[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Overview and Considerations of Access Control Based on Attribute Encryption provide? (Part 4)

[Assistant]
osure Notice

NOTICE: ITL has requested that holders of patent claims whose use may be required for compliance with the guidance or requirements of this publication disclose such patent claims to ITL.
However, holders of patents are not obligated to respond to ITL calls for patents and ITL has not undertaken a patent search in order to identify which, if any, patents may apply to this publication. As of the date of publication and following call(s) for the identification of patent claims whose use may be required for compliance with the guidance or requirements of this publication, no such patent claims have been identified to ITL. No representation is made or implied by ITL that licenses are not required to avoid patent infringement in the use of this publication. ## Table of Contents

| Executive Summary................................................................................................................. 1        | Executive Summary................................................................................................................. 1        | Executive Summary................................................................................................................. 1   |
|---------------------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------|
| 1. | Introduction ...................................................................................................................... | 2                                                                                |
| 2.

Overview and Considerations of Access Control Based on Attribute Encryption


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Contingency Planning Guide for Federal Information Systems provide? (Part 10)

[Assistant] Information System Contingency Planning Process................................13 | | 3.1 | Develop the Contingency Planning Policy Statement...............................................14 | Develop the Contingency Planning Policy Statement...............................................14 | | | 3.2 | Conduct the Business Impact Analysis (BIA)............................................................15 | Conduct the Business Impact Analysis (BIA)............................................................15 | | | 3.2 | 3.2.1 | Determine Business Processes and Recovery Criticality..............................16 | | | 3.2 | 3.2.2 | Identify Resource Requirements ...................................................................19 | | | 3.2 | 3.2.3 | Identify System Resource Recovery Priorities ..............................................19 | | | 3.3 | Identify Preventive Controls......................................................................................19 | Identify Preventive Controls......................................................................................19 | | | 3.4 | Create Contingency Strategies .................................................................................20 | Create Contingency Strategies .................................................................................20 | | | 3.4 | 3.4.1 | Backup and Recovery ...................................................................................20 | | | 3.4 | 3.4.2 | Backup Methods and Offsite Storage............................................................21 | | | 3.4 | 3.4.3 | Alternate Sites ...............................................................................................21 | | | 3.4 | 3.4.4 | Equipment Replacement ...............................................................................24 | | | 3.4 | 3.4.5 | Cost Considerations ......................................................................................25 | | | 3.5 | 3.4.6 Roles and Responsibilities ............................................................................26 Plan Testing, Training, and Exercises (TT&E)..........................................................27 | 3.4.6 Roles and Responsibilities ............................................................................26 Plan Testing, Training, and Exercises (TT&E)..........................................................27 | | | | | | Testing...........................................................................................................27 | | | 3.5.1 | | | | |

Contingency Planning Guide for Federal Information Systems

Audit and Accountability
System and Information Integrity
Security Assessment
Media Protection
Identification and Authentication
Awareness and Training
System and Communications Protection
Access Control
Planning
Incident Response
Risk Assessment
Personnel Security
System and Services Acquisition
Supply Chain Risk Management
Maintenance
Physical Protection
Configuration Management


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for Awareness and Training?

[Assistant]
According to Protecting Controlled Unclassified Information (CUI)_ NIST Special Publication 800-171, Revision 3. Small Business Primer:

| Access Control                    | Maintenance         | Security Assessment and Monitoring   |
|-----------------------------------|---------------------|--------------------------------------|
| Awareness and Training            | Media Protection    | System and Communications Protection |
| Audit and Accountability          | Personnel Security  | System and Information Integrity     |
| Configuration Management          | Physical Protection | Planning                             |
| Identification and Authentication | Risk Assessment     | System and Services Acquisition      |
| Incident Response                 |                     | Supply Chain Risk Management         |

## Getting Started with Awareness and Training

## Family: Awareness and Training

Protecting Controlled Unclassified Information (CUI)_ NIST Special Publication 800-171, Revision 3. Small Business Primer


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Information Integrity?

[Assistant]
According to Addressing Visibility Challenges with TLS 1.3 within the Enterprise_ High-Level Document:

- Stolen keys . If threat actors gain unauthorized access to symmetric keys used for data encryption or private keys used in public key cryptograph y, they can bypass authentication systems or gain access to other keys . If symmetric or private keys are stored without encrypt ion, they are especially at risk of being exploited to undermine the security protections that TLS provides. -  Inadequately protected keys are subject to unauthorized access by direct theft, hacking, or other means. The more data a key protects, the more severe the consequences typically are if a threat actor gains unauthorized access. -  TLS 1.3 symmetric keys are used with Authenticated Encryption with Associated Data (AEAD) algorithms-providing confidentiality and integrity for the keys. - Certificate compromise . Public keys used during authentication are often exchanged in certificates issued by a CA. A real threat exists if the issuing CA is compromised or if the registration system, persons, or process are used to obtain an unauthorized certificate in the name o f a legitimate entity to compromise the clients. - Handshake data replay . Parties to cryptographically protected communications like TLS exchange keys use protocols often called 'handshakes,' which often include multiple steps. TLS 1.3 allows the client to send data (known as 0 -RTT data) in the first flight of a handshake with a server that previously connected to the client. Replayable 0 -RTT data presents several security threats to TLS-using applications unless those applications are specifically engineered to be safe under replay (minimally, an HTTP method that is idempotent, but could require stronger conditions, such as constant -time response). Many applications do not allow 0 -RTT to avoid the replay concern (e.g., draft -ietf-netconf-overtls13). | Analytics             | The discipline that applies logic and mathematics to data to provide insights for event recognition and for making response decisions.

Addressing Visibility Challenges with TLS 1.3 within the Enterprise_ High-Level Document


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Security Assessment?

[Assistant]
According to Transitioning to the Security Content Automation Protocol (SCAP) Version 2:

SCAP is a suite of specifications for expressing, exchanging, and processing security automation content. SCAP content describes what endpoint posture information to collect and how to compare this information against a desired state using implementation-neutral, standardized formats. SCAP tools use these formats to drive the collection and evaluation of posture information to determine if software vulnerabilities and misconfigurations exist on a specific managed endpoint. By identifying endpoints with these problems, organizations can make informed decisions about how to remediate these issues.

No Component-level Interoperability: SCAP v1 products that support different use cases often require similar information, such as software inventory and configuration information. While SCAP v1 supports data interoperability, control of collected posture information and evaluation remains with each tool. The lack of standardized interfaces between tools prevents transport layer interoperability, forces redundant posture information collection and evaluation that adds to system and network load, reduces modularity of solutions, and increases integration costs.

By realizing these design goals, SCAP v2 will support timely endpoint posture collection and evaluation that provides a strong foundation for enabling more advanced cyber defense capabilities and the next generation of security automation solutions.

