[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] How does IoT Non-Technical Supporting Capability Core Baseline support CMMC certification?

[Assistant]
According to IoT Non-Technical Supporting Capability Core Baseline:

## NISTIR 8259B

## IoT Non-Technical Supporting Capability Core Baseline

Michael Fagan Jeffrey Marron Kevin G. Brady, Jr. Barbara B. Cuthill Katerina N. Megas Rebecca Herold

This publication is available free of charge from:

https://doi.org/10.6028/NIST.IR.8259B

<!-- image -->

## NISTIR 8259B

## Internet of Things Non-Technical Supporting Capability Core Baseline

Michael Fagan Jeffrey Marron Kevin G. Brady, Jr. Barbara B. Cuthill Katerina N. Megas

Applied Cybersecurity Division Information Technology Laboratory

Rebecca Herold

The Privacy Professor

Des Moines, IA

This publication is available free of charge from: https://doi.org/10.6028/NIST.IR.8259B

August 2021

<!-- image -->

U.S. Department of Commerce Gina M. Raimondo, Secretary

National Institute of Standards and Technology James K. Olthoff, Performing the Non-Exclusive Functions and Duties of the Under Secretary of Commerce for Standards and Technology & Director, National Institute of Standards and Technology

## National Institute of Standards and Technology Interagency or Internal Report 8259B 21 pages (August 2021)

## This publication is available free of charge from: https://doi.org/10.6028/NIST.IR.8259B

Certain  commercial  entities,  equipment,  or  materials  may  be  identified  in  this  document  in  order  to  describe  an experimental  procedure  or  concept  adequately. Such  identification  is  not  intended  to  imply  recommendation  or endorsement by NIST, nor is it intended to imply that the entities, materials, or equipment are necessarily the best available for the purpose. There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may  be  used  by  federal  agencies  even  before  the  completion  of  such  companion  publications.

IoT Non-Technical Supporting Capability Core Baseline


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Federal Cybersecurity Role-Based Training Approaches, Successes, and Challenges provide? (Part 4)

[Assistant]
ations when implementing role-based training activities. This paper reports the results of the study and suggests actions that organizations can take to improve federal role-based training activities.
Keywords:GLYPH<c=2,font=/AAAAAA+HKGrotesk-Medium> cybersecurity,GLYPH<c=2,font=/AAAAAA+HKGrotesk-Medium> role-basedGLYPH<c=2,font=/AAAAAA+HKGrotesk-Medium> trainingGLYPH<c=2,font=/AAAAAA+HKGrotesk-Medium>

## TABLEGLYPH<c=2,font=/EAAAAA+HKGrotesk-Bold> OFGLYPH<c=2,font=/EAAAAA+HKGrotesk-Bold> CONTENTSGLYPH<c=2,font=/EAAAAA+HKGrotesk-Bold>

| NIST Usable Cybersecurity                  |   1 |
|--------------------------------------------|-----|
| Executive Summary                          |   2 |
| Study Background and Purpose               |   4 |
| Methodology                                |   6 |
| Results                                    |   7 |
| Training Assignment                        |   8 |
| Role-Based Training Content and Approaches |  10 |
| Training Compliance                        |  15 |
| Support for Role-Based Training            |  18 |
| Determining Training Effectiveness         |  21 |
| Limitations                                |  23 |
| Discussion                                 |  24 |
| Technical Appendix                         |  29 |
| Detailed Study Methodology                 |  30 |
| Survey Participant Demographics            |  35 |
| Survey Organizations                       |  38 |
| - Role Based Training Programs             |  39 |
| References                                 |  40 |
| Study Instruments                          |  41 |

## NIST USABLE CYBERSECURITY

We are the Usable Cybersecurity team within the National Institute of Standards and Technology (NIST) Visualization and Usability Group.

Federal Cybersecurity Role-Based Training Approaches, Successes, and Challenges

Audit and Accountability
System and Information Integrity
Security Assessment
Media Protection
Identification and Authentication
Awareness and Training
System and Communications Protection
Access Control
Planning
Incident Response
Risk Assessment
Personnel Security
System and Services Acquisition
Supply Chain Risk Management
Maintenance
Physical Protection
Configuration Management


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 2 require for Planning?

[Assistant]
According to Assessing Security Requirements for Controlled Unclassified Information:

stomize assessments based on organizational policies and requirements, known threat and vulnerability information, system and platform dependencies, operational considerations, and tolerance for risk.
1

| Access Control                    | Maintenance         | Security Assessment and Monitoring   |
|-----------------------------------|---------------------|--------------------------------------|
| Awareness and Training            | Media Protection    | System and Communications Protection |
| Audit and Accountability          | Personnel Security  | System and Information Integrity     |
| Configuration Management          | Physical Protection | Planning                             |
| Identification and Authentication | Risk Assessment     | System and Services Acquisition      |
| Incident Response                 |                     | Supply Chain Risk Management         |

Assessing Security Requirements for Controlled Unclassified Information


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for System and Information Integrity?

[Assistant]
According to Protecting Controlled Unclassified Information (CUI)_ NIST Special Publication 800-171, Revision 3. Small Business Primer:

NIST SP 800-172, Enhanced Security Requirements for Protecting Controlled Unclassified Information provides enhanced security requirements to help protect CUI associated with critical programs or high value assets in nonfederal systems and organizations from the advanced persistent threat (APT). The SP 800-172 enhanced security requirements are designed to protect confidentiality, integrity and availability of information.

2 SP 800-171 does not explicitly cover integrity and availability so it is not a comprehensive security program.

| Access Control                    | Maintenance         | Security Assessment and Monitoring   |
|-----------------------------------|---------------------|--------------------------------------|
| Awareness and Training            | Media Protection    | System and Communications Protection |
| Audit and Accountability          | Personnel Security  | System and Information Integrity     |
| Configuration Management          | Physical Protection | Planning                             |
| Identification and Authentication | Risk Assessment     | System and Services Acquisition      |
| Incident Response                 |                     | Supply Chain Risk Management         |

Protecting Controlled Unclassified Information (CUI)_ NIST Special Publication 800-171, Revision 3. Small Business Primer


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Identification and Authentication?

[Assistant]
According to Contingency Planning Guide for Federal Information Systems:

| | Introduction ....................................................................................................1 | | |-----------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------| | 1.1 | | Purpose.......................................................................................................................1 | | | 1.2 | | Scope..........................................................................................................................2 | | | 1.3 | | Audience.....................................................................................................................3 | | | 1.4 | Document | Structure....................................................................................................4 | | | Chapter 2.

Contingency Planning Guide for Federal Information Systems


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Status Report on the Fourth Round of the NIST Post-Quantum Cryptography Standardization Process provide? (Part 8)

[Assistant]
ms, analyses, and public comments; performed testing; provided technical and administrative support; and participated in numerous meetings to discuss the selection of the candidate to be standardized.
They are Zuzana Bajcsy, Lily Chen, Morris Dworkin, Sara Kerman, and Andrew Regenscheid. ## 1. Introduction

The National Institute of Standards and Technology (NIST) initiated the Post-Quantum Cryptography (PQC) Standardization Process in December 2016 to select quantum-resistant public-key cryptographic algorithms for standardization in response to the substantial development and advancement of quantum computing. After three rounds of evaluation and analysis, NIST announced the selection of the first algorithms to be standardized [2]. The key encapsulation mechanism (KEM) selected for standardization was CRYSTALS-Kyber (ML-KEM [3]). The digital signatures selected were CRYSTALS-Dilithium (ML-DSA [4]), Falcon (FN-DSA), and SPHINCS + (SLH-DSA [5]). For a detailed explanation of NIST's choices, as well as a summary of the third round, see NIST IR 8413 [2]. In addition to those initial selections, NIST advanced four KEM candidates to the fourth round for continued evaluation: BIKE [6], Classic McEliece [7], HQC [8], and SIKE [9]. These algorithms were all based on different security assumptions than ML-KEM. NIST indicated that it would select one or two of the algorithms for standardization at the conclusion of the fourth round. The fourth round began in July 2022 and involved a thorough analysis of the theoretical and empirical evidence used to justify the security of the candidates. During this time, the submitters of SIKE acknowledged its insecurity and recommended against its further use. The submission teams of the unbroken fourth-round candidates were invited to present updates for their candidate algorithms at the Fifth NIST PQC Standardization Conference in Rockville, Maryland, on April 10-12, 2024.

