Devices and Components Across the Supply Chain


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice CM.L2-3.4.2 (NIST 3.4.2)?

[Assistant]
According to Validating the Integrity of Computing Devices:

3.4.2                                                                                | Vulnerabilities... 3.4.2 Vulnerabilities

This document is guided by NIST SP 800-161 Revision 1 [3], which describes an ICT supply chain vulnerability as the following:

' A vulnerability is a weakness in an information system, system security procedures, internal controls, or implementation that could be exploited or triggered by a threat source […] . 3.4.2 PR.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What guidance does High-Performance Computing Security_ Architecture, Threat Analysis, and Security Posture provide?

[Assistant]
<!-- image -->

## NIST Special Publication 800 NIST SP 800-223

## High-Performance Computing Security

Architecture, Threat Analysis, and Security Posture

Yang Guo Ramaswamy Chandramouli Lowell Wofford Rickey Gregg Gary Key Antwan Clark Catherine Hinton Andrew Prout Albert Reuther Ryan Adamson Aron Warren Purushotham Bangalore Erik Deumens

Csilla Farkas

This publication is available free of charge from:

https://doi.org/10.6028/NIST.SP.800-223

<!-- image -->

## NIST Special Publication 800 NIST SP 800-223

## High-Performance Computing Security

Architecture, Threat Analysis, and Security Posture

Yang Guo Ramaswamy Chandramouli

Computer Security Division

Information Technology Laboratory

Lowell Wofford Amazon.com, Inc. Rickey Gregg Gary Key

HPCMP

Antwan Clark Laboratory for Physical Sciences

Catherine Hinton

Los Alamos National Laboratory

Andrew Prout Albert Reuther MIT Lincoln Laboratory

Ryan Adamson

Oak Ridge National Laboratory

Aron Warren Sandia National Laboratories

Purushotham Bangalore

University of Alabama

Erik Deumens University of Florida

Csilla Farkas University of South Carolina

This publication is available free of charge from:

https://doi.org/10.6028/NIST.SP.800-223

February 2024

<!-- image -->

U.S. Department of Commerce Gina M. Raimondo, Secretary

Certain commercial entities, equipment, or materials may be identified in this document in order to describe an experimental procedure or concept adequately. Such identification is not intended to imply recommendation or endorsement by the National Institute of Standards and Technology (NIST), nor is it intended to imply that the entities, materials, or equipment are necessarily the best available for the purpose. There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities.

High-Performance Computing Security_ Architecture, Threat Analysis, and Security Posture


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Maintenance?

[Assistant]
According to Strategies for the Integration of Software Supply Chain Security in DevSecOps CI_CD Pipelines:

Additional information about this publication is available at https://csrc.nist.gov/pubs/sp/800/204/d/final, including related content, potential updates, and document history. | Executive Summary............................................................................................................................1        |
|-------------------------------------------------------------------------------------------------------------------------------------------------------|
| 1. Introduction...................................................................................................................................2   |
| 2. Software Supply Chain (SSC) -Definition and Model .....................................................................4                           |
| 2.4.1. Software Supply Chain Defects ....................................................................................................6            |
| 2.4.2. Software Supply Chain Attacks.....................................................................................................6            |
| SSC Security -Risk Factors and Mitigation Measures .....................................................................8                             |
| 3. |
| 3.1.1. Developer Environment ...............................................................................................................8         |
| 3.1.2. Threat Actors................................................................................................................................8 |
| 3.1.3. Attack Vectors ..............................................................................................................................9 |
| 3.1.4. Attack Targets (Assets).................................................................................................................9      |
| 3.1.5.

Strategies for the Integration of Software Supply Chain Security in DevSecOps CI_CD Pipelines


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Maintenance?

[Assistant]
According to Control Baselines for Information Systems and Organizations:

INCLUDES UPDATES AS OF 12-10-2020; SEE PAGE XI

| CHAPTERONE INTRODUCTION...................................................................................................... 1               | CHAPTERONE INTRODUCTION...................................................................................................... 1               | CHAPTERONE INTRODUCTION...................................................................................................... 1   |
|-----------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------|
| 1.1                                                                                | PURPOSEANDAPPLICABILITY ................................................................................................... | 1                                                                                |
| 1.2                                                                                | TARGET AUDIENCE .................................................................................................................. | 2                                                                                |
| 1.3                                                                                | ORGANIZATIONAL RESPONSIBILITIES .........................................................................................

Control Baselines for Information Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Audit and Accountability?

[Assistant]
According to Blockchain for Access Control Systems:

The rapid development and wide application of distributed network systems have made network security  -  especially  access  control  and  data  privacy  -  ever  more  important.  Blockchain technology offers features such as decentralization, high confidence, and tamper-resistance, which are advantages to solving auditability, resource consumption, scalability, central authority, and trust issues - all of which are challenges for network access control by traditional mechanisms. This document presents general information for blockchain access control systems from the views of blockchain system properties, components, functions, and supports for access control policy models. Considerations for implementing blockchain access control systems are also included.

Blockchain properties improve the security, flexibility, scalability, integrity, and confidentiality of AC data/logs and processes (compared to traditional AC systems) by allowing organizations to verify and audit AC data transactions and processes to track the states of their AC systems hosted on distributed sites [SP162].