Transitioning to the Security Content Automation Protocol (SCAP) Version 2


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Services Acquisition?

[Assistant]
According to Guide for Developing Security Plans for Federal Information Systems:

The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology promotes the United States economy and public welfare by providing technical leadership for the Nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof-of-concept implementations, and technical analyses to advance the development and productive use of information technology. ITL's responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of non-national-security-related information in federal information systems. This Special Publication 800 series reports on ITL's research, guidelines, and outreach efforts in information system security and its collaborative activities with industry, government, and academic organizations. | EXECUTIVE SUMMARY.......................................................................................................... | VII                                                                                |
|--------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------|
| 1. INTRODUCTION ........................................................................................................................ | 1                                                                                |
| 1.1 BACKGROUND............................................................................................................................

Guide for Developing Security Plans for Federal Information Systems


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Services Acquisition?

[Assistant]
According to Cryptographic Module Validation Program (CMVP) Security Policy Requirements_ CMVP Validation Authority Updates to ISO_IEC 24759 and ISO_IEC 19790 Anne:

There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may be used by federal agencies even before the completion of such companion publications. Thus, until each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning and transition purposes, federal agencies may wish to closely follow the development of these new publications by NIST.

The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the Nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology. ITL's responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in federal information systems. The Special Publication 800-series reports on ITL's research, guidelines, and outreach efforts in information system security, and its collaborative activities with industry, government, and academic organizations.

Cryptographic Module Validation Program (CMVP) Security Policy Requirements_ CMVP Validation Authority Updates to ISO_IEC 24759 and ISO_IEC 19790 Anne


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 1 require for Audit and Accountability?

IoT Non-Technical Supporting Capability Core Baseline


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Configuration Management?

[Assistant]
According to Guide to Auditing for Controls and Security_ A System Development Life Cycle Approach:

| 3.4.5.1.1 Mission Impact/Strategic Value/Organization | 55 | | | (Business) Criticality and Sensitivity Factors 3.4.5.2 Level II: | (Business) Criticality and Sensitivity Factors 3.4.5.2 Level II: | (Business) Criticality and Sensitivity Factors 3.4.5.2 Level II: | | | | | | | 56 | | | 3.4.5.2.1 | 3.4.5.2.1 | System Size/Scale/Complexity | 56 | | | 3.4.5.2.2 | 3.4.5.2.2 | System Environment/Stability | 57 | | | 3.4.5.2.3 | 3.4.5.2.3 | Reliability/Integrity | 58 | | | 3.4.5.2.4 | 3.4.5.2.4 | Technology Integration | 59 | | 3.5 | RISK SCORING -- APPLICATION OF THE WORK PRIORITY SCHEME | RISK SCORING -- APPLICATION OF THE WORK PRIORITY SCHEME | RISK SCORING -- APPLICATION OF THE WORK PRIORITY SCHEME | 59 | | | 3.5.1 Implementation of the Scheme | 3.5.1 Implementation of the Scheme | 3.5.1 Implementation of the Scheme | 59 | | | 3.5.2 | A Simple Scoring Approach | A Simple Scoring Approach | 60 | | | 3.5.3 | A Detailed Scoring Approach | A Detailed Scoring Approach | 60 | | | 3.5.4 | Discretionary Audits | Discretionary Audits | 60 | | 3.6 | USES OF THE WORK PRIORITY SCHEME | USES

Guide to Auditing for Controls and Security_ A System Development Life Cycle Approach


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Communications Protection?

[Assistant]
According to Secure Software Development Practices for Generative AI and Dual-Use Foundation Models_ An SSDF Community Profile:

- NIST research and publications on trustworthy and responsible AI, including the Artificial Intelligence Risk Management Framework (AI RMF 1.0) [2], Adversarial Machine Learning: A Taxonomy and Terminology of Attacks and Mitigations [3], Towards a Standard for Identifying and Managing Bias in Artificial Intelligence [4], and the Dioptra experimentation testbed for security evaluations of machine learning algorithms [5]. - NIST's Secure Software Development Framework (SSDF) Version 1.1 [6], which is a set of fundamental, sound, and secure software development practices. It provides a common language to help facilitate communications among stakeholders, including software producers and software acquirers. The SSDF has also been used in support of EO 14028, Improving the Nation's Cybersecurity [7], to enhance software supply chain security. - NIST general cybersecurity resources, including The NIST Cybersecurity Framework (CSF) 2.0 [8], Security and Privacy Controls for Information Systems and Organizations [9], and Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations [10]. - AI model developers, AI researchers, AI system developers, and secure software practitioners from industry and government with expertise in the unique security challenges of AI models and the practices for addressing those challenges. This expertise was primarily captured through NIST's January 2024 workshop, where speakers and attendees shared suggestions for adapting secure software development practices and tasks to accommodate the unique aspects of AI model development and the software leveraging them. AI model producers, AI system producers, AI system acquirers, and others can use the SSDF to foster their communications regarding secure AI model development throughout the software development life cycle.

Secure Software Development Practices for Generative AI and Dual-Use Foundation Models_ An SSDF Community Profile


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AT.L2-3.2.2 (NIST 3.2.2)?

[Assistant]
According to Audit and Evaluation of Computer Security II_ System Vulnerabilities and Controls:

3.2.2 Machine Operation                                                                               | 4-10      |
|      |                | 3. 3.2.2 Man-made Hazards                                 | 3. 3.2.2 Machine Operation .

Audit and Evaluation of Computer Security II_ System Vulnerabilities and Controls


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Incident Response Recommendations and Considerations for Cybersecurity Risk Management_ A CSF 2.0 Community Profile provide? (Part 10)

[Assistant]
tiality, or availability of information or an information system; or constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies.
[FISMA2014]

## Examples of incidents include an attacker:

- Employing a botnet to send high volumes of connection requests to an internet-facing service, making it unavailable to legitimate service users
- Obtaining administrative credentials at a software-as-a-service provider, which puts sensitive tenant data entrusted to that provider at risk
- Intruding upon an organization's business network to steal credentials and use them to instruct industrial control systems to shut down or destroy critical physical components, causing a major service disruption
- Deploying ransomware to prevent the use of computer systems and cause multiple data breaches by copying files from those systems
- Using phishing emails to compromise user accounts and using those accounts to commit financial fraud
- Identifying a new vulnerability in network management appliances and exploiting the vulnerability to gain unauthorized access to network communications
- Compromising a vendor's software, which is subsequently distributed to customers in its compromised state

Because of the damage that cybersecurity incidents can inflict on organizations and their customers, business partners, and others, it is vital to respond quickly and effectively when an incident occurs. Effective implementation of incident response processes enables systematic responses to and recovery from incidents by analyzing information and taking appropriate action. This reduces cybersecurity and enterprise risks by minimizing data loss or theft, the disruption of services, and the overall impact of incidents.

