[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Configuration Management?

[Assistant]
According to Status Report on the Fourth Round of the NIST Post-Quantum Cryptography Standardization Process:

| 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . | . . . | 1              |
|------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------|
| 1.1. | Purpose and Organization of This Document . . . . | 3              |
| 2. Evaluation Criteria and Selection Process . . | . . . . . . . . | 4              |
| 2.1. | Acceptance of the Fourth-Round Candidates . . . . | 4              |
| 2.2. | Evaluation Criteria . . . . . . . . . . . . . . . . . . . . | 4              |
|                                                                                | 2.2.1. Security . . . . . . . . . . . . . . . . . . . . . . | 4              |
|                                                                                | 2.2.2.Cost and Performance . . . . . . . . . . . . . | 5              |
|                                                                                | 2.2.3.Algorithm and Implementation Characteristics                                                                                | 8              |
| 2.3. | Selection of the Candidates for Standardization . . . | 8              |
| 3. Summary of the Fourth-Round Candidates . | . . . . . . . . | 10             |
| 3.1. | HQC . . . . . . . . . . . . . . . . . . . . . . . . . . . . | 10             |
| 3.2. | BIKE . . . . . . . . . . . . . . . . . . . . . . . . . . . . | 12             |
| 3.3. | Classic McEliece . . . . . . . . . . . . . . . . . .

Status Report on the Fourth Round of the NIST Post-Quantum Cryptography Standardization Process


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Services Acquisition?

[Assistant]
According to Data Integrity_ Detecting and Responding to Ransomware and Other Destructive Events:

he State of Maryland and Montgomery County, Maryland. The Technology Partners/Collaborators who participated in this build submitted their capabilities in response to a notice in the Federal Register.
Respondents with relevant capabilities or product components were invited to sign a Cooperative Research and Development Agreement (CRADA) with NIST, allowing them to participate in a consortium to build this example solution. We worked with:

Data Integrity_ Detecting and Responding to Ransomware and Other Destructive Events


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Access Control?

[Assistant]
According to Organizational Views of NIST Cryptographic Standards and Testing and Validation Programs:

## 3.1. Recruitment

Organizational Views of NIST Cryptographic Standards and Testing and Validation Programs


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Incident Response?

[Assistant]
According to Guide to Malware Incident Prevention and Handling for Desktops and Laptops:

## Guide to Malware Incident Prevention and Handling for Desktops and Laptops

## Guide to Malware Incident Prevention and Handling for Desktops and Laptops

Malware, also known as malicious code, refers to a program that is covertly inserted into another program with the intent to destroy data, run destructive or intrusive programs, or otherwise compromise the confidentiality, integrity, or availability of the victim's data, applications, or operating system. Malware is the most common external threat to most hosts, causing widespread damage and disruption and necessitating extensive recovery efforts within most organizations. This publication provides recommendations for improving an organization's malware incident prevention measures. It also gives extensive recommendations for enhancing an organization's existing incident response capability so that it is better prepared to handle malware incidents, particularly widespread ones.

Guide to Malware Incident Prevention and Handling for Desktops and Laptops


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Maintenance?

[Assistant]
According to Assessing Security and Privacy Controls in Information Systems and Organizations:

.......................................................................................... 19
3.1   PREPARE FOR SECURITY AND PRIVACY CONTROL ASSESSMENTS ...............................................
19
3.2   DEVELOP SECURITY AND PRIVACY ASSESSMENT PLANS .............................................................. 23
3.3   CONDUCT SECURITY AND PRIVACY CONTROL ASSESSMENTS ..................................................... 30
3.4   ANALYZE ASSESSMENT REPORT RESULTS ..................................................................................... 32
3.5   ASSESS SECURITY AND PRIVACY CAPABILITIES .............................................................................. 34
CHAPTER FOUR SECURITY AND PRIVACY ASSESSMENT PROCEDURES ................................................. 37
4.1   ACCESS CONTROL............................................................................................................................ 40
4.2   AWARENESS AND TRAINING ........................................................................................................ 118
4.3   AUDIT AND ACCOUNTABILITY ...................................................................................................... 128
4.4   ASSESSMENT, AUTHORIZATION, AND MONITORING ................................................................. 160
4.5   CONFIGURATION MANAGEMENT ................................................................................................ 177
4.6   CONTINGENCY PLANNING ............................................................................................................ 215
4.7   IDENTIFICATION AND AUTHENTICATION .................................................................................... 243
4.8   INCIDENT RESPONSE ...............................................................................................................

Assessing Security and Privacy Controls in Information Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Information Integrity?

[Assistant]
According to Assessing Security and Privacy Controls in Information Systems and Organizations:

CHAPTER ONE INTRODUCTION ............................................................................................................... 1
1.1   PURPOSE AND APPLICABILITY .......................................................................................................... 1
1.2   TARGET AUDIENCE ............................................................................................................................ 4
1.3   RELATED PUBLICATIONS AND ASSESSMENT PROCESSES ............................................................... 4
1.4   ORGANIZATION OF THIS PUBLICATION ........................................................................................... 5
CHAPTER TWO THE FUNDAMENTALS ..................................................................................................... 6
2.1   ASSESSMENTS WITHIN THE SYSTEM DEVELOPMENT LIFE CYCLE .................................................. 6
2.2   CONTROL STRUCTURE AND ORGANIZATION .................................................................................. 7
2.3   BUILDING AN EFFECTIVE ASSURANCE CASE .................................................................................... 8
2.4   ASSESSMENT PROCEDURES: ASSESSMENT OBJECTS, METHODS AND OBJECTIVES ................... 11
CHAPTER THREE THE PROCESS ............................................................................................................. 19
3.1   PREPARE FOR SECURITY AND PRIVACY CONTROL ASSESSMENTS ............................................... 19
3.2   DEVELOP SECURITY AND PRIVACY ASSESSMENT PLANS .............................................................. 23
3.3   CONDUCT SECURITY AND PRIVACY CONTROL ASSESSMENTS ..................................................... 30
3.4   ANALYZE ASSESSMENT REPORT RESULTS .....................................................................................


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Information Integrity?

[Assistant]
According to Audit and Evaluation of Computer Security:

The National Bureau of Standards, with the support of the U.S. Gen-
eral Accounting Office, sponsored an invitational workshop on "Audit and
Evaluation of Computer Security," held in Miami Beach, Florida on March
22-24, 1977.
area and define appropriate subjects for future research.
perts in the audit and computer communities were invited to discuss the
subject in one of ten sessions, each of which considered a different as-
pect.
these reports form the body of these Proceedings.
The ten topics re-
ported on are: Internal Audit Standards, Qualifications and Training,
Security Administration, Audit Considerations in Various System Environ-
ments, Administrative and Physical Controls, Program Integrity, Data In-
tegrity, Communications, Post-Processing Audit Tools and Techniques, and
Interactive Audit Tools and Techniques.

KEYWORDS:
training, communications security, computer controls, computer
security, data integrity, interactive audit, internal audit, post-
processing audit, program integrity.

........
....
Internal Audit Standards
Qualifications and Training ............
.....
Security Administration
Audit Considerations in Various System
.....
Environments
Administrative and Physical Controls .......
.....
Program Integrity
Data Integrity
Communications
Post-Processing Audit Tools and Techniques ....
Interactive Audit Tools and Techniques

Audit and Evaluation of Computer Security


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] How does Summary Report for “Workshop on Updating Manufacturer Guidance for Securable Connected Product Development” support CMMC certification?

