[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What guidance does A Data Structure for Integrity Protection with Erasure Capability provide?

[Assistant]
## A Data Structure for Integrity Protection with Erasure Capability

D. Richard Kuhn Computer Security Division Information Technology Laboratory

May 20, 2022

This publication is available free of charge from: https://doi.org/10.6028/NIST.CSWP.25

This publication is a final version of a draft cybersecurity white paper originally published on May 31, 2018: https://csrc.nist.gov/publications/detail/white-paper/2018/05/31/data-structure-for-integrityprotection-with-erasurecapability/draft. <!-- image -->

## Abstract

This document describes a data structure, referred to as a data block matrix, that supports the ongoing addition of hash-linked records while also allowing for the deletion of arbitrary records, thereby preserving hash-based integrity assurance that other blocks are unchanged. The block matrix data structure may have utility for incorporation into applications requiring integrity protection that currently use permissioned blockchains. This capability could for example be useful in meeting privacy requirements such as the European Union General Data Protection Regulation (GDPR), which requires that organizations make it possible to delete all information related to a particular individual, at that person's request. ## Keywords

blockchain; computer security; data structure; distributed ledger; hash; integrity protection. ## Patent and Licensing

The data block matrix technology (US Patent #11,175,826) is available to be licensed . For information on patent and licensing see NIST Technology Partnerships Office (TPO). Parties interested in licensing a NIST-owned invention may contact TPO, or may complete a research license application or commercial use license application. Instructions on how to submit the license application are provided at the end of each application. When a license application is received, TPO will contact you regarding the licensing process and to obtain additional information that may be necessary for the application process.

A Data Structure for Integrity Protection with Erasure Capability


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Guide for Developing Security Plans for Federal Information Systems provide? (Part 8)

[Assistant]
|
| 3.4 AUTHORIZING OFFICIAL ..........................................................................................................
| 20                                                                                |
| 3.5 OTHER DESIGNATED CONTACTS.............................................................................................. | 20                                                                                |
| 3.6 ASSIGNMENT OF SECURITY RESPONSIBILITY ........................................................................... | 21                                                                                |
| 3.7 SYSTEM OPERATIONAL STATUS............................................................................................... | 21                                                                                |
| 3.8 INFORMATION SYSTEM TYPE ................................................................................................... | 21                                                                                |
| 3.9 GENERAL DESCRIPTION/PURPOSE............................................................................................ | 21                                                                                |
| 3.10 SYSTEM ENVIRONMENT .........................................................................................................

Guide for Developing Security Plans for Federal Information Systems

Audit and Accountability
System and Information Integrity
Security Assessment
Media Protection
Identification and Authentication
Awareness and Training
System and Communications Protection
Access Control
Planning
Incident Response
Risk Assessment
Personnel Security
System and Services Acquisition
Supply Chain Risk Management
Maintenance
Physical Protection
Configuration Management


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Audit and Evaluation of Computer Security II_ System Vulnerabilities and Controls provide? (Part 8)

[Assistant]
xcellent coordination activities while the workshop sessions were in progress; Dennis K. Branstad for the photographs taken during the workshop; and Tina Faecke for her steadfast typing support. Z. G.
Ruthberg, Editor

## TABLE OF CONTENTS

| FOREWORD                                                                        | FOREWORD                                                                                | FOREWORD                                                                              | HI              |
|---------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------|-----------------|
| ABSTRACT                                                                        | ABSTRACT                                                                                | ABSTRACT                                                                              | Iv              |
| ACKNOWLEDGEtENTS                                                                | ACKNOWLEDGEtENTS                                                                                | ACKNOWLEDGEtENTS                                                                      | Iv              |
| EXECUTIVE SUMMARY                                                               | EXECUTIVE SUMMARY                                                                                | EXECUTIVE SUMMARY                                                                     | xlll            |
| PART T: INTRODUCTION                                                            | PART T: INTRODUCTION                                                                             | PART T: INTRODUCTION                                                                  | 1-]             |
| 1.

Audit and Evaluation of Computer Security II_ System Vulnerabilities and Controls


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Access Control?

[Assistant]
According to Guide to a Secure Enterprise Network Landscape:

ovided by stateful inspection, this has capabilities related to finding hidden threats within the data stream, such as attempts at data exfiltration, violations of content policies, malware, and more.
- Threat detection and response: Modern firewalls can gather and analyze enough data across multiple packets and sessions to detect threats and security incidents targeted at a particular system or a family of systems. These data from multiple firewalls can also be directed toward security information and event management (SIEM) and correlated with data from other security tools and IT systems to detect enterprise-wide attacks that span multiple systems and network layers. In addition, these data can be used to understand evolving threats and define new access rules, attack patterns, and defensive strategies [6]. - Logging and auditing capabilities: Logging and auditing capabilities result in the construction of network events that can be used to identify patterns of performance and security issues. - Access control functions: Access control functions enforce granular sophisticated access control policies. - Multiple locations and functions: Firewalls reside at different locations to perform different functions. Firewalls at the network edge perform the network perimeter protection function by filtering disallowed sources and destinations and blocking the packets of potential threats. Firewalls inside a data center can segment the internal network to prevent the lateral movement of traffic and isolate sensitive resources (e.g., services and data stores). Device-based firewalls prevent malicious traffic in and out of endpoints. - Open Application Programming Interfaces (APIs): These enable integration with many networking products that provide additional security capabilities.

Guide to a Secure Enterprise Network Landscape


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Audit and Accountability?

[Assistant]
According to Analyzing Collusion Threats in the Semiconductor Supply Chain:

## 3.3. Analyze Stages of Hardware Development Life Cycle for Exploitability of the Threat

Analyzing Collusion Threats in the Semiconductor Supply Chain


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Physical Protection?

[Assistant]
According to Audit and Evaluation of Computer Security:

The National Bureau of Standards^ was established by an act of Congress March 3, 1901. The Bureau's overall goal is to
strengthen and advance the Nation's science and technology and facilitate their effective application for public benefit. To this
end, the Bureau conducts research and provides: (1) a basis for the Nation's physical measurement system, (2) scientific and
technological services for industry and government, (3) a technical basis for equity in trade, and (4) technical services to pro-
mote public safety. The Bureau consists of the Institute for Basic Standards, the Institute for Materials Research, the Institute
for Applied Technology, the Institute for Computer Sciences and Technology, the Office for Information Programs, and the
Office of Experimental Technology Incentives Program.

