[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Identification and Authentication?

[Assistant]
According to Risk Management Framework for Information Systems and Organizations_ A System Life Cycle Approach for Security and Privacy:

function of the adverse impacts that arise if the circumstance or event occurs, and the likelihood of occurrence. Types security and privacy risk (including supply chain risk); project risk; reputational risk; safety risk; strategic planning risk. 6  [OMB A-130] defines PII as 'information that can be used to distinguish or trace an individual's identity, either alone

The authorization boundary defines the system 36 for RMF execution to facilitate risk management and accountability. The system may be supported by one or more enabling systems that provide support during the system life cycle. Enabling systems are not contained within the authorization boundary of the system and do not necessarily exist in the system's environment of operation. An enabling system may provide common (i.e., inherited) controls for the system or may include any type of service or functionality used by the system such as identification and authentication services, network services, or monitoring functionality. Finally, there are other systems the system interacts with in the operational environment. The other systems are also outside of the authorization boundary and may be the beneficiaries of services provided by the system or may simply have some general interaction. 37

Discussion: Common controls are controls that can be inherited by one or more information systems. 60 Common controls can include controls from any [SP 800-53] control family, for example, physical and environmental protection controls, system boundary and monitoring controls, personnel security controls, policies and procedures, acquisition controls, account and identity management controls, audit log and accountability controls, or complaint management controls for receiving privacy inquiries from the public. Organizations identify and select the set of common controls and allocate those controls to the organizational entities designated as common control providers.

Risk Management Framework for Information Systems and Organizations_ A System Life Cycle Approach for Security and Privacy


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What guidance does NIST provide for CMMC Level 3?

[Assistant]
According to Protecting Controlled Unclassified Information (CUI)_ NIST Special Publication 800-171, Revision 3. Small Business Primer:

ent, or possibly with other organizations like municipal governments, prime contractors, universities, etc., you will likely be required to demonstrate you are taking adequate measures to protect CUI.
Examples of CUI include:

<!-- image -->

|                      | When provided as part of a government contract, examples include:                                                                                | Marking 1     |
|----------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------|
| Controlled           | e.g., research and engineering data, engineering drawings, specifications, process sheets, manuals, technical reports, technical orders, catalog-item identifications, data sets, studies and analyses and related information, and computer software executable code and source code. | CUI//SP-CTI   |
| General Proprietary  | e.g., financial information, trade secrets, product research and development, existing and future product designs and performance specifications. | CUI//PROPIN   |
| Business Information | you do not handle CUI, implementing the security requirements in SP 800-171 will                                                                                | help you take |

1  For more information on types of CUI and markings, visit the National Archives and Records Administration (NARA) https://www.archives.gov/cui.

Protecting Controlled Unclassified Information (CUI)_ NIST Special Publication 800-171, Revision 3. Small Business Primer

Audit and Accountability
System and Information Integrity
Security Assessment
Media Protection
Identification and Authentication
Awareness and Training
System and Communications Protection
Access Control
Planning
Incident Response
Risk Assessment
Personnel Security
System and Services Acquisition
Supply Chain Risk Management
Maintenance
Physical Protection
Configuration Management


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Configuration Management?

[Assistant]
According to Guidelines on Mobile Device Forensics:

| Figure 1: Memory Configurations......................................   |   6 |
|-------------------------------------------------------------------------|-----|
| Figure 2: SIM Card Size Formats [Orm09] .......................         |   8 |
| Figure 3: SIM File System (GSM).....................................    |   9 |
| Figure 4: Cellular Network Organization.........................        |  12 |
| Figure 5: Satellite Phone Network....................................   |  13 |
| Figure 6: Mobile Device Tool Classification System......                |  17 |
| Figure 7: Generic Triage Decision Tree...........................       |  36 |

Memory configurations among mobile devices have evolved over time. Feature phones were among the first types of devices that contained NOR flash and RAM memory. System and user data are stored in NOR and copied to RAM upon booting for faster code execution and access. This is known as the first generation of mobile device memory configurations.

As  smartphones  were  introduced,  memory  configurations  evolved,  adding  NAND  flash memory. This arrangement of NOR, NAND and RAM memory is referred to as the second generation. This generation of memory configurations stores system files in NOR flash, user files in NAND and RAM is used for code execution.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Guide to Enterprise Patch Management Planning_ Preventive Maintenance for Technology provide? (Part 9)

[Assistant]
| Purpose and Scope ........................................................................................
| 1                                                                                |
|                                                                                | 1.2                                                                                | Changes from Previous Versions.................................................................... | 1                                                                                |
|                                                                                | 1.3                                                                                | Publication Structure.......................................................................................

Guide to Enterprise Patch Management Planning_ Preventive Maintenance for Technology


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Incident Response?

[Assistant]
According to Proceedings of the Cybersecurity in Cyber-Physical Systems Workshop, April 23-24, 2012:

scovered recently [7], show that industrial control systems are evolving, bringing powerful  capabilities  into  the  critical  infrastructure  environment along with new and yet undiscovered threats.
Additionally,  incidents  witnessed  in  the  recent  years  have underlined  an  unprecedented  level  of  sophistication  in  the threats  targeting  ICS  environments. A  prime  example of this sophistication is the Stuxnet infection, which used four distinct and previously unknown zero-day exploits, and leveraged multiple stolen certificates for the injection of its rootkit: when the certificate used for the installation of the rootkit was reported stolen, and consequently revoked by the Symantec (Verisign) Certification Authority, the malware was immediately patched remotely to utilize a second stolen certificate. Stuxnet was not an isolated incident: in 2011, a threat sharing similar characteristics  to  Stuxnet  was  discovered  and  was  shown  to  have been generated by the same authors, or those who have access to the Stuxnet source code [7].

Proceedings of the Cybersecurity in Cyber-Physical Systems Workshop, April 23-24, 2012


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Awareness and Training?

[Assistant]
According to High-Performance Computing Security_ Architecture, Threat Analysis, and Security Posture:

.............6                   |
| 2.1.9. Basic Services................................................................................................................................7  |
| 2.1.10.
Configuration Management.......................................................................................................7                |
| 2.1.11. HPC Scheduler and Workflow Management..............................................................................7                            |
| 2.1.12. HPC Software..............................................................................................................................8     |
| 2.1.13. User Software.............................................................................................................................8     |
| 2.1.14. Site-Provided Software and Vendor Software ...........................................................................8                         |
| 2.1.15. Containerized Software in HPC ..................................................................................................9               |
| 3. HPC Threat Analysis......................................................................................................................10          |
| 3.2.1. Access Zone Threats...................................................................................................................11         |
| 3.2.2. Management Zone Threats........................................................................................................11                |
| 3.2.3. High-Performance Computing Zone Threats..............................................................................12                          |
| 3.2.4. Data Storage Zone Threats.........................................................................................................12             |
| 4.

