[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Ordered t-way Combinations for Testing State-based Systems provide? (Part 10)

[Assistant]
ruction of OCCs are of interest. Example. Fig. 6  shows a test array that covers all 2way combinations of values for four parameters, as well as all 2-sequences of 2-way parameter combinations. Fig.6.
Tests for four parameters, OCC(20,2,4,2)

<!-- image -->

|    |   p 1 |   p 2 |   p 3 |   p 4 |
|----|-------|-------|-------|-------|
|  1 |     1 |     1 |     1 |     0 |
|  2 |     0 |     0 |     0 |     0 |
|  3 |     1 |     1 |     0 |     1 |
|  4 |     0 |     0 |     1 |     1 |
|  5 |     1 |     1 |     0 |     0 |
|  6 |     1 |     1 |     1 |     1 |
|  7 |     0 |     1 |     1 |     0 |
|  8 |     0 |     1 |     1 |     0 |
|  9 |     0 |     1 |     0 |     1 |
| 10 |     1 |     1 |     1 |     1 |
| 11 |     1 |     0 |     1 |     0 |
| 12 |     1 |     1 |     0 |     1 |
| 13 |     0 |     1 |     1 |     1 |
| 14 |     0 |     0 |     0 |     0 |
| 15 |     0 |     0 |     0 |     1 |
| 16 |     0 |     0 |     1 |     0 |
| 17 |     1 |     1 |     1 |     0 |
| 18 |     0 |     1 |     0 |     1 |
| 19 |     1 |     1 |     1 |     0 |
| 20 |     1 |     0 |     1 |     1 |

That is, the test array includes every solution of ( pwpx = v 1 v 2 ) *→ ( pypz = v 1 v 2 ), of which  there are ( 𝐶𝐶 (4,2) 𝑥𝑥 2 2 ) 2 = 576 instances. For example, each of the four possible settings of p 1 p 2 is followed by each of the four possible settings of p 3 p 4 somewhere in the table (distinguished by color). That is, ( p1p2 = 11) in line 1 is followed by ( p3p4 = 01), ( p3p4 = 01), ( p3p4 = 11), ( p3p4 = 00), ( p3p4 = 10) in lines 3, 4, 5, and 7, respectively, highlighted in yellow (also  for ( p1p2 = 00)). Sequences for ( p1p2 = 01) are shown in green, plus line 14, which provides a ( p3p4 =  00) for both ( p1p2 = 01) and ( p1p2 = 10). Sequences for ( p1p2 = 10) are highlighted in blue. ## 3.1 Combination Sequence Covering Arrays in Testing

As  seen  in  Fig.

Ordered t-way Combinations for Testing State-based Systems


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AU.L2-3.3.1 (NIST 3.3.1)?

[Assistant]
According to Recommendation for Pair-Wise Key-Establishment Using Integer Factorization Cryptography:

3.3.1                                                                                | KAS2 Key-Confirmation Components... 3.3.1  KAS2 Key-Confirmation Components

The components for KAS2 key agreement with key confirmation are the components in Section 8.

Recommendation for Pair-Wise Key-Establishment Using Integer Factorization Cryptography


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Communications Protection?

[Assistant]
According to Guidelines for Media Sanitization:

..................................13  |
| 3.2.4. Quality of Cryptographic Implementations................................................................................15                   |
| 3.2.5.
Traceability of CE Operations.....................................................................................................16         |
| Media Sanitization Program .........................................................................................................18              |
| 4. |
| 4.3.1. Information Decisions in the System Life Cycle..........................................................................20                   |
| 4.3.2. Determination of Security Categorization..................................................................................21                 |
| 4.3.3. Reuse of Media...........................................................................................................................22  |
| 4.3.4. Control of Media ........................................................................................................................22  |
| 4.3.5. Data Protection Level .................................................................................................................23    |
| 4.3.6. Sanitization and Disposal Decision.............................................................................................23            |


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Planning?

[Assistant]
According to Recommendations for Federal Vulnerability Disclosure Guidelines:

o prepare for contact from news media. Organization planning should consider facilitating close working relationships and supporting customer service to handle and respond to security vulnerabilities.
These capabilities may vary from a confidential means of communication with stakeholders to the escalation of questions from advisories for a coordinated response.

Recommendations for Federal Vulnerability Disclosure Guidelines


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Physical Protection?