THE INSTITUTE FOR BASIC STANDARDS provides the central basis within the United States of a complete and consist-
ent system of physical measurement; coordinates that system with measurement systems of other nations; and furnishes essen-
tial services leading to accurate and uniform physical measurements throughout the Nation's scientific community, industry,
and commerce. The Institute consists of the Office of Measurement Services, and the following center and divisions:

Analytical Chemistry — Polymers — Metallurgy — Inorganic Materials — Reactor Radiation — Physical Chemistry.
THE INSTITUTE FOR APPLIED TECHNOLOGY provides technical services developing and promoting the use of avail-
able technology; cooperates with public and private organizations in developing technological standards, codes, and test meth-
ods; and provides technical advice services, and information to Government agencies and the public. The Institute consists of
the following divisions and centers:

Audit and Evaluation of Computer Security


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice IA.L2-3.5.1 (NIST 3.5.1)?

[Assistant]
According to Contingency Planning Guide for Federal Information Systems:

3.5.1                                                                                |                                                                                |                                                                                |
|                                                                                | 3. 3.5.1 Testing

ISCP testing is a critical element of a viable contingency capability.

Contingency Planning Guide for Federal Information Systems


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Cryptographic Module Validation Program (CMVP) Security Policy Requirements_ CMVP Validation Authority Updates to ISO_IEC 24759 and ISO_IEC 19790 Anne provide? (Part 6)

[Assistant]
| General.......................................................................................................................
2        |
|                                                                                | Modifications .............................................................................................................. 2          |
|                                                                                | Security Requirements .................................................................................................... 3            |
|                                                                                | Changes to ISO/IEC 24759 Section 6.14 and ISO/IEC 19790 Annex B Requirements3                                                           |
|                                                                                | Documentation Requirement Additions....................................................................... 4                            |
|                                                                                | Documentation Input, Structure, and Formatting......................................................... 6                               |
| Appendix A. Document Revisions......................................................................................24 | Appendix A. Document Revisions......................................................................................24                  |
| Appendix B. List of Symbols, Abbreviations, and Acronyms...........................................25                  | Appendix B.

Cryptographic Module Validation Program (CMVP) Security Policy Requirements_ CMVP Validation Authority Updates to ISO_IEC 24759 and ISO_IEC 19790 Anne


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for Supply Chain Risk Management?

[Assistant]
According to Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171:

The system component inventory includes system-specific information required for component accountability and to provide support to identify, control, monitor, and verify configuration items in accordance with the authoritative source. The information necessary for effective accountability of system components includes the system name, hardware and software component owners, hardware inventory specifications, software license information, software version numbers, andfor networked components-the machine names and network addresses. Inventory specifications include the manufacturer, supplier information, component type, date of receipt, cost, model, serial number, and physical location. Organizations also use automated mechanisms to implement and maintain authoritative (i.e., up-to-date, complete, accurate, and available) baseline configurations  for  systems  that  include  hardware  and  software  inventory  tools,  configuration management tools, and network management tools. Tools can be used to track version numbers on operating systems, applications, types of software installed, and current patch levels.

- 3.11.6e  Assess, respond to, and monitor supply chain risks associated with organizational systems and system components.

Supply chain events include disruption, use of defective components, insertion of counterfeits, theft,  malicious development practices, improper delivery practices, and insertion of malicious code. These events can have a significant impact on a system and its information and, therefore, can also adversely impact organizational operations (i.e., mission, functions, image, or reputation), organizational assets, individuals, other organizations, and the Nation. The supply chain-related events may be unintentional or malicious and can occur at any point during the system life cycle. An analysis of supply chain risk can help an organization identify systems or components for which additional supply chain risk mitigations are required.

Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does IoT Non-Technical Supporting Capability Core Baseline provide? (Part 10)

[Assistant]
eiving input from stakeholders. It represents a coordinated effort to produce a definition of common capabilities not an exhaustive list. The core baseline is intended to be a flexible starting point.
Manufacturers and supporting parties can use the IoT non-technical supporting capability core baseline in the context of the activities in NISTIR 8259 and that is appropriate to them. It is important to note that manufacturers and supporting third parties should implement the non-technical supporting capabilities that support the risk management needs of customers of the IoT device within its intended digital ecosystem. This will then result in each of the individual non-technical supporting capabilities in the baseline being implemented in a manner consistent with the needs and expectations of those customers. If additional supporting capabilities are necessary to enable secure use of the devices, organizations are encouraged to consider defining additional supporting capabilities that better suit their use case(s). 1  One resource supporting both Information Reception and Information Dissemination to others in the ecosystem about vulnerabilities is found in Draft NIST SP 800-216: Federal Vulnerability Disclosure Guidelines [17] . This document recommends guidance for establishing a federal vulnerability disclosure framework and highlights the importance of proper handling of vulnerability reports and communicating the minimization or elimination of vulnerabilities. ## 2 The IoT Non-Technical Supporting Capability Core Baseline

Table 1 defines the IoT device non-technical supporting capability core baseline, which, in combination with the device cybersecurity (technical) capability core baseline of NISTIR 8259A, can make it possible to secure an IoT device.

IoT Non-Technical Supporting Capability Core Baseline


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Audit and Accountability?

[Assistant]
According to Addressing Visibility Challenges with TLS 1.3 within the Enterprise_ High-Level Document:

Loss of visibility into received network traffic can impair critical functions such as network and application performance monitoring, security logging, and diagnostics, which undermines the effectiveness of network and security operations and engineering teams. Without the ability to decrypt network data for deep packet inspection (DPI), monitoring, or diagnostics, enterprises will rely on endpoint devices for performance and security information. The incoming network data stream can contain information or perspectives that individual endpoint devices, like workstations, servers, etc., that support a security client are not capable of providing. Reliance on endpoints in the absence of visibility into network traffic introduces security and operational risks for network and data center operations in the following ways :

- Visibility into network data is even more critical when the endpoints are having problems or are in any way compromised. A degraded or compromised endpoint device may fail to report incidents that can be detected within the incoming network data stream. -  Visibility into network data is essential to enable the ability to discover issues that involve multiple platforms or multiple organizations within the enterprise. -  Visibility into network data is required when sessions span across devices that do not log information well or at all. Even with devices that do logging well, it is frequently necessary to augment that logging by having visibility to related network data. Even where endpoint data is adequate, it still needs to be collected, consolidated, centralized, and correlated. -  When logging of network traffic is turned off or reduced, which is often the case, visibility into network data may be the only alternative to see anomalies.

