[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] How does Protecting Controlled Unclassified Information (CUI)_ NIST Special Publication 800-171, Revision 3. Small Business Primer support CMMC certification?

[Assistant]
According to Protecting Controlled Unclassified Information (CUI)_ NIST Special Publication 800-171, Revision 3. Small Business Primer:

<!-- image -->

<!-- image -->

Howard Lutnick, Secretary of Commerce

<!-- image -->

Protecting Controlled Unclassified Information (CUI): NIST Special Publication 800-171, Revision 3 Small Business Primer

## Purpose of this Primer

This guide provides small businesses with an overview of NIST Special Publication (SP) 800-171 Revision 3, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations . The following pages contain:

- An overview of foundational components of SP 800-171
- A list of frequently asked questions and their answers
- Tips for getting started
- Related resources

## What is Controlled Unclassified Information (CUI)?*

CUI is information the government creates or possesses, or that an entity creates or possesses on behalf of the government, that law, regulation, or governmentwide policy requires you to take technical and operational steps to protect. Systems that process, store, and transmit CUI often support government programs involving sensitive critical assets. As part of a contractual agreement with the federal government, or possibly with other organizations like municipal governments, prime contractors, universities, etc., you will likely be required to demonstrate you are taking adequate measures to protect CUI.

Protecting Controlled Unclassified Information (CUI)_ NIST Special Publication 800-171, Revision 3. Small Business Primer


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 1 require for Maintenance?

[Assistant]
According to IoT Non-Technical Supporting Capability Core Baseline:

updates, such as software updates, algorithm changes, new protocols, or changes in the vendors used by the manufacturer to update cybersecurity, that may impact cybersecurity risks.

IoT Non-Technical Supporting Capability Core Baseline


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AT.L2-3.2.1 (NIST 3.2.1)?

[Assistant]
According to Assessing Security and Privacy Controls in Information Systems and Organizations:

3.2.1   DETERMINE WHICH SECURITY AND PRIVACY CONTROLS ARE TO BE ASSESSED

The security plan and privacy plan provide an overview of the security and privacy requirements
for the system and organization and describe the security controls and privacy controls in place
or planned for meeting those requirements.

Assessing Security and Privacy Controls in Information Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does IoT Device Cybersecurity Capability Core Baseline provide? (Part 3)

[Assistant]
y core baseline, which is a set of device capabilities generally needed to support common cybersecurity controls that protect an organization's devices as well as device data, systems, and ecosystems.
The purpose of this publication is to provide organizations a starting point to use in identifying the device cybersecurity capabilities for new IoT devices they will manufacture, integrate, or acquire. This publication can be used in conjunction with NISTIR 8259, Foundational Cybersecurity Activities for IoT Device Manufacturers . ## Keywords

cybersecurity baseline; Internet of Things (IoT); securable computing devices. ## Acknowledgments

The authors wish to thank all contributors to this publication, including the participants in workshops and other interactive sessions; the individuals and organizations from the public and private sectors, including manufacturers from various sectors as well as several manufacturer trade organizations, who provided feedback on the preliminary essay and the public comment drafts; and colleagues at NIST who offered invaluable inputs and feedback. Special thanks to Cybersecurity for IoT Program team members Barbara Cuthill and Jeff Marron and the NIST FISMA Implementation Project team for their extensive help in copy editing. ## Audience

The main audience for this publication is IoT device manufacturers. This publication may also help IoT device customers or integrators.

IoT Device Cybersecurity Capability Core Baseline

Audit and Accountability
System and Information Integrity
Security Assessment
Media Protection
Identification and Authentication
Awareness and Training
System and Communications Protection
Access Control
Planning
Incident Response
Risk Assessment
Personnel Security
System and Services Acquisition
Supply Chain Risk Management
Maintenance
Physical Protection
Configuration Management


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Identification and Authentication?

[Assistant]
According to Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations:

.......24                         |
| 2.3.2. Level 1 -Enterprise...................................................................................................................27         |
| 2.3.3.
Level 2 -Mission and Business Process....................................................................................30                      |
| 2.3.4. Level 3 -Operational................................................................................................................32           |
| 2.3.5. C-SCRM PMO..............................................................................................................................33       |
| Critical Success Factors...................................................................................................................37           |
| 3. |
| 3.1.2. The Role of C-SCRM in the Acquisition Process .........................................................................40                        |
| 3.4.1. Foundational Practices ...............................................................................................................46         |

Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Guidelines for Media Sanitization provide? (Part 10)

[Assistant]
|                                                                                |
| Fig. 1.
Sanitization and disposition decision flow...............................................................................20                      |                                                                                |
| Fig. 2. Certificate of sanitization .......................................................................................................37            |                                                                                |

## Acknowledgments

The authors would like to thank Richard Kissel, Andrew Regenscheid, Matthew Scholl, and Kevin Stine for their work on the original version and the first revision of this publication. The authors would also like to thank Steven Skolochenko and Xing Li for their contributions to the original version of this publication. The authors would also like to thank Jim Foti and Isabel Van Wyk for their exceptional editing skills and thorough review of this document; their work made this a much better document. Thanks to their diligent and detailed reviews, we expect this document to serve as a useful guide for developing an effective media sanitization program. ## Executive Summary

Protecting the confidentiality of information should be a concern for everyone, from federal agencies and businesses to home users. Media disposition and sanitization decisions need to consider the confidentiality obligations associated with recording or storing sensitive information on hard copy media or information storage media (ISM). To help ensure media disposition and sanitization are effective and traceable, consideration should be given to implementing a media sanitization program. The modern storage environment is rapidly evolving.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Physical Protection?

[Assistant]
According to Automated Secure Configuration Guidance from the macOS Security Compliance Project (mSCP):

The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the Nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology. ITL's responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in federal information systems. The Special Publication 800-series reports on ITL's research, guidelines, and outreach efforts in information system security, and its collaborative activities with industry, government, and academic organizations.

Automated Secure Configuration Guidance from the macOS Security Compliance Project (mSCP)


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Control Baselines for Information Systems and Organizations provide? (Part 6)

[Assistant]
Cybersecurity Policy and Partnerships

Director, Security Coordination Center

## National Institute of Standards and Technology

## Committee on National Security Systems

Charles H. Romine

Mark G.
Hakun

Director, Information Technology Laboratory

Chair

Kevin Stine

Susan Dorr Co-Chair

Acting Cybersecurity Advisor, ITL

Matthew Scholl

Kevin Dulany

Chief, Computer Security Division

Tri-Chair-Defense Community

Kevin Stine

Chris Johnson

Chief, Applied Cybersecurity Division

Tri-Chair-Intelligence Community

Ron Ross

Vicki Michetti

FISMA Implementation Project Leader

Tri-Chair-Civil Agencies

## Joint Task Force Working Group

| Victoria Pillitteri   | McKay Tolboe          | Dorian Pappas          | Kelley Dempsey   |
|-----------------------|-----------------------|------------------------|------------------|
| NIST, JTF Leader      | DoD                   | Intelligence Community | NIST             |
| Ehijele Olumese       | Lydia Humphries       | Daniel Faigin          | Naomi Lefkovitz  |
| The MITRE Corporation | Booz Allen Hamilton   | Aerospace Corporation  | NIST             |
| Esten Porter          | Julie Nethery Snyder  | Christina Sames        | Christian Enloe  |
| The MITRE Corporation | The MITRE Corporation | The MITRE Corporation  | NIST             |
| David Black           | Rich Graubart         | Peter Duspiva          | Kaitlin Boeckl   |
| The MITRE Corporation | The MITRE Corporation | Intelligence Community | NIST             |
| Eduardo Takamura      | Ned Goren             | Andrew Regenscheid     | Jon Boyens       |
| NIST                  | NIST                  | NIST                   | NIST             |

\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

In addition to the above acknowledgments, a special note of thanks goes to Jeff Brewer, Jim Foti, and the NIST web team for their outstanding administrative support.