[Assistant]
According to Federal Cybersecurity Awareness Programs_ A Mixed Methods Research Study:

The  Information  Technology  Laboratory  (ITL)  at  the  National  Institute  of  Standards  and Technology  (NIST)  promotes  the  U.S.  economy  and  public  welfare  by  providing  technical leadership  for  the  Nation's  measurement  and  standards  infrastructure.  ITL  develops  tests,  test methods, reference data, proof of concept implementations, and technical analyses to advance the development  and  productive  use  of  information  technology.  ITL's  responsibilities  include  the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in federal information systems.

The term security will be used as a shorthand for 'cybersecurity' or 'information security.' Reference to physical security is different and will be labeled as such.

□ Physical security

Federal Cybersecurity Awareness Programs_ A Mixed Methods Research Study


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Recommendation for Pair-Wise Key-Establishment Schemes Using Discrete Logarithm Cryptography provide? (Part 6)

[Assistant]
s, Symbols and Abbreviations ............................................................... | 3. Definitions, Symbols and Abbreviations ...............................................................
| 2                                                                                |
|                                                                                | 3.1                                                                                | Definitions........................................................................................................................ | 2                                                                                |
|                                                                                | 3.2                                                                                | Symbols and Abbreviations ............................................................................................. | 9                                                                                |
| 4. Overview of Key-Establishment Schemes........................................................... | 4. Overview of Key-Establishment Schemes........................................................... | 4. Overview of Key-Establishment Schemes...........................................................

Recommendation for Pair-Wise Key-Establishment Schemes Using Discrete Logarithm Cryptography

Audit and Accountability
System and Information Integrity
Security Assessment
Media Protection
Identification and Authentication
Awareness and Training
System and Communications Protection
Access Control
Planning
Incident Response
Risk Assessment
Personnel Security
System and Services Acquisition
Supply Chain Risk Management
Maintenance
Physical Protection
Configuration Management


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for Planning?

[Assistant]
According to Protecting Controlled Unclassified Information (CUI)_ NIST Special Publication 800-171, Revision 3. Small Business Primer:

| Access Control                    | Maintenance         | Security Assessment and Monitoring   |
|-----------------------------------|---------------------|--------------------------------------|
| Awareness and Training            | Media Protection    | System and Communications Protection |
| Audit and Accountability          | Personnel Security  | System and Information Integrity     |
| Configuration Management          | Physical Protection | Planning                             |
| Identification and Authentication | Risk Assessment     | System and Services Acquisition      |
| Incident Response                 |                     | Supply Chain Risk Management         |

| Identify the role(s) responsible for security and provide the necessary resources. | Whether it is just one person or multiple people within the business, ensure roles, responsibilities, and authorities related to cybersecurity risk management are established, communicated, understood, and enforced. Even if cybersecurity activities are outsourced to an external provider, someone within the business should still be designated to manage cybersecurity risk.

Protecting Controlled Unclassified Information (CUI)_ NIST Special Publication 800-171, Revision 3. Small Business Primer


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Physical Protection?

[Assistant]
According to Status Report on the First Round of the Additional Digital Signature Schemes for the NIST Post-Quantum Cryptography Standardization Process:

The  Information  Technology  Laboratory  (ITL)  at  the  National  Institute  of  Standards  and
Technology (NIST) promotes the U.S. economy and public welfare by providing technical
leadership for the Nation’s measurement and standards infrastructure. ITL develops tests,
test methods, reference data, proof of concept implementations, and technical analyses
to advance the development and productive use of information technology.  ITL’s respon-
sibilities include the development of management, administrative, technical, and physical
standards and guidelines for the cost-effective security and privacy of other than national
security-related information in federal information systems.

3.10. MAYO . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

3.10. MAYO

Status Report on the First Round of the Additional Digital Signature Schemes for the NIST Post-Quantum Cryptography Standardization Process


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does High-Performance Computing Security_ Architecture, Threat Analysis, and Security Posture provide? (Part 6)

[Assistant]
|
| 2.1.1. Components of the High-Performance Computing Zone.............................................................3                                  |
| 2.1.2.
Components of the Data Storage Zone........................................................................................4                     |
| 2.1.3. Parallel File System.......................................................................................................................4     |
| 2.1.4. Archival and Campaign Storage....................................................................................................5               |
| 2.1.5. Burst Buffer ..................................................................................................................................5 |
| 2.1.6. Components of the Access Zone..................................................................................................6                 |
| 2.1.7. Components of the Management Zone.......................................................................................6                        |
| 2.1.8. General Architecture and Characteristics ....................................................................................6                   |
| 2.1.9. Basic Services................................................................................................................................7  |
| 2.1.10. Configuration Management.......................................................................................................7                |
| 2.1.11. HPC Scheduler and Workflow Management..............................................................................7                            |
| 2.1.12. HPC Software..............................................................................................................................8     |
| 2.1.13.