High-Performance Computing Security_ Architecture, Threat Analysis, and Security Posture


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Risk Assessment?

[Assistant]
According to Secure Software Development Framework (SSDF) Version 1.1_ Recommendations for Mitigating the Risk of Software Vulnerabilities:

- Securely Provision (SP): Risk Management (RSK), Software Development (DEV), Systems Requirements Planning (SRP), Test and Evaluation (TST), Systems Development (SYS)
- Operate and Maintain (OM): Systems Analysis (ANA)
- Oversee and Govern (OV): Training, Education, and Awareness (TEA); Cybersecurity Management (MGT); Executive Cyber Leadership (EXL); Program/Project Management (PMA) and Acquisition
- Protect and Defend (PR): Incident Response (CIR), Vulnerability Assessment and Management (VAM)
- Analyze (AN): Threat Analysis (TWA), Exploitation Analysis (EXP)

The SSDF defines only a high-level subset of what organizations may need to do, so organizations should consult the references and other resources for additional information on implementing the practices. Not all practices are applicable to all use cases; organizations should adopt a risk-based approach to determine what practices are relevant, appropriate, and effective to mitigate the threats to their software development practices.

Secure Software Development Framework (SSDF) Version 1.1_ Recommendations for Mitigating the Risk of Software Vulnerabilities


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 2 require for Access Control?

[Assistant]
According to Assessing Security Requirements for Controlled Unclassified Information:

| Access Control                    | Maintenance         | Security Assessment and Monitoring   |
|-----------------------------------|---------------------|--------------------------------------|
| Awareness and Training            | Media Protection    | System and Communications Protection |
| Audit and Accountability          | Personnel Security  | System and Information Integrity     |
| Configuration Management          | Physical Protection | Planning                             |
| Identification and Authentication | Risk Assessment     | System and Services Acquisition      |
| Incident Response                 |                     | Supply Chain Risk Management         |

## 03.01.06      Least Privilege - Privileged Accounts

[SELECT FROM: access control policy and procedures; procedures for least privilege; list of system-generated privileged accounts; list of system administration personnel; system audit records; system configuration settings; system security plan; list of system-generated security functions or security-relevant information assigned to system accounts or roles; other relevant documents or records]

Assessing Security Requirements for Controlled Unclassified Information


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for Risk Assessment?

[Assistant]
According to Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171:

ance. The decision to select a particular set of enhanced security requirements will be based on the mission and business needs of federal agencies and guided and informed by ongoing risk assessments.
The enhanced security requirements for nonfederal systems processing, storing, or transmitting CUI associated with critical programs or high value assets will be conveyed to nonfederal organizations by federal agencies in a contract, grant, or other agreement. The application of the enhanced security requirements to subcontractors will also be addressed by federal agencies in consultation with nonfederal organizations.

Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AT.L2-3.2.3 (NIST 3.2.3)?

[Assistant]
According to Validating the Integrity of Computing Devices:

3.2.3                                                                                | Scenario 3: Verification of Components During Use... 3.2.3 Scenario 3: Verification of Components During Use

In this scenario, the computing device has been accepted by the organization (Scenario 2) and has been provisioned for the end user. 3.2.3                                                                                | Platform Integrity Incident Management ...

Validating the Integrity of Computing Devices


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Assessing Security Requirements for Controlled Unclassified Information provide? (Part 4)

[Assistant]
ed as independent, third-party assessments or as government-sponsored assessments. The assessments can be applied with various degrees of rigor based on customer-defined depth and coverage attributes.
## Keywords

assessment; assessment method; assessment object; assessment procedure; assurance; Controlled Unclassified Information; coverage; FISMA; NIST Special Publication 800-171; NIST Special Publication 800-53A; nonfederal organization; nonfederal system; security assessment; security requirement. ## Reports on Computer Systems Technology

The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the Nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology. ITL's responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in federal information systems. The Special Publication 800-series reports on ITL's research, guidelines, and outreach efforts in information system security, and its collaborative activities with industry, government, and academic organizations.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Multi-Factor Authentication for Criminal Justice Information Systems_ Implementation Considerations for Protecting Criminal Justice Information provide? (Part 6)

[Assistant]
................................14  |
| 3.2.3. Other Agencies ...........................................................................................................................14   |
| 3.2.4.
Procurement Teams...................................................................................................................14         |
| 3.2.5. Compliance Teams .....................................................................................................................15       |
| 3.2.6. Legal Teams................................................................................................................................15  |
| 3.2.7. Technology Vendors...................................................................................................................15        |
| 3.4.1. Local Agency MFA Architectures................................................................................................17               |
| 3.4.2. State MFA Deployments.............................................................................................................21           |
| 3.4.3. Implementing MFA with VPNs ...................................................................................................25               |
| 4. Key Takeaways.............................................................................................................................29       |
| References.......................................................................................................................................31   |
| Appendix A. Technology Components Relevant to MFA for CJIS Access .............................................32                                     |

| Appendix B.

Multi-Factor Authentication for Criminal Justice Information Systems_ Implementation Considerations for Protecting Criminal Justice Information


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 2 require for Incident Response?

[Assistant]
According to Assessing Security Requirements for Controlled Unclassified Information:

| Access Control                    | Maintenance         | Security Assessment and Monitoring   |
|-----------------------------------|---------------------|--------------------------------------|
| Awareness and Training            | Media Protection    | System and Communications Protection |
| Audit and Accountability          | Personnel Security  | System and Information Integrity     |
| Configuration Management          | Physical Protection | Planning                             |
| Identification and Authentication | Risk Assessment     | System and Services Acquisition      |
| Incident Response                 |                     | Supply Chain Risk Management         |

operations, exercising an incident response plan, and monitoring network traffic). Individuals are the people applying the specifications, mechanisms, or activities described above.

## 3.6. Incident Response


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AT.L2-3.2.1 (NIST 3.2.1)?

[Assistant]
According to Digital Identity Guidelines_ Authentication and Authenticator Management:

3.2.1. 3.2.10. 3.2.11.

Digital Identity Guidelines_ Authentication and Authenticator Management


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for Physical Protection?

[Assistant]
According to Protecting Controlled Unclassified Information (CUI)_ NIST Special Publication 800-171, Revision 3. Small Business Primer:

| Access Control                    | Maintenance         | Security Assessment and Monitoring   |
|-----------------------------------|---------------------|--------------------------------------|
| Awareness and Training            | Media Protection    | System and Communications Protection |
| Audit and Accountability          | Personnel Security  | System and Information Integrity     |
| Configuration Management          | Physical Protection | Planning                             |
| Identification and Authentication | Risk Assessment     | System and Services Acquisition      |
| Incident Response                 |                     | Supply Chain Risk Management         |

Scope and Applicability of SP 800-171. The security requirements in NIST SP 800-171 are only applicable to components of nonfederal systems that process, store, or transmit CUI or that provide protection for such components. Appropriately scoping requirements is an important factor in determining protection-related investment decisions and managing security risks for your business. You may limit the scope of the security requirements by isolating the system components in a separate security domain. Isolation can be achieved by implementing subnetworks with firewalls or other boundary protection devices. Security domains may employ physical separation, logical separation, or a combination of both. This approach can provide adequate security for CUI and avoid increasing the organization's security posture beyond what it requires for protecting its missions, operations, and assets.