[Assistant]
According to Summary Report for “Workshop on Updating Manufacturer Guidance for Securable Connected Product Development”:

n Updating Manufacturer Guidance for Securable Connected Product Development' (National Institute of Standards and Technology, Gaithersburg, MD), NIST Interagency or Internal Report (IR) NIST IR 8562.
https://doi.org/10.6028/NIST.IR.8562

## Author ORCID iDs

Katerina Megas: 0000-0002-2815-5448 Michael Fagan: 0000-0002-1861-2609 Barbara Cuthill: 0000-0002-2588-6165

## Contact Information

iotsecurity@nist.gov

National Institute of Standards and Technology Attn: Applied Cybersecurity Division, Information Technology Laboratory 100 Bureau Drive (Mail Stop 2000) Gaithersburg, MD 20899-2000

## Abstract

This report summarizes the feedback received by the NIST Cybersecurity for the Internet of Things (IoT) program at the in-person and hybrid workshop on "Updating Manufacturer Guidance for Securable Connected Product Development" held in December 2024. The purpose of this workshop was to consider how to update Foundational Cybersecurity Activities for IoT Device Manufacturers (NIST Internal Report (IR) 8259) based on concepts in risk management, operational technology concerns, product end of life concerns and recent trends in IoT cybersecurity and privacy. Over time, the NIST volume of work has built upon the concepts introduced in NIST IR 8259,to add technical (NIST IR 8259A) and nontechnical (NIST IR 8259B) concepts to help manufacturers and customers consider the cybersecurity of IoT devices. The NIST IR 8259 series has been used to inform and develop subsequent publications that elaborate on IoT cybersecurity across sectors and use cases (e.g., federal agency uses cases reflected in NIST SP 800-213 and consumer use cases reflected in NIST IR 8425 and the U.S. Cyber Trust Mark). ## Keywords

cybersecurity baseline; Internet of Things (IoT); IoT products; manufacturing; privacy; risk management; securable products; security requirements; software development; threat modelling. ## Table of Contents

| 1.

Summary Report for “Workshop on Updating Manufacturer Guidance for Securable Connected Product Development”

Audit and Accountability
System and Information Integrity
Security Assessment
Media Protection
Identification and Authentication
Awareness and Training
System and Communications Protection
Access Control
Planning
Incident Response
Risk Assessment
Personnel Security
System and Services Acquisition
Maintenance
Physical Protection
Configuration Management


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Services Acquisition?

[Assistant]
According to Zero Trust Architecture:

Assessment (evaluación). System  Inventory (inventario  del  sistema). User  Inventory (inventario de usuarios). Business Process Review Risk  Assessment  and  Policy  Development políticas). Deployment (implementación). Operations (operaciones).

Se trata de las brechas que afectan a la implementación y despliegue iniciales de la ZTA y a la continuidad de su funcionamiento y madurez. Estas podrían ralentizar la adopción de la ZTA en las organizaciones o provocar la fragmentación de la industria de componentes de ZTA. Los estándares abiertos (producidos por organizaciones de desarrollo de estándares [SDO, por su desarrollo en inglés Standards Development Organization] o un consorcio industrial) podrían ayudar en estas brechas sistémicas.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Maintenance?

[Assistant]
According to Blockchain for Access Control Systems:

| [SP162]   | Hu VC, Ferraiolo DF, Kuhn DR, Schnitzer A, Sandlin K, Miller R, Scarfone KA (2014) Guide to Attribute Based Access Control (ABAC) Definition and Considerations. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) 800-162, Includes updates as of August 02, 2019. https://doi.org/10.6028/NIST.SP.800-162   |
|-----------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| [SP205]   | Hu VC, Ferraiolo DF, Kuhn DR (2019) Attribute Considerations for Access Control Systems. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) 800-205. https://doi.org/10.6028/NIST.SP.800-205                                                                                |
| [XACML]   | OASIS eXtensible Access Control Markup Language (XACML) TC (2020) Organization for the Advancement of Structured Information Standards . Available at https://www.oasis- open.org/committees/tc_home.php?wg_abbrev=xacml                                                                                |
| [ZZH]     | Zhai P, Zhang L, He J (2021) A Review of Blockchain-Based Access Control for the Industrial IoT. CONVERTER 2021(3):308-316. https://doi.org/10.17762/converter.62                                                                                |


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Maintenance?

[Assistant]
According to Automated Secure Configuration Guidance from the macOS Security Compliance Project (mSCP):

nt provides a high-level overview of the mSCP, its components, and some common use cases. It refers readers to the online project documentation for in-depth technical information and use instructions.
This document is intended to be independent of macOS version releases; updates will be released as needed when there are substantial changes to the mSCP. Updates from the previous release of this document mainly involve the new mSCP capability to create a custom benchmark by tailoring a baseline.

Automated Secure Configuration Guidance from the macOS Security Compliance Project (mSCP)


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does IoT Non-Technical Supporting Capability Core Baseline provide? (Part 5)

[Assistant]
publication, no such patent claims have been identified to ITL. No representation is made or implied by ITL that licenses are not required to avoid patent infringement in the use of this publication.
## Table of Contents

| 1                                                                                | Introduction ............................................................................................................1      |
|---------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------|
| 2                                                                                | The IoT Non-Technical Supporting Capability Core Baseline............................4                                          |
| References...................................................................................................................11 | References...................................................................................................................11 |
| Appendix A-Acronyms............................................................................................13               | Appendix A-Acronyms............................................................................................13               |
| Appendix B-Glossary ..............................................................................................14            | Appendix B-Glossary ..............................................................................................14            |

## 1 Introduction

Internet of Things (IoT) devices often lack built-in device cybersecurity capabilities, as well as non-technical support relevant to cybersecurity.

IoT Non-Technical Supporting Capability Core Baseline

Audit and Accountability
System and Information Integrity
Security Assessment
Media Protection
Identification and Authentication
Awareness and Training
System and Communications Protection
Access Control
Planning
Incident Response
Risk Assessment
Personnel Security
System and Services Acquisition
Supply Chain Risk Management
Maintenance
Physical Protection
Configuration Management


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Audit and Accountability?

[Assistant]
According to Organizational Views of NIST Cryptographic Standards and Testing and Validation Programs:

|                                                                                | Introduction ..................................................................................................................... | Introduction ..................................................................................................................... |
|------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
|                                                                                | Background: NIST Cryptographic Standards and Testing/Validation Programs ... 1 Methodology.......................................................................................................... 2 | Background: NIST Cryptographic Standards and Testing/Validation Programs ... 1 Methodology..........................................................................................................


