[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What guidance does Data Integrity_ Detecting and Responding to Ransomware and Other Destructive Events provide?

[Assistant]
## NIST SPECIAL PUBLICATION 1800-26

## Data Integrity:

## Detecting and Responding to Ransomware and Other Destructive Events

Includes Executive Summary (A); Approach, Architecture, and Security Characteristics (B); and How-To Guides (C)

Jennifer Cawthra Michael Ekstrom Lauren Lusty Julian Sexton John Sweetnam

FINAL

This publications is available free of charge from https://doi.org/10.6028/NIST.SP.1800-26. This publication is available free of charge from https://www.nccoe.nist.gov/projects/building-blocks/data-integrity/detect-respond. <!-- image -->

NIST SPECIAL PUBLICATION 1800-26

## Data Integrity: Detecting and Responding to Ransomware and Other Destructive Events

Includes Executive Summary (A); Approach, Architecture, and Security Characteristics (B); and How-To Guides (C)

Jennifer Cawthra National Cybersecurity Center of Excellence NIST

Michael Ekstrom Lauren Lusty Julian Sexton John Sweetnam The MITRE Corporation McLean, Virginia

FINAL

DECEMBER 2020

<!-- image -->

U.S. Department of Commerce Wilbur Ross, Secretary

National Institute of Standards and Technology Walter Copan, NIST Director and Undersecretary of Commerce for Standards and Technology

## NIST SPECIAL PUBLICATION 1800-26A

## Detecting and Responding to Ransomware and Other

## Data Integrity: Destructive Events

## Volume A:

Executive Summary

## Jennifer Cawthra

National Cybersecurity Center of Excellence NIST

Michael Ekstrom Lauren Lusty Julian Sexton John Sweetnam Anne Townsend

The MITRE Corporation McLean, Virginia

## December 2020

FINAL

This publications is available free of charge from https://doi.org/10.6028/NIST.SP.1800-26. This publication is available free of charge from https://www.nccoe.nist.gov/projects/building-blocks/data-integrity/detect-respond. <!-- image -->

## Executive Summary

The CIA triad represents the three pillars of information security: confidentiality, integrity, and availability, as follows.

Data Integrity_ Detecting and Responding to Ransomware and Other Destructive Events


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Access Control?

[Assistant]
According to Approaches and Challenges of Federal Cybersecurity Awareness Programs:

| EXECUTIVE SUMMARY......................................................................................................... iii             | EXECUTIVE SUMMARY......................................................................................................... iii                                                                           | EXECUTIVE SUMMARY......................................................................................................... iii   |
|--------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------|
| 1 INTRODUCTION................................................................................................................. | 1 INTRODUCTION................................................................................................................. | 1                                                                                |
| 2 REPORTING CONVENTIONS.......................................................................................... | 2 REPORTING CONVENTIONS.......................................................................................... | 2                                                                                |
| 3 SECURITY AWARENESS APPROACHES..................................................................... | 3 SECURITY AWARENESS APPROACHES.....................................................................

Approaches and Challenges of Federal Cybersecurity Awareness Programs


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Services Acquisition?

[Assistant]
According to Recommendations for Federal Vulnerability Disclosure Guidelines:

................................................................... | Executive Summary.................................................................................................................
|
|--------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------|
| U.S. Government Vulnerability Disclosure..................................................................... | 2                                                                                |                                                                                |
| Usage of Document Terminology................................................................................ | 5                                                                                |                                                                                |
| Federal Vulnerability Disclosure Coordination Body .................................................... | 6                                                                                |                                                                                |
| Preparation.................................................................................................................

Recommendations for Federal Vulnerability Disclosure Guidelines


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Communications Protection?

[Assistant]
According to Digital Identity Guidelines:

NFC (communications protocol)
Near-Field Communication

approved cryptography
An encryption algorithm, hash function, random bit generator, or similar technique that
is Federal Information Processing Standards (FIPS)-approved or NIST-recommended.
Approved algorithms and techniques are either specified or adopted in a FIPS or NIST
recommendation.

asymmetric keys
Two related cryptographic keys comprised of a public key and a private key that are used
to perform complementary operations, such as encryption and decryption or signature
verification and generation.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Personnel Security?

[Assistant]
According to Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations:

| 1. Introduction.....................................................................................................................................1   |
|---------------------------------------------------------------------------------------------------------------------------------------------------------|
| 1.4.1. Enterprise Risk Management and C-SCRM Owners and Operators.............................................5                                         |
| 1.4.2. Enterprise, Agency, and Mission and Business Process Owners and Operators .........................5                                             |
| 1.4.3. Acquisition and Procurement Owners and Operators.................................................................6                               |
| 1.4.4. Information Security, Privacy, or Cybersecurity Operators .........................................................6                             |
| 1.4.5. System Development, System Engineering, and System Implementation Personnel.................7                                                    |
| 1.5.1. Enterprise's Supply Chain.............................................................................................................9          |
| 1.5.2. Supplier Relationships Within Enterprises .................................................................................10                    |
| 2. Integration of C-SCRM Into Enterprise-Wide Risk Management...................................................... 18                                  |
| 2.3.1. Roles and Responsibilities Across the Three Levels ...................................................................24                         |
| 2.3.2. Level 1 -Enterprise...................................................................................................................27         |
| 2.3.3.

Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Blockchain for Access Control Systems provide? (Part 10)

[Assistant]
nodes. The main purpose of smart contracts is to satisfy common contractual conditions, as well as minimize exceptions (both malicious and accidental) and the need for trusted intermediaries [IR8202].
Every blockchain node that executes the smart contract should arrive at the same result given the same input. Blockchain can be utilized for AC systems as a trustable alternative for a single entity/organization or  a  member of a large-scale system to enforce AC policies. The robust, distributed nature of blockchain technology can overcome the limitations of traditional AC systems in a decentralized and efficient way. It is supported by the following infrastructural properties that are not included in traditional AC mechanisms unless specifically implemented:

- Tamper-evident  and  tamper-resistant  design  prevents  the  alteration AC  data (i.e., attributes, policy rules, environment conditions, and access requests) and AC logs (i.e., request permissions and previous AC data) and reduces the probability of frauds. - The control of authorization processing is decentralized, and the storage of AC data/logs has no single point of failure, thus providing more system tolerance and availability. - The traceability of blocks allows AC data/logs and system states to be seen and tracked. - The execution of arbitrary programs in smart contracts allows for controls on distributed AC data and authorization processes. - Consensus mechanisms and protocols jointly regulate the participating AC entities/organizations in determining policy rules through blocks or smart contracts. Blockchain properties improve the security, flexibility, scalability, integrity, and confidentiality of AC data/logs and processes (compared to traditional AC systems) by allowing organizations to verify and audit AC data transactions and processes to track the states of their AC systems hosted on distributed sites [SP162].

Audit and Accountability
System and Information Integrity
Security Assessment
Media Protection
Identification and Authentication
Awareness and Training
System and Communications Protection
Access Control
Planning
Incident Response
Risk Assessment
Personnel Security
System and Services Acquisition
Supply Chain Risk Management
Maintenance
Physical Protection
Configuration Management


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Services Acquisition?