Status Report on the Fourth Round of the NIST Post-Quantum Cryptography Standardization Process


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Guide to Malware Incident Prevention and Handling for Desktops and Laptops provide? (Part 10)

[Assistant] | Malware Incident Prevention........................................................................................... | Malware Incident Prevention...........................................................................................

Guide to Malware Incident Prevention and Handling for Desktops and Laptops


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 1 require for Risk Assessment?

[Assistant]
According to IoT Device Cybersecurity Capability Core Baseline:

full, in part, or not at all. It is left to the implementing organization to understand the unique risk context in which it operates and what is appropriate for its given circumstance. For more information on how to conduct a risk assessment, see NIST Special Publication 800-30, Guide for Conducting Risk Assessments [3].

IoT Device Cybersecurity Capability Core Baseline


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Assessing Security and Privacy Controls in Information Systems and Organizations provide? (Part 10)

[Assistant]
However, holders of patents are not obligated to
respond to ITL calls for patents and ITL has not undertaken a patent search in order to identify
which, if any, patents may apply to this publication.
As of the date of publication and following call(s) for the identification of patent claims whose
use may be required for compliance with the guidance or requirements of this publication, no
such patent claims have been identified to ITL. No representation is made or implied by ITL that licenses are not required to avoid patent
infringement in the use of this publication. v

T
h
s

i

p
u
b

l
i

c
a

t
i

o
n

i

s

a
v
a

i
l

l

a
b
e
f
r
e
e
o
f

c
h
a
r
g
e
f
r
o
m

:

h
t
t
p
s
:
/
/
d
o
i
. o
r
g
/
1
0
. 6
0
2
8
/
N
S
T
S
P
. 8
0
0
-
5
3
A
r
5

. I

NIST SP 800-53A REV. 5
ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS
_________________________________________________________________________________________________

DEVELOPING COMMON INFORMATION SECURITY AND PRIVACY FOUNDATIONS
COLLABORATION AMONG PUBLIC AND PRIVATE SECTOR ENTITIES

In developing standards and guidelines required by [FISMA], NIST consults with other federal agencies and
offices as well as private sector entities to improve information security, avoid unnecessary and costly
duplication of effort, and ensure that NIST publications complement the standards and guidelines
employed for the protection of national security systems. In addition to its comprehensive public review
and vetting process, NIST collaborates with the Office of the Director of National Intelligence (ODNI), the
Department of Defense (DoD), and the Committee on National Security Systems (CNSS) to establish and
maintain a unified framework and common foundation for information security across the Federal
Government.

Assessing Security and Privacy Controls in Information Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Maintenance?

[Assistant]
According to Secure Software Development Practices for Generative AI and Dual-Use Foundation Models_ An SSDF Community Profile:

Additional information about this publication is available at https://csrc.nist.gov/pubs/sp/800/218/a/final, including related content, potential updates, and document history.

Secure Software Development Practices for Generative AI and Dual-Use Foundation Models_ An SSDF Community Profile


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does High-Performance Computing Security_ Architecture, Threat Analysis, and Security Posture provide? (Part 5)

[Assistant]
gement, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in federal information systems.
The Special Publication 800-series reports on ITL's research, guidelines, and outreach efforts in information system security, and its collaborative activities with industry, government, and academic organizations. ## Patent Disclosure Notice

NOTICE: ITL has requested that holders of patent claims whose use may be required for compliance with the guidance or requirements of this publication disclose such patent claims to ITL. However, holders of patents are not obligated to respond to ITL calls for patents and ITL has not undertaken a patent search in order to identify which, if any, patents may apply to this publication. As of the date of publication and following call(s) for the identification of patent claims whose use may be required for compliance with the guidance or requirements of this publication, no such patent claims have been identified to ITL. No representation is made or implied by ITL that licenses are not required to avoid patent infringement in the use of this publication. ## Table of Contents

| 1. Introduction...................................................................................................................................1     |
|---------------------------------------------------------------------------------------------------------------------------------------------------------|
| 2. HPC System Reference Architecture and Main Components ............................................................2                                  |
| 2.1.1. Components of the High-Performance Computing Zone.............................................................3                                  |
| 2.1.2.

High-Performance Computing Security_ Architecture, Threat Analysis, and Security Posture


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Security Assessment?

[Assistant]
According to Assessing Security and Privacy Controls in Information Systems and Organizations:

CHAPTER ONE INTRODUCTION ............................................................................................................... 1
1.1   PURPOSE AND APPLICABILITY .......................................................................................................... 1
1.2   TARGET AUDIENCE ............................................................................................................................ 4
1.3   RELATED PUBLICATIONS AND ASSESSMENT PROCESSES ............................................................... 4
1.4   ORGANIZATION OF THIS PUBLICATION ........................................................................................... 5
CHAPTER TWO THE FUNDAMENTALS ..................................................................................................... 6
2.1   ASSESSMENTS WITHIN THE SYSTEM DEVELOPMENT LIFE CYCLE .................................................. 6
2.2   CONTROL STRUCTURE AND ORGANIZATION .................................................................................. 7
2.3   BUILDING AN EFFECTIVE ASSURANCE CASE .................................................................................... 8
2.4   ASSESSMENT PROCEDURES: ASSESSMENT OBJECTS, METHODS AND OBJECTIVES ................... 11
CHAPTER THREE THE PROCESS ............................................................................................................. 19
3.1   PREPARE FOR SECURITY AND PRIVACY CONTROL ASSESSMENTS ............................................... 19
3.2   DEVELOP SECURITY AND PRIVACY ASSESSMENT PLANS .............................................................. 23
3.3   CONDUCT SECURITY AND PRIVACY CONTROL ASSESSMENTS ..................................................... 30
3.4   ANALYZE ASSESSMENT REPORT RESULTS .....................................................................................


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Likely Exploited Vulnerabilities_ A Proposed Metric for Vulnerability Exploitation Probability provide? (Part 9)

[Assistant]
xploitation data is unavailable but necessary to thoroughly test the performance of the LEV metric. The EPSS performance results are not of a form that enables a direct calculation of LEV performance.
Thus, while LEV performance is presumed to be high given the quality of its foundational EPSS data, performance results for the LEV probabilities themselves are not currently available. The National Institute of Standards and Technology (NIST) is seeking industry partners with relevant datasets to empirically measure the performance of LEV probabilities. The rest of this work is organized as follows. Section 2 provides background on vulnerability enumerations, EPSS, and KEV lists. Section 3 discusses LEV probability use cases. Section 4 presents the LEV equations. Section 5 derives the equations. Section 6 provides example LEV output. Section 7 presents empirical results. Section 8 discusses KEV list comprehensiveness measurements and possible sources of error. Section 9 covers performance. Section 10 discusses the LEV implementation and Section 11 concludes. Appendix A contain excerpts from the EPSS documentation. Appendix B is a list of abbreviations and acronyms. ## 2. Background

This section contains background necessary to understand the LEV equations and approach. It introduces vulnerability enumeration lists, EPSS scoring, and discusses KEV lists. ## 2.1. Common Vulnerabilities and Exposures

The Common Vulnerabilities and Exposures (CVE) is an enumeration of known vulnerabilities in information technology products, primarily software but also hardware [7]. It is widely accepted as the most comprehensive list available and is used extensively within the information technology security community. The United States National Vulnerability Database (NVD) provides information and references for all CVEs [8]. ## 2.2. Exploit Prediction Scoring System

EPSS provides a daily updated score for each CVE.