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Automated Secure Configuration Guidance from the macOS Security Compliance Project (mSCP) provide? (Part 3)

[Assistant]
l official. This publication may be used by nongovernmental organizations on a voluntary basis and is not subject to copyright in the United States. Attribution would, however, be appreciated by NIST.
## NIST Technical Series Policies

Copyright, Use, and Licensing Statements NIST Technical Series Publication Identifier Syntax

## Publication History

Approved by the NIST Editorial Review Board on 2023-06-29 Supersedes NIST SP 800-219 (June 2022) https://doi.org/10.6028/NIST.SP.800-219

## How to Cite this NIST Technical Series Publication:

Trapnell M, Trapnell E, Souppaya MP, Gendler B, Brodjieski D, Golbig A, Scarfone K, Heiserman B (2023) Automated Secure Configuration Guidance from the macOS Security Compliance Project (mSCP). (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) NIST SP 800-219r1. https://doi.org/10.6028/NIST.SP.800-219r1

## Author ORCID iDs

Mark Trapnell: 0000-0002-5266-3610

Eric Trapnell: 0000-0001-9315-3732

Murugiah Souppaya: 0000-0002-8055-8527

Bob Gendler: 0000-0002-8928-6492

Karen Scarfone: 0000-0001-6334-9486

## Contact Information

applesec@nist.gov

National Institute of Standards and Technology Attn: Computer Security Division, Information Technology Laboratory 100 Bureau Drive (Mail Stop 8930) Gaithersburg, MD 20899-8930

All comments are subject to release under the Freedom of Information Act (FOIA). ## Abstract

The macOS Security Compliance Project (mSCP) provides resources that system administrators, security professionals, security policy authors, information security officers, and auditors can leverage to secure and assess macOS desktop and laptop system security in an automated way. This publication introduces the mSCP and gives an overview of the resources available from the project's GitHub site, which is continuously curated and updated to support each new release of macOS.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Security Assessment?

[Assistant]
According to Cryptographic Module Validation Program (CMVP) Security Policy Requirements_ CMVP Validation Authority Updates to ISO_IEC 24759 and ISO_IEC 19790 Anne:

CMVP; Cryptographic Module Validation Program; FIPS 140; FIPS 140 testing; ISO/IEC 19790; ISO/IEC 24759; security policy; testing requirement; vendor documentation; vendor evidence.

This document is intended for vendors, testing labs, and CMVP to address issues in ISO/IEC 19790, Information technology - Security techniques - Security requirements for cryptographic modules , and ISO/IEC 24759, Information technology - Security techniques - Test requirements for cryptographic modules .

This document specifies the Cryptographic Module Validation Program (CMVP) modifications of the methods to be used by a Cryptographic and Security Testing Laboratory (CSTL) to demonstrate conformance. This document also specifies the modification of documentation for providing evidence to demonstrate conformity. Unless otherwise specified in this document, the test requirements are specified in ISO/IEC 19790 Annex B and ISO/IEC 24759 Section 6.14.

Cryptographic Module Validation Program (CMVP) Security Policy Requirements_ CMVP Validation Authority Updates to ISO_IEC 24759 and ISO_IEC 19790 Anne


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Report on the Design-A-Thon_ Designing Effective and Accessible Approaches for Digital Product Cybersecurity Education and Awareness provide? (Part 6)

[Assistant]
cybersecurity education and awareness plan..7                                                                                |
| Fig. 4.
Mock-up of how cybersecurity education and awareness information could be delivered via the app. ..........................................................................................................................................8 |
| Fig. 5. Example of the quick start manual proposed to support the product. ........................................9                                                                                |
| Fig. 6. An example of a cybersecurity-targeted newsletter proposed by the team.............................. 10                                                                                |
| Fig. 7. Planning notes for Team 3's cybersecurity education and awareness strategy. ........................ 11                                                                                |
| Fig. 8. A detailed user narrative was developed to hone cybersecurity education and awareness approaches. ( Note: cropping of text is due to framing of the source image ) ............................ 11                                           |
| Fig. 9. The team's mock-up of a guided and gamified approach that could be used to support cybersecurity education and awareness.................................................................................. 12                                |
| Fig. 10.

Report on the Design-A-Thon_ Designing Effective and Accessible Approaches for Digital Product Cybersecurity Education and Awareness


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Access Control?

Secure Software Development Framework (SSDF) Version 1.1_ Recommendations for Mitigating the Risk of Software Vulnerabilities


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Services Acquisition?

[Assistant]
According to Digital Identity Guidelines_ Identity Proofing and Enrollment:

gement, administrative, technical,
and physical standards and guidelines for the cost-effective security and privacy of other
than national security-related information in federal information systems.
The Special
Publication 800-series reports on ITL’s research, guidelines, and outreach efforts in
information system security, and its collaborative activities with industry, government,
and academic organizations.

Digital Identity Guidelines_ Identity Proofing and Enrollment


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Planning?

[Assistant]
According to Report on the Design-A-Thon_ Designing Effective and Accessible Approaches for Digital Product Cybersecurity Education and Awareness:

--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| 2.
Background......................................................................................................................................2                                                                                |
| 3. Report from the Design-A-Thon .......................................................................................................4                                                                                |
| 4. Designs ............................................................................................................................................6                                                                                |
| 5. Discussion......................................................................................................................................14                                                                                |
| References.........................................................................................................................................16                                                                                |
| Appendix A. Call for Participants........................................................................................................18                                                                                |
| Appendix B. Mock Product Data Cards............................................................................................... 19                                                                                |
| Appendix C.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Risk Assessment?

[Assistant]
According to Contingency Planning Guide for Federal Information Systems:

Information systems are vulnerable to a variety of disruptions, ranging from mild (e.g., short-term power outage, disk drive failure) to severe (e.g., equipment destruction, fire).  Much vulnerability may be minimized or eliminated through management, operational, or technical controls as part of the organization's resiliency effort; however, it is virtually impossible to completely eliminate all risks. 6 Contingency planning is designed to mitigate the risk of system and service unavailability by providing effective and efficient solutions to enhance system availability.

An organization must have the ability to withstand all hazards and sustain its mission through environmental changes.  These changes can be gradual, such as economic or mission changes, or sudden, as in a disaster event.  Rather than just working to identify and mitigate threats, vulnerabilities, and risks, organizations can work toward building a resilient infrastructure, minimizing the impact of any disruption on mission essential functions.

COOP focuses on restoring an organization's mission essential functions (MEF) at an alternate site and performing those functions for up to 30 days before returning to normal operations.  Additional functions, or those at a field office level, may be addressed by a BCP.  Minor threats or disruptions that do not require relocation to an alternate site are typically not addressed in a COOP plan.

Contingency Planning Guide for Federal Information Systems


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Communications Protection?

[Assistant]
According to Validating the Integrity of Computing Devices:

The supply chains of information and communications technologies are increasingly at risk of compromise. Additional risks causing supply chain disruptions include counterfeiting, unauthorized production, tampering, theft, and insertion of unexpected software and hardware. Managing these risks requires ensuring the integrity of the supply chain and its products and services. This project demonstrates how organizations can verify that the internal components and system firmware of the computing devices they acquire are genuine and have not been unexpectedly altered during manufacturing, distribution, or operational use.

The supply chains of information and communications technologies are increasingly at risk of compromise. Additional risks causing supply chain disruptions include counterfeiting, unauthorized production, tampering, theft, and insertion of unexpected software and hardware. Managing these risks requires ensuring the integrity of the cyber supply chain and its products and services. This prototype implementation demonstrates how organizations can verify that the internal components of the computing devices they acquire are genuine and have not been unexpectedly altered during manufacturing or distribution processes.

Section 4, Architecture, specifies the components of the prototype implementation and details how data and communications flow between validation systems.

Validating the Integrity of Computing Devices


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 2 require for System and Services Acquisition?

