[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Risk Assessment?

[Assistant]
According to Guide to a Secure Enterprise Network Landscape:

Changes in application architecture: Application architectures - especially those of cloud-native applications - have changed from being monolithic to being microservices-based in order to meet the deployment agility and modular scalability requirements. This, combined with DevSecOps (a paradigm covering Development, Security and Operations) primitives such as continuous integration/continuous deployment (CI/CD) pipelines for the development and deployment of software, has improved the security profile of the applications but has also introduced new threat vectors related to the CI/CD workflows themselves. - Distributed nature of the application into ones located within a corporate data center, remote branch offices, and multiple cloud locations
- Perimeter approach based on the premise that the threat originates outside of the network, which is why most perimeter security solutions (e.g., intrusion prevention system - IPS, intrusion detection systems - IDS, firewalls) focus only on north-south traffic (i.e., ingress, which refers to traffic that originates from outside of the local network and destined for endpoints in the local cluster network). However, over 75 % of network traffic is now east-west (i.e., within the local network) or server-to-server (due to applications being based on microservices), which is largely invisible to security teams, though some visibility is now sought through endpoint detection and response (EDR) solutions that collect security telemetry data on endpoints. Any threat that is already inside of a network can move laterally and remain undetected for days or even months.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AC.L2-3.1.2 (NIST 3.1.2)?

[Assistant]
According to Data Integrity_ Detecting and Responding to Ransomware and Other Destructive Events:

3.1.2           | SP-ARC-001                   |
| DETECT (DE)                    | Anomalies and Events (DE. 3.1.2 Resolution

The build provides a significant defense in depth against this use case.

Data Integrity_ Detecting and Responding to Ransomware and Other Destructive Events


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Workshop on Enhancing Security of Devices and Components Across the Supply Chain provide? (Part 8)

[Assistant]
ex with many business drivers, relying on expertise at best cost across a global supply chain. This panel discussion focused on open security concerns in the hardware development life cycle. ## 2.1.1.
Speaker Viewpoints

The panel opened with Jonathan Ring, Deputy Assistant National Cyber Director for Technology Security from the Office of the National Cyber Director (ONCD). Jonathan reflected that ONCD's National Cybersecurity Strategy recognizes the importance of improving the cybersecurity of the Nation's critical infrastructure, which includes restoring the production of critical goods to the United States (US) as well as improving cybersecurity in the semiconductor/IC supply chain. Jonathan highlighted past achievements of the Biden-Harris Administration that overlap with cybersecurity in the hardware development life cycle, including:

- Shifting the balance of security to those best suited to bear it, as represented in the Cybersecurity and Infrastructure Security Agency's (CISA) Secure by Design initiative
- The NIST CHIPS (Creating Helpful Incentives to Produce Semiconductors) R&D Metrology Program, which outlines gaps in the semiconductor ecosystem
- Ongoing work through the Subcommittee for Microelectronics Leadership
- Eliminating entire classes of software vulnerabilities in Back to the Building Blocks: A Path Toward Secure and Measurable Software

Furthermore, Jonathan stressed the importance and continued need for public-private partnerships, like the Semiconductor Research Corporation and the Semiconductor Industry Association. He also stressed the need for continued conversations concerning advanced metrology for supply chain trust and assurance, guidelines for security analytics and automation, vulnerability management across all product life cycles, and the use of machine learning in chip design and manufacturing. The second speaker for the panel was Adam Golodner, advisor to the Semiconductor Industry Association.

Workshop on Enhancing Security of Devices and Components Across the Supply Chain

Audit and Accountability
System and Information Integrity
Security Assessment
Media Protection
Identification and Authentication
Awareness and Training
System and Communications Protection
Access Control
Planning
Incident Response
Risk Assessment
Personnel Security
System and Services Acquisition
Supply Chain Risk Management
Maintenance
Physical Protection
Configuration Management


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice CM.L2-3.4.1 (NIST 3.4.1)?

[Assistant]
According to Data Integrity_ Detecting and Responding to Ransomware and Other Destructive Events:

3.4.1                                                                                | Risk... 3.4.1, Risk, provides a description of the risk analysis we performed. 3.4.1 Risk

Using the guidance in NIST's series of publications concerning risk, we worked with financial institutions and the Financial Sector Information Sharing and Analysis Center to identify the most compelling risk factors encountered by this business group.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Planning?

[Assistant]
According to Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule_ A Cybersecurity Resource Guide:

There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may be used by federal agencies even before the completion of such companion publications. Thus, until each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning and transition purposes, federal agencies may wish to closely follow the development of these new publications by NIST.

Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule_ A Cybersecurity Resource Guide


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for System and Services Acquisition?

[Assistant]
According to Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171:

........................................................................ | CHAPTERONE INTRODUCTION......................................................................................................
|
|--------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------|
| 1.1 PURPOSEANDAPPLICABILITY                                                                                | ................................................................................................... 3                                            |
| 1.2 TARGET AUDIENCE                                                                                | .................................................................................................................. 4                             |
| 1.3 ORGANIZATIONOF THIS SPECIAL PUBLICATION                                                                                | .......................................................................... 4                                                                     |
| CHAPTERTWO THE FUNDAMENTALS............................................................................................ 5                        | CHAPTERTWO THE FUNDAMENTALS............................................................................................ 5                        |
| 2.1 DEVELOPMENTAPPROACH ......................................................................................................

Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Security Assessment?

[Assistant]
According to Incident Response Recommendations and Considerations for Cybersecurity Risk Management_ A CSF 2.0 Community Profile:

|
| ID.RA-10            | Critical suppliers are assessed prior to acquisition                                                                                | Low        | N1: See the notes for ID.RA. |
| ID.IM (Improvement) | Improvements to organizational cybersecurity risk management processes, procedures, and activities are identified across all CSF Functions    | Medium     | N1: See the note for ID. |
| ID.IM-01            | Improvements are identified from evaluations                                                                                | Medium     | R1: Periodically evaluate incident response program performance to identify problems and deficiencies that should be corrected. N1: Possible evaluation forms include self- assessments, third-party assessments, and independent audits. |
| ID.IM-02            | Improvements are identified from security tests and exercises, including those done in coordination with suppliers and relevant third parties | High       | N1: Incident response exercises and tests may provide helpful information for program evaluation and prepare staff and involved third parties (e.g., critical service providers and product suppliers) for future incident response activities. N2: See [SP800-84] for more information on simulations, tabletop discussions, and other forms of exercises. |
| ID.IM-03            | Improvements are identified from the execution of operational processes, procedures, and activities                                           | High       | N1: The execution of operational processes, procedures, and activities includes all incident response and recovery efforts.

Incident Response Recommendations and Considerations for Cybersecurity Risk Management_ A CSF 2.0 Community Profile


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Planning?