- Permit only qualified and authorized individuals to access the system for the purpose of initiating changes. Access restrictions include physical and logical access controls, software libraries, workflow automation, media libraries, abstract layers (i.e., changes implemented into external interfaces rather than directly into the system), and change windows (i.e., changes occur only during specified times).


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Information Integrity?

[Assistant]
According to Contingency Planning Guide for Federal Information Systems:

Technical Contingency Planning Considerations.....................................43                                       | Chapter 5. Technical Contingency Planning Considerations.....................................43                                       | Chapter 5.

Contingency Planning Guide for Federal Information Systems


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What guidance does Validating the Integrity of Computing Devices provide?

[Assistant]
<!-- image -->

## NIST SPECIAL PUBLICATION 1800-34

## Validating the Integrity of Computing Devices

Includes Executive Summary (A); Approach, Architecture, and Security Characteristics (B); and How-To Guides (C)

Jon Boyens Christopher Brown Chelsea Deane Tyler Diamond* Nakia Grayson Jason Hurlburt Celia Paulsen William T. Polk Andrew Regenscheid Karen Scarfone Murugiah Souppaya

*Former employee; all work for this publication was done while at employer

DECEMBER 2022

FINAL

This publication is available free of charge from https://doi.org/10.6028/NIST.SP.1800-34

<!-- image -->

NIST SPECIAL PUBLICATION 1800-34

## Validating the Integrity of Computing Devices

Includes Executive Summary (A); Approach, Architecture, and Security Characteristics (B); and How-To Guides (C)

Jon Boyens

Tyler Diamond* Nakia Grayson Celia Paulsen William T. Polk Andrew Regenscheid Murugiah Souppaya National Cybersecurity Center of Excellence Information Technology Laboratory

Christopher Brown Chelsea Deane Jason Hurlburt The MITRE Corporation McLean, Virginia

Karen Scarfone Scarfone Cybersecurity Clifton, Virginia

*Former employee; all work for this publication was done while at employer

FINAL

December 2022

<!-- image -->

U.S. Department of Commerce Gina M. Raimondo, Secretary

National Institute of Standards and Technology Laurie E. Locascio, NIST Director and Under Secretary of Commerce for Standards and Technology

## NIST SPECIAL PUBLICATION 1800-34A

## Validating the Integrity of Computing Devices

Volume A: Executive Summary

Jon Boyens Tyler Diamond* Nakia Grayson Celia Paulsen William T.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Physical Protection?

[Assistant]
According to Blockchain for Access Control Systems:

The  Information  Technology  Laboratory  (ITL)  at  the  National  Institute  of  Standards  and Technology  (NIST)  promotes  the  U.S.  economy  and  public  welfare  by  providing  technical leadership  for  the  Nation's  measurement  and  standards  infrastructure.  ITL  develops  tests,  test methods, reference data, proof of concept implementations, and technical analyses to advance the development  and  productive  use  of  information  technology.  ITL's  responsibilities  include  the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in federal information systems.

The Organization for the Advancement of Structured Information Standards (OASIS) standard XACML proposes basic processing entities for AC systems. Each entity handles a different stage of processing a user's access request, as shown in Figure 1. These functional components may be physically  and  logically  separated  and  distributed  rather  than  centralized,  such  as  several functional 'points' that are the service node for the retrieval and management of the policy, along with some logical components for handling the context or workflow of AC data retrieval and assessment.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for Personnel Security?

[Assistant]
According to Protecting Controlled Unclassified Information (CUI)_ NIST Special Publication 800-171, Revision 3. Small Business Primer:

| Access Control                    | Maintenance         | Security Assessment and Monitoring   |
|-----------------------------------|---------------------|--------------------------------------|
| Awareness and Training            | Media Protection    | System and Communications Protection |
| Audit and Accountability          | Personnel Security  | System and Information Integrity     |
| Configuration Management          | Physical Protection | Planning                             |
| Identification and Authentication | Risk Assessment     | System and Services Acquisition      |
| Incident Response                 |                     | Supply Chain Risk Management         |

Description: Ensuring personnel are made aware of the security risks associated with their activities and of the applicable laws, directives, policies, standards, regulations, or procedures related to the security of organizational systems; and ensuring that organizational personnel are adequately trained to carry out their assigned information security-related duties and responsibilities.

Regularly provide basic and advanced security literacy training to new and existing staff. Customize the content to make it relevant -based on the systems that personnel have authorized access to, contextualized to the work environments of personnel (e.g., telework, shop floor), and tailored to the specific roles of personnel. The content should include:


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Communications Protection?

[Assistant]
According to Report on the Design-A-Thon_ Designing Effective and Accessible Approaches for Digital Product Cybersecurity Education and Awareness:

.g., encryption) which require limited human interaction, particularly with users, education and awareness addresses the human-in-the-loop and so depends, in large part, on human-factors for efficacy.
All three teams specifically considered how their designs could be 'easiest' for users to use, understand, and be most accessible. Teams 1 and 3 incorporated gamification and other interactive elements to encourage users to pursue cybersecurity topics. For example, Team 3 attempted to gamify the pursuit of cybersecurity knowledge relative to the product by building out 'levels' of concepts that build upon each other so that users could 'level up' at their pace. Understanding and encouraging cybersecurity engagement has been a focus of research for the SOUPS community [8][9][10][11][12][13], and so the teams brought the insights from that research to the practical tasks of the Design-A-Thon. The contextual nature of cybersecurity education and awareness approaches was apparent when two teams (i.e., Teams 2 and 3) selected the same product but developed different approaches and focused on different aspects of the design. Teams 2 and 3 homed in on different information that may be useful at different times during the product's lifecycle. In one case, Team 2 focused on ensuring information was at users' fingertips, particularly when support was needed. In the other case, Team 3 considered how individuals could be encouraged to engage on cybersecurity education and awareness outside of times they needed support, landing on gamification elements. Research shows that gamification of cybersecurity education and awareness can drive engagement for individuals around the subject [14], but for IoT products, gamification elements should not get in the way when users need support or specific information.

Report on the Design-A-Thon_ Designing Effective and Accessible Approaches for Digital Product Cybersecurity Education and Awareness


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Planning?

[Assistant]
According to A Zero Trust Architecture Model for Access Control in Cloud-Native Applications in Multi-Cloud Environments:

There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may be used by federal agencies even before the completion of such companion publications. Thus, until each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning and transition purposes, federal agencies may wish to closely follow the development of these new publications by NIST.