Blockchain  systems  provide  an  alternative  (or  complimentary)  system  for  reliability,  security, accountability, and scalability for AC systems. Blockchain characteristics - such as transparency, distributed computing/storage, and a tamper-evident/tamper-resistant design - help to prevent AC data from being accessed or modified by malicious users. Access logs are also recorded in blocks that  allow  for  the  detection  of  malicious  activities.  Blockchain  system  components  and  their advantages for AC systems are:


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Overview and Considerations of Access Control Based on Attribute Encryption provide? (Part 7)

[Assistant]
...........................22                        |                                                                                |
| 5.1.2.
| Threats and Attacks ................................................................................................23                      |                                                                                |
| 5.2. | Performance..............................................................................................................24                 |                                                                                |
| 5.2.1. | Computational Complexity.......................................................................................24                           |                                                                                |
| 5.2.2. | Keys and Ciphertext Size                                                                                | ........................................................................................24                                             |
| 5.2.3. | Physical Limitations.................................................................................................25                     |                                                                                |
| 5.3. | Access Control Policies and Model Supports.............................................................25                                   |                                                                                |
| 6.

Overview and Considerations of Access Control Based on Attribute Encryption


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Audit and Evaluation of Computer Security II_ System Vulnerabilities and Controls provide? (Part 6)

[Assistant]
e successful approach used in the first workshop, leading experts in the audit and computer communities were again invited to share their views -this time on a more focused arrangement of the subject.
Three manageria] and five technical sessions on vulnerabilities and countering controls were the result. These Proceedings contain the findings of these eight sessions. The Co-Chairpersons of this workshop were Robert G. McKenzle, an Audit Manager with the GAO [now Eastern Region Director of Audit for the National Aeronautics and Space Administration] , and Zella G. Ruthberg, a Computer Scientist with fIBS. The GAO again gave their generous support to this important undertaking by allowing Mr. McKenzle to devote time to the planning and execution of the workshop, by sending several vital attendees, and by providing us with Mr. Donald L. Scantlebury, Director of the Financial and General Management Studies Division, as Keynote speaker and Chairperson of the session in "Managerial and Organizational Vulnerabilities and Controls -Staff Level."

The Proceedings represent the thinking of the Invited participants. The views expressed do not necessarily reflect those of the National Bureau of Standards, the U. S. General Accounting Office, or any of the organizations that sponsored an individual at the workshop. However, we at the National Bureau of Standards think these Proceedings warrant careful consideration by all those seriously concerned with security of computer systems and data. <!-- image -->

1^1^ ctA^H\_\_\_\_.\^

Cenr^rfor Programming Science and Technology

The National Bureau of Standards, with the support of the U.S. General Accounting Office, sponsored a second invitational workshop on computer security audit, entitled "Audit and Evaluation of Computer Security II: System Vulnerabilities and Controls," In Miami Beach, Florida, on November 28-30, 1978.

Audit and Evaluation of Computer Security II_ System Vulnerabilities and Controls


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Assessing Security Requirements for Controlled Unclassified Information provide? (Part 9)

[Assistant]
led Unclassified Information (CUI) in Nonfederal Systems and Organizations [3]. Organizations can use the assessment procedures to generate evidence that the security requirements have been satisfied.
The scope of the security assessments conducted using the procedures described in this publication is guided and informed by the system security plans for systems that process, store, or transmit CUI. The assessment procedures offer the flexibility to customize assessments based on organizational policies and requirements, known threat and vulnerability information, system and platform dependencies, operational considerations, and tolerance for risk. 1

## 1.2. Organization of This Publication

The remainder of this special publication is organized as follows:

- Section 2 describes the fundamental concepts associated with assessments of security requirements, including assessment procedures, methods, objects, and assurance cases that can be created using the evidence produced during assessments. - Section 3 provides assessment procedures for the security requirements in SP 800-171, including assessment objectives and potential assessment methods and objects for each procedure. 1  The term risk refers to risks to organizational operations (i.e., mission, functions, image, and reputation), organizational assets, individuals, other organizations, and the Nation. See SP 800-39 [4] for additional information on organizational risk management and risk tolerance. The following sections provide additional information to support the protection of CUI:

- References
- Appendix A: Acronyms
- Appendix B: Glossary
- Appendix C: Security Requirement Assessments
- Appendix D: Organization-Defined Parameters
- Appendix E: Change Log

The contents of this publication can be used for many different assessment-related purposes to determine organizational compliance with the security requirements.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Physical Protection?

[Assistant]
According to Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations:

................................................................................57 |                                                                                |
| Appendix A.
C-SCRM Security Controls............................................................................................... | 63                                                                                |
| A.1.1. C-SCRM Controls Summary........................................................................................................63              |                                                                                |
| A.1.1.1. C-SCRM Controls Throughout the Enterprise.......................................................................64                           |                                                                                |
| A.1.2. Selecting, Tailoring, and Implementing C-SCRM Security Controls ...........................................67                                  |                                                                                |
| A.2.3. FAMILY: ACCESS CONTROL.........................................................................................................69              |                                                                                |
| A.2.4. FAMILY: AWARENESS AND TRAINING........................................................................................76                       |                                                                                |
| A.2.5. FAMILY: AUDIT AND ACCOUNTABILITY......................................................................................79                       |                                                                                |
| A.2.6.

Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Personnel Security?