Incident Response Recommendations and Considerations for Cybersecurity Risk Management_ A CSF 2.0 Community Profile


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Information Integrity?

[Assistant]
According to Digital Identity Guidelines:

Cybersecurity, Fraud, and Identity Program Integrity . . . . . . . . . . .

1.3.1.
It is increasingly important for organizations to assess and manage digital identity
security risks, such as unauthorized access due to impersonation. As organizations
consult these guidelines, they should consider potential impacts to the confidentiality,
integrity, and availability of information and information systems that they manage, and

The exact nature of the interaction is important in determining the overall security
of the system. Well-designed protocols protect the integrity and confidentiality of
communication between the claimant and the verifier both during and after the
authentication and can help limit the damage done by an attacker masquerading as a
legitimate verifier (i.e., phishing).


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for System and Information Integrity?

[Assistant]
According to Assessing Enhanced Security Requirements for Controlled Unclassified Information:

| ASSESSMENT PROCEDURES................................................................................................................
| 3   |
| 2.2                                                                                | ASSURANCE CASES.............................................................................................................................. | 4   |
| CHAPTER THREE THE PROCEDURES............................................................................................... | CHAPTER THREE THE PROCEDURES............................................................................................... | 7   |
| 3.1                                                                                | ACCESSCONTROL ............................................................................................................................... | 8   |
| 3.2                                                                                | AWARENESSANDTRAINING............................................................................................................... | 9   |
| 3.3                                                                                | AUDIT ANDACCOUNTABILITY........................................................................................................... | 10  |
| 3.4                                                                                | CONFIGURATION MANAGEMENT.....................................................................................................

Assessing Enhanced Security Requirements for Controlled Unclassified Information


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for Personnel Security?

[Assistant]
According to Assessing Enhanced Security Requirements for Controlled Unclassified Information:

| CHAPTERONE INTRODUCTION...................................................................................................... | CHAPTERONE INTRODUCTION...................................................................................................... | 1   |
|-----------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------|-----|
| 1.1                                                                                | PURPOSEANDAPPLICABILITY............................................................................................................. 1        | 2   |
| 1.2                                                                                | TARGET AUDIENCE.............................................................................................................................. |     |
| 1.3                                                                                | ORGANIZATIONOF THIS SPECIAL PUBLICATION................................................................................. | 2   |
| CHAPTERTWO THE FUNDAMENTALS............................................................................................ | CHAPTERTWO THE FUNDAMENTALS............................................................................................ | 3   |
| 2.1                                                                                | ASSESSMENT PROCEDURES................................................................................................................


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What guidance does Digital Identity Guidelines provide?

[Assistant]
NIST Special Publication
NIST SP 800-63-4

Digital Identity Guidelines

David Temoshok
Diana Proud-Madruga
Yee-Yin Choong
Ryan Galluzzo
Sarbari Gupta
Connie LaSalle
Naomi Lefkovitz
Andrew Regenscheid

This publication is available free of charge from:
https://doi.org/10.6028/NIST.SP.800-63-4

NIST Special Publication
NIST SP 800-63-4

Digital Identity Guidelines

David Temoshok
Ryan Galluzzo
Connie LaSalle
Naomi Lefkovitz *
Applied Cybersecurity Division
Information Technology Laboratory

Andrew Regenscheid
Computer Security Division
Information Technology Laboratory

Yee-Yin Choong
Information Access Division
Information Technology Laboratory

Diana Proud-Madruga
Sarbari Gupta
Electrosoft

* Former NIST employee; all work for this publication was done while at NIST. This publication is available free of charge from:
https://doi.org/10.6028/NIST.SP.800-63-4

July 2025

National Institute of Standards and Technology
Craig Burkhardt, Acting Under Secretary for Standards and Technology and Acting NIST Director

U.S. Department of Commerce
Howard Lutnick, Secretary

Certain equipment, instruments, software, or materials, commercial or non-commercial,
are identified in this paper in order to specify the experimental procedure adequately. Such identification does not imply recommendation or endorsement of any product
or service by NIST, nor does it imply that the materials or equipment identified are
necessarily the best available for the purpose. There may be references in this publication to other publications currently under
development by NIST in accordance with its assigned statutory responsibilities. The
information in this publication, including concepts and methodologies, may be used by
federal agencies even before the completion of such companion publications. Thus, until
each publication is completed, current requirements, guidelines, and procedures, where
they exist, remain operative.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Identification and Authentication?

[Assistant]
According to Guide to a Secure Enterprise Network Landscape:

Authentication Infrastructure...............................................................................6 | 2.4 Limitation of Authentication Infrastructure...............................................................................6 | 2.4 Limitation of Authentication Infrastructure...............................................................................6 | | Network Security Appliances in the Enterprise Network Landscape ............................8 | Network Security Appliances in the Enterprise Network Landscape ............................8 | | | Cloud Access Security Broker (CASB)..........................................................................8 | Cloud Access Security Broker (CASB)..........................................................................8 | | | Enhanced Firewall Capabilities | Enhanced Firewall Capabilities | .....................................................................................8 | | Appliance-set with Integrated Functions | Appliance-set with Integrated Functions | .....................................................................10 | | Network Security Automation Tools | Network Security Automation Tools | ............................................................................11 | | 3.4.1.

Guide to a Secure Enterprise Network Landscape


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Physical Protection?

[Assistant]
According to Guide to Enterprise Patch Management Planning_ Preventive Maintenance for Technology:

The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the Nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology. ITL's responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in federal information systems. The Special Publication 800-series reports on ITL's research, guidelines, and outreach efforts in information system security, and its collaborative activities with industry, government, and academic organizations. 2 OT refers to 'programmable systems or devices that interact with the physical environment (or manage devices that interact with the physical environment). These systems/devices detect or cause a direct change through the monitoring and/or control of devices, processes, and events. Examples include industrial control systems, building management systems, fire control systems, and physical access control mechanisms.' [from NIST SP 800-37 Rev. 2]

Organizations should establish and constantly maintain up-to-date software inventories for their physical and virtual computing assets, including OT, IoT, and container assets. This information could be in a single enterprise asset inventory, or it could be split among multiple resources. While a comprehensive inventory of all assets is ideal, it may be impossible to achieve, given the highly dynamic nature of assets and software. A realistic goal is to maintain a close-to-comprehensive inventory by relying on automation to constantly discover new assets and collect up-to-date information on all assets.

Guide to Enterprise Patch Management Planning_ Preventive Maintenance for Technology


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Physical Protection?