[Assistant]
According to Guidelines for Media Sanitization:

There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may be used by federal agencies even before the completion of such companion publications. Thus, until each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning and transition purposes, federal agencies may wish to closely follow the development of these new publications by NIST.

The need and methods for conducting media sanitization should be identified and developed before arriving at the disposal phase in the system life cycle. ISM sanitization controls should be developed, documented, and deployed when the initial system security plan is developed [12].


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 1 require for Awareness and Training?

[Assistant]
According to Summary Report for “Workshop on Updating Manufacturer Guidance for Securable Connected Product Development”:

|   1. | Government actions to support strengthening IoT cybersecurity need to be coordinated with industry. |
|------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
|    2 | The use of robust frameworks and the adoption of open standards are crucial for effectively managing risks across heterogeneous environments. |
|    3 | The dynamic nature of threats requires more context aware inputs, more proactive tracking and mitigation measures, and more examination into the inputs of the threat modeling approach. |
|    4 | There are market opportunities to securely design the next wave of products with cybersecurity through end of life and instill incentives into the maintenance of existing products. |
|    5 | The balance of shared responsibility between manufacturers and users for improving security varies by sector and needs the right incentives for both. |
|    6 | There are broad challenges to integrating privacy objectives into IoT cybersecurity risk management. |
|    7 | There is an increased awareness for evolving cybersecurity responsibilities across the players of the IoT ecosystem from manufacturers to users of the ecosystem. |

Stacey Higginbotham of Consumer Reports noted that connected devices establish an ongoing relationship between the buyer,  seller, and manufacturer. The lifetime of a connected product is often separate from its physical state. While physical products fail in visible ways, software degrades more quickly, often without consumer awareness. The industry also lacks adequate support for maintenance. Stacey's discussion highli ghted three key areas: zombie hordes of end of life devices, supported devices with unsupportive owners, and herd immunity against malicious actors. ' Zombie devices ' are those that no longer receive software support and security updates.

Summary Report for “Workshop on Updating Manufacturer Guidance for Securable Connected Product Development”


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Physical Protection?

[Assistant]
According to Risk Management Framework for Information Systems and Organizations_ A System Life Cycle Approach for Security and Privacy:

or mobile devices/systems, do not require a separate risk management process but rather a tailored set of controls and specific implementation details determined by applying the existing RMF process.
1  An information system is a discrete set of information resources organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of information [44 USC 3502]. The term information system includes, for example, general-purpose computing systems; industrial/process control systems; cyber-physical systems; weapons systems; super computers; command, control, and communications systems; devices such as smart phones and tablets; environmental control systems; embedded devices/sensors; and paper-based systems.

Risk Management Framework for Information Systems and Organizations_ A System Life Cycle Approach for Security and Privacy


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Summary of NIST SP 800-53, Revision 4_ Security and Privacy Controls for Federal Information Systems and Organizations provide? (Part 9)

[Assistant]
tise, and understanding. Appendix E provides three tables that identify specific assurance-related controls that are included in the low-, moderate-, and high-impact baselines described in Appendix D.
The controls described assist organizations in defining the controls needed to satisfy minimum assurance requirements. Where additional assurance is desired to achieve risk management objectives, Table E-4 provides additional security controls and control enhancements to achieve enhanced assurance. Implementers should note that designation of assurance-related controls is not intended to imply a greater level of importance for such controls. Achieving adequate security for organizational information systems requires the correct combination of both functionality- and assurance-related security controls. ## 6 Security Controls

Appendix F, the Security Control Catalog, provides a comprehensive range of countermeasures for organizations and information systems. The security controls are designed to be technologyneutral such that the focus is on the fundamental countermeasures needed to protect organizational information during processing, storage, or transmission. SP 800-53 Rev. 4, therefore, does not provide guidance on the application of security controls to specific technologies, environments of operation, or missions/business functions. These specific areas may be addressed using overlays (see below). Control enhancements are included with many security controls and are selected in order to increase the strength of the base control. Control enhancements are intended to be implemented only in conjunction with implementation of the base control. Some security controls and control enhancements include one or more assignment and selection statements. These are variable parameters that organizations define, providing them with the ability to tailor security controls based on specific security requirements, environments of operation, and organizational risk tolerance.

Summary of NIST SP 800-53, Revision 4_ Security and Privacy Controls for Federal Information Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What are the CMMC Level 1 requirements?

[Assistant]
According to IoT Device Cybersecurity Capability Core Baseline:

ts, guidelines, and procedures, where they exist, remain operative. For planning and transition purposes, federal agencies may wish to closely follow the development of these new publications by NIST.
Organizations are encouraged to review all draft publications during public comment periods and provide feedback to NIST. Many NIST cybersecurity publications, other than the ones noted above, are available at https://csrc.nist.gov/publications. ## Comments on this publication may be submitted to:

National Institute of Standards and Technology Attn: Applied Cybersecurity Division, Information Technology Laboratory 100 Bureau Drive (Mail Stop 2000) Gaithersburg, MD 20899-2000

Email: iotsecurity@nist.gov

All comments are subject to release under the Freedom of Information Act (FOIA). ## Reports on Computer Systems Technology

The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the Nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology. ITL's responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in federal information systems. ## Abstract

Device cybersecurity capabilities are cybersecurity features or functions that computing devices provide through their own technical means (i.e., device hardware and software). This publication defines an Internet of Things (IoT) device cybersecurity capability core baseline, which is a set of device capabilities generally needed to support common cybersecurity controls that protect an organization's devices as well as device data, systems, and ecosystems.

IoT Device Cybersecurity Capability Core Baseline


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Access Control?

[Assistant]
According to Ascon-Based Lightweight Cryptography Standards for Constrained Devices_ Authenticated Encryption, Hash, and Extendable Output Functions:

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . |  15 |
| 4.2. Implementation Options . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . |  18 |
| 4.2.1. Truncation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . |  18 |
| 4.2.2. Nonce Masking . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . |  18 |
| 4.3. AEAD Requirements.............................................................. |  19 |
| 4.4. Security Properties . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . |  20 |
| 4.4.1. Single-Key Setting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . |  20 |
| 4.4.2. Multi-Key Setting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . |  20 |
| 4.4.3. Nonce-Misuse Setting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . |  21 |
| 5. Hash and eXtendable-Output Functions (XOFs) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . |  23 |
| 5.1. Specification of Ascon-Hash256 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . |  23 |
| 5.2. Specification of Ascon-XOF128 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . |  25 |
| 5.3. Specification of Ascon-CXOF128 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . |  28 |
| 5.4. Streaming API for XOF............................................................ |  30 |
| 5.5. Security Strengths . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Ascon-Based Lightweight Cryptography Standards for Constrained Devices_ Authenticated Encryption, Hash, and Extendable Output Functions


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Access Control?

