[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for Identification and Authentication?

[Assistant]
According to Protecting Controlled Unclassified Information (CUI)_ NIST Special Publication 800-171, Revision 3. Small Business Primer:

| Access Control                    | Maintenance         | Security Assessment and Monitoring   |
|-----------------------------------|---------------------|--------------------------------------|
| Awareness and Training            | Media Protection    | System and Communications Protection |
| Audit and Accountability          | Personnel Security  | System and Information Integrity     |
| Configuration Management          | Physical Protection | Planning                             |
| Identification and Authentication | Risk Assessment     | System and Services Acquisition      |
| Incident Response                 |                     | Supply Chain Risk Management         |

- View all SP 800-171 Access Control Requirements and Assessment Procedures
- NIST Identity and Access Management Resources

- An understanding of the need for security (why is cybersecurity important to our business mission?).
- Specific actions required of users to maintain security (required use of multi-factor authentication, not sharing passwords, etc.).
- How to respond to confirmed or suspected incidents.
- How to securely handle CUI (training should be provided to staff before authorizing access to the system or CUI).
- How to recognize and report insider threats, social engineering, and social mining.

Protecting Controlled Unclassified Information (CUI)_ NIST Special Publication 800-171, Revision 3. Small Business Primer


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Physical Protection?

[Assistant]
According to Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule_ A Cybersecurity Resource Guide:

administrative safeguards; Health Insurance Portability and Accountability Act; implementation specification; physical safeguards; risk assessment; risk management; Security Rule; standards; technical safeguards.

The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the Nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology. ITL's responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in federal information systems. The Special Publication 800-series reports on ITL's research, guidelines, and outreach efforts in information system security, and its collaborative activities with industry, government, and academic organizations.

The terms 'can' and 'cannot' indicate a possibility and capability, whether material, physical, or causal.

Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule_ A Cybersecurity Resource Guide


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Guide to Malware Incident Prevention and Handling for Desktops and Laptops provide? (Part 8)

[Assistant] | Understanding Malware Threats ..................................................................................... | Understanding Malware Threats .....................................................................................

Guide to Malware Incident Prevention and Handling for Desktops and Laptops

Audit and Accountability
System and Information Integrity
Security Assessment
Media Protection
Identification and Authentication
Awareness and Training
System and Communications Protection
Access Control
Planning
Incident Response
Risk Assessment
Personnel Security
System and Services Acquisition
Supply Chain Risk Management
Maintenance
Physical Protection
Configuration Management


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for Access Control?

[Assistant]
According to Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171:

- Applying a threat-centric approach to security requirements specification;
- Employing system and security architectures that support logical and physical isolation using system and network segmentation techniques, virtual machines, and containers; 16
- Implementing dual authorization controls for the most critical or sensitive operations;
- Limiting persistent storage to isolated enclaves or domains;
- Implementing a comply-to-connect approach for systems and networks;
- Extending configuration management requirements by establishing authoritative sources for addressing changes to systems and system components;
- Periodically refreshing or upgrading organizational systems and system components to a known state or developing new systems or components;
- Employing a security operations center with advanced analytics to support continuous monitoring and protection of organizational systems; and
- Using deception to confuse and mislead adversaries regarding the information they use for decision-making, the value and authenticity of the information they attempt to exfiltrate, or the environment in which they are operating.

| FAMILY                            | FAMILY                               |
|-----------------------------------|--------------------------------------|
| Access Control                    | Media Protection                     |
| Awareness and Training            | Personnel Security                   |
| Audit and Accountability          | Physical Protection                  |
| Configuration Management          | Risk Assessment                      |
| Identification and Authentication | Security Assessment                  |
| Incident Response                 | System and Communications Protection |
| Maintenance                       | System and Information Integrity     |

## 3.1   ACCESS CONTROL

Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Risk Assessment?

[Assistant]
According to Guide to Enterprise Patch Management Planning_ Preventive Maintenance for Technology:

............................................................................... | Executive Summary.....................................................................................................
| iv                                                                               |
|---------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------|
| 1 Introduction ............................................................................................................1    | 1 Introduction ............................................................................................................1    | 1 Introduction ............................................................................................................1    |                                                                                |
|                                                                                | 1.1                                                                                | Purpose and Scope ........................................................................................

Guide to Enterprise Patch Management Planning_ Preventive Maintenance for Technology


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Maintenance?

[Assistant]
According to Validating the Integrity of Computing Devices:

| Component | Product/Technology | Function/Capability | Cybersecurity Framework Subcategories | |------------------------------------------------|---------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------| | Configuration Management System | Microsoft Configuration Manager | Enforces corporate governance and policies through actions such as applying software patches and updates, removing denylisted software, and automatically updating configurations | DE.CM-7 | | Security Information and Event Management Tool | IBM QRadar | Performs real-time analysis of alerts and notifications generated by organizational information systems | DE.CM-7 | | Certificate Authority (CA) | Host Integrity at Runtime and Start-up (HIRS) Attestation Certificate Authority (ACA) | Issues an Attestation Identity Credential in accordance with Trusted Computing Group (TCG) specifications | PR.AC-6, PR.DS-8 | | Platform Integrity Validation System | Eclypsium Analytic Platform | Validates the integrity of firmware installed on computing devices | PR.DS-6 | | Platform Integrity Validation System | HIRS ACA | Validates platform components in accordance with TCG specifications | PR.DS-8 | | Platform Integrity Validation System | Platform Certificate Verification Tool (PCVT) | Validates platform components in accordance with TCG specifications | PR.DS-8 | | Platform Integrity Validation System | Secure Component Verification (SCV) | Validates platform components in accordance with TCG specifications | PR.DS-8 | | Platform Integrity Validation System | Platform Manifest

Validating the Integrity of Computing Devices


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Recommendations for Federal Vulnerability Disclosure Guidelines provide? (Part 10)

[Assistant] | Government Advisory Services ...............................................................................13 | | | Stakeholders | in Federal Vulnerability Disclosure Coordination ..................................14 | | | Technical Approaches | and Resources ......................................................................14 | | | Vulnerability Disclosure Program Offices .....................................................................16 | Vulnerability Disclosure Program Offices .....................................................................16 | | | | Disclosure Program Office Structural Requirements..............................16 | | | Vulnerability Development | Vulnerability Development | | | 3.2.1.

Recommendations for Federal Vulnerability Disclosure Guidelines


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for System and Communications Protection?

[Assistant]
According to Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171:

............................................ 5                        |
| 2.1 DEVELOPMENTAPPROACH ......................................................................................................
| 5                                                                                |
| 2.2 ORGANIZATIONANDSTRUCTURE                                                                                | ............................................................................................. 7                                                  |
| 2.3 FLEXIBLE APPLICATION                                                                                | ............................................................................................................. 9                                  |
| CHAPTER THREE THE REQUIREMENTS......................................................................................... 11                       | CHAPTER THREE THE REQUIREMENTS......................................................................................... 11                       |
| 3.1 ACCESSCONTROL                                                                                | .................................................................................................................. 12                            |
| 3.2 AWARENESSANDTRAINING                                                                                | ...................................................................................................


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Services Acquisition?