[Assistant]
According to Risk Management Framework for Information Systems and Organizations_ A System Life Cycle Approach for Security and Privacy:

The National Institute of Standards and Technology (NIST) Information Technology Laboratory (ITL) promotes the U.S. economy and public welfare by providing technical leadership for the Nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology (IT). ITL's responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the costeffective security of other than national security-related information in federal information systems. The Special Publication 800-series reports on ITL's research, guidelines, and outreach efforts in information systems security and privacy and its collaborative activities with industry, government, and academic organizations. All  information  systems  process,  store,  or  transmit  some  type  of  information. For  example, information about the temperature in a remote facility collected and transmitted by a sensor to a monitoring station, location coordinates transmitted by radio to a controller on a weapons system, photographic images transmitted by a remote camera (land/satellite-based) to a server, or health IT devices transmitting patient information via a hospital network, require protection. This information can be protected by: categorizing the information to determine the impact of loss; assessing whether the processing of the information could impact individuals' privacy; and selecting and implementing controls that are applicable to the IT resources in use. Therefore, cloud-based  systems,  industrial/process  control  systems,  weapons  systems,  cyber-physical systems, applications, IoT devices, or mobile devices/systems, do not require a separate risk management process but rather a tailored set of controls and specific implementation details determined by applying the existing RMF process.

Risk Management Framework for Information Systems and Organizations_ A System Life Cycle Approach for Security and Privacy


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AC.L2-3.1.4 (NIST 3.1.4)?

[Assistant]
According to Digital Identity Guidelines_ Authentication and Authenticator Management:

3.1.4. 3.1.4): A one-time secret obtained

from a device or application held by the subscriber

• Multi-factor OTP (Sec. 3.1.4)

• Single-factor cryptographic authentication (Sec.

Digital Identity Guidelines_ Authentication and Authenticator Management


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Security and Privacy Controls for Information Systems and Organizations provide? (Part 7)

[Assistant]
s

i

p
u
b

l
i

c
a

t
i

o
n

i

s

a
v
a

i
l

l

a
b
e
f
r
e
e
o
f

c
h
a
r
g
e
f
r
o
m

:

h
t
t
p
s
:
/
/
d
o
i
. o
r
g
/
1
0
. 6
0
2
8
/
N
S
T
S
P
. 8
0
0
-
5
3
r
5

. I

NIST SP 800-53, REV.
5                                                                                SECURITY AND PRIVACY CONTROLS FOR INFORMATION SYSTEMS AND ORGANIZATIONS
_________________________________________________________________________________________________

In addition to the above acknowledgments, a special note of thanks goes to Jeff Brewer, Jim
Foti, and the NIST web team for their outstanding administrative support. The authors also wish
to recognize Kristen Baldwin, Carol Bales, John Bazile, Jennifer Besceglie, Sean Brooks, Ruth
Cannatti, Kathleen Coupe, Keesha Crosby, Charles Cutshall, Ja’Nelle DeVore, Jennifer Fabius, Jim
Fenton, Hildy Ferraiolo, Ryan Galluzzo, Robin Gandhi, Mike Garcia, Paul Grassi, Marc Groman,
Matthew Halstead, Kevin Herms, Scott Hill, Ralph Jones, Martin Kihiko, Raquel Leone, Jason
Marsico, Kirsten Moncada, Ellen Nadeau, Elaine Newton, Michael Nieles, Michael Nussdorfer,
Taylor Roberts, Jasmeet Seehra, Joe Stuntz, Jeff Williams, the professional staff from the NIST
Computer Security Division and Applied Cybersecurity Division, and the representatives from
the Federal CIO Council, Federal CISO Council, Federal Privacy Council, Control Baseline
Interagency Working Group, Security and Privacy Collaboration Working Group, and Federal
Privacy Council Risk Management Subcommittee for their ongoing contributions in helping to
improve the content of the publication. Finally, the authors gratefully acknowledge the
contributions from individuals and organizations in the public and private sectors, both
nationally and internationally, whose insightful and constructive comments improved the
overall quality, thoroughness, and usefulness of this publication.

Security and Privacy Controls for Information Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Security Assessment?

[Assistant]
According to Protecting Information and System Integrity in Industrial Control System Environments_ Cybersecurity for the Manufacturing Sector:

This practice guide documents the approach the NCCoE used to develop example solutions, called builds, to support information and system integrity objectives. The approach includes a logical design, example build development, testing, security control mapping, and analysis.

## 5.2 Example Solution Testing

This section presents a summary of the solution testing and results. A total of eleven tests were developed for the builds. The following information is provided for each scenario:

Protecting Information and System Integrity in Industrial Control System Environments_ Cybersecurity for the Manufacturing Sector


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Identification and Authentication?

[Assistant]
According to A Zero Trust Architecture Model for Access Control in Cloud-Native Applications in Multi-Cloud Environments:

| Executive Summary.................................................................................................................
1                                   | Executive Summary................................................................................................................. 1                                   |
|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Introduction ...................................................................................................................... | Introduction ...................................................................................................................... | 2                                                                                |
|                                                                                | Background - Zero Trust Principles and Zero Trust Architecture................................

A Zero Trust Architecture Model for Access Control in Cloud-Native Applications in Multi-Cloud Environments


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Information Integrity?

[Assistant]
According to Contingency Planning Guide for Federal Information Systems:

| | 4.3.2 | Recovery Procedures....................................................................................39 | | |---------------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------| | | 4.3.3 Recovery Escalation and Notification ............................................................40 | 4.3.3 Recovery Escalation and Notification ............................................................40 | | | 4.4 | Reconstitution Phase................................................................................................41 | Reconstitution Phase................................................................................................41 | | | 4.5 | Plan Appendices.......................................................................................................42 | Plan Appendices.......................................................................................................42 | | | Chapter 5.

Contingency Planning Guide for Federal Information Systems


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Audit and Evaluation of Computer Security provide? (Part 5)

[Assistant]
tion for such activities and programs. This publication
series will report these NBS efforts to the Federal computer community as well as to
interested specialists in the academic and private sectors.
Those wishing to receive
notices of publications in this series should complete and return the form at the end
of this publication. National Bureau of Standards Special Publication 500-19

Nat. Bur. Stand. (U.S.), Spec. Publ. 500-19, 256 pages (Oct. 1977)
CODEN: XNBSAV

Library of Congress Catalog Card Number: 77-600045

U.S. GOVERNMENT PRINTING OFFICE
WASHINGTON: 1977

For sale by the Superintendent of Documents, U.S. Government Printing Office, Washington, D.C. 20402
Price $4—Stock No. 003-003-01848-1

. FOREWORD

The increasing use of computers by Government and private organiza-
tions for the storage and manipulation of records of all kinds— personal
as well as of a business nature— has placed computers and the systems in
which they reside in an extremely sensitive position in our society. The
needs of the individual as well as Government and private organizations
require that this data and their resident systems be accurate and reli-
able. given adequate protection from threats and hazards. The establishment of
secure computer systems is the way in which the computer community as-
sures the users of such systems that all of these requirements are being
met

These needs also require that this data and these systems be

The auditing and evaluating of computer systems for adequate secu-

Controls that provide computer security are of interest to both

rity has been a natural outgrowth of this widening interest in this
area. the financial and internal auditors and has been made a subject of spe-
cial consideration by organizations such as the Institute of Internal
Auditors, the American Institute of Certified Public Accountants, and
the EDP Auditors Associtation. The National Bureau of Standards, with the support of the U.S.

