[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 2 require for Identification and Authentication?

[Assistant]
According to Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations:

| Table 1. Security Requirement Families .......................................................................................................4          |
|----------------------------------------------------------------------------------------------------------------------------------------------------------|
| Table 2. Security Control Tailoring Criteria.................................................................................................93          |
| Table 3. Access Control (AC) .......................................................................................................................93   |
| Table 4. Awareness and Training (AT).........................................................................................................94          |
| Table 5. Audit and Accountability (AU).......................................................................................................95          |
| Table 6. Assessment, Authorization, and Monitoring (CA).........................................................................95                       |
| Table 7. Configuration Management (CM).................................................................................................96                |
| Table 8. Contingency Planning (CP) ............................................................................................................96        |
| Table 9. Identification and Authentication (IA) ..........................................................................................97             |
| Table 10. Incident Response (IR).................................................................................................................98      |
| Table 11. Maintenance (MA) ......................................................................................................................98      |
| Table 12.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for System and Services Acquisition?

[Assistant]
According to Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171:

........................................................................ | CHAPTERONE INTRODUCTION......................................................................................................
|
|--------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------|
| 1.1 PURPOSEANDAPPLICABILITY                                                                                | ................................................................................................... 3                                            |
| 1.2 TARGET AUDIENCE                                                                                | .................................................................................................................. 4                             |
| 1.3 ORGANIZATIONOF THIS SPECIAL PUBLICATION                                                                                | .......................................................................... 4                                                                     |
| CHAPTERTWO THE FUNDAMENTALS............................................................................................ 5                        | CHAPTERTWO THE FUNDAMENTALS............................................................................................ 5                        |
| 2.1 DEVELOPMENTAPPROACH ......................................................................................................

Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Security Assessment?

[Assistant]
According to Digital Identity Guidelines_ Identity Proofing and Enrollment:

3.12. Requirements for Visual Facial Image Comparison . . . . . . . . . . . .

transcription, or accessibility support) to assist the applicant in the identity
proofing process but does not support decision-making or risk-based evaluation.

13. The CSP’s policy for assessing customer experience, including the testing methods
employed, timing of its periodic reviews, and any specific conditions that will
trigger an out-of-cycle review (see Sec. 3.4)

Digital Identity Guidelines_ Identity Proofing and Enrollment


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Incident Response?

[Assistant]
According to Digital Identity Guidelines:

3.6.

3.6. Redress
Designing services that support a wide range of populations requires processes to
adjudicate issues and provide redress4
 as warranted. Service failures, disputes, and
other issues tend to arise as part of normal operations, and their impacts can vary
broadly, from minor inconveniences to major disruptions or damage. Furthermore,
the same issue experienced by one person or community as an inconvenience can have
disproportionately damaging impacts on other individuals and communities.

authentication intent
The process of confirming the claimant’s intent to authenticate or reauthenticate by
requiring user intervention in the authentication flow. Some authenticators (e.g., OTPs)
establish authentication intent as part of their operation. Others require a specific step
to establish intent, such as pressing a button. Authentication intent is a countermeasure
against malware at the endpoint as a proxy for authenticating an attacker without the
subscriber’s knowledge.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Services Acquisition?

[Assistant]
According to Status Report on the First Round of the Additional Digital Signature Schemes for the NIST Post-Quantum Cryptography Standardization Process:

There may be references in this publication to other publications currently under development by NIST in
accordance with its assigned statutory responsibilities. The information in this publication, including
concepts and methodologies, may be used by federal agencies even before the completion of such
companion publications. Thus, until each publication is completed, current requirements, guidelines, and
procedures, where they exist, remain operative. For planning and transition purposes, federal agencies
may wish to closely follow the development of these new publications by NIST.

The  Information  Technology  Laboratory  (ITL)  at  the  National  Institute  of  Standards  and
Technology (NIST) promotes the U.S. economy and public welfare by providing technical
leadership for the Nation’s measurement and standards infrastructure. ITL develops tests,
test methods, reference data, proof of concept implementations, and technical analyses
to advance the development and productive use of information technology.  ITL’s respon-
sibilities include the development of management, administrative, technical, and physical
standards and guidelines for the cost-effective security and privacy of other than national
security-related information in federal information systems.

Status Report on the First Round of the Additional Digital Signature Schemes for the NIST Post-Quantum Cryptography Standardization Process


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Organizational Views of NIST Cryptographic Standards and Testing and Validation Programs provide? (Part 7)

[Assistant]
..................................................................... | Summary ........................................................................................................................
| 28                                                                                |
| References.............................................................................................................................. | References.............................................................................................................................. | 28                                                                                |
| Appendix: Interview Questions ........................................................................................... | Appendix: Interview Questions ........................................................................................... | 30                                                                                |
| List of Tables                                                                                | List of Tables                                                                                | List of Tables                                                                                |

## Introduction

Cryptography is an essential component of modern computing.

Organizational Views of NIST Cryptographic Standards and Testing and Validation Programs

Audit and Accountability
System and Information Integrity
Security Assessment
Media Protection
Identification and Authentication
Awareness and Training
System and Communications Protection
Access Control
Planning
Incident Response
Risk Assessment
Personnel Security
System and Services Acquisition
Supply Chain Risk Management
Maintenance
Physical Protection
Configuration Management


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Awareness and Training?

[Assistant]
According to Digital Identity Guidelines:

1.3.2. Privacy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

2.3.2. Authentication Process

3.2.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Planning for a Zero Trust Architecture_ A Planning Guide for Federal Administrators provide? (Part 10)

[Assistant]
Note that it may not be possible to perform all checks at the time of each access request, some policy check may be performed on an independent schedule (e.g., daily software versioning checks). - IV.
The enterprise collects as much information as possible about the current state of assets, network infrastructure and communications and uses it to improve its security posture. Zero trust adds a dynamic response factor that was typically lacking (or not possible) in previous perimeter-based architectures. This requires the enterprise to monitor all traffic to the extent feasible and restricted (or required) by policy, regulation or legal requirement. System logs and threat intelligence are used to refine or change policy in response to new information. For example, a new vulnerability in a software component in use in the enterprise is announced. A zero trust enterprise could move quickly to quarantine the affected resources until they can be patched or modified to mitigate the newly discovered vulnerability. Administrators will need to set up and maintain a comprehensive monitoring and patching program for the enterprise and should consider how automated tools could assist in responding to newly discovered threats. ## 2 Getting Started on the Journey

Moving to a zero trust architecture will likely never start from scratch but will involve a series of upgrades and changes over time. Some changes may be simple configuration changes, and some may involve the purchase and deployment of new infrastructure; it all depends on what tools are currently used and available to the enterprise. The process of migrating to a ZTA is not a unique process and is similar to other cybersecurity upgrades or improvements but guided by zero trust principles in the planning and implementation. Existing frameworks such as the NIST Risk Management Framework (RMF) [2] and Cybersecurity Framework (CSF) [3] can help an enterprise discuss, develop, and implement a ZTA.

Planning for a Zero Trust Architecture_ A Planning Guide for Federal Administrators


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Maintenance?

