[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for System and Communications Protection?

[Assistant]
According to Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171:

| CHAPTERONE INTRODUCTION...................................................................................................... | CHAPTERONE INTRODUCTION...................................................................................................... |
|--------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------|
| 1.1 PURPOSEANDAPPLICABILITY                                                                                | ................................................................................................... 3                                            |
| 1.2 TARGET AUDIENCE                                                                                | .................................................................................................................. 4                             |
| 1.3 ORGANIZATIONOF THIS SPECIAL PUBLICATION                                                                                | .......................................................................... 4                                                                     |
| CHAPTERTWO THE FUNDAMENTALS............................................................................................ 5                        | CHAPTERTWO THE FUNDAMENTALS............................................................................................ 5                        |
| 2.1 DEVELOPMENTAPPROACH ......................................................................................................

Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AT.L2-3.2.1 (NIST 3.2.1)?

[Assistant]
According to Audit and Evaluation of Computer Security II_ System Vulnerabilities and Controls:

3.2.1 Data Entry                                                                           |           |
|      |                | 3. 3.2.1                                                  | Natural Hazards                                                                 | 6-10      |
|               | 3. 3.2.1 Data Entry .

Audit and Evaluation of Computer Security II_ System Vulnerabilities and Controls


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171 provide? (Part 8)

[Assistant]
e requirements also apply to services, including externally provided services, that process, store, or transmit CUI, or that provide security protections, for the system requiring enhanced protection.
The protection of a specific service to include CUI that is processed, stored or transmitted during the provision of that service, is achieved by implementing the enhanced security  requirements  for  the  service,  or  the  system  or  system  components  responsible  for providing that service. In addition to protecting CUI from unauthorized disclosure, the enhanced security requirements have been designed to protect the integrity and availability of CUI. This is achieved by promoting penetration-resistant architectures, damage-limiting operations, and designs to help achieve cyber resiliency and survivability. The term organizational system is used in many of the enhanced security requirements. It has a specific meaning regarding the applicability of the enhanced requirements as described above. Appropriate scoping considerations for the requirements are important factors in determining protection-related investment decisions and managing security risk for nonfederal organizations that have the responsibility of protecting CUI associated with critical programs and high value assets. \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

## FRAMEWORK FOR IMPROVING CRITICAL INFRASTRUCTURE CYBERSECURITY

Organizations that have implemented or plan to implement the NIST Framework for Improving Critical Infrastructure Cybersecurity [NIST CSF] can find in Appendix C a mapping of the enhanced security requirements in this publication to the security controls in [SP 800-53].

Audit and Accountability
System and Information Integrity
Security Assessment
Media Protection
Identification and Authentication
Awareness and Training
System and Communications Protection
Access Control
Planning
Incident Response
Risk Assessment
Personnel Security
System and Services Acquisition
Supply Chain Risk Management
Maintenance
Physical Protection
Configuration Management


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Addressing Visibility Challenges with TLS 1.3 within the Enterprise_ High-Level Document provide? (Part 7)

[Assistant]
publication, no such patent claims have been identified to ITL. No representation is made or implied by ITL that licenses are not required to avoid patent infringement in the use of this publication.
## Table of Contents

| 1   | Executive Summary.............................................................................1                                                                                | Executive Summary.............................................................................1                                                                                |
|-----|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| 2   | Introduction........................................................................................2                                                                                | Introduction........................................................................................2                                                                                |
|     | 2.1                                                                                | Audience ......................................................................................................................

Addressing Visibility Challenges with TLS 1.3 within the Enterprise_ High-Level Document


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Summary of NIST SP 800-53, Revision 4_ Security and Privacy Controls for Federal Information Systems and Organizations provide? (Part 9)

[Assistant]
tise, and understanding. Appendix E provides three tables that identify specific assurance-related controls that are included in the low-, moderate-, and high-impact baselines described in Appendix D.
The controls described assist organizations in defining the controls needed to satisfy minimum assurance requirements. Where additional assurance is desired to achieve risk management objectives, Table E-4 provides additional security controls and control enhancements to achieve enhanced assurance. Implementers should note that designation of assurance-related controls is not intended to imply a greater level of importance for such controls. Achieving adequate security for organizational information systems requires the correct combination of both functionality- and assurance-related security controls. ## 6 Security Controls

Appendix F, the Security Control Catalog, provides a comprehensive range of countermeasures for organizations and information systems. The security controls are designed to be technologyneutral such that the focus is on the fundamental countermeasures needed to protect organizational information during processing, storage, or transmission. SP 800-53 Rev. 4, therefore, does not provide guidance on the application of security controls to specific technologies, environments of operation, or missions/business functions. These specific areas may be addressed using overlays (see below). Control enhancements are included with many security controls and are selected in order to increase the strength of the base control. Control enhancements are intended to be implemented only in conjunction with implementation of the base control. Some security controls and control enhancements include one or more assignment and selection statements. These are variable parameters that organizations define, providing them with the ability to tailor security controls based on specific security requirements, environments of operation, and organizational risk tolerance.

Summary of NIST SP 800-53, Revision 4_ Security and Privacy Controls for Federal Information Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Personnel Security?

[Assistant]
According to Assessing Security and Privacy Controls in Information Systems and Organizations:

CHAPTER ONE INTRODUCTION ............................................................................................................... 1
1.1   PURPOSE AND APPLICABILITY .......................................................................................................... 1
1.2   TARGET AUDIENCE ............................................................................................................................ 4
1.3   RELATED PUBLICATIONS AND ASSESSMENT PROCESSES ............................................................... 4
1.4   ORGANIZATION OF THIS PUBLICATION ........................................................................................... 5
CHAPTER TWO THE FUNDAMENTALS ..................................................................................................... 6
2.1   ASSESSMENTS WITHIN THE SYSTEM DEVELOPMENT LIFE CYCLE .................................................. 6
2.2   CONTROL STRUCTURE AND ORGANIZATION .................................................................................. 7
2.3   BUILDING AN EFFECTIVE ASSURANCE CASE .................................................................................... 8
2.4   ASSESSMENT PROCEDURES: ASSESSMENT OBJECTS, METHODS AND OBJECTIVES ................... 11
CHAPTER THREE THE PROCESS ............................................................................................................. 19
3.1   PREPARE FOR SECURITY AND PRIVACY CONTROL ASSESSMENTS ............................................... 19
3.2   DEVELOP SECURITY AND PRIVACY ASSESSMENT PLANS .............................................................. 23
3.3   CONDUCT SECURITY AND PRIVACY CONTROL ASSESSMENTS ..................................................... 30
3.4   ANALYZE ASSESSMENT REPORT RESULTS .....................................................................................

Assessing Security and Privacy Controls in Information Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Security Assessment?

[Assistant]
According to Multi-Factor Authentication for Criminal Justice Information Systems_ Implementation Considerations for Protecting Criminal Justice Information:

|   Phase | User Base                          | Rationale                                                                                | Outcome                                                                                |
|---------|------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
|       1 | IT support and help desk personnel | IT support and help desk personnel are tech-savvy users who can also anticipate potential support issues that the larger user base may have with the solution. | • Test multiple authenticator types and gain feedback on the processes of obtaining and using each authenticator. • Enumerate potential support issues. • Gain feedback on MFA instructions and communication tools. • Confirm authenticator type selection. |
|       2 | General IT staff                   | This is a larger, but still technically literate, user base. | • Test authenticators selected from phase 1. • Gain feedback on MFA instructions and communication tools. • Update communications and/or policy based on feedback. |
|       3 | General user cohort                | A representative cohort of general users can help test the MFA solution before a general user rollout. | • Take volunteers or a selection of the general cohort to test the MFA solution.