[Assistant]
According to Assessing Security and Privacy Controls in Information Systems and Organizations:

In developing standards and guidelines required by [FISMA], NIST consults with other federal agencies and
offices as well as private sector entities to improve information security, avoid unnecessary and costly
duplication of effort, and ensure that NIST publications complement the standards and guidelines
employed for the protection of national security systems. In addition to its comprehensive public review
and vetting process, NIST collaborates with the Office of the Director of National Intelligence (ODNI), the
Department of Defense (DoD), and the Committee on National Security Systems (CNSS) to establish and
maintain a unified framework and common foundation for information security across the Federal
Government. A common foundation and framework for information security provides the intelligence,
defense, and civilian sectors of the Federal Government and their contractors more uniform and
consistent ways to manage risks to organizational operations and assets, individuals, other organizations,
and the Nation that result from the operation and use of systems. A common foundation and framework
also provides a strong basis for the reciprocal acceptance of security authorization decisions and facilitate
information sharing. NIST also works with public and private sector entities to establish and maintain
specific mappings and relationships between the security standards and guidelines developed by NIST, the
International Organization for Standardization (ISO), and the International Electrotechnical Commission
(IEC).

Assessing Security and Privacy Controls in Information Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Audit and Accountability?

[Assistant]
According to Summary of NIST SP 800-53, Revision 4_ Security and Privacy Controls for Federal Information Systems and Organizations:

- Authority and Purpose (AP);
- Accountability, Audit, and Risk Management (AR);
- Data Quality and Integrity (DI);
- Data Minimization and Retention (DM);
- Individual Participation and Redress (IP);
- Security (SE);
- Transparency (TR); and,
- Use Limitation (UL).


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Secure Software Development Practices for Generative AI and Dual-Use Foundation Models_ An SSDF Community Profile provide? (Part 5)

[Assistant]
gement, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in federal information systems.
The Special Publication 800-series reports on ITL's research, guidelines, and outreach efforts in information system security, and its collaborative activities with industry, government, and academic organizations. ## Audience

There are three primary audiences for this document:

- AI model producers - Organizations that are developing their own generative AI and dual-use foundation models, as defined in EO 14110
- AI system producers - Organizations that are developing software that leverages a generative AI or dual-use foundation model
- AI system acquirers 1 - Organizations that are acquiring a product or service that utilizes one or more AI systems

Individuals who are interested in better understanding secure software development practices for AI models may also benefit from this document. Readers are not expected to be experts in secure software development or AI model development, but such expertise may be needed to implement these recommended practices. ## Note to Readers

If you are from a standards developing organization (SDO) or another organization that is defining a set of secure practices for AI model development and you would like to map your standard or guidance to the SSDF profile, please contact the authors at ssdf@nist.gov. They will introduce you to the National Online Informative References Program (OLIR), where you can submit your mapping to augment the existing set of informative references. The authors also welcome feedback at any time on any part of the document, as well as suggestions for Implementation Examples and Informative References to add to this document. All feedback should be sent to ssdf@nist.gov. ## Trademark Information

All registered trademarks belong to their respective organizations.

Secure Software Development Practices for Generative AI and Dual-Use Foundation Models_ An SSDF Community Profile


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AT.L2-3.2.1 (NIST 3.2.1)?

[Assistant]
According to Digital Identity Guidelines_ Identity Proofing and Enrollment:

3.2.1. 3.2.1. 3.2.12 of [SP800-63B]).

Digital Identity Guidelines_ Identity Proofing and Enrollment


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Risk Assessment?

[Assistant]
According to Multi-Factor Authentication for Criminal Justice Information Systems_ Implementation Considerations for Protecting Criminal Justice Information:

The Criminal Justice Information Services (CJIS) Security Policy versions 5.9.2 and later [1] require the use of multi-factor authentication (MFA) to protect access to criminal justice information (CJI). MFA is important for protecting against credential compromises and other cyber risks that may threaten CJI. Criminal and non-criminal justice agencies around the country will need to work with their technology vendors to implement this CJIS requirement. Credential compromises represent a critical and pervasive cybersecurity threat, serving as a gateway for malicious actors to infiltrate networks and systems, thus gaining access to sensitive data. Whether through phishing, brute-force attacks, or exploiting vulnerabilities in authentication mechanisms, credential compromise poses a significant risk to organizations and individuals alike. To mitigate this threat, version 5.9.2 and subsequent versions of the Federal Bureau of Investigation (FBI) Criminal Justice Information Services (CJIS) Security Policy [1] require multi-factor authentication (MFA) for all users when accessing criminal justice information (CJI). Both criminal and non-criminal justice agencies that receive CJI are subject to this requirement. In this document, we refer to these organizations generically as agencies . - [1] U.S. Department of Justice (2024) Criminal Justice Information Services (CJIS) Security Policy, Version 6.0. CJISSECPOL v6.0. Available at https://le.fbi.gov/filerepository/cjis\_security\_policy\_v6-0\_20241227.pdf
- [2] Wisconsin Law Enforcement Network (2024) Public Safety Threat Report: 2024 Threat Landscape. https://wilenet.widoj.gov/sites/default/files/public\_files-2025-02/ijis2024-threat-landscape-report.pdf
- [3] Temoshok D, Proud-Madruga D, Choong YY, Galluzzo R, Gupta S, LaSalle C, Lefkovitz N, Regenscheid A (2025) Digital Identity Guidelines. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) 800-63-4.

Multi-Factor Authentication for Criminal Justice Information Systems_ Implementation Considerations for Protecting Criminal Justice Information


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171 provide? (Part 4)

[Assistant]
pment of management, administrative, technical, and physical standards and guidelines for the costeffective security of other than national security-related information in federal information systems.
The Special Publication 800-series reports on ITL's research, guidelines, and outreach efforts in information systems security and privacy and its collaborative activities with industry, government, and academic organizations. ## Abstract

The protection of Controlled Unclassified Information (CUI) resident in nonfederal systems and organizations is of paramount importance to federal agencies and can directly impact the ability of the Federal Government to successfully conduct its essential missions and functions. This publication provides federal agencies with recommended enhanced security requirements for protecting the confidentiality of CUI: (1) when the information is resident in nonfederal systems and organizations; (2) when the nonfederal organization is not collecting or maintaining information on behalf of a federal agency or using or operating a system on behalf of an agency; and (3) where there are no specific safeguarding requirements for protecting the confidentiality of CUI prescribed by the authorizing law, regulation, or government-wide policy for the CUI category listed in the CUI Registry. The enhanced requirements apply to components of nonfederal systems that process, store, or transmit CUI or that provide security protection for such components when the designated CUI is associated with a critical program or high value asset. The enhanced requirements supplement the basic and derived security requirements in NIST Special Publication 800-171 and are intended for use by federal agencies in contractual vehicles or other agreements established between those agencies and nonfederal organizations.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Information Integrity?

