[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Personnel Security?

[Assistant]
According to Control Baselines for Information Systems and Organizations:

| ORGANIZATIONAL RESPONSIBILITIES .........................................................................................
| 2                                                                                |
| 1.4                                                                                | RELATIONSHIPTOOTHERPUBLICATIONS ................................................................................... | 3                                                                                |
| 1.5                                                                                | REVISIONSANDEXTENSIONS .................................................................................................... | 3                                                                                |
| 1.6                                                                                | PUBLICATIONORGANIZATION .................................................................................................. | 3                                                                                |
| CHAPTERTWO THE FUNDAMENTALS............................................................................................ 5                     | CHAPTERTWO THE FUNDAMENTALS............................................................................................ 5                     | CHAPTERTWO THE FUNDAMENTALS............................................................................................

Control Baselines for Information Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Awareness and Training?

[Assistant]
According to Guide for Developing Security Plans for Federal Information Systems:

here those common security controls are applied. Security controls not designated as common controls are considered system-specific controls and are the responsibility of the information system owner.
System security plans should clearly identify which security controls have been designated as common security controls and which controls have been designated as system-specific controls.

Guide for Developing Security Plans for Federal Information Systems


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 2 require for Personnel Security?

[Assistant]
According to Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations:

| Table 1. Security Requirement Families .......................................................................................................4          |
|----------------------------------------------------------------------------------------------------------------------------------------------------------|
| Table 2. Security Control Tailoring Criteria.................................................................................................93          |
| Table 3. Access Control (AC) .......................................................................................................................93   |
| Table 4. Awareness and Training (AT).........................................................................................................94          |
| Table 5. Audit and Accountability (AU).......................................................................................................95          |
| Table 6. Assessment, Authorization, and Monitoring (CA).........................................................................95                       |
| Table 7. Configuration Management (CM).................................................................................................96                |
| Table 8. Contingency Planning (CP) ............................................................................................................96        |
| Table 9. Identification and Authentication (IA) ..........................................................................................97             |
| Table 10. Incident Response (IR).................................................................................................................98      |
| Table 11. Maintenance (MA) ......................................................................................................................98      |
| Table 12.

Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Communications Protection?

[Assistant]
According to Assessing Security and Privacy Controls in Information Systems and Organizations:

CHAPTER ONE INTRODUCTION ............................................................................................................... 1
1.1   PURPOSE AND APPLICABILITY .......................................................................................................... 1
1.2   TARGET AUDIENCE ............................................................................................................................ 4
1.3   RELATED PUBLICATIONS AND ASSESSMENT PROCESSES ............................................................... 4
1.4   ORGANIZATION OF THIS PUBLICATION ........................................................................................... 5
CHAPTER TWO THE FUNDAMENTALS ..................................................................................................... 6
2.1   ASSESSMENTS WITHIN THE SYSTEM DEVELOPMENT LIFE CYCLE .................................................. 6
2.2   CONTROL STRUCTURE AND ORGANIZATION .................................................................................. 7
2.3   BUILDING AN EFFECTIVE ASSURANCE CASE .................................................................................... 8
2.4   ASSESSMENT PROCEDURES: ASSESSMENT OBJECTS, METHODS AND OBJECTIVES ................... 11
CHAPTER THREE THE PROCESS ............................................................................................................. 19
3.1   PREPARE FOR SECURITY AND PRIVACY CONTROL ASSESSMENTS ............................................... 19
3.2   DEVELOP SECURITY AND PRIVACY ASSESSMENT PLANS .............................................................. 23
3.3   CONDUCT SECURITY AND PRIVACY CONTROL ASSESSMENTS ..................................................... 30
3.4   ANALYZE ASSESSMENT REPORT RESULTS .....................................................................................

Assessing Security and Privacy Controls in Information Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations provide? (Part 9)

[Assistant]
...............................................................79                       |                                                                                |
| A.2.6.
FAMILY: ASSESSMENT, AUTHORIZATION, AND MONITORING..................................................84                                          |                                                                                |
| A.2.7. FAMILY: CONFIGURATION MANAGEMENT................................................................................87                             |                                                                                |
| A.2.8. FAMILY: CONTINGENCY PLANNING ...........................................................................................98                     |                                                                                |
| A.2.9. FAMILY: IDENTIFICATION AND AUTHENTICATION...................................................................102                                |                                                                                |
| A.2.10. FAMILY: INCIDENT RESPONSE................................................................................................105                  |                                                                                |
| A.2.11. FAMILY: MAINTENANCE.........................................................................................................110               |                                                                                |
| A.2.12. FAMILY: MEDIA PROTECTION ................................................................................................115                  |                                                                                |
| A.2.13.

Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations

Audit and Accountability
System and Information Integrity
Security Assessment
Media Protection
Identification and Authentication
Awareness and Training
System and Communications Protection
Access Control
Planning
Incident Response
Risk Assessment
Personnel Security
System and Services Acquisition
Supply Chain Risk Management
Maintenance
Physical Protection
Configuration Management


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Incident Response?

[Assistant]
According to Guide for Developing Security Plans for Federal Information Systems:

as a master template for a generalized contingency plan for all agency information systems with individual information system owners tailoring the plan, where appropriate, for system-specific issues.
| CLASS       | FAMILY                                                 | IDENTIFIER   |
|-------------|--------------------------------------------------------|--------------|
| Management  | Risk Assessment                                        | RA           |
| Management  | Planning                                               | PL           |
| Management  | System and Services Acquisition                        | SA           |
| Management  | Certification, Accreditation, and Security Assessments | CA           |
| Operational | Personnel Security                                     | PS           |
| Operational | Physical and Environmental Protection                  | PE           |
| Operational | Contingency Planning                                   | CP           |
| Operational | Configuration Management                               | CM           |
| Operational | Maintenance                                            | MA           |
| Operational | System and Information Integrity                       | SI           |
| Operational | Media Protection                                       | MP           |
| Operational | Incident Response                                      | IR           |
| Operational | Awareness and Training                                 | AT           |
| Technical   | Identification and Authentication                      | IA           |
| Technical   | Access Control                                         | AC           |
| Technical   | Audit and Accountability                               | AU           |
| Technical   | System and Communications Protection                   | SC           |


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for Configuration Management?

[Assistant]
According to Assessing Enhanced Security Requirements for Controlled Unclassified Information:

| CHAPTERONE INTRODUCTION...................................................................................................... | CHAPTERONE INTRODUCTION...................................................................................................... | 1   |
|-----------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------|-----|
| 1.1                                                                                | PURPOSEANDAPPLICABILITY............................................................................................................. 1        | 2   |
| 1.2                                                                                | TARGET AUDIENCE.............................................................................................................................. |     |
| 1.3                                                                                | ORGANIZATIONOF THIS SPECIAL PUBLICATION................................................................................. | 2   |
| CHAPTERTWO THE FUNDAMENTALS............................................................................................ | CHAPTERTWO THE FUNDAMENTALS............................................................................................ | 3   |
| 2.1                                                                                | ASSESSMENT PROCEDURES................................................................................................................

Assessing Enhanced Security Requirements for Controlled Unclassified Information


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Media Protection?

[Assistant]
According to Digital Identity Guidelines_ Identity Proofing and Enrollment:

3.8.