[Assistant]
According to Transitioning to the Security Content Automation Protocol (SCAP) Version 2:

Support for Streamlined SCAP Content Creation, Acquisition, and Reuse: SCAP v2 will develop and incorporate simpler formats for use in content creation, including updates to the Extensible Configuration Checklist Description Format (XCCDF) and the

Open Vulnerability and Assessment Language (OVAL), and will develop ways to use system artifacts in posture assessments that do not require deep system expertise. Additionally, by using standardized interfaces and protocols to discover and retrieve SCAP content, SCAP v2 products will be able to detect when new SCAP content is available and automatically acquire suitable content updates based on organizational policies. These same interfaces can be used to discover content for reuse. - Posture Evaluator Protocol : To support the separation of collection and evaluation, SCAP v2 will need to define a remote evaluation protocol to enable Posture Evaluators to be plugged into the architecture. This protocol will need to define how to request an evaluation and how a Posture Evaluator can request Endpoint posture to be collected from a Posture Collection Server. - XCCDF Language Improvements: XCCDF currently uses the CPE Applicability language. XCCDF [18] needs to be updated to support the Endpoint Applicability Language and SWID tags. There are also several extensibility enhancements requested by the SCAP community that need to be addressed. These updates are expected to be worked in an international standards organization. - OVAL-Based Collection and Language Improvements: A messaging model is needed to allow for the collection of configuration setting information from an endpoint using OVAL [19]. A NEA extension will be developed to allow for event-driven and ad-hoc OVAL-based collection of configuration setting information.

Transitioning to the Security Content Automation Protocol (SCAP) Version 2


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice CM.L2-3.4.2 (NIST 3.4.2)?

[Assistant]
According to Guide to a Secure Enterprise Network Landscape:

3.4.2. 3.4.2. 3.4.2.

Guide to a Secure Enterprise Network Landscape


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Personnel Security?

[Assistant]
According to Multi-Factor Authentication for Criminal Justice Information Systems_ Implementation Considerations for Protecting Criminal Justice Information:

Law enforcement and other personnel accessing CJI already manage multiple user identities and may already manage multiple MFA tokens for those identities. To the greatest extent feasible, agencies should consider MFA architectures that minimize the number of separate MFA credentials that need to be issued to users and managed. For instance, if a user has an MFA credential to access a state CJIS portal and another MFA credential to get access to their CAD/RMS system, there may be opportunities to avoid the user having to manage two sets of credentials. Moreover, each MFA implementation requires a management system, a support staff to assist users with obtaining, registering, and using their MFA credentials, and administrative processes that drive costs in both time and money. Agencies should consider integrating CJI applications and/or services with existing IdPs that can or already support MFA. This might include leveraging SSO services, as mentioned in Sec. 2.4.2.

Because the average agency user may not be familiar with MFA systems, agency personnel responsible for MFA deployment should conduct market research on potentially viable MFA solutions and present them to a representative portion of the user base to facilitate feedback and to enumerate requirements.

Implementing any MFA solution likely requires users to change the way they conduct daily interactions with their IT systems. Because of this, it is important that once an MFA solution is selected, agencies educate users with clear instructions on how to obtain and use any new authenticators, as well as provide easy access to help desk or support personnel who can assist users in setting up and using the new MFA solution. Section 3.3 provides a notional plan for a phased MFA rollout to different user bases.

Multi-Factor Authentication for Criminal Justice Information Systems_ Implementation Considerations for Protecting Criminal Justice Information


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Risk Management Framework for Information Systems and Organizations_ A System Life Cycle Approach for Security and Privacy provide? (Part 5)

[Assistant]
nd assessment; system and common control authorizations; and continuous monitoring. The RMF includes activities to prepare organizations to execute the framework at appropriate risk management levels.
The RMF also promotes near real-time risk management and ongoing information system and common control authorization through the implementation of continuous monitoring processes; provides senior leaders and executives with the necessary information to make efficient, cost-effective, risk management decisions about the systems supporting their missions and business functions; and incorporates security and privacy into the system development life cycle. Executing the RMF tasks links essential risk management processes at the system level to risk management processes at the organization level. In addition, it establishes responsibility and accountability for the controls implemented within an organization's information systems and inherited by those systems. ## Keywords

assess; authorization to operate; authorization to use; authorizing official; categorize; common control; common control authorization; common control provider; continuous monitoring; control assessor; control baseline; cybersecurity framework profile; hybrid control; information owner or steward; information security; monitor; ongoing authorization; plan of action and milestones; privacy; privacy assessment report; privacy control; privacy plan; privacy risk; risk assessment; risk executive function; risk management; risk management framework; security; security assessment report; security control; security engineering; security plan; security risk; senior agency information security officer; senior agency official for privacy; supply chain risk management; system development life cycle; system owner; system privacy officer; system security officer; system-specific control.

Risk Management Framework for Information Systems and Organizations_ A System Life Cycle Approach for Security and Privacy


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AT.L2-3.2.2 (NIST 3.2.2)?

[Assistant]
According to Access Control on NoSQL Databases:

3.2.2. 3.2.2.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Media Protection?

[Assistant]
According to Audit and Evaluation of Computer Security:

4. Management controls to ensure that security objectives are
achieved fit into three categories— policies that are formulated
at the top, procedures for administrative, physical, and technical
security measures, and practices for the standard management ac-
tivities .
5. ADP security controls should include a) administrative safe-
guards in the form of contingency plans, security documentation,
authorization control lists, program access controls, personnel
rules; b) physical security safeguards such as area restrictions,
disaster back-up, storage libraries, disposal procedures; and c)
technical security in the form of a security system to handle data
and files, program libraries, operating system(s), teleprocessing,
and encryption.
6. Training is needed for systems people as well as users.

Data Handling and Disposal

It is also necessary that appropriate disposal techniques

Audit and Evaluation of Computer Security


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does A Zero Trust Architecture Model for Access Control in Cloud-Native Applications in Multi-Cloud Environments provide? (Part 3)

[Assistant]
l official. This publication may be used by nongovernmental organizations on a voluntary basis and is not subject to copyright in the United States. Attribution would, however, be appreciated by NIST.
## NIST Technical Series Policies

Copyright, Use, and Licensing Statements NIST Technical Series Publication Identifier Syntax

## Publication History

Approved by the NIST Editorial Review Board on 2023-09-08

## How to Cite this NIST Technical Series Publication:

Chandramouli R, Butcher Z (2023) A Zero-Trust Architecture Model for Access Control in Cloud-Native Applications in Multi-Location Environments. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) NIST SP 800-207A. https://doi.org/10.6028/NIST.SP.800-207A

## Author ORCID iDs

Ramaswamy Chandramouli: 0000-0002-7387-5858

## Contact Information

sp800-207A-comments@nist.gov

National Institute of Standards and Technology Attn: Computer Security Division, Information Technology Laboratory 100 Bureau Drive (Mail Stop 8930) Gaithersburg, MD 20899-8930

All comments are subject to release under the Freedom of Information Act (FOIA). ## Abstract

One of the basic tenets of zero trust is to remove the implicit trust in users, services, and devices based only on their network location, affiliation, and ownership. NIST Special Publication 800207 has laid out a comprehensive set of zero trust principles and referenced zero trust architectures (ZTA) for turning those concepts into reality. A key paradigm shift in ZTAs is the change in focus from security controls based on segmentation and isolation using network parameters (e.g., Internet Protocol (IP) addresses, subnets, perimeter) to identities. From an application security point of view, this requires authentication and authorization policies based on application and service identities in addition to the underlying network parameters and user identities.