Control Baselines for Information Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Information Integrity?

[Assistant]
According to Secure Software Development Framework (SSDF) Version 1.1_ Recommendations for Mitigating the Risk of Software Vulnerabilities:

Example 5 : Establish and follow processes to address risk when there are security requirements that third-party software components to be acquired do not meet; this should include periodic reviews of all approved exceptions to requirements. | SCAGILE : Tasks Requiring the Help of Security Experts 8 SCFPSSD : Manage Security Risk Inherent in the Use of Third-Party Components SCSIC : Vendor Sourcing Integrity Controls SP80053 : SA-4, SA-9, SA-10, SA-10(1), SA-15, SR-3, SR-4, SR-5 SP800160 : 3.1.1, 3.1.2 SP800161 : SA-4, SA-9, SA-9(1), SA-9(3), SA-10, SA-10(1), SA-15, SR-3, SR-4, SR-5 SP800181 : T0203, T0415; K0039; S0374; A0056, A0161                                                                                |
| Implement Roles and Responsibilities (PO.2) : Ensure that everyone inside and outside of the organization involved in the SDLC is prepared to perform their SDLC-related roles and responsibilities throughout the SDLC. | PO.2.1 : Create new roles and alter responsibilities for existing roles as needed to encompass all parts of the SDLC. Periodically review and maintain the defined roles and responsibilities, updating them as needed. | Example 1 : Define SDLC-related roles and responsibilities for all members of the software development team. Example 2 : Integrate the security roles into the software development team. Example 3 : Define roles and responsibilities for cybersecurity staff, security champions, project managers and leads, senior management, software developers, software testers, software assurance leads and staff, product owners, operations and platform engineers, and others involved in the SDLC. Example 4 : Conduct an annual review of all roles and responsibilities.

Secure Software Development Framework (SSDF) Version 1.1_ Recommendations for Mitigating the Risk of Software Vulnerabilities


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for Audit and Accountability?

[Assistant]
According to Assessing Enhanced Security Requirements for Controlled Unclassified Information:

| CHAPTERONE INTRODUCTION...................................................................................................... | CHAPTERONE INTRODUCTION...................................................................................................... | 1   |
|-----------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------|-----|
| 1.1                                                                                | PURPOSEANDAPPLICABILITY............................................................................................................. 1        | 2   |
| 1.2                                                                                | TARGET AUDIENCE.............................................................................................................................. |     |
| 1.3                                                                                | ORGANIZATIONOF THIS SPECIAL PUBLICATION................................................................................. | 2   |
| CHAPTERTWO THE FUNDAMENTALS............................................................................................ | CHAPTERTWO THE FUNDAMENTALS............................................................................................ | 3   |
| 2.1                                                                                | ASSESSMENT PROCEDURES................................................................................................................

Assessing Enhanced Security Requirements for Controlled Unclassified Information


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What guidance does Guide to Enterprise Patch Management Planning_ Preventive Maintenance for Technology provide?

[Assistant]
## NIST Special Publication NIST SP 800-40r4

## Guide to Enterprise Patch Management Planning:

Preventive Maintenance for Technology

Murugiah Souppaya Karen Scarfone

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-40r4

<!-- image -->

## NIST Special Publication NIST SP 800-40r4

## Guide to Enterprise Patch Management Planning:

Preventive Maintenance for Technology

Murugiah Souppaya Computer Security Division Information Technology Laboratory

Karen Scarfone Scarfone Cybersecurity Clifton, VA

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-40r4

April 2022

<!-- image -->

U.S. Department of Commerce Gina M. Raimondo, Secretary

National Institute of Standards and Technology James K. Olthoff, Performing the Non-Exclusive Functions and Duties of the Under Secretary of Commerce for Standards and Technology & Director, National Institute of Standards and Technology

## Authority

This publication has been developed by NIST in accordance with its statutory responsibilities under the Federal Information Security Modernization Act (FISMA) of 2014, 44 U.S.C. § 3551 et seq. , Public Law (P.L.) 113-283. NIST is responsible for developing information security standards and guidelines, including minimum requirements for federal information systems, but such standards and guidelines shall not apply to national security systems without the express approval of appropriate federal officials exercising policy authority over such systems. This guideline is consistent with the requirements of the Office of Management and Budget (OMB) Circular A-130. Nothing in this publication should be taken to contradict the standards and guidelines made mandatory and binding on federal agencies by the Secretary of Commerce under statutory authority.

Guide to Enterprise Patch Management Planning_ Preventive Maintenance for Technology


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Zero Trust Architecture provide? (Part 2)

[Assistant]
as normas y directrices no se aplicarán a los sistemas de seguridad nacional sin la aprobación expresa de los funcionarios federales apropiados que ejercen la autoridad política sobre dichos sistemas.
Esta directriz es coherente con los requisitos de la Circular A-130 de la Oficina de Gestión y Presupuesto (OMB). Nada  de  lo  que  figura  en  esta  publicación  debe  interpretarse  como  contradictorio  con  las  normas  y directrices que el Secretario de Comercio ha hecho obligatorias y vinculantes para los organismos federales en  virtud  de  la  autoridad  legal. Estas  directrices  tampoco  deben  interpretarse  como  una  alteración  o sustitución de las autoridades existentes del Secretario de Comercio, el Director de la OMB o cualquier otro funcionario federal. Esta publicación puede ser utilizada por organizaciones no gubernamentales de forma  voluntaria  y  no  está  sujeta  a  derechos  de  autor  en  los  Estados  Unidos. No  obstante,  el  NIST agradecerá que se cite su procedencia. Publicación especial 800-207 del Instituto Nacional de Estándares y Tecnología (NIST)

Inst. Nac. Est. Technol. Publ. Espec. 800-207, 59 páginas (agosto de 2020) CODEN: NSPUE2

Esta publicación está disponible en inglés de forma gratuita en: https://doi.org/10.6028/NIST.SP.800-207

En este documento pueden identificarse ciertas entidades, equipos o materiales comerciales con el fin de describir adecuadamente un procedimiento o concepto experimental. Dicha identificación no implica una recomendación o aprobación por parte del NIST, ni que las entidades, materiales o equipos sean necesariamente los mejores disponibles para el propósito. En esta publicación puede haber referencias a otras que actualmente están siendo desarrolladas por NIST de acuerdo con sus responsabilidades estatutarias asignadas.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Security Assessment?