4.3.8. On-Site Attended Requirements — Kiosk-Based . . . . . . . . .

a piece of identity evidence through the return of a confirmation code, consistent
with the requirements specified in Sec. 3.8.

Digital Identity Guidelines_ Identity Proofing and Enrollment


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AU.L2-3.3.2 (NIST 3.3.2)?

[Assistant]
According to Recommendations for Federal Vulnerability Disclosure Guidelines:

3.3.2. 3.3.2. 3.3.2.

Recommendations for Federal Vulnerability Disclosure Guidelines


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for Supply Chain Risk Management?

[Assistant]
According to Protecting Controlled Unclassified Information (CUI)_ NIST Special Publication 800-171, Revision 3. Small Business Primer:

deral agency to ensure that requirements to protect CUI are identified in applicable contracts or agreements, and CUI is marked by the federal agency. |
| How do I get a 'NIST SP 800 -171 Assessment'?
| The term 'NIST Assessment' and 'NIST SP 800 - 171 Assessment' is frequently used to describe the Department of Defense (DOD) proce ss used to complete its NIST SP 800-171 Assessment Module through the Supplier Performance Risk System (SPRS). NIST develops the underlying technical guidelines (SP 800-171, SP 800-171A, SP 800-172, and SP 800- 172A) on which the 'NIST Assessment' is based, but NIST does not have a role in DOD's implementation of its programs . For additional guidance on NIST's methodology to plan, prepare for, and conduct security requirement assessments, refer to SP 800-171A. |
| What products, vendors, or solutions are 'NIST SP 800 -171 compliant' or 'CMMC - certified'? | NIST does not identify or track implementation of or compliance with the security requirements. |
| What is the relationship between NIST and CMMC? | The Cybersecurity Maturity Model Certification (CMMC) is a DOD program that references the security requirements in NIST SP 800-171 and SP 800-172. NIST is not involved in the design, development, or implementation of the CMMCmodel, accreditation body, or certification process. It is important to note that CMMCis currently based on SP 800-171, Revision 2. Contractors should check for specific requirements in their contracts to understand which version they are required to use. |

Protecting Controlled Unclassified Information (CUI)_ NIST Special Publication 800-171, Revision 3. Small Business Primer


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AU.L2-3.3.8 (NIST 3.3.8)?

[Assistant]
According to Audit and Evaluation of Computer Security:

3.3.8 Program Controls

Access controls must also be in place to protect
programs, JCL and related documentation from unauthorized
A program may be proprietary for its intrinsic
access.

Audit and Evaluation of Computer Security


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Risk Assessment?

[Assistant]
According to Digital Identity Guidelines_ Identity Proofing and Enrollment:

3.3.1. Privacy Risk Assessment . . . . . . . . . . . . . . . . . . . . . .

3.11. Requirements for the Use of Biometrics . . . . . . . . . . . . . . . . . .

6. Threats and Security Considerations . . . . . . . . . . . . . . . . . . . . . . .


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Access Control?

[Assistant]
According to Protecting Information and System Integrity in Industrial Control System Environments_ Cybersecurity for the Manufacturing Sector:

| Collaborator   | Component                                                                                |
|----------------|----------------------------------------------------------------------------------------------------------------------------------------|
|                | Provides secure remote access with authentication and authorization support. |
|                | Provides network and asset monitoring to detect behavior anomalies and modifications to hardware, firmware, and software capabilities. |
|                | Provides network and asset monitoring to detect behavior anomalies and modifications to hardware, firmware, and software capabilities. |
|                | Offers secure data storage on-prem. |
|                | Provides network and asset monitoring to detect behavior anomalies and modifications to hardware, firmware, and software capabilities. |

| Collaborator   | Component                                                                                |
|----------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
|                | Real-time data management software that enables detection of behavior anomalies and modifications to hardware, firmware, and software capabilities. |
|                | Access control platform that secures connections and provides control mechanisms to enterprise systems for authorized users and devices; monitors activity down to the keystroke |
|                | Provides network and asset monitoring to detect behavior anomalies and modifications to hardware, firmware, and software capabilities.

Protecting Information and System Integrity in Industrial Control System Environments_ Cybersecurity for the Manufacturing Sector


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AT.L2-3.2.3 (NIST 3.2.3)?

[Assistant]
According to Recommendations for Federal Vulnerability Disclosure Guidelines:

3.2.3. 3.2.3.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Recommendation for Pair-Wise Key-Establishment Using Integer Factorization Cryptography provide? (Part 4)

[Assistant]
ies, and methods for key confirmation are included to provide assurance that both parties share the same keying material. In addition, the security properties associated with each scheme are provided.
## Keywords

assurances; integer factorization cryptography; key agreement; key confirmation; key derivation; key establishment; key management; key recovery; key transport. ## Acknowledgements

NIST  thanks  the  many  contributions  by  the  public  and  private  sectors  whose  thoughtful  and constructive comments improved the quality and usefulness of this publication. The authors also acknowledge the contributions by Dustin Moody, Andrew Regenscheid and Miles Smid made to previous versions of this Recommendation . ## Conformance Testing

Conformance testing for implementations of this Recommendation will be conducted within the framework of the Cryptographic Algorithm Validation Program (CAVP) and the Cryptographic Module Validation Program (CMVP). The requirements of this Recommendation are indicated by the word ' shall .' Some of these requirements may be out-of-scope for CAVP or CMVP validation testing, and thus are the responsibility of entities using, implementing, installing or configuring applications that incorporate this Recommendation. ## Table of Contents

| 1. Introduction............................................................................................................................. | 1. Introduction............................................................................................................................. | 1. Introduction.............................................................................................................................

Recommendation for Pair-Wise Key-Establishment Using Integer Factorization Cryptography


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Physical Protection?

[Assistant]
According to Overview and Considerations of Access Control Based on Attribute Encryption:

The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the Nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof-of-concept implementations, and technical analyses to advance the development and productive use of information technology. ITL's responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in federal information systems. | Executive Summary................................................................................................................. 1        | Executive Summary................................................................................................................. 1        | Executive Summary................................................................................................................. 1   |
|---------------------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------|
| 1. | Introduction ...................................................................................................................... | 2                                                                                |
| 2. | Fundamental Theories .....................................................................................................

Overview and Considerations of Access Control Based on Attribute Encryption


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Risk Assessment?

[Assistant]
According to Security and Privacy Controls for Information Systems and Organizations:

bust and comprehensive information security and privacy risk
management  programs  can  facilitate  compliance  with  applicable  laws,  regulations,  executive
orders,  and  governmentwide  policies.
Risk  management  frameworks  and  risk  management
processes are essential in developing, implementing, and maintaining the protection measures
necessary to address stakeholder needs and the current threats to organizational operations
and  assets,  individuals,  other  organizations,  and  the  Nation. Employing  effective  risk-based
processes,  procedures,  methods,  and  technologies  ensures  that  information  systems  and
organizations have the necessary trustworthiness and resiliency to support essential mission and
business functions, the U.S. critical infrastructure, and continuity of government.

Security and Privacy Controls for Information Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AU.L2-3.3.3 (NIST 3.3.3)?