[Assistant]
According to Summary of NIST SP 800-53, Revision 4_ Security and Privacy Controls for Federal Information Systems and Organizations:

Information technologySecurity techniques-Information security management systems-Requirements and ISO/IEC 15408, Information technology -- Security techniques -- Evaluation criteria for IT security .
ISO/IEC 27001 applies to all types of organizations and specifies requirements for establishing, implementing, operating, monitoring, reviewing, maintaining, and improving a documented information security management system (ISMS) within the context of business risks. ISO/IEC 15408 (also known as the Common Criteria) provides functionality and assurance requirements for developers of information systems and information system components (i.e., information technology products). Since many of the technical security controls defined in Appendix F are implemented in hardware, software, and firmware components of information systems, organizations can obtain significant benefit from the acquisition and employment of information technology products evaluated against the requirements of ISO/IEC 15408. The use of such products can provide evidence that certain security controls are implemented correctly, operating as intended, and producing the desired effect in satisfying stated security requirements.

Summary of NIST SP 800-53, Revision 4_ Security and Privacy Controls for Federal Information Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Communications Protection?

[Assistant]
According to Organizational Views of NIST Cryptographic Standards and Testing and Validation Programs:

multitude of errors and developer pitfalls in the cryptographic implementations of software products [1-5]. However, these studies focused on the practices of less-experienced, individual developers.
Therefore, there was little understanding of the cryptographic development practices of organizations, including the benefits and challenges of using cryptographic resources such as standards specifications and libraries.

Organizational Views of NIST Cryptographic Standards and Testing and Validation Programs


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Access Control?

[Assistant]
According to Transitioning to the Security Content Automation Protocol (SCAP) Version 2:

- Endpoint: An Endpoint is the target of a posture assessment. Collection applications will collect software inventory, configuration settings, and other endpoint posture and publish this posture to Posture Collection Servers using standardized protocols and interfaces. These standards will enable Endpoints to be monitored and for changes in posture to be reported automatically. These standards will also allow Posture Collection Servers to query an Endpoint's posture when new or refreshed posture information is required. The initial release of SCAP 2.0 will define protocol requirements for desktops, laptops, and servers; however, all endpoint types are in scope for SCAP v2. Later revisions will define requirements for other endpoint types (e.g., network devices, mobile devices, IoT devices). - Posture Collection Server: This server is responsible for efficiently coordinating the collection of posture from multiple Endpoints. Posture collected from an Endpoint will be published by the Posture Collection Server to the Configuration Management Database (CMDB) where it can then be accessed by other tools. This reduces duplicate posture collection and load on Endpoints that have constrained capabilities, that are under significant load, or that have strict performance requirements. The Posture Collection Server acts as a point of integration for access control and for standardized management protocols including Network Endpoint Assessment (NEA), the Simple Network Management Protocol (SNMP), the Network Configuration Protocol (NETCONF), and mobile device management (MDM) protocols. - Posture Evaluator: By decoupling collection and evaluation and creating standardized interfaces, SCAP v2 enables the distribution of Posture Evaluator service instances across the network. A Posture Evaluator retrieves previously collected posture from a CMDB and requests new posture collection from Posture Collection Servers.

Transitioning to the Security Content Automation Protocol (SCAP) Version 2


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Communications Protection?

[Assistant]
According to Ordered t-way Combinations for Testing State-based Systems:

- [20] James  M. Higdon,  Gerald  Oveson,  Efficient  Test  of Configurations  and  Orders  of  Complex  Operating  Procedures Tech. Rpt.,  COLSA North Florida Ops, 96th Cyberspace Test Group, AFMC, Eglin AFB, FL, 4 Apr 2018. - [21] Duan F, Lei Y, Kacker RN, Kuhn DR. An Approach to T-Way Test Sequence Generation With Constraints. 2019 IEEE Intl Conference on Software Testing, Verification and Validation Workshops (ICSTW) 2019 Apr 22 (pp. 241-250). IEEE. - [22] Garn B, Simos DE, Duan F, Lei Y, Bozic J, Wotawa F. Weighted Combinatorial Sequence Testing for the TLS Protocol. In2019  IEEE  International  Conference  on  Software  Testing, Verification and Validation Workshops (ICSTW) 2019 Apr 22 (pp. 46-51). IEEE. - [23] Oetsch  J,  Nieves  JC. Stable-Ordered  Models  for Propositional Theories with Order Operators. InEuropean Conference on Logics in Artificial Intelligence 2019 May 7 (pp. 794-802). Springer, Cham. - [24] Yuster R. Perfect sequence covering arrays. Designs, Codes and Cryptography. 2020 Mar;88(3):585-93. - [25] Younis MI. MVSCA: Multi-Valued Sequence Covering Array. Journal of Engineering. 2019 Oct 29;25(11):8291. - [26] D.R. Kuhn,  I. Dominguez,  R.N. Kacker  and  Y. Lei. "Combinatorial Coverage Measurement Concepts and Applications", 2nd  Intl  Workshop  on  Combinatorial  Testing , Luxembourg, IWCT2013, IEEE, Mar. 2013. - [27] Zamli KZ, Othman RR, Zabil MH. On sequence based interaction  testing. In2011  IEEE  Symposium  on  Computers  & Informatics 2011 Mar 20 (pp. 662-667). IEEE. - [28] Kuhn DR, Higdon JM, Lawrence JF, Kacker RN, Lei Y. Efficient  methods  for  interoperability  testing  using  event sequences. FLIGHT TEST SQUADRON (46TH) EGLIN AFB FL; 2012 Aug 1. - [29] Yilmaz C, Fouche S, Cohen MB, Porter A, Demiroz G, Koc U. Moving forward with combinatorial interaction testing. Computer. 2013 Dec 11;47(2):37-45. - [30] Garn  B,  Simos  DE,  Zauner  S,  Kuhn  R,  Kacker  R. Browser fingerprinting using combinatorial sequence testing.

Ordered t-way Combinations for Testing State-based Systems


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Risk Assessment?

[Assistant]
According to Audit and Evaluation of Computer Security II_ System Vulnerabilities and Controls:

| VULNERABILITIES | VULNERABILITIES | 6-5 | | 3.1 | Targets | Targets | 6-5 | | | 3.1.1 | Vul nerabl llties of Data and Prog ranis •••••••••••«••«•••••••«••••••••• | 6~5 | | | | Vulnerabilities of Terminals | 6-7 | | | 3.1.2 3.1.3 | Vulnerabilities of Media | 6-7 | | | 3.1.4 | Vulnerability of Services | 6-9 | | 3.2 | Hazards | | 6-10 | | | 3.2.1 | Natural Hazards | 6-10 | | | 3.2.2 Man-made Hazards | 3.2.2 Man-made Hazards | 6-10 | | 4.1 | CONTROLS Control Principles | CONTROLS Control Principles | 6-11 | | | | | 6-11 | | | 4.1.1 | Separation of Duties | | | | 4.1.2 | Restrict Access | 6-12 | | | 4.1.3 | Independent Authorization | 6-12 | | | 4.1.4 | Individual Accountability | 6-12 | | | 4.1.5 | Test of Concealment | 6-12 6-12 | | | 4.1.6 Test of Sensitive Combinations | 4.1.6 Test of Sensitive Combinations | 6-12 | | 4.2 | Control Measures | Control Measures | 6-12 | | | 4.2.1 | Explicit Assignment of Responsibility 4.2.2 Physical and Environmental Controls | 6-13 |

Audit and Evaluation of Computer Security II_ System Vulnerabilities and Controls


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Communications Protection?