[Assistant]
According to Guide to Malware Incident Prevention and Handling for Desktops and Laptops:

There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may be used by Federal agencies even before the completion of such companion publications. Thus, until each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning and transition purposes, Federal agencies may wish to closely follow the development of these new publications by NIST. The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the Nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology. ITL's responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in Federal information systems. The Special Publication 800-series reports on ITL's research, guidelines, and outreach efforts in information system security, and its collaborative activities with industry, government, and academic organizations. The authors, Peter Mell of the National Institute of Standards and Technology (NIST) and Karen Kent and Joseph Nusbaum of Booz Allen Hamilton, wish to thank their colleagues who reviewed drafts of this document and contributed to its technical content. The authors would particularly like to acknowledge Tim Grance and Murugiah Souppaya of NIST and Lucinda Gagliano, Thomas Goff, and Pius Uzamere of Booz Allen Hamilton for their keen and insightful assistance throughout the development of the document.

Guide to Malware Incident Prevention and Handling for Desktops and Laptops


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What guidance does NIST provide for CMMC Level 3?

[Assistant]
According to Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171:

systems, but such standards and guidelines shall not apply to national security systems without the express approval of the appropriate federal officials exercising policy authority over such systems.
This guideline is consistent with requirements of the Office of Management and Budget (OMB) Circular A-130. Nothing in this publication should be taken to contradict the standards and guidelines made mandatory and binding on federal agencies by the Secretary of Commerce under statutory authority. Nor should these guidelines be interpreted as altering or superseding the existing authorities of the Secretary of Commerce, OMB Director, or any other federal official. This publication may be used by nongovernmental organizations on a voluntary basis and is not subject to copyright in the United States. Attribution would, however, be appreciated by NIST. National Institute of Standards and Technology Special Publication 800-172 Natl. Inst. Stand. Technol. Spec. Publ. 800-172, 84 pages (February 2021)

CODEN: NSPUE2

This publication is available free of charge from:

https://doi.org/10.6028/NIST.SP.800-172

Certain  commercial  entities,  equipment,  or  materials  may  be  identified  in  this  document  to describe an experimental procedure or concept adequately. Such identification is not intended to imply recommendation or endorsement by NIST, nor is it intended to imply that the entities, materials, or equipment are necessarily the best available for the purpose. There may be references in this publication to other publications currently under development by  NIST  in  accordance  with  its  assigned  statutory  responsibilities. The  information  in  this publication, including concepts, practices, and methodologies, may be used by federal agencies even  before  the  completion  of  such  companion  publications. Thus,  until  each  publication  is completed,  current  requirements,  guidelines,  and  procedures,  where  they  exist,  remain operative.

Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AC.L2-3.1.2 (NIST 3.1.2)?

[Assistant]
According to Recommendation for Pair-Wise Key-Establishment Using Integer Factorization Cryptography:

3.1.2 rsakpg1-prime-factor ... 3.1.2 rsakpg1-prime-factor

rsakpg1-prime-factor is the generator in the RSAKPG1 family such that the private key is in the prime factor format ( p , q , d ). 3.1.2).

Recommendation for Pair-Wise Key-Establishment Using Integer Factorization Cryptography


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Media Protection?

[Assistant]
According to Control Baselines for Information Systems and Organizations:

| CONTROL NUMBER | CONTROL NAME CONTROL ENHANCEMENT NAME | PRIVACY CONTROL BASELINE | SECURITY CONTROL BASELINES | SECURITY CONTROL BASELINES | SECURITY CONTROL BASELINES | |------------------|-------------------------------------------------------|----------------------------|------------------------------|------------------------------|------------------------------| | CONTROL NUMBER | CONTROL NAME CONTROL ENHANCEMENT NAME | PRIVACY CONTROL BASELINE | LOW | MOD | HIGH | | AC-4(2) | PROCESSING DOMAINS | | | | | | AC-4(3) | DYNAMIC INFORMATION FLOW CONTROL | | | | | | AC-4(4) | FLOW CONTROL OF ENCRYPTED INFORMATION | | | | x | | AC-4(5) | EMBEDDED DATA TYPES | | | | | | AC-4(6) | METADATA | | | | | | AC-4(7) | ONE-WAY FLOW MECHANISMS | | | | | | AC-4(8) | SECURITY AND PRIVACY POLICY FILTERS | | | | | | AC-4(9) | HUMAN REVIEWS | | | | | | AC-4(10) | ENABLE AND DISABLE SECURITY OR PRIVACY POLICY FILTERS | | | | | | AC-4(11) | CONFIGURATION OF SECURITY OR PRIVACY POLICY FILTERS | | | | | | AC-4(12) | DATA TYPE IDENTIFIERS | | | | | | AC-4(13) | DECOMPOSITION INTO POLICY - RELEVANT SUBCOMPONENTS | | | | | | AC-4(14) | SECURITY OR PRIVACY POLICY

Control Baselines for Information Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Contingency Planning Guide for Federal Information Systems provide? (Part 5)

[Assistant]
Technology (NIST), Amy Wohl Phillips, Dean Gallup, and David Lynes of Booz Allen Hamilton, wish to thank their colleagues who reviewed drafts of this document and contributed to its technical content.
The authors would like to acknowledge Kelley Dempsey, Esther Katzman, Peter Mell, Murugiah Souppaya, Lee Badger, and Elizabeth Lennon of NIST, and David Linthicum of Booz Allen Hamilton for their keen and insightful assistance with technical issues throughout the development of the document. ## Table of Contents

| Chapter 1.

Contingency Planning Guide for Federal Information Systems


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Services Acquisition?

[Assistant]
According to Blockchain for Access Control Systems:

There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may  be  used  by  federal  agencies  even  before  the  completion  of  such  companion  publications. Thus,  until  each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning  and  transition  purposes,  federal  agencies  may  wish  to  closely  follow  the  development  of  these  new publications by NIST. The  Information  Technology  Laboratory  (ITL)  at  the  National  Institute  of  Standards  and Technology  (NIST)  promotes  the  U.S. economy  and  public  welfare  by  providing  technical leadership  for  the  Nation's  measurement  and  standards  infrastructure. ITL  develops  tests,  test methods, reference data, proof of concept implementations, and technical analyses to advance the development  and  productive  use  of  information  technology. ITL's  responsibilities  include  the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in federal information systems. The rapid development and wide application of distributed network systems have made network security  -  especially  access  control  and  data  privacy  -  ever  more  important. Blockchain technology offers features such as decentralization, high confidence, and tamper-resistance, which are advantages to solving auditability, resource consumption, scalability, central authority, and trust issues - all of which are challenges for network access control by traditional mechanisms.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Incident Response?

[Assistant]
According to High-Performance Computing Security_ Architecture, Threat Analysis, and Security Posture:

HPC file systems in the data storage zone provide superior data access speed and much larger storage capacity compared to average enterprise file systems. Hard disk failure is a threat due to the large number of disks deployed in the data storage zone. Incident response and contingency planning controls may not be easy to implement, and file backup, recovery, and forensic imaging may become infeasible. The security measures that can be implemented on the enterprise file systems may take an unacceptably long time and degrade HPC file system performance in an unacceptable way. system that can remotely mount a file system will have complete control over all file system data. This access could be used to gain privileges elsewhere within other zones of the HPC security enclave. Hashing is another technique for monitoring data integrity. Data files can be hashed at the beginning to acquire hashing keys. A file is not modified if its hashing key remains the same. Parallel file systems maintain many types of metadata (e.g., user ID, group ID, modification time, checksum, etc.). Hashing metadata is another way to check whether a file has been modified. Periodically scanning file systems for malware is a proven technique for monitoring data integrity. However, scanning an HPC system for malware is challenging. HPC data storage can easily contain a petabyte or more of data. Existing malware scanning tools are mainly designed for a single machine or laptop. They are not efficient or fast enough to scan large HPC data storage systems. Furthermore, the scanning operation can adversely affect the performance of running jobs. HPC systems may consider alternate implementation options for malware scanning to alleviate some of the stated impacts. For example, conduct scanning at write, and conduct subsequent batch scanning at read. Protection against ransomware attacks on HPC data is especially important.