A Zero Trust Architecture Model for Access Control in Cloud-Native Applications in Multi-Cloud Environments


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for Risk Assessment?

[Assistant]
According to Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171:

Advanced Persistent Threat; Basic Security Requirement; Contractor Systems; Controlled Unclassified Information; CUI Registry; Derived Security Requirement; Enhanced Security Requirement; Executive Order 13556; FIPS Publication 199; FIPS Publication 200; FISMA; NIST Special Publication 800-53; Nonfederal Organizations; Nonfederal Systems; Security Assessment; Security Control; Security Requirement. This publication is a supplement to NIST Special Publication 800-171 [SP 800-171]. It contains recommendations  for  enhanced  security  requirements  to  provide  additional  protection  for Controlled Unclassified Information (CUI) in nonfederal systems and organizations when such information is  associated  with critical  programs  or  high  value  assets. The  enhanced  security requirements are designed to respond to the advanced persistent threat (APT) and supplement the basic and derived security requirements in [SP 800-171]. While the security requirements in [SP 800-171] focus primarily on confidentiality protection, the enhanced security requirements in this publication address confidentiality, integrity, and availability protection. The enhanced security requirements are implemented in addition to the basic and derived requirements since those requirements are not designed to address the APT. The enhanced security requirements apply to those components of nonfederal systems that process, store, or transmit CUI or that provide protection for such components. There is no expectation that all of the enhanced security requirements will be selected by federal agencies implementing this guidance. The decision to select a particular set of enhanced security requirements will be based on the mission and business needs of federal agencies and guided and informed by ongoing risk assessments.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Access Control?

[Assistant]
According to Summary of NIST SP 800-53, Revision 4_ Security and Privacy Controls for Federal Information Systems and Organizations:

The resulting tailored baseline set of security controls and the supporting rationale for the selection decisions (including any information system use restrictions required by organizations) are documented in system security plans. Documenting significant risk management decisions in the security control selection process is imperative so that authorizing officials have access to necessary information to make informed authorization decisions for organizational information systems, as demonstrated in Figure 3.

Summary of NIST SP 800-53, Revision 4_ Security and Privacy Controls for Federal Information Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Security Assessment?

[Assistant]
According to Summary of NIST SP 800-53, Revision 4_ Security and Privacy Controls for Federal Information Systems and Organizations:

8 (also known as the Common Criteria) provides functionality and assurance requirements for developers of information systems and information system components (i.e., information technology products).
Since many of the technical security controls defined in Appendix F are implemented in hardware, software, and firmware components of information systems, organizations can obtain significant benefit from the acquisition and employment of information technology products evaluated against the requirements of ISO/IEC 15408. The use of such products can provide evidence that certain security controls are implemented correctly, operating as intended, and producing the desired effect in satisfying stated security requirements.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AT.L2-3.2.5 (NIST 3.2.5)?

[Assistant]
According to Recommendations for Federal Vulnerability Disclosure Guidelines:

3.2.5. 3.2.5. 3.2.5.

Recommendations for Federal Vulnerability Disclosure Guidelines


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Media Protection?

[Assistant]
According to Secure Software Development Practices for Generative AI and Dual-Use Foundation Models_ An SSDF Community Profile:

[Not part of SSDF 1.1]                                                                                | purposes, and mitigate the risks as necessary. [Not part of SSDF 1.1]                                                                                |            | R2: Select and apply appropriate methods for analyzing and altering the training, testing, fine- tuning, and aligning data for an AI model. Examples of methods include anomaly detection, bias detection, data cleaning, data curation, data filtering, data sanitization, fact- checking, and noise reduction. C1: Consider using a human-in-the-loop to examine data, such as with exploratory data analysis techniques [18]. | OWASP: LLM03, LLM06                       |
| being consumed as part of AI model training, testing, fine-tuning, and aligning. [Not part of SSDF 1.1]                                                                                | PW.3.2: Track the provenance, when known, of all training, testing, fine-tuning, and aligning data used for an AI model, and document which data do not have known provenance. [Not part of SSDF 1.1]                              | Medium     | N1: Provenance verification is not possible in all cases because provenance is not always known.

Secure Software Development Practices for Generative AI and Dual-Use Foundation Models_ An SSDF Community Profile


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Awareness and Training?

[Assistant]
According to Recommendation for Pair-Wise Key-Establishment Using Integer Factorization Cryptography:

| RSA Key Pairs....................................................................................................................... | RSA Key Pairs....................................................................................................................... | RSA Key Pairs....................................................................................................................... |   36 |
|----------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------|
|                                                                                | 6.1 General Requirements....................................................................................................... | 6.1 General Requirements....................................................................................................... |   36 |
|                                                                                | 6.2 Criteria for RSA Key Pairs for Key Establishment .......................................................... | 6.2 Criteria for RSA Key Pairs for Key Establishment ..........................................................

Recommendation for Pair-Wise Key-Establishment Using Integer Factorization Cryptography


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Media Protection?

[Assistant]
According to Audit and Evaluation of Computer Security II_ System Vulnerabilities and Controls:

- 3.2.1 Data Entry . For all data received manually, either in source document form for conversion to media or directly in media form, procedures should be developed (in conjunction with submitting departments) to ensure that the data is complete, accurate, authorized, not duplicated, and timely. Where data conversion is required, it should be validated to ensure that the above characteristics are retained. - 3.2.2 Machine Operation . To ensure that the correct data and programs are used, that records are not improperly destroyed, and that the installation can survive system failures, appropriate policies with respect to the human operation of computer and communications equipment should be established regarding:
- The content and use of machine operator instructions (e.g., run books). - File label checking
- The use of restart/recovery capabilities
- The preparation of error logs
- The use of protective devices (e.g., tape rings)
- Permissible operator intervention
- Backup arrangements (and when they should be employed)
- Rotating and/or dual operators
- Validation and authorization of remote terminals accessing the system, and
- Validation procedures to be included in powering up and enabling the computer and communications equipment. - 3.2.3 Library Operation . To prevent the loss, destruction, or disabling of files and/or software, appropriate policies with respect to the maintenance of program, data, and job control libraries, and the use and movement of media should be established. These should include:
- Identification of media
- Identification of files and programs (to the version level)
- Retention back-up and destruction
- Usage logs
- Cleaning of media
- Storage and custody of supplies and media, and
- Disposal of sensitive media remnants. - 3.2.4 Machine Uti 1 ization .

Audit and Evaluation of Computer Security II_ System Vulnerabilities and Controls


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Risk Assessment?

[Assistant]
According to Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations:

|
| Appendix A. C-SCRM Security Controls...............................................................................................
| 63                                                                                |
| A.1.1. C-SCRM Controls Summary........................................................................................................63              |                                                                                |
| A.1.1.1. C-SCRM Controls Throughout the Enterprise.......................................................................64                           |                                                                                |
| A.1.2. Selecting, Tailoring, and Implementing C-SCRM Security Controls ...........................................67                                  |                                                                                |
| A.2.3. FAMILY: ACCESS CONTROL.........................................................................................................69              |                                                                                |
| A.2.4. FAMILY: AWARENESS AND TRAINING........................................................................................76                       |                                                                                |
| A.2.5. FAMILY: AUDIT AND ACCOUNTABILITY......................................................................................79                       |                                                                                |
| A.2.6.

Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Audit and Evaluation of Computer Security II_ System Vulnerabilities and Controls provide? (Part 9)

[Assistant]
NTRODUCTION                                                                             | PART T: INTRODUCTION                                                                  | 1-]             |
| 1.
HOST WELCOIING ADDRESS                                                       | 1. HOST WELCOIING ADDRESS                                                                        | 1. HOST WELCOIING ADDRESS                                                             | 1-1 1-3         |
| 2. | THE CHARGE TO ALL THE SESSIONS COMMENTS ON THE SESSIONS AND THE REPORTS                          | THE CHARGE TO ALL THE SESSIONS COMMENTS ON THE SESSIONS AND THE REPORTS               | 1-10            |
| 3. EDITOR'S                                                                     | 3. EDITOR'S                                                                                | 3. EDITOR'S                                                                           |                 |
|                                                                                |                                                                                |                                                                                | 1-10            |
| 3.1 Definitions of Terms                                                        | 3.1 Definitions of Terms                                                                         | 3.1 Definitions of Terms                                                              | T-11            |
| 3.2 Materials Distributed at the Workshop 3.3 Reading the Report 3.4 References | 3.2 Materials Distributed at the Workshop 3.3 Reading the Report 3.4 References                  | 3.2 Materials Distributed at the Workshop 3.3 Reading the Report 3.4 References       |                 |
| PART II: 1.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Security Assessment?

[Assistant]
According to Cryptographic Module Validation Program (CMVP)-Approved Security Functions_ CMVP Validation Authority Updates to ISO_IEC 24759:

Cryptographic Module Validation Program; CMVP; FIPS 140 testing; FIPS 140; ISO/IEC 19790; ISO/IEC 24759; testing requirement; vendor evidence; vendor documentation; security policy.

This document is intended for use by vendors, testing labs, and the CMVP.

Cryptographic Module Validation Program (CMVP)-Approved Security Functions_ CMVP Validation Authority Updates to ISO_IEC 24759


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Physical Protection?

[Assistant]
According to Incident Response Recommendations and Considerations for Cybersecurity Risk Management_ A CSF 2.0 Community Profile:

cks. This guide addresses only adverse cybersecurity events . Additional analysis is often needed to determine whether adverse cybersecurity events indicate that a cybersecurity incident has occurred.
- Employing a botnet to send high volumes of connection requests to an internet-facing service, making it unavailable to legitimate service users
- Obtaining administrative credentials at a software-as-a-service provider, which puts sensitive tenant data entrusted to that provider at risk
- Intruding upon an organization's business network to steal credentials and use them to instruct industrial control systems to shut down or destroy critical physical components, causing a major service disruption
- Deploying ransomware to prevent the use of computer systems and cause multiple data breaches by copying files from those systems
- Using phishing emails to compromise user accounts and using those accounts to commit financial fraud
- Identifying a new vulnerability in network management appliances and exploiting the vulnerability to gain unauthorized access to network communications
- Compromising a vendor's software, which is subsequently distributed to customers in its compromised state

Incident Response Recommendations and Considerations for Cybersecurity Risk Management_ A CSF 2.0 Community Profile


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Identification and Authentication?

[Assistant]
According to Blockchain for Access Control Systems:

AC systems are basically categorized as Discretionary AC (DAC), which leaves a certain amount of  AC to the discretion of the object's owner or anyone else who is authorized to control the object's access. In general, all AC policies other than DAC are grouped under the category of nondiscretionary AC (NDAC). As the name implies, policies in this category have rules that are not established  at  the  discretion  of  the  user. NDAC  establishes  controls  that  can  only  be  changed through administrative action, not by subjects. For example, a capability list is a popular model of DAC, and Identity based AC (IBAC) [IR7316], RBAC, ABAC, and CBAC models are popular examples of NDAC. In general, permissionless blockchains are suitable for DAC implementations, and  permissioned  blockchains  are  preferred  for  NDAC  implementations  for  their  control mechanisms. | References   |                                                                                |
|--------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| [BXANL]      | Bouras MA, Xia B, Abuassba AO, Ning H, Lu Q (2021) IoT-CCAC: A Blockchain-Based Consortium Capability Access Control Approach for IoT. PeerJ Computer Science 7:e455.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Planning?

[Assistant]
According to Digital Identity Guidelines_ Identity Proofing and Enrollment:

There may be references in this publication to other publications currently under
development by NIST in accordance with its assigned statutory responsibilities. The
information in this publication, including concepts and methodologies, may be used by
federal agencies even before the completion of such companion publications. Thus, until
each publication is completed, current requirements, guidelines, and procedures, where
they exist, remain operative. For planning and transition purposes, federal agencies may
wish to closely follow the development of these new publications by NIST.

3.15. Exception and Error Handling . . . . . . . . . . . . . . . . . . . . . . .

3.15.1. Requirements for Trusted Referees . . . . . . . . . . . . . . . .

Digital Identity Guidelines_ Identity Proofing and Enrollment


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171 provide? (Part 10)

[Assistant]
| ..................................................................................................................
4                             |
| 1.3 ORGANIZATIONOF THIS SPECIAL PUBLICATION                                                                                | .......................................................................... 4                                                                     |
| CHAPTERTWO THE FUNDAMENTALS............................................................................................ 5                        | CHAPTERTWO THE FUNDAMENTALS............................................................................................ 5                        |
| 2.1 DEVELOPMENTAPPROACH ...................................................................................................... | 5                                                                                |
| 2.2 ORGANIZATIONANDSTRUCTURE                                                                                | ............................................................................................. 7                                                  |
| 2.3 FLEXIBLE APPLICATION                                                                                | ............................................................................................................. 9                                  |
| CHAPTER THREE THE REQUIREMENTS......................................................................................... 11                       | CHAPTER THREE THE REQUIREMENTS.........................................................................................

Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Digital Identity Guidelines provide? (Part 10)

[Assistant]
exist along a continuum. Consequently, a digital
identity risk management approach should seek to manage risks using outcome-based
approaches that are designed to meet the organization’s unique needs.
These guidelines
define specific assurance levels that operate as baseline control sets. These assurance
levels provide multiple benefits, including a starting point for organizations in their
risk management journey and a common structure for supporting interoperability
between different entities. It is, however, impractical to create assurance levels that
can comprehensively address the entire spectrum of risks, threats, or considerations
that an organization will face when deploying an identity solution. For this reason, these
guidelines promote a risk-based approach to digital identity solution implementation
rather than a compliance-oriented approach, and organizations are encouraged to tailor
their control implementations based on the processes defined in these guidelines. Additionally, risks associated with digital identity stretch beyond the potential impacts
to the organization providing online services. These guidelines endeavor to robustly
and explicitly account for risks to individuals, communities, and other organizations. Organizations should also consider how digital identity decisions might affect, or need
to accommodate, the individuals who interact with the organization’s programs and
services. Privacy and customer experience for individuals should be considered along
with security. Additionally, organizations should consider their digital identity approach
alongside other mechanisms for identity management, such as those used in call centers
and in-person interactions.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AT.L2-3.2.1 (NIST 3.2.1)?