[Assistant]
According to Security and Privacy Controls for Information Systems and Organizations:

............................................................. 16
3.1   ACCESS CONTROL ..................................................................................................................
18
3.2   AWARENESS AND TRAINING ................................................................................................... 59
3.3   AUDIT AND ACCOUNTABILITY ................................................................................................. 65
3.4   ASSESSMENT, AUTHORIZATION, AND MONITORING ................................................................. 83
3.5   CONFIGURATION MANAGEMENT ........................................................................................... 96
3.6   CONTINGENCY PLANNING .................................................................................................... 115
3.7   IDENTIFICATION AND AUTHENTICATION ............................................................................... 131
3.8   INCIDENT RESPONSE ............................................................................................................ 149
3.9   MAINTENANCE .................................................................................................................... 162
3.10   MEDIA PROTECTION .......................................................................................................... 171
3.11   PHYSICAL AND ENVIRONMENTAL PROTECTION .................................................................... 179
3.12   PLANNING ........................................................................................................................ 194
3.13   PROGRAM MANAGEMENT ................................................................................................. 203
3.14   PERSONNEL SECURITY ........................................................................................................ 222
3.15   PERSONALLY IDENTIFIABLE INFORMATION PROCESSING AND TRANSPARENCY .......................

Security and Privacy Controls for Information Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for System and Information Integrity?

[Assistant]
According to Protecting Controlled Unclassified Information (CUI)_ NIST Special Publication 800-171, Revision 3. Small Business Primer:

NIST SP 800-172, Enhanced Security Requirements for Protecting Controlled Unclassified Information provides enhanced security requirements to help protect CUI associated with critical programs or high value assets in nonfederal systems and organizations from the advanced persistent threat (APT). The SP 800-172 enhanced security requirements are designed to protect confidentiality, integrity and availability of information.

2 SP 800-171 does not explicitly cover integrity and availability so it is not a comprehensive security program.

| Access Control                    | Maintenance         | Security Assessment and Monitoring   |
|-----------------------------------|---------------------|--------------------------------------|
| Awareness and Training            | Media Protection    | System and Communications Protection |
| Audit and Accountability          | Personnel Security  | System and Information Integrity     |
| Configuration Management          | Physical Protection | Planning                             |
| Identification and Authentication | Risk Assessment     | System and Services Acquisition      |
| Incident Response                 |                     | Supply Chain Risk Management         |


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Physical Protection?

[Assistant]
According to Digital Identity Guidelines:

The Information Technology Laboratory (ITL) at the National Institute of Standards and
Technology (NIST) promotes the U.S. economy and public welfare by providing technical
leadership for the Nation’s measurement and standards infrastructure. ITL develops
tests, test methods, reference data, proof of concept implementations, and technical
analyses to advance the development and productive use of information technology.
ITL’s responsibilities include the development of management, administrative, technical,
and physical standards and guidelines for the cost-effective security and privacy of other
than national security-related information in federal information systems. The Special
Publication 800-series reports on ITL’s research, guidelines, and outreach efforts in
information system security, and its collaborative activities with industry, government,
and academic organizations.

These guidelines address logical access to online systems, services, and applications.
They do not specifically address physical access control processes. However, the
processes specified in these guidelines can be applied to physical access use cases where
appropriate. Additionally, these guidelines do not explicitly address some subjects
including, but not limited to, machine-to-machine authentication, interconnected
devices (e.g., Internet of Things [IoT] devices), or access to Application Programming
Interfaces (APIs) on behalf of subjects.

whether material, physical, or causal — or, in the negative, the absence of
that possibility or capability.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Multi-Factor Authentication for Criminal Justice Information Systems_ Implementation Considerations for Protecting Criminal Justice Information provide? (Part 5)

[Assistant]
----------------------------------------|
| 1. Introduction...................................................................................................................................3   |
| 2.
An Overview of MFA Technologies and Concepts ............................................................................5                         |
| 2.4.1. Benefits of Identity Federation ....................................................................................................7          |
| 2.4.2. Benefits of Single Sign-On ............................................................................................................8       |
| 3. Choosing an MFA Implementation for Protecting CJI .....................................................................11                          |
| 3.1.1. Principle 1: Authenticator Reusability........................................................................................12               |
| 3.1.2. Principle 2: Authenticator Optionality .......................................................................................12               |
| 3.1.3. Principle 3: Minimize the Passing of Memorized Secrets ..........................................................12                            |
| 3.1.4. Principle 4: Ensure MFA Is Integrated to Protect CJI..................................................................13                       |
| 3.2.1. MFA Users ..................................................................................................................................13 |
| 3.2.2. IT Support Staff...........................................................................................................................14  |
| 3.2.3. Other Agencies ...........................................................................................................................14   |
| 3.2.4.

Multi-Factor Authentication for Criminal Justice Information Systems_ Implementation Considerations for Protecting Criminal Justice Information


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Communications Protection?

[Assistant]
According to Secure Software Development Practices for Generative AI and Dual-Use Foundation Models_ An SSDF Community Profile:

el producers, AI system producers, AI system acquirers, and others can use the SSDF to foster their communications regarding secure AI model development throughout the software development life cycle.
2  Following SSDF practices should help AI model producers reduce the number of vulnerabilities in their AI models, reduce the potential impacts of the exploitation of undetected or unaddressed vulnerabilities, and address the root causes of vulnerabilities to prevent recurrences. AI system producers can use the SSDF's common vocabulary when communicating with AI model producers regarding their security practices for AI model development and when integrating AI models into the software they are developing. AI system acquirers can also use SSDF terms to better communicate their cybersecurity requirements and needs to AI model producers and AI system producers, such as during acquisition processes. The SSDF Community Profile is not a checklist to follow, but rather a starting point for planning and implementing a risk-based approach to adopting secure software development practices involving AI models. The contents of the Profile are meant to be adapted and customized, as not all practices and tasks are applicable to all use cases. Organizations should adopt a riskbased approach to determine what practices and tasks are relevant, appropriate, and effective to mitigate the threats to software development practices from the organization's perspective as an AI model producer, AI system producer, or AI system acquirer. Factors such as risk, cost, feasibility, and applicability should be considered when deciding which practices and tasks to use and how much time and resources to devote to each one. Cost models may need to be updated to effectively consider the costs inherent to AI model development.

Secure Software Development Practices for Generative AI and Dual-Use Foundation Models_ An SSDF Community Profile


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171 provide? (Part 7)

[Assistant]
tegrity, and availability protection. The enhanced security requirements are implemented in addition to the basic and derived requirements since those requirements are not designed to address the APT.
The enhanced security requirements apply to those components of nonfederal systems that process, store, or transmit CUI or that provide protection for such components. There is no expectation that all of the enhanced security requirements will be selected by federal agencies implementing this guidance. The decision to select a particular set of enhanced security requirements will be based on the mission and business needs of federal agencies and guided and informed by ongoing risk assessments. The enhanced security requirements for nonfederal systems processing, storing, or transmitting CUI associated with critical programs or high value assets will be conveyed to nonfederal organizations by federal agencies in a contract, grant, or other agreement. The application of the enhanced security requirements to subcontractors will also be addressed by federal agencies in consultation with nonfederal organizations. \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

## THE APPLICABILITY OF ENHANCED SECURITY REQUIREMENTS

The enhanced security requirements are only applicable to a nonfederal system or nonfederal organization as mandated by a federal agency in a contract, grant, or other agreement. The requirements apply to the components of nonfederal systems that process, store, or transmit CUI associated with a critical program or a high value asset or that provide protection for such components. The requirements also apply to services, including externally provided services, that process, store, or transmit CUI, or that provide security protections, for the system requiring enhanced protection.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Configuration Management?