High-Performance Computing Security_ Architecture, Threat Analysis, and Security Posture


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for System and Communications Protection?

[Assistant]
According to Protecting Controlled Unclassified Information (CUI)_ NIST Special Publication 800-171, Revision 3. Small Business Primer:

| Access Control                    | Maintenance         | Security Assessment and Monitoring   |
|-----------------------------------|---------------------|--------------------------------------|
| Awareness and Training            | Media Protection    | System and Communications Protection |
| Audit and Accountability          | Personnel Security  | System and Information Integrity     |
| Configuration Management          | Physical Protection | Planning                             |
| Identification and Authentication | Risk Assessment     | System and Services Acquisition      |
| Incident Response                 |                     | Supply Chain Risk Management         |

- A business champion: Someone who is responsible for developing and maintaining the incident response plan.
- Who to call: List all the individuals who may be part of the incident response efforts. Include their contact information, roles, and responsibilities.
- What/when/how to report: List the business' communications/reporting responsibilities as required by laws, regulations, contracts, agreements, or policies.
- Also, most federal contracts will include specific reporting and notification requirements that should be included in the Incident Response Plan

Description: Monitor, control, and protect organizational communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of the systems; and employ architectural designs, software development techniques, and systems engineering principles that promote effective information security within organizational systems.

Protecting Controlled Unclassified Information (CUI)_ NIST Special Publication 800-171, Revision 3. Small Business Primer


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Security Assessment?

[Assistant]
According to Data Integrity_ Detecting and Responding to Ransomware and Other Destructive Events:

| 1 | Summary..............................................................................................1 | Summary..............................................................................................1 | |-----|------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | | 1.1 | Challenge.......................................................................................................................2 | | | 1.2 | Solution..........................................................................................................................2 | | | 1.3 | Benefits..........................................................................................................................3 | | 2 | How to Use This Guide.........................................................................4 | How to Use This Guide.........................................................................4 | | | 2.1 | Typographic Conventions..............................................................................................5 | | 3 | Approach .............................................................................................6 | Approach .............................................................................................6 | | | 3.1 | Audience........................................................................................................................6 | | | 3.2 | Scope .............................................................................................................................6 | | | 3.3 | Assumptions..................................................................................................................7 | | | 3.4 | Risk Assessment ............................................................................................................7 | | | 3.4.1 | Risk................................................................................................................................8 | | | | 3.4.2 Security Control Map....................................................................................................9 | | | 3.5 Technologies................................................................................................................13 | 3.5 Technologies................................................................................................................13 | | 4 | Architecture .......................................................................................16 | Architecture .......................................................................................16 | | | 4.1 Architecture Description .............................................................................................16 | 4.1 Architecture Description .............................................................................................16 | | | 4.1.1 | High-Level Architecture ..............................................................................................16 | | | 4.1.2 | Architecture Components...........................................................................................17 | | 5 | Security Characteristic Analysis..........................................................20 | Security Characteristic Analysis..........................................................20 | | | 5.1 Assumptions and Limitations | ......................................................................................20 | | | 5.2 Build | Testing................................................................................................................20 | | | 5.3 | Scenarios and Findings................................................................................................21 | | | 5.3.1 | Ransomware via Web Vector and Self-Propagation...................................................21 | | | 5.3.2 | Destructive Malware via USB Vector..........................................................................22 | | |


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AC.L2-3.1.3 (NIST 3.1.3)?

[Assistant]
According to Zero Trust Architecture:

3.1.3                                                                                | ZTA y el uso de una infraestructura de red y perímetros definidos a través de software... 3.1.3 ZTA y el uso de una infraestructura de red y perímetros definidos a través de software

El último modelo utiliza la infraestructura de red para implementar una ZTA.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Automated Secure Configuration Guidance from the macOS Security Compliance Project (mSCP) provide? (Part 10)

[Assistant]
..................11                                  |                                                                                |
| 3.4.4.
| SCAP Generation Script ........................................................................................11                           |                                                                                |
| 3.4.5.

Automated Secure Configuration Guidance from the macOS Security Compliance Project (mSCP)


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 1 require for Risk Assessment?

[Assistant]
According to IoT Non-Technical Supporting Capability Core Baseline:

1  One resource supporting both Information Reception and Information Dissemination to others in the ecosystem about vulnerabilities is found in Draft NIST SP 800-216: Federal Vulnerability Disclosure Guidelines [17] . This document recommends guidance for establishing a federal vulnerability disclosure framework and highlights the importance of proper handling of vulnerability reports and communicating the minimization or elimination of vulnerabilities.

IoT Non-Technical Supporting Capability Core Baseline


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Machine Learning for Access Control Policy Verification provide? (Part 8)

[Assistant]
10, ACPT], data structure [MARG], system simulation [VK13, ACRLCS], and test oracle [ACTS] to verify the expected functional logic implied in policy rules [AS15]. The model proof method converts policy to a finite state machine (FSM) and verifies test access cases against it to detect policy faults, such as rule conflict, access blocking, or privilege leakage [SP192]. For instance, [ACPT] applies the symbolic model verification [NuSMV] tool to build an FSM model in terms of policy rule attributes. Thus, a test case is represented by a deterministic finite state transducer that corresponds to the FSM, which should satisfy the two requirements below after it takes actions in compliance with the test case:

- 1) Safety - There is no violation of the FSM model to the test case, and it is assured that the FSM will eventually be in a desired state. - 2) Liveness - Where the FSM will have neither a deadlock in which the system waits forever for system events nor a livelock in which the model repeatedly executes the same operations forever [NuSMV]. An access control policy verification method uses structured data that represents underlying policy rule logics. The data structure, such as a binary decision diagram [CFMY93], is given assignments of  binary  values  to  the  policy  attributes  that  traverse  from  the  root  to  a  terminal  of  the  rule's permission [Fisler et al. 05]. This method is used by software tool suite Margrave [MARG] for verifying safety requirements (test cases) against policies written in eXtensible Access Control Markup Language (XACML) [XACML]. Margrave's API verifies safety requirements in the form of  queries,  which  should  hold  by  the  binary  tree. Otherwise,  counterexamples  are  produced indicating violations of the tree structure [SND13]. Model proof and data structure methods initially accept the policy under verification as faultless until tested against specified cases or requirements.

Machine Learning for Access Control Policy Verification


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Incident Response Recommendations and Considerations for Cybersecurity Risk Management_ A CSF 2.0 Community Profile provide? (Part 4)

[Assistant]
h incorporating cybersecurity incident response recommendations and considerations throughout their cybersecurity risk management activities as described by the NIST Cybersecurity Framework (CSF) 2.0.
Doing so can help organizations prepare for incident responses, reduce the number and impact of incidents that occur, and improve the efficiency and effectiveness of their incident detection, response, and recovery activities. Readers are encouraged to utilize online resources in conjunction with this document to access additional information on implementing these recommendations and considerations. ## Keywords

cyber threat information sharing; Cybersecurity Framework; cybersecurity incident; cybersecurity risk management; incident handling; incident management; incident response. ## Reports on Computer Systems Technology

The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the Nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology. ITL's responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in federal information systems. The Special Publication 800-series reports on ITL's research, guidelines, and outreach efforts in information system security, and its collaborative activities with industry, government, and academic organizations. ## Supplemental Content

NIST has established an Incident Response project page that hosts links to resources with additional information on incident response activities.