Likely Exploited Vulnerabilities_ A Proposed Metric for Vulnerability Exploitation Probability


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Information Integrity?

[Assistant]
According to Automated Secure Configuration Guidance from the macOS Security Compliance Project (mSCP):

consistency, and it also maintains the integrity of the source content. Because the YAML content is all command-driven, it is converted to Tenable's CMD\_EXEC check type for use with the Unix plugin.
The YAML rules have a 'tags' section that was used to create unique audit profiles related to common frameworks. An example of these profiles can be seen in the audit file naming convention:

Automated Secure Configuration Guidance from the macOS Security Compliance Project (mSCP)


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Secure Software Development Practices for Generative AI and Dual-Use Foundation Models_ An SSDF Community Profile provide? (Part 9)

[Assistant]
elopment. These additions are documented in the form of an SSDF Community Profile ('Profile'), which is a baseline of SSDF practices and tasks that have been enhanced to address a particular use case.
An example of an addition is, 'Secure code storage should include AI models, model weights, pipelines, reward models, and any other AI model elements that need their confidentiality, integrity, and/or availability protected.'

This Profile supplements what SSDF version 1.1 already includes. The Profile is intended to be used in conjunction with NIST Special Publication (SP) 800-218, Secure Software Development Framework (SSDF) Version 1.1: Recommendations for Mitigating the Risk of Software Vulnerabilities [6] and should not be used without SP 800-218 . Readers should also utilize the implementation examples and informative references defined in SP 800-218 for additional information on how to perform each SSDF practice and task for all types of software development, as they are also generally applicable to AI model and AI system development. ## Scope

This Profile's scope is AI model development , which includes data sourcing for, designing, training, fine-tuning, and evaluating AI models, as well as incorporating and integrating AI models into other software. Consistent with SSDF version 1.1 and EO 14110, practices for the deployment and operation of AI systems with AI models are out of scope . Similarly, while cybersecurity practices for training data and other forms of data being used for AI model development are in scope, the rest of the data governance and management life cycle is out of scope. Practices and tasks in this Profile do not distinguish between human-written and AI-generated source code, because it is assumed that all source code should be evaluated for vulnerabilities and other issues before use.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AU.L2-3.3.2 (NIST 3.3.2)?

[Assistant]
According to Guide to Auditing for Controls and Security_ A System Development Life Cycle Approach:

3.3.2                                                            | Workshop Points of Agreement                                     | Workshop Points of Agreement                                     | 49        |
| 3. 3.3.2 Review Initiation Phase Plans                                                       | 4. 3.3.2 Review Initiation Phase Plans                                                       | 81   |
|       |                                                                                | Information on the Initiation                                                               |      |
|       | 4.

Guide to Auditing for Controls and Security_ A System Development Life Cycle Approach


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What guidance does Approaches and Challenges of Federal Cybersecurity Awareness Programs provide?

[Assistant]
## NISTIR 8420A

## Approaches and Challenges of Federal Cybersecurity Awareness Programs

Julie Haney Jody Jacobs Susanne Furman Fernando Barrientos

This publication is available free of charge from: https://doi.org/10.6028/NIST.IR.8420A

<!-- image -->

## NISTIR 8420A

## Approaches and Challenges of Federal Cybersecurity Awareness Programs

Julie Haney Jody Jacobs Susanne Furman Fernando Barrientos Information Access Division Information Technology Laboratory

This publication is available free of charge from: https://doi.org/10.6028/NIST.IR.8420A

March 2022

<!-- image -->

U.S. Department of Commerce Gina M. Raimondo, Secretary

National Institute of Standards and Technology James K. Olthoff, Performing the Non-Exclusive Functions and Duties of the Under Secretary of Commerce for Standards and Technology & Director, National Institute of Standards and Technology

## National Institute of Standards and Technology Interagency or Internal Report 8420A 73 pages (March 2022)

## This publication is available free of charge from:

## https://doi.org/10.6028/NIST.IR.8420A

Certain  commercial  entities,  equipment,  or  materials  may  be  identified  in  this  document  in  order  to  describe  an experimental  procedure  or  concept  adequately. Such  identification  is  not  intended  to  imply  recommendation  or endorsement by NIST, nor is it intended to imply that the entities, materials, or equipment are necessarily the best available for the purpose. There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may  be  used  by  federal  agencies  even  before  the  completion  of  such  companion  publications. Thus,  until  each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative.

Approaches and Challenges of Federal Cybersecurity Awareness Programs


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Federal Cybersecurity Role-Based Training Approaches, Successes, and Challenges provide? (Part 6)

[Assistant]
Cybersecurity role-based training (RBT) includes specialized training on policies, procedures, and tools for individuals who are assigned roles having security and privacy responsibilities [SP800-53].
Most United States (U.S.) Federal Government organizations are required to conduct RBT for applicable federal government personnel and supporting contractors [CISA2022]. Despite the training mandate, there has been little prior effort to look broadly across federal organizations to see how they are implementing RBT activities and what issues they are experiencing. This lack of understanding may be hindering the development of improvements and resources for federal RBT activities. To address this gap, we - the Usable Cybersecurity team at the National Institute of Standards and Technology (NIST) conducted a research study to gain insights into the approaches of and challenges faced by organizations when implementing RBT activities. Our research initially focused on cybersecurity awareness programs targeted at organizations' general workforce. However, during focus groups of 29 federal employees with cybersecurity awareness duties, many participants discussed role-based training as being an especially challenging and related aspect of their jobs. Spurred by these discoveries, we conducted a follow-up online survey solely focused on role-based training that was completed by 82 federal employees. ## We found:

- RBT assignment: There is no standard way that organizations determine which employees should be assigned RBT. Some use the National Initiative for Cybersecurity Education (NICE) Workforce Framework for Cybersecurity (NICE Framework) as a guide, but others leave decisions up to the office of the Chief Information Officer (CIO) or even individual supervisors. - RBT content: About two-thirds of surveyed participants said that their organizations create at least some RBT content on their own, which could be resource-intensive.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Security Assessment?

[Assistant]
According to Validating the Integrity of Computing Devices:

| 1 | Summary.............................................................................................1 | Summary.............................................................................................1 | Summary.............................................................................................1 | |-----|---------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | | 1.1 | Challenge.......................................................................................................................2 | | | | 1.2 | Solution..........................................................................................................................3 | | | | 1.3 | Benefits..........................................................................................................................4 | | | 2 | How to Use This Guide.........................................................................4 | How to Use This Guide.........................................................................4 | | | | 2.1 | Typographic Conventions..............................................................................................5 | | | 3 | Approach.............................................................................................6 | Approach.............................................................................................6 | | | | 3.1 | Audience........................................................................................................................6 | | | | 3.2 | Scope .............................................................................................................................6 | | | | | 3.2.1 Scenario 1: Creation of Verifiable Platform | Artifacts ...................................................