Audit and Evaluation of Computer Security


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Personnel Security?

[Assistant]
According to Federal Cybersecurity Awareness Programs_ A Mixed Methods Research Study:

n M, Hash J (2003) Building an Information Technology Security Awareness and Training Program. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) 800-50.
https://doi.org/10.6028/NIST.SP.800-50                                                                           |
| [WOELK]   | Woelk, B (2015) The Successful Security Awareness Professional: Foundational Skills and Continuing Education Strategies. EDUCAUSE Center for Analysis and Research . Available at https://library.educause.edu/~/media/files/library/2016/8/ erb1608.pdf                                                                       |

Federal Cybersecurity Awareness Programs_ A Mixed Methods Research Study


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does High-Performance Computing Security_ Architecture, Threat Analysis, and Security Posture provide? (Part 4)

[Assistant]
ble at https://csrc.nist.gov/pubs/sp/800/223/final, including related content, potential updates, and document history. All comments are subject to release under the Freedom of Information Act (FOIA).
## Abstract

Security is essential component of high-performance computing (HPC). HPC systems often differ based on the evolution of their system designs, the applications they run, and the missions they support. An HPC system may also have its own unique security requirements, follow different security guidance, and require tailored security solutions. Their complexity and uniqueness impede the sharing of security solutions and knowledge. This NIST Special Publication aims to standardize and facilitate the information and knowledge-sharing of HPC security using an HPC system reference architecture and key components as the basis of an HPC system lexicon. This publication also analyzes HPC threats, considers current HPC security postures and challenges, and makes best-practice recommendations. ## Keywords

high-performance computing; HPC reference architecture; HPC security; HPC security posture; HPC threat analysis; security guidance. ## Reports on Computer Systems Technology

The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the Nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology. ITL's responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in federal information systems.

High-Performance Computing Security_ Architecture, Threat Analysis, and Security Posture


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Physical Protection?

[Assistant]
According to Security and Privacy Controls for Information Systems and Organizations:

s of computing platforms, including
general  purpose  computing  systems,  cyber-physical  systems,  cloud  systems,  mobile  systems,
industrial control systems, and Internet of Things (IoT) devices.
Safeguarding measures include
both security and privacy controls to protect the critical and essential operations and assets of
organizations and the privacy of individuals. The objective is to make the systems we depend on
more penetration resistant to attacks, limit the damage from those attacks when they occur,
and make the systems resilient, survivable, and protective of individuals’ privacy.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] How does Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171 support CMMC certification?

[Assistant]
According to Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171:

## NIST Special Publication 800-172

## Enhanced Security Requirements for Protecting Controlled Unclassified Information

A Supplement to NIST Special Publication 800-171

RON ROSS VICTORIA PILLITTERI GARY GUISSANIE RYAN WAGNER RICHARD GRAUBART

DEB BODEAU

This publication is available free of charge from:

https://doi.org/10.6028/NIST.SP.800-172

<!-- image -->

## NIST Special Publication 800-172

## Enhanced Security Requirements for Protecting Controlled Unclassified Information

A Supplement to NIST Special Publication 800-171

## RON ROSS VICTORIA PILLITTERI

Computer Security Division

National Institute of Standards and Technology

## GARY GUISSANIE RYAN WAGNER

Institute for Defense Analyses

RICHARD GRAUBART DEB BODEAU

The MITRE Corporation

This publication is available free of charge from:

https://doi.org/10.6028/NIST.SP.800-172

## February 2021

<!-- image -->

U.S. Department of Commerce Wynn Coggins, Acting Secretary

National Institute of Standards and Technology James K. Olthoff, Performing the Non-Exclusive Functions and Duties of the Under Secretary of Commerce for Standards and Technology & Director, National Institute of Standards and Technology

\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

## Authority

This publication has been developed by NIST to further its statutory responsibilities under the Federal Information Security Modernization Act (FISMA), 44 U.S.C. § 3551 et seq. , Public Law (P.L.) 113-283. NIST is responsible for developing information security standards and guidelines, including minimum requirements for federal information systems, but such standards and guidelines shall not apply to national security systems without the express approval of the appropriate federal officials exercising policy authority over such systems.

Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Supply Chain Risk Management?

[Assistant]
According to Digital Identity Guidelines_ Authentication and Authenticator Management:

• The provenance (e.g., manufacturer or supplier certification), health, and integrity


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Identification and Authentication?

[Assistant]
According to Guide to Enterprise Patch Management Planning_ Preventive Maintenance for Technology:

| Purpose and Scope ........................................................................................
| 1                                                                                |
|                                                                                | 1.2                                                                                | Changes from Previous Versions.................................................................... | 1                                                                                |
|                                                                                | 1.3                                                                                | Publication Structure.......................................................................................


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Supply Chain Risk Management?

[Assistant]
According to Incident Response Recommendations and Considerations for Cybersecurity Risk Management_ A CSF 2.0 Community Profile:

- Technology professionals. Cybersecurity, privacy, system, network, cloud, and other technology architects, engineers, and administrators, as well as software developers, may be involved in incident response and recovery efforts. - Legal. Legal experts can review incident response plans, policies, and procedures to ensure compliance with applicable laws and regulations, including the right to privacy. Legal experts can also review contracts with technology suppliers and other third parties when there are incident response implications. In addition, incident responders can seek guidance from their organization's legal department if a particular incident may have legal ramifications, such as the prosecution of a suspect, lawsuits, or situations that require a memorandum of understanding (MOU) or other binding agreement. - Public affairs and media relations. Depending on the nature and impact of an incident, it may be necessary to inform the media and, by extension, the public. Sometimes, the media learns of incidents through alternate sources (i.e., not through public affairs personnel). Having a media engagement strategy in place can greatly aid in this situation.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Guidelines for the Use of PIV Credentials in Facility Access provide? (Part 3)