Incident Response Recommendations and Considerations for Cybersecurity Risk Management_ A CSF 2.0 Community Profile


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 2 require for Physical Protection?

[Assistant]
According to Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations:

...................94          |
| Table 5. Audit and Accountability (AU).......................................................................................................95          |
| Table 6.
Assessment, Authorization, and Monitoring (CA).........................................................................95                       |
| Table 7. Configuration Management (CM).................................................................................................96                |
| Table 8. Contingency Planning (CP) ............................................................................................................96        |
| Table 9. Identification and Authentication (IA) ..........................................................................................97             |
| Table 10. Incident Response (IR).................................................................................................................98      |
| Table 11. Maintenance (MA) ......................................................................................................................98      |
| Table 12. Media Protection (MP)................................................................................................................99        |
| Table 13. Physical and Environmental Protection (PE)...............................................................................99                    |
| Table 14. Planning (PL)..............................................................................................................................100 |
| Table 15. Program Management (PM) .....................................................................................................100               |
| Table 16. Personnel Security (PS) .............................................................................................................101       |
| Table 17.

Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Control Baselines for Information Systems and Organizations provide? (Part 8)

[Assistant]
CONTRIBUTIONS TO NIST SPECIAL PUBLICATION 800-53

The authors wanted to acknowledge the many individuals who contributed to previous versions of Special Publication 800-53 since its inception in 2005.
They include Marshall Abrams, Dennis Bailey, Lee Badger, Curt Barker, Matthew Barrett, Nadya Bartol, Frank Belz, Paul Bicknell, Deb Bodeau, Paul Brusil, Brett Burley, Bill Burr, Dawn Cappelli, Roger Caslow, Corinne Castanza, Mike Cooper, Matt Coose, Dominic Cussatt, George Dinolt, Randy Easter, Kurt Eleam, Denise Farrar, Dave Ferraiolo, Cita Furlani, Harriett Goldman, Peter Gouldmann, Tim Grance, Jennifer Guild, Gary Guissanie,  Sarbari  Gupta,  Priscilla  Guthrie,  Richard  Hale,  Peggy  Himes,  Bennett  Hodge, William Hunteman, Cynthia Irvine, Arnold Johnson, Roger Johnson, Donald Jones, Lisa Kaiser, Stuart Katzke, Sharon Keller, Tom Kellermann, Cass Kelly, Eustace King, Daniel Klemm, Steve LaFountain, Annabelle Lee, Robert Lentz, Steven Lipner, William MacGregor, Thomas Macklin, Thomas Madden, Robert Martin, Erika McCallister, Tim McChesney, Michael McEvilley, Rosalie McQuaid, Peter Mell, John Mildner, Pam Miller, Sandra Miravalle, Joji Montelibano, Douglas Montgomery, George Moore, Rama Moorthy, Mark Morrison, Harvey Newstrom, Sherrill Nicely, Robert Niemeyer, LouAnna Notargiacomo, Pat O'Reilly, Tim Polk, Karen Quigg, Steve Quinn, Mark Riddle, Ed Roback, Cheryl Roby, George Rogers, Scott Rose, Mike Rubin, Karen Scarfone, Roger  Schell,  Jackie  Snouffer,  Ray  Snouffer,  Murugiah  Souppaya,  Gary  Stoneburner,  Keith Stouffer,  Marianne  Swanson,  Pat  Toth,  Glenda  Turner,  Patrick  Viscuso,  Joe  Weiss,  Richard Wilsher, Mark Wilson, John Woodward, and Carol Woody.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Physical Protection?

[Assistant]
According to Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations:

The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the Nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology. ITL's responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in federal information systems. The Special Publication 800-series reports on ITL's research, guidelines, and outreach efforts in information system security, and its collaborative activities with industry, government, and academic organizations. | 3.4.3. Enhancing Practices....................................................................................................................49      |                                                                                |
|-------------------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------|
| 3.5.1. Measuring C-SCRM Through Performance Measures................................................................52                                |                                                                                |
| References.........................................................................................................................................57 |                                                                                |
| Appendix A.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Information Integrity?

[Assistant]
According to Protecting Information and System Integrity in Industrial Control System Environments_ Cybersecurity for the Manufacturing Sector:

## Protecting Information and System Integrity in Industrial Control System Environments: Cybersecurity for the Manufacturing Sector

The first draft of this publication is available free of charge from https://www.nccoe.nist.gov/publications/practice-guide/protecting-information-and-systemintegrity-industrial-control-system-draft

## Protecting Information and System Integrity in Industrial Control System Environments: Cybersecurity for the Manufacturing Sector

Protecting Information and System Integrity in Industrial Control System Environments_ Cybersecurity for the Manufacturing Sector


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Risk Assessment?

[Assistant]
According to Risk Management Framework for Information Systems and Organizations_ A System Life Cycle Approach for Security and Privacy:

assess; authorization to operate; authorization to use; authorizing official; categorize; common control; common control authorization; common control provider; continuous monitoring; control assessor; control baseline; cybersecurity framework profile; hybrid control; information owner or steward; information security; monitor; ongoing authorization; plan of action and milestones; privacy; privacy assessment report; privacy control; privacy plan; privacy risk; risk assessment; risk executive function; risk management; risk management framework; security; security assessment report; security control; security engineering; security plan; security risk; senior agency information security officer; senior agency official for privacy; supply chain risk management; system development life cycle; system owner; system privacy officer; system security officer; system-specific control.

The Defense Science Board Report, Resilient Military Systems and the Advanced Cyber Threat [DSB 2013], provides a sobering assessment of the vulnerabilities in the United States Government, the U.S. critical infrastructure, and the systems supporting the mission-essential operations and assets in the public and private sectors.

'…The Task Force notes that the cyber threat to U.S. critical infrastructure is outpacing efforts to reduce pervasive vulnerabilities, so that for the next decade at least the United States must lean significantly on deterrence to address the cyber threat posed by the most capable U.S. adversaries. It is clear that a more proactive and systematic approach to U.S. cyber deterrence is urgently needed…'

Risk Management Framework for Information Systems and Organizations_ A System Life Cycle Approach for Security and Privacy


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Assessing Security and Privacy Controls in Information Systems and Organizations provide? (Part 3)

[Assistant]
ft publications during the designated public comment periods
and provide feedback to NIST. Many NIST publications, other than the ones noted above, are available at
https://csrc.nist.gov/publications.
Submit comments on this publication to: sec-cert@nist.gov

National Institute of Standards and Technology
Attn: Computer Security Division, Information Technology Laboratory
100 Bureau Drive (Mail Stop 8930) Gaithersburg, MD 20899-8930

All comments are subject to release under the Freedom of Information Act (FOIA) [FOIA96]. T
h
s

i

p
u
b

l
i

c
a

t
i

o
n

i

s

a
v
a

i
l

l

a
b
e
f
r
e
e
o
f

c
h
a
r
g
e
f
r
o
m

:

h
t
t
p
s
:
/
/
d
o
i
. o
r
g
/
1
0
. 6
0
2
8
/
N
S
T
S
P
. 8
0
0
-
5
3
A
r
5

I

. NIST SP 800-53A REV. 5
ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS
_________________________________________________________________________________________________

Reports on Computer Systems Technology

The National Institute of Standards and Technology (NIST) Information Technology Laboratory
(ITL) promotes the U.S. economy and public welfare by providing technical leadership for the
Nation’s measurement and standards infrastructure. ITL develops tests, test methods, reference
data, proof of concept implementations, and technical analyses to advance the development
and productive use of information technology (IT). ITL’s responsibilities include the development
of management, administrative, technical, and physical standards and guidelines for the cost-
effective security of other than national security-related information in federal information
systems. The Special Publication 800-series reports on ITL’s research, guidelines, and outreach
efforts in information systems security and privacy and its collaborative activities with industry,
government, and academic organizations.