[Assistant]
According to Secure Software Development Practices for Generative AI and Dual-Use Foundation Models_ An SSDF Community Profile:

| Practice | Task | Priority | Recommendations [R], Considerations [C], and Notes [N] Specific to AI Model Development | Informative References | |------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------|------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------| | | PO.3.3: Configure tools to generate artifacts of their support of secure software development practices as defined by the organization.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Contingency Planning Guide for Federal Information Systems provide? (Part 7)

[Assistant] Background ....................................................................................................5 | Chapter 2. Background ....................................................................................................5                                                                                | Chapter 2.

Contingency Planning Guide for Federal Information Systems


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Physical Protection?

[Assistant]
According to Zero Trust Architecture:

Enterprise Campus Network (red de las instalaciones de la empresa). Internal App Server (servidor  de  aplicaciones  interno). Database (base  de  datos). Internet (Internet). Employees (empleados). Employee (empleado). Contractor  Service  Tech (técnico  de  servicio  de  contratistas ).  Contracted HVAC (contratación de climatización). Conference Center (centro de conferencias). Visitors (visitantes).


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Configuration Management?

[Assistant]
According to Summary of NIST SP 800-53, Revision 4_ Security and Privacy Controls for Federal Information Systems and Organizations:

| 1 | Introduction ............................................................................................................1 | |------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------| | 2 | NIST SP 800-53 Revision 4 and the Risk Management Framework (RMF)........2 | | 3 | Control Baselines and Tailoring ...........................................................................4 | | 4 | Documenting the Control Selection Process ......................................................5 | | 5 | Assurance...............................................................................................................6 | | 6 | Security Controls ...................................................................................................7 | | 7 | International Information Security Standards .....................................................8 | | 8 | Overlays..................................................................................................................9 | | 9 | Privacy ..................................................................................................................10 | | List of Figures | List of Figures | | Figure 1: Risk Management 3-Tiered Approach.........................................................2 | Figure 1: Risk Management 3-Tiered Approach.........................................................2 | | Figure 2: The Risk Management Framework ..............................................................3 | Figure 2: The Risk Management Framework ..............................................................3 | | Figure 3: Security Control Selection Process ............................................................5 | Figure 3: Security Control Selection Process ............................................................5 |


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for Planning?

[Assistant]
According to Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171:

There may be references in this publication to other publications currently under development by  NIST  in  accordance  with  its  assigned  statutory  responsibilities.  The  information  in  this publication, including concepts, practices, and methodologies, may be used by federal agencies even  before  the  completion  of  such  companion  publications.  Thus,  until  each  publication  is completed,  current  requirements,  guidelines,  and  procedures,  where  they  exist,  remain operative. For planning and transition purposes, federal agencies may wish to closely follow the development of these new publications by NIST.

The enhanced security requirements are organized into 14 families consistent with the families for basic and derived requirements. Each family contains the requirements related to the general security topic of the family. The families are closely aligned with the minimum security requirements for federal information and information systems in [FIPS 200]. The security requirements for contingency planning , system and services acquisition , and planning are not included within the scope of this publication due to the tailoring criteria in [SP 800-171]. Table 1 lists the security requirement families addressed in this publication. 17

- 3.11.4e  Document or reference in the system security plan the security solution selected, the rationale for the security solution, and the risk determination.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Maintenance?

[Assistant]
According to Security and Privacy Controls for Information Systems and Organizations:

...................................................................... 14
CHAPTER THREE   THE CONTROLS .................................................................................................
16
3.1   ACCESS CONTROL .................................................................................................................. 18
3.2   AWARENESS AND TRAINING ................................................................................................... 59
3.3   AUDIT AND ACCOUNTABILITY ................................................................................................. 65
3.4   ASSESSMENT, AUTHORIZATION, AND MONITORING ................................................................. 83
3.5   CONFIGURATION MANAGEMENT ........................................................................................... 96
3.6   CONTINGENCY PLANNING .................................................................................................... 115
3.7   IDENTIFICATION AND AUTHENTICATION ............................................................................... 131
3.8   INCIDENT RESPONSE ............................................................................................................ 149
3.9   MAINTENANCE .................................................................................................................... 162
3.10   MEDIA PROTECTION .......................................................................................................... 171
3.11   PHYSICAL AND ENVIRONMENTAL PROTECTION .................................................................... 179
3.12   PLANNING ........................................................................................................................ 194
3.13   PROGRAM MANAGEMENT .................................................................................................

Security and Privacy Controls for Information Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Audit and Accountability?

[Assistant]
According to Addressing Visibility Challenges with TLS 1.3 within the Enterprise_ High-Level Document:

olidated, centralized, and correlated. -  When logging of network traffic is turned off or reduced, which is often the case, visibility into network data may be the only alternative to see anomalies.
Visibility into network data is preferable when the endpoint (or a middlebox , a network device that often intercepts and manipulates network traffic for security, optimization, or content filtering ) platform is incapable of adequate logging without causing utilization or performance issues on the platform. -  There are many security threats that are more easily identifiable or only visible with visibility into network data. Where and how the network data is identified and collected can reveal key information about security threats . -  Staff can analyze network data to ensure that endpoint security agents are operating properly . If an endpoint is compromised or its security agent is not running properly, network data is the only line of defense and the most critical tool for performing related triage and forensics to quickly resolv e related issues. -  If network data cannot be decrypted, a security breach, malware, or other compromise can more easily spread throughout the entire organization via a single platform. -  Nearly all attacks occur over the network-leaving behind traces or tracks. To understand q uestionable traffic , it is necessary to understand the source of the traffic. Without decrypt ion, you cannot gain such insights, nor can you detect, trace, or eliminate malicious actions . -  Root cause analysis is critical to most large organizations. Forensics performed after a breach or other security exposure event depends heavily on DPI and network data to figure out what happened, why, and what can be done about it. Alternatives to DPI require significant time and effort and are generally prohibitively disruptive and expensive.

Addressing Visibility Challenges with TLS 1.3 within the Enterprise_ High-Level Document


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Information Integrity?

[Assistant]
According to Audit and Evaluation of Computer Security II_ System Vulnerabilities and Controls:

| 4.2         | Access Policies                                                                                | 4-12      |
|-------------|------------------------------------------------------------------------------------------------|-----------|
| 4.3         | Unauthorized Statistical Disclosure                                                            | 4-12      |
| 4.4         | Transaction Trail                                                                              | 4-13      |
|             | 4.4.1 Automated Journals                                                                       | 4-13      |
| 4.5         | Data Checks and Integrity                                                                      | 4-13      |
| 5. | APPLICATIONS INTERFACE                                                                         | 4-14      |
| 5.1         | General                                                                                | 4-14      |
| 5.2         | System Development Controls                                                                    | 4-14      |
| 5.3         | Project Definition                                                                             | 4-14      |
| 5.4         | System Design                                                                                | 4-15      |
| 5.5         | Detailed Design and Programming                                                                | 4-15      |
| 5.6         | System Testing                                                                                | 4-15      |
| 5.7 6.