[Assistant]
According to Assessing Security Requirements for Controlled Unclassified Information:

blication 800-series reports on ITL's research, guidelines, and outreach efforts in information system security, and its collaborative activities with industry, government, and academic organizations.
- System development life cycle responsibilities (e.g., program managers, mission/business owners, information owners/stewards, system designers and developers, system/security engineers, systems integrators)
- Acquisition or procurement responsibilities (e.g., contracting officers)
- System, security, or risk management and oversight responsibilities (e.g., authorizing officials, chief information officers, chief information security officers, system owners, information security managers)
- Security assessment and monitoring responsibilities (e.g., auditors, system evaluators, assessors, independent verifiers/validators, analysts)

Assessing Security Requirements for Controlled Unclassified Information


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Configuration Management?

[Assistant]
According to Digital Identity Guidelines_ Authentication and Authenticator Management:

2.4.1.
The verifier  SHALL  employ appropriately tailored security controls from the moderate
baseline security controls defined in [SP800-53] or an equivalent federal (e.g.,
[FEDRAMP]) or industry standard that the organization has chosen for the information
systems, applications, and online services that these guidelines are used to protect.

3.1.3.4. Multi-Factor Out-of-Band Authenticators
Multi-factor out-of-band authenticators operate similarly to single-factor out-of-band
authenticators (see Sec. 3.1.3.1). However, they require the presentation and verification
of an activation factor (i.e., a password or a biometric characteristic) before allowing the
claimant to complete the authentication transaction (i.e., before accessing or entering
the authentication secret as appropriate for the authentication flow being used). Each
use of the authenticator  SHALL  require the presentation of the activation factor.

3.2.3.4. Use of Biometric Samples
Biometric samples collected in the authentication process  MAY  be used locally within
the authenticator or verifier performing the biometric comparison to update the
templates for the purpose of compensating for changes in subscriber characteristics or
— with explicit subscriber consent — other research purposes. The biometric samples
and any other biometric data derived from them  SHALL  be erased immediately after
any adaptation or research data has been derived. A limit on the allowable time for
adaptation  SHALL  be established and enforced by the authenticator or the CSP.

Digital Identity Guidelines_ Authentication and Authenticator Management


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Access Control?

[Assistant]
According to High-Performance Computing Security_ Architecture, Threat Analysis, and Security Posture:

C

One important characteristic of the management zone is that it has a separate security posture because non-privileged users do not need to access the management servers or services in a direct way.
Privileged users responsible for configuring, maintaining, and operating the HPC system access the management zone servers and switches through extra security controls. For example, from the public-facing login nodes, they may go through a bastion host that is typically located in the management zone, or they may establish a virtual private network (VPN) with separate authentication and authorization or other appropriate security controls to reach the management zone. All systems are configured on networks that are not routed beyond the perimeter of the HPC system so that only nodes like compute nodes and storage nodes can access the services.

High-Performance Computing Security_ Architecture, Threat Analysis, and Security Posture


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Access Control?

[Assistant]
According to Planning for a Zero Trust Architecture_ A Planning Guide for Federal Administrators:

Zero trust provides a collection of concepts designed to minimize uncertainty in enforcing accurate, least privilege per-request access decisions in information systems and services in the face of a network viewed as contested. That is, there may be a malicious actor on the network that can intercept or initiate communication. Zero trust is fundamentally comprised of a set of principles upon which information technology architectures are planned, deployed, and operated [1]. Zero trust uses a holistic view that considers potential risks to a given mission or business process and how they are mitigated. As such, there is no single specific zero trust infrastructure implementation or architecture. zero trust solutions depend on the workflow (i.e., part of the enterprise mission) being analyzed and the resources that are used in performing that workflow. zero trust strategic thinking can be used to plan and implement an enterprise IT infrastructure, this plan is called a zero trust architecture (ZTA). - I. All resource authentication and authorization are dynamic and strictly enforced before access is allowed. A typical enterprise has a wide collection of network identities: end users, accounts used by processes and services, etc. Some end users may have multiple network identities, and some identities may only be used by

1 The unit of 'session' can be nebulous and differ depending on tools, architecture, etc. The basic definition in a zero trust context is a connection to one resource utilizing one network identity and one privilege for that identity (e.g. read, write, delete, etc.) or even a single operation (similar to an API call).

Planning for a Zero Trust Architecture_ A Planning Guide for Federal Administrators


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Communications Protection?

[Assistant]
According to Secure Software Development Framework (SSDF) Version 1.1_ Recommendations for Mitigating the Risk of Software Vulnerabilities:

The common language helps facilitate communications about secure software practices among both internal and external organizational stakeholders, such as: | Practices | Tasks | Notional Implementation Examples | References | |---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | | PO.2.3 : Obtain upper management or authorizing official commitment to secure development, and convey that commitment to all with development- related roles and responsibilities.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Identification and Authentication?

[Assistant]
According to Guide for Developing Security Plans for Federal Information Systems:

t information systems that provide public access services, the same controls might not be required for users accessing those systems through public interfaces to obtain publicly available information.
On the other hand, identification and authentication must be required for users accessing information systems through public interfaces to access their private/personal information.

Guide for Developing Security Plans for Federal Information Systems


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AC.L2-3.1.5 (NIST 3.1.5)?

[Assistant]
According to Approaches and Challenges of Federal Cybersecurity Awareness Programs:

3.1.5 Challenges: Required Training... 3.1.5 Challenges: Required Training... 3.1.5 Challenges: Required Training

Participants rated their challenges with required training on a four-point scale ranging from 'very challenging' to 'not at all challenging,' with a 'does not apply' (N/A) option (see Figure 5).

Approaches and Challenges of Federal Cybersecurity Awareness Programs


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What guidance does Summary Report for “Workshop on Updating Manufacturer Guidance for Securable Connected Product Development” provide?

[Assistant]
<!-- image -->

## NIST Interagency Report NIST IR 8562

## Summary Report for ' Workshop on Updating Manufacturer Guidance for Securable Connected Product Development '

Katerina N. Megas Michael Fagan Barbara Cuthill Brad Hoehn Evie Petrella

This publication is available free of charge from:

https://doi.org/10.6028/NIST.IR.8562

<!-- image -->

## NIST Interagency Report NIST IR 8562

## Summary Report for ' Workshop on Updating Manufacturer Guidance for Securable Connected Product Development '

Katerina N. Megas Michael Fagan Barbara Cuthill

Applied Cybersecurity Division Information Technology Laboratory

Brad Hoehn HII

Evie Petrella Electrosoft Services, Inc. This publication is available free of charge from: https://doi.org/10.6028/NIST.IR.8562

April 2025

<!-- image -->

U.S. Department of Commerce Howard Lutnick, Secretary

National Institute of Standards and Technology

Craig S. Burkhardt, Acting NIST Director and Under Secretary of Commerce for Standards and Technology

Certain equipment, instruments, software, or materials, commercial or non-commercial, are identified in this paper in order to specify the experimental procedure adequately. Such identification does not imply recommendation or endorsement of any product or service by NIST, nor does it imply that the materials or equipment identified are necessarily the best available for the purpose. ## NIST Technical Series Policies

Copyright, Use, and Licensing Statements NIST Technical Series Publication Identifier Syntax

## Publication History

Approved by the NIST Editorial Review Board on 2025-03-21

## How to Cite this NIST Technical Series Publication

Megas K, Fagan M, Cuthill B, Hoehn N, and Petrella E  (2025) Summary Report for 'Workshop on Updating Manufacturer Guidance for Securable Connected Product Development' (National Institute of Standards and Technology, Gaithersburg, MD), NIST Interagency or Internal Report (IR) NIST IR 8562.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Access Control?