[Assistant]
According to Risk Management Framework for Information Systems and Organizations_ A System Life Cycle Approach for Security and Privacy:

curity officer; senior agency official for privacy; supply chain risk management; system development life cycle; system owner; system privacy officer; system security officer; system-specific control.
- To provide closer linkage and communication between the risk management processes and activities at the C-suite or governance level of the organization and the individuals, processes, and activities at the system and operational level of the organization;
- To institutionalize critical risk management preparatory activities at all risk management levels to facilitate a more effective, efficient, and cost-effective execution of the RMF;
- To demonstrate how the NIST Cybersecurity Framework [NIST CSF] can be aligned with the RMF and implemented using established NIST risk management processes;
- To integrate privacy risk management processes into the RMF to better support the privacy protection needs for which privacy programs are responsible;
- To promote the development of trustworthy secure software and systems by aligning life cycle-based systems engineering processes in NIST Special Publication 800-160, Volume 1 [SP 800-160 v1], with the relevant tasks in the RMF;
- To integrate security-related, supply chain risk management (SCRM) concepts into the RMF to address untrustworthy suppliers, insertion of counterfeits, tampering, unauthorized production, theft, insertion of malicious code, and poor manufacturing and development practices throughout the SDLC; and
- To allow for an organization-generated control selection approach to complement the traditional baseline control selection approach and support the use of the consolidated control catalog in NIST Special Publication 800-53, Revision 5.

Risk Management Framework for Information Systems and Organizations_ A System Life Cycle Approach for Security and Privacy


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Information Integrity?

[Assistant]
According to Incident Response Recommendations and Considerations for Cybersecurity Risk Management_ A CSF 2.0 Community Profile:

…an occurrence that actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an information system; or constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies.

Incident Response Recommendations and Considerations for Cybersecurity Risk Management_ A CSF 2.0 Community Profile


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Overview and Considerations of Access Control Based on Attribute Encryption provide? (Part 5)

[Assistant]
........................................................ | 2                                                                                |
| 2.
| Fundamental Theories ..................................................................................................... | 4                                                                                |
| 2.1. | Elliptic Curve                                                                                | .............................................................................................................. 4                       |
| 2.2. | Elliptic-Curve Cryptography ........................................................................................ | 5                                                                                |
| 2.3. | Bilinear Pair Mapping.................................................................................................. | 7                                                                                |
| 2.4. | Bilinear Pairing for Cryptography................................................................................ | 9                                                                                |
| 3. | Identity-Based Encryption ..............................................................................................11                  |                                                                                |
| 4.

Overview and Considerations of Access Control Based on Attribute Encryption


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Data Integrity_ Detecting and Responding to Ransomware and Other Destructive Events provide? (Part 7)

[Assistant]
hrough  this collaboration,  the  NCCoE  develops  modular,  adaptable  example cybersecurity solutions demonstrating how to apply standards and best practices using commercially available technology.
## LEARN MORE

Visit https://www.nccoe.nist.gov nccoe@nist.gov 301-975-0200

## NIST SPECIAL PUBLICATION 1800-26B

## Detecting and Responding to Ransomware and Other

## Data Integrity: Destructive Events

## Volume B:

Approach, Architecture, and Security Characteristics

## Jennifer Cawthra

National Cybersecurity Center of Excellence NIST

Michael Ekstrom Lauren Lusty Julian Sexton John Sweetnam

The MITRE Corporation McLean, Virginia

## December 2020

FINAL

This publications is available free of charge from https://doi.org/10.6028/NIST.SP.1800-26. This publication is available free of charge from https://www.nccoe.nist.gov/projects/building-blocks/data-integrity/detect-respond. <!-- image -->

## DISCLAIMER

Certain commercial entities, equipment, products, or materials may be identified by name or company logo or other insignia in order to acknowledge their participation in this collaboration or to describe an experimental procedure or concept adequately. Such identification is not intended to imply special status or relationship with NIST or recommendation or endorsement by NIST or NCCoE; neither is it intended to imply that the entities, equipment, products, or materials are necessarily the best available for the purpose. National Institute of Standards and Technology Special Publication 1800-26B, Natl. Inst. Stand. Technol. Spec. Publ. 1800-26B, 54 pages, (December 2020), CODEN: NSPUE2

## FEEDBACK

As a private-public partnership, we are always seeking feedback on our practice guides. We are particularly interested in seeing how businesses apply NCCoE reference designs in the real world. If you have implemented the reference design, or have questions about applying it in your environment, please email us ds-nccoe@nist.gov.

Data Integrity_ Detecting and Responding to Ransomware and Other Destructive Events


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Awareness and Training?

[Assistant]
According to Summary of NIST SP 800-53, Revision 4_ Security and Privacy Controls for Federal Information Systems and Organizations:

The security control baselines address the security needs of a broad and diverse set of constituencies, and are developed based on a number of general assumptions, including common environmental, operational, and functional considerations. The baselines also assume typical threats facing common information systems.  Articulating the underlying assumptions is a key element in the initial risk framing step of the risk management process described in NIST SP 800-39.  To ensure that an appropriate set of controls is identified to provide security commensurate with risk, organizations tailor the controls to align with specific security needs. Organizations may perform tailoring at the organization level for all information systems, in support of a particular line of business or mission/business process, at the individual information system level, or by using a combination of the above. The tailoring process is comprised of several steps, as described in SP 800-53 Rev. 4 Section 3.2.  These actions include:


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Security Assessment?

[Assistant]
According to Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule_ A Cybersecurity Resource Guide:

.................44                   |
| 5.1.7. Contingency Plan (§ 164.308(a)(7))............................................................................................47             |
| 5.1.8.
Evaluation (§ 164.308(a)(8)).......................................................................................................51        |
| 5.2.1. Facility Access Controls (§ 164.310(a)).......................................................................................56             |
| 5.1.9. Business Associate Contracts and Other Arrangements (§ 164.308(b)(1))................................54                                      |
| 5.2.2. Workstation Use (§ 164.310(b)).................................................................................................59            |
| 5.2.3. Workstation Security (§ 164.310(c)) ..........................................................................................61             |

Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule_ A Cybersecurity Resource Guide


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AT.L2-3.2.1 (NIST 3.2.1)?

[Assistant]
According to Guidelines for Media Sanitization:

3.2.1. 3.2.1.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Access Control?

[Assistant]
According to Multi-Factor Authentication for Criminal Justice Information Systems_ Implementation Considerations for Protecting Criminal Justice Information:

| Executive Summary............................................................................................................................1        |
|-------------------------------------------------------------------------------------------------------------------------------------------------------|
| 1. Introduction...................................................................................................................................3   |
| 2. An Overview of MFA Technologies and Concepts ............................................................................5                         |
| 2.4.1. Benefits of Identity Federation ....................................................................................................7          |
| 2.4.2. Benefits of Single Sign-On ............................................................................................................8       |
| 3. Choosing an MFA Implementation for Protecting CJI .....................................................................11                          |
| 3.1.1. Principle 1: Authenticator Reusability........................................................................................12               |
| 3.1.2. Principle 2: Authenticator Optionality .......................................................................................12               |
| 3.1.3. Principle 3: Minimize the Passing of Memorized Secrets ..........................................................12                            |
| 3.1.4. Principle 4: Ensure MFA Is Integrated to Protect CJI..................................................................13                       |
| 3.2.1. MFA Users ..................................................................................................................................13 |
| 3.2.2.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Access Control?