[Assistant]
According to Federal Cybersecurity Awareness Programs_ A Mixed Methods Research Study:

3.2.1                                                                                | Organization Type ... 3.2.1 Organization Type

## Focus Groups

Twenty-eight unique organizations were represented in the focus groups.

Federal Cybersecurity Awareness Programs_ A Mixed Methods Research Study


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Machine Learning for Access Control Policy Verification provide? (Part 4)

[Assistant]
es  and  appreciates  the  comments  and  contributions  made  by government agencies, private organizations, and individuals in providing direction and assistance in the development of this document.
## Patent Disclosure Notice

NOTICE:  ITL  has  requested  that  holders  of  patent  claims  whose  use  may  be  required  for compliance with the guidance or requirements of this publication disclose such patent claims to ITL. However, holders of patents are not obligated to respond to ITL calls for patents, and ITL has not undertaken a patent search in order to identify which, if any, patents may apply to this publication. As of the date of publication and following call(s) for the identification of patent claims whose use may be required for compliance with the guidance or requirements of this publication, no such patent claims have been identified to ITL. No  representation  is  made  or  implied  by  ITL  that  licenses  are  not  required  to  avoid  patent infringement in the use of this publication. ## Executive Summary

Access control policy verification ensures that there are no faults within the policy that leak or block access privileges. As a software test, access control policy verification relies on methods such as model proof, data structure, system simulation, and test oracle to verify that the policy logic  functions  as  expected. However,  these  methods  have  capability  and  performance  issues related to inaccuracy and complexity limited by applied technologies. For instance, model proof, test oracle, and data structure methods initially assume that the policy under verification is faultless unless the policy model cannot hold for test cases. Thus, the challenge of the method is to compose test cases that can comprehensively discover all faults. Alternatively, a system simulation method requires translating the policy to a simulated system.

Machine Learning for Access Control Policy Verification


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Planning for a Zero Trust Architecture_ A Planning Guide for Federal Administrators provide? (Part 8)

[Assistant]
as endpoint and environmental factors impact authentication and authorization policies. ## 1.1.2 Tenets that Deal with Endpoints

- I. All data sources and computing services are considered resources.
An enterprise relies on different resources to perform its mission: mobile devices, data stores, compute resources (including virtual), remote sensors/actuators, etc. All these components are resources and need to be considered in a ZTA. Some components (e.g., IoT sensors) may not be able to support some solutions such as configuration agents, application sandboxing, etc. so compensating technologies or alternative mitigations may be needed. If the resource lacks certain security capabilities, the enterprise may need to add a PEP component to provide that functionality. - II. The enterprise monitors and measures the integrity and security posture of all owned and associated resources. This tenet deals with the aspects of cyber hygiene for both enterprise-owned resources and those that may not be owned, but used in an enterprise workflow such as configuration, patching, application loading, etc. The state of resources should be monitored, and appropriate action taken when new information such as a new vulnerability or attack is reported or observed. The confidentiality and integrity of data on the resource should be protected. This requires enterprise admins to know how resources are configured, maintained, and monitored. ## 1.1.3 Tenets that Apply to Data Flows

- I. All communication is secured regardless of network location. In zero trust, the network is always considered contested. A ZTA should be designed with the assumption that an attacker is present on the network and could observe/modify communications. Appropriate safeguards should be in place to protect the confidentiality and integrity of data in transit. If a resource cannot provide this functionality natively, a separate PEP component may be necessary. - II.

Planning for a Zero Trust Architecture_ A Planning Guide for Federal Administrators


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does A Data Structure for Integrity Protection with Erasure Capability provide? (Part 4)

[Assistant]
Algorithm 1 Data block matrix construction

Figure 2. Block matrix with numbered cells

<!-- image -->

## III. PROPERTIES

Certain  desirable  properties  are  maintained  with  this data  structure.
These  features  allow  for  the  efficient storage  and  retrieval  of  data  blocks  (results  originally introduced in [1]). Theorem 1 (Balance  property) . Cells  are  filled  in  a balanced manner so that the upper half (above diagonal) contains at most one additional cell more than the lower half. Proof. The following invariant implies the property, and for each iteration of the loop, the invariant is maintained, ( i = j ∨ i < j ) ∧ u = l ∨ i > j ∧ u = l +1

where u =  number  of  cells  above  diagonal,  and l = number  of  cells  below  diagonal. Initially, i = j = 0 and u = l = 0 . If i = j ,  then u, l are  unchanged,  so the  invariant  remains  true. If i < j ,  then u = l . A ′ block  is  then  added  to  the  upper  half  and u = l + 1

and i ′ = j, j ′ = i so  that i ′ > j ′ and  the  invariant  is maintained. If i > j , then u = l +1 and a block is added ′ to the lower half such that u = l ′ and i ′ = j +1 , j ′ = i , so that i ′ < j ′ ,  maintaining the invariant. Theorem 2 (Hash chain length) . The number of blocks in a row or column hash chain is proportional to N for a matrix with N blocks. Proof. The balance property  ensures  filling  in  a  square form. Theorem 3 (Block  numbering) . All  even-numbered blocks  are  placed  below  the  diagonal  and  all  oddnumbered blocks are placed above the diagonal. Proof. The following invariant implies the property. i < j ∧ odd ( B i,j ) ∨ i > j ∧ even ( B i,j )

Initially, i < j and B = 1 ,  so  the  invariant  holds,  and for each iteration of the loop, the invariant is maintained. ̸

Theorem 4 (Block  dispersal) . No  consecutive  blocks appear in the same row or column.

A Data Structure for Integrity Protection with Erasure Capability

Audit and Accountability
System and Information Integrity
Media Protection
Identification and Authentication
Awareness and Training
System and Communications Protection
Access Control
Planning
Incident Response
Risk Assessment
Personnel Security
System and Services Acquisition
Supply Chain Risk Management
Maintenance
Physical Protection
Security Assessment


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Security Assessment?

[Assistant]
According to Guidelines on Mobile Device Forensics:

ating  systems  and  hardware configurations prevailed. JTAG - Many manufacturers support the JTAG standard, which defines a common test interface for processor, memory, and other semiconductor chips.
Forensic examiners can communicate with a JTAG-compliant component by utilizing special purpose standalone programmer devices to probe defined test points [Wil05]. The JTAG testing unit can be used to request memory addresses from the JTAGcompliant component and accept the response for storage and rendition [Bre06]. JTAG gives specialists another avenue for imaging devices that are locked or devices that may have minor damage and cannot be properly interfaced otherwise. This method involves attaching a cable (or wiring harness) from a workstation to the mobile device's JTAG interface and access memory via the device's microprocessor to produce an image [Bre07]. JTAG extractions differ mainly from Hex Dumping in that it is invasive as access to the connections frequently require that the examiner dismantle some (or most) of a mobile device to obtain access to establish the wiring connections.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for Audit and Accountability?