Addressing Visibility Challenges with TLS 1.3 within the Enterprise_ High-Level Document


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Overview and Considerations of Access Control Based on Attribute Encryption provide? (Part 2)

[Assistant]
may wish to closely follow the development of these new publications by NIST. Organizations are encouraged to review all draft publications during public comment periods and provide feedback to NIST.
Many NIST cybersecurity publications, other than the ones noted above, are available at https://csrc.nist.gov/publications. ## NIST Technical Series Policies

Copyright, Use, and Licensing Statements NIST Technical Series Publication Identifier Syntax

## Publication History

Approved by the NIST Editorial Review Board on 2023-12-19 Supersedes NIST Internal Report 8450 (September 2023) https://doi.org/10.6028/NIST.IR.8450

## How to Cite this NIST Technical Series Publication:

Hu VC (2023) Overview and Considerations of Access Control Based on Attribute Encryption. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Interagency or Internal Report (IR) NIST IR 8450-upd1, Includes updates as of December 20, 2023. https://doi.org/10.6028/NIST.IR.8450-upd1

## Author ORCID iDs

Vincent C. Hu: 0000-0002-164 6 -0584

## Contact Information

ir8450-comments@nist.gov

National Institute of Standards and Technology Attn: Computer Security Division, Information Technology Laboratory 100 Bureau Drive (Mail Stop 8930) Gaithersburg, MD 20899-8930

All comments are subject to release under the Freedom of Information Act (FOIA). ## Abstract

Encryption technology can be incorporated into access control mechanisms based on user identities, user attributes, or resource attributes. Traditional public-key encryption requires different data to have different keys that can be distributed to users who satisfy perspective access control policies along with the encrypted version of the data. However, some distributed or pervasive system environments wish to avoid the public-key encryption's all-or-nothing data access limitation when considering their performance requirements.

Overview and Considerations of Access Control Based on Attribute Encryption


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Assessing Security and Privacy Controls in Information Systems and Organizations provide? (Part 2)

[Assistant]
etary of Commerce, OMB Director, or any other federal official. This
publication may be used by nongovernmental organizations on a voluntary basis and is not
subject to copyright in the United States.
Attribution would, however, be appreciated by NIST. National Institute of Standards and Technology Special Publication 800-53A Revision 5
Natl. Inst. Stand. Technol. Spec. Publ. 800-53A, Rev. 5, 733 pages (January 2022)
CODEN: NSPUE2

This publication is available free of charge from:
https://doi.org/10.6028/NIST.SP.800-53Ar5

Certain commercial entities, equipment, or materials may be identified in this document to describe an
experimental procedure or concept adequately. Such identification is not intended to imply
recommendation or endorsement by NIST, nor is it intended to imply that the entities, materials, or
equipment are necessarily the best available for the purpose. There may be references in this publication to other publications currently under development by NIST in
accordance with its assigned statutory responsibilities. The information in this publication, including
concepts, practices, and methodologies may be used by federal agencies even before the completion of
such companion publications. Thus, until each publication is completed, current requirements, guidelines,
and procedures, where they exist, remain operative. For planning and transition purposes, federal
agencies may wish to closely follow the development of these new publications by NIST. Organizations are encouraged to review draft publications during the designated public comment periods
and provide feedback to NIST. Many NIST publications, other than the ones noted above, are available at
https://csrc.nist.gov/publications.

Assessing Security and Privacy Controls in Information Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Access Control?

[Assistant]
According to Ascon-Based Lightweight Cryptography Standards for Constrained Devices_ Authenticated Encryption, Hash, and Extendable Output Functions:

| 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . |   1 |
|-----------------------------------------------------------------------------------------------------------------------------------------------------------------|-----|
| 2. Preliminaries.......................................................................... |   3 |
| 2.1. Auxiliary Functions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . |   7 |
| 3. Ascon Permutations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . |   8 |
| 3.1. Internal State . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . |   8 |
| 3.2. Constant-Addition Layer 𝑝 𝐶 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . |   8 |
| 3.3. Substitution Layer 𝑝 𝑆 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . |   9 |
| 3.4. Linear Diffusion Layer 𝑝 𝐿 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . |  10 |
| 4. Authenticated Encryption Scheme: Ascon-AEAD128 . . . . . . . . . . . . . . . . . . . . . . . . . . . . |  11 |
| 4.1. Specification of Ascon-AEAD128 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . |  11 |
| 4.1.1. Encryption . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . |  11 |
| 4.1.2. Decryption . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . |  15 |
| 4.2. Implementation Options . . . . . . . . . . . . . . . . . . . . . . . . . .

Ascon-Based Lightweight Cryptography Standards for Constrained Devices_ Authenticated Encryption, Hash, and Extendable Output Functions


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Audit and Accountability?

[Assistant]
According to Secure Software Development Practices for Generative AI and Dual-Use Foundation Models_ An SSDF Community Profile:

| Practice                                                                                | Task                                                                                | Priority   | Recommendations [R], Considerations [C], and Notes [N] Specific to AI Model Development                                                                                | Informative References                                                               |
|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------|
| that they can be remediated more quickly in accordance with risk, reducing the window of opportunity for attackers. | and third-party components that the software uses, and investigate all credible reports.

Secure Software Development Practices for Generative AI and Dual-Use Foundation Models_ An SSDF Community Profile


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Configuration Management?

[Assistant]
According to Data Integrity_ Detecting and Responding to Ransomware and Other Destructive Events:

| 1 | Summary..............................................................................................1 | Summary..............................................................................................1 | |-----|------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | | 1.1 | Challenge.......................................................................................................................2 | | | 1.2 | Solution..........................................................................................................................2 | | | 1.3 | Benefits..........................................................................................................................3 | | 2 | How to Use This Guide.........................................................................4 | How to Use This Guide.........................................................................4 | | | 2.1 | Typographic Conventions..............................................................................................5 | | 3 | Approach .............................................................................................6 | Approach .............................................................................................6 | | | 3.1 | Audience........................................................................................................................6 | | | 3.2 | Scope .............................................................................................................................6 | | | 3.3 | Assumptions..................................................................................................................7 | | | 3.4 | Risk Assessment ............................................................................................................7 | | | 3.4.1 | Risk................................................................................................................................8 | | | | 3.4.2 Security Control Map....................................................................................................9 | | | 3.5 Technologies................................................................................................................13 | 3.5 Technologies................................................................................................................13 | | 4 | Architecture .......................................................................................16 | Architecture .......................................................................................16 | | | 4.1 Architecture Description .............................................................................................16 | 4.1 Architecture Description .............................................................................................16 | | | 4.1.1 | High-Level Architecture ..............................................................................................16 | | | 4.1.2 | Architecture Components...........................................................................................17 | | 5 | Security Characteristic Analysis..........................................................20 | Security Characteristic Analysis..........................................................20 | | | 5.1 Assumptions and Limitations | ......................................................................................20 | | | 5.2 Build | Testing................................................................................................................20 | | | 5.3 | Scenarios and Findings................................................................................................21 | | | 5.3.1 | Ransomware via Web Vector and Self-Propagation...................................................21 | | | 5.3.2 | Destructive Malware via USB Vector..........................................................................22 | | |

Data Integrity_ Detecting and Responding to Ransomware and Other Destructive Events


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Security Assessment?