Validating the Integrity of Computing Devices


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Blockchain for Access Control Systems provide? (Part 9)

[Assistant] The objectives of an AC system  are  often  described  in  terms  of  protecting  system  resources  against  inappropriate  or undesired user access. From a business perspective, this objective could just as well be described in  terms  of  the  optimal  sharing  of  information  [IR7316]. As  current  information  systems  and network architectures evolve to be more lightweight, pervasive, and interactive - such as the cloud and Internet of Things (IoT) - there is need for an AC mechanism to support the requirements of decentralization,  scalability,  and  trust  for  accessing  objects,  all  of  which  are  challenging  for traditional mechanisms. Blockchains  are  tamper-evident  and  tamper-resistant  cryptographically  linked  blocks  of  data (which  create  digital  ledgers)  implemented  in  a  distributed  fashion  (i.e.,  without  a  central repository) and usually without a central authority (i.e., a bank, company, or government). It uses replicated,  shared,  and  synchronized  digital  blocks  between  the  users  of  a  private  or  public distributed computer network located in different sites or organizations. A block links to previous blocks by containing a cryptographic hash summary of the previous block's contents, thus making the blockchain tamper-resistant and tamper-evident (because to change a block, one must then change all subsequent blocks that follow it). A linked list of blocks (i.e., a blockchain) typically has no central control authority and utilizes a decentralized consensus mechanism for reliable data transactions. A smart contract is a transaction protocol that executes the terms of a contract (such as payment term, lien, confidentiality, and even enforcement) on a blockchain via code that is deployed to and executed by blockchain nodes. The main purpose of smart contracts is to satisfy common contractual conditions, as well as minimize exceptions (both malicious and accidental) and the need for trusted intermediaries [IR8202].


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Physical Protection?

[Assistant]
According to Assessing Security and Privacy Controls in Information Systems and Organizations:

DEVELOPMENT LIFE CYCLE .................................................. 6
2.2   CONTROL STRUCTURE AND ORGANIZATION ..................................................................................
7
2.3   BUILDING AN EFFECTIVE ASSURANCE CASE .................................................................................... 8
2.4   ASSESSMENT PROCEDURES: ASSESSMENT OBJECTS, METHODS AND OBJECTIVES ................... 11
CHAPTER THREE THE PROCESS ............................................................................................................. 19
3.1   PREPARE FOR SECURITY AND PRIVACY CONTROL ASSESSMENTS ............................................... 19
3.2   DEVELOP SECURITY AND PRIVACY ASSESSMENT PLANS .............................................................. 23
3.3   CONDUCT SECURITY AND PRIVACY CONTROL ASSESSMENTS ..................................................... 30
3.4   ANALYZE ASSESSMENT REPORT RESULTS ..................................................................................... 32
3.5   ASSESS SECURITY AND PRIVACY CAPABILITIES .............................................................................. 34
CHAPTER FOUR SECURITY AND PRIVACY ASSESSMENT PROCEDURES ................................................. 37
4.1   ACCESS CONTROL............................................................................................................................ 40
4.2   AWARENESS AND TRAINING ........................................................................................................ 118
4.3   AUDIT AND ACCOUNTABILITY ...................................................................................................... 128
4.4   ASSESSMENT, AUTHORIZATION, AND MONITORING ................................................................. 160
4.5   CONFIGURATION MANAGEMENT ................................................................................................


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171 provide? (Part 5)

[Assistant]
quirements in NIST Special Publication 800-171 and are intended for use by federal agencies in contractual vehicles or other agreements established between those agencies and nonfederal organizations.
## Keywords

Advanced Persistent Threat; Basic Security Requirement; Contractor Systems; Controlled Unclassified Information; CUI Registry; Derived Security Requirement; Enhanced Security Requirement; Executive Order 13556; FIPS Publication 199; FIPS Publication 200; FISMA; NIST Special Publication 800-53; Nonfederal Organizations; Nonfederal Systems; Security Assessment; Security Control; Security Requirement. \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

## Acknowledgements

The authors also wish to recognize the scientists, engineers, and research staff from the NIST Computer Security and the Applied Cybersecurity Divisions for their exceptional contributions in helping to improve the content of the publication. A special note of thanks to Pat O'Reilly, Jim Foti, Jeff Brewer, Chris Enloe, Ned Goren, and the entire NIST web team for their outstanding administrative support. Finally, the authors also gratefully acknowledge the contributions from individuals and organizations in the public and private sectors, nationally and internationally, whose thoughtful and constructive comments improved the overall quality, thoroughness, and usefulness of this publication. \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

## Patent Disclosure Notice

NOTICE: The Information Technology Laboratory (ITL) has requested that holders of patent claims whose use may be required for compliance with the guidance or requirements of this publication disclose such patent claims to ITL.

Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does NIST Cybersecurity Framework 2.0_ Quick-Start Guide for Cybersecurity Supply Chain Risk Management (C-SCRM) provide? (Part 5)

[Assistant]
ibility matrixes (e.g., RACI charts) to document who will be responsible, accountable, consulted, and informed for C-SCRM activities and how those teams and individuals will be consulted and informed.
☐ Include C-SCRM responsibilities and performance requirements in personnel descriptions to ensure clarity and improve accountability. ☐ Document performance goals for personnel with C-SCRM responsibilities, and periodically measure them to demonstrate and improve performance. ☐ Develop roles and responsibilities for suppliers, customers, and business partners to address shared responsibilities for applicable cybersecurity risks and integrate them into organizational policies and applicable third-party agreements. ☐ Internally communicate C-SCRM roles and responsibilities for suppliers. ☐ Establish rules and protocols for information sharing and reporting processes between the organization and its suppliers. ## C-SCRM requirements:

- ☐ Establish security requirements for suppliers, products, and services commensurate with their criticality and potential impact if compromised. - ☐ Include all cybersecurity and supply chain requirements that suppliers must follow and how compliance with the requirements may be verified in default contractual language. - ☐ Define the rules and protocols for information sharing between the organization and its suppliers and sub-tier suppliers in contracts. ☐ Include security requirements in contracts based on their criticality and potential impact if compromised. - ☐ Define security requirements in service level agreements (SLAs) for monitoring suppliers for acceptable security performance throughout the supplier relationship lifecycle. - ☐ Specify in contracts the rights and responsibilities of the organization, its suppliers, and their supply chains with respect to potential cybersecurity risks.

NIST Cybersecurity Framework 2.0_ Quick-Start Guide for Cybersecurity Supply Chain Risk Management (C-SCRM)


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Audit and Evaluation of Computer Security provide? (Part 6)

[Assistant]
ns such as the Institute of Internal
Auditors, the American Institute of Certified Public Accountants, and
the EDP Auditors Associtation. The National Bureau of Standards, with the support of the U.S.
Gen-

eral Accounting Office, sponsored an invitational workshop in March of
1977 to explore the subject of "Audit and Evaluation of Computer Securi-
ty." Leading experts in the audit and computer communities were invited
to share their thoughts and develop a consensus view on ten aspects of
the subject. These Proceedings are the results of that meeting. To all those concerned with the audit and evaluation of computer

security today, we at the National Bureau of Standards offer this series
The views expressed do not
of consensus reports for your consideration. necessarily reflect those of the National Bureau of Standards, the U. S. General Accounting Office, or any of the organizations that sponsored an
individual at the workshop. However, these reports do reflect the compo-
site thoughts of a group that deserves your serious attention. M. Zane Thornton
Acting Director
Institute for Computer
Sciences and Technology

iil

. PREFACE

The National Bureau of Standards (NBS) initiated a Task Group

within the Federal Information Processing Standards (FIPS) program in
1973 to develop standards in Computer Systems Security. (TG-15) was composed of representatives from private industry as well as
Federal, State and local governments. The NBS Invitational Workshop on
Audit and Evaluation of Computer Security was organized as one phase of
a two-phase project defined by the Task Group in this important area of
computer security. The
second phase will be to adapt this information to the needs of Federal
agencies in the form of Federal Information Processing Guidelines. latter effort will be carried out by a working group convened for this
purpose and will result in a FIPS publication by NBS. These Proceedings are the result of phase one.