Multi-Factor Authentication for Criminal Justice Information Systems_ Implementation Considerations for Protecting Criminal Justice Information


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AC.L2-3.1.3 (NIST 3.1.3)?

[Assistant]
According to Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations:

3.1.3. 3.1.3.

Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice IA.L2-3.5.1 (NIST 3.5.1)?

[Assistant]
According to Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations:

3.5.1. 3.5.1. 3.5.1.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Risk Assessment?

[Assistant]
According to Guide to Auditing for Controls and Security_ A System Development Life Cycle Approach:

| EXECUTIVE SUMMARY | EXECUTIVE SUMMARY | EXECUTIVE SUMMARY | EXECUTIVE SUMMARY | xiii | |-------------------------|------------------------------------------------------------|------------------------------------------------------------|------------------------------------------------------------|--------| | CHAPTER 1 | CHAPTER 1 | CHAPTER 1 | CHAPTER 1 | | | GENERALADP AUDIT ISSUES | GENERALADP AUDIT ISSUES | GENERALADP AUDIT ISSUES | GENERALADP AUDIT ISSUES | 1 | | 1.1 | INTRODUCTION | INTRODUCTION | INTRODUCTION | 1 | | | 1.1.1 | Scope of the Audit Guide | Scope of the Audit Guide | 1 | | | 1.1.2 | How to Use the Audit Guide | How to Use the Audit Guide | 2 | | | 1.1.3 | Auditor Skills Needed | Auditor Skills Needed | 2 | | | 1.1.4 | Auditing in a Computerized Environment | Auditing in a Computerized Environment | 3 | | | 1.1.4.1 | 1.1.4.1 | The Need | 3 | | | 1.1.4.2 | 1.1.4.2 | The Scope of Audit in a Computerized Environment | 3 | | | 1.1.4.3 | 1.1.4.3 | Relationship Between Systems Development Audits and | | | | Operational Audits of Automated Information Systems (AISs) | Operational Audits of Automated Information Systems (AISs) | Operational Audits of Automated Information Systems (AISs) | 4 |

Guide to Auditing for Controls and Security_ A System Development Life Cycle Approach


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Access Control on NoSQL Databases provide? (Part 6)

[Assistant]
.................................12    |
| 4. Considerations of Access Control for NoSQL Systems.....................................................................15                           |
| 5.
Conclusion ...................................................................................................................................19    |
| References.......................................................................................................................................20    |
| Appendix A......................................................................................................................................22     |

| List of Tables                                                                                |
|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Table 1. Comparison of RDBMS and NoSQL features ...........................................................................6                                                                                |
| List of Figures                                                                                |
| Fig. 1. Key-value database model .......................................................................................................3                                                                                |
| Fig. 2.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What guidance does NIST provide for CMMC Level 3?

[Assistant]
According to Assessing Enhanced Security Requirements for Controlled Unclassified Information:

lar A-130. Nothing in this publication should be taken to contradict the standards and guidelines made mandatory and binding on federal agencies by the Secretary of Commerce under statutory authority.
Nor should these guidelines be interpreted as altering or superseding the existing authorities of the Secretary of Commerce, OMB Director, or any other federal official. This publication may be used by nongovernmental organizations on a voluntary basis and is not subject to copyright in the United States. Attribution would, however, be appreciated by NIST. National Institute of Standards and Technology Special Publication 800-172A Natl. Inst. Stand. Technol. Spec. Publ. 800-172A, 62 pages (March 2022)

CODEN: NSPUE2

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-172A

Certain  commercial  entities,  equipment,  or  materials  may  be  identified  in  this  document  to describe an experimental procedure or concept adequately. Such identification is not intended to imply recommendation or endorsement by NIST, nor is it intended to imply that the entities, materials, or equipment are necessarily the best available for the purpose. There may be references in this publication to other publications currently under development by  NIST  in  accordance  with  its  assigned  statutory  responsibilities. The  information  in  this publication, including concepts, practices, and methodologies, may be used by federal agencies even  before  the  completion  of  such  companion  publications. Thus,  until  each  publication  is completed,  current  requirements,  guidelines,  and  procedures,  where  they  exist,  remain operative. For planning and transition purposes, federal agencies may wish to closely follow the development of these new publications by NIST. Organizations are encouraged to review draft publications during the public comment periods and provide feedback to NIST.

Assessing Enhanced Security Requirements for Controlled Unclassified Information


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AC.L2-3.1.3 (NIST 3.1.3)?

[Assistant]
According to Data Integrity_ Detecting and Responding to Ransomware and Other Destructive Events:

3.1.3 Other Considerations

Because malware comes in many forms, it is imperative to have multiple layers of defense against it while also working to actively improve these defenses.

Data Integrity_ Detecting and Responding to Ransomware and Other Destructive Events


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for Planning?

[Assistant]
According to Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171:

There may be references in this publication to other publications currently under development by  NIST  in  accordance  with  its  assigned  statutory  responsibilities.  The  information  in  this publication, including concepts, practices, and methodologies, may be used by federal agencies even  before  the  completion  of  such  companion  publications.  Thus,  until  each  publication  is completed,  current  requirements,  guidelines,  and  procedures,  where  they  exist,  remain operative. For planning and transition purposes, federal agencies may wish to closely follow the development of these new publications by NIST.

The enhanced security requirements are organized into 14 families consistent with the families for basic and derived requirements. Each family contains the requirements related to the general security topic of the family. The families are closely aligned with the minimum security requirements for federal information and information systems in [FIPS 200]. The security requirements for contingency planning , system and services acquisition , and planning are not included within the scope of this publication due to the tailoring criteria in [SP 800-171]. Table 1 lists the security requirement families addressed in this publication. 17

- 3.11.4e  Document or reference in the system security plan the security solution selected, the rationale for the security solution, and the risk determination.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Risk Assessment?

[Assistant]
According to Guide for Developing Security Plans for Federal Information Systems:

ormation system, and that the threat and vulnerability identification and initial risk determination are identified and documented in the system security plan, risk assessment, or equivalent document.
The results of a security certification are used to reassess the risks, develop the plan of action and milestones (POA&Ms) which are required to track remedial actions, and update the system security plan, thus providing the factual basis for an authorizing official to render a security

Before the system security plan can be developed, the information system and the information resident within that system must be categorized based on a FIPS 199 impact analysis. Then a determination can be made as to which systems in the inventory can be logically grouped into major applications or general support systems. The FIPS 199 impact levels must be considered when the system boundaries are drawn and when selecting the initial set of security controls (i.e., control baseline). The baseline security controls can then be tailored based on an assessment of risk and local conditions including organization-specific security requirements, specific threat information, costbenefit analyses, the availability of compensating controls, or special circumstances. Common security controls, which is one of the tailoring considerations, must be identified prior to system security plan preparation in order to identity those controls covered at the agency level, which are not system-specific. These common security controls can then be incorporated into the system security plan by reference.

Guide for Developing Security Plans for Federal Information Systems


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Awareness and Training?