[Assistant]
According to Protecting Information and System Integrity in Industrial Control System Environments_ Cybersecurity for the Manufacturing Sector:

ces; monitors activity down to the keystroke |
|                | Provides network and asset monitoring to detect behavior anomalies and modifications to hardware, firmware, and software capabilities.
|
|                | Provides host-based application allowlisting (the blocking of unauthorized activities that have the potential to pose a harmful attack) and file integrity monitoring. |

Protecting Information and System Integrity in Industrial Control System Environments_ Cybersecurity for the Manufacturing Sector


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 2 require for Supply Chain Risk Management?

[Assistant]
According to Profile of the IoT Core Baseline for Consumer IoT Products:

- create the IoT product (i.e., used to create each product component). - ii. IoT platform used in the development and operation of the IoT product, its product components, including related documentation. - iii. Trustworthiness and protection of software and hardware elements implemented to create the IoT product and its product components (e.g., secure boot, hardware root of trust, and secure enclave). - iv. Consideration for the known risks related to the IoT product and known potential misuses. - v. Secure software development and supply chain practices used. - vi. Accreditation, certification, and/or evaluation results for cybersecurity-related practices. - vii. The ease of installation and maintenance of the IoT product by a customer (i.e., the usability of the product [ISO9241]). - e. Maintenance requirements for the IoT product, for example :
- i. Cybersecurity maintenance expectations and associated instructions or procedures (e.g., vulnerability/patch management plan). - ii. How the IoT product developer identifies authorized supporting parties who can perform maintenance activities (e.g., authorized repair centers). - iii. Cybersecurity considerations of the maintenance process (e.g., how customer data unrelated to the maintenance process remain confidential even from maintainers). - f. The secure system lifecycle policies and processes associated with the IoT product, including:
- i. Steps taken during development to ensure the IoT product and its product components are free of any known, exploitable vulnerabilities. - ii. The process of working with component suppliers and third-party vendors to ensure the security of the IoT product and its product components is maintained for the duration of its supported lifecycle. - iii. Any post end-of-support considerations, such as the discovery of a vulnerability that would significantly impact the security, privacy, or safety of customers who continue to use the IoT product and its product components. - g.

Profile of the IoT Core Baseline for Consumer IoT Products


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Ascon-Based Lightweight Cryptography Standards for Constrained Devices_ Authenticated Encryption, Hash, and Extendable Output Functions provide? (Part 6)

[Assistant]
. . . . . . . . . . . . . . . . . . . |   9 |
| 3.4. Linear Diffusion Layer 𝑝 𝐿 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . |  10 |
| 4.
Authenticated Encryption Scheme: Ascon-AEAD128 . . . . . . . . . . . . . . . . . . . . . . . . . . . . |  11 |
| 4.1. Specification of Ascon-AEAD128 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . |  11 |
| 4.1.1. Encryption . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . |  11 |
| 4.1.2. Decryption . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . |  15 |
| 4.2. Implementation Options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . |  18 |
| 4.2.1. Truncation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . |  18 |
| 4.2.2. Nonce Masking . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . |  18 |
| 4.3. AEAD Requirements.............................................................. |  19 |
| 4.4. Security Properties . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . |  20 |
| 4.4.1. Single-Key Setting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . |  20 |
| 4.4.2. Multi-Key Setting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . |  20 |
| 4.4.3. Nonce-Misuse Setting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . |  21 |
| 5. Hash and eXtendable-Output Functions (XOFs) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Ascon-Based Lightweight Cryptography Standards for Constrained Devices_ Authenticated Encryption, Hash, and Extendable Output Functions


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does IoT Non-Technical Supporting Capability Core Baseline provide? (Part 9)

[Assistant]
rity needs and goals. Information Dissemination allows for information to continue to flow to customers and others in the ecosystem about the cybersecurity of their IoT devices and associated systems.
Customers and others will benefit from 1) the disclosure of newly discovered cybersecurity vulnerabilities for the device, associated systems and software, etc. and 2) notifications about IoT device

updates, such as software updates, algorithm changes, new protocols, or changes in the vendors used by the manufacturer to update cybersecurity, that may impact cybersecurity risks. 1

Education and Awareness provides the educational content required to support customers and others in the secure use and safeguarding of IoT devices and associated systems, software, and hardware. By making customers and others in the ecosystem more knowledgeable about how to secure the IoT devices, and how to most effectively use the device's cybersecurity capabilities, manufacturers can help reduce the number of occurrences and related severity of IoT device compromises, thwart attacks against the devices, and reduce the number of vulnerabilities that are exploited and lead to compromised devices. Customers are the typical recipients of the non-technical supporting capabilities, but some customers may not be able to use these non-technical supporting capabilities directly. In the latter case, the capability might be used by other entities in the IoT device ecosystem (e.g., vendors, trade or professional organizations, advocacy groups, and technology media) to help customers meet their needs and goals. This baseline was developed after reviewing a variety of guidance documents from multiple sources and receiving input from stakeholders. It represents a coordinated effort to produce a definition of common capabilities not an exhaustive list. The core baseline is intended to be a flexible starting point.

IoT Non-Technical Supporting Capability Core Baseline


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 2 require for Supply Chain Risk Management?

[Assistant]
According to Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations:

......................98      |
| Table 11. Maintenance (MA) ......................................................................................................................98      |
| Table 12.
Media Protection (MP)................................................................................................................99        |
| Table 13. Physical and Environmental Protection (PE)...............................................................................99                    |
| Table 14. Planning (PL)..............................................................................................................................100 |
| Table 15. Program Management (PM) .....................................................................................................100               |
| Table 16. Personnel Security (PS) .............................................................................................................101       |
| Table 17. PII Processing and Transparency (PT) .......................................................................................102                |
| Table 18. Risk Assessment (RA) ................................................................................................................102       |
| Table 19. System and Services Acquisition (SA)........................................................................................103                |
| Table 20. System and Communications Protection (SC)...........................................................................103                        |
| Table 21. System and Information Integrity (SI) .......................................................................................104               |
| Table 22. Supply Chain Risk Management (SR).........................................................................................105                  |
| Table 23.

Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What guidance does IoT Device Cybersecurity Capability Core Baseline provide?

[Assistant]
## NISTIR 8259A

## IoT Device Cybersecurity Capability Core Baseline

Michael Fagan Katerina N. Megas Karen Scarfone Matthew Smith

This publication is available free of charge from: https://doi.org/10.6028/NIST.IR.8259A

<!-- image -->

## NISTIR 8259A

## IoT Device Cybersecurity Capability Core Baseline

Michael Fagan Katerina N. Megas Applied Cybersecurity Division Information Technology Laboratory

Karen Scarfone Scarfone Cybersecurity Clifton, VA

Matthew Smith Huntington Ingalls Industries Annapolis Junction, MD

This publication is available free of charge from: https://doi.org/10.6028/NIST.IR.8259A

May 2020

<!-- image -->

U.S. Department of Commerce Wilbur L. Ross, Jr., Secretary

National Institute of Standards and Technology Walter Copan, NIST Director and Under Secretary of Commerce for Standards and Technology

## National Institute of Standards and Technology Interagency or Internal Report 8259A 23 pages (May 2020)

This publication is available free of charge from: https://doi.org/10.6028/NIST.IR.8259A

Certain commercial entities, equipment, or materials may be identified in this document in order to describe an experimental procedure or concept adequately. Such identification is not intended to imply recommendation or endorsement by NIST, nor is it intended to imply that the entities, materials, or equipment are necessarily the best available for the purpose. There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may be used by federal agencies even before the completion of such companion publications. Thus, until each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning and transition purposes, federal agencies may wish to closely follow the development of these new publications by NIST.