[Assistant]
According to Recommendations for Federal Vulnerability Disclosure Guidelines:

3.3.3. 3.3.3.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Security Assessment?

[Assistant]
According to Ordered t-way Combinations for Testing State-based Systems:

## Ordered t-way Combinations for Testing State-based Systems

Fault detection often depends on the specific order of inputs that establish states which eventually lead to a failure. However, beyond basic structural coverage metrics, it is often difficult to determine if code has been exercised sufficiently to ensure confidence in its functions. Measures are needed to ensure that  relevant combinations  of  input  values  have  been  tested  with  adequate  diversity  of  ordering  to ensure  correct  operation.  Combinatorial  testing  and  combinatorial  coverage  measures  have  been applied to many types of applications but have some deficiencies for verifying and testing state-based systems where the response depends on both input values and the current system state. In such systems, internal states change as input values are processed. Examples include network protocols, which may be in listening, partial connection, full connection, disconnected, and many other states depending on the values of packet fields and the order of packets received. Similarly, merchant account balances in credit card systems change continuously as transactions are processed. This publication introduces a notion of ordered t-way combinations, proves a result regarding the construction of adequate blocks of test inputs,  and discusses the application of the results to verify and test state-based systems.

combinatorial coverage; combinatorial methods; combinatorial testing; software testing; structural coverage; test coverage.

Ordered t-way Combinations for Testing State-based Systems


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Audit and Evaluation of Computer Security provide? (Part 10)

[Assistant]
mental Standard for Physical Security and
General Controls
Commentary
2o4.1
Other Audit Requirements

2.3

2.4

2e5

Commentary

. o

. . o

. »

„

. =

. „

o

3. RECOMMENDED COURSE OF ACTION

o

4.
PART IV:

REFERENCES
QUALIFICATIONS AND TRAINING ........... o

EDITORS' NOTE

. . Qualifications and Training

•

"

0

0

0

1. 2. 3. 4. 5„
6. 7. 8. INTRODUCTION
CONSIDERATIONS ASSOCIATED WITH DEVELOPING A COMMON
BODY OF KNOWLEDGE ......... THE EIGHT PARTS OF THE COMMON BODY OF KNOWLEDGE ..... COMPUTER SYSTEM, OPERATIONS, AND SOFTWARE
DATA PROCESSING TECHNIQUES
MANAGEMENT OF THE DATA PROCESSING FUNCTION „
SECURITY OF THE DATA PROCESSING FUNCTION
RISK ANALYSIS AND THREAT ASSESSMENT .......... MANAGEMENT CONCEPTS AND PRACTICES
AUDITING CONCEPTS AND PRACTICES
BASIC QUALIFICATIONS NEEDED TO EVALUATE COMUTER
SECURITY

......... o

. . . „

. . o

o

o

. . o

. o

o

o

. . . . o

. . . 0
0

OUTLINE OF THE COMMON BODY OF KNOWLEDGE . BIBLIOGRAPHY

. . . o

. o

o

o

PART V:

SECURITY ADMINISTRATION

. . . o

EDITORS' NOTE

....... o

. . le

INTRODUCTION
General
lal
Privacy Legislation . 1.2
1.201
1.202
le2.3
Organization of this Report . 1.3

o

o

The Privacy Act of 1974
Laws in Other Countries
International Privacy Law Compatibility

o

o

. o

o

. . . o

o

. . o

. . . . . . . . . . vi ii

3-5
3-5
3-5
3-6

3-7
3-7

3-8
3-8
3-10

3-10

3-11

4-1
4-2

4-3

4-3

4-3
4-6

4-6
4-7
4-7
4-7
4-8
4-8
4-9

4-9

4-11
4-13

5-1
5-2

5-3
5-3
5-4
5-4
5-4
5-5
5-5

2. SECURITY ADMINISTRATION PROGRAM
2.1
2.2
2.3
2.4

Introduction
Planning by Management
Management Control ..... ADP Security
2.4.1
2.4.2
2.4.3
2.4.4
2.4.5

Administrative Security
Physical Security Administration
Technical Security
Training
A Suggested Security System for an
On-Line System— An Example

3. AUDITING THE SECURITY ADMINISTRATION FUNCTION .....


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Incident Response?

[Assistant]
According to Approaches and Challenges of Federal Cybersecurity Awareness Programs:

s prevention. So, within any year, I reach out to those stakeholders to ask, 'What's important for the user to understand about cybersecurity awareness? What do you want to talk to the customer about?
What kind of behaviors are you seeing that you want us to help encourage them to do or not to do?.' (D01)
- 'Build relationships with offices within your organization- Incident Response, Help Desk,…FISMA Compliance.' (Q24)

Approaches and Challenges of Federal Cybersecurity Awareness Programs


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Services Acquisition?

[Assistant]
According to Guide to Enterprise Patch Management Planning_ Preventive Maintenance for Technology:

ty on a small number of low-importance assets. - Schedule patch deployment. Many organizations schedule patch deployments as part of their enterprise change management activities. - Acquire the patch.
Patches may be downloaded from the internet, built internally by developers or system administrators, or provided through removable media. - Validate the patch. A patch's authenticity and integrity should be confirmed, preferably by automated means, before the patch is tested or installed. The patch could have been acquired from a rogue source or tampered with in transit or after acquisition. - Test the patch. A patch may be tested before deployment. This is intended to reduce operational risk by identifying problems with a patch before placing it into production. Testing may be performed manually or through automated methods.

Guide to Enterprise Patch Management Planning_ Preventive Maintenance for Technology


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Services Acquisition?

[Assistant]
According to Access Control on NoSQL Databases:

There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may be used by federal agencies even before the completion of such companion publications. Thus, until each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning and transition purposes, federal agencies may wish to closely follow the development of these new publications by NIST.

The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the Nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology. ITL's responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in federal information systems.

NoSQL systems can handle fast-paced agile development, the storage of large volumes of structured and semi-structured data, the requirements for scale-out architecture, and modern application paradigms (e.g., microservices and real-time streaming) [MO]. However, they also face many challenges with regard to access control, such as a lack of proper authentication, encryption, dynamic model support, and fine-grained authorization (as described in Sec. 3.3). Therefore, careful considerations need to be made when implementing access control on NoSQL databases to address these issues effectively.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Identification and Authentication?

[Assistant]
According to Guidelines for Media Sanitization:

..................................13  |
| 3.2.4. Quality of Cryptographic Implementations................................................................................15                   |
| 3.2.5.
Traceability of CE Operations.....................................................................................................16         |
| Media Sanitization Program .........................................................................................................18              |
| 4. |
| 4.3.1. Information Decisions in the System Life Cycle..........................................................................20                   |
| 4.3.2. Determination of Security Categorization..................................................................................21                 |
| 4.3.3. Reuse of Media...........................................................................................................................22  |
| 4.3.4. Control of Media ........................................................................................................................22  |
| 4.3.5. Data Protection Level .................................................................................................................23    |
| 4.3.6. Sanitization and Disposal Decision.............................................................................................23            |


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Physical Protection?