[Assistant]
According to Guide to a Secure Enterprise Network Landscape:

- Unified threat management (or UTMs): UTM devices combine many of the most critical security functions - firewall, IPS, VPN concentrator, gateway antivirus, content filtering, and WAN load balancing - into a single device, usually with a unified management console. - Next-generation firewall (NGFW): The distinguishing feature of NGFW is application data awareness. It can look at data not only at layers 3 and 4 of an Open Systems Interconnection (OSI) stack but also at layer 7 - the application level. Its capabilities extend beyond packet filtering and stateful inspection. There are multiple deployment options available for NGFWs, such as an appliance in the data center, as a software running in a VM in a cloud, or as a cloud service (FWaaS). Some capabilities of NGFW include [9]:
- a. Deep Packet Inspection (DPI)
- b. TLS decryption and inspection of packet payload
- c. Intrusion prevention system (IPS) feature
- Web application and API protection (WAAP): This is a comprehensive security approach and an enhancement over WAF. WAF is an integral component for API security, BOT (abbreviation for Robot) defense, and DDOS protection. - a. These can be offered as a product suite or as a cloud-based service [10][11]. - b. Secure web gateway (SWGs): SWGs are appliances utilized for policy-based access to and control of cloud-based applications as well as governance of access to the open web for enterprise users in ubiquitous locations (e.g., headquarters, branch offices, home, remote locations). An SWG is fundamentally a web filter that protects outbound user traffic through HTTP or Hypertext Transfer Protocol Secure (HTTPS) inspection [12]. It also protects user endpoints from web-based threats that can occur when users click on links to malicious websites or to websites infected with malware. They centralize control, visibility, and reporting across many locations and types of users. They are not a replacement for WAFs,

- a.

Guide to a Secure Enterprise Network Landscape


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What guidance does NIST provide for CMMC Level 3?

[Assistant]
According to Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171:

## NIST Special Publication 800-172

## Enhanced Security Requirements for Protecting Controlled Unclassified Information

A Supplement to NIST Special Publication 800-171

RON ROSS VICTORIA PILLITTERI GARY GUISSANIE RYAN WAGNER RICHARD GRAUBART

DEB BODEAU

This publication is available free of charge from:

https://doi.org/10.6028/NIST.SP.800-172

<!-- image -->

## NIST Special Publication 800-172

## Enhanced Security Requirements for Protecting Controlled Unclassified Information

A Supplement to NIST Special Publication 800-171

## RON ROSS VICTORIA PILLITTERI

Computer Security Division

National Institute of Standards and Technology

## GARY GUISSANIE RYAN WAGNER

Institute for Defense Analyses

RICHARD GRAUBART DEB BODEAU

The MITRE Corporation

This publication is available free of charge from:

https://doi.org/10.6028/NIST.SP.800-172

## February 2021

<!-- image -->

U.S. Department of Commerce Wynn Coggins, Acting Secretary

National Institute of Standards and Technology James K. Olthoff, Performing the Non-Exclusive Functions and Duties of the Under Secretary of Commerce for Standards and Technology & Director, National Institute of Standards and Technology

\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

## Authority

This publication has been developed by NIST to further its statutory responsibilities under the Federal Information Security Modernization Act (FISMA), 44 U.S.C. § 3551 et seq. , Public Law (P.L.) 113-283. NIST is responsible for developing information security standards and guidelines, including minimum requirements for federal information systems, but such standards and guidelines shall not apply to national security systems without the express approval of the appropriate federal officials exercising policy authority over such systems.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Zero Trust Architecture provide? (Part 6)

[Assistant]
. Entre ellas se encuentran Greg Holden, director del proyecto ZTA del Consejo Federal de CIO; Alper Kerman, director del proyecto ZTA del NIST/Centro Nacional de Ciberseguridad; y Douglas Montgomery.
En la traducción, un especial reconocimiento a las personas que colaboraron de alguna u otra forma con  la  gestión,  redacción,  terminología  específica  y  compaginación:  Fabien  Spychiger,  CEO Dreamlab Technologies Chile; Javier Toro Rodríguez, Cybersecurity Service Manager, Dreamlab Tecnologies  Chile;  Stéphane  Bürgi,  Senior  Technical  Writer  Dreamlab  Technologies  Chile  y Celeste Gauna, Cyberintelligence Analyst Dreamlab Technologies Chile. ## Audiencia

Este documento pretende describir la confianza cero para los arquitectos de seguridad empresarial. Se intenta ayudar a la comprensión de la confianza cero para los sistemas civiles no clasificados y proporcionar una hoja de ruta para migrar y desplegar conceptos de seguridad de confianza cero a un entorno empresarial. Los responsables de ciberseguridad de las agencias, los administradores de red y los directivos también pueden obtener información sobre la confianza cero y la ZTA a partir de este documento. Esta guía no pretende ser un plan de despliegue único para la ZTA, ya que cada empresa tendrá sus propios casos de uso y activos de datos que requieran protección. Si se  parte  de  un  conocimiento  sólido del  negocio y los  datos  de la  organización,  se  obtendrá un enfoque sólido de la confianza cero. ## Información sobre marcas registradas

Todas las marcas registradas o comerciales pertenecen a sus respectivas organizaciones. ## Aviso de divulgación de patentes

AVISO: el laboratorio de tecnologías de la información (ITL) ha solicitado que los titulares de registros de patentes cuyo uso pueda ser necesario para el cumplimiento de las orientaciones o requisitos de esta publicación comuniquen dichos registros de patentes al ITL.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for System and Information Integrity?

[Assistant]
According to Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171:

This publication is a supplement to NIST Special Publication 800-171 [SP 800-171]. It contains recommendations  for  enhanced  security  requirements  to  provide  additional  protection  for Controlled Unclassified Information (CUI) in nonfederal systems and organizations when such information is  associated  with critical  programs  or  high  value  assets. The  enhanced  security requirements are designed to respond to the advanced persistent threat (APT) and supplement the basic and derived security requirements in [SP 800-171]. While the security requirements in [SP 800-171] focus primarily on confidentiality protection, the enhanced security requirements in this publication address confidentiality, integrity, and availability protection. The enhanced security requirements are implemented in addition to the basic and derived requirements since those requirements are not designed to address the APT. The enhanced security requirements apply to those components of nonfederal systems that process, store, or transmit CUI or that provide protection for such components. In addition to protecting CUI from unauthorized disclosure, the enhanced security requirements have been designed to protect the integrity and availability of CUI. This is achieved by promoting penetration-resistant architectures, damage-limiting operations, and designs to help achieve cyber resiliency and survivability. | CHAPTERONE INTRODUCTION...................................................................................................... | CHAPTERONE INTRODUCTION......................................................................................................


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What guidance does Federal Cybersecurity Role-Based Training Approaches, Successes, and Challenges provide?