Audit and Evaluation of Computer Security II_ System Vulnerabilities and Controls


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AU.L2-3.3.4 (NIST 3.3.4)?

[Assistant]
According to Recommendation for Pair-Wise Key-Establishment Using Integer Factorization Cryptography:

3.3.4 KAS2-bilateral-confirmation... 3.3.4. 3.3.4 can be used to provide assurance to a key-pair owner acting as either party U or party V that both parties are in  possession of the correct private key; i.

Recommendation for Pair-Wise Key-Establishment Using Integer Factorization Cryptography


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Summary of NIST SP 800-53, Revision 4_ Security and Privacy Controls for Federal Information Systems and Organizations provide? (Part 3)

[Assistant] The guide was developed and is maintained by the Joint Task Force Transformation Initiative Interagency Working Group, part of an ongoing information security partnership among the U.S. Department of Defense, the Intelligence Community, the Committee on National Security Systems, the Department of Homeland Security, and U.S. federal civil agencies. SP 800-53 Revision 4 has been updated to reflect the evolving technology and threat space. Example areas include issues particular to mobile and cloud computing; insider threats; applications security; supply chain risks; advanced persistent threat; and trustworthiness, assurance, and resilience of information systems. The revision also contains a new appendix of privacy controls, and related implementation guidance (Appendix J), based on the Fair Information Practice Principles (FIPPs), a widely accepted framework of defining principles to be used in the evaluation and consideration of systems, processes, or programs that affect individual privacy. SP 800-53 Revision 4 is part of the NIST Special Publication 800-series that reports on the NIST Information Technology Laboratory's (ITL) computer security-related research, guidelines, and outreach. The publication provides a comprehensive set of security controls, three security control baselines (low, moderate, and high impact), and guidance for tailoring the appropriate baseline to specific needs according to the organization's missions, environments of operation, and technologies used. As the risk to an information system's confidentiality, integrity and/or availability increases, the need for additional controls to protect the system may also increase accordingly. SP 800-53 Revision 4 provides the security control baselines as the starting point for the security control selection process.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 2 require for Personnel Security?

[Assistant]
According to Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations:

......................98      |
| Table 11. Maintenance (MA) ......................................................................................................................98      |
| Table 12.
Media Protection (MP)................................................................................................................99        |
| Table 13. Physical and Environmental Protection (PE)...............................................................................99                    |
| Table 14. Planning (PL)..............................................................................................................................100 |
| Table 15. Program Management (PM) .....................................................................................................100               |
| Table 16. Personnel Security (PS) .............................................................................................................101       |
| Table 17. PII Processing and Transparency (PT) .......................................................................................102                |
| Table 18. Risk Assessment (RA) ................................................................................................................102       |
| Table 19. System and Services Acquisition (SA)........................................................................................103                |
| Table 20. System and Communications Protection (SC)...........................................................................103                        |
| Table 21. System and Information Integrity (SI) .......................................................................................104               |
| Table 22. Supply Chain Risk Management (SR).........................................................................................105                  |
| Table 23.

Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Digital Identity Guidelines_ Authentication and Authenticator Management provide? (Part 5)

[Assistant]
gement, administrative, technical,
and physical standards and guidelines for the cost-effective security and privacy of other
than national security-related information in federal information systems.
The Special
Publication 800-series reports on ITL’s research, guidelines, and outreach efforts in
information system security, and its collaborative activities with industry, government,
and academic organizations. i

NIST SP 800-63B-4
July 2025

Digital Identity Guidelines
Authentication and Authenticator Management

Patent Disclosure Notice

NOTICE: ITL has requested that holders of patent claims whose use may be required for
compliance with the guidance or requirements of this publication disclose such patent
claims to ITL. However, holders of patents are not obligated to respond to ITL calls for
patents and ITL has not undertaken a patent search in order to identify which, if any,
patents may apply to this publication. As of the date of publication and following call(s) for the identification of patent claims
whose use may be required for compliance with the guidance or requirements of this
publication, no such patent claims have been identified to ITL. No representation is made or implied by ITL that licenses are not required to avoid
patent infringement in the use of this publication. ii

NIST SP 800-63B-4
July 2025

Table of Contents

Digital Identity Guidelines
Authentication and Authenticator Management

1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1.1. Notations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1.2. Document Structure . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2. Authentication Assurance Levels . . . . . . . . . . . . . . . . . . . . . . . . . 2.1. Authentication Assurance Level 1 . . . . . . . . . . . . . . . . . . . . . 2.1.1. Permitted Authenticator Types

. . . . . . . . . . . . . . . . . . 2.1.2. Authenticator and Verifier Requirements . . . . . . . . . . . . .

Digital Identity Guidelines_ Authentication and Authenticator Management


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Maintenance?

[Assistant]
According to Guidelines for the Use of PIV Credentials in Facility Access:

| [RFC5280]     | D. Cooper, S. Santesson, S. Farrell, S. Boeyen, R. Housley, and W. Polk, Inter X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile , Internet Engineering Task Force (IETF) Network Working Group Request for Comments (RFC) 5280, May 2008. https://doi.org/10.17487/RFC5280. |
|---------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| [SECTION508]  | Section 508 of the Rehabilitation Act of 1973, as amended , 29 U.S.C. §794(d), https://www.section508.gov [accessed 5/16/18]. |
| [SKIMMER]     | I. Kirschenbaum and A. Wool, 'How to Build a Low-Cost, Extended-Range RFID Skimmer,' Proceedings of the 15th USENIX Security Symposium (Security '06) , Vancouver, British Columbia, Canada, July 31 - August 4, 2006, USENIX Association: Berkeley, California, 2006, pp. 43-57. https://www.usenix.org/legacy/event/sec06/tech/full_papers/kirschenbaum/ kirschenbaum.pdf [accessed 3/1/17]. |
| [SP800-73]    | NIST Special Publication 800-73-4, Interfaces for Personal Identity Verification, May 2015 (including updates as of 2/8/16). https://doi.org/10.6028/NIST.SP.800-73-4. |
| [SP800-76]    | NIST Special Publication 800-76-2, Biometric Specifications for Personal Identity Verification , July 2013. https://doi.org/10.6028/NIST.SP.800-76-2. |
| [SP800-78]    | NIST Special Publication 800-78-4, Cryptographic Algorithms and Key Sizes for Personal Identity Verification , May 2015. https://doi.org/10.6028/NIST.SP.800-78-4. |
| [SP800-87]    | NIST Special Publication 800-87 Revision 2, Codes for the Identification of Federal and Federally-Assisted Organizations , April 2018.

Guidelines for the Use of PIV Credentials in Facility Access


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Personnel Security?