[Assistant]
According to A Zero Trust Architecture Model for Access Control in Cloud-Native Applications in Multi-Cloud Environments:

The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the Nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology. ITL's responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in federal information systems. The Special Publication 800-series reports on ITL's research, guidelines, and outreach efforts in information system security, and its collaborative activities with industry, government, and academic organizations. - The application is made up of a set of loosely coupled components called microservices. Each of the microservices can be hosted on different physical or virtual machines (VMs) and even be geographically distributed (e.g., within several facilities that belong to the enterprise, such as the headquarters, branch offices, and in various cloud service provider environments). - Any transaction involving the application may also involve one or more inter-service (microservice) calls across the network. - A widespread feature (though not necessarily a requirement for cloud-native applications) is the presence of a software platform called the service mesh that provides an integrated set of all application services (e.g., services discovery, networking connections, communication resilience, and security services like authentication and authorization). - Zero trust is the term for an evolving set of cybersecurity paradigms that move defenses from static, network-based perimeters to focus on users and resources. It is a set of security primitives rather than a particular set of technologies.

A Zero Trust Architecture Model for Access Control in Cloud-Native Applications in Multi-Cloud Environments


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Services Acquisition?

[Assistant]
According to Planning for a Zero Trust Architecture_ A Planning Guide for Federal Administrators:

Enterprise administrators and system operators need to be involved in the planning and deployment for a ZTA to be successful. ZTA planning requires input and analysis from system and workflow owners as well as professional security architects. Zero trust cannot be simply added onto an existing workflow but needs to be integrated into all aspects of the enterprise. This document introduces NIST Risk Management Framework (RMF) [2] concepts for administrators and operators who are in the process of migrating to a ZTA. The RMF lays out an approach that includes set of steps and tasks that is integrated into enterprise risk analysis, planning, development, and operations. Administrators who normally do not perform the steps and tasks detailed in the RMF may find that they will need to become familiar with them as they migrate to a ZTA.

Zero trust lends itself to the use of more dynamic development and operations (DevOps) [17] and DevOps and security (DevSecOps) style operations. The cycles of security updates and reviews could be described as involving a subset of the RMF process.  For example, a DevOps cycle for the cybersecurity posture could be expressed as figure 3 below:

Planning for a Zero Trust Architecture_ A Planning Guide for Federal Administrators


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 1 require for Access Control?

IoT Non-Technical Supporting Capability Core Baseline


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AC.L2-3.1.1 (NIST 3.1.1)?

[Assistant]
According to Contingency Planning Guide for Federal Information Systems:

3.1.1 Identify Outage Impacts and Estimated Downtime

This section identifies and characterizes the types of impact categories that a system disruption is likely to create in addition to those identified by the FIPS 199 impact level, as well as the estimated downtime that the organization can tolerate for a given process.

Contingency Planning Guide for Federal Information Systems


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171 provide? (Part 2)

[Assistant]
systems, but such standards and guidelines shall not apply to national security systems without the express approval of the appropriate federal officials exercising policy authority over such systems.
This guideline is consistent with requirements of the Office of Management and Budget (OMB) Circular A-130. Nothing in this publication should be taken to contradict the standards and guidelines made mandatory and binding on federal agencies by the Secretary of Commerce under statutory authority. Nor should these guidelines be interpreted as altering or superseding the existing authorities of the Secretary of Commerce, OMB Director, or any other federal official. This publication may be used by nongovernmental organizations on a voluntary basis and is not subject to copyright in the United States. Attribution would, however, be appreciated by NIST. National Institute of Standards and Technology Special Publication 800-172 Natl. Inst. Stand. Technol. Spec. Publ. 800-172, 84 pages (February 2021)

CODEN: NSPUE2

This publication is available free of charge from:

https://doi.org/10.6028/NIST.SP.800-172

Certain  commercial  entities,  equipment,  or  materials  may  be  identified  in  this  document  to describe an experimental procedure or concept adequately. Such identification is not intended to imply recommendation or endorsement by NIST, nor is it intended to imply that the entities, materials, or equipment are necessarily the best available for the purpose. There may be references in this publication to other publications currently under development by  NIST  in  accordance  with  its  assigned  statutory  responsibilities. The  information  in  this publication, including concepts, practices, and methodologies, may be used by federal agencies even  before  the  completion  of  such  companion  publications. Thus,  until  each  publication  is completed,  current  requirements,  guidelines,  and  procedures,  where  they  exist,  remain operative.

Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Risk Management Framework for Information Systems and Organizations_ A System Life Cycle Approach for Security and Privacy provide? (Part 3)

[Assistant]
d States. Attribution would, however, be appreciated by NIST. National Institute of Standards and Technology Special Publication 800-37, Revision 2 Natl. Inst. Stand. Technol. Spec. Publ. 800-37, Rev.
2, 183 pages (December 2018)

CODEN: NSPUE2

This publication is available free of charge from:

https://doi.org/10.6028/NIST.SP.800-37r2

Certain commercial entities, equipment, or materials may be identified in this document to describe an  experimental  procedure  or  concept  adequately. Such  identification  is  not  intended  to  imply recommendation or endorsement by NIST, nor is it intended to imply that the entities, materials, or equipment are necessarily the best available for the purpose. There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts, practices, and methodologies, may be used by federal agencies even before the completion  of  such  companion  publications. Thus,  until  each  publication  is  completed,  current requirements, guidelines, and procedures, where they exist, remain operative. For planning and transition purposes, federal agencies may wish to closely follow the development of these new publications by NIST. Organizations are encouraged to review draft publications during the designated public comment periods and provide feedback to NIST. Many NIST publications, other than the ones noted above, are available at https://csrc.nist.gov/publications. ## Comments on this publication may be submitted to:

National Institute of Standards and Technology Attn: Computer Security Division, Information Technology Laboratory 100 Bureau Drive (Mail Stop 8930) Gaithersburg, MD 20899-8930

Email: sec-cert@nist.gov

All comments are subject to release under the Freedom of Information Act (FOIA) [FOIA96].

Risk Management Framework for Information Systems and Organizations_ A System Life Cycle Approach for Security and Privacy


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AU.L2-3.3.4 (NIST 3.3.4)?

[Assistant]
According to Secure Software Development Framework (SSDF) Version 1.1_ Recommendations for Mitigating the Risk of Software Vulnerabilities:

3.3.4, 3.

Secure Software Development Framework (SSDF) Version 1.1_ Recommendations for Mitigating the Risk of Software Vulnerabilities


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Maintenance?

[Assistant]
According to Guide to Malware Incident Prevention and Handling for Desktops and Laptops:

control (e.g., contractor computers, employees' home computers, business partners' computers, mobile devices). Organizations should ensure that their policies address prevention of malware incidents.
These policy statements should be used as the basis for additional malware prevention efforts, such as user and IT staff awareness, vulnerability mitigation, threat mitigation, and defensive architecture (described in Sections 3.2 through 3.5, respectively). If an organization does not state malware prevention considerations clearly in its policies, it is unlikely to perform malware prevention activities consistently and effectively throughout the organization. Malware prevention-related policy should be as general as possible to provide flexibility in policy implementation and to reduce the need for frequent policy updates, but also specific enough to make the intent and scope of the policy clear. Although some organizations have separate malware policies, many malware prevention considerations belong in other policies, such as acceptable use policies, so a separate malware policy might duplicate some of the content of other policies. 5 Malware prevention-related policy should include provisions related to remote workers-both those using hosts controlled by the organization and those using hosts outside of the organization's control (e.g., contractor computers, employees' home computers, business partners' computers, mobile devices).