[Assistant]
h  to  closely  follow  the  development  of  these  new publications by NIST. Organizations are encouraged to review all draft publications during public comment periods and provide feedback to NIST.
Many NIST cybersecurity publications, other than the ones noted above, are available at https://csrc.nist.gov/publications. ## Comments on this publication may be submitted to:

National Institute of Standards and Technology Attn: Computer Security Division, Information Technology Laboratory 100 Bureau Drive (Mail Stop 8930) Gaithersburg, MD 20899-8930 Email: piv\_comments@nist.gov

All comments are subject to release under the Freedom of Information Act (FOIA). ## Reports on Computer Systems Technology

The  Information  Technology  Laboratory  (ITL)  at  the  National  Institute  of  Standards  and Technology  (NIST)  promotes  the  U.S. economy  and  public  welfare  by  providing  technical leadership  for  the  Nation's  measurement  and  standards  infrastructure. ITL  develops  tests,  test methods, reference data, proof of concept implementations, and technical analyses to advance the development  and  productive  use  of  information  technology. ITL's  responsibilities  include  the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in federal information systems. The Special Publication 800-series reports on ITL's research, guidelines, and outreach  efforts  in  information  system  security,  and  its  collaborative  activities  with  industry, government, and academic organizations. ## Abstract

This recommendation provides a technical guideline to use Personal Identity Verification (PIV) Cards in facility access; enabling federal agencies to operate as government-wide interoperable enterprises.

Guidelines for the Use of PIV Credentials in Facility Access


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for System and Communications Protection?

[Assistant]
According to Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171:

| CHAPTERONE INTRODUCTION...................................................................................................... | CHAPTERONE INTRODUCTION...................................................................................................... |
|--------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------|
| 1.1 PURPOSEANDAPPLICABILITY                                                                                | ................................................................................................... 3                                            |
| 1.2 TARGET AUDIENCE                                                                                | .................................................................................................................. 4                             |
| 1.3 ORGANIZATIONOF THIS SPECIAL PUBLICATION                                                                                | .......................................................................... 4                                                                     |
| CHAPTERTWO THE FUNDAMENTALS............................................................................................ 5                        | CHAPTERTWO THE FUNDAMENTALS............................................................................................ 5                        |
| 2.1 DEVELOPMENTAPPROACH ......................................................................................................


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Communications Protection?

[Assistant]
According to Addressing Visibility Challenges with TLS 1.3 within the Enterprise_ High-Level Document:

..................................................................... | 5.4 Specific Details ...........................................................................................................
| 29                                                                          |
|------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------|
| 6                                                                                | Functional Demonstrations...............................................................30                                         | Functional Demonstrations...............................................................30                                         | Functional Demonstrations...............................................................30                                         |                                                                             |
|                                                                                | 6.1                                                                                | Usage Scenarios Supported ....................................................................................... | Usage Scenarios Supported .......................................................................................

Addressing Visibility Challenges with TLS 1.3 within the Enterprise_ High-Level Document


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Guidelines on Mobile Device Forensics provide? (Part 5)

[Assistant]
ochester Institute of Technology and Daren Melson for their assistance on technical issues that arose in our work. The authors would also like to thank all others who assisted with our review process.
| Table of Contents                                                                                | Table of Contents                                                                                | Table of Contents                                                                                |
|----------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------|
| TABLE OFCONTENTS.............................................................................................................V         | TABLE OFCONTENTS.............................................................................................................V         |                                                                                |
| LIST OF FIGURES....................................................................................................................VII | LIST OF FIGURES....................................................................................................................VII |                                                                                |
| LIST OFTABLES....................................................................................................................


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Contingency Planning Guide for Federal Information Systems provide? (Part 6)

[Assistant] | | Introduction ....................................................................................................1 | | |-----------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------| | 1.1 | | Purpose.......................................................................................................................1 | | | 1.2 | | Scope..........................................................................................................................2 | | | 1.3 | | Audience.....................................................................................................................3 | | | 1.4 | Document | Structure....................................................................................................4 | | | Chapter 2.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice IR.L2-3.6.1 (NIST 3.6.1)?

[Assistant]
According to Validating the Integrity of Computing Devices:

3.6.1                                                                                | Trusted Computing Group... 3.6.1 Trusted Computing Group

The technology providers for this prototype implement standards from the TCG, a not-for-profit organization formed to develop, define, and promote open, vendor-neutral, global industry standards supportive of hardware-based roots of trust for interoperable trusted computing platforms. 3.6.1.

Validating the Integrity of Computing Devices


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What are the CMMC Level 2 requirements?

[Assistant]
According to Profile of the IoT Core Baseline for Consumer IoT Products:

may wish to closely follow the development of these new publications by NIST. Organizations are encouraged to review all draft publications during public comment periods and provide feedback to NIST.
Many NIST cybersecurity publications, other than the ones noted above, are available at https://csrc.nist.gov/publications. ## NIST Technical Series Policies

Copyright, Fair Use, and Licensing Statements NIST Technical Series Publication Identifier Syntax

## Publication History

Approved by the NIST Editorial Review Board on 2022-09-08

## How to Cite this NIST Technical Series Publication:

Fagan M, Megas KN, Watrobski P, Marron J, Cuthill B (2022) Profile of the IoT Core Baseline for Consumer IoT Products. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Interagency or Internal Report (IR) NIST IR 8425. https://doi.org/10.6028/NIST.IR.8425

## Author ORCID iDs

Michael Fagan: 0000-0002-1861-2609

Katerina N. Megas: 0000-0002-2815-5448

Paul Watrobski: 0000-0002-6449-3030

Jeffrey Marron: 0000-0002-7871-683X

Barbara B. Cuthill: 0000-0002-2588-6165

## Contact Information

iotsecuirty@nist.gov

National Institute of Standards and Technology Attn: Applied Cybersecurity Division, Information Technology Laboratory 100 Bureau Drive (Mail Stop 2000) Gaithersburg, MD 20899-2000

All comments are subject to release under the Freedom of Information Act (FOIA). ## Reports on Computer Systems Technology

The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the Nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology.

Profile of the IoT Core Baseline for Consumer IoT Products


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Information Integrity?

[Assistant]
According to NIST Cybersecurity Framework 2.0_ Quick-Start Guide for Cybersecurity Supply Chain Risk Management (C-SCRM):

- Risk Assessment: The authenticity and integrity of hardware and software are assessed prior to acquisition and use [ID.RA-09]; Critical suppliers are assessed prior to acquisition [ID.RA-10] - Improvement: Improvements are identified from security tests and exercises, including those done in coordination with suppliers and relevant third parties [ID.IM-02] - Incident Recovery Plan Execution: The integrity of backups and other restoration assets is verified before using them for restoration [RC.RP-03] - Incident Recovery Communication: Recovery activities and progress in restoring operational capabilities are communicated to designated internal and external stakeholders [RC.CO-03] | Selected CSF Outcomes | Target Priority | Target Internal Practices | Selected Informative References | |------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------| | PR.PS, The hardware, software (e.g., firmware, operating systems, applications), and services of physical and virtual platforms are managed consistent with the organization's risk strategy to protect their confidentiality, integrity, and availability | High | 1.