[Assistant]
According to Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171:

| CHAPTERONE INTRODUCTION...................................................................................................... | CHAPTERONE INTRODUCTION...................................................................................................... |
|--------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------|
| 1.1 PURPOSEANDAPPLICABILITY                                                                                | ................................................................................................... 3                                            |
| 1.2 TARGET AUDIENCE                                                                                | .................................................................................................................. 4                             |
| 1.3 ORGANIZATIONOF THIS SPECIAL PUBLICATION                                                                                | .......................................................................... 4                                                                     |
| CHAPTERTWO THE FUNDAMENTALS............................................................................................ 5                        | CHAPTERTWO THE FUNDAMENTALS............................................................................................ 5                        |
| 2.1 DEVELOPMENTAPPROACH ......................................................................................................


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171 provide? (Part 9)

[Assistant]
ework for Improving Critical Infrastructure Cybersecurity [NIST CSF] can find in Appendix C a mapping of the enhanced security requirements in this publication to the security controls in [SP 800-53].
The security control mappings can be useful to organizations that wish to demonstrate compliance to the security requirements in the context of their established information security programs when such programs have been built using the NIST security controls. \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

## Table of Contents

| CHAPTERONE INTRODUCTION...................................................................................................... | CHAPTERONE INTRODUCTION...................................................................................................... |
|--------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------|
| 1.1 PURPOSEANDAPPLICABILITY                                                                                | ................................................................................................... 3                                            |
| 1.2 TARGET AUDIENCE                                                                                | ..................................................................................................................


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Security and Privacy Controls for Information Systems and Organizations provide? (Part 5)

[Assistant]
ability provided by the
controls). Addressing functionality and assurance helps to ensure that information technology
products and the systems that rely on those products are sufficiently trustworthy.
Keywords

Assurance; availability; computer security; confidentiality; control; cybersecurity; FISMA;
information security; information system; integrity; personally identifiable information; Privacy
Act; privacy controls; privacy functions; privacy requirements; Risk Management Framework;
security controls; security functions; security requirements; system; system security. ii

T
h
s

i

p
u
b

l
i

c
a

t
i

o
n

i

s

a
v
a

i
l

l

a
b
e
f
r
e
e
o
f

c
h
a
r
g
e
f
r
o
m

:

h
t
t
p
s
:
/
/
d
o
i
. o
r
g
/
1
0
. 6
0
2
8
/
N
S
T
S
P
. 8
0
0
-
5
3
r
5

I

. NIST SP 800-53, REV. 5                                                                                SECURITY AND PRIVACY CONTROLS FOR INFORMATION SYSTEMS AND ORGANIZATIONS
_________________________________________________________________________________________________

Acknowledgements

This publication was developed by the Joint Task Force Interagency Working Group. The group
includes representatives from the civil, defense, and intelligence communities. The National
Institute of Standards and Technology wishes to acknowledge and thank the senior leaders from
the Department of Commerce, Department of Defense, the Office of the Director of National
Intelligence, the Committee on National Security Systems, and the members of the interagency
working group whose dedicated efforts contributed significantly to this publication. Department of Defense

Dana Deasy
Chief Information Officer

Office of the Director of National
Intelligence
Matthew A. Kozma
Chief Information Officer

John Sherman
Principal Deputy CIO

Michael E. Waschull
Deputy Chief Information Officer

Mark Hakun
Deputy CIO for Cybersecurity and DoD SISO

Clifford M.

Security and Privacy Controls for Information Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Security Assessment?

[Assistant]
According to Blockchain for Access Control Systems:

This document presents analyses of blockchain AC systems from the perspectives of properties, components,  architectures,  and  model  supports,  as  well  as  discussions  on  considerations  for implementation. It  should  not  be  deemed  comprehensive  due  to  the  diverse  applications  of business and mission requirements. Before selecting and deploying a blockchain AC product or technology, the host organization should augment considerations in this document with testing and independent product reviews. 1. Policy  Administration  Point  (PAP):  Provides  a  user  interface  for  creating,  testing,  and debugging policies, as well as storing these policies in the appropriate repository. PAP can be created and maintained by AC nodes or smart contracts that are coded to access AC policies, depending on where the source of the AC data is maintained. 2. Policy  Information  Point  (PIP):  Serves  as  the  source  of  subject/object  attributes  or environment  condition  data  required  for  policy  evaluation  to  provide  the  information needed by the PDP to make the authorization decisions. PIP can be performed in AC nodes,

Blockchain  AC  system  management  needs  to  coordinate  with  the  business  and  resource requirements  of  the  system. For  instance,  a  federated  AC  system  may  spread  over  multiple organizations for cooperation and communication between participating organizations. Hence, AC policies needs to be flexible and fine-grained. A blockchain AC system can transform the policy evaluation process to executable smart contracts so that each organization can control its own system  while  communicating  with  other  federated  organizations. Optionally,  some  federation schemes  may  use  the  blockchain  as  a  database  for  storing  only  the  policies  but  not  use  the blockchain for access enforcement, such that PDP and PEP functions are performed off-the-chain.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice IA.L2-3.5.1 (NIST 3.5.1)?

[Assistant]
According to Data Integrity_ Detecting and Responding to Ransomware and Other Destructive Events:

3.5.1 Scenario

The following scenario was simulated to test the architecture's defense against unwanted database modification.

Data Integrity_ Detecting and Responding to Ransomware and Other Destructive Events


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Guide to Enterprise Patch Management Planning_ Preventive Maintenance for Technology provide? (Part 10)

[Assistant]
| Publication Structure.......................................................................................
| 2                                                                                |
| 2                                                                                | Risk Response Approaches for Software Vulnerabilities ..................................3                                       | Risk Response Approaches for Software Vulnerabilities ..................................3                                       |                                                                                |
|                                                                                | 2.1                                                                                | Risk Responses.............................................................................................. | 3                                                                                |
|                                                                                | 2.2                                                                                | Software Vulnerability Management Life Cycle...............................................

Guide to Enterprise Patch Management Planning_ Preventive Maintenance for Technology


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice CM.L2-3.4.2 (NIST 3.4.2)?

[Assistant]
According to Digital Identity Guidelines:

3.4.2. 3.4.2 and
Sec. 3.4.2 and
Sec.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Media Protection?

[Assistant]
According to Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule_ A Cybersecurity Resource Guide:

| Security Incident Procedures | 164.308(a)(6) | Response and Reporting (R) | | Contingency Plan | 164.308(a)(7) | Data Backup Plan (R) | | Contingency Plan | 164.308(a)(7) | Disaster Recovery Plan (R) | | Contingency Plan | 164.308(a)(7) | Emergency Mode Operation Plan (R) | | Contingency Plan | 164.308(a)(7) | Testing and Revision Procedure (A) | | Contingency Plan | 164.308(a)(7) | Applications and Data Criticality Analysis (A) | | Evaluation | 164.308(a)(8) | (R) | | Business Associate Contracts and Other Arrangements | 164.308(b)(1) | Written Contract or Other Arrangement (R) | | Physical Safeguards | Physical Safeguards | Physical Safeguards | | Facility Access Controls | 164.310(a)(1) | Contingency Operations (A) | | Facility Access Controls | 164.310(a)(1) | Facility Security Plan (A) | | Facility Access Controls | 164.310(a)(1) | Access Control and Validation Procedures (A) | | Facility Access Controls | 164.310(a)(1) | Maintenance Records (A) | | Workstation Use | 164.310(b) | (R) | | Workstation Security | 164.310(c) | (R) | | Device and Media Controls | 164.310(d)(1) | Disposal (R) | | Device and Media Controls | 164.310(d)(1) | Media Re-use (R) | | Device and Media Controls | 164.310(d)(1) |

Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule_ A Cybersecurity Resource Guide


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What guidance does Recommendation for Pair-Wise Key-Establishment Using Integer Factorization Cryptography provide?