A Zero Trust Architecture Model for Access Control in Cloud-Native Applications in Multi-Cloud Environments


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Identification and Authentication?

[Assistant]
According to Digital Identity Guidelines_ Identity Proofing and Enrollment:

Digital Identity Guidelines
Identity Proofing and Enrollment

Digital Identity Guidelines
Identity Proofing and Enrollment

Temoshok D, Abruzzi C, Choong YY, Fenton JL, Galluzzo R, LaSalle C, Lefkovitz N,
Regenscheid A, Vachino M (2025) Digital Identity Guidelines: Identity Proofing and
Enrollment. (National Institute of Standards and Technology, Gaithersburg, MD), NIST
Special Publication (SP) NIST SP 800-63A-4. https://doi.org/10.6028/NIST.SP.800-63A-4

Digital Identity Guidelines_ Identity Proofing and Enrollment


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Machine Learning for Access Control Policy Verification provide? (Part 3)

[Assistant]
a software test, access control policy verification relies on methods such as model proof, data structure, system simulation, and test oracle to verify that the policy logic  functions  as  expected.
However,  these  methods  have  capability  and  performance  issues related to inaccuracy and complexity limited by applied technologies. For instance, model proof, test oracle, and data structure methods initially assume that the policy under verification is faultless unless the policy model cannot hold for test cases. Thus, the challenge of the method is to compose test cases that can comprehensively discover all faults. Alternatively, a system simulation method requires translating the policy to a simulated system. The translation between systems may be difficult or impractical to implement if the policy logic is complicated or the number of policy rules  is  large. To  answer  these  challenges,  this  internal  report  (IR)  proposes  an  efficient  and straightforward method for access control policy verification by applying a classification algorithm of machine learning, which does not require comprehensive test cases, oracle, or system translation but rather checks the logic of policy rules directly, making it more efficient and feasible compared to traditional methods. ## Keywords

attribute based access control; access control; access control test; access control verification; AI; authorization; machine learning; policy. ## Acknowledgments

The author, Vincent C. Hu of the National Institute of Standards and Technology (NIST), wishes to thank Isabel Van Wyk and Jim Foti (NIST) who reviewed drafts of this document. The author also  gratefully  acknowledges  and  appreciates  the  comments  and  contributions  made  by government agencies, private organizations, and individuals in providing direction and assistance in the development of this document.

Machine Learning for Access Control Policy Verification


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for Incident Response?

[Assistant]
According to Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171:

| CHAPTERONE INTRODUCTION...................................................................................................... | CHAPTERONE INTRODUCTION...................................................................................................... |
|--------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------|
| 1.1 PURPOSEANDAPPLICABILITY                                                                                | ................................................................................................... 3                                            |
| 1.2 TARGET AUDIENCE                                                                                | .................................................................................................................. 4                             |
| 1.3 ORGANIZATIONOF THIS SPECIAL PUBLICATION                                                                                | .......................................................................... 4                                                                     |
| CHAPTERTWO THE FUNDAMENTALS............................................................................................ 5                        | CHAPTERTWO THE FUNDAMENTALS............................................................................................ 5                        |
| 2.1 DEVELOPMENTAPPROACH ......................................................................................................


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 2 require for System and Information Integrity?

[Assistant]
According to Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations:

| Table 1. Security Requirement Families .......................................................................................................4          |
|----------------------------------------------------------------------------------------------------------------------------------------------------------|
| Table 2. Security Control Tailoring Criteria.................................................................................................93          |
| Table 3. Access Control (AC) .......................................................................................................................93   |
| Table 4. Awareness and Training (AT).........................................................................................................94          |
| Table 5. Audit and Accountability (AU).......................................................................................................95          |
| Table 6. Assessment, Authorization, and Monitoring (CA).........................................................................95                       |
| Table 7. Configuration Management (CM).................................................................................................96                |
| Table 8. Contingency Planning (CP) ............................................................................................................96        |
| Table 9. Identification and Authentication (IA) ..........................................................................................97             |
| Table 10. Incident Response (IR).................................................................................................................98      |
| Table 11. Maintenance (MA) ......................................................................................................................98      |
| Table 12.

Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Guidelines for Media Sanitization provide? (Part 9)

[Assistant]
| .......................................................................................................................32 |
| Appendix B.
Device-Specific Characteristics of Interest......................................................................35                          |                                                                                |
| Appendix C. Sample 'Certificate of Sanitization' Form......................................................................36                            |                                                                                |
| Appendix D. Change Log...................................................................................................................38              |                                                                                |
| List of Tables                                                                                |                                                                                |
| Table 1. CE considerations................................................................................................................12             |                                                                                |
| List of Figures                                                                                |                                                                                |
| Fig. 1.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Addressing Visibility Challenges with TLS 1.3 within the Enterprise_ High-Level Document provide? (Part 8)

[Assistant]
| Audience ......................................................................................................................
4                                                                               |
|     | 2.2 How to use this Guide.................................................................................................. 4                                                                                | 2.2 How to use this Guide.................................................................................................. 4                                                                                |
| 3   | Project Overview ................................................................................4                                                                                | Project Overview ................................................................................4                                                                                |
|     | 3.1                                                                                | Background .................................................................................................................. 4                                                                                |
|     | 3.2 Solution                                                                                | ........................................................................................................................

Addressing Visibility Challenges with TLS 1.3 within the Enterprise_ High-Level Document


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AT.L2-3.2.1 (NIST 3.2.1)?

[Assistant]
According to Guide to Auditing for Controls and Security_ A System Development Life Cycle Approach:

3.2.1 ADP Audits/Security Reviews - A Form of Control         | 3. 3.2.1 ADP Audits/Security Reviews - A Form of Control         | 48        |

| ^         | 3. 3.2.1 Participants and Their Tasks                                                        | 4.

Guide to Auditing for Controls and Security_ A System Development Life Cycle Approach


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Information Integrity?

[Assistant]
According to Guide to Auditing for Controls and Security_ A System Development Life Cycle Approach:

Value/Organization | 3.4.5.1.1 Mission Impact/Strategic Value/Organization | 3.4.5.1.1 Mission Impact/Strategic Value/Organization | 55 | | | (Business) Criticality and Sensitivity Factors 3.4.5.2 Level II: | (Business) Criticality and Sensitivity Factors 3.4.5.2 Level II: | (Business) Criticality and Sensitivity Factors 3.4.5.2 Level II: | | | | | | | 56 | | | 3.4.5.2.1 | 3.4.5.2.1 | System Size/Scale/Complexity | 56 | | | 3.4.5.2.2 | 3.4.5.2.2 | System Environment/Stability | 57 | | | 3.4.5.2.3 | 3.4.5.2.3 | Reliability/Integrity | 58 | | | 3.4.5.2.4 | 3.4.5.2.4 | Technology Integration | 59 | | 3.5 | RISK SCORING -- APPLICATION OF THE WORK PRIORITY SCHEME | RISK SCORING -- APPLICATION OF THE WORK PRIORITY SCHEME | RISK SCORING -- APPLICATION OF THE WORK PRIORITY SCHEME | 59 | | | 3.5.1 Implementation of the Scheme | 3.5.1 Implementation of the Scheme | 3.5.1 Implementation of the Scheme | 59 | | | 3.5.2 | A Simple Scoring Approach | A Simple Scoring Approach | 60 | | | 3.5.3 | A Detailed Scoring Approach | A Detailed Scoring Approach | 60 | | | 3.5.4 | Discretionary Audits | Discretionary Audits | 60 | | 3.6 | USES OF


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Awareness and Training?