[Assistant]
According to Data Integrity_ Detecting and Responding to Ransomware and Other Destructive Events:

.13.1.2           | SP-ARC-001                   |
| DETECT (DE)                    | Anomalies and Events (DE.AE)   | DE.AE-2: Detected events are analyzed to understand attack tar- gets and methods.
| AU-6, CA-7, IR-4, SI-4             | A.12.4.1, A.16.1.1, A.16.1.4                     | PR-CDA-001                   |
| DETECT (DE)                    | Anomalies and Events (DE.AE)   | DE.AE-3: Event data are collected and correlated from multiple sources and sensors. | AU-6, CA-7, IR-4, IR-5, IR-8, SI-4 | A.12.4.1, A.16.1.7                               | CO-OPS-001, PR-CIR-001       |
| DETECT (DE)                    | Anomalies and Events (DE.AE)   | DE.AE-4: Impact of events is determined. | CP-2, IR-4, RA-3, SI-4             | A.16.1.4                                         | PR-INF-001                   |

Data Integrity_ Detecting and Responding to Ransomware and Other Destructive Events


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Federal Cybersecurity Awareness Programs_ A Mixed Methods Research Study provide? (Part 4)

[Assistant]
| INTRODUCTION.................................................................................................................
1           | INTRODUCTION................................................................................................................. 1           |
|-------------------------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------|
| 2                                                                                | STUDY METHODOLOGY................................................................................................. 2                      | STUDY METHODOLOGY................................................................................................. 2                      |
| 2.1 FOCUS GROUP METHODOLOGY............................................................................................ 3                 | 2.1 FOCUS GROUP METHODOLOGY............................................................................................ 3                 | 2.1 FOCUS GROUP METHODOLOGY............................................................................................ 3                 |
| 2.1.1                                                                                | Focus Group Design...................................................................................................

Federal Cybersecurity Awareness Programs_ A Mixed Methods Research Study


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AC.L2-3.1.2 (NIST 3.1.2)?

[Assistant]
According to Guide to Auditing for Controls and Security_ A System Development Life Cycle Approach:

3.1.2                                                         | Brief Overview of the Scheme                                  | Brief Overview of the Scheme                                  | 47        |
| 3. 3.1.2 Brief Overview of the Scheme

The Scheme described in this Chapter enables its user to systematically perform a riskbased evaluation ofthe subjects for ADP audit (or security review) within an organization (i.

Guide to Auditing for Controls and Security_ A System Development Life Cycle Approach


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 2 require for Awareness and Training?

[Assistant]
According to Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations:

......................98      |
| Table 11. Maintenance (MA) ......................................................................................................................98      |
| Table 12.
Media Protection (MP)................................................................................................................99        |
| Table 13. Physical and Environmental Protection (PE)...............................................................................99                    |
| Table 14. Planning (PL)..............................................................................................................................100 |
| Table 15. Program Management (PM) .....................................................................................................100               |
| Table 16. Personnel Security (PS) .............................................................................................................101       |
| Table 17. PII Processing and Transparency (PT) .......................................................................................102                |
| Table 18. Risk Assessment (RA) ................................................................................................................102       |
| Table 19. System and Services Acquisition (SA)........................................................................................103                |
| Table 20. System and Communications Protection (SC)...........................................................................103                        |
| Table 21. System and Information Integrity (SI) .......................................................................................104               |
| Table 22. Supply Chain Risk Management (SR).........................................................................................105                  |
| Table 23.

Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice CM.L2-3.4.1 (NIST 3.4.1)?

[Assistant]
According to Digital Identity Guidelines:

3.4.1. 3.4.1.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Awareness and Training?

[Assistant]
According to Summary of NIST SP 800-53, Revision 4_ Security and Privacy Controls for Federal Information Systems and Organizations:

The security control baselines address the security needs of a broad and diverse set of constituencies, and are developed based on a number of general assumptions, including common environmental, operational, and functional considerations. The baselines also assume typical threats facing common information systems.  Articulating the underlying assumptions is a key element in the initial risk framing step of the risk management process described in NIST SP 800-39.  To ensure that an appropriate set of controls is identified to provide security commensurate with risk, organizations tailor the controls to align with specific security needs. Organizations may perform tailoring at the organization level for all information systems, in support of a particular line of business or mission/business process, at the individual information system level, or by using a combination of the above. The tailoring process is comprised of several steps, as described in SP 800-53 Rev. 4 Section 3.2.  These actions include:

Summary of NIST SP 800-53, Revision 4_ Security and Privacy Controls for Federal Information Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Federal Cybersecurity Role-Based Training Approaches, Successes, and Challenges provide? (Part 7)

[Assistant]
or even individual supervisors. - RBT content: About two-thirds of surveyed participants said that their organizations create at least some RBT content on their own, which could be resource-intensive.
Those who purchase training may find the cost to obtain content for many cybersecurity roles to be prohibitive. Indeed, over 40% of survey participants rated finding RBT materials and updating RBT as moderately or very challenging. On the upside, the majority (about 60%) said that their RBT content is tailored to their organizational mission and current security threats. - RBT approaches: Almost all survey participants (95%) said their organizations offered at least some online training, while over half also allow live training options. Almost half utilize industry-recognized certifications to fulfill RBT requirements. - Compliance with mandatory RBT requirements: Most organizations do not experience substantial challenges in tracking employee completion of RBT. Still, over a third are using a manual method (e.g., a spreadsheet) for tracking. Additionally, about 40% of organizations were moderately or very challenged in getting employees to complete training by the appointed deadline. This may be due to training overload, employee time constraints, or a lack of concrete consequences for not completing training. - Organizational support for RBT: More than two-thirds of survey participants believed that organizational employees and leadership were supportive of RBT activities. Over 70% said they have adequate technology to support RBT activities. However, 42% disagreed that they have adequate funding and 52% disagreed that they have adequate staff for conducting RBT activities. - Measuring RBT effectiveness: Just over half of survey participants rated their RBT activities as moderately or very successful.

Federal Cybersecurity Role-Based Training Approaches, Successes, and Challenges


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Configuration Management?

[Assistant]
According to Recommendation for Pair-Wise Key-Establishment Schemes Using Discrete Logarithm Cryptography:

- [RFC 4492] Elliptic  Curve  Cryptography  (ECC)  Cipher  Suites  for  Transport  Layer Security (TLS), May 2006, see https://tools.ietf.org/html/rfc4492. - [RFC 5903] Elliptic Curve Groups Modulo a Prime (ECP Groups) for IKE and IKEv2, June 2010, see https://tools.ietf.org/html/rfc5903. - [RFC 7919] Negotiated Finite Field Diffie-Hellman Ephemeral Parameters, August 2016, see https://tools.ietf.org/html/rfc7919. - [SECG] Standards for Efficient Cryptography Group, see http://www.secg.org/. - [SEC2] Standards for Efficient Cryptography, SEC 2: Recommended Elliptic Curve Domain Parameters, September 2000, see http://www.secg.org/SEC2-Ver1.0.pdf. - [SP 800-38B]  Special Publication 800-38B, Recommendation for Block Cipher Modes of Operation: The CMAC Mode for Authentication ,  May  2005,  with  updates dated October 2016. https://doi.org/10.6028/NIST.SP.800-38B
- [SP 800-38C]  Special Publication 800-38C, Recommendation for Block Cipher Modes of Operation: the CCM Mode for Authentication and Confidentiality , May 2004, with updates dated July 2007. https://doi.org/10.6028/NIST.SP.800-38C
- [SP 800-38F]  Special Publication 800-38F, Recommendation for Block Cipher Modes of Operation: Methods for Key Wrapping , December 2012. https://doi.org/10.6028/NIST.SP.800-38F
- [SP 800-52] Special Publication 800-52 Revision 2 (DRAFT), Guidelines for the Selection, Configuration and Use of Transport Layer Security (TLS) Implementations , November 15, 2017. https://csrc.nist.gov/publications/detail/sp/800-52/rev-2/draft
- [SP 800-56B]  Special  Publication  800-56B  Revision  1, Recommendation  for  Pair-Wise Key-Establishment  Schemes  Using  Integer  Factorization  Cryptography , September 2014. https://doi.org/10.6028/NIST.SP.800-56Br1
- [SP 800-56C]  Special Publication 800-56C Revision 1, Recommendation for Key Derivation Methods in Key Establishment Schemes , April 2018.