[Assistant]
According to Guide to Auditing for Controls and Security_ A System Development Life Cycle Approach:

velopers will also find it useful guidance on security and control issues. The guide is designed to provide audit/review programs for each major phase of the SDLC and assumes a large sensitive system.
The reader is expected to make appropriate modifications for a small less sensitive system.

Guide to Auditing for Controls and Security_ A System Development Life Cycle Approach


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Organizational Views of NIST Cryptographic Standards and Testing and Validation Programs provide? (Part 8)

[Assistant]
|

## Introduction

Cryptography is an essential component of modern computing.
Unfortunately, implementing cryptography correctly is a non-trivial undertaking. Past research studies have supported this observation by revealing a multitude of errors and developer pitfalls in the cryptographic implementations of software products [1-5]. However, these studies focused on the practices of less-experienced, individual developers. Therefore, there was little understanding of the cryptographic development practices of organizations, including the benefits and challenges of using cryptographic resources such as standards specifications and libraries. To address this gap, between January and September 2017, a four-person research team led by the National Institute of Standards and Technology (NIST) Information Technology Laboratory Visualization and Usability Group conducted a qualitative investigation into the processes and resources that organizations employ in the development and testing of cryptographic products. The study involved in-depth interviews of participants representing organizations that develop either a security product that uses cryptography or a non-security product that heavily relies on cryptography. The study aimed to answer the following research questions:

- What are the cryptographic development and testing practices of organizations? - What challenges, if any, do organizations encounter while developing and testing these products? - What cryptographic resources do these organizations use, and what are their reasons for choosing them? This NIST Internal Report (NISTIR) is a companion to the research paper 'We make it a big deal in the company': Security Mindsets in Organizations that Develop Cryptographic Products [6].

Organizational Views of NIST Cryptographic Standards and Testing and Validation Programs


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Security Assessment?

[Assistant]
According to Cryptographic Module Validation Program (CMVP)-Approved Sensitive Security Parameter Generation and Establishment Methods_ CMVP Validation Authority U:

Cryptographic Module Validation Program; CMVP; FIPS 140 testing; FIPS 140-3; ISO/IEC 19790; ISO/IEC 24759; sensitive security parameter establishment methods; sensitive security parameter generation; testing requirement; vendor evidence; vendor documentation.

This document is intended for use by vendors, testing labs, and the CMVP.

Cryptographic Module Validation Program (CMVP)-Approved Sensitive Security Parameter Generation and Establishment Methods_ CMVP Validation Authority U


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Maintenance?

[Assistant]
According to Digital Identity Guidelines:

Additional information about this publication is available at https://csrc.nist.gov/pubs/
sp/800/63/4/final, including related content, potential updates, and document history.

3.7.

collection, maintenance, use, and disclosure of information about individuals that
is maintained by federal agencies in systems of records


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Media Protection?

[Assistant]
According to Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule_ A Cybersecurity Resource Guide:

| Standard | Sections | Implementation Specifications (R) = Required, (A) = Addressable | |-----------------------------------------------------|---------------------------|-------------------------------------------------------------------| | Administrative Safeguards | Administrative Safeguards | Administrative Safeguards | | Security Management Process | 164.308(a)(1) | Risk Analysis (R) | | Security Management Process | 164.308(a)(1) | Risk Management (R) | | Security Management Process | 164.308(a)(1) | Sanction Policy (R) | | Security Management Process | 164.308(a)(1) | Information System Activity Review (R) | | Assigned Security Responsibility | 164.308(a)(2) | (R) | | Workforce Security | 164.308(a)(3) | Authorization and/or Supervision (A) | | Workforce Security | 164.308(a)(3) | Workforce Clearance Procedure (A) | | Workforce Security | 164.308(a)(3) | Termination Procedures (A) | | Information Access Management | 164.308(a)(4) | Isolating Health care Clearinghouse Function (R) | | Information Access Management | 164.308(a)(4) | Access Authorization (A) | | Information Access Management | 164.308(a)(4) | Access Establishment and Modification (A) | | Security Awareness and Training | 164.308(a)(5) | Security Reminders (A) | | Security Awareness and Training | 164.308(a)(5) | Protection from Malicious Software (A) | | Security Awareness and Training | 164.308(a)(5) | Log-in Monitoring (A) | | Security Awareness and Training | 164.308(a)(5) | Password Management (A) |

Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule_ A Cybersecurity Resource Guide


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Strategies for the Integration of Software Supply Chain Security in DevSecOps CI_CD Pipelines provide? (Part 10)

[Assistant]
cations are developed through an agile software development life cycle (SDLC) paradigm called DevSecOps, which uses flow processes called Continuous Integration/ Continuous Delivery (CI/CD) pipelines.
The security of applications during runtime is ensured through various security measures, such as assigning unique service identities for microservices and subjects that invoke those services and policy enforcement through proxies. However, sophisticated attacks on software have been carried out through the stealthy introduction of attack vectors during various activities in the SDLC, which collectively constitute the software supply chain (SSC). Thus, in the context of cloud-native applications, SSC security assurance measures must be integrated into CI/CD pipelines. ## 1.1. Purpose

This document outlines strategies for integrating SSC security assurance measures into CI/CD pipelines to protect the integrity of the underlying activities. The overall goal is to ensure that the CI/CD pipeline activities that take source code through the build, test, package, and deployment stages are not compromised. ## 1.2. Scope

SSC security assurance measures use various artifacts, such as a software bill of materials (SBOM) and frameworks for the attestation of software components. The specification of these artifacts, their mandatory constituents, and the requirements that processes using them must satisfy are continually evolving through projects in government organizations and various industry forums and are, therefore, beyond the scope of this document. Rather, this document focuses on actionable measures to integrate various building blocks for SSC security assurance into CI/CD pipelines to enhance the preparedness of organizations to address SSC security in the development and deployment of their cloud-native applications. ## 1.3.

Strategies for the Integration of Software Supply Chain Security in DevSecOps CI_CD Pipelines


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for Supply Chain Risk Management?

[Assistant]
According to Protecting Controlled Unclassified Information (CUI)_ NIST Special Publication 800-171, Revision 3. Small Business Primer:

| Access Control                    | Maintenance         | Security Assessment and Monitoring   |
|-----------------------------------|---------------------|--------------------------------------|
| Awareness and Training            | Media Protection    | System and Communications Protection |
| Audit and Accountability          | Personnel Security  | System and Information Integrity     |
| Configuration Management          | Physical Protection | Planning                             |
| Identification and Authentication | Risk Assessment     | System and Services Acquisition      |
| Incident Response                 |                     | Supply Chain Risk Management         |

| How can I 'comply' with SP 800-171? | NIST does not have a role in determining compliance with the security requirements in SP 800-171. If you have questions regarding requirements to protect CUI or other regulatory requirements, please contact your prime contractor and/or federal point of contact for the contract. |
|----------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| How do I know if I have CUI? | It is the responsibility of the federal agency to ensure that requirements to protect CUI are identified in applicable contracts or agreements, and CUI is marked by the federal agency. |
| How do I get a 'NIST SP 800 -171 Assessment'?