[Assistant] <!-- image --> <!-- image --> ## NIST Special Publication (SP) 1288GLYPH<c=2,font=/BAAAAA+HKGrotesk-SemiBold> FEDERAL CYBERSECURITY ROLE-BASEDGLYPH<c=2,font=/BAAAAA+HKGrotesk-SemiBold> TRAINING APPROACHES, SUCCESSES,GLYPH<c=2,font=/BAAAAA+HKGrotesk-SemiBold> AND CHALLENGESGLYPH<c=2,font=/BAAAAA+HKGrotesk-SemiBold> JulieGLYPH<c=2,font=/AAAAAA+HKGrotesk-Medium> Haney,GLYPH<c=2,font=/AAAAAA+HKGrotesk-Medium> JodyGLYPH<c=2,font=/AAAAAA+HKGrotesk-Medium> Jacobs,GLYPH<c=2,font=/AAAAAA+HKGrotesk-Medium> andGLYPH<c=2,font=/AAAAAA+HKGrotesk-Medium> SusanneGLYPH<c=2,font=/AAAAAA+HKGrotesk-Medium> FurmanGLYPH<c=2,font=/AAAAAA+HKGrotesk-Medium> ThisGLYPH<c=2,font=/AAAAAA+HKGrotesk-Medium> publicationGLYPH<c=2,font=/AAAAAA+HKGrotesk-Medium> isGLYPH<c=2,font=/AAAAAA+HKGrotesk-Medium> availableGLYPH<c=2,font=/AAAAAA+HKGrotesk-Medium> freeGLYPH<c=2,font=/AAAAAA+HKGrotesk-Medium> ofGLYPH<c=2,font=/AAAAAA+HKGrotesk-Medium> chargeGLYPH<c=2,font=/AAAAAA+HKGrotesk-Medium> from:GLYPH<c=2,font=/AAAAAA+HKGrotesk-Medium> https://doi.org/10.6028/NIST.SP.1288GLYPH<c=2,font=/AAAAAA+HKGrotesk-Medium> ## NIST Special Publication (SP) 1288GLYPH<c=2,font=/BAAAAA+HKGrotesk-SemiBold> FEDERAL CYBERSECURITY ROLE-BASEDGLYPH<c=2,font=/BAAAAA+HKGrotesk-SemiBold> TRAINING APPROACHES, SUCCESSES,GLYPH<c=2,font=/BAAAAA+HKGrotesk-SemiBold> AND CHALLENGESGLYPH<c=2,font=/BAAAAA+HKGrotesk-SemiBold> JulieGLYPH<c=2,font=/AAAAAA+HKGrotesk-Medium> Haney,GLYPH<c=2,font=/AAAAAA+HKGrotesk-Medium> JodyGLYPH<c=2,font=/AAAAAA+HKGrotesk-Medium> Jacobs,GLYPH<c=2,font=/AAAAAA+HKGrotesk-Medium> andGLYPH<c=2,font=/AAAAAA+HKGrotesk-Medium> SusanneGLYPH<c=2,font=/AAAAAA+HKGrotesk-Medium> FurmanGLYPH<c=2,font=/AAAAAA+HKGrotesk-Medium> InformationGLYPH<c=2,font=/CAAAAA+HKGrotesk-MediumItalic> AccessGLYPH<c=2,font=/CAAAAA+HKGrotesk-MediumItalic> DivisionGLYPH<c=2,font=/CAAAAA+HKGrotesk-MediumItalic> InformationGLYPH<c=2,font=/CAAAAA+HKGrotesk-MediumItalic> TechnologyGLYPH<c=2,font=/CAAAAA+HKGrotesk-MediumItalic> LaboratoryGLYPH<c=2,font=/CAAAAA+HKGrotesk-MediumItalic> NationalGLYPH<c=2,font=/CAAAAA+HKGrotesk-MediumItalic> InstituteGLYPH<c=2,font=/CAAAAA+HKGrotesk-MediumItalic> ofGLYPH<c=2,font=/CAAAAA+HKGrotesk-MediumItalic> StandardsGLYPH<c=2,font=/CAAAAA+HKGrotesk-MediumItalic> andGLYPH<c=2,font=/CAAAAA+HKGrotesk-MediumItalic> TechnologyGLYPH<c=2,font=/CAAAAA+HKGrotesk-MediumItalic> ThisGLYPH<c=2,font=/AAAAAA+HKGrotesk-Medium> publicationGLYPH<c=2,font=/AAAAAA+HKGrotesk-Medium> isGLYPH<c=2,font=/AAAAAA+HKGrotesk-Medium> availableGLYPH<c=2,font=/AAAAAA+HKGrotesk-Medium> freeGLYPH<c=2,font=/AAAAAA+HKGrotesk-Medium> ofGLYPH<c=2,font=/AAAAAA+HKGrotesk-Medium> chargeGLYPH<c=2,font=/AAAAAA+HKGrotesk-Medium> from:GLYPH<c=2,font=/AAAAAA+HKGrotesk-Medium> https://doi.org/10.6028/NIST.SP.1288GLYPH<c=2,font=/AAAAAA+HKGrotesk-Medium> JANUARYGLYPH<c=2,font=/BAAAAA+HKGrotesk-SemiBold> 2023GLYPH<c=2,font=/BAAAAA+HKGrotesk-SemiBold> <!-- image --> U.S.GLYPH<c=2,font=/AAAAAA+HKGrotesk-Medium> DepartmentGLYPH<c=2,font=/AAAAAA+HKGrotesk-Medium> ofGLYPH<c=2,font=/AAAAAA+HKGrotesk-Medium> CommerceGLYPH<c=2,font=/AAAAAA+HKGrotesk-Medium> GinaGLYPH<c=2,font=/AAAAAA+HKGrotesk-Medium> M.GLYPH<c=2,font=/AAAAAA+HKGrotesk-Medium> Raimondo,GLYPH<c=2,font=/AAAAAA+HKGrotesk-Medium> SecretaryGLYPH<c=2,font=/AAAAAA+HKGrotesk-Medium> NationalGLYPH<c=2,font=/AAAAAA+HKGrotesk-Medium> InstituteGLYPH<c=2,font=/AAAAAA+HKGrotesk-Medium> ofGLYPH<c=2,font=/AAAAAA+HKGrotesk-Medium> StandardsGLYPH<c=2,font=/AAAAAA+HKGrotesk-Medium> andGLYPH<c=2,font=/AAAAAA+HKGrotesk-Medium> TechnologyGLYPH<c=2,font=/AAAAAA+HKGrotesk-Medium> LaurieGLYPH<c=2,font=/AAAAAA+HKGrotesk-Medium> E.GLYPH<c=2,font=/AAAAAA+HKGrotesk-Medium> Locascio,GLYPH<c=2,font=/AAAAAA+HKGrotesk-Medium> NISTGLYPH<c=2,font=/AAAAAA+HKGrotesk-Medium> DirectorGLYPH<c=2,font=/AAAAAA+HKGrotesk-Medium> andGLYPH<c=2,font=/AAAAAA+HKGrotesk-Medium> UnderGLYPH<c=2,font=/AAAAAA+HKGrotesk-Medium> SecretaryGLYPH<c=2,font=/AAAAAA+HKGrotesk-Medium> ofGLYPH<c=2,font=/AAAAAA+HKGrotesk-Medium> CommerceGLYPH<c=2,font=/AAAAAA+HKGrotesk-Medium> forGLYPH<c=2,font=/AAAAAA+HKGrotesk-Medium> StandardsGLYPH<c=2,font=/AAAAAA+HKGrotesk-Medium> andGLYPH<c=2,font=/AAAAAA+HKGrotesk-Medium> TechnologyGLYPH<c=2,font=/AAAAAA+HKGrotesk-Medium> ## DISCLAIMERGLYPH<c=2,font=/EAAAAA+HKGrotesk-Bold> Certain commercial entities, equipment, or materials may be identified in this document in order to describe an experimental procedure or concept adequately.

Federal Cybersecurity Role-Based Training Approaches, Successes, and Challenges


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Physical Protection?

[Assistant]
According to Machine Learning for Access Control Policy Verification:

The  Information  Technology  Laboratory  (ITL)  at  the  National  Institute  of  Standards  and Technology  (NIST)  promotes  the  U.S.  economy  and  public  welfare  by  providing  technical leadership  for  the  Nation's  measurement  and  standards  infrastructure.  ITL  develops  tests,  test methods, reference data, proof of concept implementations, and technical analyses to advance the development  and  productive  use  of  information  technology.  ITL's  responsibilities  include  the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in federal information systems.

Machine Learning for Access Control Policy Verification


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Media Protection?

[Assistant]
According to Digital Identity Guidelines_ Authentication and Authenticator Management:

Ensure the secure disposal of
equipment that contains device-
based authentication keys.

Digital Identity Guidelines_ Authentication and Authenticator Management


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What guidance does Protecting Controlled Unclassified Information (CUI)_ NIST Special Publication 800-171, Revision 3. Small Business Primer provide?