Guide to Malware Incident Prevention and Handling for Desktops and Laptops


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Media Protection?

[Assistant]
According to Guide for Developing Security Plans for Federal Information Systems:

ncy official with statutory or operational authority for specified information and responsibility for establishing the controls for its generation, collection, processing, dissemination, and disposal.
The information owner has the following responsibilities related to system security plans:

| CLASS       | FAMILY                                                 | IDENTIFIER   |
|-------------|--------------------------------------------------------|--------------|
| Management  | Risk Assessment                                        | RA           |
| Management  | Planning                                               | PL           |
| Management  | System and Services Acquisition                        | SA           |
| Management  | Certification, Accreditation, and Security Assessments | CA           |
| Operational | Personnel Security                                     | PS           |
| Operational | Physical and Environmental Protection                  | PE           |
| Operational | Contingency Planning                                   | CP           |
| Operational | Configuration Management                               | CM           |
| Operational | Maintenance                                            | MA           |
| Operational | System and Information Integrity                       | SI           |
| Operational | Media Protection                                       | MP           |
| Operational | Incident Response                                      | IR           |
| Operational | Awareness and Training                                 | AT           |
| Technical   | Identification and Authentication                      | IA           |
| Technical   | Access Control                                         | AC           |
| Technical   | Audit and Accountability                               | AU           |
| Technical   | System and Communications Protection                   | SC           |

| Configuration Control [CNSS Inst.

Guide for Developing Security Plans for Federal Information Systems


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AC.L2-3.1.5 (NIST 3.1.5)?

[Assistant]
According to Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations:

3.1.5. 3.1.5.

Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice CM.L2-3.4.1 (NIST 3.4.1)?

[Assistant]
According to Guide to a Secure Enterprise Network Landscape:

3.4.1. 3.4.1. 3.4.1.

Guide to a Secure Enterprise Network Landscape


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Risk Assessment?

[Assistant]
According to Incident Response Recommendations and Considerations for Cybersecurity Risk Management_ A CSF 2.0 Community Profile:

cyber threat information sharing; Cybersecurity Framework; cybersecurity incident; cybersecurity risk management; incident handling; incident management; incident response.

…an occurrence that actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an information system; or constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies. [FISMA2014]

- Employing a botnet to send high volumes of connection requests to an internet-facing service, making it unavailable to legitimate service users
- Obtaining administrative credentials at a software-as-a-service provider, which puts sensitive tenant data entrusted to that provider at risk
- Intruding upon an organization's business network to steal credentials and use them to instruct industrial control systems to shut down or destroy critical physical components, causing a major service disruption
- Deploying ransomware to prevent the use of computer systems and cause multiple data breaches by copying files from those systems
- Using phishing emails to compromise user accounts and using those accounts to commit financial fraud
- Identifying a new vulnerability in network management appliances and exploiting the vulnerability to gain unauthorized access to network communications
- Compromising a vendor's software, which is subsequently distributed to customers in its compromised state

Incident Response Recommendations and Considerations for Cybersecurity Risk Management_ A CSF 2.0 Community Profile


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Security Assessment?

[Assistant]
According to Secure Software Development Practices for Generative AI and Dual-Use Foundation Models_ An SSDF Community Profile:

- NIST research and publications on trustworthy and responsible AI, including the Artificial Intelligence Risk Management Framework (AI RMF 1.0) [2], Adversarial Machine Learning: A Taxonomy and Terminology of Attacks and Mitigations [3], Towards a Standard for Identifying and Managing Bias in Artificial Intelligence [4], and the Dioptra experimentation testbed for security evaluations of machine learning algorithms [5]. - NIST's Secure Software Development Framework (SSDF) Version 1.1 [6], which is a set of fundamental, sound, and secure software development practices. It provides a common language to help facilitate communications among stakeholders, including software producers and software acquirers. The SSDF has also been used in support of EO 14028, Improving the Nation's Cybersecurity [7], to enhance software supply chain security. - NIST general cybersecurity resources, including The NIST Cybersecurity Framework (CSF) 2.0 [8], Security and Privacy Controls for Information Systems and Organizations [9], and Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations [10]. - AI model developers, AI researchers, AI system developers, and secure software practitioners from industry and government with expertise in the unique security challenges of AI models and the practices for addressing those challenges. This expertise was primarily captured through NIST's January 2024 workshop, where speakers and attendees shared suggestions for adapting secure software development practices and tasks to accommodate the unique aspects of AI model development and the software leveraging them. All practices and tasks are unchanged from SSDF version 1.1 unless they are explicitly tagged as 'Modified from SSDF 1.1' or 'Not part of SSDF 1.1.' An example is the PW.3 practice, ' Confirm the Integrity of Training, Testing, Fine-Tuning, and Aligning Data Before Use' and all of its tasks.

Secure Software Development Practices for Generative AI and Dual-Use Foundation Models_ An SSDF Community Profile


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Secure Software Development Framework (SSDF) Version 1.1_ Recommendations for Mitigating the Risk of Software Vulnerabilities provide? (Part 5)

[Assistant]
orkshop and received over 150 position papers, many of which suggested secure software development practices, tasks, examples of implementations, and references for consideration for this SSDF update.
The authors appreciate all of those suggestions, as well as the input from those who spoke at or attended the workshop and shared their thoughts during or after the workshop. Additionally, the authors appreciate the public comments submitted by dozens of organizations and individuals and wish to acknowledge the particularly helpful feedback from Amazon Web Services, Apiiro, Blackberry, BSA | The Software Alliance, the Enterprise Cloud Coalition, the General Services Administration (GSA), Google, IBM, Medical Imaging & Technology Alliance (MITA), Microsoft, Oracle, the Software Assurance Forum for Excellence in Code (SAFECode), Synopsis, the U.S. Navy, Xoomworks, and Robert Grupe. Representatives of Siemens Energy and Synopsis contributed mappings to new references. The authors thank all of their NIST colleagues for their support throughout the SSDF update, especially Curt Barker, Paul Black, Jon Boyens, Jim Foti, Barbara Guttman, Mat Heyman, Nicole Keller, Matt Scholl, Adam Sedgewick, Kevin Stine, and Isabel Van Wyk. The authors also wish to thank all of the individuals and organizations who provided comments on drafts of the original version of the SSDF, including the Administrative Offices of the U.S. Courts, The Aerospace Corporation, BSA | The Software Alliance, Capitis Solutions, the Consortium for Information & Software Quality (CISQ), HackerOne, Honeycomb Secure Systems, iNovex, Ishpi Information Technologies, the Information Security and Privacy Advisory Board (ISPAB), Juniper Networks, Microsoft, MITA, Naval Sea Systems Command (NAVSEA), NIST, Northrop Grumman, the Office of the Undersecretary of Defense for Research and Engineering, Red Hat, SAFECode, and the Software Engineering Institute (SEI).


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Planning?