[Assistant]
According to Guide to Auditing for Controls and Security_ A System Development Life Cycle Approach:

This guide addresses auditing the system development hfe cycle (SDLC) process for an automated information system (AIS), to ensure that controls and security are designed and built into the system. The guide also presents a process for deciding which system to audit among an organization's universe of systems. It is directed toward mid-level ADP auditors having a minimum of two years experience in ADP auditing, but can also be used by security reviewers, quaHty assurance personnel, and as a training tool for less experienced ADP auditors. ADP managers and system developers will also find it useful guidance on security and control issues. The guide is designed to provide audit/review programs for each major phase of the SDLC process and assumes a large sensitive system. The reader is expected to make appropriate modifications for small less sensitive systems. The guide represents the results of the past four years of activities by the Electronic Data Processing (EDP) Systems Review and Security Work Group of the Computer Security Project within the President's Council on Integrity and Efficiency (PCIE). (See Appendix A for more information on the Work Group.)

This guide covers auditing the system development life cycle (SDLC)^process for a system, to ensure that controls and security are designed into the system. The guide also presents a process for deciding which system to audit among an organization's universe of systems. It is directed toward mid-level ADP'^ auditors having a minimum of two years experience in ADP auditing, but can also be used by security reviewers, quality assurance personnel, and as a training tool for auditors with less experience in ADP auditing. ADP managers and system developers will also find it useful guidance on security and control issues. The guide is designed to provide audit/review programs for each major phase of the SDLC and assumes a large sensitive system.

Guide to Auditing for Controls and Security_ A System Development Life Cycle Approach


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Identification and Authentication?

[Assistant]
According to Incident Response Recommendations and Considerations for Cybersecurity Risk Management_ A CSF 2.0 Community Profile:

- Employing a botnet to send high volumes of connection requests to an internet-facing service, making it unavailable to legitimate service users
- Obtaining administrative credentials at a software-as-a-service provider, which puts sensitive tenant data entrusted to that provider at risk
- Intruding upon an organization's business network to steal credentials and use them to instruct industrial control systems to shut down or destroy critical physical components, causing a major service disruption
- Deploying ransomware to prevent the use of computer systems and cause multiple data breaches by copying files from those systems
- Using phishing emails to compromise user accounts and using those accounts to commit financial fraud
- Identifying a new vulnerability in network management appliances and exploiting the vulnerability to gain unauthorized access to network communications
- Compromising a vendor's software, which is subsequently distributed to customers in its compromised state

Processes and procedures should be based on the incident response policy and plan. Documented procedures should explain how technical processes and other operating procedures should be performed. Procedures can be tested or exercised periodically to verify their accuracy and can be used to help train new personnel. While it is impossible to have detailed procedures for every possible situation, organizations should consider documenting procedures for responding to the most common types of incidents and threats. Organizations should also develop and maintain procedures for particularly important processes that may be urgently needed during emergency situations, such as redeploying the organization's primary authentication platform.

Incident Response Recommendations and Considerations for Cybersecurity Risk Management_ A CSF 2.0 Community Profile


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Risk Assessment?

[Assistant]
According to Guide to Auditing for Controls and Security_ A System Development Life Cycle Approach:

| | 1.1.5 | Relevant Laws and Regulations | Relevant Laws and Regulations | 4 | | | 1.1.5.1 | Requirements for Audit Involvement | Requirements for Audit Involvement | 4 | | | | 1.1.5.2 | Requirements for Internal Control | 5 | | 1.2 | RISKS GENERATED BY COMPUTER TECHNOLOGY | RISKS GENERATED BY COMPUTER TECHNOLOGY | RISKS GENERATED BY COMPUTER TECHNOLOGY | 6 | | | 1.2.1 Overview of Risks | 1.2.1 Overview of Risks | 1.2.1 Overview of Risks | 6 | | | 1.2.1.1 | | Definitions | 7 | | | | 1.2.1.2 | Vulnerability/Risk Related Requirements | 7 | | | 1.2.2 | Risks in a Computerized Environment | Risks in a Computerized Environment | 8 | | | | 1.2.2.1 | Additional Risks Present in a Computerized Environment | 8 | | | | 1.2.2.2 | Assessing Vulnerabilities Through the Audit Process | 9 | | 1.3 | CONTROL OBJECTIVES AND STANDARDS IN A COMPUTER ENVIRONMENT | CONTROL OBJECTIVES AND STANDARDS IN A COMPUTER ENVIRONMENT | CONTROL OBJECTIVES AND STANDARDS IN A COMPUTER ENVIRONMENT | 10 | | | 1.3.1 | Impact of the Computer on Controls | Impact of the Computer


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does A Data Structure for Integrity Protection with Erasure Capability provide? (Part 6)

[Assistant]
The  total  number  of  data  blocks  in  the  matrix  is N 2 -N since  the  diagonal  is  null. Thus,  the  last
- numbered  block  in  a  filled  matrix  of  N  rows  and columns is number N 2 -N .
- Lower half: Numbered from 0, with no data blocks on the diagonal, the total of blocks for i rows in the lower half (below diagonal) is ( i + 1) 2 -( i +1) = i 2 + i ,  with  the  last  data  block  in  the  lower  half numbered  as i 2 + i ,  and  because  the  diagonal  is empty, j = i -1 . The  first  data  block  in  row i is i 2 -i +2 ,  with j = 0 . - Upper half: the last upper half data block in column j is j 2 + j -1 ,  with i = j -1 . For a block B in the lower half ( B is even), i, j indices can be computed as:

<!-- formula-not-decoded -->

and for block B in the upper half ( B is odd), i, j indices can be computed as: :