[Assistant]
<!-- image -->

<!-- image -->

Howard Lutnick, Secretary of Commerce

<!-- image -->

Protecting Controlled Unclassified Information (CUI): NIST Special Publication 800-171, Revision 3 Small Business Primer

## Purpose of this Primer

This guide provides small businesses with an overview of NIST Special Publication (SP) 800-171 Revision 3, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations . The following pages contain:

- An overview of foundational components of SP 800-171
- A list of frequently asked questions and their answers
- Tips for getting started
- Related resources

## What is Controlled Unclassified Information (CUI)?*

CUI is information the government creates or possesses, or that an entity creates or possesses on behalf of the government, that law, regulation, or governmentwide policy requires you to take technical and operational steps to protect. Systems that process, store, and transmit CUI often support government programs involving sensitive critical assets. As part of a contractual agreement with the federal government, or possibly with other organizations like municipal governments, prime contractors, universities, etc., you will likely be required to demonstrate you are taking adequate measures to protect CUI.

Protecting Controlled Unclassified Information (CUI)_ NIST Special Publication 800-171, Revision 3. Small Business Primer


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What guidance does Guidelines for Media Sanitization provide?

[Assistant]
<!-- image -->

## NIST Special Publication 800 NIST SP 800-88r2

## Guidelines for Media Sanitization

Ramaswamy Chandramouli

Eric A. Hibbard

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-88r2

<!-- image -->

## NIST Special Publication 800 NIST SP 800-88r2

## Guidelines for Media Sanitization

Ramaswamy Chandramouli Computer Security Division Information Technology Laboratory

Eric A. Hibbard Samsung Semiconductor, Inc. This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-88r2

September 2025

<!-- image -->

U.S. Department of Commerce Howard Lutnick, Secretary

National Institute of Standards and Technology

Craig Burkhardt, Acting Under Secretary of Commerce for Standards and Technology and Acting NIST Director

Certain equipment, instruments, software, or materials, commercial or non-commercial, are identified in this paper in order to specify the experimental procedure adequately. Such identification does not imply recommendation or endorsement of any product or service by NIST, nor does it imply that the materials or equipment identified are necessarily the best available for the purpose. There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may be used by federal agencies even before the completion of such companion publications. Thus, until each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning and transition purposes, federal agencies may wish to closely follow the development of these new publications by NIST. Organizations are encouraged to review all draft publications during public comment periods and provide feedback to NIST.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AT.L2-3.2.1 (NIST 3.2.1)?

[Assistant]
According to Audit and Evaluation of Computer Security:

3.2.1

Physical Security, Site, Facility DP Instal-
lation

Facility and installation access control are the
Only personnel whose

first two levels of protection.

Audit and Evaluation of Computer Security


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Configuration Management?

[Assistant]
According to Federal Cybersecurity Awareness Programs_ A Mixed Methods Research Study:

Unfortunately, security awareness efforts may face significant challenges. Industry surveys and research studies have discovered that security awareness programs in organizations of all sizes may be underfunded and often rely on part-time security awareness professionals who may lack sufficient background, skills, tools, or resources necessary for managing an effective program [SANS][WOELK][BADA][STEWART]. Furthermore, employees may view training as boring and burdensome [BADA]. While mandates enforce a minimum baseline for security awareness, when viewed simply as a 'check-the-box' exercise, organizations may begin to measure program success simply in terms of compliance metrics, like training completion rates. However, these metrics reveal little about the effectiveness of the training in changing and sustaining workforce attitudes and behaviors [FERTIG].

Federal Cybersecurity Awareness Programs_ A Mixed Methods Research Study


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AC.L2-3.1.24 (NIST 3.1.24)?

[Assistant]
According to Protecting Information and System Integrity in Industrial Control System Environments_ Cybersecurity for the Manufacturing Sector:

3.1.24
-  PI Interface for SNMP ReadOnly version 1.

Protecting Information and System Integrity in Industrial Control System Environments_ Cybersecurity for the Manufacturing Sector


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Supply Chain Risk Management?

[Assistant]
According to Risk Management Framework for Information Systems and Organizations_ A System Life Cycle Approach for Security and Privacy:

This publication contains comprehensive updates to the Risk Management Framework . The updates include an alignment with the constructs in the NIST Cybersecurity Framework; the integration of privacy risk management processes; an alignment with system life cycle security engineering processes; and the incorporation of supply chain  risk  management  processes. Organizations  can use the frameworks and processes in a complementary manner within the RMF to effectively manage security and  privacy risks to organizational  operations  and assets, individuals, other organizations, and the Nation. Revision 2 includes a set of organization-wide RMF tasks that are designed to prepare information system owners to conduct system-level risk management activities. The intent  is  to  increase  the  effectiveness,  efficiency,  and cost-effectiveness  of  the  RMF  by  establishing  a  closer connection to the organization's missions and business functions  and  improving  the  communications  among senior leaders, managers, and operational personnel. assess; authorization to operate; authorization to use; authorizing official; categorize; common control; common control authorization; common control provider; continuous monitoring; control assessor; control baseline; cybersecurity framework profile; hybrid control; information owner or steward; information security; monitor; ongoing authorization; plan of action and milestones; privacy; privacy assessment report; privacy control; privacy plan; privacy risk; risk assessment; risk executive function; risk management; risk management framework; security; security assessment report; security control; security engineering; security plan; security risk; senior agency information security officer; senior agency official for privacy; supply chain risk management; system development life cycle; system owner; system privacy officer; system security officer; system-specific control.

Risk Management Framework for Information Systems and Organizations_ A System Life Cycle Approach for Security and Privacy


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Communications Protection?

[Assistant]
According to Recommendation for Pair-Wise Key-Establishment Using Integer Factorization Cryptography:

## Recommendation for Pair-Wise Key Establishment Using Integer Factorization Cryptography

## Recommendation for Pair-Wise Key Establishment Using Integer Factorization Cryptography

This Recommendation specifies key-establishment schemes using integer factorization cryptography (in particular, RSA). Both key-agreement and key transport schemes are specified for pairs of entities, and methods for key confirmation are included to provide assurance that both parties share the same keying material. In addition, the security properties associated with each scheme are provided.

Recommendation for Pair-Wise Key-Establishment Using Integer Factorization Cryptography


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Cryptographic Module Validation Program (CMVP) Security Policy Requirements_ CMVP Validation Authority Updates to ISO_IEC 24759 and ISO_IEC 19790 Anne provide? (Part 8)

[Assistant]
. The requirements statements are presented as originally written in ISO/IEC 19790 Annex B and ISO/IEC 24759. These often include acronyms and abbreviations spelled out earlier within those documents.
When the first use occurs within this document, the acronym or abbreviation will be spelled out within brackets immediately following the occurrence. These statements also include the British English standard spellings for the words 'zeroize' and 'authorize' as 'zeroise' and 'authorise'. ## Modifications

Modifications to ISO/IEC 24759 Section 6.14, Cryptographic module security policy , will follow a similar format as ISO/IEC 24759. For additions to test requirements, new Test Evidence (TE) or Vendor Evidence (VE) will be listed by increasing the 'sequence\_number.' Modifications can include a combination of additions using underline and deletions using strikethrough. If no changes are required, the paragraph will indicate 'No change.'

ISO/IEC 19790 Annex B includes security policy requirements in bulleted form but does not include ways to format the required information. Modifications are addressed by adding formatting guidance (e.g., tables, images), adding underlined text, or using strikethrough for deletion. If no changes are required, the paragraph will indicate 'No change.' Additional guidance may also be included to address requirements presented in NIST Special Publication (SP) 800-140, SP 800-140A, SP 800-140C, SP 800-140D, SP 800-140E, and SP 800-140F. 1

1 More information about the SP 800-140 subseries is available at https://csrc.nist.gov/projects/cmvp/sp800-140-series-info. ## Security Requirements

## Changes to ISO/IEC 24759 Section 6.14 and ISO/IEC 19790 Annex B Requirements

All requirements from ISO/IEC 24759 Section 6.14 and ISO/IEC 19790 Annex B apply and are required in the security policy as applicable. ISO/IEC 19790 Annex B uses the same section naming convention as ISO/IEC 19790 Section 7 -Security requirements .