[Assistant]
According to Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule_ A Cybersecurity Resource Guide:

| Executive Summary............................................................................................................................1      |
|-----------------------------------------------------------------------------------------------------------------------------------------------------|
| 1. Introduction...................................................................................................................................4 |
| 2. HIPAA Security Rule .......................................................................................................................9     |
| 3. Risk Assessment Guidance............................................................................................................14           |
| 4. Risk Management Guidance .........................................................................................................24             |
| 5. Considerations When Implementing the HIPAA Security Rule........................................................28                               |
| 5.1.2. Assigned Security Responsibility (§ 164.308(a)(2)) ....................................................................35                    |
| 5.1.3. Workforce Security (§ 164.308(a)(3)).........................................................................................36              |
| 5.1.4. Information Access Management (§ 164.308(a)(4)) ..................................................................38                         |
| 5.1.5. Security Awareness and Training (§ 164.308(a)(5)) ...................................................................41                      |
| 5.1.6. Security Incident Procedures (§ 164.308(a)(6)) .........................................................................44                   |
| 5.1.7. Contingency Plan (§ 164.308(a)(7))............................................................................................47             |
| 5.1.8.

Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule_ A Cybersecurity Resource Guide


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Incident Response?

[Assistant]
According to Incident Response Recommendations and Considerations for Cybersecurity Risk Management_ A CSF 2.0 Community Profile:

## Incident Response Recommendations and Considerations for Cybersecurity Risk Management

## Incident Response Recommendations and Considerations for Cybersecurity Risk Management

Nelson A, Rekhi S, Souppaya M, Scarfone K (2025) Incident Response Recommendations and Considerations for Cybersecurity Risk Management: A CSF 2.0 Community Profile. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) NIST SP 800-61r3. https://doi.org/10.6028/NIST.SP.800-61r3

Incident Response Recommendations and Considerations for Cybersecurity Risk Management_ A CSF 2.0 Community Profile


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Services Acquisition?

[Assistant]
According to Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations:

There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may be used by federal agencies even before the completion of such companion publications. Thus, until each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning and transition purposes, federal agencies may wish to closely follow the development of these new publications by NIST.

Organizations are concerned about the risks associated with products and services that may potentially contain malicious functionality, are counterfeit, or are vulnerable due to poor manufacturing and development practices within the supply chain. These risks are associated with an enterprise's decreased visibility into and understanding of how the technology they acquire is developed, integrated, and deployed or the processes, procedures, standards, and practices used to ensure the security, resilience, reliability, safety, integrity, and quality of the products and services.

This publication provides guidance to organizations on identifying, assessing, and mitigating cybersecurity risks throughout the supply chain at all levels of their organizations. The publication integrates cybersecurity supply chain risk management (C-SCRM) into risk management activities by applying a multilevel, C-SCRM-specific approach, including guidance on the development of C-SCRM strategy implementation plans, C-SCRM policies, C-SCRM plans, and risk assessments for products and services.

Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Maintenance?

[Assistant]
According to Recommendation for Pair-Wise Key-Establishment Schemes Using Discrete Logarithm Cryptography:

, September 2014. https://doi.org/10.6028/NIST.SP.800-56Br1
- [SP 800-56C]  Special Publication 800-56C Revision 1, Recommendation for Key Derivation Methods in Key Establishment Schemes , April 2018.
https://doi.org/10.6028/NIST.SP.800-56Cr1
- [SP 800-57] Special  Publication  800-57  Part  1  Revision  4, Recommendation  for  Key Management , January 2016. https://doi.org/10.6028/NIST.SP.800-57pt1r4
- [SP 800-89] Special Publication (SP) 800-89, Recommendation for Obtaining Assurances for Digital Signature Applications , November 2006. https://doi.org/10.6028/NIST.SP.800-89
- [SP 800-90] Special Publication 800-90 series: Special  Publication  800-90A  Revision  1, Recommendation  for  Random Number Generation Using Deterministic Random Bit Generators , June 2015. https://doi.org/10.6028/NIST.SP.800-90Ar1

Recommendation for Pair-Wise Key-Establishment Schemes Using Discrete Logarithm Cryptography


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for Awareness and Training?

[Assistant]
According to Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171:

| CHAPTERONE INTRODUCTION...................................................................................................... | CHAPTERONE INTRODUCTION...................................................................................................... |
|--------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------|
| 1.1 PURPOSEANDAPPLICABILITY                                                                                | ................................................................................................... 3                                            |
| 1.2 TARGET AUDIENCE                                                                                | .................................................................................................................. 4                             |
| 1.3 ORGANIZATIONOF THIS SPECIAL PUBLICATION                                                                                | .......................................................................... 4                                                                     |
| CHAPTERTWO THE FUNDAMENTALS............................................................................................ 5                        | CHAPTERTWO THE FUNDAMENTALS............................................................................................ 5                        |
| 2.1 DEVELOPMENTAPPROACH ......................................................................................................


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does A Zero Trust Architecture Model for Access Control in Cloud-Native Applications in Multi-Cloud Environments provide? (Part 6)

[Assistant]
............................... 1                                   | Executive Summary.................................................................................................................
1                                   |
|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Introduction ...................................................................................................................... | Introduction ...................................................................................................................... | 2                                                                                |
|                                                                                | Background - Zero Trust Principles and Zero Trust Architecture................................

A Zero Trust Architecture Model for Access Control in Cloud-Native Applications in Multi-Cloud Environments


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AU.L2-3.3.1 (NIST 3.3.1)?

[Assistant]
According to The Federal Cybersecurity Awareness Workforce_ Professional Backgrounds, Knowledge, Skills, and Development Activities:

3.3.1 Education... 3.3.1 Education... 3.3.1 Education...

The Federal Cybersecurity Awareness Workforce_ Professional Backgrounds, Knowledge, Skills, and Development Activities


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Services Acquisition?