NIST Cybersecurity Framework 2.0_ Quick-Start Guide for Cybersecurity Supply Chain Risk Management (C-SCRM)


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Physical Protection?

[Assistant]
According to Guidelines on Mobile Device Forensics:

The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the Nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology. ITL's responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in Federal information systems. The Special Publication 800-series reports on ITL's research, guidelines, and outreach efforts in information system security, and its collaborative activities with industry, government, and academic organizations. Different  mobile  devices  have  different  technical  and  physical  characteristics  (e.g.,  size, weight, processor speed, memory capacity). Mobile devices may also use different types of expansion capabilities to provide additional functionality. Furthermore, mobile device capabilities  sometimes  include  those  of  other  devices  such  as  handheld  Global  Positioning Systems (GPS), cameras (still and video) or personal computers. Overall, mobile devices can be classified as feature phones that are primarily simple voice and messaging communication devices  or  smartphones  that  offer  more  advanced  capabilities  and  services  for  multimedia, similar to those of a personal computer. Table 1 highlights the general hardware characteristics of feature and smartphone models, which underscore this diversity. A UICC can contain up to three applications: SIM, USIM and CSIM. UICCs used in GSM and UMTS mobile devices use the SIM and UMTS SIM (USIM) applications, while CDMA devices  use the  CSIM  application.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AC.L2-3.1.6 (NIST 3.1.6)?

[Assistant]
According to Digital Identity Guidelines_ Authentication and Authenticator Management:

3.1.6. 3.1.6): Proof of possession

and control via an authentication protocol of a cryptographic key held by the
subscriber

• Multi-factor cryptographic authentication (Sec. 3.1.6)

6

NIST SP 800-63B-4
July 2025

Digital Identity Guidelines
Authentication and Authenticator Management

A biometric characteristic is not recognized as an authenticator
by itself.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Risk Assessment?

[Assistant]
According to Control Baselines for Information Systems and Organizations:

Organizations must exercise due diligence in managing information security and privacy risk. This is accomplished, in part, by establishing a comprehensive risk management program that uses the flexibility inherent in NIST publications to categorize systems, select and implement security and  privacy  controls  that  meet  mission  and  business  needs,  assess  the  effectiveness  of  the controls, authorize the systems for operation, and continuously monitor the systems. Exercising due diligence and implementing robust and comprehensive information security and privacy risk management programs can facilitate compliance with applicable laws, regulations, executive orders,  and  government-wide  policies. Risk  management  frameworks  and  risk  management processes are essential in developing, implementing, and maintaining the protection measures necessary to address stakeholder needs and the current threats to organizational operations and  assets,  individuals,  other  organizations,  and  the  Nation. Employing  effective  risk-based processes,  procedures,  methods,  and  technologies  ensures  that  information  systems  and organizations have the necessary trustworthiness and resiliency to support essential mission and business functions, the U.S. critical infrastructure, and continuity of government. '…The Task Force notes that the cyber threat to U.S. critical infrastructure is outpacing efforts to reduce pervasive vulnerabilities, so that for the next decade at least the United States must lean significantly on deterrence to address the cyber threat posed by the most capable U.S. adversaries. It is clear that a more proactive and systematic approach to U.S. cyber deterrence is urgently needed…'

The security and privacy controls specified in the baselines represent the state-of-the-practice protection measures for individuals, information systems, and organizations.

Control Baselines for Information Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Protecting Information and System Integrity in Industrial Control System Environments_ Cybersecurity for the Manufacturing Sector provide? (Part 3)

[Assistant]
r operational technology (OT) systems to their information technology (IT) systems to enable and expand enterprise-wide connectivity and remote access for enhanced business processes and capabilities.
Although the integration of IT and OT networks is helping manufacturers boost productivity and gain efficiencies, it has also provided malicious actors, including nation states, common criminals, and insider threats a fertile landscape where they can exploit cybersecurity vulnerabilities to compromise the integrity of ICS and ICS data to reach their end goal. The motivations behind these attacks can range from degrading manufacturing capabilities to financial gain, and causing reputational harm. Once malicious actors gain access, they can harm an organization by compromising data or system integrity, hold ICS and/or OT systems ransom, damage ICS machinery, or cause physical injury to workers. The statistics bear this out. The X-Force Threat Intelligence Index 2021 (ibm.com) stated that manufacturing was the second-most-attacked industry in 2020, up from eighth place in 2019. One particular case study illustrates the long-lasting effects and damage a single cyber attack can inflict on an organization. It was reported that a global pharmaceutical manufacturer suffered a cyber attack that caused temporary production delays at a facility making a key vaccination. More than 30,000 laptop and desktop computers, along with 7,500 servers, sat idle. Although the company claimed that its operations were back to normal within six months of the incident; at this writing, news reports stated that the organization is locked in a legal battle with its insurers and is looking to reclaim expenses that include repairing its computer networks and the costs associated with interruptions to its operations. They are seeking more than $1.3 billion in damages.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice CM.L2-3.4.4 (NIST 3.4.4)?

[Assistant]
According to Guide to Malware Incident Prevention and Handling for Desktops and Laptops:

3.4.4                                                                                | Content Filtering/Inspection... 3.4.4 Content Filtering/Inspection

Organizations should use content inspection and filtering technologies for stopping email-based malware threats.

Guide to Malware Incident Prevention and Handling for Desktops and Laptops


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Digital Identity Guidelines provide? (Part 8)

[Assistant]
. . . . . . . . . . . . . . . . . . . . . . . . . . . . List of Tables
Table 1. Table 2. Table 3. Table 4. IAL Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . AAL Summary . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . FAL Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Performance Metrics . . . . . . . . . . . . . . . . . . . . . . . . . . . 33

33

38

40

41

42

44

44

45

46

47

47

50

50

51

52

54

57

62

85

85

85

85

86

35
36
37
47

iv

NIST SP 800-63-4
July 2025

Digital Identity Guidelines

List of Figures
Fig. 1. Fig. 2. Fig. 3. Fig. 4. Fig. 5. Fig. 6. . . . . . Sample Identity Proofing and Enrollment Digital Identity Model
Sample Authentication Process
. . . . . . . . . . . . . . . . . . . . . . Non-Federated Digital Identity Model Example . . . . . . . . . . . . . . Federated Digital Identity Model Example . . . . . . . . . . . . . . . . . Federated Digital Identity Model with Subscriber-Controlled Wallet Exam-
ple . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . High-level diagram of the Digital Identity Risk Management Process Flow