Assessing Security and Privacy Controls in Information Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AC.L2-3.1.4 (NIST 3.1.4)?

[Assistant]
According to Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations:

3.1.4. 3.1.4.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Multi-Factor Authentication for Criminal Justice Information Systems_ Implementation Considerations for Protecting Criminal Justice Information provide? (Part 8)

[Assistant]
.................61                      |
| List of Tables                                                                                |
| Table 1.
Example of a phased MFA deployment................................................................................16                  |
| List of Figures                                                                                |
| Fig. 1. Callout box formats..................................................................................................................4 |
| Fig. 2. The identity provider (IdP) can be at hosted at the state or county, or both...............................7                           |
| Fig. 3. Single sign-on eliminates repeated MFA challenges to users......................................................9                      |
| Fig. 4. An example of a phishing attack. ............................................................................................10        |
| Fig. 5. MFA implementation points...................................................................................................11         |
| Fig. 6. Potential authentication points for local agencies. ..................................................................17               |
| Fig. 7. MFA at the CAD/RMS application. ..........................................................................................18           |
| Fig. 8. Local agency identity service Integrated with CAD/RMS using identity federation....................19                                  |
| Fig. 9. State-provided identity service for use by a local agency.........................................................20                   |
| Fig. 11. Common architecture for implementing MFA directly with state portal.................................22                                |
| Fig. 12.

Multi-Factor Authentication for Criminal Justice Information Systems_ Implementation Considerations for Protecting Criminal Justice Information


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What guidance does Transitioning to the Security Content Automation Protocol (SCAP) Version 2 provide?

[Assistant]
## Transitioning to the Security Content Automation Protocol (SCAP) Version 2

David Waltermire Computer Security Division Information Technology Laboratory

Jessica Fitzgerald-McKay Cybersecurity Solutions National Security Agency Fort Meade, MD

This publication is available free of charge from: https://doi.org/10.6028/NIST.CSWP.09102018

September 10, 2018

<!-- image -->

## Abstract

The Security Content Automation Protocol (SCAP) version 2 (v2) automates endpoint posture information collection and the incorporation of that information into network defense capabilities using standardized protocols. SCAP v2 expands the endpoint types supported by SCAP v1 through the explicit inclusion of network equipment, Internet of Things (IoT), and mobile devices in its scope. To automate self-reporting of posture information from endpoint machines, SCAP v2 will integrate with existing network management protocols that include the Internet Engineering Task Force (IETF) Network Endpoint Assessment (NEA) protocols. SCAP v2 will streamline SCAP content acquisition and reuse through its use of the IETF Resource Oriented Lightweight Information Exchange (ROLIE) protocol. Improvements to software version identification and the incorporation of patch information will be made by transitioning from the Common Platform Enumeration (CPE) to Software Identification (SWID) Tags. SCAP v2 provides component-level interoperability via a modular and extensible architecture. This white paper provides a gap analysis of SCAP v1 and an overview of how SCAP v2 will address these gaps; describes the SCAP 2.0 architecture; and provides a plan for completing the work necessary to finalize SCAP v2.

Transitioning to the Security Content Automation Protocol (SCAP) Version 2


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Information Integrity?

[Assistant]
According to Recommendation for Pair-Wise Key-Establishment Using Integer Factorization Cryptography:

Many  U.S. Government Information Technology (IT) systems need to employ strong cryptographic schemes to protect the integrity and confidentiality of the data that they process. Algorithms such as the Advanced Encryption Standard (AES), as defined in Federal Information Processing Standard (FIPS) 197, 1 and HMAC, as defined in FIPS 198, 2 make attractive choices for  the  provision  of  these  services. These  algorithms  have  been  standardized  to  facilitate interoperability between systems. However, the use of these algorithms requires the establishment of secret keying material that is shared in advance. Trusted couriers may manually distribute this secret keying material, but as the number of entities using a system grows, the work involved in the distribution of the secret keying material grows rapidly. Therefore, it is essential to support the cryptographic  algorithms  used  in  modern  U.S. Government  applications  with  automated  keyestablishment schemes. | Additional input                    | Information known by two parties that is cryptographically bound to the secret keying material being protected using the encryption operation.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Security Assessment?

[Assistant]
According to Workshop on Enhancing Security of Devices and Components Across the Supply Chain:

cycle. The last panel member was Matthew Areno, Senior Principal Engineer for Intel Corporation. Matthew admitted that there is no industry standard to describe the phases of the supply chain for ICs.
However, his expertise and history with the industry have enabled him to develop his own conceptual model that is divided into seven stages: concept, development, integration, manufacturing, testing, provisioning, and deployment. During his time at Intel, Matthew has worked to develop a threat model for Intel's supply chain. Intel discovered that each of their teams approached the exercise of threat modeling in different ways, which made it difficult and time-consuming for them to exchange information. As a result, Intel has been developing and deploying a unified Threat Modeling Tool that utilizes vulnerability resources like MITRE Common Weakness Enumeration (CWE) to automatically make design-based suggestions on potential vulnerabilities and mitigations. The tool also forms a closed loop that incorporates knowledge learned from Intel's own design processes.

Workshop on Enhancing Security of Devices and Components Across the Supply Chain


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Configuration Management?

[Assistant]
According to Audit and Evaluation of Computer Security II_ System Vulnerabilities and Controls:

| VULNERABILITIES | VULNERABILITIES | 6-5 | | 3.1 | Targets | Targets | 6-5 | | | 3.1.1 | Vul nerabl llties of Data and Prog ranis •••••••••••«••«•••••••«••••••••• | 6~5 | | | | Vulnerabilities of Terminals | 6-7 | | | 3.1.2 3.1.3 | Vulnerabilities of Media | 6-7 | | | 3.1.4 | Vulnerability of Services | 6-9 | | 3.2 | Hazards | | 6-10 | | | 3.2.1 | Natural Hazards | 6-10 | | | 3.2.2 Man-made Hazards | 3.2.2 Man-made Hazards | 6-10 | | 4.1 | CONTROLS Control Principles | CONTROLS Control Principles | 6-11 | | | | | 6-11 | | | 4.1.1 | Separation of Duties | | | | 4.1.2 | Restrict Access | 6-12 | | | 4.1.3 | Independent Authorization | 6-12 | | | 4.1.4 | Individual Accountability | 6-12 | | | 4.1.5 | Test of Concealment | 6-12 6-12 | | | 4.1.6 Test of Sensitive Combinations | 4.1.6 Test of Sensitive Combinations | 6-12 | | 4.2 | Control Measures | Control Measures | 6-12 | | | 4.2.1 | Explicit Assignment of Responsibility 4.2.2 Physical and Environmental Controls | 6-13 |

Audit and Evaluation of Computer Security II_ System Vulnerabilities and Controls


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Security Assessment?