[Assistant]
According to Audit and Evaluation of Computer Security II_ System Vulnerabilities and Controls:

s to interested specialists in the academic and private sectors. Those wishing to receive notices of publications in this series should complete and return the form at the end of this publicaton. | 3.
| POLICY         | AND CONTROL STANDARDS                                                                                | 3-6       |
|------|----------------|-------------------------------------------------------------------------------------------------------|-----------|
|      | 3.1            | General                                                                                | 3-6       |
|      | 3.2            | Assessing Security Safeguards                                                                         | 3-6       |
|      | 3.3            | Establishing Control Standards                                                                        | 3-6       |
|      | 3.4            | Require a Plan to Implement Controls                                                                  | 3-7       |
|      | 3.5            | Establish Personnel Security Policies                                                                 | 3-7       |
| 4. | ALLOCATE       | RESOURCES                                                                                | 3-7       |
|      | 4.1            | General                                                                                | 3-7 3-8   |
| 5. | REPORT         | ON SECURITY                                                                                |           |
|      | 5.1            | General                                                                                | 3-8       |
| Fig. | 1              | Responsibilities and Duties to Provide Security for Data Processing System ..

Audit and Evaluation of Computer Security II_ System Vulnerabilities and Controls


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for Maintenance?

[Assistant]
According to Protecting Controlled Unclassified Information (CUI)_ NIST Special Publication 800-171, Revision 3. Small Business Primer:

| Access Control                    | Maintenance         | Security Assessment and Monitoring   |
|-----------------------------------|---------------------|--------------------------------------|
| Awareness and Training            | Media Protection    | System and Communications Protection |
| Audit and Accountability          | Personnel Security  | System and Information Integrity     |
| Configuration Management          | Physical Protection | Planning                             |
| Identification and Authentication | Risk Assessment     | System and Services Acquisition      |
| Incident Response                 |                     | Supply Chain Risk Management         |

## Updates to the Security Requirements and Families

- It is important to identify permitted and prohibited actions regarding software installation when users have the ability to install software on organizational systems. Permitted software installations could include updates and security patches to existing software and downloading new applications from organizationapproved 'app stores.' Companies might prohibit employees from downloading certain programs, services, software versions, etc .

Protecting Controlled Unclassified Information (CUI)_ NIST Special Publication 800-171, Revision 3. Small Business Primer


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Audit and Evaluation of Computer Security provide? (Part 3)

[Assistant]
ering — Center for Building Technology; Structures, Materials, and Safety; Building
Environment; Technical Evaluation and Application — Center for Fire Research: Fire Science; Fire Safety Engineering.
THE INSTITUTE FOR COMPUTER SCIENCES AND TECHNOLOGY conducts research and provides technical services
designed to aid Government agencies in improving cost effectiveness in the conduct of their programs through the selection,
acquisition, and effective utilization of automatic data processing equipment: and serves as the principal focus wthin the exec-
utive branch for the development of Federal standards for automatic data processing equipment, techniques, and computer
languages. The Institute consist of the following divisions:

Computer Services — Systems and Software — Computer Systems Engineering — Information Technology. THE OFFICE OF EXPERIMENTAL TECHNOLOGY INCENTIVES PROGRAM seeks to affect public policy and process
to facilitate technological change in the private sector by examining and experimenting with Government policies and prac-
tices in order to identify and remove Government-related barriers and to correct inherent market imperfections that impede
the innovation process. THE OFFICE FOR INFORMATION PROGRAMS promotes optimum dissemination and accessibility of scientific informa-
tion generated within NBS; promotes the development of the National Standard Reference Data System and a system of in-
formation analysis centers dealing with the broader aspects of the National Measurement System; provides appropriate services
to ensure that the NBS staff has optimum accessibility to the scientific information of the world. The Office consists of the
following organizational units:

Office of Standard Reference Data — Office of Information Activities — Office of Technical Publications — Library —
Office of International Standards — Office of International Relations.

Audit and Evaluation of Computer Security


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Assessing Enhanced Security Requirements for Controlled Unclassified Information provide? (Part 5)

[Assistant]
ation 800-53A; NIST Special Publication 800-171; NIST Special Publication 800-172; NIST Special Publication 800-172A; nonfederal organization; nonfederal system; security assessment; security control.
\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

## Acknowledgments

The authors wish to recognize the research staff from the NIST Computer Security Division and the Applied Cybersecurity Division for their contributions in helping to improve the content of this publication. A special note of thanks is given to Jeff Brewer, Jim Foti, Cristina Ritfeld, Isabel Van Wyk, and the NIST web team for their outstanding administrative support, and to Kevin Dulany, Chris Enloe, and Ned Goren for their technical review and feedback. The authors also wish to acknowledge the contributions from individuals and organizations in the public and private sectors - nationally and internationally - whose thoughtful and constructive comments improved the overall quality, thoroughness, and usefulness of this publication. \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

## Patent Disclosure Notice

NOTICE: The Information Technology Laboratory (ITL) has requested that holders of patent claims whose use may be required for compliance with the guidance or requirements of this publication disclose such patent claims to ITL. However, holders of patents are not obligated to respond to ITL calls for patents and ITL has not undertaken a patent search in order to identify which, if any, patents may apply to this publication.

Assessing Enhanced Security Requirements for Controlled Unclassified Information


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Cryptographic Module Validation Program (CMVP)-Approved Sensitive Security Parameter Generation and Establishment Methods_ CMVP Validation Authority U provide? (Part 5)

[Assistant]
for details about the SP 800-140x series publications and their relationships to ISO/IEC 19790 and ISO/IEC 24759. ## Audience

This document is intended for use by vendors, testing labs, and the CMVP.
## Table of Contents

|                                                                                | Scope ................................................................................................................................ 1                                                                         |
|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
|                                                                                | Normative references....................................................................................................... 1                                                                                |
|                                                                                | Terms and definitions ......................................................................................................

Cryptographic Module Validation Program (CMVP)-Approved Sensitive Security Parameter Generation and Establishment Methods_ CMVP Validation Authority U


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does IoT Device Cybersecurity Capability Core Baseline provide? (Part 2)

[Assistant]
ts, guidelines, and procedures, where they exist, remain operative. For planning and transition purposes, federal agencies may wish to closely follow the development of these new publications by NIST.
Organizations are encouraged to review all draft publications during public comment periods and provide feedback to NIST. Many NIST cybersecurity publications, other than the ones noted above, are available at https://csrc.nist.gov/publications. ## Comments on this publication may be submitted to:

National Institute of Standards and Technology Attn: Applied Cybersecurity Division, Information Technology Laboratory 100 Bureau Drive (Mail Stop 2000) Gaithersburg, MD 20899-2000

Email: iotsecurity@nist.gov

All comments are subject to release under the Freedom of Information Act (FOIA). ## Reports on Computer Systems Technology

The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the Nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology. ITL's responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in federal information systems. ## Abstract

Device cybersecurity capabilities are cybersecurity features or functions that computing devices provide through their own technical means (i.e., device hardware and software). This publication defines an Internet of Things (IoT) device cybersecurity capability core baseline, which is a set of device capabilities generally needed to support common cybersecurity controls that protect an organization's devices as well as device data, systems, and ecosystems.