Audit and Evaluation of Computer Security


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Audit and Accountability?

[Assistant]
According to Guidelines for Media Sanitization:

..................................13  |
| 3.2.4. Quality of Cryptographic Implementations................................................................................15                   |
| 3.2.5.
Traceability of CE Operations.....................................................................................................16         |
| Media Sanitization Program .........................................................................................................18              |
| 4. |
| 4.3.1. Information Decisions in the System Life Cycle..........................................................................20                   |
| 4.3.2. Determination of Security Categorization..................................................................................21                 |
| 4.3.3. Reuse of Media...........................................................................................................................22  |
| 4.3.4. Control of Media ........................................................................................................................22  |
| 4.3.5. Data Protection Level .................................................................................................................23    |
| 4.3.6. Sanitization and Disposal Decision.............................................................................................23            |


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Supply Chain Risk Management?

[Assistant]
According to Risk Management Framework for Information Systems and Organizations_ A System Life Cycle Approach for Security and Privacy:

curity officer; senior agency official for privacy; supply chain risk management; system development life cycle; system owner; system privacy officer; system security officer; system-specific control.
As we push computers to 'the edge,' building a complex world of interconnected information systems and devices, security and privacy risks (including supply chain risks) continue to be a large part of the national conversation and topics of great importance. The significant increase in the complexity of the hardware, software, firmware, and systems within the public and private sectors (including the U.S. critical infrastructure) represents a significant increase in attack surface that can be exploited by adversaries. Moreover, adversaries are using the supply chain as an attack vector and effective means of penetrating our systems, compromising the integrity of system elements, and gaining access to critical assets.

Risk Management Framework for Information Systems and Organizations_ A System Life Cycle Approach for Security and Privacy


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Recommendation for Pair-Wise Key-Establishment Using Integer Factorization Cryptography provide? (Part 7)

[Assistant]
| 3. Definitions, Symbols and Abbreviations...............................................................................
2                                                                                |
| 3.1 Definitions........................................................................................................................... 2                                                                                | 3.1 Definitions........................................................................................................................... 2                                                                                | 3.1 Definitions........................................................................................................................... 2                                                                                |
| 3.2 Symbols and Abbreviations................................................................................................

Recommendation for Pair-Wise Key-Establishment Using Integer Factorization Cryptography


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Awareness and Training?

[Assistant]
According to Incident Response Recommendations and Considerations for Cybersecurity Risk Management_ A CSF 2.0 Community Profile:

Many organizations may use more than one of these approaches, such as internally performing basic incident response and engaging third-party resources for assistance with certain incidents. Larger organizations may have multiple incident response teams, with each team responsible for a particular logical or physical segment of the organization. When this model is employed, the teams should be part of a single coordinated entity (e.g., a federation) to ensure that incident response processes, procedures, and training are consistent across the organization and that information is shared among teams. The Community Profile is intended for use by most organizations, regardless of sector, size, or other factors. Additional versions of this Community Profile could be developed for narrower audiences, such as federal agencies, small businesses, or educational institutions. For more information on CSF 2.0 Community Profiles, see the Framework Resource Center.

Incident Response Recommendations and Considerations for Cybersecurity Risk Management_ A CSF 2.0 Community Profile


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice IA.L2-3.5.1 (NIST 3.5.1)?

[Assistant]
According to Protecting Information and System Integrity in Industrial Control System Environments_ Cybersecurity for the Manufacturing Sector:

3.5.1. 3.5.1. 3.5.1.

Protecting Information and System Integrity in Industrial Control System Environments_ Cybersecurity for the Manufacturing Sector


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What are the CMMC Level 3 requirements?

[Assistant]
According to Protecting Controlled Unclassified Information (CUI)_ NIST Special Publication 800-171, Revision 3. Small Business Primer:

<!-- image -->

<!-- image -->

Howard Lutnick, Secretary of Commerce

<!-- image -->

Protecting Controlled Unclassified Information (CUI): NIST Special Publication 800-171, Revision 3 Small Business Primer

## Purpose of this Primer

This guide provides small businesses with an overview of NIST Special Publication (SP) 800-171 Revision 3, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations . The following pages contain:

- An overview of foundational components of SP 800-171
- A list of frequently asked questions and their answers
- Tips for getting started
- Related resources

## What is Controlled Unclassified Information (CUI)?*

CUI is information the government creates or possesses, or that an entity creates or possesses on behalf of the government, that law, regulation, or governmentwide policy requires you to take technical and operational steps to protect. Systems that process, store, and transmit CUI often support government programs involving sensitive critical assets. As part of a contractual agreement with the federal government, or possibly with other organizations like municipal governments, prime contractors, universities, etc., you will likely be required to demonstrate you are taking adequate measures to protect CUI.

Protecting Controlled Unclassified Information (CUI)_ NIST Special Publication 800-171, Revision 3. Small Business Primer


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Incident Response?

[Assistant]
According to Approaches and Challenges of Federal Cybersecurity Awareness Programs:

Participants indicated topics that their security awareness programs addressed via training courses, events, or other communications in the past 1 - 2 years. Figure 9 shows the security awareness topics and percentages of programs addressing those topics. All participants' programs covered the topic of social engineering, and over 90% addressed passwords and authentication, malware, and privacy topics. Security considerations when installing or updating software was the least covered topic but still addressed by 64% of programs. Participants were asked what other teams/groups within their organization they collaborate with or consult in their security awareness mission (Figure 18). Over 70% collaborated with the incident response team (77%), the privacy team (73%), and the IT team (71%). Much fewer work with the General Counsel (39%) and Human Resources (HR) (38%). - 'I do consult with members of the SOC [Security Operations Center] to see if there's anything glaring that I need to include in my training each year.' (N09)
- 'Also working with the help desk, just what type of problems our users encounter that are related to security issues.' (S05)
- 'Being tied directly to the cybersecurity policy team has made it easier because the awareness team always has whatever the latest guidance is and can push that out very quickly.' (D03)
- 'We've worked closely with the information security officials' (N08)
- 'I'm located in the chief information security office, and there are…divisions in that office that provide a wide range of cybersecurity services to the Department. And those managers have responsibilities for things such as identity management, internet response, data loss prevention. So, within any year, I reach out to those stakeholders to ask, 'What's important for the user to understand about cybersecurity awareness? What do you want to talk to the customer about?


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Information Integrity?

[Assistant]
According to Secure Software Development Practices for Generative AI and Dual-Use Foundation Models_ An SSDF Community Profile:

The SSDF provides a common language for describing secure software development practices throughout the software development life cycle. This document augments the practices and tasks defined in SSDF version 1.1 by adding recommendations, considerations, notes, and informative references that are specific to generative AI and dual-use foundation model development. These additions are documented in the form of an SSDF Community Profile ('Profile'), which is a baseline of SSDF practices and tasks that have been enhanced to address a particular use case. An example of an addition is, 'Secure code storage should include AI models, model weights, pipelines, reward models, and any other AI model elements that need their confidentiality, integrity, and/or availability protected.'