[Assistant]
According to Overview and Considerations of Access Control Based on Attribute Encryption:

In addition to functionalities like revocation, accountability, attribute privacy protection, policy updating, decentralization (multi-authorities), and key hierarchy for practical access control system deployments [ZDXSLZ], the applicable access policy structure for fundamental ABE is restricted to supporting non-monotone and stated policy rules [TKN]. For example, CP-ABE allows data owners to define their own access policies  by attributes and, thus, support complex access control policy structure. However, by only associating attributes, decryption keys are organized logically as a static set. Users can only use all possible combinations of attributes in the set of keys issued to compose their policies, and it has restrictions for specifying policies, attribute managements (e.g., applying environment conditions and dynamic attributes), and the application of deny rules. This may fail to satisfy the enterprise requirements of access control in terms of flexibility and dynamic properties [BS]. However, research has introduced methods to handle the non-monotone restriction [AG, AN, AT, TKN] to address the deny rule issue. The policy issue can be addressed by combining various technologies, such as refreshing user secret keys more frequently, shortening the expiration time interval, or allowing dynamic attributes to be updated closer to real-time. In KP-ABE, the secret key and ciphertext relate to a set of attributes to offer fine-grained access control [BCSES] for which permission evaluation depends only on the resources' attributes. The resource provider (i.e., data owner or encrypted) cannot specify the access policy except by choosing descriptive attributes for permissions. This means that there is no choice but to trust the key issuer. Such accountability for user secret keys provides fine-grained access without flexibility or scalability [BS].

Overview and Considerations of Access Control Based on Attribute Encryption


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice IA.L2-3.5.2 (NIST 3.5.2)?

[Assistant]
According to Guide to Malware Incident Prevention and Handling for Desktops and Laptops:

3.5.2                                                                                | Sandboxing... 3.5.2 Sandboxing

Sandboxing refers to a security model where applications are run within a sandbox-a controlled environment that restricts what operations the applications can perform and that isolates them from other applications running on the same host.

Guide to Malware Incident Prevention and Handling for Desktops and Laptops


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Access Control?

[Assistant]
According to Audit and Evaluation of Computer Security II_ System Vulnerabilities and Controls:

| 3. | POLICY         | AND CONTROL STANDARDS                                                                                | 3-6       |
|------|----------------|-------------------------------------------------------------------------------------------------------|-----------|
|      | 3.1            | General                                                                                | 3-6       |
|      | 3.2            | Assessing Security Safeguards                                                                         | 3-6       |
|      | 3.3            | Establishing Control Standards                                                                        | 3-6       |
|      | 3.4            | Require a Plan to Implement Controls                                                                  | 3-7       |
|      | 3.5            | Establish Personnel Security Policies                                                                 | 3-7       |
| 4. | ALLOCATE       | RESOURCES                                                                                | 3-7       |
|      | 4.1            | General                                                                                | 3-7 3-8   |
| 5. | REPORT         | ON SECURITY                                                                                |           |
|      | 5.1            | General                                                                                | 3-8       |
| Fig. | 1              | Responsibilities and Duties to Provide Security for Data Processing System ..


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What guidance does Guide to Malware Incident Prevention and Handling for Desktops and Laptops provide?

[Assistant]
## NIST Special Publication 800-83 Revision 1

## Guide to Malware Incident Prevention and Handling for Desktops and Laptops

Murugiah Souppaya Karen Scarfone

## C  O  M  P  U  T  E  R      S  E  C  U  R  I  T  Y

<!-- image -->

## NIST Special Publication 800-83 Revision 1

## Guide to Malware Incident Prevention and Handling for Desktops and Laptops

Murugiah Souppaya Computer Security Division Information Technology Laboratory

Karen Scarfone Scarfone Cybersecurity Clifton, VA

July 2013

<!-- image -->

U.S. Department of Commerce

## Cameron F. Kerry, Acting Secretary

National Institute of Standards and Technology Patrick D. Gallagher, Under Secretary of Commerce for Standards and Technology and Director

## Authority

This publication has been developed by NIST to further its statutory responsibilities under the Federal Information Security Management Act (FISMA), Public Law (P.L.) 107-347. NIST is responsible for developing information security standards and guidelines, including minimum requirements for Federal information systems, but such standards and guidelines shall not apply to national security systems without the express approval of appropriate Federal officials exercising policy authority over such systems. This guideline is consistent with the requirements of the Office of Management and Budget (OMB) Circular A-130, Section 8b(3), Securing Agency Information Systems , as analyzed in Circular A130, Appendix IV: Analysis of Key Sections . Supplemental information is provided in Circular A-130, Appendix III, Security of Federal Automated Information Resources . Nothing in this publication should be taken to contradict the standards and guidelines made mandatory and binding on Federal agencies by the Secretary of Commerce under statutory authority. Nor should these guidelines be interpreted as altering or superseding the existing authorities of the Secretary of Commerce, Director of the OMB, or any other Federal official.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Protecting Controlled Unclassified Information (CUI)_ NIST Special Publication 800-171, Revision 3. Small Business Primer provide? (Part 7)

[Assistant]
171A. |
| What products, vendors, or solutions are 'NIST SP 800 -171 compliant' or 'CMMC - certified'? | NIST does not identify or track implementation of or compliance with the security requirements.
|
| What is the relationship between NIST and CMMC? | The Cybersecurity Maturity Model Certification (CMMC) is a DOD program that references the security requirements in NIST SP 800-171 and SP 800-172. NIST is not involved in the design, development, or implementation of the CMMCmodel, accreditation body, or certification process. It is important to note that CMMCis currently based on SP 800-171, Revision 2. Contractors should check for specific requirements in their contracts to understand which version they are required to use. |

<!-- image -->

View more FAQs here. If you still have a question after reviewing all our FAQs , send your question to: sec-cert@nist.gov. ht ps:/

csrc.nist.gov/projects/protecting-control ed-unclas ified-information

<!-- image -->

<!-- image -->

## Additional Resources

## Online Introductory Courses Available for the NIST SP 800-53 Series

<!-- image -->

SP 800-171 requirements are focused on protecting confidentiality and are based on a subset of controls found in SP 800-53, which is a catalog of security and privacy controls for systems and organizations. With that in mind, it is important to have a basic understanding of the SP 800-53 series. To assist, NIST has released three self-guided online introductory courses to provide a high-level overview of foundational security and privacy risk management concepts. The online introductory courses are between 45-60 minutes, are available at no cost, and registration is not required. Access the courses. ## Roles of Different Federal Agencies

- The National Archives and Records Administration (NARA) , per 32 CFR Part 2002 "Controlled Unclassified Information," determines what CUI is and lists CUI types at archives.gov/cui.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Access Control?

[Assistant]
According to Control Baselines for Information Systems and Organizations:

In  working with the Office of Management and Budget to develop standards and guidelines required by FISMA, NIST consults with federal agencies; state, local, and tribal governments; and private sector organizations to improve information security and privacy, avoid unnecessary and costly duplication of effort, and help ensure that its publications are complementary with the standards and guidelines used for the protection of national security systems. In addition to a comprehensive  and  transparent  public  review  and  comment  process,  NIST  is  engaged  in  a collaborative partnership with the Office of Management and Budget, Office of the Director of National Intelligence, Department of Defense, Committee on National Security Systems, Federal CIO Council, and Federal Privacy Council to establish a Risk Management Framework (RMF) for information security and privacy for the Federal Government. This common foundation provides the Federal Government and their contractors with cost-effective, flexible, and consistent ways to manage security and privacy risks to organizational operations and assets, individuals, other organizations, and the Nation. The framework provides a basis for the reciprocal acceptance of security  and privacy control assessment evidence and authorization decisions and facilitates information sharing and collaboration. NIST continues to work with public and private sector entities  to  establish  mappings  and  relationships  between  the  standards  and  guidelines developed by NIST and those developed by other organizations. NIST anticipates using these mappings and the gaps they identify to improve the control catalog. | CHAPTERONE INTRODUCTION...................................................................................................... 1               | CHAPTERONE INTRODUCTION......................................................................................................

Control Baselines for Information Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Configuration Management?