[Assistant]
According to Guide for Developing Security Plans for Federal Information Systems:

rmeasures) for an information system that are primarily implemented and executed by the information system through mechanisms contained in the hardware, software, or firmware components of the system.
|
|--------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Threat [CNSS Inst. 4009, Adapted]          | Any circumstance or event with the potential to adversely impact agency operations (including mission, functions, image, or reputation), agency assets, or individuals through an information system via unauthorized access, destruction, disclosure, modification of information, and/or denial of service. |
| Threat Agent/Source [NIST SP 800- 30]      | Either: (i) intent and method targeted at the intentional exploitation of a vulnerability; or (ii) a situation and method that may accidentally trigger a vulnerability. |
| Threat Assessment [CNSS Inst. 4009]        | Formal description and evaluation of threat to an information system. |
| Trusted Path                               | A mechanism by which a user (through an input device) can communicate directly with the security functions of the information system with the necessary confidence to support the system security policy. This mechanism can only be activated by the user or the security functions of the information system and cannot be imitated by untrusted software. |
| User [CNSS Inst. 4009]                     | Individual or (system) process authorized to access an information system. |
| Vulnerability [CNSS Inst.

Guide for Developing Security Plans for Federal Information Systems


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Identification and Authentication?

[Assistant]
According to Contingency Planning Guide for Federal Information Systems:

| Chapter 1.

Contingency Planning Guide for Federal Information Systems


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 1 require for Planning?

[Assistant]
According to Summary Report for “Workshop on Updating Manufacturer Guidance for Securable Connected Product Development”:

Instead, participants recommended that the government could provide top-level support for broader cybersecurity objectives, integrating planning approaches to navigate the complexities of different sectors. Tools like effective consumer education awareness campaigns may drive better security practices to ensure consumers are well-informed about cybersecurity measures as they evolve. Participants agreed that one key aspect of government involvement is effective communication, which the participants agreed should be action-based messages directed at consumers. For example, simplifying communication and facilitating customer outreach are ways to promote awareness and understanding of cybersecurity practices.  Government-led programs for consumer education were seen as vital by the audience in driving consumer engagement and encouraging consumers to value secure products. It was noted that 'one size fits all communications' does not address the varying levels of knowledge in the general public.

Summary Report for “Workshop on Updating Manufacturer Guidance for Securable Connected Product Development”


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Proceedings of the Cybersecurity in Cyber-Physical Systems Workshop, April 23-24, 2012 provide? (Part 9)

[Assistant]
and Computer Science from Columbia University in 1978. He is a Fellow of the IEEE. <!-- image -->

<!-- image -->

<!-- image -->

<!-- image -->

<!-- image -->

<!-- image -->

<!-- image -->

## 3.
Implantable Medical Devices - Cyber Risks and Mitigation Approaches

Sarbari Gupta Electrosoft Services Reston, Virginia USA sarbari@electrosoft-inc.com

Abstract -Over the past decade, there has been an explosion in the deployment of implantable medical devices (IMDs) to facilitate the management and treatment of a wide variety of human health  conditions. While  functionality  and  patient  safety  requirements have driven new generation IMDs to be increasingly accessible through wireless communication channels, these changes cause significant concern in terms of increased risk from cyber  threats  whether  malicious  or  unintentional. This  paper investigates the risks associated with such devices from the cyber environment  and  proposes  approaches  to  support  decisions  regarding the integration of adequate security and privacy measures to mitigate these risks. Keywords-medical devices; security, privacy, cyber, risks

## I. Introduction

Deployment rates for implantable medical devices (IMDs) have skyrocketed over the past decade. Devices such as pacemakers,  cardiac  defibrillators,  heart  monitors,  cochlear  implants, insulin pumps, infusion pumps and other similar devices are  routinely  used  to  monitor  and  treat  a  plethora  of  medical conditions. These  IMDs  have  been  increasingly  accessible through  wireless  channels  to  support  functions  such  as  emergency extraction of patient health history, remote monitoring of health  status,  firmware  updates  and  local  as  well  as  remote therapy  reprogramming. As  with  all  things  connected  to  the cyber world, there are known and unknown threats lurking that threaten the reliability and safety of these devices as well the privacy of patients who depends on them. ## II.

Proceedings of the Cybersecurity in Cyber-Physical Systems Workshop, April 23-24, 2012


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171 provide? (Part 8)

[Assistant]
e requirements also apply to services, including externally provided services, that process, store, or transmit CUI, or that provide security protections, for the system requiring enhanced protection.
The protection of a specific service to include CUI that is processed, stored or transmitted during the provision of that service, is achieved by implementing the enhanced security  requirements  for  the  service,  or  the  system  or  system  components  responsible  for providing that service. In addition to protecting CUI from unauthorized disclosure, the enhanced security requirements have been designed to protect the integrity and availability of CUI. This is achieved by promoting penetration-resistant architectures, damage-limiting operations, and designs to help achieve cyber resiliency and survivability. The term organizational system is used in many of the enhanced security requirements. It has a specific meaning regarding the applicability of the enhanced requirements as described above. Appropriate scoping considerations for the requirements are important factors in determining protection-related investment decisions and managing security risk for nonfederal organizations that have the responsibility of protecting CUI associated with critical programs and high value assets. \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

## FRAMEWORK FOR IMPROVING CRITICAL INFRASTRUCTURE CYBERSECURITY

Organizations that have implemented or plan to implement the NIST Framework for Improving Critical Infrastructure Cybersecurity [NIST CSF] can find in Appendix C a mapping of the enhanced security requirements in this publication to the security controls in [SP 800-53].

Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Media Protection?

[Assistant]
According to Control Baselines for Information Systems and Organizations:

Information security programs are responsible for protecting information and information systems from unauthorized access, use, disclosure, disruption, modification, or destruction (i.e., unauthorized system activity or behavior) in order to provide confidentiality, integrity, and availability. Privacy programs are responsible for managing the risks to individuals associated with the creation, collection, use, processing, dissemination, storage, maintenance, disclosure, or disposal (collectively referred to as 'processing') of personally identifiable information (PII) and for ensuring compliance with applicable privacy requirements. 11  When a system processes PII, the information security and privacy programs have a shared responsibility to manage the impacts to individuals that arise from security risks and collaborate to determine the security categorization and the selection and tailoring of controls from the security control baselines.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Services Acquisition?

[Assistant]
According to Control Baselines for Information Systems and Organizations:

There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts, practices, and methodologies may be used by federal agencies even before the completion  of  such  companion  publications. Thus,  until  each  publication  is  completed,  current requirements, guidelines, and procedures, where they exist, remain operative. For planning and transition purposes, federal agencies may wish to closely follow the development of these new publications by NIST. The National Institute of Standards and Technology (NIST) Information Technology Laboratory (ITL) promotes the U.S. economy and public welfare by providing technical leadership for the Nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology (IT). ITL's responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the costeffective security of other than national security-related information in federal information systems. The Special Publication 800-series reports on ITL's research, guidelines, and outreach efforts in information systems security and privacy and its collaborative activities with industry, government, and academic organizations. This publication provides security and privacy control baselines for the Federal Government. There are three security control baselines (one for each system impact level-low-impact, moderate-impact, and high-impact), as well as a privacy baseline that is applied to systems irrespective of impact level. In addition to the control baselines, this publication provides tailoring guidance and a set of working assumptions that help guide and inform the control selection process.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Maintenance?