<!-- formula-not-decoded -->

Note: [ ϵ ] is  the  Iverson  bracket where [ ϵ ] = 1 if  expression ϵ evaluates to true ,  and 0 otherwise. Blocks  can  now  be  deleted  by  overwriting  with  zeroes, with one row and one column hash recalculated. Specifically, after  deleting  block i, j ,  row i and  column j hash  values are  recalculated. The  block  matrix  data  structure  may  have utility  for  incorporation  into  applications  requiring  integrity protection  that  currently  use  permissioned  blockchains. This capability  could  for  example  be  useful  in  meeting  privacy requirements such as the European Union General Data Protection Regulation (GDPR), which requires that organizations make it possible to delete all information related to a particular individual, at that person's request. This requirement may be incompatible with current blockchain data structures, including permissioned blockchains [2] [3] [4], because blockchains are designed  to  ensure  that  block  contents  are  immutable. Any change  in  a  blockchain  will  invalidate  subsequent  hashes  in following  blocks,  losing  integrity  protection.

A Data Structure for Integrity Protection with Erasure Capability

Audit and Accountability
System and Information Integrity
Media Protection
Identification and Authentication
Awareness and Training
System and Communications Protection
Access Control
Planning
Incident Response
Risk Assessment
Personnel Security
System and Services Acquisition
Supply Chain Risk Management
Maintenance
Physical Protection
Security Assessment


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Ascon-Based Lightweight Cryptography Standards for Constrained Devices_ Authenticated Encryption, Hash, and Extendable Output Functions provide? (Part 8)

[Assistant]
--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-----|
| Table 2.
Terms and definitions........................................................... |   3 |
| Table 3. Notations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . |   5 |
| Table 4. Basic operations and functions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . |   6 |
| Table 5. The constants const 𝑖 to derive round constants of the Ascon permutations. |   9 |
| Table 6. Lookup table representation of SBOX . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . |  10 |
| Table 7. Security strength of Ascon-AEAD128 with 𝜆 -bit tag in the 𝑢 -key setting, where ( 𝑁 , 𝐴 ) pairs are distinct for encryption per key . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . |  21 |
| Table 8. Integrity security strength of Ascon-AEAD128 with 𝑢 keys in the nonce- misuse setting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . |  22 |
| Table 9. Security strengths of Ascon-Hash256 , Ascon-XOF128 , and Ascon-CXOF128 algorithms . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . |  31 |
| Table 10. Address for each byte of Ascon state word 𝑆 𝑖 in memory on little-endian and big-endian machines, where the word 𝑆 𝑖 begins at memory address 𝑎 . . . . . . . . . . |  36 |
| Table 11. Examples of padding an unsigned integer 𝑥 to a 64-bit block, where 𝑥 encodes a sequence of bytes that each have value 0xFF in little-endian byte order . |  38 |
| Table 12.

Ascon-Based Lightweight Cryptography Standards for Constrained Devices_ Authenticated Encryption, Hash, and Extendable Output Functions


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Summary of NIST SP 800-53, Revision 4_ Security and Privacy Controls for Federal Information Systems and Organizations provide? (Part 5)

[Assistant]
e of continuous improvement in the organization's risk-related activities, with effective communication among tiers and stakeholders. Figure 1 illustrates the three-tiered approach to risk management.
Figure 1: Risk Management 3-Tiered Approach

<!-- image -->

The NIST Risk Management Framework (RMF), described in NIST Special Publication 800-37 Revision 1, Guide for Applying the Risk Management Framework to Federal Information Systems: a Security Life Cycle Approach, is a methodology for implementing risk management at the information systems tier. The RMF (depicted in Figure 2) identifies six distinct steps that provide a disciplined and structured process to integrate information security risk management activities into the system development life cycle. The RMF addresses security concerns of organizations related to the design, development, implementation, operation, and disposal of information systems and the environments in which those systems operate. The security controls in SP 800-53 Rev. 4 support Step Two of the RMF, and a detailed catalog of these controls is provided in Appendix F. For ease of use in the security control selection and specification process, controls are organized into eighteen families, each containing security controls related to the general security topic of the family. Security controls involve aspects of policy, oversight, supervision, manual processes, individual actions, or automated mechanisms implemented by information systems/devices. The security control structure consists of the

following components: (i) a control section; (ii) a supplemental guidance section; (iii) a control enhancements section; (iv) a references section; and (v) a priority and baseline allocation section.

Summary of NIST SP 800-53, Revision 4_ Security and Privacy Controls for Federal Information Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AT.L2-3.2.4 (NIST 3.2.4)?

[Assistant]
According to Digital Identity Guidelines_ Authentication and Authenticator Management:

3.2.4. 3.2.4

Biometric comparison can be performed locally on a device being used by the claimant
or at a central verifier. 3.2.4.

Digital Identity Guidelines_ Authentication and Authenticator Management


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice CM.L2-3.4.2 (NIST 3.4.2)?

[Assistant]
According to Multi-Factor Authentication for Criminal Justice Information Systems_ Implementation Considerations for Protecting Criminal Justice Information:

3.4.2. 3.4.2. 3.4.2 covers state agency MFA.