IoT Device Cybersecurity Capability Core Baseline


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for Security Assessment?

[Assistant]
According to Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171:

Advanced Persistent Threat; Basic Security Requirement; Contractor Systems; Controlled Unclassified Information; CUI Registry; Derived Security Requirement; Enhanced Security Requirement; Executive Order 13556; FIPS Publication 199; FIPS Publication 200; FISMA; NIST Special Publication 800-53; Nonfederal Organizations; Nonfederal Systems; Security Assessment; Security Control; Security Requirement. | CHAPTERONE INTRODUCTION...................................................................................................... | CHAPTERONE INTRODUCTION...................................................................................................... |
|--------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------|
| 1.1 PURPOSEANDAPPLICABILITY                                                                                | ................................................................................................... 3                                            |
| 1.2 TARGET AUDIENCE                                                                                | .................................................................................................................. 4                             |
| 1.3 ORGANIZATIONOF THIS SPECIAL PUBLICATION                                                                                | .......................................................................... 4                                                                     |
| CHAPTERTWO THE FUNDAMENTALS............................................................................................

Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 1 require for Physical Protection?

[Assistant]
According to IoT Non-Technical Supporting Capability Core Baseline:

The  Information  Technology  Laboratory  (ITL)  at  the  National  Institute  of  Standards  and Technology  (NIST)  promotes  the  U.S. economy  and  public  welfare  by  providing  technical leadership  for  the  Nation's  measurement  and  standards  infrastructure. ITL  develops  tests,  test methods, reference data, proof of concept implementations, and technical analyses to advance the development  and  productive  use  of  information  technology. ITL's  responsibilities  include  the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in federal information systems. Internet of Things (IoT) devices often lack built-in device cybersecurity capabilities, as well as non-technical support relevant to cybersecurity. Customers can use this type of information to help mitigate cybersecurity risks related to the IoT devices and their use. The wide range of connectivity possible for IoT devices, and the ability for these devices to interact with the physical world, means securing these devices often becomes a priority; but it is a challenge for customers when they are not adequately supported.

IoT Non-Technical Supporting Capability Core Baseline


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Awareness and Training?

[Assistant]
According to Guide to Malware Incident Prevention and Handling for Desktops and Laptops:

| 1 | | 1.1 | | Purpose and Scope...................................................................................................1 | | | | 1.2 | Audience ...................................................................................................................1 | | | | 1.3 | Document Structure | ..................................................................................................1 | | 2.

Guide to Malware Incident Prevention and Handling for Desktops and Laptops


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Zero Trust Architecture provide? (Part 5)

[Assistant]
la empresa o personal). La autenticación y la autorización (tanto del sujeto como del dispositivo) son funciones discretas que se realizan antes de establecer una sesión con un recurso de la empresa.
La confianza cero es una respuesta a las tendencias de las redes empresariales que incluyen usuarios remotos, dispositivos personales (BYOD,  por su nombre en inglés bring-your-owned-device )  y activos  basados  en la nube que no se encuentran dentro de los límites de una red propiedad de la empresa. La confianza cero se centra en proteger los recursos (activos, servicios, flujos de trabajo, cuentas de red, etc.), no los segmentos de red, ya que la ubicación de la red ya no se considera el componente principal de la postura  de  seguridad  del recurso. Este  documento  contiene una  definición abstracta  de  la arquitectura de confianza cero (ZTA) y ofrece modelos generales de despliegue y casos de uso en los que la confianza cero podría mejorar la postura global de seguridad de las tecnologías de la información de una empresa. ## Palabras claves

Arquitectura, ciberseguridad, empresa, seguridad de la red, confianza cero. ## Agradecimientos

Este documento es fruto de la colaboración entre múltiples agencias federales y está supervisado por el Consejo Federal de CIO. El subgrupo de arquitectura es responsable del desarrollo de este documento, pero hay personas concretas que merecen reconocimiento. Entre ellas se encuentran Greg Holden, director del proyecto ZTA del Consejo Federal de CIO; Alper Kerman, director del proyecto ZTA del NIST/Centro Nacional de Ciberseguridad; y Douglas Montgomery.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AT.L2-3.2.5 (NIST 3.2.5)?

[Assistant]
According to Multi-Factor Authentication for Criminal Justice Information Systems_ Implementation Considerations for Protecting Criminal Justice Information:

3.2.5. 3.2.5.

Multi-Factor Authentication for Criminal Justice Information Systems_ Implementation Considerations for Protecting Criminal Justice Information


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for Planning?

[Assistant]
According to Protecting Controlled Unclassified Information (CUI)_ NIST Special Publication 800-171, Revision 3. Small Business Primer:

d, communicated, understood, and enforced. Even if cybersecurity activities are outsourced to an external provider, someone within the business should still be designated to manage cybersecurity risk.
|
|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| It's not all technology. | An important point to emphasize is that many requirements in SP 800-171 do not need investments in technology or services to implement. Many requirements can be achieved through the creation of processes and procedures. |
| Implement the requirements and document implementation in a system security plan. | Satisfying the security requirements won't be accomplished overnight. Implement in phases based upon your resources (includin g time, expertise, budget, etc.), starting with understanding what security requirements you may have already satisfied and building from there.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Planning?

[Assistant]
According to Data Integrity_ Detecting and Responding to Ransomware and Other Destructive Events:

Office of Management and Budget, Circular Number A-130: Managing Information as a Strategic Resource [13]
- NIST SP 800-61 Rev. 2: Computer Security Incident Handling Guide [14]
- NIST SP 800-83 Rev.
1: Guide to Malware Incident Prevention and Handling for Desktops and Laptops [15]
- NIST SP 800-150: Guide to Cyber Threat Information Sharing [16]
- NIST SP 800-184: Guide for Cybersecurity Event Recovery [17]

| Cybersecurity Framework v1.1   | Cybersecurity Framework v1.1               | Cybersecurity Framework v1.1                                                                       | Cybersecurity Framework v1.1                      | Standards & Best Practices   | Standards & Best Practices   |
|--------------------------------|--------------------------------------------|----------------------------------------------------------------------------------------------------|---------------------------------------------------|------------------------------|------------------------------|
| Function                       | Category                                   | Subcategory                                                                                | NIST SP 800- 53 R4                                | ISO/IEC 27001:2013           | NIST SP 800- 181             |
|                                | Security Con- tinuous Moni- toring (DE.CM) | DE.AE-5: Incident alert thresholds are estab- lished. | IR-4, IR-5, IR-8                                  | A.16.1.4                     | PR-CIR-001                   |
|                                |                                            | DE.CM-1: The network is monitored to detect po- tential cybersecurity events. | AC-2, AU- 12, CA-7, CM-3, SC-5, SC-7, SI-4        |                              | OM-NET-001                   |
|                                |                                            | DE.CM-3: Personnel ac- tivity is monitored to de- tect potential cybersecu- rity events.