Recommendation for Pair-Wise Key-Establishment Schemes Using Discrete Logarithm Cryptography


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Maintenance?

[Assistant]
According to Ascon-Based Lightweight Cryptography Standards for Constrained Devices_ Authenticated Encryption, Hash, and Extendable Output Functions:

Additional information about this publication is available at https://csrc.nist.gov/pubs/sp/800/232/final, including related content, potential updates, and document history.

The substitution layer 𝑝 𝑆 updates the state S with 64 parallel applications of the 5-bit substitution box SBOX as

- 𝑐𝑡𝑥 ← Ascon-XOF128 .Absorb( 𝑐𝑡𝑥 , str ) Absorbs an arbitrary-length input str into the state and updates the context 𝑐𝑡𝑥 . Restriction: May be called multiple times after Init , but cannot be called after any call to Squeeze .
- ( 𝑐𝑡𝑥 , 𝑜𝑢𝑡 ) ← Ascon-XOF128 .Squeeze( 𝑐𝑡𝑥 , 𝐿 ) and

Ascon-Based Lightweight Cryptography Standards for Constrained Devices_ Authenticated Encryption, Hash, and Extendable Output Functions


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Audit and Accountability?

[Assistant]
According to Guide for Developing Security Plans for Federal Information Systems:

- Delineate responsibilities, expected use of system, and behavior of all users.
- Describe appropriate limits on interconnections.
- Define service provisions and restoration priorities.
- Describe consequences of behavior not consistent with rules.
- Covers the following topics:
- o Work at home
- o Dial-in access
- o Connection to the Internet
- o Use of copyrighted work
- o Unofficial use of government equipment
- o Assignment and limitations of system privileges and individual accountability
- o Password usage
- o Searching databases and divulging information.

The first item listed in the system security plan is the system name and identifier. As required in OMB Circular A-11, each system should be assigned a name and unique identifier.  Assignment of a unique identifier supports the agency's ability to easily collect agency information and security metrics specific to the system as well as facilitate complete traceability to all requirements related to system implementation and performance.  This identifier should remain the same throughout the life of the system and be retained in audit logs related to system use.

An authorizing official must be identified in the system security plan for each system. This person is the senior management official who has the authority to authorize operation (accredit) of an information system (major application or general support system) and accept the residual risk associated with the system. The assignment of the authorizing official should be in writing, and the plan must include the same contact information listed in Section 3.3.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Security Assessment?

[Assistant]
According to Recommendation for Pair-Wise Key-Establishment Using Integer Factorization Cryptography:

## Conformance Testing

Conformance testing for implementations of this Recommendation will be conducted within the framework of the Cryptographic Algorithm Validation Program (CAVP) and the Cryptographic Module Validation Program (CMVP). The requirements of this Recommendation are indicated by the word ' shall .' Some of these requirements may be out-of-scope for CAVP or CMVP validation testing, and thus are the responsibility of entities using, implementing, installing or configuring applications that incorporate this Recommendation.

The RSA private key may be expressed in several formats. The basic format of the RSA private key consists of the modulus n and a private-key exponent d that depends on n and the public-key exponent e ; this format is used to specify the RSA primitives and operations in Section 7. The other two formats may be used in implementations, but may require appropriate modifications for correct implementation. To facilitate implementation testing, the format for the private key shall be one of the following:

Recommendation for Pair-Wise Key-Establishment Using Integer Factorization Cryptography


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Likely Exploited Vulnerabilities_ A Proposed Metric for Vulnerability Exploitation Probability provide? (Part 5)

[Assistant]
|
| Table 1. Variables for the Expected_Exploited() Equation....................................................................5                       | Table 1.
Variables for the Expected_Exploited() Equation....................................................................5                       |
| Table 2. Variables for the Expected_Exploited() Equation....................................................................6                       | Table 2. Variables for the Expected_Exploited() Equation....................................................................6                       |
| Table 3. Variables and Functions for the Composite_Probability() Equation.........................................7                                 | Table 3. Variables and Functions for the Composite_Probability() Equation.........................................7                                 |
| Table 4. Variable and Function for the LEV and LEV2 Equations...........................................................8                           | Table 4. Variable and Function for the LEV and LEV2 Equations...........................................................8                           |
| Table 5. Proportion of expected exploited on 2025-01-16 .................................................................18                         | Table 5. Proportion of expected exploited on 2025-01-16 .................................................................18                         |
| List of Figures                                                                                | List of Figures                                                                                |
| Fig. 1.

Likely Exploited Vulnerabilities_ A Proposed Metric for Vulnerability Exploitation Probability


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Communications Protection?

[Assistant]
According to Guide to Enterprise Patch Management Planning_ Preventive Maintenance for Technology:

- Harden software, such as enforcing the principles of least privilege and least functionality (e.g., deactivating or uninstalling software services, features, and other components that are not needed). For additional information on hardening assets, especially those considered critical, see the NIST publication Security Measures for 'EO-Critical Software' Use Under Executive Order (EO) 14028 (July 9, 2021). - Acquire software that is likely to have fewer vulnerabilities over time compared to other software. - Work with software development partners that are likely to introduce fewer vulnerabilities into software over time, taking into consideration factors such as how rigorous their secure software development practices are, how quickly they address issues and release patches, how often problems are associated with their patches, and how transparent they are in their security-related communications. - Use managed services instead of software when feasible. 1. Will you be releasing updates for this software to address vulnerabilities? 2. Approximately how many patches, updates, and upgrades do you expect to release each year for this software? On average, how quickly do you expect to address each vulnerability and release a patch? Do you bundle patches together or is each patch separate? How often do you anticipate releasing emergency updates? 3. For how many years are you committed to correcting vulnerabilities in the software? 4. Will you release updates on a regular schedule, as needed, or both? If a schedule will be followed, what is that schedule (weekly, monthly, quarterly, etc.)? 5. Do you have a vulnerability disclosure and incident response program for your software? How transparent are you in your security-related communications to your customers? 6. When a vulnerability in your software becomes public but a patch, update, or upgrade is not available, how do you recommend that customers protect their computing assets running your software?

Guide to Enterprise Patch Management Planning_ Preventive Maintenance for Technology


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Audit and Accountability?