Multi-Factor Authentication for Criminal Justice Information Systems_ Implementation Considerations for Protecting Criminal Justice Information


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Validating the Integrity of Computing Devices provide? (Part 4)

[Assistant]
guidance focused on the developers and providers of technology. NIICS' mission is to help organizations build, evaluate, and assess the cybersecurity of

products and services in their supply chains.
This project aligns with that mission by demonstrating how organizations can verify that the internal components of the computing devices they acquire are genuine and have not been tampered with. This prototype relies on device vendors storing information within each device and organizations using a combination of commercial off-the-shelf and open-source tools that work together to validate the stored information. By doing this, organizations can reduce the risk of compromise to products within their supply chains. In this approach, device vendors create an artifact within each device that securely binds the device's attributes to the device's identity. The customer who acquires the device can validate the artifact's source and authenticity, then check the attributes stored in the artifact against the device's actual attributes to ensure they match. A similar process can be used to periodically verify the integrity of computing devices while they are in use. The authoritative source of information regarding the provenance and integrity of the components provides a strong basis for trust in a computing device. Hardware roots of trust are the foundation upon which the computing system's trust model is built, forming the basis in hardware for providing one or more security-specific functions for the system. Incorporating hardware roots of trust into acquisition and lifecycle management processes enables organizations to achieve better visibility into supply chain attacks and to detect advanced persistent threats and other attacks. By leveraging hardware roots of trust capabilities as a computing device traverses the supply chain, we can maintain trust in the computing device throughout its operational lifecycle.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Services Acquisition?

[Assistant]
According to Guidelines on Mobile Device Forensics:

e field of digital forensics. This guide attempts to bridge the gap by providing an indepth look into mobile devices and explaining technologies involved and their relationship to forensic procedures.
This document covers mobile devices with features beyond simple voice communication and text messaging capabilities. This guide also discusses procedures for the validation, preservation, acquisition, examination, analysis, and reporting of digital information.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Configuration Management?

[Assistant]
According to Guide to Auditing for Controls and Security_ A System Development Life Cycle Approach:

| ^ | 3.2.2 | Size of Review Task | Size of Review Task | 49 | |-----------|------------------------------------------------------------------|------------------------------------------------------------------|------------------------------------------------------------------|-----------| | 3.3 | BACKGROUND ON THE METHODOLOGY | BACKGROUND ON THE METHODOLOGY | BACKGROUND ON THE METHODOLOGY | 49 | | | 3.3.1 | The Invitational Workshop | The Invitational Workshop | 49 | | | 3.3.2 | Workshop Points of Agreement | Workshop Points of Agreement | 49 | | 3.4 | AWORK PRIORITY SCHEME FOR THE ADP AUDITOR | AWORK PRIORITY SCHEME FOR THE ADP AUDITOR | AWORK PRIORITY SCHEME FOR THE ADP AUDITOR | 50 | | | 3.4.1 | Assumptions and Caveats | Assumptions and Caveats | 50 | | | 3.4.2 | Audit Planning/Prioritization Process | Audit Planning/Prioritization Process | 51 | | | 3.4.3 | Non-Discretionary Audits | Non-Discretionary Audits | 51 | | | 3.4.4 | Risk Evaluation Levels and Dimensions | Risk Evaluation Levels and Dimensions | 53 | | | 3.4.5 | Two Level Work Priority Dimensions/Characteristics | Two Level Work Priority Dimensions/Characteristics | 54 | | | 3.4.5.1 Level I: | 3.4.5.1 Level I: | 3.4.5.1 Level I: | .....55 | | | 3.4.5.1.1 Mission Impact/Strategic Value/Organization | 3.4.5.1.1 Mission Impact/Strategic Value/Organization


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice CM.L2-3.4.1 (NIST 3.4.1)?

[Assistant]
According to Zero Trust Architecture:

3.4.1                                                                                | Requisitos de la red para admitir una ZTA... 3.4.1 Requisitos de la red para admitir una ZTA

1. 3.4.1, todo el tráfico se inspecciona, se registra en la red y se analiza con el fin de identificar y reaccionar ante posibles ataques contra la empresa.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Audit and Accountability?

[Assistant]
According to Recommendations for Federal Vulnerability Disclosure Guidelines:

| Executive Summary................................................................................................................. | Executive Summary................................................................................................................. | Executive Summary................................................................................................................. |
|--------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------|
| U.S. Government Vulnerability Disclosure..................................................................... | 2                                                                                |                                                                                |
| Usage of Document Terminology................................................................................ | 5                                                                                |                                                                                |
| Federal Vulnerability Disclosure Coordination Body ....................................................

Recommendations for Federal Vulnerability Disclosure Guidelines


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Digital Identity Guidelines_ Identity Proofing and Enrollment provide? (Part 4)

[Assistant]
OIA). NIST SP 800-63A-4
July 2025

Abstract

Digital Identity Guidelines
Identity Proofing and Enrollment

This guideline focuses on identity proofing and enrollment for use in digital
authentication.
During the process of identity proofing, an applicant provides evidence
to a credential service provider (CSP) reliably identifying themselves, thereby allowing
the CSP to assert that identification at a useful identity assurance level. This document
defines technical requirements for each of three identity assurance levels. The guidelines
are not intended to constrain the development or use of standards outside of this
purpose. This publication supersedes NIST Special Publication (SP) 800-63A. Keywords

authentication; credential service provider; digital authentication; identity proofing;
federation. Reports on Computer Systems Technology

The Information Technology Laboratory (ITL) at the National Institute of Standards and
Technology (NIST) promotes the U.S. economy and public welfare by providing technical
leadership for the Nation’s measurement and standards infrastructure. ITL develops
tests, test methods, reference data, proof of concept implementations, and technical
analyses to advance the development and productive use of information technology. ITL’s responsibilities include the development of management, administrative, technical,
and physical standards and guidelines for the cost-effective security and privacy of other
than national security-related information in federal information systems. The Special
Publication 800-series reports on ITL’s research, guidelines, and outreach efforts in
information system security, and its collaborative activities with industry, government,
and academic organizations.