[Assistant]
## NIST Special Publication 800-56B

## Revision 2

## Recommendation for Pair-Wise Key Establishment Using Integer Factorization Cryptography

Elaine Barker Lily Chen Allen Roginsky Apostol Vassilev Richard Davis Scott Simon

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-56Br2

## C  O  M  P  U  T  E  R      S  E  C  U  R  I  T  Y

<!-- image -->

## NIST Special Publication 800-56B Revision 2

## Recommendation for Pair-Wise Key Establishment Using Integer Factorization Cryptography

Elaine Barker Lily Chen Allen Roginsky Apostol Vassilev Computer Security Division Information Technology Laboratory

Richard Davis Scott Simon National Security Agency

This publication is available free of charge from:

https://doi.org/10.6028/NIST.SP.800-56Br2

March 2019

<!-- image -->

U.S. Department of Commerce Wilbur L. Ross, Jr., Secretary

National Institute of Standards and Technology

## Authority

This publication has been developed by NIST in accordance with its statutory responsibilities under the Federal Information Security Modernization Act (FISMA) of 2014, 44 U.S.C. § 3551 et seq. , Public Law (P.L.) 113-283. NIST is responsible for developing information security standards and guidelines, including minimum requirements for federal information systems, but such standards and guidelines shall not apply to national security systems without the express approval of appropriate federal officials exercising policy authority over such systems. This guideline is consistent with the requirements of the Office of Management and Budget (OMB) Circular A-130. Nothing in this publication should be taken to contradict the standards and guidelines made mandatory and binding on federal agencies by the Secretary of Commerce under statutory authority. Nor should these guidelines be interpreted as altering or superseding the existing authorities of the Secretary of Commerce, Director of the OMB, or any other federal official.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Assessing Enhanced Security Requirements for Controlled Unclassified Information provide? (Part 2)

[Assistant]
lar A-130. Nothing in this publication should be taken to contradict the standards and guidelines made mandatory and binding on federal agencies by the Secretary of Commerce under statutory authority.
Nor should these guidelines be interpreted as altering or superseding the existing authorities of the Secretary of Commerce, OMB Director, or any other federal official. This publication may be used by nongovernmental organizations on a voluntary basis and is not subject to copyright in the United States. Attribution would, however, be appreciated by NIST. National Institute of Standards and Technology Special Publication 800-172A Natl. Inst. Stand. Technol. Spec. Publ. 800-172A, 62 pages (March 2022)

CODEN: NSPUE2

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-172A

Certain  commercial  entities,  equipment,  or  materials  may  be  identified  in  this  document  to describe an experimental procedure or concept adequately. Such identification is not intended to imply recommendation or endorsement by NIST, nor is it intended to imply that the entities, materials, or equipment are necessarily the best available for the purpose. There may be references in this publication to other publications currently under development by  NIST  in  accordance  with  its  assigned  statutory  responsibilities. The  information  in  this publication, including concepts, practices, and methodologies, may be used by federal agencies even  before  the  completion  of  such  companion  publications. Thus,  until  each  publication  is completed,  current  requirements,  guidelines,  and  procedures,  where  they  exist,  remain operative. For planning and transition purposes, federal agencies may wish to closely follow the development of these new publications by NIST. Organizations are encouraged to review draft publications during the public comment periods and provide feedback to NIST.

Assessing Enhanced Security Requirements for Controlled Unclassified Information


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Media Protection?

[Assistant]
According to Status Report on the First Round of the Additional Digital Signature Schemes for the NIST Post-Quantum Cryptography Standardization Process:

3.8.

3.8. SDitH

Status Report on the First Round of the Additional Digital Signature Schemes for the NIST Post-Quantum Cryptography Standardization Process


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for Planning?

[Assistant]
According to Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171:

There may be references in this publication to other publications currently under development by  NIST  in  accordance  with  its  assigned  statutory  responsibilities.  The  information  in  this publication, including concepts, practices, and methodologies, may be used by federal agencies even  before  the  completion  of  such  companion  publications.  Thus,  until  each  publication  is completed,  current  requirements,  guidelines,  and  procedures,  where  they  exist,  remain operative. For planning and transition purposes, federal agencies may wish to closely follow the development of these new publications by NIST.

The enhanced security requirements are organized into 14 families consistent with the families for basic and derived requirements. Each family contains the requirements related to the general security topic of the family. The families are closely aligned with the minimum security requirements for federal information and information systems in [FIPS 200]. The security requirements for contingency planning , system and services acquisition , and planning are not included within the scope of this publication due to the tailoring criteria in [SP 800-171]. Table 1 lists the security requirement families addressed in this publication. 17

- 3.11.4e  Document or reference in the system security plan the security solution selected, the rationale for the security solution, and the risk determination.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Physical Protection?

[Assistant]
According to Guidelines for Media Sanitization:

The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the Nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology. ITL's responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in federal information systems. The Special Publication 800-series reports on ITL's research, guidelines, and outreach efforts in information system security, and its collaborative activities with industry, government, and academic organizations. - Hard copy. Hard copy media refers to physical representations of information, typically paper printouts, film, microfiche, etc. However, printer and facsimile ribbons, drums, and platens are also examples of hard copy media. The supplies associated with producing paper printouts are often the most uncontrolled. Hard copy materials containing sensitive data that leave an organization without effective sanitization expose a significant vulnerability to 'dumpster divers' and overcurious employees. - Information storage media (ISM).


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What guidance does NIST provide for CMMC Level 2?

[Assistant]
According to Profile of the IoT Core Baseline for Consumer IoT Products:

may wish to closely follow the development of these new publications by NIST. Organizations are encouraged to review all draft publications during public comment periods and provide feedback to NIST.
Many NIST cybersecurity publications, other than the ones noted above, are available at https://csrc.nist.gov/publications. ## NIST Technical Series Policies

Copyright, Fair Use, and Licensing Statements NIST Technical Series Publication Identifier Syntax

## Publication History

Approved by the NIST Editorial Review Board on 2022-09-08

## How to Cite this NIST Technical Series Publication:

Fagan M, Megas KN, Watrobski P, Marron J, Cuthill B (2022) Profile of the IoT Core Baseline for Consumer IoT Products. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Interagency or Internal Report (IR) NIST IR 8425. https://doi.org/10.6028/NIST.IR.8425

## Author ORCID iDs

Michael Fagan: 0000-0002-1861-2609

Katerina N. Megas: 0000-0002-2815-5448

Paul Watrobski: 0000-0002-6449-3030

Jeffrey Marron: 0000-0002-7871-683X

Barbara B. Cuthill: 0000-0002-2588-6165

## Contact Information

iotsecuirty@nist.gov

National Institute of Standards and Technology Attn: Applied Cybersecurity Division, Information Technology Laboratory 100 Bureau Drive (Mail Stop 2000) Gaithersburg, MD 20899-2000

All comments are subject to release under the Freedom of Information Act (FOIA). ## Reports on Computer Systems Technology

The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the Nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology.