IoT Device Cybersecurity Capability Core Baseline


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Contingency Planning Guide for Federal Information Systems provide? (Part 8)

[Assistant] Background ....................................................................................................5 | | | 2.1 | Contingency Planning and Resilience ........................................................................5 | Contingency Planning and Resilience ........................................................................5 | | | 2.2 | Types of Plans ............................................................................................................7 | Types of Plans ............................................................................................................7 | | | 2.2 | 2.2.1 | Business Continuity Plan (BCP)......................................................................8 | | | 2.2 | 2.2.2 | Continuity of Operations (COOP) Plan............................................................8 | | | 2.2 | 2.2.3 | Crisis Communications Plan............................................................................9 | | | 2.2 | 2.2.4 | Critical Infrastructure Protection (CIP) Plan.....................................................9 | | | 2.2 | 2.2.5 | Cyber Incident Response Plan......................................................................10 | | | 2.2 | 2.2.6 | Disaster Recovery Plan (DRP)......................................................................10 | | | 2.2 | 2.2.7 | Information System Contingency Plan (ISCP)...............................................10 | | | | 2.2.8 | Occupant Emergency Plan (OEP).................................................................10 | | | Chapter 3.

Contingency Planning Guide for Federal Information Systems


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Status Report on the Fourth Round of the NIST Post-Quantum Cryptography Standardization Process provide? (Part 7)

[Assistant]
] . . . | 6              |
| Table 5. Performance of Classic McEliece in thousands of cycles on x86_64                                                                                | Table 5.
Performance of Classic McEliece in thousands of cycles on x86_64                                                                                | 6              |
| Table 6. BIKE keys and ciphertext sizes in bytes                                                                                | . . . . . . . . | 7              |
| Table 7.HQC keys and ciphertext sizes in bytes . | . . . . . . . | 7              |
| Table 8. Classic McEliece keys and ciphertext sizes in bytes . . | Table 8. Classic McEliece keys and ciphertext sizes in bytes . . | 7              |

## Supplemental Content

The NIST Post-Quantum Cryptography Standardization Process web page is available at https://cs rc.nist.gov/Projects/post-quantum-cryptography/post-quantum-cryptography-standardization. ## Acknowledgments

NIST would like to thank all of the candidate submission teams who developed, designed, and analyzed the post-quantum candidate algorithms and prepared detailed submission packages. NIST is also grateful for the efforts of those in the cryptographic community who provided security, implementation, and performance analyses of the candidate algorithms during the four rounds of the process. NIST would not be able to select post-quantum digital algorithms for standardization without the combined efforts of these individuals and the algorithm submitters. The authors of this report also appreciate the efforts by other members of NIST's PQC team who reviewed candidate algorithms, analyses, and public comments; performed testing; provided technical and administrative support; and participated in numerous meetings to discuss the selection of the candidate to be standardized.

Status Report on the Fourth Round of the NIST Post-Quantum Cryptography Standardization Process


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Supply Chain Risk Management?

[Assistant]
According to Secure Software Development Framework (SSDF) Version 1.1_ Recommendations for Mitigating the Risk of Software Vulnerabilities:

Few software development life cycle (SDLC) models explicitly address software security in detail, so secure software development practices usually need to be added to each SDLC model to ensure that the software being developed is well-secured. This document recommends the Secure Software Development Framework (SSDF) - a core set of high-level secure software development practices that can be integrated into each SDLC implementation. Following such practices should help software producers reduce the number of vulnerabilities in released software, reduce the potential impact of the exploitation of undetected or unaddressed vulnerabilities, and address the root causes of vulnerabilities to prevent future recurrences. Because the framework provides a common vocabulary for secure software development, software acquirers can also use it to foster communications with suppliers in acquisition processes and other management activities. This document describes a set of fundamental, sound practices for secure software development called the Secure Software Development Framework (SSDF). Organizations should integrate the SSDF throughout their existing software development practices, express their secure software development requirements to third-party suppliers using SSDF conventions, and acquire software that meets the practices described in the SSDF.

Secure Software Development Framework (SSDF) Version 1.1_ Recommendations for Mitigating the Risk of Software Vulnerabilities


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 1 require for System and Information Integrity?


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice CM.L2-3.4.2 (NIST 3.4.2)?

[Assistant]
According to Contingency Planning Guide for Federal Information Systems:

3.4.2                                                                                | Backup Methods and Offsite Storage... 3.4.2 should be considered and may include commercial contracts with alternate site vendors, reciprocal agreements with internal or external organizations, and service-level agreements (SLAs) with equipment vendors. 3.4.2 through 3.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for System and Communications Protection?

[Assistant]
According to Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171:

............................................ 5                        |
| 2.1 DEVELOPMENTAPPROACH ......................................................................................................
| 5                                                                                |
| 2.2 ORGANIZATIONANDSTRUCTURE                                                                                | ............................................................................................. 7                                                  |
| 2.3 FLEXIBLE APPLICATION                                                                                | ............................................................................................................. 9                                  |
| CHAPTER THREE THE REQUIREMENTS......................................................................................... 11                       | CHAPTER THREE THE REQUIREMENTS......................................................................................... 11                       |
| 3.1 ACCESSCONTROL                                                                                | .................................................................................................................. 12                            |
| 3.2 AWARENESSANDTRAINING                                                                                | ...................................................................................................

Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Assessing Security and Privacy Controls in Information Systems and Organizations provide? (Part 6)

[Assistant]
echnology Laboratory (ITL)

Mark G. Hakun
Chair

Kevin Stine
Cybersecurity Advisor, ITL

Matthew Scholl
Chief, Computer Security Division

Kevin Stine
Chief, Applied Cybersecurity Division

Dominic A.
Cussatt
Co-Chair

Kevin Dulany
Tri-Chair—Defense Community

Chris Johnson
Tri-Chair—Intelligence Community

Victoria Yan Pillitteri
Risk Management Framework Project Leader

Vicki Michetti
Tri-Chair—Civil Agencies

Joint Task Force (JTF) Working Group

Victoria Yan Pillitteri
NIST, JTF Leader

Eduardo Takamura
NIST

McKay Tolboe
DoD

Dave Myers
Veterans Affairs

Kelley Dempsey
NIST

Vicki Michetti
Veterans Affairs

Ron Ross
NIST

Naomi Lefkovitz
NIST

Andy Rovnak
Intelligence Community

Peter Duspiva
Intelligence Community

Chris Johnson
Intelligence Community

Jessica Dickson
NIST

Angela Smith
NIST

Jon Boyens
NIST

Ned Goren
NIST

Kaitlin Boeckl
NIST

Katie Isaacson
The MITRE Corporation

Randy Gabel
The MITRE Corporation

David Black
The MITRE Corporation

Pam Miller
The MITRE Corporation

iii

NIST SP 800-53A REV. 5
ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS
_________________________________________________________________________________________________

In addition to the above acknowledgments, a special note of thanks goes to Jeff Brewer, Jim
Foti, Cristina Ritfeld, Isabel Van Wyk, and the NIST web team for their outstanding
administrative support, Chris Enloe for his technical review and insight, and to David Waltermire
and Wendell Piez for their contribution to the development of the SP 800-53A assessment
tables (both electronic sources, and derivative publications) using Open Security Controls
Assessment Language (OSCAL).