[Assistant]
According to Approaches and Challenges of Federal Cybersecurity Awareness Programs:

| EXECUTIVE SUMMARY......................................................................................................... iii             | EXECUTIVE SUMMARY......................................................................................................... iii                                                                           | EXECUTIVE SUMMARY......................................................................................................... iii   |
|--------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------|
| 1 INTRODUCTION................................................................................................................. | 1 INTRODUCTION................................................................................................................. | 1                                                                                |
| 2 REPORTING CONVENTIONS.......................................................................................... | 2 REPORTING CONVENTIONS.......................................................................................... | 2                                                                                |
| 3 SECURITY AWARENESS APPROACHES..................................................................... | 3 SECURITY AWARENESS APPROACHES.....................................................................

Approaches and Challenges of Federal Cybersecurity Awareness Programs


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Physical Protection?

[Assistant]
According to Guidelines for the Use of PIV Credentials in Facility Access:

## Guidelines for the Use of PIV Credentials in Facility Access

## Guidelines for the Use of PIV Credentials in Facility Access

The  Information  Technology  Laboratory  (ITL)  at  the  National  Institute  of  Standards  and Technology  (NIST)  promotes  the  U.S.  economy  and  public  welfare  by  providing  technical leadership  for  the  Nation's  measurement  and  standards  infrastructure.  ITL  develops  tests,  test methods, reference data, proof of concept implementations, and technical analyses to advance the development  and  productive  use  of  information  technology.  ITL's  responsibilities  include  the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in federal information systems. The Special Publication 800-series reports on ITL's research, guidelines, and outreach  efforts  in  information  system  security,  and  its  collaborative  activities  with  industry, government, and academic organizations.

Guidelines for the Use of PIV Credentials in Facility Access


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Audit and Accountability?

[Assistant]
According to Federal Cybersecurity Awareness Programs_ A Mixed Methods Research Study:

| Focus Group Design...................................................................................................
| 3                                                                                |
| 2.1.2                                                                                | Focus Group Recruitment........................................................................................... | 3                                                                                |
| 2.1.3                                                                                | Focus Group Data Collection..................................................................................... | 3                                                                                |
| 2.1.4                                                                                | Focus Group Data Analysis........................................................................................ | 4                                                                                |
| 2.2 SURVEY METHODOLOGY ..................................................................................................... 4            | 2.2 SURVEY METHODOLOGY ..................................................................................................... 4            | 2.2 SURVEY METHODOLOGY .....................................................................................................

Federal Cybersecurity Awareness Programs_ A Mixed Methods Research Study


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Audit and Evaluation of Computer Security II_ System Vulnerabilities and Controls provide? (Part 3)

[Assistant]
n activities; provides scientific and technological advisory services and assistance to Federal agencies; and provides the technical foundation for computer-related policies of the Federal Government.
The Institute consists of the following centers:

Programming Science and Technology - Computer Systems Engineering. 'Headquarters and Laboratories at Gaithersburg, MD, unless otherwise noted;

mailing address Washington, DC 20234. ^Some divisions within the center are located at Boulder, CO 80303. f). ## COMPUTER SCIENCE & TECHNOLOGY:

## Audit and Evaluation of Computer Security II: System Vulnerabilities and Controls NATIOIVAX. Proceedings of the NBS Invitational Workshop held at Miami Beach, Florida, November 28-30, 1978

Editor:

Zella G. Ruthberg

General Co-Chairpersons:

Robert G. McKenzie

General Accounting Office Washington, DC 20548

Session Chairpersons:

Donald L. Scantiebury Richard D. Webb Richard J. Guiitinan William H. Murray Jerry FitzGerald Theodore M. P. Lee Gerald E. Short Hart Will

<!-- image -->

<!-- image -->

U.S. DEPARTMENT OF COMMERCE, Philip M. Klutznick, Secretary

Luther H. Hodges, Jr., Deputy Secretary

Jordan J. Baruch, Assistant Secretary for Productivity, Technology, and Innovation

NATIONAL BUREAU OF STANDARDS, Ernest Ambler, Director

Issued April 1980

BUEBAtJ OP BTAIfDAJtDS LIBBAST

APR 25 1980

ribi acc,

~Ci^

no. 6c>C) ' 5 7

/no

6. ^

Zella G. Ruthberg

Institute for Computer Sciences and Technology National Bureau of Standards Washington, DC 20234

## Reports on Computer Science and Technology

The National Bureau of Standards has a special responsibility within the Federal Government for computer science and technology activities.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Awareness and Training?

[Assistant]
According to Guide to a Secure Enterprise Network Landscape:

inks to malicious websites or to websites infected with malware. They centralize control, visibility, and reporting across many locations and types of users. They are not a replacement for WAFs,

- a.
Virtualized server-based approach: This approach is only applicable to networks that contain virtualized servers since it is implemented in the hypervisor. There are two possible mechanisms:
1. Using virtual firewalls inside a hypervisor to isolate traffic destined for different VMs inside the hypervisor
2. Using encapsulation techniques to create overlays (e.g., Virtual Extensible LAN ( VXLAN)) that run on top of an underlying network that consists of IP addresses designations; access control policies are enforced on the hypervisor itself outside of the workload (application or microservice)
- b. Host-based microsegmentation: Alternatively (or additionally), host-based microsegmentation can be implemented using software agents on the endpoint artifacts (e.g., servers). It leverages native firewall functionality built into the host. Software agents can overlay a software-defined segmented network across data centers, cloud, bare metal, and hybrid environments. The agent provides context awareness and visibility for each workload and enables the definition and enforcement of fine-grained policies.

Guide to a Secure Enterprise Network Landscape


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Audit and Evaluation of Computer Security II_ System Vulnerabilities and Controls provide? (Part 4)

[Assistant]
on, DC 20234

## Reports on Computer Science and Technology

The National Bureau of Standards has a special responsibility within the Federal Government for computer science and technology activities.
The programs of the NBS Institute for Computer Sciences and Technology are designed to provide ADP standards, guidelines, and technical advisory services to improve the effectiveness of computer utilization in the Federal sector, and to perform appropriate research and development efforts as foundation for such activities and programs. This publication series will report these NBS efforts to the Federal computer community as well as to interested specialists in the academic and private sectors. Those wishing to receive notices of publications in this series should complete and return the form at the end of this publicaton. ## National Bureau of Standards Special Publication 500-57

Nat. Bur. Stand. (U.S.), Spec. Publ. 500-57, 2 lOpages (Apr. 1980) CODEN: XNBSAV

Library of Congress Catalog Card Number: 80-600034

## U.S. GOVERNMENT PRINTING OFFICE

WASHINGTON: 1980

(Add 25 percent additional for other than U.S. mailing)

The use of computers by Government and private organizations for the storage and manipulation of records of all kinds has continued to Increase at a rapid rate in the three years since the first NBS-sponsored/ GAO-supported Invitational workshop on audit of computer security in March of 1977. The needs of the Individual as well as Government and private organizations for the security of sensitive data and its processing -Including accuracy, reliability, timeliness, and confidentiality -have therefore continued to remain a major concern to the public at large during this time Interval. In response to this need. Government laws and regulations in this arena have continued to grow and place legal requirements on computer systems.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 1 require for Personnel Security?