[Assistant]
According to Guide to Malware Incident Prevention and Handling for Desktops and Laptops:

This publication provides recommendations for improving an organization's malware incident prevention measures. It also gives extensive recommendations for enhancing an organization's existing incident response capability so that it is better prepared to handle malware incidents, particularly widespread ones. This revision of the publication, Revision 1, updates material throughout the publication to reflect the changes in threats and incidents. Unlike most malware threats several years ago, which tended to be fastspreading and easy to notice, many of today's malware threats are more stealthy, specifically designed to quietly, slowly spread to other hosts, gathering information over extended periods of time and eventually leading to exfiltration of sensitive data and other negative impacts. An organization's policy statements should be used as the basis for additional malware prevention efforts, such as user and IT staff awareness, vulnerability mitigation, threat mitigation, and defensive architecture. If an organization does not state malware prevention considerations clearly in its policies, it is unlikely to perform malware prevention activities consistently and effectively throughout the organization. Malware prevention-related policy should be as general as possible to provide flexibility in policy implementation and to reduce the need for frequent policy updates, but should also be specific enough to make the intent and scope of the policy clear. Malware prevention-related policy should include provisions related to remote workers-both those using hosts controlled by the organization and those using hosts outside of the organization's control (e.g., contractor computers, employees' home computers, business partners' computers, mobile devices). Organizations should ensure that their policies address prevention of malware incidents.

Guide to Malware Incident Prevention and Handling for Desktops and Laptops


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AU.L2-3.3.4 (NIST 3.3.4)?

[Assistant]
According to Digital Identity Guidelines:

3.3.4. 3.3.4. 3.3.4.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AC.L2-3.1.5 (NIST 3.1.5)?

[Assistant]
According to Digital Identity Guidelines_ Authentication and Authenticator Management:

3.1.5. 3.1.5): A one-time secret obtained from a device

or application held by the subscriber that requires activation by a second
authentication factor

• Single-factor cryptographic authentication (Sec. 3.1.5)

• Multi-factor cryptographic authentication (Sec.

Digital Identity Guidelines_ Authentication and Authenticator Management


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations provide? (Part 4)

[Assistant]
ns. This publication can be used in conjunction with its companion publication, NIST Special Publication 800-171A, which provides a comprehensive set of procedures to assess the security requirements.
## Keywords

Controlled Unclassified Information; Executive Order 13556; FIPS Publication 199; FIPS Publication 200; FISMA; NIST Special Publication 800-53; nonfederal organizations; nonfederal systems; organization-defined parameter; security assessment; security control; security requirement. ## Reports on Computer Systems Technology

The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the Nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology. ITL's responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in federal information systems. The Special Publication 800-series reports on ITL's research, guidelines, and outreach efforts in information system security, and its collaborative activities with industry, government, and academic organizations.

Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Personnel Security?

[Assistant]
According to Summary of NIST SP 800-53, Revision 4_ Security and Privacy Controls for Federal Information Systems and Organizations:

SP 800-53 Revision 4 has been updated to reflect the evolving technology and threat space. Example areas include issues particular to mobile and cloud computing; insider threats; applications security; supply chain risks; advanced persistent threat; and trustworthiness, assurance, and resilience of information systems. The revision also contains a new appendix of privacy controls, and related implementation guidance (Appendix J), based on the Fair Information Practice Principles (FIPPs), a widely accepted framework of defining principles to be used in the evaluation and consideration of systems, processes, or programs that affect individual privacy.

The criteria for whether a security control is assurance- or functionality-related is based on the overall characteristics of the control. In general, assurance-related controls are controls that: (i) define processes, procedures, techniques, or methodologies for designing and developing information systems and system components; (ii) provide supporting operational processes including improving the quality of systems, components, or processes; (iii) produce security evidence from developmental or operational activities; (iv) determine security control effectiveness or risk; or (v) improve personnel skills, expertise, and understanding.

Summary of NIST SP 800-53, Revision 4_ Security and Privacy Controls for Federal Information Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Supply Chain Risk Management?

[Assistant]
According to Control Baselines for Information Systems and Organizations:

See [SP 800-37], Task S-2, Control Tailoring, for additional guidance on tailoring control baselines for systems and environments of operation.' | 9 | | 12-10-2020 | Editorial | Section 2.4 (Footnote 28): Change 'Guidance on developing privacy plans is forthcoming.' to 'Guidance on developing privacy and supply chain risk management plans is forthcoming.' | 9 | | 12-10-2020 | Editorial | Table 3-1 (AC-3(1)) Title: Change 'FUNCTION' to 'FUNCTIONS' | 16 | | 12-10-2020 | Editorial | Table 3-1 (AC-3(6)): Change 'MP-4, SC-28' to 'MP-4 and SC-28' | 16 | | 12-10-2020 | Editorial | Table 3-1 (AC-13): Change 'AC-2, AU-6' to 'AC-2 and AU-6' | 18 | | 12-10-2020 | Editorial | Table 3-1 (AC-19(5)) Title: Change 'FULL DEVICE AND' to 'FULL DEVICE OR' | 19 | | 12-10-2020 | Editorial | Table 3-1 (AC-20(4)) Title: Change 'NETWORK-ACCESSIBLE' to 'NETWORK ACCESSIBLE' | 19 | | 12-10-2020 | Editorial | Table 3-2 (AT-3(5)) Title: Change 'ACCESSING PERSONALLY' to 'PROCESSING PERSONALLY' | 20 | | 12-10-2020 | Editorial | Table 3-3 (AU-7(2)) Title: Change 'SEARCH AND SORT' to 'SORT AND SEARCH' | 21 | | 12-10-2020 | Editorial | Table 3-3 (AU-15): Change 'Incorporated into' to 'Moved to' | 22 |


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Planning?

[Assistant]
According to Secure Software Development Practices for Generative AI and Dual-Use Foundation Models_ An SSDF Community Profile:

adopting secure software development practices involving AI models. The contents of the Profile are meant to be adapted and customized, as not all practices and tasks are applicable to all use cases.
Organizations should adopt a riskbased approach to determine what practices and tasks are relevant, appropriate, and effective to mitigate the threats to software development practices from the organization's perspective as an AI model producer, AI system producer, or AI system acquirer. Factors such as risk, cost, feasibility, and applicability should be considered when deciding which practices and tasks to use and how much time and resources to devote to each one. Cost models may need to be updated to effectively consider the costs inherent to AI model development. A risk-based approach to secure software development may change over time as an organization responds to new or elevated capabilities and risks associated with an AI model or system. Generative AI and dual-use foundation models present additional challenges in tracking model versioning and lineage. Source code for defining the model architecture and building model binaries is amenable to secure software engineering practices for versioning, lineage, and reproducibility. However, the final model weights are defined only after the model is trained and fine-tuned; this is where limitations in tracking all aspects of collection, processing, and training arise. Organizations should follow secure software development practices for the parts of a model that can be covered fully and strive to introduce secure practices to the extent possible for the stages and corresponding artifacts where obtaining such security guarantees is hard to achieve. Organizations should document the parts and artifacts that are not covered by the secure software development practices.