Digital Identity Guidelines_ Identity Proofing and Enrollment


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 1 require for Awareness and Training?

[Assistant]
According to IoT Non-Technical Supporting Capability Core Baseline:

ess. Education and Awareness provides the educational content required to support customers and others in the secure use and safeguarding of IoT devices and associated systems, software, and hardware.
By making customers and others in the ecosystem more knowledgeable about how to secure the IoT devices, and how to most effectively use the device's cybersecurity capabilities, manufacturers can help reduce the number of occurrences and related severity of IoT device compromises, thwart attacks against the devices, and reduce the number of vulnerabilities that are exploited and lead to compromised devices.

IoT Non-Technical Supporting Capability Core Baseline


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Audit and Evaluation of Computer Security provide? (Part 2)

[Assistant]
divisions:

Applied Mathematics — Electricity — Mechanics — Heat — Optical Physics — Center for Radiation Research — Lab-
oratory Astrophysics- — Cryogenics^ — Electromagnetics — Time and Frequency'.
THE INSTITUTE FOR MATERIALS RESEARCH conducts materials research leading to improved methods of measure-
ment, standards, and data on the properties of well-characterized materials needed by industry, commerce, educational insti-
tutions, and Government: provides advisory and research services to other Government agencies; and develops, produces, and
distributes standard reference materials. The Institute consists of the Office of Standard Reference Materials, the Office of Air
and Water Measurement, and the following divisions:

Analytical Chemistry — Polymers — Metallurgy — Inorganic Materials — Reactor Radiation — Physical Chemistry. THE INSTITUTE FOR APPLIED TECHNOLOGY provides technical services developing and promoting the use of avail-
able technology; cooperates with public and private organizations in developing technological standards, codes, and test meth-
ods; and provides technical advice services, and information to Government agencies and the public. The Institute consists of
the following divisions and centers:

Standards Application and Analysis —• Electronic Technology — Center for Consumer Product Technology: Product
Systems Analysis; Product Engineering — Center for Building Technology; Structures, Materials, and Safety; Building
Environment; Technical Evaluation and Application — Center for Fire Research: Fire Science; Fire Safety Engineering.

Audit and Evaluation of Computer Security


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 1 require for Physical Protection?

[Assistant]
According to Summary Report for “Workshop on Updating Manufacturer Guidance for Securable Connected Product Development”:

- Broaden the discussions from a focus on the IoT system device component to considerations of entire IoT products (and connected products) to better reflect the wide variety of applications and use cases that exist. - Develop the relationship between risk assessment and threat modeling activities. - Address the different cybersecurity considerations among Information Technology (IT), Internet of Things (IoT), Operational Technology (OT), and Industrial Internet of Things (IIoT)
- Identify insights, considerations, approaches, etc. for IoT based on the NIST Privacy Framework, NIST Cyber Physical Systems/IoT Framework, NIST Cybersecurity Framework 2.0, and the NIST Secure Software Development Framework. Stacey Higginbotham of Consumer Reports noted that connected devices establish an ongoing relationship between the buyer,  seller, and manufacturer. The lifetime of a connected product is often separate from its physical state. While physical products fail in visible ways, software degrades more quickly, often without consumer awareness. The industry also lacks adequate support for maintenance. Stacey's discussion highli ghted three key areas: zombie hordes of end of life devices, supported devices with unsupportive owners, and herd immunity against malicious actors. ' Zombie devices ' are those that no longer receive software support and security updates. Higginbotham noted that unsupportive owners can neglect cybersecurity issues, leading to vulnerabilities. Herd immunity in cybersecurity requires collective action from manufacturers and consumers. Most consumers are unaware or indifferent to the end of life status of their products, resulting in ' zombie hordes ' . Communicating end of life status and dates is crucial, including proactive notification to consumers, retailers, and third parties. Companies should track devices to address critical vulnerabilities and create structured options for off-ramping zombie devices.

Summary Report for “Workshop on Updating Manufacturer Guidance for Securable Connected Product Development”


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does The Federal Cybersecurity Awareness Workforce_ Professional Backgrounds, Knowledge, Skills, and Development Activities provide? (Part 5)

[Assistant]
edge and skills for security awareness professionals within the federal government. The following is a high-level overview of these results, with statistics from the survey unless otherwise indicated.
## Security Awareness Duties and Work Roles

- 90% of survey participants performed security awareness duties on a part-time basis, with just over 55% spending 25% or less of their time. Focus group participants had similar allocations: 93% part-time and 39% spending 25% of less time. - 50% of survey participants either did not know or were not sure of their National Initiative for Cybersecurity Education (NICE) Workforce Framework for Cybersecurity (NICE Framework) Work Role. This was despite the Federal Cybersecurity Workforce Assessment Act which requires federal agencies to assign the NICE Framework coding structure to its cybersecurity and information technology (IT) positions. Those participants who knew their Work Role identified 11 unique Work Roles. ## Professional Backgrounds

- Participants were diverse in their educational backgrounds, with 83% from focus group and 51% from the survey indicating that they have at least one non-STEM degree. - 92% of survey participants had worked in cybersecurity positions and 76% had worked in IT jobs that did not have a cybersecurity focus. Less than 25% had worked in a variety of

\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

other fields, including non-IT fields such as instructional design and education, communications, and human resources. We found that 40% of participants had only ever worked in a technical field (cybersecurity, IT, or software development). ## Knowledge and Skills

- Survey participants rated the importance of having specific knowledge and skills represented on their teams.