Protecting Controlled Unclassified Information (CUI)_ NIST Special Publication 800-171, Revision 3. Small Business Primer


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Maintenance?

[Assistant]
According to Data Integrity_ Detecting and Responding to Ransomware and Other Destructive Events:

| 1 | Summary..............................................................................................1 | Summary..............................................................................................1 | |-----|------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | | 1.1 | Challenge.......................................................................................................................2 | | | 1.2 | Solution..........................................................................................................................2 | | | 1.3 | Benefits..........................................................................................................................3 | | 2 | How to Use This Guide.........................................................................4 | How to Use This Guide.........................................................................4 | | | 2.1 | Typographic Conventions..............................................................................................5 | | 3 | Approach .............................................................................................6 | Approach .............................................................................................6 | | | 3.1 | Audience........................................................................................................................6 | | | 3.2 | Scope .............................................................................................................................6 | | | 3.3 | Assumptions..................................................................................................................7 | | | 3.4 | Risk Assessment ............................................................................................................7 | | | 3.4.1 | Risk................................................................................................................................8 | | | | 3.4.2 Security Control Map....................................................................................................9 | | | 3.5 Technologies................................................................................................................13 | 3.5 Technologies................................................................................................................13 | | 4 | Architecture .......................................................................................16 | Architecture .......................................................................................16 | | | 4.1 Architecture Description .............................................................................................16 | 4.1 Architecture Description .............................................................................................16 | | | 4.1.1 | High-Level Architecture ..............................................................................................16 | | | 4.1.2 | Architecture Components...........................................................................................17 | | 5 | Security Characteristic Analysis..........................................................20 | Security Characteristic Analysis..........................................................20 | | | 5.1 Assumptions and Limitations | ......................................................................................20 | | | 5.2 Build | Testing................................................................................................................20 | | | 5.3 | Scenarios and Findings................................................................................................21 | | | 5.3.1 | Ransomware via Web Vector and Self-Propagation...................................................21 | | | 5.3.2 | Destructive Malware via USB Vector..........................................................................22 | | |

Data Integrity_ Detecting and Responding to Ransomware and Other Destructive Events


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Configuration Management?

[Assistant]
According to Proceedings of the Cybersecurity in Cyber-Physical Systems Workshop, April 23-24, 2012:

IMDs are tiny computing platforms that run firmware in extremely power constrained environments. They offer data storage for static data (such as device information), relatively static data (such as patient identification, medical condition, therapy configuration) and dynamic data (such as recent patient readings and audit logs). IMDs offer wireless access for read and write  operations  to  the  data  on  the  IMD  (including  the  firmware) to a variety of stakeholders and roles.

Some of the threats to wireless IMDs include device reprogramming,  data  extraction,  data  tampering,  repeated  access attempts  and  data  flooding.  Vulnerabilities  include  unsecured communication channels, inadequate authentication and access control,  weak  audit  mechanisms  and  meager  storage.  The  resulting risks include patient safety compromise resulting from firmware malfunction or therapy misconfiguration, device unavailability due to battery power depletion, patient privacy loss due to data leakage to unauthorized parties, and inappropriate medical follow-up due to tampering of patient readings. While some cyber threats may be unintentional, various motivations exist  for  deliberate  cyber  attacks,  such  as  patient  information gathering, negative impact to patient health status, ego satisfaction of the attacker, as well as gaining competitive advantage over another vendor through negative press.

Identification of the various data types within an IMD is an essential  step  in  analyzing  the  security  and  privacy  risks  of such  devices.  Possible  data  types  include  firmware  (though technically not 'data'), device identification data, patient identification and health condition data, therapy configuration data, patient readings, audit log data, and other data.

Proceedings of the Cybersecurity in Cyber-Physical Systems Workshop, April 23-24, 2012


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What guidance does NIST provide for CMMC Level 3?

[Assistant]
According to Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171:

## NIST Special Publication 800-172

## Enhanced Security Requirements for Protecting Controlled Unclassified Information

A Supplement to NIST Special Publication 800-171

RON ROSS VICTORIA PILLITTERI GARY GUISSANIE RYAN WAGNER RICHARD GRAUBART

DEB BODEAU

This publication is available free of charge from:

https://doi.org/10.6028/NIST.SP.800-172

<!-- image -->

## NIST Special Publication 800-172

## Enhanced Security Requirements for Protecting Controlled Unclassified Information

A Supplement to NIST Special Publication 800-171

## RON ROSS VICTORIA PILLITTERI

Computer Security Division

National Institute of Standards and Technology

## GARY GUISSANIE RYAN WAGNER

Institute for Defense Analyses

RICHARD GRAUBART DEB BODEAU

The MITRE Corporation

This publication is available free of charge from:

https://doi.org/10.6028/NIST.SP.800-172

## February 2021

<!-- image -->

U.S. Department of Commerce Wynn Coggins, Acting Secretary

National Institute of Standards and Technology James K. Olthoff, Performing the Non-Exclusive Functions and Duties of the Under Secretary of Commerce for Standards and Technology & Director, National Institute of Standards and Technology

\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

## Authority

This publication has been developed by NIST to further its statutory responsibilities under the Federal Information Security Modernization Act (FISMA), 44 U.S.C. § 3551 et seq. , Public Law (P.L.) 113-283. NIST is responsible for developing information security standards and guidelines, including minimum requirements for federal information systems, but such standards and guidelines shall not apply to national security systems without the express approval of the appropriate federal officials exercising policy authority over such systems.

Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AT.L2-3.2.1 (NIST 3.2.1)?

[Assistant]
According to Zero Trust Architecture:

3.2.1                                                                                | Despliegue basado en agentes y puertas de enlace de los dispositivos... 3.2.1) o cortafuegos en el o los puntos finales. 3.2.1).


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 2 require for Security Assessment?

[Assistant]
According to Assessing Security Requirements for Controlled Unclassified Information:

assessment; assessment method; assessment object; assessment procedure; assurance; Controlled Unclassified Information; coverage; FISMA; NIST Special Publication 800-171; NIST Special Publication 800-53A; nonfederal organization; nonfederal system; security assessment; security requirement.

- System development life cycle responsibilities (e.g., program managers, mission/business owners, information owners/stewards, system designers and developers, system/security engineers, systems integrators)
- Acquisition or procurement responsibilities (e.g., contracting officers)
- System, security, or risk management and oversight responsibilities (e.g., authorizing officials, chief information officers, chief information security officers, system owners, information security managers)
- Security assessment and monitoring responsibilities (e.g., auditors, system evaluators, assessors, independent verifiers/validators, analysts)

- Federal perspective : The entity establishing and conveying security assessment requirements in contractual vehicles or other types of agreements
- Nonfederal perspective : The entity responding to and complying with the security assessment requirements set forth in contracts or agreements

Assessing Security Requirements for Controlled Unclassified Information


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice IA.L2-3.5.2 (NIST 3.5.2)?