Secure Software Development Practices for Generative AI and Dual-Use Foundation Models_ An SSDF Community Profile


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Secure Software Development Framework (SSDF) Version 1.1_ Recommendations for Mitigating the Risk of Software Vulnerabilities provide? (Part 3)

[Assistant]
es  even  before  the  completion  of  such  companion  publications. Thus,  until  each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative.
For planning  and  transition  purposes,  federal  agencies  may  wish  to  closely  follow  the  development  of  these  new publications by NIST. Organizations are encouraged to review all draft publications during public comment periods and provide feedback to NIST. Many NIST cybersecurity publications, other than the ones noted above, are available at https://csrc.nist.gov/publications. Submit comments on this publication to:

ssdf@nist.gov

National Institute of Standards and Technology Attn: Computer Security Division, Information Technology Laboratory 100 Bureau Drive (Mail Stop 8930) Gaithersburg, MD 20899-8930

All comments are subject to release under the Freedom of Information Act (FOIA). ## Reports on Computer Systems Technology

The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the Nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology. ITL's responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in federal information systems. The Special Publication 800-series reports on ITL's research, guidelines, and outreach efforts in information system security, and its collaborative activities with industry, government, and academic organizations.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Protecting Information and System Integrity in Industrial Control System Environments_ Cybersecurity for the Manufacturing Sector provide? (Part 7)

[Assistant]
While the NCCoE used a suite of commercial products to address this challenge, this guide does not endorse these particular products, nor does it guarantee compliance with any regulatory initiatives.
Your organization's information security experts should identify the products that will best integrate with your existing tools and IT system infrastructure. Your organization can adopt this solution or one that adheres to these guidelines in whole, or you can use this guide as a starting point for tailoring and implementing parts of a solution. ## HOW TO USE THIS GUIDE

Depending on your role in your organization, you might use this guide in different ways:

Business decision makers, including chief information security and technology officers, can use this part of the guide, NIST SP 1800-10A: Executive Summary , to understand the drivers for the guide, the cybersecurity challenge we address, our approach to solving this challenge, and how the solution could benefit your organization. Technology, security, and privacy program managers who are concerned with how to identify, understand, assess, and mitigate risk can use NIST SP 1800-10B: Approach, Architecture, and Security Characteristics . It describes what we built and why, including the risk analysis performed and the security/privacy control mappings. Technology professionals who want to implement an approach like this can make use of NIST SP 180010C: How-To Guides . It provides specific product installation, configuration, and integration instructions for building the example implementation, allowing you to replicate all or parts of this project. ## SHARE YOUR FEEDBACK

You can view or download the guide at https://www.nccoe.nist.gov/projects/usecases/manufacturing/integrity-ics. Once the example implementation is developed, you can adopt this solution for your own organization. If you do, please share your experience and advice with us.

Protecting Information and System Integrity in Industrial Control System Environments_ Cybersecurity for the Manufacturing Sector


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Communications Protection?

[Assistant]
According to Control Baselines for Information Systems and Organizations:

| CHAPTERONE INTRODUCTION...................................................................................................... 1               | CHAPTERONE INTRODUCTION...................................................................................................... 1               | CHAPTERONE INTRODUCTION...................................................................................................... 1   |
|-----------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------|
| 1.1                                                                                | PURPOSEANDAPPLICABILITY ................................................................................................... | 1                                                                                |
| 1.2                                                                                | TARGET AUDIENCE .................................................................................................................. | 2                                                                                |
| 1.3                                                                                | ORGANIZATIONAL RESPONSIBILITIES .........................................................................................


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Federal Cybersecurity Awareness Programs_ A Mixed Methods Research Study provide? (Part 7)

[Assistant]
| Survey Data Analysis ..................................................................................................
| 6                                                                                |
| 3                                                                                | REPRESENTED PARTICIPANTS, ORGANIZATIONS, AND PROGRAMS ............ 7                                                                      | REPRESENTED PARTICIPANTS, ORGANIZATIONS, AND PROGRAMS ............ 7                                                                      |
| 3.1 PARTICIPANTS ...................................................................................................................... 7 | 3.1 PARTICIPANTS ...................................................................................................................... 7 | 3.1 PARTICIPANTS ...................................................................................................................... 7 |
| 3.1.1                                                                                | Security Awareness Role............................................................................................. | 8                                                                                |
| 3.1.2                                                                                | Time Spent on Security Awareness .............................................................................

Federal Cybersecurity Awareness Programs_ A Mixed Methods Research Study


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Services Acquisition?

[Assistant]
According to Digital Identity Guidelines:

gement, administrative, technical,
and physical standards and guidelines for the cost-effective security and privacy of other
than national security-related information in federal information systems.
The Special
Publication 800-series reports on ITL’s research, guidelines, and outreach efforts in
information system security, and its collaborative activities with industry, government,
and academic organizations.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Guide to a Secure Enterprise Network Landscape provide? (Part 7)

[Assistant] | 2.4 Limitation of Authentication Infrastructure...............................................................................6 | 2.4 Limitation of Authentication Infrastructure...............................................................................6 | 2.4 Limitation of Authentication Infrastructure...............................................................................6 | | Network Security Appliances in the Enterprise Network Landscape ............................8 | Network Security Appliances in the Enterprise Network Landscape ............................8 | | | Cloud Access Security Broker (CASB)..........................................................................8 | Cloud Access Security Broker (CASB)..........................................................................8 | | | Enhanced Firewall Capabilities | Enhanced Firewall Capabilities | .....................................................................................8 | | Appliance-set with Integrated Functions | Appliance-set with Integrated Functions | .....................................................................10 | | Network Security Automation Tools | Network Security Automation Tools | ............................................................................11 | | 3.4.1.

Guide to a Secure Enterprise Network Landscape


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Awareness and Training?

[Assistant]
According to Cryptographic Module Validation Program (CMVP) Security Policy Requirements_ CMVP Validation Authority Updates to ISO_IEC 24759 and ISO_IEC 19790 Anne:

This section provides further guidance on what type of information is expected for a specific requirement or set of requirements from Annex B and the additional requirements listed in Section 3.2. All of the requirement statements are organized into appropriately named and numbered subsections (e.g., 1.2 - Security Levels, 2.1 - Purpose or Use). Each subsection identifies the applicable requirements and provides any clarifying and explanatory notes.

Cryptographic Module Validation Program (CMVP) Security Policy Requirements_ CMVP Validation Authority Updates to ISO_IEC 24759 and ISO_IEC 19790 Anne


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Maintenance?

[Assistant]
According to Digital Identity Guidelines_ Identity Proofing and Enrollment:

Additional information about this publication is available at https://csrc.nist.gov/pubs/
sp/800/63/A/4/final, including related content, potential updates, and document
history.

3.7. Additional Requirements for Federal Agencies

4.3.7. On-Site Attended Requirements — Colocated Agent

Digital Identity Guidelines_ Identity Proofing and Enrollment


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Services Acquisition?