The Federal Cybersecurity Awareness Workforce_ Professional Backgrounds, Knowledge, Skills, and Development Activities


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What guidance does Guidelines on Mobile Device Forensics provide?

[Assistant]
## NIST Special Publication 800-101 Revision 1

## Guidelines on Mobile Device Forensics

Rick Ayers Sam Brothers Wayne Jansen http://dx.doi.org/10.6028/NIST.SP.800-101r1

<!-- image -->

## NIST Special Publication 800-101 Revision 1

## Guidelines on Mobile Device Forensics

Rick Ayers Software and Systems Division Information Technology Laboratory

Sam Brothers U.S. Customs and Border Protection Department of Homeland Security Springfield, VA

Wayne Jansen Booz Allen Hamilton McLean, VA

http://dx.doi.org/10.6028/NIST.SP. 800-101r1

May 2014

<!-- image -->

U.S. Department of Commerce Penny Pritzker, Secretary

National Institute of Standards and Technology

Patrick D. Gallagher, Under Secretary of Commerce for Standards and Technology and Director

## Authority

This publication has been developed by NIST in accordance with its statutory responsibilities under the Federal Information Security Management Act of 2002 (FISMA), 44 U.S.C. § 3541 et seq., Public Law (P.L.) 107-347. NIST is responsible for developing information security standards and guidelines, including minimum requirements for Federal information systems, but such standards and guidelines shall not apply to national security systems without the express approval of appropriate Federal officials exercising policy authority over such systems. This guideline is consistent with the requirements of the Office of Management and Budget (OMB) Circular A-130, Section 8b(3), Securing Agency Information Systems , as analyzed in Circular A130, Appendix IV: Analysis of Key Sections . Supplemental information is provided in Circular A130, Appendix III, Security of Federal Automated Information Resources . Nothing in this publication should be taken to contradict the standards and guidelines made mandatory and binding on Federal agencies by the Secretary of Commerce under statutory authority.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Data Integrity_ Detecting and Responding to Ransomware and Other Destructive Events provide? (Part 5)

[Assistant]
While the NCCoE used a suite of commercial products to address this challenge, this guide does not endorse these particular products, nor does it guarantee compliance with any regulatory initiatives.
Your organization ʼ s information security experts should identify the products that will best integrate with your existing tools and IT system infrastructure. Your organization can adopt this solution or one that adheres to these guidelines in whole, or you can use this guide as a starting point for tailoring and implementing parts of a solution. ## BENEFITS

The NCCoE's practice guide to Data Integrity: Detecting and Responding to Ransomware and Other Destructive Events can help your organization:

-  develop a strategy for detecting and responding to a data integrity cybersecurity event
-  facilitate effective detection and response to adverse events, maintain operations, and ensure the integrity and availability of data critical to supporting business operations and revenuegenerating activities
-  manage enterprise risk (consistent with foundations of the NIST Framework for Improving Critical Infrastructure Cybersecurity )

## SHARE YOUR FEEDBACK

You can view or download the guide at https://www.nccoe.nist.gov/projects/building-blocks/dataintegrity/detect-respond. If you adopt this solution for your own organization, please share your experience and advice with us. We recognize that technical solutions alone will not fully enable the benefits of our solution, so we encourage organizations to share lessons learned and best practices for transforming the processes associated with implementing this guide. To provide comments or to learn more by arranging a demonstration of this example implementation, contact the NCCoE at ds-nccoe@nist.gov.

Data Integrity_ Detecting and Responding to Ransomware and Other Destructive Events


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Incident Response?

[Assistant]
According to Contingency Planning Guide for Federal Information Systems:

| | Introduction ....................................................................................................1 | | |-----------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------| | 1.1 | | Purpose.......................................................................................................................1 | | | 1.2 | | Scope..........................................................................................................................2 | | | 1.3 | | Audience.....................................................................................................................3 | | | 1.4 | Document | Structure....................................................................................................4 | | | Chapter 2.

Contingency Planning Guide for Federal Information Systems


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Guidelines for the Use of PIV Credentials in Facility Access provide? (Part 6)

[Assistant]
as shown in Table ES-1. Some agencies may have different names for their security areas, however each agency should establish their criteria to implement authentication consistent with this document.
Table ES-1 - Authentication Factors for Security Areas

| Security Areas   |   Minimum Number of Authentication Factors Required |
|------------------|-----------------------------------------------------|
| Controlled       |                                                   1 |
| Limited          |                                                   2 |
| Exclusion        |                                                   3 |

[FIPS201] identifies a number of authentication mechanisms supported by mandatory features of PIV Cards. These mechanisms include Authentication using Authentication with the Card Authentication Certificate Credential (PKI-CAK), Authentication Using Off-Card Biometric Comparison (BIO), Attended Authentication Using Off-Card Biometric Comparison (BIO-A), Authentication with the PIV Authentication Certificate Credential (PKI-AUTH). In addition, PIV Cards may optionally support a number of other authentication mechanisms; these include Authentication with the Symmetric Card Authentication Key (SYM-CAK) and Authentication Using On-Card Biometric Comparison (OCC-AUTH). Access points should not rely solely on an

1     The OMB Circular A-130 can be located at https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/circulars/A130/a130revised.pdf . authentication mechanism that requires optional card features as it is not guaranteed that the optional features to be used for authentication are present on all cards. Many changes in this document were made to align SP 800-116 with revision 2 of FIPS 201 (FIPS 201-2). For example, credential validation is now required (see Section 4.4). The CHUID authentication mechanism has been deprecated due to security concerns.