[Assistant]
According to Status Report on the First Round of the Additional Digital Signature Schemes for the NIST Post-Quantum Cryptography Standardization Process:

3.2.

3.2. LESS

Status Report on the First Round of the Additional Digital Signature Schemes for the NIST Post-Quantum Cryptography Standardization Process


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for Identification and Authentication?

[Assistant]
According to Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171:

| CHAPTERONE INTRODUCTION...................................................................................................... | CHAPTERONE INTRODUCTION...................................................................................................... |
|--------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------|
| 1.1 PURPOSEANDAPPLICABILITY                                                                                | ................................................................................................... 3                                            |
| 1.2 TARGET AUDIENCE                                                                                | .................................................................................................................. 4                             |
| 1.3 ORGANIZATIONOF THIS SPECIAL PUBLICATION                                                                                | .......................................................................... 4                                                                     |
| CHAPTERTWO THE FUNDAMENTALS............................................................................................ 5                        | CHAPTERTWO THE FUNDAMENTALS............................................................................................ 5                        |
| 2.1 DEVELOPMENTAPPROACH ......................................................................................................


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 2 require for Supply Chain Risk Management?

[Assistant]
According to Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations:

| Table 1. Security Requirement Families .......................................................................................................4          |
|----------------------------------------------------------------------------------------------------------------------------------------------------------|
| Table 2. Security Control Tailoring Criteria.................................................................................................93          |
| Table 3. Access Control (AC) .......................................................................................................................93   |
| Table 4. Awareness and Training (AT).........................................................................................................94          |
| Table 5. Audit and Accountability (AU).......................................................................................................95          |
| Table 6. Assessment, Authorization, and Monitoring (CA).........................................................................95                       |
| Table 7. Configuration Management (CM).................................................................................................96                |
| Table 8. Contingency Planning (CP) ............................................................................................................96        |
| Table 9. Identification and Authentication (IA) ..........................................................................................97             |
| Table 10. Incident Response (IR).................................................................................................................98      |
| Table 11. Maintenance (MA) ......................................................................................................................98      |
| Table 12.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Assessing Enhanced Security Requirements for Controlled Unclassified Information provide? (Part 8)

[Assistant]
or services that  process,  store,  or  transmit  CUI  or  that  provide security protections for those components or services as mandated by a federal agency in a contract, grant, or other agreement.
\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

## Table of Contents

| CHAPTERONE INTRODUCTION...................................................................................................... | CHAPTERONE INTRODUCTION...................................................................................................... | 1   |
|-----------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------|-----|
| 1.1                                                                                | PURPOSEANDAPPLICABILITY............................................................................................................. 1        | 2   |
| 1.2                                                                                | TARGET AUDIENCE.............................................................................................................................. |     |
| 1.3                                                                                | ORGANIZATIONOF THIS SPECIAL PUBLICATION................................................................................. | 2   |
| CHAPTERTWO THE FUNDAMENTALS............................................................................................

Assessing Enhanced Security Requirements for Controlled Unclassified Information


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Maintenance?

[Assistant]
According to Guidelines on Mobile Device Forensics:

Forensic software tools strive to handle conventional investigative needs by addressing a wide range of applicable devices. More difficult situations, such as the recovery of deleted data from the memory of a device, may require more specialized tools and expertise and disassembly of the device. The range of support provided, including mobile device cables and drivers, product documentation, PC/SC readers, and the frequency of updates, may vary significantly among products. The features offered such as searching, bookmarking, and reporting capabilities may also vary considerably.

Discrepancies in recovering and reporting the data residing on a device have been noted in previous testing of tools. They include the inability to recover resident data, inconsistencies between the data displayed on workstation and that generated in output reports, truncated data in reported or displayed output, errors in the decoding and translation of recovered data, and the inability to recover all relevant data. On occasion, updates or new versions of a tool were also found to be less capable in some aspects than a previous version was [Aye11, Jan09].

Tools should be validated to ensure their  acceptability and  reapplied  when updates  or  new versions of the tool become  available. These  results play a factor in deciding the appropriateness of the tool, how to compensate for any noted shortcomings, and whether to consider using a different version or update of the tool. Validating a tool entails defining and identifying a comprehensive set of test data, following acquisition procedures to recover the test data, and assessing the results [Aye11, Jan09]. Present-day tools seldom provide the means


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Communications Protection?

[Assistant]
According to Contingency Planning Guide for Federal Information Systems:

| | Introduction ....................................................................................................1 | | |-----------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------| | 1.1 | | Purpose.......................................................................................................................1 | | | 1.2 | | Scope..........................................................................................................................2 | | | 1.3 | | Audience.....................................................................................................................3 | | | 1.4 | Document | Structure....................................................................................................4 | | | Chapter 2.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Physical Protection?

[Assistant]
According to Cryptographic Module Validation Program (CMVP) Security Policy Requirements_ CMVP Validation Authority Updates to ISO_IEC 24759 and ISO_IEC 19790 Anne:

The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the Nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology. ITL's responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in federal information systems. The Special Publication 800-series reports on ITL's research, guidelines, and outreach efforts in information system security, and its collaborative activities with industry, government, and academic organizations. - Illustrative diagram, schematic, or photograph of the module. A photograph included for hardware modules. If the security policy encompasses multiple versions of the module, each version is represented separately or annotated that the representation is illustrated for all versions. For a software or , firmware, hybrid, or sub-chip cryptographic module, the security policy includes a block diagram that illustrates:
- o The location of the logical object of the software or firmware module with respect to the operating system, other supporting applications, and the cryptographic boundary so that all of the logical and physical layers between the logical object and the cryptographic boundary are clearly defined and
- o The interactions of the logical object of the software or firmware module with the operating system and other supporting applications resident within the cryptographic boundary.

Cryptographic Module Validation Program (CMVP) Security Policy Requirements_ CMVP Validation Authority Updates to ISO_IEC 24759 and ISO_IEC 19790 Anne


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for Awareness and Training?