[Assistant]
According to Report on the Design-A-Thon_ Designing Effective and Accessible Approaches for Digital Product Cybersecurity Education and Awareness:

n approaches were adequately tailored. Teams indicated that any standardization effort should similarly be human-centric and consider the spectrum of potential users of a given application or product.
Unlike some areas of cybersecurity (e.g., encryption) which require limited human interaction, particularly with users, education and awareness addresses the human-in-the-loop and so depends, in large part, on human-factors for efficacy. All three teams specifically considered how their designs could be 'easiest' for users to use, understand, and be most accessible. Teams 1 and 3 incorporated gamification and other interactive elements to encourage users to pursue cybersecurity topics. For example, Team 3 attempted to gamify the pursuit of cybersecurity knowledge relative to the product by building out 'levels' of concepts that build upon each other so that users could 'level up' at their pace. Understanding and encouraging cybersecurity engagement has been a focus of research for the SOUPS community [8][9][10][11][12][13], and so the teams brought the insights from that research to the practical tasks of the Design-A-Thon. The contextual nature of cybersecurity education and awareness approaches was apparent when two teams (i.e., Teams 2 and 3) selected the same product but developed different approaches and focused on different aspects of the design. Teams 2 and 3 homed in on different information that may be useful at different times during the product's lifecycle. In one case, Team 2 focused on ensuring information was at users' fingertips, particularly when support was needed. In the other case, Team 3 considered how individuals could be encouraged to engage on cybersecurity education and awareness outside of times they needed support, landing on gamification elements.

Report on the Design-A-Thon_ Designing Effective and Accessible Approaches for Digital Product Cybersecurity Education and Awareness


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Information Integrity?

[Assistant]
According to Validating the Integrity of Computing Devices:

## Validating the Integrity of Computing Devices

## Validating the Integrity of Computing Devices

## Validating the Integrity of Computing Devices

Validating the Integrity of Computing Devices


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Services Acquisition?

[Assistant]
According to A Data Structure for Integrity Protection with Erasure Capability:

The data block matrix technology (US Patent #11,175,826) is available to be licensed . For information on patent and licensing see NIST Technology Partnerships Office (TPO). Parties interested in licensing a NIST-owned invention may contact TPO, or may complete a research license application or commercial use license application. Instructions on how to submit the license application are provided at the end of each application. When a license application is received, TPO will contact you regarding the licensing process and to obtain additional information that may be necessary for the application process. A license application should include the prospective licensee's intentions for research and development of the invention(s) and a description of the resources and technical capabilities of the prospective licensee to bring the invention to practical application.

A Data Structure for Integrity Protection with Erasure Capability


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Multi-Factor Authentication for Criminal Justice Information Systems_ Implementation Considerations for Protecting Criminal Justice Information provide? (Part 10)

[Assistant]
CAD/RMS web app and IdP at county (SAML proxy). .............................................................45                     |
| Fig. 23. CAD/RMS web app and IdP at state - OIDC and OAuth 2.0.
...................................................47                        |
| Fig. 24. VPN with an LDAP directory..................................................................................................49      |
| Fig. 25. VPN with Kerberos. ..............................................................................................................50 |
| Fig. 26. VPN gateway integration with enterprise SSO.......................................................................51                |

## Acknowledgments

We are grateful to the following individuals for their generous contributions of expertise and time. | Name                | Organization                               |
|---------------------|--------------------------------------------|
| Chris Weatherly     | Federal Bureau of Investigation (FBI) CJIS |
| Jeff Campbell       | FBI CJIS                                   |
| Holden Cross        | ECS                                        |
| John Beltz          | NIST                                       |
| Hildegard Ferraiolo | NIST                                       |
| Ryan Galluzzo       | NIST                                       |
| Cheri Pascoe        | NIST                                       |
| Andrew Regenscheid  | NIST                                       |
| Ron Pulivarti       | NIST                                       |
| Julie Chua          | NIST                                       |

## Executive Summary

The Criminal Justice Information Services (CJIS) Security Policy versions 5.9.2 and later [1] require the use of multi-factor authentication (MFA) to protect access to criminal justice information (CJI). MFA is important for protecting against credential compromises and other cyber risks that may threaten CJI.

Multi-Factor Authentication for Criminal Justice Information Systems_ Implementation Considerations for Protecting Criminal Justice Information


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Awareness and Training?

[Assistant]
According to Strategies for the Integration of Software Supply Chain Security in DevSecOps CI_CD Pipelines:

| Executive Summary............................................................................................................................1        |
|-------------------------------------------------------------------------------------------------------------------------------------------------------|
| 1. Introduction...................................................................................................................................2   |
| 2. Software Supply Chain (SSC) -Definition and Model .....................................................................4                           |
| 2.4.1. Software Supply Chain Defects ....................................................................................................6            |
| 2.4.2. Software Supply Chain Attacks.....................................................................................................6            |
| SSC Security -Risk Factors and Mitigation Measures .....................................................................8                             |
| 3. |
| 3.1.1. Developer Environment ...............................................................................................................8         |
| 3.1.2. Threat Actors................................................................................................................................8 |
| 3.1.3. Attack Vectors ..............................................................................................................................9 |
| 3.1.4. Attack Targets (Assets).................................................................................................................9      |
| 3.1.5. Types of Exploits.........................................................................................................................10   |
| 3.2.1.

Strategies for the Integration of Software Supply Chain Security in DevSecOps CI_CD Pipelines


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Machine Learning for Access Control Policy Verification provide? (Part 7)

[Assistant] 6: Machine Learning RFC method for access control policy verification.........................................12 | | Figure 7: Numerical attribute values in a subtree model ............................................................................15 | Figure 7: Numerical attribute values in a subtree model ............................................................................15 | | List of Tables | List of Tables | ## 1 Introduction As a software test, access control policy verification relies on methods such as model proof [Hwang et al.

Machine Learning for Access Control Policy Verification


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Incident Response?

[Assistant]
According to Guide to a Secure Enterprise Network Landscape:

of network events that can be used to identify patterns of performance and security issues. - Access control functions: Access control functions enforce granular sophisticated access control policies.
- Multiple locations and functions: Firewalls reside at different locations to perform different functions. Firewalls at the network edge perform the network perimeter protection function by filtering disallowed sources and destinations and blocking the packets of potential threats. Firewalls inside a data center can segment the internal network to prevent the lateral movement of traffic and isolate sensitive resources (e.g., services and data stores). Device-based firewalls prevent malicious traffic in and out of endpoints. - Open Application Programming Interfaces (APIs): These enable integration with many networking products that provide additional security capabilities. - Policy Composition Capabilities: Some firewalls can have the capabilities to merge policies at enforcement time so as to ensure that consistent policies are applied to different classes of users (e.g., those on-premises and on private and public clouds). - Web application firewalls (WAF): This class of firewalls has been used ever since web applications accessed through web protocols, such as Hypertext Transfer Protocol


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Identification and Authentication?