High-Performance Computing Security_ Architecture, Threat Analysis, and Security Posture


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Maintenance?

[Assistant]
According to Multi-Factor Authentication for Criminal Justice Information Systems_ Implementation Considerations for Protecting Criminal Justice Information:

.org/10.6028/NIST.SP.800-63-4
- [4] Temoshok D, Fenton JL, Choong YY, Lefkovitz N, Regenscheid A, Galluzzo R, Richer JP (2025) Digital Identity Guidelines: Authentication and Authenticator Management.
(National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) 800-63B-4. https://doi.org/10.6028/NIST.SP.800-63B-4
- [5] Regenscheid A, Galluzzo R (2023) Phishing Resistance -Protecting the Keys to Your Kingdom. https://www.nist.gov/blogs/cybersecurity-insights/phishing-resistanceprotecting-keys-your-kingdom
- [6] Cybersecurity and Infrastructure Security Agency (2025) List of Federal Financial Assistance Programs Funding Emergency Communications. https://www.cisa.gov/safecom/emergency-comms-grants-list
- [7] Weston D (2024) Microsoft's guidance to help mitigate Kerberoasting. (Microsoft Corporation, Redmond, WA.) Available at https://www.microsoft.com/enus/security/blog/2024/10/11/microsofts-guidance-to-help-mitigate-kerberoasting/
- [8] Fisher W, Russell M, Umarji S, Scarfone K (2021) Background on Identity Federation Technologies for the Public Safety Community. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Internal Report 8336. https://doi.org/10.6028/NIST.IR.8336-draft
- [9] Grassi PA, Nadeau EM, Richer JP, Squire SK, Fenton JL, Lefkovitz NB, Danker JM, Choong Y-Y, Greene KK, Theofanos MF (2017) Digital Identity Guidelines: Federation and Assertions. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) 800-63C, Includes updates as of March 02, 2020. https://doi.org/10.6028/NIST.SP.800-63C

Multi-Factor Authentication for Criminal Justice Information Systems_ Implementation Considerations for Protecting Criminal Justice Information


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Services Acquisition?

[Assistant]
According to Organizational Views of NIST Cryptographic Standards and Testing and Validation Programs:

multitude of errors and developer pitfalls in the cryptographic implementations of software products [1-5]. However, these studies focused on the practices of less-experienced, individual developers.
Therefore, there was little understanding of the cryptographic development practices of organizations, including the benefits and challenges of using cryptographic resources such as standards specifications and libraries.

Organizational Views of NIST Cryptographic Standards and Testing and Validation Programs


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Awareness and Training?

[Assistant]
According to Risk Management Framework for Information Systems and Organizations_ A System Life Cycle Approach for Security and Privacy:

n the RMF; information resources as system and system elements; authorization boundaries; security and privacy posture; and security and privacy considerations related to supply chain risk management.
- Chapter Three describes the tasks required to implement the steps in the RMF including: organization-level and information system-level preparation; categorization of information and information systems; control selection, tailoring, and implementation; assessment of control effectiveness; information system and common control authorization; the ongoing monitoring of controls; and maintaining awareness of the security and privacy posture of information systems and the organization. - Supporting Appendices provide additional information and guidance for the application of the RMF including:
- -References;
- -Glossary of Terms;
- -Acronyms;
- -Roles and Responsibilities;
- -Summary of RMF Tasks;
- -System and Common Control Authorizations;
- -Authorization Boundary Considerations; and
- -System Life Cycle Considerations.

Risk Management Framework for Information Systems and Organizations_ A System Life Cycle Approach for Security and Privacy


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AT.L2-3.2.10 (NIST 3.2.10)?

[Assistant]
According to Digital Identity Guidelines_ Authentication and Authenticator Management:

3.2.10. 3.2.10

4. 3.2.10.

Digital Identity Guidelines_ Authentication and Authenticator Management


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for System and Communications Protection?

[Assistant]
According to Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171:

| CHAPTERONE INTRODUCTION...................................................................................................... | CHAPTERONE INTRODUCTION...................................................................................................... |
|--------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------|
| 1.1 PURPOSEANDAPPLICABILITY                                                                                | ................................................................................................... 3                                            |
| 1.2 TARGET AUDIENCE                                                                                | .................................................................................................................. 4                             |
| 1.3 ORGANIZATIONOF THIS SPECIAL PUBLICATION                                                                                | .......................................................................... 4                                                                     |
| CHAPTERTWO THE FUNDAMENTALS............................................................................................ 5                        | CHAPTERTWO THE FUNDAMENTALS............................................................................................ 5                        |
| 2.1 DEVELOPMENTAPPROACH ......................................................................................................

Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 2 require for System and Information Integrity?

[Assistant]
According to Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations:

......................98      |
| Table 11. Maintenance (MA) ......................................................................................................................98      |
| Table 12.
Media Protection (MP)................................................................................................................99        |
| Table 13. Physical and Environmental Protection (PE)...............................................................................99                    |
| Table 14. Planning (PL)..............................................................................................................................100 |
| Table 15. Program Management (PM) .....................................................................................................100               |
| Table 16. Personnel Security (PS) .............................................................................................................101       |
| Table 17. PII Processing and Transparency (PT) .......................................................................................102                |
| Table 18. Risk Assessment (RA) ................................................................................................................102       |
| Table 19. System and Services Acquisition (SA)........................................................................................103                |
| Table 20. System and Communications Protection (SC)...........................................................................103                        |
| Table 21. System and Information Integrity (SI) .......................................................................................104               |
| Table 22. Supply Chain Risk Management (SR).........................................................................................105                  |
| Table 23.

Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Audit and Accountability?

[Assistant]
According to Strategies for the Integration of Software Supply Chain Security in DevSecOps CI_CD Pipelines:

ed package. - The security team should approve the merging of unverified sources of OSS. - Developers should download OSS as source code rather than pre-compiled libraries or binaries, when available.
- Developers should verify digital signatures, run vulnerability scans, check for recent updates on newly downloaded OSS's source-code packages, and generate an SBOM with dependency scanning on the first commit in order to identify the risks of any upstream or downstream dependencies within the OSS. - Artifacts should be scanned in internal repositories for newly discovered or identified defects and the ability to stop their use in builds based on criticality. - CI/CD processes should be audited regularly, and automation should be introduced wherever possible to improve the performance of activities and operations. - There should be isolated CI/CD environment and elevated administrator credentials for the deployment of applications in clouds. - There should be enhanced real-time monitoring and alerting mechanisms to detect suspicious activities in CI/CD servers, especially activities that might indicate the exfiltration of sensitive data or the tampering of builds.

Strategies for the Integration of Software Supply Chain Security in DevSecOps CI_CD Pipelines


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Security Assessment?

[Assistant]
According to Machine Learning for Access Control Policy Verification:

Machine learning has been used for device control, system analysis, and business forecasting. However, the use of ML for software testing is in the early stages [AWCS, CAT5]. In particular, ML applications for model proof are still elusive and have yet to be explored. ML classification allows for the generation or prediction of target classes for new input data using some sample training data produced by running the system instead of comprehensive input data. For access control policy verification, the training data is assigned attributes' values of policy rules, and the target for classification is access permissions (e.g., grant and deny) assigned to rules. The data is consumed by an ML classification algorithm to  generate a classification model . Querying the accuracy of training data against the model allows for the detection of inconsistencies, indicating faults found among policy rules. In addition, to verify new or updated policy rules, they need to be contained in test data for additional accuracy analysis on test data. 1. Enhancement of existing verification method - In addition to replacing traditional access control policy verification methods, the RFC verification method can be used to enhance traditional methods by checking the correctness of the policy model itself before applying it to test new or updated cases. Most traditional model verification methods assume that the access control policy has no faults until new or updated rules are tested against. For example,  Access  Control  Policy  Tool  (ACPT)  [Hwang  et  al. 10,  ACPT]  uses  security requirements as test cases for counterexample generation of found faults. It would be more efficient if the policy model error can be verified without composing security requirements to discover faults that already exist in the model. 2.

Machine Learning for Access Control Policy Verification


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Risk Assessment?

[Assistant]
According to Control Baselines for Information Systems and Organizations:

ence is urgently needed…'

The security and privacy controls specified in the baselines represent the state-of-the-practice protection measures for individuals, information systems, and organizations.
The controls comprising the baselines are periodically reviewed and revised to reflect the experience gained from using the controls; new or revised laws, executive orders, directives, regulations, policies, and standards; changing security and privacy requirements; emerging threats, vulnerabilities, attacks, and information processing methods; and the availability of new technologies. Thus, the security and privacy controls specified in the baselines are also expected to change over time as controls are withdrawn, revised, and added. In addition to the need for change, the need for stability is addressed by requiring that proposed changes to the baseline undergo a rigorous and transparent public review process to obtain public and private sector feedback and to build a consensus for baseline changes. The public review process provides a stable, flexible, and technically sound set of security and privacy control baselines.

Control Baselines for Information Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Planning?