11
13
16
17

19
25

v

NIST SP 800-63-4
July 2025

Preface

Digital Identity Guidelines

This publication and its companion volumes — [SP800-63A], [SP800-63B], and
[SP800-63C] — provide technical and process guidelines to organizations for the
implementation of digital identity services. Acknowledgments

The authors would like to thank their fellow collaborators — Christine Abruzzi, James
L. Fenton, Justin P. Richer, and Maria Vachino — on the current revision of this special
publication, as well as Kerrianne Buchanan and Evelyn Petrella for their contributions
and review. The authors would also like to acknowledge the past contributions of Donna
F. Dodson, Elaine M. Newton, Ray A. Perlner, W. Timothy Polk, Emad A. Nabbus, Paul A. Grassi, Michael E.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Planning for a Zero Trust Architecture_ A Planning Guide for Federal Administrators provide? (Part 2)

[Assistant]
IST,  the  Information Technology  Laboratory  (ITL)  and  Communications  Technology  Laboratory  (CTL)  is  also available. Zero trust related information is also found on the zero trust topic page.
Submit comments on this publication to: zerotrust-arch@nist.gov

National Institute of Standards and Technology Attn: Wireless Networks Division, Communications Technology Laboratory 100 Bureau Drive (Mail Stop 8920) Gaithersburg, MD 20899-8920

All comments are subject to release under the Freedom of Information Act (FOIA). ## Acknowledgments

The author would like to thank the members of the NIST Risk Management Framework team and the Zero Trust Architecture project team for their input and review. ## Audience

This document was written to help enterprise administrators, system operators and IT security officers understand how the various roles and tasks in the NIST Risk Management Framework (RMF) can be used when moving to a zero trust architecture. This document briefly introduces zero trust, and how the RMF process can be used in a zero trust migration process. It is assumed that the reader is familiar with the concepts of zero trust as described in NIST SP 800-207 and has had exposure to federal information security practices. ## Trademark Information

All registered trademarks or trademarks belong to their respective organizations.

Planning for a Zero Trust Architecture_ A Planning Guide for Federal Administrators


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Physical Protection?

[Assistant]
According to Multi-Factor Authentication for Criminal Justice Information Systems_ Implementation Considerations for Protecting Criminal Justice Information:

The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the Nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology. ITL's responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of information other than national security-related information in federal information systems.

Caution: What makes phishing attacks so dangerous is the way they can bypass physical and network security protections. Simply sending a phishing email to an employee of a target agency could result in the attacker gaining legitimate credentials and using them to access agency systems, potentially including CJI. Phishing attacks do not require physical access to buildings, servers, or data, nor do they require hacking or intrusion. Instead, phishing attacks rely upon tricking users into giving up valid user credentials, effectively letting the attacker through the 'front door . ' Phishing-resistant MFA is the best defense against these attacks. Although phishing resistance is an optional requirement at AAL2, it is recommended that agencies implement phishing-resistant MFA at AAL2, given the prevalence of phishing attacks.

Multi-Factor Authentication for Criminal Justice Information Systems_ Implementation Considerations for Protecting Criminal Justice Information


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Guidelines for Media Sanitization provide? (Part 6)

[Assistant]
....................16         |
| Media Sanitization Program .........................................................................................................18              |
| 4. |
| 4.3.1.
Information Decisions in the System Life Cycle..........................................................................20                   |
| 4.3.2. Determination of Security Categorization..................................................................................21                 |
| 4.3.3. Reuse of Media...........................................................................................................................22  |
| 4.3.4. Control of Media ........................................................................................................................22  |
| 4.3.5. Data Protection Level .................................................................................................................23    |
| 4.3.6. Sanitization and Disposal Decision.............................................................................................23            |

| 4.5.1. Sanitization Verification .............................................................................................................24         |                                                                                |
|----------------------------------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------|
| 4.5.2. Sanitization Validation................................................................................................................24         |                                                                                |
| 4.7.1.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AT.L2-3.2.1 (NIST 3.2.1)?

[Assistant]
According to Contingency Planning Guide for Federal Information Systems:

3.2.1                                                                                | Determine Business Processes and Recovery Criticality... 3.2.1 Determine Business Processes and Recovery Criticality

An information system can be very complex and often supports multiple mission/business processes, resulting in different perspectives on the importance of system services or capabilities.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Audit and Accountability?

[Assistant]
According to The Federal Cybersecurity Awareness Workforce_ Professional Backgrounds, Knowledge, Skills, and Development Activities:

| 1 INTRODUCTION.................................................................................................................
1                                                                                | 1 INTRODUCTION................................................................................................................. 1                                                                                |
| 2 REPORTING CONVENTIONS.......................................................................................... 2                                                                                | 2 REPORTING CONVENTIONS.......................................................................................... 2                                                                                | 2 REPORTING CONVENTIONS.......................................................................................... 2                                                                                |
| 3 PROFESSIONAL DEMOGRAPHICS............................................................................... 3                                                                                | 3 PROFESSIONAL DEMOGRAPHICS............................................................................... 3                                                                                | 3 PROFESSIONAL DEMOGRAPHICS...............................................................................

The Federal Cybersecurity Awareness Workforce_ Professional Backgrounds, Knowledge, Skills, and Development Activities


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Guide to Malware Incident Prevention and Handling for Desktops and Laptops provide? (Part 2)

[Assistant]
er statutory authority. Nor should these guidelines be interpreted as altering or superseding the existing authorities of the Secretary of Commerce, Director of the OMB, or any other Federal official.
This publication may be used by nongovernmental organizations on a voluntary basis and is not subject to copyright in the United States. Attribution would, however, be appreciated by NIST. National Institute of Standards and Technology Special Publication 800-83 Revision 1 Natl. Inst. Stand. Technol. Spec. Publ. 800-83r1, 47 pages (July 2013)

http://dx.doi.org/10.6028/NIST.SP.800-83r1

CODEN: NSPUE2

Certain commercial entities, equipment, or materials may be identified in this document in order to describe an experimental procedure or concept adequately. Such identification is not intended to imply recommendation or endorsement by NIST, nor is it intended to imply that the entities, materials, or equipment are necessarily the best available for the purpose. There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may be used by Federal agencies even before the completion of such companion publications. Thus, until each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning and transition purposes, Federal agencies may wish to closely follow the development of these new publications by NIST. Organizations are encouraged to review all draft publications during public comment periods and provide feedback to NIST. All NIST Computer Security Division publications, other than the ones noted above, are available at http://csrc.nist.gov/publications.