[Assistant]
According to Guidelines on Mobile Device Forensics:

| Table of Contents                                                                                | Table of Contents                                                                                | Table of Contents                                                                                |
|----------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------|
| TABLE OFCONTENTS.............................................................................................................V         | TABLE OFCONTENTS.............................................................................................................V         |                                                                                |
| LIST OF FIGURES....................................................................................................................VII | LIST OF FIGURES....................................................................................................................VII |                                                                                |
| LIST OFTABLES.................................................................................................................... | LIST OFTABLES....................................................................................................................


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Awareness and Training?

[Assistant]
According to Recommendation for Pair-Wise Key-Establishment Using Integer Factorization Cryptography:

Pairs for Key Establishment .......................................................... | 6.2 Criteria for RSA Key Pairs for Key Establishment ..........................................................
|   37 |
|                                                                                | 6.2.1                                                                                | Definition of a Key Pair ......................................................................................... |   37 |
|                                                                                | 6.2.2                                                                                | Formats................................................................................................................... |   37 |
| 6.3 RSA Key-Pair Generators................................................................................................. | 6.3 RSA Key-Pair Generators................................................................................................. | 6.3 RSA Key-Pair Generators................................................................................................. |   38 |
|                                                                                | 6.3.1                                                                                | RSAKPG1 Family: RSA Key-Pair Generation with a Fixed Public Exponent .....

Recommendation for Pair-Wise Key-Establishment Using Integer Factorization Cryptography


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule_ A Cybersecurity Resource Guide provide? (Part 6)

[Assistant]
publication, no such patent claims have been identified to ITL. No representation is made or implied by ITL that licenses are not required to avoid patent infringement in the use of this publication.
## Table of Contents

| Executive Summary............................................................................................................................1      |
|-----------------------------------------------------------------------------------------------------------------------------------------------------|
| 1. Introduction...................................................................................................................................4 |
| 2. HIPAA Security Rule .......................................................................................................................9     |
| 3. Risk Assessment Guidance............................................................................................................14           |
| 4. Risk Management Guidance .........................................................................................................24             |
| 5. Considerations When Implementing the HIPAA Security Rule........................................................28                               |
| 5.1.2. Assigned Security Responsibility (§ 164.308(a)(2)) ....................................................................35                    |
| 5.1.3. Workforce Security (§ 164.308(a)(3)).........................................................................................36              |
| 5.1.4. Information Access Management (§ 164.308(a)(4)) ..................................................................38                         |
| 5.1.5. Security Awareness and Training (§ 164.308(a)(5)) ...................................................................41                      |
| 5.1.6.

Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule_ A Cybersecurity Resource Guide


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AT.L2-3.2.6 (NIST 3.2.6)?

[Assistant]
According to Audit and Evaluation of Computer Security II_ System Vulnerabilities and Controls:

3.2.6 Environment Control                                                                             | 4-11      |
| 4. 3.2.6 Environment Control .

Audit and Evaluation of Computer Security II_ System Vulnerabilities and Controls


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 2 require for Identification and Authentication?

[Assistant]
According to Profile of the IoT Core Baseline for Consumer IoT Products:

1. Each IoT product component controls access to and from all interfaces (e.g., local interfaces, whether externally accessible or not, network interfaces, protocols, and services) in order to limit access to only authorized entities. At a minimum, the IoT product component shall:
- a. Use and have access only to interfaces necessary for the IoT product's operation. All other channels and access to channels are removed or secured. - b. For all interfaces necessary for the IoT product's use, access control measures are in place (e.g., unique password-based multifactor authentication, physical interface ports inaccessible from the outside of a component). - c. For all interfaces, access and modification privileges are limited. 2. Some, but not necessarily all, IoT product components have the means to protect and maintain interface access control. At a minimum, the IoT product shall:
- a. Validate that data shared among IoT product components match specified definitions of format and content. - b. Prevent unauthorized transmissions or access to other product components. - c. Maintain appropriate access control during initial connection (i.e., onboarding) and when reestablishing connectivity after disconnection or outage.

Profile of the IoT Core Baseline for Consumer IoT Products


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 1 require for Access Control?

[Assistant]
According to IoT Device Cybersecurity Capability Core Baseline:

- [1] Joint Task Force Transformation Initiative (2013) Security and Privacy Controls for Federal Information Systems and Organizations. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) 800-53, Rev. 4, Includes updates as of January 22, 2015. https://doi.org/10.6028/NIST.SP.800-53r4
- [2] Fagan M, Megas KN, Scarfone K, Smith M (2020) Foundational Cybersecurity Activities for IoT Device Manufacturers. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Interagency or Internal Report (IR) 8259. https://doi.org/10.6028/NIST.IR.8259
- [3] Joint Task Force Transformation Initiative (2012) Guide for Conducting Risk Assessments. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) 800-30, Rev. 4. https://doi.org/10.6028/NIST.SP.80030r1
- [4] Boeckl K, Fagan M, Fisher W, Lefkovitz N, Megas K, Nadeau E, Piccarreta B, Gabel O'Rourke D, Scarfone K (2019) Considerations for Managing Internet of Things (IoT) Cybersecurity and Privacy Risks. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Interagency or Internal Report (IR) 8228. https://doi.org/10.6028/NIST.IR.8228
- [5] AgeLight Digital Trust Advisory Group (2019) IoT Safety Architecture & Risk Toolkit (IoTSA) v3.1. (AgeLight Advisory & Research Group, Bellevue, WA). http://agelight.com/iot.html
- [6] Broadband Internet Technical Advisory Group (BITAG) (2016) Internet of Things (IoT) Security and Privacy Recommendations. (Broadband Internet Technical Advisory Group [BITAG], Denver, CO). https://www.bitag.org/documents/BITAG\_Report\_-\_Internet\_of\_Things\_(IoT)\_Security\_and\_Privacy\_Recommendations.pdf
- [7] Cloud Security Alliance (CSA) IoT Working Group (2015) Identity and Access Management for the Internet of Things. (Cloud Security Alliance [CSA]).

IoT Device Cybersecurity Capability Core Baseline


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Digital Identity Guidelines provide? (Part 7)

[Assistant]
. . . . . . . . . . . . . . . . . . . . . 3.3.2. Assurance Level Descriptions

. . . . . . . . . . . . . . . . . . . 3.3.3. Initial Assurance Level Selection . . . . . . . . . . . . . . . . . . 3.3.4.
Identify Baseline Controls . . . . . . . . . . . . . . . . . . . . . 3.4. Tailor and Document Assurance Levels

. . . . . . . . . . . . . . . . . . 3.4.1. Assess Privacy, Customer Experience, and Threat Resistance . . . 3.4.2. Identify Compensating Controls . . . . . . . . . . . . . . . . . . 3.4.3. Identify Supplemental Controls . . . . . . . . . . . . . . . . . . 3.4.4. Digital Identity Acceptance Statement . . . . . . . . . . . . . . . 3.5. Continuously Evaluate and Improve . . . . . . . . . . . . . . . . . . . . 3.5.1. Evaluation Inputs . . . . . . . . . . . . . . . . . . . . . . . . . . 3.5.2. Performance Metrics . . . . . . . . . . . . . . . . . . . . . . . . 3.5.3. Measurement in Support of Customer Experience Outcomes

. . Redress . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Cybersecurity, Fraud, and Identity Program Integrity . . . . . . . . . . . 3.6. 3.7. 3.8. Artificial Intelligence and Machine Learning in Identity Systems

. . . . . References

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Appendix A. List of Symbols, Abbreviations, and Acronyms . . . . . . . . . . . . Appendix B. Glossary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Appendix C. Change Log . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C.1. C.2. C.3. C.4. SP 800-63-1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . SP 800-63-2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . SP 800-63-3 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . SP 800-63-4 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . List of Tables
Table 1. Table 2. Table 3. Table 4. IAL Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . AAL Summary . . . .