[Assistant]
According to Guide to Auditing for Controls and Security_ A System Development Life Cycle Approach:

| 2.1 | BACKGROUND | BACKGROUND | BACKGROUND | 16 | |-------|------------------------------------------------------------|------------------------------------------------------------|------------------------------------------------------------|------| | | 2.1.1 | PCIE - EDP Systems Review and Security Work Group | PCIE - EDP Systems Review and Security Work Group | 16 | | | 2.1.2 | System Development Life Cycle | System Development Life Cycle | 16 | | 2.2 | OPERATING ENVIRONMENT | OPERATING ENVIRONMENT | OPERATING ENVIRONMENT | 17 | | | 2.2.1 IRM Planning and Implementation of Policy Guidelines | 2.2.1 IRM Planning and Implementation of Policy Guidelines | 2.2.1 IRM Planning and Implementation of Policy Guidelines | 17 | | | 2.2.1.1 IRM Planning | 2.2.1.1 IRM Planning | 2.2.1.1 IRM Planning | 17 | | | 2.2.1.2 Using Policy/Procedures/Standards | 2.2.1.2 Using Policy/Procedures/Standards | 2.2.1.2 Using Policy/Procedures/Standards | 18 | | | 2.2.1.2.1 | 2.2.1.2.1 | References Used by the Life Cycle Matrix | 19 | | | 2.2.1.2.2 | 2.2.1.2.2 | Major GSA References | 21 | | | 2.2.2 AIS Development Methodologies | 2.2.2 AIS Development Methodologies | 2.2.2 AIS Development Methodologies | 21 | | | 2.2.3 Project Administration and Control | 2.2.3 Project Administration and Control | 2.2.3 Project Administration and Control | 23 |

Guide to Auditing for Controls and Security_ A System Development Life Cycle Approach


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Audit and Accountability?

[Assistant]
According to Ascon-Based Lightweight Cryptography Standards for Constrained Devices_ Authenticated Encryption, Hash, and Extendable Output Functions:

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . |  15 |
| 4.2. Implementation Options . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . |  18 |
| 4.2.1. Truncation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . |  18 |
| 4.2.2. Nonce Masking . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . |  18 |
| 4.3. AEAD Requirements.............................................................. |  19 |
| 4.4. Security Properties . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . |  20 |
| 4.4.1. Single-Key Setting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . |  20 |
| 4.4.2. Multi-Key Setting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . |  20 |
| 4.4.3. Nonce-Misuse Setting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . |  21 |
| 5. Hash and eXtendable-Output Functions (XOFs) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . |  23 |
| 5.1. Specification of Ascon-Hash256 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . |  23 |
| 5.2. Specification of Ascon-XOF128 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . |  25 |
| 5.3. Specification of Ascon-CXOF128 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . |  28 |
| 5.4. Streaming API for XOF............................................................ |  30 |
| 5.5. Security Strengths . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Ascon-Based Lightweight Cryptography Standards for Constrained Devices_ Authenticated Encryption, Hash, and Extendable Output Functions


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Secure Software Development Framework (SSDF) Version 1.1_ Recommendations for Mitigating the Risk of Software Vulnerabilities provide? (Part 2)

[Assistant]
approval of appropriate federal officials exercising policy authority over such systems. This guideline is consistent with the requirements of the Office of Management and Budget (OMB) Circular A-130.
Nothing in this publication should be taken to contradict the standards and guidelines made mandatory and binding on federal agencies by the Secretary of Commerce under statutory authority. Nor should these guidelines be interpreted as altering or superseding the existing authorities of the Secretary of Commerce, Director of the OMB, or any other federal official. This publication may be used by nongovernmental organizations on a voluntary basis and is not subject to copyright in the United States. Attribution would, however, be appreciated by NIST. National Institute of Standards and Technology Special Publication 800-218

Natl. Inst. Stand. Technol. Spec. Publ. 800-218, 36 pages (February 2022) CODEN: NSPUE2

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-218

Certain  commercial  entities,  equipment,  or  materials  may  be  identified  in  this  document  in  order  to  describe  an experimental  procedure  or  concept  adequately. Such  identification  is  not  intended  to  imply  recommendation  or endorsement by NIST, nor is it intended to imply that the entities, materials, or equipment are necessarily the best available for the purpose. There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may  be  used  by  federal  agencies  even  before  the  completion  of  such  companion  publications. Thus,  until  each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Identification and Authentication?

[Assistant]
According to NIST Cybersecurity Framework 2.0_ Quick-Start Guide for Cybersecurity Supply Chain Risk Management (C-SCRM):

- Identity Management, Authentication, and Access Control: Identities and credentials for authorized users, services, and hardware are managed by the organization [PR.AA-01]
- Awareness and Training: Individuals in specialized roles are provided with awareness and training so that they possess the knowledge and skills to perform relevant tasks with cybersecurity risks in mind [PR.AT-02]

NIST Cybersecurity Framework 2.0_ Quick-Start Guide for Cybersecurity Supply Chain Risk Management (C-SCRM)


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Report on the Design-A-Thon_ Designing Effective and Accessible Approaches for Digital Product Cybersecurity Education and Awareness provide? (Part 3)

[Assistant]
ble at https://csrc.nist.gov/pubs/ir/8558/final, including related content, potential updates, and document history. ## All comments are subject to release under the Freedom of Information Act (FOIA).
## Abstract

This report documents the first SOUPS Design-A-Thon, which was held on August 11 th , 2024, and focused on Designing Effective and Accessible Approaches for Digital Product Cybersecurity Education and Awareness. In total, eight individuals participated in the event, forming three teams. The teams each selected a mock product based on a selection of five Product Data Cards developed by the NIST team. Participants used the information on the Product Data Cards to develop a strategy for cybersecurity education and awareness for the product. Teams were successful in planning strategies that utilize novel techniques and sound best practices. From the participant teams' designs, the NIST team identified highlights and takeaways that are further elaborated in this report. ## Keywords

cybersecurity; Internet of Things; Design-A-Thon; usability; human factors; education and awareness. ## Audience

This report is primarily intended for students and researchers in the fields of IoT cybersecurity and usable security. The topics and discussion of this report may also be useful and interesting to practitioners in these fields, but since the report contains initial findings from a small group exercise, it is not intended as a specific recommendation or guideline for practice. ## Table of Contents

| 1.

Report on the Design-A-Thon_ Designing Effective and Accessible Approaches for Digital Product Cybersecurity Education and Awareness


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does NIST Cybersecurity Framework 2.0_ Quick-Start Guide for Cybersecurity Supply Chain Risk Management (C-SCRM) provide? (Part 6)

[Assistant]
the supplier relationship lifecycle. - ☐ Specify in contracts the rights and responsibilities of the organization, its suppliers, and their supply chains with respect to potential cybersecurity risks.
Contractually require suppliers to do the following:

☐ disclose cybersecurity features, functions, and vulnerabilities of their products and services for the life of the product or the term of service

☐ provide and maintain a current component inventory (e.g., software or hardware bill of materials) for critical products

☐ vet their employees and guard against insider threats

☐ provide evidence of performing acceptable security practices through, for example, self-attestation, conformance to known standards, certifications, or inspections

## NIST CSF 2.0: CYBERSECURITY SUPPLY CHAIN RISK MANAGEMENT (C-SCRM)

A QUICK-START GUIDE

## HOW TO USE THE CSF TO DEFINE AND COMMUNICATE SUPPLIER REQUIREMENTS

## Developing Supplier Requirements

An organization should specify requirements for technology suppliers. Robustness of these requirements should correspond to supplier criticality. Organizations can use two different methods for specifying supplier requirements:

1. Use CSF Categories and Subcategories. Not all Categories and Subcategories will apply to all suppliers. You can pick and choose requirements that fit your mission or business supplier criticality level. Select requirements for suppliers based on their criticality and your mission or business. To do that, review the list of CSF Categories and Subcategories, and determine which ones will be applicable to suppliers within each of the criticality levels, based on the risk appetite for each supplier criticality level. When considering individual supplier agreements, determine if additional supplier requirements are needed based on existing criticality criteria, such as your mission or business, data type being processed, or digital product or service being provided. 2.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Communications Protection?