Data Integrity_ Detecting and Responding to Ransomware and Other Destructive Events


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Secure Software Development Framework (SSDF) Version 1.1_ Recommendations for Mitigating the Risk of Software Vulnerabilities provide? (Part 8)

[Assistant]
ware development practices, express their secure software development requirements to third-party suppliers using SSDF conventions, and acquire software that meets the practices described in the SSDF.
Using the SSDF helps organizations to meet the following secure software development recommendations:

- Organizations should ensure that their people, processes, and technology are prepared to perform secure software development. - Organizations should protect all components of their software from tampering and unauthorized access. - Organizations should produce well-secured software with minimal security vulnerabilities in its releases. - Organizations should identify residual vulnerabilities in their software releases and respond appropriately to address those vulnerabilities and prevent similar ones from occurring in the future. The SSDF does not prescribe how to implement each practice. The focus is on the outcomes of the practices rather than on the tools, techniques, and mechanisms to do so. This means that the SSDF can be used by organizations in any sector or community, regardless of size or cybersecurity sophistication. It can also be used for any type of software development, regardless of technology, platform, programming language, or operating environment. The SSDF defines only a high-level subset of what organizations may need to do, so organizations should consult the references and other resources for additional information on implementing the practices. Not all practices are applicable to all use cases; organizations should adopt a risk-based approach to determine what practices are relevant, appropriate, and effective to mitigate the threats to their software development practices. Organizations can communicate how they are addressing the clauses from Section 4 of the President's Executive Order (EO) on 'Improving the Nation's Cybersecurity (14028)' by referencing the SSDF practices and tasks described in Appendix A.

Secure Software Development Framework (SSDF) Version 1.1_ Recommendations for Mitigating the Risk of Software Vulnerabilities


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 1 require for Maintenance?


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Analyzing Collusion Threats in the Semiconductor Supply Chain provide? (Part 5)

[Assistant]
he risk of side-channel analysis is more common in chip use scenarios, whereas the risk of a hardware Trojan is more common in the early stages of design and manufacturing, as shown in Fig. 1. Fig. 1.
Security challenges in the semiconductor supply chain

<!-- image -->

This implies that threat analysis must consider both the type of threat and the various phases of the supply chain in which the threat is most effective. Moreover, one or more adversaries from different stages of supply chain can collaborate to compromise a hardware, which increases the severity of threats. Such insider threats are called collusion threats [6]. This document focuses on potential collusion risks in the hardware supply chain and is organized as follows:

- Section 2 outlines the different phases of a semiconductor supply chain. - Section 3 describes a framework for analyzing supply chain threats. - Section 4 presents two real-life examples of hardware security threats to provide a comprehensive explanation of the proposed framework. - Section 5 concludes the discussion and provides directions for future work. ## 2. Stages of Semiconductor Supply Chain Stages

The first step in analyzing security concerns in the semiconductor supply chain is to outline the various stages of the supply chain and identify potential threats associated with each. There is no standard set of stages. However, for our analysis we will use seven stages as defined by Areno [7]. The user stage has been merged with the deployment stage since they have similar attack surfaces. An end-of-life stage has also been added to the seven stages originally defined by Areno [7]. A brief explanation of the stages is described below

1. Concept: Concept stage is the birthplace of an Integrated Circuit (IC). At this stage, the goals and purpose of an integrated circuit (IC) are formulated, and the scope and target of a hardware component are discussed.

Analyzing Collusion Threats in the Semiconductor Supply Chain


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Summary of NIST SP 800-53, Revision 4_ Security and Privacy Controls for Federal Information Systems and Organizations provide? (Part 2)

[Assistant] ## Table of Contents | 1 | Introduction ............................................................................................................1 | |------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------| | 2 | NIST SP 800-53 Revision 4 and the Risk Management Framework (RMF)........2 | | 3 | Control Baselines and Tailoring ...........................................................................4 | | 4 | Documenting the Control Selection Process ......................................................5 | | 5 | Assurance...............................................................................................................6 | | 6 | Security Controls ...................................................................................................7 | | 7 | International Information Security Standards .....................................................8 | | 8 | Overlays..................................................................................................................9 | | 9 | Privacy ..................................................................................................................10 | | List of Figures | List of Figures | | Figure 1: Risk Management 3-Tiered Approach.........................................................2 | Figure 1: Risk Management 3-Tiered Approach.........................................................2 | | Figure 2: The Risk Management Framework ..............................................................3 | Figure 2: The Risk Management Framework ..............................................................3 | | Figure 3: Security Control Selection Process ............................................................5 | Figure 3: Security Control Selection Process ............................................................5 | ## 1 Introduction In April, 2013, NIST published an update, Revision 4, to NIST Special Publication 800-53, Security and Privacy Controls for Federal Information Systems and Organization .

Summary of NIST SP 800-53, Revision 4_ Security and Privacy Controls for Federal Information Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Overview and Considerations of Access Control Based on Attribute Encryption provide? (Part 8)

[Assistant]
....................25                                   |                                                                                |
| 6.
Conclusion.......................................................................................................................27      | 6. Conclusion.......................................................................................................................27      |                                                                                |
| References ..............................................................................................................................28 | References ..............................................................................................................................28 |                                                                                |
| Appendix A. Change Log ....................................................................................................34               | Appendix A. Change Log ....................................................................................................34               |                                                                                |
| List of Figures                                                                                | List of Figures                                                                                | List of Figures                                                                                |
| Fig. 1.

Overview and Considerations of Access Control Based on Attribute Encryption


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Identification and Authentication?