Cryptographic Module Validation Program (CMVP) Security Policy Requirements_ CMVP Validation Authority Updates to ISO_IEC 24759 and ISO_IEC 19790 Anne


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Proceedings of the Cybersecurity in Cyber-Physical Systems Workshop, April 23-24, 2012 provide? (Part 2)

[Assistant]
ion systems, but such standards and guidelines shall not apply to national security systems without the express approval of appropriate Federal officials exercising policy authority over such systems.
This guideline is consistent with the requirements of the Office of Management and Budget (OMB) Circular A-130, Section 8b(3), Securing Agency Information Systems , as analyzed in Circular A-130, Appendix IV: Analysis of Key Sections . Supplemental information is provided in Circular A-130, Appendix III, Security of Federal Automated Information Resources . Nothing in this publication should be taken to contradict the standards and guidelines made mandatory and binding on Federal agencies by the Secretary of Commerce under statutory authority. Nor should these guidelines be interpreted as altering or superseding the existing authorities of the Secretary of Commerce, Director of the OMB, or any other Federal official. This publication may be used by nongovernmental organizations on a voluntary basis and is not subject to copyright in the United States. Attribution would, however, be appreciated by NIST. ## National Institute of Standards and Technology Interagency Report 7916 276 pages (February 2013)

Certain commercial entities, equipment, or materials may be identified in this document in order to describe an experimental procedure or concept adequately. Such identification is not intended to imply recommendation or endorsement by NIST, nor is it intended to imply that the entities, materials, or equipment are necessarily the best available for the purpose. There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may be used by Federal agencies even before the completion of such companion publications.

Proceedings of the Cybersecurity in Cyber-Physical Systems Workshop, April 23-24, 2012


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Awareness and Training?

[Assistant]
According to Recommendation for Pair-Wise Key-Establishment Schemes Using Discrete Logarithm Cryptography:

When the domain parameters ( p, q, g {, SEED, counter }) conform to a FIPS 186-type FFC parameter-size set (see Table 1), private keys are generated in the interval [1, q - 1], and the corresponding public keys are in the interval [2, p - 2].  For the key-pair generation methods in Sections 5.6.1.1.3 and 5.6.1.1.4, the value used for the input parameter N shall be len( q ), i.e., the bit length of the domain parameter q , and the value used for the input parameter s shall be 112, which is the security strength that can be supported by the FIPS 186-type FFC parameter-size  set  that  was  used  to  generate  the  domain  parameters  (see  Table  1).  The generated key pairs shall be used only for key-agreement purposes (see Section 6 for the approved key-agreement  schemes),  with  the  possible  exception  discussed  in  item  5  of Section 5.6.3.2.

d. See Section 5.6.2.2.3.2.

Recipients not acting in the role of a binding authority shall obtain this assurance - either through a trusted third party (see Section 5.6.2.2.3.1) or directly from the owner (i.e., the other party) (see Section 5.6.2.2.3.2) before using the derived keying material for purposes beyond those required during the key-agreement transaction itself. If the recipient chooses to obtain this assurance directly from the other party (i.e., the claimed owner of that public key), then to comply with this Recommendation, the recipient shall use one of the methods specified in Section 5.6.2.2.3.2.

Recommendation for Pair-Wise Key-Establishment Schemes Using Discrete Logarithm Cryptography


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Guidelines for the Use of PIV Credentials in Facility Access provide? (Part 7)

[Assistant]
800-116 with revision 2 of FIPS 201 (FIPS 201-2). For example, credential validation is now required (see Section 4.4). The CHUID authentication mechanism has been deprecated due to security concerns.
For this reason, this publication marks the authentication mechanism as deprecated to signify that it is not a viable authentication mechanism to deploy for physical access control system (PACS). The CHUID data element on the PIV Card, however, remains a mandatory element as the BIO(-A) and SYMCAK authentication mechanisms use the data element as a source for the card's expiration date. It also provides unique identifiers for PACS ACLs. The previous version of this document also included the combined VIS + CHUID authentication mechanism as an option to transitioning from Unrestricted to Controlled areas. VIS + CHUID, however, is not included in this version of the document since it provides 'LITTLE or NO' confidence in the identity of the cardholder. Other changes in this version of the guideline include the removal of the migration strategy as PACS implementation in the Federal Government have moved beyond the described strategy and are more advanced. The future topics (i.e., global identifier and secure biometric match on card) have been addressed in FIPS 201-2 and associated technical specification and thus have become part of this version of guidelines rather than topics for future considerations. Finally, a new Appendix C describes possible improvements to PKI authentication for fast contactless transaction at access points. Appendix I, Revision History, provides a list of changes. This document focuses on the use of PIV Cards to gain access to federal buildings and facilities. It does not address non-PIV credentials that may be issued to populations that do not fall under the scope of HSPD-12 but require access to federal facilities. ## Table of Contents

| 1.

Guidelines for the Use of PIV Credentials in Facility Access


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Status Report on the First Round of the Additional Digital Signature Schemes for the NIST Post-Quantum Cryptography Standardization Process provide? (Part 4)

[Assistant]
mes. This report de-
scribes the evaluation criteria and selection process of the First Round of the Additional
Digital Signatures for the NIST Post-Quantum Cryptography (PQC) Standardization Process.
Based on public feedback and internal reviews of the first-round candidates, NIST selected
14 candidate algorithms to move forward to the second round of evaluation: CROSS, FAEST,
HAWK, LESS, MAYO, Mirath (merger of MIRA/MiRitH), MQOM, PERK, QR-UOV, RYDE, SDitH,
SNOVA, SQIsign, and UOV. Keywords

cryptography;  digital signatures;  post-quantum cryptography;  quantum-resistant;  quan-
tum safe. Reports on Computer Systems Technology

The  Information  Technology  Laboratory  (ITL)  at  the  National  Institute  of  Standards  and
Technology (NIST) promotes the U.S. economy and public welfare by providing technical
leadership for the Nation’s measurement and standards infrastructure. ITL develops tests,
test methods, reference data, proof of concept implementations, and technical analyses
to advance the development and productive use of information technology. ITL’s respon-
sibilities include the development of management, administrative, technical, and physical
standards and guidelines for the cost-effective security and privacy of other than national
security-related information in federal information systems. i

NIST IR 8528
October 2024

Additional Digital Signatures
First Round Status Report

Contents

1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1.1. Purpose and Organization of This Document

. . . . . . . . . . . . . . . . . . 2. Evaluation Criteria and the Selection Process . . . . . . . . . . . . . . . . . . . . . . 2.1. Acceptance of the First-Round Candidates . . . . . . . . . . . . . . . . . . . . 2.2. 2.3. Evaluation Criteria . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2.4.

Status Report on the First Round of the Additional Digital Signature Schemes for the NIST Post-Quantum Cryptography Standardization Process


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for Physical Protection?

[Assistant]
According to Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171:

The National Institute of Standards and Technology (NIST) Information Technology Laboratory (ITL) promotes the U.S. economy and public welfare by providing technical leadership for the Nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology (IT). ITL's responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the costeffective security of other than national security-related information in federal information systems. The Special Publication 800-series reports on ITL's research, guidelines, and outreach efforts in information systems security and privacy and its collaborative activities with industry, government, and academic organizations. | CHAPTERONE INTRODUCTION...................................................................................................... | CHAPTERONE INTRODUCTION...................................................................................................... |
|--------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------|
| 1.1 PURPOSEANDAPPLICABILITY                                                                                | ...................................................................................................

Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for Personnel Security?