[Assistant]
According to Planning for a Zero Trust Architecture_ A Planning Guide for Federal Administrators:

Scott Rose Wireless Networks Division Communications Technology Laboratory

For additional information on NIST's Cybersecurity programs, projects, and publications, visit the Computer  Security  Resource  Center.  Information  on  other  efforts  at  NIST,  the  Information Technology  Laboratory  (ITL)  and  Communications  Technology  Laboratory  (CTL)  is  also available. Zero trust related information is also found on the zero trust topic page.

National Institute of Standards and Technology Attn: Wireless Networks Division, Communications Technology Laboratory 100 Bureau Drive (Mail Stop 8920) Gaithersburg, MD 20899-8920


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Information Integrity?

[Assistant]
According to Strategies for the Integration of Software Supply Chain Security in DevSecOps CI_CD Pipelines:

.............................9      |
| 3.1.5. Types of Exploits.........................................................................................................................10   |
| 3.2.1.
Baseline Security ........................................................................................................................11   |
| 3.2.2. Controls for Interacting With SCM Systems...............................................................................12                     |
| 4. CI/CD Pipelines -Background, Security Goals, and Entities to be Trusted .....................................13                                    |
| 5. Integrating SSC Security Into CI/CD Pipelines.................................................................................15                   |
| 5.1.1. Secure Build................................................................................................................................16 |
| 5.1.2. Secure Pull-Push Operations on Repositories............................................................................17                      |
| 5.1.3. Integrity of Evidence Generation During Software Updates......................................................18                               |
| 5.1.4. Secure Code Commits ................................................................................................................19         |

Strategies for the Integration of Software Supply Chain Security in DevSecOps CI_CD Pipelines


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Personnel Security?

[Assistant]
According to High-Performance Computing Security_ Architecture, Threat Analysis, and Security Posture:

- Environmental and physical threats: Physical or cyber attacks against facilities (e.g., power, cooling, water), unauthorized physical access, and natural disasters (e.g., fire, flood, earthquake, hurricane, etc.) are all potential threats to an HPC system. - Vulnerabilities introduced by prioritizing performance in HPC design and operation: HPC is designed to process large volumes of data and perform complex computations at very high speeds. Achieving the highest performance possible is a priority in HPC design and operation. Such prioritization, however, has its security implications. For instance, designers often make conscious decisions to build a less redundant system to achieve high performance, making the system less robust and potentially more vulnerable to attacks, such as DoS attacks. As another example, using a backup system to improve system robustness and high availability is a proven technology. However, building a spare or backup HPC system is often too costly. HPC systems can often lack storage backup due to the vast size of the data stored. Similarly, most HPC missions do not have a service-level agreement to justify the need for a full backup system at a backup location. All resources are poured into building the single best HPC system possible. - Supply chain threats: The HPC supply chain faces a variety of threats, from the theft of proprietary information to attacks on critical hardware components and software manipulation to gain unauthorized access. Some HPC software (e.g., OS, applications), firmware, and hardware components have limited manufacturers, suppliers, and integrators, which makes diversification difficult. Limited suppliers also lead to shortages in the qualified workforce who can provide required technical support. - Insider threats: Insider threats come from people within the organization who have internal information and may have the privileges needed to access the HPC system.

High-Performance Computing Security_ Architecture, Threat Analysis, and Security Posture


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 1 require for Identification and Authentication?

[Assistant]
According to Summary Report for “Workshop on Updating Manufacturer Guidance for Securable Connected Product Development”:

ation of privacy capabilities in IoT products. Gilbert also discussed specific privacy risks related to IoT, such as interactions with the physical world leading to reputational harm or safety issues.
Data processing might exceed the product's intended scope, and access, management, and monitoring features could result in loss of trust and economic loss. Additionally, privacy capability availability, efficiency, and effectiveness are crucial to prevent issues like discrimination and to maintain trust. IoT products need the capabilities to support configurations such as remote activation, prevention, and data minimization.

Summary Report for “Workshop on Updating Manufacturer Guidance for Securable Connected Product Development”


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AT.L2-3.2.2 (NIST 3.2.2)?

[Assistant]
According to Automated Secure Configuration Guidance from the macOS Security Compliance Project (mSCP):

3.2.2. 3.2.2.

Automated Secure Configuration Guidance from the macOS Security Compliance Project (mSCP)


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Summary of NIST SP 800-53, Revision 4_ Security and Privacy Controls for Federal Information Systems and Organizations provide? (Part 5)

[Assistant]
e of continuous improvement in the organization's risk-related activities, with effective communication among tiers and stakeholders. Figure 1 illustrates the three-tiered approach to risk management.
Figure 1: Risk Management 3-Tiered Approach

<!-- image -->

The NIST Risk Management Framework (RMF), described in NIST Special Publication 800-37 Revision 1, Guide for Applying the Risk Management Framework to Federal Information Systems: a Security Life Cycle Approach, is a methodology for implementing risk management at the information systems tier. The RMF (depicted in Figure 2) identifies six distinct steps that provide a disciplined and structured process to integrate information security risk management activities into the system development life cycle. The RMF addresses security concerns of organizations related to the design, development, implementation, operation, and disposal of information systems and the environments in which those systems operate. The security controls in SP 800-53 Rev. 4 support Step Two of the RMF, and a detailed catalog of these controls is provided in Appendix F. For ease of use in the security control selection and specification process, controls are organized into eighteen families, each containing security controls related to the general security topic of the family. Security controls involve aspects of policy, oversight, supervision, manual processes, individual actions, or automated mechanisms implemented by information systems/devices. The security control structure consists of the

following components: (i) a control section; (ii) a supplemental guidance section; (iii) a control enhancements section; (iv) a references section; and (v) a priority and baseline allocation section.

Summary of NIST SP 800-53, Revision 4_ Security and Privacy Controls for Federal Information Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice MA.L2-3.7.4 (NIST 3.7.4)?

[Assistant]
According to Audit and Evaluation of Computer Security II_ System Vulnerabilities and Controls:

3.7.4 Privileged Program Controls 3. 3.7.4 Privileged Program Controls 3. 3.7.4 Privileged Program Controls ; A means of permitting users to have limited access to a data base to vSiich they do not have authorization for direct access is to produce a set of privileged (or trusted) sanitization programs vAiich are permitted to access the restricted data base components for the user.