All practices and tasks are unchanged from SSDF version 1.1 unless they are explicitly tagged as 'Modified from SSDF 1.1' or 'Not part of SSDF 1.1.' An example is the PW.3 practice, ' Confirm the Integrity of Training, Testing, Fine-Tuning, and Aligning Data Before Use' and all of its tasks.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Guidelines for Media Sanitization provide? (Part 8)

[Assistant]
..............................................27                  |                                                                                |
| 4.7.7.
Property Management Officer ...................................................................................................28                 |                                                                                |
| 4.7.8. Records Management Officer ....................................................................................................28                 |                                                                                |
| 4.7.9. Privacy Officer ............................................................................................................................28    |                                                                                |
| 4.7.10. Users.........................................................................................................................................28 |                                                                                |
| References.......................................................................................................................................29      |                                                                                |
| Appendix A. Glossary                                                                                | .......................................................................................................................32 |
| Appendix B.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Configuration Management?

[Assistant]
According to Addressing Visibility Challenges with TLS 1.3 within the Enterprise_ High-Level Document:

| F.1        | Traffic Visibility to Support Troubleshooting ............................................................. | Traffic Visibility to Support Troubleshooting ............................................................. | 51    |
|------------|---------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-------|
| F.2        | Traffic Visibility to Support Performance Monitoring ................................................ | Traffic Visibility to Support Performance Monitoring ................................................ | 51    |
| F.3        | Traffic Visibility to Support Cybersecurity Threat Triage and Forensics ..................... | Traffic Visibility to Support Cybersecurity Threat Triage and Forensics ..................... | 51    |
| F.4        | Traffic Visibility to Support Monitoring for Compliance and Hygiene ........................ | Traffic Visibility to Support Monitoring for Compliance and Hygiene ........................ | 51    |
| F.5        | Functional Demonstration Scripts and Results .......................................................... | Functional Demonstration Scripts and Results .......................................................... | 51    |
|            | F.5.1                                                                                | Scenario 1.1 - Identify Failed Network Traffic Due to Expired TLS PKI Certificates (Layer 4) ......................................................................................................................

Addressing Visibility Challenges with TLS 1.3 within the Enterprise_ High-Level Document


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Access Control?

[Assistant]
According to Audit and Evaluation of Computer Security II_ System Vulnerabilities and Controls:

| 3-8       |
| Fig. | 1              | Responsibilities and Duties to Provide Security for Data Processing System ..
| 3-5       |
| PART |                | SESSION 2 ~ MANAGERIAL AND ORGANIZATIONAL VULNERABILITIES AND CONTROLS ~ LINE LEVEL - DATA PROCESSING |           |
|      | IV:            |                                                                                | 4-1       |
|      |                |                                                                                | 4-2       |
| 1. | EDITOR'S       | NOTE INTRODUCTION 4-3                                                                                | 4-3 4-3   |
|      | 1.1 1.2 1.3    | The Charge Intent of Paper                                                                            | 4-3 4-3   |
| 2. | 1.4            | Elements of Discussion Comments                                                                       | 4-4       |
|      | DATA           | PROCESSING ".

Audit and Evaluation of Computer Security II_ System Vulnerabilities and Controls


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Media Protection?

[Assistant]
According to Summary of NIST SP 800-53, Revision 4_ Security and Privacy Controls for Federal Information Systems and Organizations:

The NIST Risk Management Framework (RMF), described in NIST Special Publication 800-37 Revision 1, Guide for Applying the Risk Management Framework to Federal Information Systems: a Security Life Cycle Approach, is a methodology for implementing risk management at the information systems tier. The RMF (depicted in Figure 2) identifies six distinct steps that provide a disciplined and structured process to integrate information security risk management activities into the system development life cycle. The RMF addresses security concerns of organizations related to the design, development, implementation, operation, and disposal of information systems and the environments in which those systems operate.

Summary of NIST SP 800-53, Revision 4_ Security and Privacy Controls for Federal Information Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Risk Assessment?

[Assistant]
According to Summary of NIST SP 800-53, Revision 4_ Security and Privacy Controls for Federal Information Systems and Organizations:

ne or more information systems. If an information system inherits a common control, such as environmental controls within a data center, that system does not need to explicitly implement that control.
- Applying scoping considerations - these, when applied in conjunction with risk management guidance, can eliminate unnecessary security controls from the initial security control baselines and help ensure that organizations select only those controls needed to provide the appropriate level of protection for information systems. When scoping considerations are applied, compensating controls may need to be selected to provide alternative means to achieve security requirements. - Supplementing baselines - additional security controls and control enhancements are selected if needed to address specific threats and vulnerabilities.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Zero Trust Architecture provide? (Part 3)

[Assistant]
ores disponibles para el propósito. En esta publicación puede haber referencias a otras que actualmente están siendo desarrolladas por NIST de acuerdo con sus responsabilidades estatutarias asignadas.
La información contenida en esta publicación, incluidos conceptos y  metodologías,  puede  ser  utilizada  por  los  organismos  federales  incluso  antes  de  la  finalización  de  dichas publicaciones  complementarias. Por  lo  tanto,  hasta  que  se  finalice  cada  publicación,  los  requisitos,  directrices  y procedimientos  actuales,  cuando  existan,  seguirán  siendo  operativos. A  efectos  de  planificación  y  transición,  los organismos federales pueden seguir de cerca el desarrollo de estas nuevas publicaciones del NIST. Se anima a las organizaciones a revisar todos los borradores de publicaciones durante los periodos de comentarios públicos y proporcionar retroalimentación al NIST. Muchas publicaciones sobre ciberseguridad del NIST, aparte de las mencionadas anteriormente, están disponibles en https://csrc.nist.gov/publications. ## Los comentarios sobre esta publicación pueden enviarse a

Instituto Nacional de Estándares y Tecnología A la atención de: Advanced Network Technologies Division, Information Technology Laboratory

100 Bureau Drive (Mail Stop 8920) Gaithersburg, MD 20899-8920

Correo electrónico: zerotrust-arch@nist.gov

Todos los comentarios están sujetos a la Ley de Libertad de Información (FOIA). ## Informes sobre tecnología de sistemas informáticos

El  Laboratorio  de  Tecnología  de  la  Información  (ITL,  por  su  nombre  en  inglés,  Information Technology Laboratory) del Instituto Nacional de Estándares y Tecnología (NIST) promueve la economía  y  el  bienestar  público  de  Estados  Unidos  a  través  de  su  liderazgo  técnico  en  la infraestructura  de  medición  y  normalización  del  país.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Identification and Authentication?

[Assistant]
According to Recommendations for Federal Vulnerability Disclosure Guidelines:

|
| Federal Vulnerability Disclosure Coordination Body ....................................................
| 6                                                                                |                                                                                |
| Preparation................................................................................................................. | 7                                                                                |                                                                                |
| 2.1.1. Create Source Vulnerability                                                                                | Report Receipt Capability............................................. 7                                                             |                                                                                |
| 2.1.2. Determine Scope and Obtain Contacts .................................................................... | 8                                                                                |                                                                                |
| 2.1.3. Develop Technical Analysis Capability .....................................................................

Recommendations for Federal Vulnerability Disclosure Guidelines


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Access Control?