[Assistant]
According to Assessing Security and Privacy Controls in Information Systems and Organizations:

DEVELOPMENT LIFE CYCLE .................................................. 6
2.2   CONTROL STRUCTURE AND ORGANIZATION ..................................................................................
7
2.3   BUILDING AN EFFECTIVE ASSURANCE CASE .................................................................................... 8
2.4   ASSESSMENT PROCEDURES: ASSESSMENT OBJECTS, METHODS AND OBJECTIVES ................... 11
CHAPTER THREE THE PROCESS ............................................................................................................. 19
3.1   PREPARE FOR SECURITY AND PRIVACY CONTROL ASSESSMENTS ............................................... 19
3.2   DEVELOP SECURITY AND PRIVACY ASSESSMENT PLANS .............................................................. 23
3.3   CONDUCT SECURITY AND PRIVACY CONTROL ASSESSMENTS ..................................................... 30
3.4   ANALYZE ASSESSMENT REPORT RESULTS ..................................................................................... 32
3.5   ASSESS SECURITY AND PRIVACY CAPABILITIES .............................................................................. 34
CHAPTER FOUR SECURITY AND PRIVACY ASSESSMENT PROCEDURES ................................................. 37
4.1   ACCESS CONTROL............................................................................................................................ 40
4.2   AWARENESS AND TRAINING ........................................................................................................ 118
4.3   AUDIT AND ACCOUNTABILITY ...................................................................................................... 128
4.4   ASSESSMENT, AUTHORIZATION, AND MONITORING ................................................................. 160
4.5   CONFIGURATION MANAGEMENT ................................................................................................

Assessing Security and Privacy Controls in Information Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Access Control?

[Assistant]
According to Assessing Security and Privacy Controls in Information Systems and Organizations:

gs and relationships between the security standards and guidelines developed by NIST, the
International Organization for Standardization (ISO), and the International Electrotechnical Commission
(IEC).
Identify determination statements for organization-defined parameters (ODPs) first and separately
from the determination statements for each control item;
Improve the readability of the assessment procedures;
Provide a structured schema for automated tools when assessment information is imported into such
tools;
Provide greater flexibility in conducting assessments by giving organizations the capability to target
certain aspects of controls (highlighting the particular weaknesses and/or deficiencies in controls),
Improve the efficiency of security and privacy control assessments;
Support continuous monitoring and ongoing authorization programs by providing a greater number
of component parts of security and privacy controls that can be assessed at organization-defined
frequencies and degrees of rigor.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Communications Protection?

[Assistant]
According to Access Control on NoSQL Databases:

NoSQL systems can handle fast-paced agile development, the storage of large volumes of structured and semi-structured data, the requirements for scale-out architecture, and modern application paradigms (e.g., microservices and real-time streaming) [MO]. However, they also face many challenges with regard to access control, such as a lack of proper authentication, encryption, dynamic model support, and fine-grained authorization (as described in Sec. 3.3). Therefore, careful considerations need to be made when implementing access control on NoSQL databases to address these issues effectively.

Due to NoSQL's distributed nature, security becomes a more significant concern compared to central management-oriented RDBMS. From the perspective of data at rest and data in transit (i.e., communications between databases), NoSQL databases generally provide weaker security features when compared to RDBMS.

The security of data in transit and communications in horizontally scaled NoSQL databases is a critical issue. Some systems use symmetric key algorithms to encrypt data based on the NoSQL structure (i.e., types). For example, in a key-value system, the value of the key is the encrypted data, including all of the other key values being concatenated and encrypted. When a query is created, the system retrieves data entities and then uses the symmetric key to decrypt the data [ZM]. As a result, the data is protected by encryption even if the key is intercepted while in transit between different NoSQL hosts.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Planning?

[Assistant]
According to Strategies for the Integration of Software Supply Chain Security in DevSecOps CI_CD Pipelines:

There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may be used by federal agencies even before the completion of such companion publications. Thus, until each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning and transition purposes, federal agencies may wish to closely follow the development of these new publications by NIST.

Strategies for the Integration of Software Supply Chain Security in DevSecOps CI_CD Pipelines


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Contingency Planning Guide for Federal Information Systems provide? (Part 2)

[Assistant]
, other than the ones noted above, are available at http://csrc.nist.gov/publications. National Institute of Standards and Technology Special Publication 800-34 Natl. Inst. Stand. Technol. Spec. Publ.
800-34, 150 pages (May 2010) CODEN: NSPUE2

## Reports on Computer Systems Technology

The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analysis to advance the development and productive use of information technology. ITL's responsibilities include the development of technical, physical, administrative, and management standards and guidelines for the cost-effective security and privacy of sensitive unclassified information in federal computer systems. This Special Publication 800-series reports on ITL's research, guidance, and outreach efforts in computer security and its collaborative activities with industry, government, and academic organizations. ## Authority

This document has been developed by the National Institute of Standards and Technology (NIST) in furtherance of its statutory responsibilities under the Federal Information Security Management Act (FISMA) of 2002, Public Law 107-347. NIST is responsible for developing standards and guidelines, including minimum requirements, for providing adequate information security for all agency operations and assets, but such standards and guidelines shall not apply to national security systems. This guideline is consistent with the requirements of the Office of Management and Budget (OMB) Circular A-130, Section 8b(3), 'Securing Agency Information Systems,' as analyzed in A-130, Appendix IV: Analysis of Key Sections. Supplemental information is provided in A-130, Appendix III.

Contingency Planning Guide for Federal Information Systems


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Maintenance?

[Assistant]
According to Workshop on Enhancing Security of Devices and Components Across the Supply Chain:

Additional information about this publication is available at https://csrc.nist.gov/pubs/ir/8532/final, including related content, potential updates, and document history.

Semiconductor-based hardware is the foundation of modern-day electronics - from smartphones, computers, and telecommunications to transportation and critical infrastructure. The semiconductor hardware supply chain is a complex network of companies that collectively provide intellectual property, designs, and raw materials and manufacture, test, package, and distribute products. Coordination among the components of a supply chain is required at different stages, including inception, deployment to end users, maintenance during use, and disposal or end of life. Securing semiconductor-based hardware and their supply chains help protect sensitive information, maintain the integrity of systems, and ensure overall stability across the infrastructure and connected world.

These activities range from physical protection mechanisms (e.g., tamper-resistant packaging) to strong encryption protocols to safeguard data. Secure boot processes ensure that only verified firmware runs, and maintaining supply chain integrity through verification and audits prevents counterfeit components. Life cycle management includes secure provisioning, updates, and end-of-life processes that are complemented by rigorous security testing and compliance with regulatory standards. Educating users on secure practices and continuously improving security measures further fortifies defenses against evolving threats and ensures that semiconductor devices operate securely throughout their life cycle.

Workshop on Enhancing Security of Devices and Components Across the Supply Chain


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Configuration Management?

[Assistant]
According to Audit and Evaluation of Computer Security:

7-12
7-12
7-13
7-13
7-13
....... 7-13
Design Standards o
7-14
Organization Control .
7-14
Access Control .
7-15
Phase Review/Project Control
Testing/System Assurance ........ ^
7-16
7-16
Promotion Process
Documentation ............... 7-17
7-17
Auditor/Independent Party Involvement
Configuration Management .......... 7-17
Emergency Procedures ........... 7-18

categories: physical, system and administrative.
The physical con-
trols include the traditional "put the system in a vault" measures,
including perimeter control, hazard protection and backup mechanisms.
System controls include hardware/software access control techniques,
program integrity measures, audit trail techniques and failure re-
Administrative control techniques include what
sponse procedures.
are commonly referred to as Change Control Procedures.
control techniques must be evaluated against each of the access con-
trol, accuracy, and availability factors and an overall score must be
arrived at for each of those factors.