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice MP.L2-3.8.2 (NIST 3.8.2)?

[Assistant]
According to Guide to Auditing for Controls and Security_ A System Development Life Cycle Approach:

3.8.2                                                            | The ADP Auditor                                                  | The ADP Auditor                                                  | 65        |
| CHAPTER 4 | CHAPTER 4                                                        | CHAPTER 4                                                        | CHAPTER 4                                                        | CHAPTER 4 |
| AIS       | DEVELOPMENTAL                                                    | DEVELOPMENTAL                                                    | AUDITS                                                           | 67        |

i

^

(

I

^

| 4. 3.8.2 The ADP Auditor

Hopefully, the ADP auditor will have the opportunity to prioritize his or her work before jumping in.

Guide to Auditing for Controls and Security_ A System Development Life Cycle Approach


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Recommendation for Pair-Wise Key-Establishment Schemes Using Discrete Logarithm Cryptography provide? (Part 7)

[Assistant]
. Overview of Key-Establishment Schemes........................................................... | 4. Overview of Key-Establishment Schemes...........................................................
| 14                                                                                |
|                                                                                | 4.1                                                                                | Key Establishment Preparations .................................................................................... | 15                                                                                |
|                                                                                | 4.2                                                                                | Key-Agreement Process................................................................................................. | 17                                                                                |
|                                                                                | 4.3                                                                                | DLC-based Key-Transport Process ............................................................................... | 19                                                                                |
| 5. Cryptographic Elements .......................................................................................

Recommendation for Pair-Wise Key-Establishment Schemes Using Discrete Logarithm Cryptography


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Supply Chain Risk Management?

[Assistant]
According to Secure Software Development Practices for Generative AI and Dual-Use Foundation Models_ An SSDF Community Profile:

- NIST research and publications on trustworthy and responsible AI, including the Artificial Intelligence Risk Management Framework (AI RMF 1.0) [2], Adversarial Machine Learning: A Taxonomy and Terminology of Attacks and Mitigations [3], Towards a Standard for Identifying and Managing Bias in Artificial Intelligence [4], and the Dioptra experimentation testbed for security evaluations of machine learning algorithms [5]. - NIST's Secure Software Development Framework (SSDF) Version 1.1 [6], which is a set of fundamental, sound, and secure software development practices. It provides a common language to help facilitate communications among stakeholders, including software producers and software acquirers. The SSDF has also been used in support of EO 14028, Improving the Nation's Cybersecurity [7], to enhance software supply chain security. - NIST general cybersecurity resources, including The NIST Cybersecurity Framework (CSF) 2.0 [8], Security and Privacy Controls for Information Systems and Organizations [9], and Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations [10]. - AI model developers, AI researchers, AI system developers, and secure software practitioners from industry and government with expertise in the unique security challenges of AI models and the practices for addressing those challenges. This expertise was primarily captured through NIST's January 2024 workshop, where speakers and attendees shared suggestions for adapting secure software development practices and tasks to accommodate the unique aspects of AI model development and the software leveraging them.

Secure Software Development Practices for Generative AI and Dual-Use Foundation Models_ An SSDF Community Profile


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Communications Protection?

[Assistant]
According to Multi-Factor Authentication for Criminal Justice Information Systems_ Implementation Considerations for Protecting Criminal Justice Information:

|   Phase | User Base                          | Rationale                                                                                | Outcome                                                                                |
|---------|------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
|       1 | IT support and help desk personnel | IT support and help desk personnel are tech-savvy users who can also anticipate potential support issues that the larger user base may have with the solution. | • Test multiple authenticator types and gain feedback on the processes of obtaining and using each authenticator. • Enumerate potential support issues. • Gain feedback on MFA instructions and communication tools. • Confirm authenticator type selection. |
|       2 | General IT staff                   | This is a larger, but still technically literate, user base. | • Test authenticators selected from phase 1. • Gain feedback on MFA instructions and communication tools. • Update communications and/or policy based on feedback. |
|       3 | General user cohort                | A representative cohort of general users can help test the MFA solution before a general user rollout. | • Take volunteers or a selection of the general cohort to test the MFA solution.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AU.L2-3.3.3 (NIST 3.3.3)?

[Assistant]
According to Digital Identity Guidelines:

3.3.3. 3.3.3. 3.3.3.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Access Control?

[Assistant]
According to Transitioning to the Security Content Automation Protocol (SCAP) Version 2:

n of Posture Evaluator service instances across the network. A Posture Evaluator retrieves previously collected posture from a CMDB and requests new posture collection from Posture Collection Servers.
Through these interactions, Posture Evaluators gain access to current posture information without having to collect all posture information directly from Endpoints. Posture Evaluators can store evaluation results in CMDBs, making these results available for additional evaluation and use by other tools. - Configuration Management Database: A Configuration Management Database (CMDB) maintains stores of collected endpoint posture information and evaluated data. Before directing the collection of additional posture information from Endpoints, evaluators can query one or more CMDBs to retrieve previously collected information, streamlining data collection needs. CMDBs serve as a consolidated point of access control for authorizing access to posture information, reducing the need for peer-to-peer trust relationships that open attack vectors on the network. - SCAP Content Repository: SCAP v2 will continue to support interoperable, standardized content formats, enabling community-driven content production. Additionally, SCAP v2 supports discovery and retrieval of content through standardized interfaces. One or more SCAP Content Repositories can serve SCAP content including SWID tags, vulnerability records, configuration checklists, and other security automation content. Authorized SCAP components will be able to automatically retrieve new and updated content from local and/or remote SCAP Content Repositories, keeping used content current and improving content reuse. NIST, software vendors, and third-parties will be able to self-publish and manage their own content, while allowing tools to automatically access this content.

Transitioning to the Security Content Automation Protocol (SCAP) Version 2


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for Audit and Accountability?

[Assistant]
According to Protecting Controlled Unclassified Information (CUI)_ NIST Special Publication 800-171, Revision 3. Small Business Primer:

d, communicated, understood, and enforced. Even if cybersecurity activities are outsourced to an external provider, someone within the business should still be designated to manage cybersecurity risk.
|
|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| It's not all technology. | An important point to emphasize is that many requirements in SP 800-171 do not need investments in technology or services to implement. Many requirements can be achieved through the creation of processes and procedures. |
| Implement the requirements and document implementation in a system security plan. | Satisfying the security requirements won't be accomplished overnight. Implement in phases based upon your resources (includin g time, expertise, budget, etc.), starting with understanding what security requirements you may have already satisfied and building from there.

Protecting Controlled Unclassified Information (CUI)_ NIST Special Publication 800-171, Revision 3. Small Business Primer