Audit and Evaluation of Computer Security II_ System Vulnerabilities and Controls


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Maintenance?

[Assistant]
According to Guidelines for Media Sanitization:

Additional information about this publication is available at https://csrc.nist.gov/pubs/sp/800/88/r2/final, including related content, potential updates, and document history.

During the requirements phase, other types of ISM that will be used to create, capture, or transfer information used by the system should be identified. This analysis balances business needs and confidentiality risks in compliance with FIPS 200 [3]. While media sanitization and information disposition activities primarily occur during the disposal phase of the system life cycle, many types of ISM containing data will be transferred outside of the positive control of the organization throughout the life of an information system (e.g., for maintenance, system upgrades, or during a configuration update).

- Alignment of the organization's data classification scheme (e.g., low, medium, and high security categorizations) with minimum acceptable sanitization methods (i.e., clear, purge, and destroy)
- Requirements for the disposal and/or reuse of storage assets
- Expected outcomes from storage sanitization activities (e.g., identification of specific, acceptable sanitization techniques [13])
- Documentation or evidence associated with sanitization activities (see Sec. 4.6)
- The identification of roles and responsibilities (see Sec. 4.7) and personnel competencies, skills, and training
- The use of sanitization tools, including equipment calibration, testing, and maintenance
- Type of assurances (e.g., guarantees, assessment results, formal certifications) that the ISM vendor should provide for the sanitization capabilities


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Addressing Visibility Challenges with TLS 1.3 within the Enterprise_ High-Level Document provide? (Part 9)

[Assistant]
| ........................................................................................................................
5                                                                                |
| 4   | Architecture and Builds.......................................................................6                                                                                | Architecture and Builds.......................................................................6                                                                                |
|     | 4.1 Project                                                                                | Collaborators ................................................................................................... 6                                                                                |
|     | 4.1.1                                                                                | AppViewX ...................................................................................................................... 7                                                                               |
|     | 4.1.2                                                                                | DigiCert .........................................................................................................................

Addressing Visibility Challenges with TLS 1.3 within the Enterprise_ High-Level Document


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice IA.L2-3.5.1 (NIST 3.5.1)?

[Assistant]
According to Guide to Auditing for Controls and Security_ A System Development Life Cycle Approach:

3.5.1 Implementation of the Scheme                               | 3. 3.5.1 Implementation of the Scheme                               | 59        |
|           | 3. 3.5.1                                                                                | Introduction                                                                                | 86   |
|       | 4.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Security Assessment?

[Assistant]
According to Guide to a Secure Enterprise Network Landscape:

- It enables the enterprise to have tight version control (tracking changes) so that unauthorized networking devices and changes in associated configurations do not open up security vulnerabilities. - It enables the enterprise to have a uniform infrastructure across all environments development, testing, staging, and production. - Monitoring the drift (the unintended changes) between the defined infrastructure (as found in IaC) and the operational infrastructure (as measured by monitoring tools

- The DevSecOps paradigm consisting of CI/CD pipelines invokes the network provisioning tool (IaC code generator) to automate the initial deployment and subsequent reconfiguration of the networking infrastructure. Since the pipelines have a built-in audit process, the changes in network configuration are automatically captured in the audit, which enables the enterprise to demonstrate corporate security policy compliance and regulatory policy compliance for their networks where applicable. - Testing the code (IaC code) generated by IaC tools (and invoked by the CI/CD pipeline code that deploys the infrastructure using IaC in the DevSecOps process) ensures that security policies are consistently and uniformly applied across the entire enterprise networking infrastructure (i.e., multiple cloud services). - The advantage of having plug-ins for defining network provisioning for different public cloud provider environments is that they can be used to customize the observability tools used for network monitoring for each of those cloud services that the enterprise has subscribed to [17]. 2. Information about the device from which access is being requested - Establishing trust in the device through a combination of health and risk profiles of the device. For example, the risk profile of the device can be obtained through an out-of-the-box posture check (risk of the device [28]) with or without integrating with an endpoint protection tool for the device.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Awareness and Training?

[Assistant]
According to Control Baselines for Information Systems and Organizations:

| ORGANIZATIONAL RESPONSIBILITIES .........................................................................................
| 2                                                                                |
| 1.4                                                                                | RELATIONSHIPTOOTHERPUBLICATIONS ................................................................................... | 3                                                                                |
| 1.5                                                                                | REVISIONSANDEXTENSIONS .................................................................................................... | 3                                                                                |
| 1.6                                                                                | PUBLICATIONORGANIZATION .................................................................................................. | 3                                                                                |
| CHAPTERTWO THE FUNDAMENTALS............................................................................................ 5                     | CHAPTERTWO THE FUNDAMENTALS............................................................................................ 5                     | CHAPTERTWO THE FUNDAMENTALS............................................................................................

Control Baselines for Information Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Guide to Auditing for Controls and Security_ A System Development Life Cycle Approach provide? (Part 8)

[Assistant] IRM Planning | 2.2.1.1 IRM Planning | 2.2.1.1 IRM Planning | 17 | | | 2.2.1.2 Using Policy/Procedures/Standards | 2.2.1.2 Using Policy/Procedures/Standards | 2.2.1.2 Using Policy/Procedures/Standards | 18 | | | 2.2.1.2.1 | 2.2.1.2.1 | References Used by the Life Cycle Matrix | 19 | | | 2.2.1.2.2 | 2.2.1.2.2 | Major GSA References | 21 | | | 2.2.2 AIS Development Methodologies | 2.2.2 AIS Development Methodologies | 2.2.2 AIS Development Methodologies | 21 | | | 2.2.3 Project Administration and Control | 2.2.3 Project Administration and Control | 2.2.3 Project Administration and Control | 23 | | | 2.2.4 AIS Life Cycle Matrix | 2.2.4 AIS Life Cycle Matrix | 2.2.4 AIS Life Cycle Matrix | 24 | | 2.3 | LIFE CYCLE PHASES | LIFE CYCLE PHASES | LIFE CYCLE PHASES | 26 | | | 2.3.1 Initiation - Phase I | 2.3.1 Initiation - Phase I | 2.3.1 Initiation - Phase I | 27 | | | 2.3.2 Definition - Phase II | 2.3.2 Definition - Phase II | 2.3.2 Definition - Phase II | 27 | | | 2.3.3 System Design - Phase III | 2.3.3 System Design - Phase III | 2.3.3 System Design


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for Physical Protection?

[Assistant]
According to Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171:

| ...................................................................................................
3                                            |
| 1.2 TARGET AUDIENCE                                                                                | .................................................................................................................. 4                             |
| 1.3 ORGANIZATIONOF THIS SPECIAL PUBLICATION                                                                                | .......................................................................... 4                                                                     |
| CHAPTERTWO THE FUNDAMENTALS............................................................................................ 5                        | CHAPTERTWO THE FUNDAMENTALS............................................................................................ 5                        |
| 2.1 DEVELOPMENTAPPROACH ...................................................................................................... | 5                                                                                |
| 2.2 ORGANIZATIONANDSTRUCTURE                                                                                | ............................................................................................. 7                                                  |
| 2.3 FLEXIBLE APPLICATION                                                                                | .............................................................................................................

Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171