[Assistant]
According to Digital Identity Guidelines:

3.5.2. 3.5.2.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for Supply Chain Risk Management?

[Assistant]
According to Protecting Controlled Unclassified Information (CUI)_ NIST Special Publication 800-171, Revision 3. Small Business Primer:

| Access Control                    | Maintenance         | Security Assessment and Monitoring   |
|-----------------------------------|---------------------|--------------------------------------|
| Awareness and Training            | Media Protection    | System and Communications Protection |
| Audit and Accountability          | Personnel Security  | System and Information Integrity     |
| Configuration Management          | Physical Protection | Planning                             |
| Identification and Authentication | Risk Assessment     | System and Services Acquisition      |
| Incident Response                 |                     | Supply Chain Risk Management         |

| How can I 'comply' with SP 800-171? | NIST does not have a role in determining compliance with the security requirements in SP 800-171. If you have questions regarding requirements to protect CUI or other regulatory requirements, please contact your prime contractor and/or federal point of contact for the contract. |
|----------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| How do I know if I have CUI? | It is the responsibility of the federal agency to ensure that requirements to protect CUI are identified in applicable contracts or agreements, and CUI is marked by the federal agency. |
| How do I get a 'NIST SP 800 -171 Assessment'?


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What guidance does Ordered t-way Combinations for Testing State-based Systems provide?

[Assistant]
## Ordered t-way Combinations for Testing State-based Systems

D. Richard Kuhn M S Raunak Computer Security Division Information Technology Laboratory

Raghu N. Kacker Applied and Computational Mathematics Division Information Technology Laboratory

June 13, 2022

This publication is available free of charge from: https://doi.org/10.6028/NIST.CSWP.26

<!-- image -->

## Abstract

Fault detection often depends on the specific order of inputs that establish states which eventually lead to a failure. However, beyond basic structural coverage metrics, it is often difficult to determine if code has been exercised sufficiently to ensure confidence in its functions. Measures are needed to ensure that  relevant combinations  of  input  values  have  been  tested  with  adequate  diversity  of  ordering  to ensure  correct  operation. Combinatorial  testing  and  combinatorial  coverage  measures  have  been applied to many types of applications but have some deficiencies for verifying and testing state-based systems where the response depends on both input values and the current system state. In such systems, internal states change as input values are processed. Examples include network protocols, which may be in listening, partial connection, full connection, disconnected, and many other states depending on the values of packet fields and the order of packets received. Similarly, merchant account balances in credit card systems change continuously as transactions are processed. This publication introduces a notion of ordered t-way combinations, proves a result regarding the construction of adequate blocks of test inputs,  and discusses the application of the results to verify and test state-based systems. ## Keywords

combinatorial coverage; combinatorial methods; combinatorial testing; software testing; structural coverage; test coverage.

Ordered t-way Combinations for Testing State-based Systems


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Physical Protection?

[Assistant]
According to Secure Software Development Practices for Generative AI and Dual-Use Foundation Models_ An SSDF Community Profile:

The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the Nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology. ITL's responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in federal information systems. The Special Publication 800-series reports on ITL's research, guidelines, and outreach efforts in information system security, and its collaborative activities with industry, government, and academic organizations.

Secure Software Development Practices for Generative AI and Dual-Use Foundation Models_ An SSDF Community Profile


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Guide to a Secure Enterprise Network Landscape provide? (Part 9)

[Assistant] Automated Network Provisioning Tools....................................................................12 | | | Networking Appliances as Services ............................................................................13 | Networking Appliances as Services ............................................................................13 | | | Network Configurations for Basic Security Functions..................................................14 | Network Configurations for Basic Security Functions..................................................14 | Network Configurations for Basic Security Functions..................................................14 | | 4.1 Conceptual Underpinning - Contextual Information .............................................................14 | 4.1 Conceptual Underpinning - Contextual Information .............................................................14 | 4.1 Conceptual Underpinning - Contextual Information .............................................................14 | | 4.2 Network Configuration for Device Management ...................................................................15 | 4.2 Network Configuration for Device Management ...................................................................15 | 4.2 Network Configuration for Device Management ...................................................................15 | | 4.3 Network Configuration for User Authentication.....................................................................16 | 4.3 Network Configuration for User Authentication.....................................................................16 | | | 4.4 Network Configuration for Device Authentication and Health Monitoring....................16 | 4.4 Network Configuration for Device Authentication and Health Monitoring....................16 | | | 4.5 Network Configuration for Authorizing Application/Service Access......................................16 | 4.5 Network Configuration for Authorizing Application/Service Access......................................16 | 4.5 Network Configuration for Authorizing Application/Service Access......................................16 | | 4.6 Network Configurations for Preventing Attack Escalation.....................................................16 | 4.6 Network Configurations for Preventing Attack Escalation.....................................................16 | 4.6 Network Configurations for Preventing Attack Escalation.....................................................16 | | | Enterprise-Wide Network Security Framework - Zero Trust Network Access (ZTNA) 17 | Enterprise-Wide Network Security Framework - Zero

Guide to a Secure Enterprise Network Landscape


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Configuration Management?

[Assistant]
According to Recommendations for Federal Vulnerability Disclosure Guidelines:

| Executive Summary................................................................................................................. | Executive Summary................................................................................................................. | Executive Summary................................................................................................................. |
|--------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------|
| U.S. Government Vulnerability Disclosure..................................................................... | 2                                                                                |                                                                                |
| Usage of Document Terminology................................................................................ | 5                                                                                |                                                                                |
| Federal Vulnerability Disclosure Coordination Body ....................................................

Recommendations for Federal Vulnerability Disclosure Guidelines


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Identification and Authentication?

[Assistant]
According to Control Baselines for Information Systems and Organizations:

| ORGANIZATIONAL RESPONSIBILITIES .........................................................................................
| 2                                                                                |
| 1.4                                                                                | RELATIONSHIPTOOTHERPUBLICATIONS ................................................................................... | 3                                                                                |
| 1.5                                                                                | REVISIONSANDEXTENSIONS .................................................................................................... | 3                                                                                |
| 1.6                                                                                | PUBLICATIONORGANIZATION .................................................................................................. | 3                                                                                |
| CHAPTERTWO THE FUNDAMENTALS............................................................................................ 5                     | CHAPTERTWO THE FUNDAMENTALS............................................................................................ 5                     | CHAPTERTWO THE FUNDAMENTALS............................................................................................

Control Baselines for Information Systems and Organizations