[Assistant]
According to Assessing Enhanced Security Requirements for Controlled Unclassified Information:

| ASSESSMENT PROCEDURES................................................................................................................
| 3   |
| 2.2                                                                                | ASSURANCE CASES.............................................................................................................................. | 4   |
| CHAPTER THREE THE PROCEDURES............................................................................................... | CHAPTER THREE THE PROCEDURES............................................................................................... | 7   |
| 3.1                                                                                | ACCESSCONTROL ............................................................................................................................... | 8   |
| 3.2                                                                                | AWARENESSANDTRAINING............................................................................................................... | 9   |
| 3.3                                                                                | AUDIT ANDACCOUNTABILITY........................................................................................................... | 10  |
| 3.4                                                                                | CONFIGURATION MANAGEMENT.....................................................................................................


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Guide to Auditing for Controls and Security_ A System Development Life Cycle Approach provide? (Part 10)

[Assistant] | | 2.4.2.1 | 2.4.2.1 | Sponsor/User | 30 | | | 2.4.2.2 Project Manager/Contracting Officer's Technical | 2.4.2.2 Project Manager/Contracting Officer's Technical | 2.4.2.2 Project Manager/Contracting Officer's Technical | | | | | | Representative (COTR) | 30 | | | 2.4.2.3 System Security Specialist (SSS) | 2.4.2.3 System Security Specialist (SSS) | 2.4.2.3 System Security Specialist (SSS) | 31 | | | 2.4.2.4 Internal Control Specialist (ICS) | 2.4.2.4 Internal Control Specialist (ICS) | 2.4.2.4 Internal Control Specialist (ICS) | 31 | | | 2.4.2.5 | 2.4.2.5 | Contracting Officer | 31 | | | 2.4.2.6 | 2.4.2.6 | ADP Manager | 32 | | | 2.4.2.7 | 2.4.2.7 | QuaHty Assurance (QA) Specialist | 32 | | 2.5 | USE OF EXTERNAL DEVELOPMENl^ SERVICES | USE OF EXTERNAL DEVELOPMENl^ SERVICES | USE OF EXTERNAL DEVELOPMENl^ SERVICES | 32 | | | 2.5.1 Contractor Services | 2.5.1 Contractor Services | 2.5.1 Contractor Services | 32 | | | 2.5,1.1 Differences from the AIS Life Cycle Matrix | 2.5,1.1 Differences from the AIS Life Cycle Matrix | 2.5,1.1 Differences from the AIS Life Cycle Matrix | 33 | ( ^ p 9 I | | 2.5.1.2 | 2.5.1.2 |


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AT.L2-3.2.4 (NIST 3.2.4)?

[Assistant]
According to Recommendations for Federal Vulnerability Disclosure Guidelines:

3.2.4. 3.2.4.

Recommendations for Federal Vulnerability Disclosure Guidelines


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Services Acquisition?

[Assistant]
According to Cryptographic Module Validation Program (CMVP)-Approved Sensitive Security Parameter Generation and Establishment Methods_ CMVP Validation Authority U:

There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may be used by federal agencies even before the completion of such companion publications. Thus, until each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning and transition purposes, federal agencies may wish to closely follow the development of these new publications by NIST.

The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the Nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology. ITL's responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in federal information systems. The Special Publication 800-series reports on ITL's research, guidelines, and outreach efforts in information system security, and its collaborative activities with industry, government, and academic organizations.

Cryptographic Module Validation Program (CMVP)-Approved Sensitive Security Parameter Generation and Establishment Methods_ CMVP Validation Authority U


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Identification and Authentication?

Secure Software Development Framework (SSDF) Version 1.1_ Recommendations for Mitigating the Risk of Software Vulnerabilities


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Awareness and Training?

[Assistant]
According to NIST Cybersecurity Framework 2.0_ Quick-Start Guide for Cybersecurity Supply Chain Risk Management (C-SCRM):

- Identity Management, Authentication, and Access Control: Identities and credentials for authorized users, services, and hardware are managed by the organization [PR.AA-01]
- Awareness and Training: Individuals in specialized roles are provided with awareness and training so that they possess the knowledge and skills to perform relevant tasks with cybersecurity risks in mind [PR.AT-02]

NIST Cybersecurity Framework 2.0_ Quick-Start Guide for Cybersecurity Supply Chain Risk Management (C-SCRM)


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Incident Response?

[Assistant]
According to Assessing Security and Privacy Controls in Information Systems and Organizations:

NTROL ASSESSMENTS ..................................................... 30
3.4   ANALYZE ASSESSMENT REPORT RESULTS .....................................................................................
32
3.5   ASSESS SECURITY AND PRIVACY CAPABILITIES .............................................................................. 34
CHAPTER FOUR SECURITY AND PRIVACY ASSESSMENT PROCEDURES ................................................. 37
4.1   ACCESS CONTROL............................................................................................................................ 40
4.2   AWARENESS AND TRAINING ........................................................................................................ 118
4.3   AUDIT AND ACCOUNTABILITY ...................................................................................................... 128
4.4   ASSESSMENT, AUTHORIZATION, AND MONITORING ................................................................. 160
4.5   CONFIGURATION MANAGEMENT ................................................................................................ 177
4.6   CONTINGENCY PLANNING ............................................................................................................ 215
4.7   IDENTIFICATION AND AUTHENTICATION .................................................................................... 243
4.8   INCIDENT RESPONSE ............................................................................................................... 275
4.9   MAINTENANCE ........................................................................................................................ 298
4.10   MEDIA PROTECTION .............................................................................................................. 316
4.11   PHYSICAL AND ENVIRONMENTAL PROTECTION .......................................................................

Assessing Security and Privacy Controls in Information Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Maintenance?

[Assistant]
According to Secure Software Development Framework (SSDF) Version 1.1_ Recommendations for Mitigating the Risk of Software Vulnerabilities:

This includes requirements from internal sources (e.g., the organization's policies, business objectives, and risk management strategy) and external sources (e.g., applicable laws and regulations). | PO.1.1 : Identify and document all security requirements for the organization's software development infrastructures and processes, and maintain the requirements over time. | Example 1 : Define policies for securing software development infrastructures and their components, including development endpoints, throughout the SDLC and maintaining that security. Example 2 : Define policies for securing software development processes throughout the SDLC and maintaining that security, including for open-source and other third-party software components utilized by software being developed. Example 3 : Review and update security requirements at least annually, or sooner if there are new requirements from internal or external sources, or a major security incident targeting software development infrastructure has occurred. Example 4 : Educate affected individuals on impending changes to requirements.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Protecting Controlled Unclassified Information (CUI)_ NIST Special Publication 800-171, Revision 3. Small Business Primer provide? (Part 9)

[Assistant]
NIST does not necessarily endorse the views expressed or the facts presented on those sites. Further, NIST does not endorse any commercial products that may be advertised or available on these sites.
ht ps:/

csrc.nist.gov/projects/protecting-control ed-unclas ified-information

## Introductory Tips for Implementers

<!-- image -->

## What's New in SP 800 -171, Revision 3? ## SP 800-171, Revision 3 was published in May 2024. Significant changes include:

## Updates to the Security Requirements and Families

- Based on NIST SP 800-53, Revision 5 and the NIST SP 800-53B moderate impact control baseline. - Applies updated tailoring criteria addressing stakeholder feedback (adding new, consolidating, and withdrawing requirements). - Includes increased specificity in security requirements. - Introduces organization-defined parameters (ODP) to increase flexibility to better manage organizationspecific risks. ## Additional Revision 3 Resources

- A CUI overlay (.xlsx) showing the direct link between SP 800-53 and SP 800171, including NIST's tailoring decisions. - Transitioning your organization from implementation of Revision 2 to Revision 3? Review this detailed analysis of the changes between Revision 2 and Revision 3 (.xlsx). - The SP 800-171 security requirements in multiple formats (Excel, JSON, and online) through the NIST Cybersecurity and Privacy Reference Tool. ht ps:/

csrc.nist.gov/projects/protecting-control ed-unclas ified-information

## Key Terms

<!-- image -->

<!-- image -->

Control Baseline: A set of controls you can implement to meet strategic, legal, regulatory, or contractual security and privacy requirements and manage risk. Organization-Defined Parameters (ODPs) are included in certain security requirements. ODPs provide the flexibility and specificity needed by organizations to clearly define their CUI security requirements, given the diverse nature of their missions, business functions, operational environments, and risk tolerance.

Protecting Controlled Unclassified Information (CUI)_ NIST Special Publication 800-171, Revision 3. Small Business Primer


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Security Assessment?

[Assistant]
According to Federal Cybersecurity Role-Based Training Approaches, Successes, and Challenges:

Almost two-thirds (65%) of survey participants measure RBT effectiveness by using training completion rates, and just under half evaluate success via audit reports or evaluations (Figure 14). Less than half (46%) gauge effectiveness from informal employee feedback (e.g., inperson discussions, emails), and 34% use employee surveys to determine training success. Just under a quarter (24%) examine behaviors (e.g., security incident trends and incident reporting) as evidence that employees are applying what they have learned through RBT. 9% of participants do not attempt to measure the effectiveness of their RBT activities at all.

Over half of survey participants rated their RBT activities as moderately or very successful. However, there is great variation in how organizations determine that success, and determining RBT effectiveness was viewed as challenging by close to 60% of survey participants. Many rely on compliance metrics, such as training completion rates or FISMA evaluations, that do not necessarily reflect impact on employee learning or behaviors, which is the goal of RBT. The lack of meaningful metrics may also place RBT staff at a disadvantage in trying to gain leadership support for training activities.

□ Audit reports or FISMA (Federal Information Security Modernization Act of 2014) evaluations

Federal Cybersecurity Role-Based Training Approaches, Successes, and Challenges


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Guidelines for Media Sanitization provide? (Part 4)

[Assistant]
ards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology.
ITL's responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in federal information systems. The Special Publication 800-series reports on ITL's research, guidelines, and outreach efforts in information system security, and its collaborative activities with industry, government, and academic organizations. ## Patent Disclosure Notice

NOTICE: ITL has requested that holders of patent claims whose use may be required for compliance with the guidance or requirements of this publication disclose such patent claims to ITL. However, holders of patents are not obligated to respond to ITL calls for patents and ITL has not undertaken a patent search in order to identify which, if any, patents may apply to this publication. As of the date of publication and following call(s) for the identification of patent claims whose use may be required for compliance with the guidance or requirements of this publication, no such patent claims have been identified to ITL. No representation is made or implied by ITL that licenses are not required to avoid patent infringement in the use of this publication. ## Table of Contents

| Executive Summary............................................................................................................................1      |
|-----------------------------------------------------------------------------------------------------------------------------------------------------|
| 1. Introduction...................................................................................................................................2 |
| 2.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Configuration Management?

[Assistant]
According to Recommendation for Pair-Wise Key-Establishment Using Integer Factorization Cryptography:

To include bilateral key confirmation, two instances of unilateral key confirmation (as specified in Section 5.6.1, subject to the modifications listed below) shall be incorporated into the KAS2 scheme, once with party U as the key-confirmation provider (i.e., P = U and R = V) and once with party  V  as  the  key-confirmation  provider  (i.e.,  P  =  V  and  R  =  U).  Additional  details  will  be provided in Section 8.3.3.4.

Recommendation for Pair-Wise Key-Establishment Using Integer Factorization Cryptography


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Zero Trust Architecture provide? (Part 4)

[Assistant]
ares y Tecnología (NIST) promueve la economía  y  el  bienestar  público  de  Estados  Unidos  a  través  de  su  liderazgo  técnico  en  la infraestructura  de  medición  y  normalización  del  país.
El  ITL  desarrolla  pruebas,  métodos  de prueba, datos  de referencia, implementaciones de  pruebas  de  concepto  y  análisis técnicos para avanzar en el desarrollo y el  uso productivo de la tecnología de la  información. Las responsabilidades del ITL incluyen el desarrollo de normas y directrices de gestión, administrativas, técnicas y físicas para la seguridad rentable y la privacidad de la información no relacionada  con  la  seguridad  nacional  en  los  sistemas  de  información  federales. La  serie  de publicaciones  especiales  800  informa  sobre  las  investigaciones,  directrices  y  actividades  de divulgación del ITL en materia de seguridad de los sistemas de información, así como sobre sus actividades de colaboración con organizaciones industriales, gubernamentales y académicas. ## Resumen

La confianza cero (ZT) es el término que designa un conjunto de paradigmas de ciberseguridad en evolución que desplazan las defensas de los perímetros estáticos basados en la red para centrarse en  los  usuarios,  los  activos  y  los  recursos. Una  arquitectura  de  confianza  cero  (ZTA)  utiliza principios de confianza cero para planificar la infraestructura y los flujos de trabajo industriales y empresariales. La  confianza  cero  asume  que  no  hay  confianza  implícita  concedida  a  activos  o cuentas de usuario basada únicamente en su ubicación física o de red (es decir, redes de área local frente a Internet) o basada en la propiedad de los activos (propiedad de la empresa o personal). La autenticación y la autorización (tanto del sujeto como del dispositivo) son funciones discretas que se realizan antes de establecer una sesión con un recurso de la empresa.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What guidance does Blockchain for Access Control Systems provide?