[Assistant]
According to Protecting Controlled Unclassified Information (CUI)_ NIST Special Publication 800-171, Revision 3. Small Business Primer:

| Access Control                    | Maintenance         | Security Assessment and Monitoring   |
|-----------------------------------|---------------------|--------------------------------------|
| Awareness and Training            | Media Protection    | System and Communications Protection |
| Audit and Accountability          | Personnel Security  | System and Information Integrity     |
| Configuration Management          | Physical Protection | Planning                             |
| Identification and Authentication | Risk Assessment     | System and Services Acquisition      |
| Incident Response                 |                     | Supply Chain Risk Management         |

Description: Ensuring personnel are made aware of the security risks associated with their activities and of the applicable laws, directives, policies, standards, regulations, or procedures related to the security of organizational systems; and ensuring that organizational personnel are adequately trained to carry out their assigned information security-related duties and responsibilities.

Regularly provide basic and advanced security literacy training to new and existing staff. Customize the content to make it relevant -based on the systems that personnel have authorized access to, contextualized to the work environments of personnel (e.g., telework, shop floor), and tailored to the specific roles of personnel. The content should include:


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Identification and Authentication?

[Assistant]
According to Secure Software Development Practices for Generative AI and Dual-Use Foundation Models_ An SSDF Community Profile:

| Practice | Task | Priority | Recommendations [R], Considerations [C], and Notes [N] Specific to AI Model Development | Informative References | |---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------| | security requirements and risks during software design (secure by design) is key for improving software security and also helps improve development efficiency.

Secure Software Development Practices for Generative AI and Dual-Use Foundation Models_ An SSDF Community Profile


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AT.L2-3.2.2 (NIST 3.2.2)?

[Assistant]
According to Recommendations for Federal Vulnerability Disclosure Guidelines:

3.2.2. 3.2.2.

Recommendations for Federal Vulnerability Disclosure Guidelines


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for Incident Response?

[Assistant]
According to Assessing Enhanced Security Requirements for Controlled Unclassified Information:

| CHAPTERONE INTRODUCTION...................................................................................................... | CHAPTERONE INTRODUCTION...................................................................................................... | 1   |
|-----------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------|-----|
| 1.1                                                                                | PURPOSEANDAPPLICABILITY............................................................................................................. 1        | 2   |
| 1.2                                                                                | TARGET AUDIENCE.............................................................................................................................. |     |
| 1.3                                                                                | ORGANIZATIONOF THIS SPECIAL PUBLICATION................................................................................. | 2   |
| CHAPTERTWO THE FUNDAMENTALS............................................................................................ | CHAPTERTWO THE FUNDAMENTALS............................................................................................ | 3   |
| 2.1                                                                                | ASSESSMENT PROCEDURES................................................................................................................

Assessing Enhanced Security Requirements for Controlled Unclassified Information


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for Physical Protection?

[Assistant]
According to Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171:

| ...................................................................................................
3                                            |
| 1.2 TARGET AUDIENCE                                                                                | .................................................................................................................. 4                             |
| 1.3 ORGANIZATIONOF THIS SPECIAL PUBLICATION                                                                                | .......................................................................... 4                                                                     |
| CHAPTERTWO THE FUNDAMENTALS............................................................................................ 5                        | CHAPTERTWO THE FUNDAMENTALS............................................................................................ 5                        |
| 2.1 DEVELOPMENTAPPROACH ...................................................................................................... | 5                                                                                |
| 2.2 ORGANIZATIONANDSTRUCTURE                                                                                | ............................................................................................. 7                                                  |
| 2.3 FLEXIBLE APPLICATION                                                                                | .............................................................................................................


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Supply Chain Risk Management?

[Assistant]
According to Summary of NIST SP 800-53, Revision 4_ Security and Privacy Controls for Federal Information Systems and Organizations:

SP 800-53 Revision 4 has been updated to reflect the evolving technology and threat space. Example areas include issues particular to mobile and cloud computing; insider threats; applications security; supply chain risks; advanced persistent threat; and trustworthiness, assurance, and resilience of information systems. The revision also contains a new appendix of privacy controls, and related implementation guidance (Appendix J), based on the Fair Information Practice Principles (FIPPs), a widely accepted framework of defining principles to be used in the evaluation and consideration of systems, processes, or programs that affect individual privacy.

Summary of NIST SP 800-53, Revision 4_ Security and Privacy Controls for Federal Information Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Security Assessment?

[Assistant]
According to Contingency Planning Guide for Federal Information Systems:

| | Introduction ....................................................................................................1 | | |-----------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------| | 1.1 | | Purpose.......................................................................................................................1 | | | 1.2 | | Scope..........................................................................................................................2 | | | 1.3 | | Audience.....................................................................................................................3 | | | 1.4 | Document | Structure....................................................................................................4 | | | Chapter 2.

Contingency Planning Guide for Federal Information Systems


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Communications Protection?

[Assistant]
According to Addressing Visibility Challenges with TLS 1.3 within the Enterprise_ High-Level Document:

|                                                                                | 5.4 Specific Details ........................................................................................................... | 5.4 Specific Details ........................................................................................................... | 5.4 Specific Details ...........................................................................................................

Addressing Visibility Challenges with TLS 1.3 within the Enterprise_ High-Level Document


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Audit and Accountability?

[Assistant]
According to Recommendation for Pair-Wise Key-Establishment Schemes Using Discrete Logarithm Cryptography:

| Incorporating Key Confirmation into a C(0e, 2s) Scheme ..............................
107 6.3.3.1 C(0e, 2s) Scheme with Unilateral Key Confirmation Provided by Party             |
|                                                                                | 6.3.3.2                                                                                | C(0e, 2s) Scheme with Unilateral Key Confirmation Provided by Party V to Party U...................................................................................... 109        |
|                                                                                | 6.3.3.3                                                                                | C(0e, 2s) Scheme with Bilateral Key Confirmation ......................... 110                                                                                |
| 7. Rationale for Selecting a Specific Scheme........................................................ 112                                                                          | 7. Rationale for Selecting a Specific Scheme........................................................ 112                                                                          | 7. Rationale for Selecting a Specific Scheme........................................................


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Analyzing Collusion Threats in the Semiconductor Supply Chain provide? (Part 4)

[Assistant]
nterfeiting, Trojan insertion, and reverse engineering. In order to counteract these security risks, many types of solutions have been proposed, ranging from design to test phases of the supply chain.
Numerous government-funded research programs have been established to develop countermeasures, such as the Defense Advanced Research Projects Agency (DARPA) Automated Implementation of Secure Silicon (AISS) program [1], the DARPA Structured Array Hardware for Automatically Realized Applications (SAHARA) program [2], the Naval Surface Warfare Center (NSWC) Crane State-of-the-Art Heterogeneous Integration Prototype (SHIP) program [3], the Air Force Research Laboratory (AFRL) Locked Electronics for Assured Design (LEAD) program [4], and the AFRL Aether Spy program [5], just to name a few, as addressing these security issues is crucial to national security. Dealing with such serious challenges necessitates directing security countermeasure initiatives in stages where the severity of the threat can be best diminished. Supply chain threat analysis is an essential component of security research. The goals of such analysis are to 1) identify the different threats and related vulnerabilities associated with integrated circuits, 2) analyze how severe the threats become at different stages of the supply chain, and 3) quantify the severity of threats due to collusion among adversaries. The first thing to acknowledge before beginning any such analysis is that, while there are many threats and related vulnerabilities, not all of them can be exploited at every stage in the semiconductor supply chain. Threats vary in severity depending on the stage of supply chain. For example, the risk of side-channel analysis is more common in chip use scenarios, whereas the risk of a hardware Trojan is more common in the early stages of design and manufacturing, as shown in Fig. 1. Fig. 1.

Analyzing Collusion Threats in the Semiconductor Supply Chain


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Maintenance?