[Assistant]
According to IoT Non-Technical Supporting Capability Core Baseline:

Document maintenance requirements for the IoT device, such as: a. Cybersecurity maintenance expectations and associated instructions or procedures for the customer (e.g., account management, local and/or remote maintenance activities, and vulnerability/patch management plan) b. When maintenance will be performed by supporting parties that will need access (remote or onsite) to customer's IoT devices and their information security contract requirements c. Cybersecurity considerations of the maintenance process (e.g., how does customer data unrelated to the maintenance process remain confidential even to maintainers) | • Documentation of cybersecurity information enables better understanding of the potential risks related to the IoT device, which can inform customers and others in the IoT device ecosystem and guide on- going risk mitigation support. • Documentation helps personnel with the responsibility of securing IoT devices within the system understand the implementation and operation of controls and prevent misuse and compromise by unauthorized entities. • Documentation may be used to supply information about and support the management of supply chain risk, incident response, and other critical cybersecurity functions. | ( see above)             |

IoT Non-Technical Supporting Capability Core Baseline


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Personnel Security?

[Assistant]
According to Guidelines for the Use of PIV Credentials in Facility Access:

3  OMB Memorandum [M-05-24] and credentialing guidance issued the Office of Personnel Management (OPM) clarifies the eligibility requirements for a PIV Card.

Figure 5-3 depicts a security posture of an FSL I or II campus. It includes one or more Controlled areas that are available to authorized personnel. Since an FSL I or II campus can be considered a low-risk area, a PACS may or may not be maintained to preclude unauthorized entries. When PACS is maintained, SOME confidence in the identity of the cardholder should be achieved. Implementation of PIV authentication mechanisms for Controlled areas would be an appropriate countermeasure for security. PKI-CAK, SYM-CAK, and BIO are the three recommended authentication mechanisms in this environment. Note that these authentication mechanisms validate 'something you have' or 'something you are' (one-factor authentication).

In addition to the use of a PIV credential for cardholder authentication during routine everyday use, the PIV credentials may also be used for access to federal facilities and federally controlled areas internal to disaster response and recovery incident scenes. Federal agencies should consider access for personnel from agencies with responsibilities under the National Response Framework, National Incident Management System, National Infrastructure Protection Plan, and the National Continuity Policy Implementation Plan when identifying and categorizing PACS perimeters as protecting Controlled, Limited, and Exclusion areas. Subsequently, agencies should apply appropriate (in accordance with Table 4-3) PIV authentication mechanisms to the areas to ensure that incident management personnel, emergency response providers, and other personnel (including temporary personnel) and resources likely needed to respond to a natural


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Assessing Security Requirements for Controlled Unclassified Information provide? (Part 2)

[Assistant]
other than the ones noted above, are available at

Organizations are encouraged to review all draft publications during public comment periods and provide feedback https://csrc.nist.gov/publications.
## Authority

This publication has been developed by NIST in accordance with its statutory responsibilities under the Federal Information Security Modernization Act (FISMA) of 2014, 44 U.S.C. § 3551 et seq., Public Law (P.L.) 113-283 [1]. NIST is responsible for developing information security standards and guidelines, including minimum requirements for federal information systems, but such standards and guidelines shall not apply to national security systems without the express approval of appropriate federal officials exercising policy authority over such systems. This guideline is consistent with the requirements of the Office of Management and Budget (OMB) Circular A-130 [2]. Nothing in this publication should be taken to contradict the standards and guidelines made mandatory and binding on federal agencies by the Secretary of Commerce under statutory authority. Nor should these guidelines be interpreted as altering or superseding the existing authorities of the Secretary of Commerce, Director of the OMB, or any other federal official. This publication may be used by nongovernmental organizations on a voluntary basis and is not subject to copyright in the United States. Attribution would, however, be appreciated by NIST. ## NIST Technical Series Policies

Copyright, Use, and Licensing Statements NIST Technical Series Publication Identifier Syntax

## Publication History

Approved by the NIST Editorial Review Board on 2024-04-23 Supersedes NIST Special Publication 800-171A (June 2018) https://doi.org/10.6028/NIST.SP.800-171A

## How to Cite this NIST Technical Series Publication:

Ross R, Pillitteri V (2024) Assessing Security Requirements for Controlled Unclassified Information and Organizations.

Assessing Security Requirements for Controlled Unclassified Information


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Digital Identity Guidelines_ Identity Proofing and Enrollment provide? (Part 7)

[Assistant]
2

23

23

24

iii

NIST SP 800-63A-4
July 2025

Digital Identity Guidelines
Identity Proofing and Enrollment

3.7. Additional Requirements for Federal Agencies

. . . . . . . . . . . . . . 3.8. 3.9.
Requirements for Confirmation Codes . . . . . . . . . . . . . . . . . . . Requirements for Continuation Codes . . . . . . . . . . . . . . . . . . . 3.10. Requirements for Notifications of Identity Proofing . . . . . . . . . . . . 3.11. Requirements for the Use of Biometrics . . . . . . . . . . . . . . . . . . 3.12. Requirements for Visual Facial Image Comparison . . . . . . . . . . . . 3.13. Requirements for the Validation of Physical Evidence . . . . . . . . . . . 3.14. Digital Injection Prevention and Forged Media Detection . . . . . . . . . 3.15. Exception and Error Handling . . . . . . . . . . . . . . . . . . . . . . . 3.15.1. Requirements for Trusted Referees . . . . . . . . . . . . . . . . 3.15.2. Uses of Trusted Referees . . . . . . . . . . . . . . . . . . . . . . 3.15.3. Requirements for Applicant References . . . . . . . . . . . . . . 3.15.4. Uses of Applicant References

. . . . . . . . . . . . . . . . . . . 3.15.5. Establishing Applicant Reference Relationships . . . . . . . . . . 3.15.6. Requirements for Interacting With Minors

. . . . . . . . . . . . 3.16. Elevating Subscriber IALs . . . . . . . . . . . . . . . . . . . . . . . . . . 4. Identity Assurance Level Requirements . . . . . . . . . . . . . . . . . . . . . 4.1. Identity Assurance Level 1 Requirements . . . . . . . . . . . . . . . . . 4.1.1. Proofing Types . . . . . . . . . . . . . . . . . . . . . . . . . . . 4.1.2. Evidence Collection . . . . . . . . . . . . . . . . . . . . . . . . 4.1.3. Attribute Collection . . . . . . . . . . . . . . . . . . . . . . . . 4.1.4. Evidence Validation . . . . . . . . . . . . . . . . . . . . . . . . 4.1.5. Attribute Validation . . . . . . . . . . . . . . . . . . . . . . . . 4.1.6. Verification Requirements . . . . . . . . . . . . . . . . . . . . . 4.1.7.

Digital Identity Guidelines_ Identity Proofing and Enrollment


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Configuration Management?

[Assistant]
According to Ascon-Based Lightweight Cryptography Standards for Constrained Devices_ Authenticated Encryption, Hash, and Extendable Output Functions:

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . |  15 |
| 4.2. Implementation Options . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . |  18 |
| 4.2.1. Truncation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . |  18 |
| 4.2.2. Nonce Masking . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . |  18 |
| 4.3. AEAD Requirements.............................................................. |  19 |
| 4.4. Security Properties . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . |  20 |
| 4.4.1. Single-Key Setting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . |  20 |
| 4.4.2. Multi-Key Setting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . |  20 |
| 4.4.3. Nonce-Misuse Setting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . |  21 |
| 5. Hash and eXtendable-Output Functions (XOFs) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . |  23 |
| 5.1. Specification of Ascon-Hash256 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . |  23 |
| 5.2. Specification of Ascon-XOF128 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . |  25 |
| 5.3. Specification of Ascon-CXOF128 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . |  28 |
| 5.4. Streaming API for XOF............................................................ |  30 |
| 5.5. Security Strengths . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Ascon-Based Lightweight Cryptography Standards for Constrained Devices_ Authenticated Encryption, Hash, and Extendable Output Functions