[Assistant]
According to Access Control on NoSQL Databases:

## Access Control on NoSQL Databases

## Access Control on NoSQL Databases

Hu VC (2024) Access Control on NoSQL Databases. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Interagency or Internal Report (IR) NIST IR 8504. https://doi.org/10.6028/NIST.IR.8504


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Guide to Auditing for Controls and Security_ A System Development Life Cycle Approach provide? (Part 2)

[Assistant]
cies; conducts physical and chemical research; develops, produces, and distributes Standard Reference Materials; provides calibration services; and manages the National Standard Reference Data System.
The Laboratory consists of the following centers:

## The National Engineering Laboratory

Provides technology and technical services to the public and private sectors to address national needs and to solve national problems; conducts research in engineering and applied science in support of these efforts; builds and maintains competence in the necessary disciplines required to carry out this research and technical service; develops engineering data and measurement capabilities; provides engineering measurement traceability services; develops test methods and proposes engineering standards and code changes; develops and proposes new engineering practices; and develops and improves mechanisms to transfer results of its research to the ultimate user. The Laboratory consists of the following centers:

## The Institute for Computer Sciences and Technology

Conducts research and provides scientific and technical services to aid Federal agencies in the selection, acquisition, application, and use of computer technology to improve effectiveness and economy in Government operations in accordance with Public Law 89-306 (40 U.S.C. 759), relevant Executive Orders, and other directives; carries out this mission by managing the Federal Information Processing Standards Program, developing Federal ADP standards guidelines, cind managing Federal participation in ADP voluntary standardization activities; provides scientific and technological advisory services and assistance to Federal agencies; and provides the technical foundation for computer-related policies of the Federal Government.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Digital Identity Guidelines provide? (Part 6)

[Assistant]
. . . . . . . . . . . . . . . . . . . . . . 2. Digital Identity Model

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2.1. Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . 2.2. Identity Proofing and Enrollment

. . . . . . . . . . . . . . . . . . . . . 2.2.1. Subscriber Accounts . . . . . . . . . . . . . . . . . . . . . . . . 2.3. Authentication and Authenticator Management

. . . . . . . . . . . . . 2.3.1. Authenticators . . . . . . . . . . . . . . . . . . . . . . . . . . . 2.3.2. Authentication Process

. . . . . . . . . . . . . . . . . . . . . . 2.4. 2.5. Federation and Assertions . . . . . . . . . . . . . . . . . . . . . . . . . Examples of Digital Identity Models . . . . . . . . . . . . . . . . . . . . 2.5.1. Non-Federated Digital Identity Model . . . . . . . . . . . . . . . 2.5.2. Federated Digital Identity Model With General-Purpose IdP . . . 1

2

3

4

4

5

6

8

8

9

9

10

10

10

11

12

13

15

15

17

2.5.3. Federated Digital Identity Model with Subscriber-Controlled Wallet 18

3. Digital Identity Risk Management

. . . . . . . . . . . . . . . . . . . . . . . . 3.1. Define the Online Service . . . . . . . . . . . . . . . . . . . . . . . . . 3.2. Conduct Initial Impact Assessment

. . . . . . . . . . . . . . . . . . . . 3.2.1. Identify Impact Categories and Potential Harms

. . . . . . . . . 3.2.2. Identify Potential Impact Levels . . . . . . . . . . . . . . . . . . 3.2.3. Impact Analysis

. . . . . . . . . . . . . . . . . . . . . . . . . . 3.2.4. Determine the Combined Impact Level for Each User Group . . . 3.3. Select Initial Assurance Levels and Baseline Controls . . . . . . . . . . . 21

24

27

27

29

31

32

33

iii

NIST SP 800-63-4
July 2025

Digital Identity Guidelines

3.3.1. Assurance Levels . . . . . . . . . . . . . . . . . . . . . . . . . . 3.3.2. Assurance Level Descriptions

. . . . . . . . . . . . . . . . . . . 3.3.3. Initial Assurance Level Selection . . . . . . . . . . . . . . . . . . 3.3.4.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Secure Software Development Practices for Generative AI and Dual-Use Foundation Models_ An SSDF Community Profile provide? (Part 8)

[Assistant]
I and for dual-use foundation models.' This document is that companion resource. The software development and use of AI models and AI systems inherit much of the same risk as any other digital system.
A unique challenge for this community is the blurring of traditional boundaries between system code and system data, as well as the use of plain human language as the means of interaction with the systems. AI models and systems, their configuration parameters (e.g., model weights), and the data they interact with (e.g., training data, user queries, etc.) can form closed loops that can be manipulated for unintended functionality. AI model and system development is still much more of an art than an exact science, requiring developers to interact with model code, training data, and other parameters over multiple iterations. Training datasets may be acquired from unknown, untrusted sources. Model weights and other training parameters can be susceptible to malicious tampering. Some models may be complex to the point that they cannot easily be thoroughly inspected, potentially allowing for undetectable execution of arbitrary code. User queries can be crafted to produce undesirable or objectionable output and - if not sanitized properly - can be leveraged for injection-style attacks. The goal of this document is to identify the practices and tasks needed to address these novel risks. ## Purpose

The SSDF provides a common language for describing secure software development practices throughout the software development life cycle. This document augments the practices and tasks defined in SSDF version 1.1 by adding recommendations, considerations, notes, and informative references that are specific to generative AI and dual-use foundation model development. These additions are documented in the form of an SSDF Community Profile ('Profile'), which is a baseline of SSDF practices and tasks that have been enhanced to address a particular use case.

Secure Software Development Practices for Generative AI and Dual-Use Foundation Models_ An SSDF Community Profile


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does IoT Device Cybersecurity Capability Core Baseline provide? (Part 7)

[Assistant]
ation's role, this baseline is intended to give all organizations a starting point for IoT device cybersecurity risk management, but the implementation of all capabilities is not considered mandatory.
The individual capabilities in the baseline may be implemented in

1 The usage of the term 'baseline' in this publication should not be confused with the low-, moderate-, and high-impact system control baselines set forth in NIST Special Publication (SP) 800-53 [1] to help federal agencies meet their obligations under the Federal Information Security Modernization Act (FISMA) and other federal policies. In that context, the low-, moderate-, and high-impact control baselines apply to an information system, which may include multiple components, including devices. In this publication, 'baseline' is used in the generic sense to refer to a set of foundational requirements or recommendations, and the core baseline described is meant to apply to individual IoT devices. full, in part, or not at all. It is left to the implementing organization to understand the unique risk context in which it operates and what is appropriate for its given circumstance. For more information on how to conduct a risk assessment, see NIST Special Publication 800-30, Guide for Conducting Risk Assessments [3]. Furthermore, this baseline is not the only set of capabilities that exist. This baseline represents a coordinated effort to produce a definition of common capabilities, not an exhaustive list. Therefore, an implementing organization may define capabilities that better suit their organization. Using these additional capabilities to support IoT device cybersecurity risk management is encouraged. For more information on IoT device security and privacy considerations, see NISTIR 8228, Considerations for Managing Internet of Things (IoT) Cybersecurity and Privacy Risks [4].

IoT Device Cybersecurity Capability Core Baseline


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does High-Performance Computing Security_ Architecture, Threat Analysis, and Security Posture provide? (Part 9)

[Assistant]
ve significant differences. An HPC system is designed to maximize performance, so its architecture, hardware components, software stacks, and working environment are very different from enterprise IT.
Additionally, most HPC systems serve multiple projects and user communities, leading to more complex security concerns than those encountered in enterprise systems. As such, security solutions must be tailored to the HPC system's requirements. Furthermore, HPC systems are often different from one another due to the evolution of their system designs, the applications they run, and the missions they support. An HPC system frequently has its own unique method of applying security requirements and may follow different security guidance, which can impede the sharing of security solutions and knowledge. This NIST Special Publication aims to standardize and facilitate the sharing of HPC security information and knowledge through the development of an HPC system reference architecture and key components, which are introduced as the basics of the HPC system lexicon. The reference architecture divides an HPC system into four function zones. A zone-based HPC reference architecture captures the most common features across the majority of HPC systems and segues into HPC system threat analysis. Key HPC security characteristics and use requirements are laid out alongside the major threats faced by the system and individual function zones. HPC security postures, challenges, recommendations, and some currently recognized variants are also included. This publication is intended to be a conceptual guide, not a checklist of requirements. Finally, emerging technologies - such as novel networking technology, data storage solutions, hardware acceleration technology, and others - have the potential to influence the HPC reference architecture and security posture. Consequently, this document will be updated as needed. ## 2.