Assessing Security and Privacy Controls in Information Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Analyzing Collusion Threats in the Semiconductor Supply Chain provide? (Part 3)

[Assistant]
..................5                     |
| 4. Case Study .....................................................................................................................................8  |
| 5.
Conclusion and Future Work.........................................................................................................12              |
| References.......................................................................................................................................13   |
| List of Figures                                                                                |
| Fig. 1. Security challenges in the semiconductor supply chain..............................................................2                          |
| Fig. 2. Methodology for supply chain threat analysis...........................................................................5                      |
| Fig. 3. Threat severity levels for colluding adversaries in the context of hardware Trojan insertion ......6                                          |
| Fig. 4. Threat severity levels for colluding adversaries in context of logic obfuscation ........................10                                   |

## 1. Introduction

There are numerous security challenges in the semiconductor supply chain. As most chip design companies have become fabless, they rely on offshore foundries for fabrication. This is especially true for the most advanced technology nodes, and the semiconductor supply shock in 2021 has manifested these supply chain security issues. In addition to availability uncertainty, there are many more nuanced security risks in the current semiconductor supply chain, such as IP theft, counterfeiting, Trojan insertion, and reverse engineering. In order to counteract these security risks, many types of solutions have been proposed, ranging from design to test phases of the supply chain.

Analyzing Collusion Threats in the Semiconductor Supply Chain


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Audit and Evaluation of Computer Security provide? (Part 8)

[Assistant]
of the Workshop. from the Workshop and subsequent efforts in this area will have far-
reaching, beneficial effects on the use of computers throughout the
country

The products to be derived

Dennis K.
Brans tad
Chairman, TG-15

iv

ABSTRACT

Its purpose was to explore the state-of-the-art in this

The National Bureau of Standards, with the support of the U.S. Gen-
eral Accounting Office, sponsored an invitational workshop on "Audit and
Evaluation of Computer Security," held in Miami Beach, Florida on March
22-24, 1977. area and define appropriate subjects for future research. perts in the audit and computer communities were invited to discuss the
subject in one of ten sessions, each of which considered a different as-
pect. these reports form the body of these Proceedings. The ten topics re-
ported on are: Internal Audit Standards, Qualifications and Training,
Security Administration, Audit Considerations in Various System Environ-
ments, Administrative and Physical Controls, Program Integrity, Data In-
tegrity, Communications, Post-Processing Audit Tools and Techniques, and
Interactive Audit Tools and Techniques. A consensus report was produced by each of the ten sessions and

Leading ex-

Audit standards, audit techniques, audit tools, audit

KEYWORDS:
training, communications security, computer controls, computer
security, data integrity, interactive audit, internal audit, post-
processing audit, program integrity. ACKNOViLEDGEMENTS

The success of the Workshop was dependent on the work of many peo-
We would particularly like to take this opportunity to thank all

ple. the Session Chairmen, the Session Recorders, and the attendees for their
efforts in behalf of this Workshop. We would also like to thank the ses-
sion coordinators Robert V. Jacobson, John Panagacos, and Thomas C. Lowe
for making things run smoothly while the Workshop was taking place; and
Dennis K. Branstad for photographing scenes from the Workshop.

Audit and Evaluation of Computer Security


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Audit and Accountability?

[Assistant]
According to Transitioning to the Security Content Automation Protocol (SCAP) Version 2:

To enable advanced cyber defense capabilities, SCAP v2 defines an architecture of clearly scoped and defined security components. SCAP v2 architectural components must be scalable, interoperable, easy to use, extensible, and capable of sharing data with other SCAP 2.0 components. Additionally, the architecture supports the collection and distribution of all information needed by the humans supporting operations and security functions, to include systems administrators, incident responders, network operators, and other similar stakeholders. The SCAP v2 architecture is reflective of real world scenarios of how these stakeholders use data about their networks. The SCAP architecture illustrated in Figure 1 incorporates a number of components, which are described below, and standards, which are described in section 3.3.

Transitioning to the Security Content Automation Protocol (SCAP) Version 2


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for Awareness and Training?

[Assistant]
According to Protecting Controlled Unclassified Information (CUI)_ NIST Special Publication 800-171, Revision 3. Small Business Primer:

| Access Control                    | Maintenance         | Security Assessment and Monitoring   |
|-----------------------------------|---------------------|--------------------------------------|
| Awareness and Training            | Media Protection    | System and Communications Protection |
| Audit and Accountability          | Personnel Security  | System and Information Integrity     |
| Configuration Management          | Physical Protection | Planning                             |
| Identification and Authentication | Risk Assessment     | System and Services Acquisition      |
| Incident Response                 |                     | Supply Chain Risk Management         |

## Getting Started with Awareness and Training

## Family: Awareness and Training

Protecting Controlled Unclassified Information (CUI)_ NIST Special Publication 800-171, Revision 3. Small Business Primer


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AU.L2-3.3.8 (NIST 3.3.8)?

[Assistant]
According to Secure Software Development Framework (SSDF) Version 1.1_ Recommendations for Mitigating the Risk of Software Vulnerabilities:

3.3.8 SP800161 : SA-4, SA-8, SA-9, SA-9(3), SR-3, SR-4, SR-4(3), SR-4(4) SP800181 : SP-DEV-002; K0153, K0266; S0298 |
|                                                                                | PW. 3.3.8 SP800161 : SA-15(10) SP800181 : K0041, K0042, K0151, K0292, K0317; S0054; A0025 SP800216 : All |
| Assess, Prioritize, and Remediate Vulnerabilities (RV. 3.3.8 SP800161 : SA-15(7) SP800181 : K0009, K0039, K0070, K0161, K0165; S0078                                                                                |

| Practices                                                                                | Tasks                                                                                | Notional Implementation Examples                                                                                | References                                                                                |
|----------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
|                                                                                | RV.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AT.L2-3.2.2 (NIST 3.2.2)?

[Assistant]
According to Digital Identity Guidelines_ Authentication and Authenticator Management:

3.2.2. 3.2.2. 3.2.2.

Digital Identity Guidelines_ Authentication and Authenticator Management


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AT.L2-3.2.7 (NIST 3.2.7)?

[Assistant]
According to Digital Identity Guidelines_ Authentication and Authenticator Management:

3.2.7. 3.2.7. 3.2.7.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for System and Services Acquisition?