[Assistant]
According to Automated Secure Configuration Guidance from the macOS Security Compliance Project (mSCP):

| title: "Apple macOS 11 (Big Sur) Test Baseline" description: | This guide describes the prudent actions to take when securing a system against the Test Baseline. authors: | |===                                                                                |
|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| profile:                                                                                |
| - section: "Authentication" rules: - auth_pam_login_smartcard_enforce - auth_pam_su_smartcard_enforce - auth_pam_sudo_smartcard_enforce - auth_smartcard_allow - section: "Auditing" rules: - audit_acls_files_configure - audit_acls_files_mode_configure - audit_acls_folder_wheel_configure |

- audit - OpenBSM 3
- auth - Smartcard authentication
- icloud - Apple's iCloud/Apple ID service
- os - Rules to configure the operating system that do not fit into the other categories
- pwpolicy - Password policy
- system\_settings or sysprefs - Settings controlled within the System Settings or System Preferences application

```
title: "Limit SSHD to FIPS 140 Validated Ciphers" discussion: | If SSHD is enabled, then it _MUST_ be configured to limit the ciphers to algorithms that are FIPS 140-validated. FIPS 140-2 is the current standard for validating that mechanisms used to access cryptographic modules utilize authentication that meets federal requirements. Operating systems utilizing encryption _MUST_ use FIPS-validated mechanisms for authenticating to cryptographic modules.

Automated Secure Configuration Guidance from the macOS Security Compliance Project (mSCP)


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Access Control on NoSQL Databases provide? (Part 8)

[Assistant]
attributes for wide-column and document models......11                                                                                |
| Fig. 9.
Example of defining subject and object attributes for a graph model.......................................12                                                                                |
| Fig. 10. Example of defining subject and object attributes for graph models using edges for permitted actions to embed an access control policy ........................................................................................13 |
| Fig. 11. Generic resource federation model.......................................................................................23                                                                                |
| Fig. 12. Resource federation scheme.................................................................................................23                                                                                |

## Acknowledgments

The author would like to express his thanks to Isabel Van Wyk and Jim Foti of NIST for their detailed editorial review of both the public comment version and the final publication. ## Executive Summary

NoSQL stands for 'not only SQL' or 'non-SQL,' which typically refer to any non-relational database that stores data in a format other than relational tables. It shifts away from relational database management systems (RDBMS) for dealing with enormous and constantly growing data and infrastructure needs and increasingly uses the Web 3.0 framework for big data and real-time web applications, including handling unstructured data like documents, emails, and social media. NoSQL databases are particularly useful for managing unstructured or very large data objects stored across distributed and cooperating devices.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for Identification and Authentication?

[Assistant]
According to Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171:

............................................ 5                        |
| 2.1 DEVELOPMENTAPPROACH ......................................................................................................
| 5                                                                                |
| 2.2 ORGANIZATIONANDSTRUCTURE                                                                                | ............................................................................................. 7                                                  |
| 2.3 FLEXIBLE APPLICATION                                                                                | ............................................................................................................. 9                                  |
| CHAPTER THREE THE REQUIREMENTS......................................................................................... 11                       | CHAPTER THREE THE REQUIREMENTS......................................................................................... 11                       |
| 3.1 ACCESSCONTROL                                                                                | .................................................................................................................. 12                            |
| 3.2 AWARENESSANDTRAINING                                                                                | ...................................................................................................


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Maintenance?

[Assistant]
According to Status Report on the Fourth Round of the NIST Post-Quantum Cryptography Standardization Process:

of Standards and Technology (2024) Module-Lattic-Based Digital Signature Standard. (Department of Commerce, Washington, DC), Federal Information Processing Standards Publication (FIPS) NIST FIPS 204.
https://doi.org/ 10.6028/NIST.FIPS.204
- [5] National Institute of Standards and Technology (2024) Stateless Hash-Based Digital Signature Standard. (Department of Commerce, Washington, DC), Federal Information Processing Standards Publication (FIPS) NIST FIPS 205. https://doi.org/ 10.6028/NIST.FIPS.205
- [6] Aragon N, Barreto PSLM, Bettaieb S, Bidoux L, Blazy O, Deneuville JC, Gaborit P, Ghosh S, Gueron S, Güneysu T, Melchor CA, Misoczk R, Persichetti E, Richter-Brockmann J, Sendrier N, Tillich JP, Vasseur V, Zémor G (2022) BIKE: Bit Flipping Key Encapsulation, 4th Round submission to the NIST's post-quantum cryptography standardization process. https://csrc.nist.gov/projects/post-quantum-cryptography/round-4-submiss ions. - [7] Bernstein DJ, Chou T, Cid C, Gilcher J, Lange T, Maram V, von Maurich I, Misoczki R, Niederhagen R, Persichetti E, Peters C, Sendrier N, Szefer J, Tjhai CJ, Tomlinson M, Wang W (2022) Classic McEliece algorithm specifications and supporting documentation, 4th Round submission to the NIST's post-quantum cryptography standardization process. https://csrc.nist.gov/projects/post-quantum-cryptography/round-4-s ubmissions. - [8] Melchor CA, Aragon N, Bettaieb S, Bidoux L, Blazy O, Deneuville JC, Gaborit P, Persichetti E, Zémor G, Bos J, Dion A, Lacan J, Robert JM, Veron P (2022) HQC algorithm specifications and supporting documentation, 4th Round submission to the NIST's post-quantum cryptography standardization process. https://csrc.nist.gov/projects /post-quantum-cryptography/round-4-submissions. - [9] Jao D, Azarderakhsh R, Campagna M, Costello C, Feo LD, Hess B, Jalali A, Koziel B, LaMacchia B, Longa P, Naehrig M, Renes J, Soukharev V, Urbanik D, Pereira G, Karabina K, Hutchinson A (2022) Supersingular Isogeny Key Encapsulation, 4th Round

Status Report on the Fourth Round of the NIST Post-Quantum Cryptography Standardization Process


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Services Acquisition?

[Assistant]
According to High-Performance Computing Security_ Architecture, Threat Analysis, and Security Posture:

There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may be used by federal agencies even before the completion of such companion publications. Thus, until each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning and transition purposes, federal agencies may wish to closely follow the development of these new publications by NIST. The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the Nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology. ITL's responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in federal information systems. The Special Publication 800-series reports on ITL's research, guidelines, and outreach efforts in information system security, and its collaborative activities with industry, government, and academic organizations. In 2015, Executive Order 13702 established the National Strategic Computing Initiative (NSCI) to maximize the benefits of high-performance computing (HPC) for economic competitiveness and scientific discovery. The ability to process large volumes of data and perform complex calculations at high speeds is a key part of the Nation's vision for maintaining its global competitive edge. Security is essential to achieving the anticipated benefits of HPC.

High-Performance Computing Security_ Architecture, Threat Analysis, and Security Posture


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Incident Response?

[Assistant]
According to Contingency Planning Guide for Federal Information Systems:

| Chapter 1.

Contingency Planning Guide for Federal Information Systems


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Physical Protection?

[Assistant]
According to Proceedings of the Cybersecurity in Cyber-Physical Systems Workshop, April 23-24, 2012:

## Proceedings of the Cybersecurity in CyberPhysical Systems Workshop, April 23 - 24, 2012

## Proceedings of the Cybersecurity in CyberPhysical Systems Workshop, April 23 - 24, 2012

The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the Nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology. ITL's responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in Federal information systems.

Proceedings of the Cybersecurity in Cyber-Physical Systems Workshop, April 23-24, 2012