Guidelines for the Use of PIV Credentials in Facility Access


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Risk Assessment?

[Assistant]
According to Summary of NIST SP 800-53, Revision 4_ Security and Privacy Controls for Federal Information Systems and Organizations:

SP 800-53 Revision 4 has been updated to reflect the evolving technology and threat space. Example areas include issues particular to mobile and cloud computing; insider threats; applications security; supply chain risks; advanced persistent threat; and trustworthiness, assurance, and resilience of information systems. The revision also contains a new appendix of privacy controls, and related implementation guidance (Appendix J), based on the Fair Information Practice Principles (FIPPs), a widely accepted framework of defining principles to be used in the evaluation and consideration of systems, processes, or programs that affect individual privacy. The security control baselines address the security needs of a broad and diverse set of constituencies, and are developed based on a number of general assumptions, including common environmental, operational, and functional considerations. The baselines also assume typical threats facing common information systems. Articulating the underlying assumptions is a key element in the initial risk framing step of the risk management process described in NIST SP 800-39. To ensure that an appropriate set of controls is identified to provide security commensurate with risk, organizations tailor the controls to align with specific security needs. Organizations may perform tailoring at the organization level for all information systems, in support of a particular line of business or mission/business process, at the individual information system level, or by using a combination of the above. The tailoring process is comprised of several steps, as described in SP 800-53 Rev. 4 Section 3.2. These actions include:

- Identifying and designating common controls - controls that may be inherited by one or more information systems. If an information system inherits a common control, such as environmental controls within a data center, that system does not need to explicitly implement that control.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Supply Chain Risk Management?

[Assistant]
According to Secure Software Development Practices for Generative AI and Dual-Use Foundation Models_ An SSDF Community Profile:

where speakers and attendees shared suggestions for adapting secure software development practices and tasks to accommodate the unique aspects of AI model development and the software leveraging them.
- AI Risk Management Framework (AI RMF) [2] and the NIST AI RMF Playbook [11]
- Adversarial Machine Learning: A Taxonomy and Terminology of Attacks and Mitigations [3]
- Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile [12]
- Towards a Standard for Identifying and Managing Bias in Artificial Intelligence [4]
- Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations [10]
- NIST Privacy Framework: A Tool for Improving Privacy Through Enterprise Risk Management, Version 1.0 [13]
- Integrating Cybersecurity and Enterprise Risk Management (ERM) [14]

Secure Software Development Practices for Generative AI and Dual-Use Foundation Models_ An SSDF Community Profile


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice MA.L2-3.7.1 (NIST 3.7.1)?

[Assistant]
According to Guide to Auditing for Controls and Security_ A System Development Life Cycle Approach:

3.7.1                                                            | Potential Difficulties in Utilization                            | Potential Difficulties in Utilization                            | 63        |
|           | 3. 3.7.1 Potential DifTiculties in Utilization

- Time and resources are needed for sufficient data collection.

Guide to Auditing for Controls and Security_ A System Development Life Cycle Approach


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Physical Protection?

[Assistant]
According to Guidelines on Mobile Device Forensics:

A UICC can contain up to three applications: SIM, USIM and CSIM. UICCs used in GSM and UMTS mobile devices use the SIM and UMTS SIM (USIM) applications, while CDMA devices  use the  CSIM  application.
A  UICC  with  all three  applications  provides  users  with additional portability through the removal of the UICC from one mobile device and insertion into another. Because the SIM application was originally synonymous with the physical card itself, the term SIM is often used to refer to the physical card in lieu of UICC. Similarly the terms  USIM  and  CSIM  can  refer  to  both  the  physical  card  as  well  as  the  respective applications supported on the UICC.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does The Federal Cybersecurity Awareness Workforce_ Professional Backgrounds, Knowledge, Skills, and Development Activities provide? (Part 9)

[Assistant]
| 3 PROFESSIONAL DEMOGRAPHICS...............................................................................
3                                                                                | 3 PROFESSIONAL DEMOGRAPHICS............................................................................... 3                                                                                |
| 3.1 SECURITY AWARENESS DUTIES ........................................................................................... 3                                                                                | 3.1 SECURITY AWARENESS DUTIES ........................................................................................... 3                                                                                | 3.1 SECURITY AWARENESS DUTIES ........................................................................................... 3                                                                                |
| 3.1.1 Security Awareness Roles and Percentage of Time.................................................... 3 3.1.2 Years of Security Awareness Experience.................................................................... 4                           | 3.1.1 Security Awareness Roles and Percentage of Time.................................................... 3 3.1.2 Years of Security Awareness Experience.................................................................... 4                           | 3.1.1 Security Awareness Roles and Percentage of Time....................................................


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Guide to a Secure Enterprise Network Landscape provide? (Part 8)

[Assistant]
Network Monitoring and Observability Tools                                                                                | 3.4.1. Network Monitoring and Observability Tools                                                                                | ............................................................12                                                                           |
| 3.4.2. Automated Network Provisioning Tools....................................................................12                        | 3.4.2.

Guide to a Secure Enterprise Network Landscape