Profile of the IoT Core Baseline for Consumer IoT Products


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What are the CMMC Level 3 requirements?

[Assistant]
According to Protecting Controlled Unclassified Information (CUI)_ NIST Special Publication 800-171, Revision 3. Small Business Primer:

ent, or possibly with other organizations like municipal governments, prime contractors, universities, etc., you will likely be required to demonstrate you are taking adequate measures to protect CUI.
Examples of CUI include:

<!-- image -->

|                      | When provided as part of a government contract, examples include:                                                                                | Marking 1     |
|----------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------|
| Controlled           | e.g., research and engineering data, engineering drawings, specifications, process sheets, manuals, technical reports, technical orders, catalog-item identifications, data sets, studies and analyses and related information, and computer software executable code and source code. | CUI//SP-CTI   |
| General Proprietary  | e.g., financial information, trade secrets, product research and development, existing and future product designs and performance specifications. | CUI//PROPIN   |
| Business Information | you do not handle CUI, implementing the security requirements in SP 800-171 will                                                                                | help you take |

1  For more information on types of CUI and markings, visit the National Archives and Records Administration (NARA) https://www.archives.gov/cui.

Protecting Controlled Unclassified Information (CUI)_ NIST Special Publication 800-171, Revision 3. Small Business Primer


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Identification and Authentication?

[Assistant]
According to Validating the Integrity of Computing Devices:

In this approach, device vendors create an artifact within each device that securely binds the device's attributes to the device's identity. The customer who acquires the device can validate the artifact's source and authenticity, then check the attributes stored in the artifact against the device's actual attributes to ensure they match. A similar process can be used to periodically verify the integrity of computing devices while they are in use. | Technology Partner/Collaborator   | Build Involvement                                                                                |
|-----------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Eclypsium                         | Eclypsium Analytics Service, Eclypsium Device Scanner                                                                                |
| HP Inc. | (2) Elitebook 840 G7, HP Sure Start, HP Sure Recover, Sure Admin, HP Client Management Script Library (CMSL), HP Tamperlock                                               |
| Hewlett Packard Enterprise        | Proliant DL360 Gen 10, Platform Certificate Verification Tool (PCVT)                                                                                |
| IBM                               | QRadar SIEM                                                                                |
| Intel                             | HP Inc.

Validating the Integrity of Computing Devices


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Access Control?

[Assistant]
According to Security and Privacy Controls for Information Systems and Organizations:

In  working  with  the  Office  of  Management  and  Budget  to  develop  standards  and  guidelines
required by FISMA, NIST consults with federal agencies, state, local, and tribal governments, and
private sector organizations to improve information security and privacy, avoid unnecessary and
costly duplication of effort, and help ensure that its publications are complementary with the
standards and guidelines used for the protection of national security systems. In addition to a
comprehensive  and  transparent  public  review  and  comment  process,  NIST  is  engaged  in  a
collaborative partnership with the Office of Management and Budget, Office of the Director of
National Intelligence, Department of Defense, Committee on National Security Systems, Federal
CIO Council, and Federal Privacy Council to establish a Risk Management Framework (RMF) for
information security and privacy for the Federal Government. This common foundation provides
the Federal Government and their contractors with cost-effective, flexible, and consistent ways
to manage security and privacy risks to organizational operations and assets, individuals, other
organizations, and the Nation. The framework provides a basis for the reciprocal acceptance of
security  and  privacy  control  assessment  evidence  and  authorization  decisions  and  facilitates
information sharing and collaboration. NIST continues to work with public and private sector
entities  to  establish  mappings  and  relationships  between  the  standards  and  guidelines
developed by NIST and those developed by other organizations. NIST anticipates using these
mappings and the gaps they identify to improve the control catalog. CHAPTER ONE   INTRODUCTION ...................................................................................................... 1
1.1   PURPOSE AND APPLICABILITY ...................................................................................................


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Access Control?

[Assistant]
According to Secure Software Development Practices for Generative AI and Dual-Use Foundation Models_ An SSDF Community Profile:

| Medium     | N1: An artifact is 'a piece of evidence' [16]. Evidence is 'grounds for belief or disbelief; data on which to base proof or to establish truth or falsehood' [17]. Artifacts provide records of secure software development practices. Examples of artifacts specific to AI model development include attestations of the integrity and provenance of training datasets. | AI RMF: Measure 2.1                                 |
| Define and Use Criteria for Software Security Checks (PO.4): Help ensure that the software resulting from the SDLC meets the organization's expectations by defining and using criteria for checking the software's security during development. | PO.4.1: Define criteria for software security checks and track throughout the SDLC. | Medium     | R1: Implement guardrails and other controls throughout the AI development life cycle, extending beyond the traditional SDLC. C1: Consider requiring review and approval from a human-in-the-loop for software security checks beyond risk-based thresholds. | AI RMF: Measure 2.3, 2.7; Manage 1.1 OWASP: LLM01-2 |
| Define and Use Criteria for Software Security Checks (PO.4): Help ensure that the software resulting from the SDLC meets the organization's expectations by defining and using criteria for checking the software's security during development. | PO.4.2: Implement processes, mechanisms, etc. to gather and safeguard the necessary information in support of the criteria.

Secure Software Development Practices for Generative AI and Dual-Use Foundation Models_ An SSDF Community Profile


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Information Integrity?

[Assistant]
According to Access Control on NoSQL Databases:

d their connected resource consumers are the primary concerns of an RM. 3. Resource consumers (RCs) are client applications that accept user requests for resources and forward those requests to an RM.
Ideally, an RP should only have to communicate with one RM because the dissemination of shared resources is achieved by the RM. Only one connection between an RM and an RC is expected as well because the discovery of resource locations should be done by an RM, as illustrated in Fig. 11.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AC.L2-3.1.4 (NIST 3.1.4)?

[Assistant]
According to Audit and Evaluation of Computer Security II_ System Vulnerabilities and Controls:

3.1.4                                                  | Vulnerability of Services                                                       | 6-9       |
| 3. 3.1.4 Vulnerability of Services : The working group concluded that one of the vulnerabilities to the system that results from remote processing is the conversion of service or capacity from the use of the owners to the use of another person.

Audit and Evaluation of Computer Security II_ System Vulnerabilities and Controls


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice IA.L2-3.5.2 (NIST 3.5.2)?

[Assistant]
According to Audit and Evaluation of Computer Security:

3.5.2

Determine if Computer Assisted Techniques Will Be Used

Use of the computer will depend on:
-The nature of the control.

Audit and Evaluation of Computer Security


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AC.L2-3.1.70 (NIST 3.1.70)?

[Assistant]
According to Guide to Malware Incident Prevention and Handling for Desktops and Laptops:

3.1.70 appears to be infected but not have any idea where that machine resides or who uses it.

Guide to Malware Incident Prevention and Handling for Desktops and Laptops