[Assistant]
## NIST IR 8403

## Blockchain for Access Control Systems

Vincent C. Hu

This publication is available free of charge from: https://doi.org/10.6028/NIST.IR.8403

<!-- image -->

## NIST IR 8403

## Blockchain for Access Control Systems

Vincent C. Hu

Computer Security Division Information Technology Laboratory

This publication is available free of charge from: https://doi.org/10.6028/NIST.IR.8403

May 2022

<!-- image -->

U.S. Department of Commerce Gina M. Raimondo, Secretary

## National Institute of Standards and Technology Interagency or Internal Report 8403 28 pages (May 2022)

This publication is available free of charge from:

https://doi.org/10.6028/NIST.IR.8403

Certain  commercial  entities,  equipment,  or  materials  may  be  identified  in  this  document  in  order  to  describe  an experimental  procedure  or  concept  adequately. Such  identification  is  not  intended  to  imply  recommendation  or endorsement by NIST, nor is it intended to imply that the entities, materials, or equipment are necessarily the best available for the purpose. There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may  be  used  by  federal  agencies  even  before  the  completion  of  such  companion  publications. Thus,  until  each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning  and  transition  purposes,  federal  agencies  may  wish  to  closely  follow  the  development  of  these  new publications by NIST. Organizations are encouraged to review all draft publications during public comment periods and provide feedback to NIST. Many NIST cybersecurity publications, other than the ones noted above, are available at https://csrc.nist.gov/publications.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for Incident Response?

[Assistant]
According to Assessing Enhanced Security Requirements for Controlled Unclassified Information:

| ASSESSMENT PROCEDURES................................................................................................................
| 3   |
| 2.2                                                                                | ASSURANCE CASES.............................................................................................................................. | 4   |
| CHAPTER THREE THE PROCEDURES............................................................................................... | CHAPTER THREE THE PROCEDURES............................................................................................... | 7   |
| 3.1                                                                                | ACCESSCONTROL ............................................................................................................................... | 8   |
| 3.2                                                                                | AWARENESSANDTRAINING............................................................................................................... | 9   |
| 3.3                                                                                | AUDIT ANDACCOUNTABILITY........................................................................................................... | 10  |
| 3.4                                                                                | CONFIGURATION MANAGEMENT.....................................................................................................


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Personnel Security?

[Assistant]
According to The Federal Cybersecurity Awareness Workforce_ Professional Backgrounds, Knowledge, Skills, and Development Activities:

|
| [INDEED]  | Indeed (2021) 15 Professional Skills (Plus Definition and Tips).
Available at https://www.indeed.com/career-advice/career-development/professional-skills                                                                                |
| [OPM]     | U.S. Office of Personnel Management (2018) Guidance for Identifying, Addressing and Reporting Cybersecurity Work Roles of Critical Need. (U.S. Office of Personnel Management, Washington, DC). Available at https://chcoc.gov/content/guidance-identifying-addressing-and-reporting- cybersecurity-work-roles-critical-need |
| [SANS]    | SANS (2021). 2021 SANS Security Awareness Report: Managing Human Cyber Risk. Available at https://www.sans.org/security-awareness- training/resources/reports/sareport-2021/                                                                                |
| [STEWART] | Stewart, G, Lacey, D (2012) Death by a Thousand Facts: Criticising the Technocratic Approach to Information Security Awareness. Information Management &Computer Security 20(1):29-38. |
| [WILSON]  | Wilson M, Hash J (2003) Building an Information Technology Security Awareness and Training Program. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) 800-50. https://doi.org/10.6028/NIST.SP.800-50                                                                         |
| [WOELK]   | Woelk, B (2015) The Successful Security Awareness Professional: Foundational Skills and Continuing Education Strategies. EDUCAUSE Center for Analysis and Research . Available at https://library.educause.edu/~/media/files/library/2016/8/ erb1608.pdf                                                                     |

The Federal Cybersecurity Awareness Workforce_ Professional Backgrounds, Knowledge, Skills, and Development Activities


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Security Assessment?

[Assistant]
According to Data Integrity_ Detecting and Responding to Ransomware and Other Destructive Events:

5.3.3 | Accidental VMDeletion via Maintenance Script ........................................................23 | | | 5.3.4 | Backdoor Creation via Email Vector ...........................................................................24 Insider..............................................................25 | | | 5.3.5 | Database Modification via Malicious |

Data Integrity_ Detecting and Responding to Ransomware and Other Destructive Events


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Personnel Security?

[Assistant]
According to Guidelines for Media Sanitization:

guarantees, assessment results, formal certifications) that the ISM vendor should provide for the sanitization capabilities

Varying data protection policies may be established within an organization.
For example, an organization can have an engineering department and a sales department, where the sales personnel do not need to access detailed proprietary technical data (e.g., source code, schematics), and the engineers do not need to access the PII of the organization's customers. Both might be within the same confidentiality categorization but are contextually different and have different internal and external rules regarding necessary controls. As such, the data protection level is a complementary consideration to organizational control. When identifying whether sanitization is necessary, both organizational control and the data protection level should be considered.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Risk Assessment?

[Assistant]
According to Guidelines for Media Sanitization:

For organizations to have appropriate controls on the information for which they are responsible, they must properly safeguard used media. Potential misuse of information collection can result from improperly disposed hard copy media, the acquisition of improperly sanitized ISM, or laboratory reconstruction of ISM sanitized in a manner that is not commensurate with the confidentiality of information stored on that media. Media flows in and out of organizational control through recycle bins, out to vendors for equipment repairs, and swapped into other systems in response to hardware or software failures. This potential vulnerability can be mitigated by properly understanding where information is located and how to protect it.

- Hard copy. Hard copy media refers to physical representations of information, typically paper printouts, film, microfiche, etc. However, printer and facsimile ribbons, drums, and platens are also examples of hard copy media. The supplies associated with producing paper printouts are often the most uncontrolled. Hard copy materials containing sensitive data that leave an organization without effective sanitization expose a significant vulnerability to 'dumpster divers' and overcurious employees.
- Information storage media (ISM). ISM commonly 2 takes the form of:
- o Devices that contain bits and bytes, such as hard disk drives (HDDs), solid state drives (SSDs), random access memory (RAM), read-only memory (ROM), optical disks, magnetic tape, flash memory, memory devices, phones, mobile computing devices, networking devices, and office equipment
- o Systems that provide 'virtual' or 'logical' storage that abstracts the underlying electronic media (e.g., cloud storage, object storage)


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for Awareness and Training?

[Assistant]
According to Protecting Controlled Unclassified Information (CUI)_ NIST Special Publication 800-171, Revision 3. Small Business Primer:

| Access Control                    | Maintenance         | Security Assessment and Monitoring   |
|-----------------------------------|---------------------|--------------------------------------|
| Awareness and Training            | Media Protection    | System and Communications Protection |
| Audit and Accountability          | Personnel Security  | System and Information Integrity     |
| Configuration Management          | Physical Protection | Planning                             |
| Identification and Authentication | Risk Assessment     | System and Services Acquisition      |
| Incident Response                 |                     | Supply Chain Risk Management         |

## Getting Started with Awareness and Training

## Family: Awareness and Training


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Planning?

[Assistant]
According to Blockchain for Access Control Systems:

There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may  be  used  by  federal  agencies  even  before  the  completion  of  such  companion  publications.  Thus,  until  each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning  and  transition  purposes,  federal  agencies  may  wish  to  closely  follow  the  development  of  these  new publications by NIST.