[Assistant]
According to Protecting Controlled Unclassified Information (CUI)_ NIST Special Publication 800-171, Revision 3. Small Business Primer:

ource code. | CUI//SP-CTI   |
| General Proprietary  | e.g., financial information, trade secrets, product research and development, existing and future product designs and performance specifications.
| CUI//PROPIN   |
| Business Information | you do not handle CUI, implementing the security requirements in SP 800-171 will                                                                                | help you take |

| Access Control                    | Maintenance         | Security Assessment and Monitoring   |
|-----------------------------------|---------------------|--------------------------------------|
| Awareness and Training            | Media Protection    | System and Communications Protection |
| Audit and Accountability          | Personnel Security  | System and Information Integrity     |
| Configuration Management          | Physical Protection | Planning                             |
| Identification and Authentication | Risk Assessment     | System and Services Acquisition      |
| Incident Response                 |                     | Supply Chain Risk Management         |


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does IoT Non-Technical Supporting Capability Core Baseline provide? (Part 8)

[Assistant]
ies included in this baseline. Figure 1: How customers and others in the IoT device ecosystem will use the capabilities in the baseline if provided by IoT device manufacturers and supporting entities.
<!-- image -->

Documentation captures information potential customers and others in the ecosystem may need to know about the IoT devices and ways in which it, and associated data and systems, can be secured. Such documentation is also often necessary prior to purchase and throughout the IoT device's lifecycle for the customer and others in the ecosystem (e.g., auditors and assessors). This documentation supports the appropriate treatment of risk, compliance, and assurance from internal and external perspectives when the IoT device and associated systems are implemented within the customer environment. As shown in Figure 1, documentation acts as a pillar of support for other non-technical capabilities. This is because other non-technical capabilities, including those in the IoT non-technical supporting baseline, will use the information captured via documentation to customize their delivery. Information and Query Reception occurs after purchase and allows customers and others in the ecosystem (e.g., researchers, product rating organizations) to submit questions and other information related to securing the IoT device and associated systems. The manufacturer and supporting parties can then respond. Information and query reception can assist customers and others in many ways throughout the lifecycle of an IoT device such as by allowing manufacturers and supporting third -party entities to adapt and update their support services (e.g., provided through other non-technical supporting capabilities) for the customers' cybersecurity needs and goals. Information Dissemination allows for information to continue to flow to customers and others in the ecosystem about the cybersecurity of their IoT devices and associated systems.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Maintenance?

[Assistant]
According to Recommendation for Pair-Wise Key-Establishment Schemes Using Discrete Logarithm Cryptography:

- [RFC 4492] Elliptic  Curve  Cryptography  (ECC)  Cipher  Suites  for  Transport  Layer Security (TLS), May 2006, see https://tools.ietf.org/html/rfc4492. - [RFC 5903] Elliptic Curve Groups Modulo a Prime (ECP Groups) for IKE and IKEv2, June 2010, see https://tools.ietf.org/html/rfc5903. - [RFC 7919] Negotiated Finite Field Diffie-Hellman Ephemeral Parameters, August 2016, see https://tools.ietf.org/html/rfc7919. - [SECG] Standards for Efficient Cryptography Group, see http://www.secg.org/. - [SEC2] Standards for Efficient Cryptography, SEC 2: Recommended Elliptic Curve Domain Parameters, September 2000, see http://www.secg.org/SEC2-Ver1.0.pdf. - [SP 800-38B]  Special Publication 800-38B, Recommendation for Block Cipher Modes of Operation: The CMAC Mode for Authentication ,  May  2005,  with  updates dated October 2016. https://doi.org/10.6028/NIST.SP.800-38B
- [SP 800-38C]  Special Publication 800-38C, Recommendation for Block Cipher Modes of Operation: the CCM Mode for Authentication and Confidentiality , May 2004, with updates dated July 2007. https://doi.org/10.6028/NIST.SP.800-38C
- [SP 800-38F]  Special Publication 800-38F, Recommendation for Block Cipher Modes of Operation: Methods for Key Wrapping , December 2012. https://doi.org/10.6028/NIST.SP.800-38F
- [SP 800-52] Special Publication 800-52 Revision 2 (DRAFT), Guidelines for the Selection, Configuration and Use of Transport Layer Security (TLS) Implementations , November 15, 2017. https://csrc.nist.gov/publications/detail/sp/800-52/rev-2/draft
- [SP 800-56B]  Special  Publication  800-56B  Revision  1, Recommendation  for  Pair-Wise Key-Establishment  Schemes  Using  Integer  Factorization  Cryptography , September 2014. https://doi.org/10.6028/NIST.SP.800-56Br1
- [SP 800-56C]  Special Publication 800-56C Revision 1, Recommendation for Key Derivation Methods in Key Establishment Schemes , April 2018.

Recommendation for Pair-Wise Key-Establishment Schemes Using Discrete Logarithm Cryptography


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Protecting Controlled Unclassified Information (CUI)_ NIST Special Publication 800-171, Revision 3. Small Business Primer provide? (Part 4)

[Assistant]
00-171A, Assessing Security Requirements for Controlled Unclassified Information provides assessment procedures and a methodology to conduct assessments of the CUI security requirements in SP 800-171.
NIST SP 800-172, Enhanced Security Requirements for Protecting Controlled Unclassified Information provides enhanced security requirements to help protect CUI associated with critical programs or high value assets in nonfederal systems and organizations from the advanced persistent threat (APT). The SP 800-172 enhanced security requirements are designed to protect confidentiality, integrity and availability of information. <!-- image -->

NIST SP 800-172A, Assessing Enhanced Security Requirements for Controlled Unclassified Information provides assessment procedures and a methodology to conduct assessments of the enhanced security requirements in SP 800-172. ## A is for Assessment

Knowing what requirements to implement is important, but it is also important to understand how to evaluate the organization's implementation. Both publications work handin-hand for full implementation. ht ps:/

csrc.nist.gov/projects/protecting-control ed-unclas

<!-- image -->

ified-information

Protecting information from unauthorized modification

## Key Term: Security Requirement

[SP 800-171] Security Requirement: Security outcomes levied on a nonfederal organization to ensure adequate measures are taken to protect the confidentiality of CUI being processed, stored, or transmitted. <!-- image -->

<!-- image -->

Important Note: The security requirements in NIST SP 800-171 are only applicable to components of nonfederal systems that process, store, or transmit CUI or that provide protection for such components. Protecting information from unauthorized access and disclosure

Preventing disruption in how information is accessed

<!-- image -->

2 SP 800-171 does not explicitly cover integrity and availability so it is not a comprehensive security program.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice CM.L2-3.4.3 (NIST 3.4.3)?

[Assistant]
According to Guide to Malware Incident Prevention and Handling for Desktops and Laptops:

3.4.3                                                                                | Firewalls... 3.4.3 Firewalls

A network firewall is a device deployed between networks to restrict which types of traffic can pass from one network to another.

Guide to Malware Incident Prevention and Handling for Desktops and Laptops


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Personnel Security?

[Assistant]
According to Risk Management Framework for Information Systems and Organizations_ A System Life Cycle Approach for Security and Privacy:

the Federal Information Security Modernization Act of 2014 (FISMA), the Privacy Act of 1974, OMB policies, and Federal Information Processing Standards, among other laws,  regulations,  and  policies.
The  scope  of  this  publication  pertains  to  federal  information systems,  which  are  discrete  sets  of  information  resources  organized  for  the  collection, processing, maintenance, use, sharing, dissemination, or disposition of information, whether such information is in digital or non-digital form. Information resources include information and related resources, such as personnel, equipment, funds, and information technology.

Risk Management Framework for Information Systems and Organizations_ A System Life Cycle Approach for Security and Privacy