High-Performance Computing Security_ Architecture, Threat Analysis, and Security Posture


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Planning?

[Assistant]
According to Guide to a Secure Enterprise Network Landscape:

There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may be used by federal agencies even before the completion of such companion publications. Thus, until each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning and transition purposes, federal agencies may wish to closely follow the development of these new publications by NIST.

Guide to a Secure Enterprise Network Landscape


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Incident Response?

[Assistant]
According to Guidelines on Mobile Device Forensics:

## Guidelines on Mobile Device Forensics

## Guidelines on Mobile Device Forensics

Mobile device forensics is the science of recovering digital evidence from a mobile device under forensically sound conditions using accepted methods. Mobile device forensics is an evolving specialty in the field of digital forensics. This guide attempts to bridge the gap by providing an indepth look into mobile devices and explaining technologies involved and their relationship to forensic procedures. This document covers mobile devices with features beyond simple voice communication and text messaging capabilities. This guide also discusses procedures for the validation, preservation, acquisition, examination, analysis, and reporting of digital information.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Identification and Authentication?

[Assistant]
According to Audit and Evaluation of Computer Security:

Introduction
Setting PA Objectives .
Gathering Information
Performing PA Analyses and Evaluations
Designing and Performing PA Test Procedures „
3.5.1
3.5o2

3.5.3
3.5.4

guarantee that only authorized recipients may be
sent personal information via automated installa-
tions (authentication)


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Awareness and Training?

[Assistant]
According to Security and Privacy Controls for Information Systems and Organizations:

CHAPTER ONE   INTRODUCTION ...................................................................................................... 1
1.1   PURPOSE AND APPLICABILITY ................................................................................................... 2
1.2   TARGET AUDIENCE .................................................................................................................. 3
1.3   ORGANIZATIONAL RESPONSIBILITIES......................................................................................... 3
1.4   RELATIONSHIP TO OTHER PUBLICATIONS ................................................................................... 5
1.5   REVISIONS AND EXTENSIONS .................................................................................................... 5
1.6   PUBLICATION ORGANIZATION .................................................................................................. 5
CHAPTER TWO   THE FUNDAMENTALS ............................................................................................ 7
2.1   REQUIREMENTS AND CONTROLS .............................................................................................. 7
2.2   CONTROL STRUCTURE AND ORGANIZATION .............................................................................. 8
2.3   CONTROL IMPLEMENTATION APPROACHES ............................................................................. 11
2.4   SECURITY AND PRIVACY CONTROLS ......................................................................................... 13
2.5   TRUSTWORTHINESS AND ASSURANCE ..................................................................................... 14
CHAPTER THREE   THE CONTROLS ................................................................................................. 16
3.1   ACCESS CONTROL ..................................................................................................................

Security and Privacy Controls for Information Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AC.L2-3.1.1 (NIST 3.1.1)?

[Assistant]
According to Multi-Factor Authentication for Criminal Justice Information Systems_ Implementation Considerations for Protecting Criminal Justice Information:

3.1.1. 3.1.1. 3.1.1)
- Agencies will benefit if their MFA solutions support multiple authenticator types and methods.

Multi-Factor Authentication for Criminal Justice Information Systems_ Implementation Considerations for Protecting Criminal Justice Information


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Planning?

[Assistant]
According to Guide to Malware Incident Prevention and Handling for Desktops and Laptops:

tion's IT hosts and information. Accordingly, awareness programs should include guidance to users on malware incident prevention, which can help reduce the frequency and severity of malware incidents.
All users should be made aware of the ways in which malware enters and infects hosts; the risks that malware poses; the inability of technical controls to prevent all incidents; and the importance of users in preventing incidents, with an emphasis on avoiding social engineering attacks (as discussed below). In addition, the organization's awareness program should cover the malware incident prevention considerations in the organization's policies and procedures, as described in Section 3.1, as well as generally recommended practices for avoiding malware incidents. Examples of such practices are as follows:

Guide to Malware Incident Prevention and Handling for Desktops and Laptops


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Configuration Management?

[Assistant]
According to Addressing Visibility Challenges with TLS 1.3 within the Enterprise_ High-Level Document:

1 - Identify Failed Network Traffic Due to Expired TLS PKI Certificates (Layer 4) ......................................................................................................................
| 51    |
|            | F.5.2                                                                                | Scenario 1.2 - Identify and Log Protocol- Specific Distinct Characteristics of Layer 5, and 7-type Service Utilization and Consumption Information ................................... | 6, 51 |
|            | F.5.3                                                                                | Scenario 1.3 - Identify, Collect, and Report on Protocol -Specific Error Status Codes for Services (Layer 5, 6, and 7 -type status codes) ...................................................... | 51    |
|            | F.5.4                                                                                | Scenario 2.1 - Identify, Collect, and Report on Protocol -Specific Error Status Codes for Services.................................................................................................................. | 52    |
|            | F.5.5                                                                                | Scenario 2.2 - Identify the Propagation of Performance Issues Throughout a System by Correlating Error Status Codes Across Component Services ................................. | 52    |
|            | F.5.6                                                                                | Scenario 2.3 - Develop Baselines for Traffic Performance Characteristics for Each Server ..........................................................................................................................


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What guidance does NIST provide for CMMC Level 2?

[Assistant]
According to Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations:

aft publications during public comment periods and provide feedback to NIST. Many NIST cybersecurity publications, other than the ones noted above, are available at https://csrc.nist.gov/publications.
## Authority

This publication has been developed by NIST in accordance with its statutory responsibilities under the Federal Information Security Modernization Act (FISMA) of 2014, 44 U.S.C. § 3551 et seq., Public Law (P.L.) 113-283. NIST is responsible for developing information security standards and guidelines, including minimum requirements for federal information systems, but such standards and guidelines shall not apply to national security systems without the express approval of appropriate federal officials exercising policy authority over such systems. This guideline is consistent with the requirements of the Office of Management and Budget (OMB) Circular A-130. Nothing in this publication should be taken to contradict the standards and guidelines made mandatory and binding on federal agencies by the Secretary of Commerce under statutory authority. Nor should these guidelines be interpreted as altering or superseding the existing authorities of the Secretary of Commerce, Director of the OMB, or any other federal official. This publication may be used by nongovernmental organizations on a voluntary basis and is not subject to copyright in the United States. Attribution would, however, be appreciated by NIST. ## NIST Technical Series Policies

Copyright, Use, and Licensing Statements NIST Technical Series Publication Identifier Syntax

## Publication History

Approved by the NIST Editorial Review Board on 2024-04-23 Supersedes NIST Special Publication 800-171r2 (February 2020; Includes updates as of 01-28-2021) https://doi.org/10.6028/NIST.SP.800-171r2

## How to Cite this NIST Technical Series Publication:

Ross R, Pillitteri V (2024) Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations.

Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Risk Assessment?

[Assistant]
According to Guide to Malware Incident Prevention and Handling for Desktops and Laptops:

Malware, also known as malicious code, refers to a program that is covertly inserted into another program with the intent to destroy data, run destructive or intrusive programs, or otherwise compromise the confidentiality, integrity, or availability of the victim's data, applications, or operating system. Malware is the most common external threat to most hosts, causing widespread damage and disruption and necessitating extensive recovery efforts within most organizations. This publication provides recommendations for improving an organization's malware incident prevention measures. It also gives extensive recommendations for enhancing an organization's existing incident response capability so that it is better prepared to handle malware incidents, particularly widespread ones.