[Assistant]
According to Audit and Evaluation of Computer Security:

SYSTEMS DEVELOPMENT AND MAINTENANCE PRACTICES
6.1
6.2
6.3
6.4

Manual Checking
Control Totals
Test Data
Integrated Test Facility
Tagging
Extended Record Maintenance
Tracing
Mapping
Recompilation

1 . System Development and Maintenance Practices Audit
2. Application Review
3. Installation Security Review
U. Security Function (Data Base/Communication Environ-
ment) Review
5. Compromise Attempt.

Audit and Evaluation of Computer Security


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Security Assessment?

[Assistant]
According to Guide to Auditing for Controls and Security_ A System Development Life Cycle Approach:

Conducts research and provides measurements, data, standards, reference materials, quantitative understanding and other technical information fundamental to the processing, structure, properties and performance of materials; addresses the scientific basis for new advanced materials technologies; plans research around cross-cutting scientific themes such as nondestructive evaluation and phase diagram development; oversees Bureau-wide technical programs in nuclear reactor radiation research and nondestructive evaluation; and broadly disseminates generic technical information resulting from its programs.

Guide to Auditing for Controls and Security_ A System Development Life Cycle Approach


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Information Integrity?

[Assistant]
According to Proceedings of the Cybersecurity in Cyber-Physical Systems Workshop, April 23-24, 2012:

Cryptographic techniques are potentially very useful to improve  the  security  and  privacy  properties  of  IMDs  through stronger authentication protocols and (confidentiality and integrity)  protected  communications  over  wireless  channels.  However,  since  IMDs  operate  in  very  constrained  environments (such  as  device  size,  cost,  and  power  availability,)  traditional cryptographic techniques and protocols may be inappropriate. More compatible cryptographic suites and protocols need to be devised for use on IMDs and applied in a very selective manner to optimize the security protection from these power intensive operations.  The  body  of  research  conducted  for  cryptography for  sensor  networks  are  directly  applicable  [8]  to  applying cryptographic techniques to IMDs.

## A. Equipment Control and Recipe Integrity

## B. Process Data Integrity


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for Configuration Management?

[Assistant]
According to Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171:

| CHAPTERONE INTRODUCTION...................................................................................................... | CHAPTERONE INTRODUCTION...................................................................................................... |
|--------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------|
| 1.1 PURPOSEANDAPPLICABILITY                                                                                | ................................................................................................... 3                                            |
| 1.2 TARGET AUDIENCE                                                                                | .................................................................................................................. 4                             |
| 1.3 ORGANIZATIONOF THIS SPECIAL PUBLICATION                                                                                | .......................................................................... 4                                                                     |
| CHAPTERTWO THE FUNDAMENTALS............................................................................................ 5                        | CHAPTERTWO THE FUNDAMENTALS............................................................................................ 5                        |
| 2.1 DEVELOPMENTAPPROACH ......................................................................................................


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AT.L2-3.2.11 (NIST 3.2.11)?

[Assistant]
According to Digital Identity Guidelines_ Authentication and Authenticator Management:

3.2.11. 3.2.11. 3.2.11.

Digital Identity Guidelines_ Authentication and Authenticator Management


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Configuration Management?

[Assistant]
According to Contingency Planning Guide for Federal Information Systems:

| Chapter 1.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Guidelines for the Use of PIV Credentials in Facility Access provide? (Part 10)

[Assistant]
.............................................................................11             |
| 4. | PIV Authentication Mechanisms in PACS Applications ................................................
12                                      |
| 4.1  | PIV Authentication Mechanisms.................................................................................12                            |
| 4.2  | Authentication Factors.................................................................................................12                   |
| 4.3  | Selection of PIV Authentication Factors.....................................................................14                              |
| 4.4  | Credential Validation...................................................................................................19                  |
| 5. | PACS Use Cases.................................................................................................................. 21         |
| 5.1  | Single-Tenant Facility .................................................................................................22                  |
| 5.2  | Federal Multi-Tenant Facility......................................................................................22                       |
| 5.3  | Mixed-Multi-Tenant Facility.......................................................................................23                        |
| 5.4  | Single-Tenant Campus ................................................................................................24                     |
|      | 5.4.1 FSL I or II Campus......................................................................................... 24                        |
|      | 5.4.2 FSL III Campus...............................................................................................


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Addressing Visibility Challenges with TLS 1.3 within the Enterprise_ High-Level Document provide? (Part 4)

[Assistant]
forma�on they need to implement a similar approach. The documents in this series describe example implementa�ons of cybersecurity prac�ces that businesses and other organiza�ons may voluntarily adopt.
These documents do not describe regula�ons or mandatory prac�ces, nor do they carry statutory authority. ## ABSTRACT

The Transport Layer Security (TLS) protocol is widely deployed to secure network traffic. TLS 1.3 protects the contents of its previous TLS communica�ons even if a TLS -enabled server is compromised. This is known as forward secrecy. The approach used to achieve forward secrecy in TLS 1.3 may interfere with passive decryp�on techniques that enterprises rely on to have visibility into their TLS 1.2 traffic. Enterprises' authorized network security staff rely on that visibility to protect its data and syste ms with cri�cal cybersecurity controls to meet opera�onal needs and legal requirements. Adop�on of the TLS 1.3 protocol can disrupt current approaches to observing and monitoring internal network communica�ons within an enterprise. The NCCoE, in collabora�on with technology providers and enterprise customers, ini�ated a project to demonstrate op�ons for maintaining visibility within the TLS 1.3 protocol using several standards-compliant builds that enterprises can use for real�m e and post-facto systems monitoring and analy�cs capabili�es. This publica�on contains demonstrated proofs of concept along with links to detailed technical informa�on online on NIST pages. This publica�on also includes links to mappings of TLS 1.3 visibility principles to commonly used security standards and guid elines. ## KEYWORDS

bounded lifetime; break and inspect; ephemeral; key management; middlebox; passive decryption; passive inspection; protocol; Transport Layer Security (TLS); visibility. ## ACKNOWLEDGMENTS

We are grateful to the following individuals for their generous contribu�ons of exper�se and �me.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Communications Protection?

[Assistant]
According to Federal Cybersecurity Awareness Programs_ A Mixed Methods Research Study:

□ Communications

24. Which of the following topics have been addressed by your security awareness program via training courses, events, or other communications in the past 1-2 years? Check all that apply.

□ Communications and marketing

Federal Cybersecurity Awareness Programs_ A Mixed Methods Research Study


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Planning?

[Assistant]
According to Security and Privacy Controls for Information Systems and Organizations:

There may be references in this publication to other publications currently under development by
NIST in accordance with its assigned statutory responsibilities. The information in this publication,
including concepts, practices, and methodologies may be used by federal agencies even before the
completion  of  such  companion  publications. Thus,  until  each  publication  is  completed,  current
requirements, guidelines,  and  procedures, where  they  exist,  remain  operative. For  planning  and
transition  purposes,  federal  agencies  may  wish  to  closely  follow  the  development  of  these  new
publications by NIST. CHAPTER ONE   INTRODUCTION ...................................................................................................... 1
1.1   PURPOSE AND APPLICABILITY ................................................................................................... 2
1.2   TARGET AUDIENCE .................................................................................................................. 3
1.3   ORGANIZATIONAL RESPONSIBILITIES......................................................................................... 3
1.4   RELATIONSHIP TO OTHER PUBLICATIONS ................................................................................... 5
1.5   REVISIONS AND EXTENSIONS .................................................................................................... 5
1.6   PUBLICATION ORGANIZATION .................................................................................................. 5
CHAPTER TWO   THE FUNDAMENTALS ............................................................................................ 7
2.1   REQUIREMENTS AND CONTROLS .............................................................................................. 7
2.2   CONTROL STRUCTURE AND ORGANIZATION ..............................................................................

Security and Privacy Controls for Information Systems and Organizations