Development procedures - standards, configuration management,
certification, etc.

Audit and Evaluation of Computer Security


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Physical Protection?

[Assistant]
According to Analyzing Collusion Threats in the Semiconductor Supply Chain:

Mean for Your Hardware? Available at https://evernex.com/industry-guide/eol-meaning/
- [9] Vincent J (2018) Chinese spies reportedly inserted microchips into servers used by Apple, Amazon, and others.
Available at https://www.theverge.com/2018/10/4/17935868/-chinese-spies-microchip-hackservers-apple-amazon-supermicro
- [10] Yu S, Liu W, O'Neill M (2019) An improved automatic hardware Trojan generation platform. IEEE Computer Society Annual Symposium on VLSI (ISVLSI) (IEEE, Miami, Florida), pp 302-307. https://doi.org/10.1109/ISVLSI.2019.00062
- [11] Cruz J, Huang Y, Mishra P, Bhunia S (2018) An automated configurable Trojan insertion framework for dynamic trust benchmarks. Design, Automation & Test in Europe Conference & Exhibition (IEEE, Dresden, Germany) pp 1598-1603. https://doi.org/10.23919/DATE.2018.8342270
- [12] Perez TD, Pagliarini S (2023) Hardware Trojan insertion in finalized layouts: From methodology to a silicon demonstration. IEEE Transactions on Computer-Aided Design of Integrated Circuits and Systems (IEEE) 42(7): 2094-2107. https://doi.org/10.1109/TCAD.2022.3223846

Analyzing Collusion Threats in the Semiconductor Supply Chain


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Assessing Enhanced Security Requirements for Controlled Unclassified Information provide? (Part 10)

[Assistant]
| AWARENESSANDTRAINING...............................................................................................................
| 9   |
| 3.3                                                                                | AUDIT ANDACCOUNTABILITY........................................................................................................... | 10  |
| 3.4                                                                                | CONFIGURATION MANAGEMENT..................................................................................................... | 11  |
| 3.5                                                                                | IDENTIFICATION ANDAUTHENTICATION.......................................................................................... | 13  |
| 3.6                                                                                | INCIDENT RESPONSE......................................................................................................................... | 15  |
| 3.7                                                                                | MAINTENANCE ................................................................................................................................. | 16  |
| 3.8                                                                                | MEDIAPROTECTION.........................................................................................................................

Assessing Enhanced Security Requirements for Controlled Unclassified Information


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Maintenance?

[Assistant]
According to Risk Management Framework for Information Systems and Organizations_ A System Life Cycle Approach for Security and Privacy:

the Federal Information Security Modernization Act of 2014 (FISMA), the Privacy Act of 1974, OMB policies, and Federal Information Processing Standards, among other laws,  regulations,  and  policies.
The  scope  of  this  publication  pertains  to  federal  information systems,  which  are  discrete  sets  of  information  resources  organized  for  the  collection, processing, maintenance, use, sharing, dissemination, or disposition of information, whether such information is in digital or non-digital form. Information resources include information and related resources, such as personnel, equipment, funds, and information technology.

Risk Management Framework for Information Systems and Organizations_ A System Life Cycle Approach for Security and Privacy


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Physical Protection?

[Assistant]
According to Guide to Auditing for Controls and Security_ A System Development Life Cycle Approach:

hin the ADP Facility - Both errors and intentional acts committed by the ADP operations staff may result in improper operational procedures, lapsed controls, and losses in storage media and output. 6.
Program Errors - Applications programs should be developed in an environment that requires and supports complete, correct, and consistent program design, good programming practices, adequate testing, review, and documentation, and proper maintenance procedures. Although programs developed in such an environment may still contain undetected errors, programs not developed in this manner will probably be rife with errors. Additionally, programmers can deliberately modify programs to produce undesirable side effects or they can misuse the programs they are in charge of. 7. Operating System Flaws - Design and implementation errors, system generation and maintenance problems, and deliberate penetrations resulting in modifications to the operating system can produce undesirable effects in the application system. Flaws in the operating system are often difficult to prevent and detect. 8. Communications System Failure - Information being routed from one location to another over communication lines is vulnerable to accidental failures and to intentional interception and modification by unauthorized parties.

Guide to Auditing for Controls and Security_ A System Development Life Cycle Approach


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Validating the Integrity of Computing Devices provide? (Part 5)

[Assistant]
other attacks. By leveraging hardware roots of trust capabilities as a computing device traverses the supply chain, we can maintain trust in the computing device throughout its operational lifecycle.
This project addresses several processes, including:

-  how to create verifiable descriptions of components and platforms, which may be done by original equipment manufacturers (OEMs), platform integrators, and even information technology (IT) departments;
-  how to verify devices and components within the single transaction between an OEM and a customer; and
-  how to verify devices and components at subsequent stages in the system lifecycle in the operational environment. This project also demonstrates how to inspect the verification processes themselves. The following is a list of the project's collaborators. ## Collaborator

<!-- image -->

## Security Capability or Component

Integrated Risk Management Platform, Incident Management, Integrating Data from Asset Discovery and Management and Security Information and Event Management (SIEM) Systems

Manufacturer, Platform Integrity Validation System

Platform Integrity Validation System

<!-- image -->

<!-- image -->

<!-- image -->

<!-- image -->

<!-- image -->

<!-- image -->

Manufacturer, Platform Integrity Validation System

Manufacturer, Platform Integrity Validation System

Security Information and Event Management

Manufacturer, Platform Integrity Validation System

Certificate Authority, Platform Integrity Validation System

Manufacturer, Platform Integrity Validation System

While the NCCoE used a suite of commercial products to address this challenge, this guide does not endorse these particular products, nor does it guarantee compliance with any regulatory initiatives. Your organization's information security experts should identify the products that will best integrate with your existing tools and IT system infrastructure.

Validating the Integrity of Computing Devices


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Planning?

[Assistant]
According to Analyzing Collusion Threats in the Semiconductor Supply Chain:

1. Concept: Concept stage is the birthplace of an Integrated Circuit (IC). At this stage, the goals and purpose of an integrated circuit (IC) are formulated, and the scope and target of a hardware component are discussed. Customers, the design, planning, finance teams, and other key stakeholders are involved at this stage. 2. Design: Design stage gives a form to the ideas generated in the concept stage. This is the stage where prototypes of the concept are created with the help of different Computer Aided Design (CAD) tools and analysis of whether the goals identified during the concept stage are met. This stage also includes the use of third-party software and hardware prototyping. 3. Integration: Integration is the stage where different design components from designers and third parties are integrated together. This phase is crucial since many design elements already have tested solutions, so not everything needs to be created from the ground up. It is more feasible to purchase these solutions from third parties and integrate them into the design. 4. Manufacturing: After the IC's design is finished, the manufacturing phase begins. This stage includes several processes, including fabrication and packaging. Due to the high cost of building and maintaining manufacturing facilities, many design houses are fabless and outsource their designs to manufacturers located elsewhere. 5. Testing: Testing is the stage at which manufactured Integrated Circuits (ICs) are tested to ensure that they perform properly. Following the completion of fabrication, each IC undergoes testing. An IC's functionalities are tested here to make sure they adhere to design specifications. 6. Provisioning: Provisioning is the stage where standard and sensitive data are loaded into the manufactured IC. Standard data are generic and mostly available open source, but the sensitive data are anything whose disclosure would compromise IP or security.