[Assistant]
According to Automated Secure Configuration Guidance from the macOS Security Compliance Project (mSCP):

There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may be used by federal agencies even before the completion of such companion publications. Thus, until each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning and transition purposes, federal agencies may wish to closely follow the development of these new publications by NIST.

Automated Secure Configuration Guidance from the macOS Security Compliance Project (mSCP)


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Audit and Evaluation of Computer Security II_ System Vulnerabilities and Controls provide? (Part 7)

[Assistant]
second invitational workshop on computer security audit, entitled "Audit and Evaluation of Computer Security II: System Vulnerabilities and Controls," In Miami Beach, Florida, on November 28-30, 1978.
A cross-section of highly qualified people In the computer science and EDP audit fields was assembled to develop material that would be directly usable for a Federal Information Processing Standard (FTPS) Guideline on the subject. Tn order to cover the material in a systematic fashion, the workshop was partitioned into three management sessions and five technical sessions. The management sessions addressed Managerial and Organizational Vulnerabilities and Controls at the Staff Level (1 session) and the Line Level (2 sessions). The technical sessions addressed vulnerabilities and controls in the areas of Terminal and Remote Peripherals, Communication Components, Operating Systems, Applications and Non- Integrated Data Files, and Data Base/ Data Base Management Systems. These Proceedings are the reports developed by the eight sessions of the workshop. Keywords: Applications controls, computer vulnerabilities, data base controls, data base management systems controls, EDP audit, internal audit, operating system controls, system controls, system vulnerabilities, terminal controls. ## ACKNOWLEDGEM ENTS

The success of the workshop can be attributed to the efforts of many people. Tn addition to thanking all the participants, T would particularly like to thank my CoChairperson, Robert G. McKenzle, for his untiring efforts in making the workshop a reality; the Session Chairpersons and Recorders for their efforts in producing the fire set of reports contained in these proceedings; Richard Canning for his excellent coordination activities while the workshop sessions were in progress; Dennis K. Branstad for the photographs taken during the workshop; and Tina Faecke for her steadfast typing support. Z. G.

Audit and Evaluation of Computer Security II_ System Vulnerabilities and Controls


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AC.L2-3.1.3 (NIST 3.1.3)?

[Assistant]
According to Approaches and Challenges of Federal Cybersecurity Awareness Programs:

3.1.3                                                                                | Update Frequency... 3.1.3 Update Frequency

Participants indicated how often their organization updates security awareness training content, with 80% answering that they update it at least once a year.

Approaches and Challenges of Federal Cybersecurity Awareness Programs


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Transitioning to the Security Content Automation Protocol (SCAP) Version 2 provide? (Part 2)

[Assistant]
ovides a gap analysis of SCAP v1 and an overview of how SCAP v2 will address these gaps; describes the SCAP 2.0 architecture; and provides a plan for completing the work necessary to finalize SCAP v2.
## Keywords

architecture; configuration; endpoint; endpoint security; SCAP; security automation; security content automation; Security Content Automation Protocol; software identification; SWID; vulnerability

## Disclaimer

Any mention of commercial products or reference to commercial organizations is for information only; it does not imply recommendation or endorsement by NIST, nor does it imply that the products mentioned are necessarily the best available for the purpose. ## Additional Information

For additional information on NIST's Cybersecurity programs, projects and publications, visit the Computer Security Resource Center, https://csrc.nist.gov. Information on other efforts at NIST and in the Information Technology Laboratory (ITL) is available at https://www.nist.gov and https://www.nist.gov/itl. More information on NIST Software Identification and SCAP can be found at https://csrc.nist.gov/projects/Software-Identification-SWID and https://csrc.nist.gov/projects/security-content-automation-protocol respectively.

Transitioning to the Security Content Automation Protocol (SCAP) Version 2


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Communications Protection?

[Assistant]
According to Strategies for the Integration of Software Supply Chain Security in DevSecOps CI_CD Pipelines:

A software developer's workstation typically contains various assets, including source code, credentials, and access to sensitive information, such as personally identifiable information (PII), protected health information (PHI), intellectual property (IP), cryptographic materials (e.g., software artifact signing keys), and proprietary information. Companies should identify critical assets and implement controls to protect them from unauthorized access, such as access controls, multi-factor authentication, encryption of data at rest and in transit, and data loss prevention (DLP) measures.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Guidelines on Mobile Device Forensics provide? (Part 8)

[Assistant]
| MEMORY CONSIDERATIONS ..............................................................................................
| 5                                                                                |
| 2.3                                                                                | IDENTITY MODULE CHARACTERISTICS ............................................................................. | 7                                                                                |
| 2.4                                                                                | CELLULAR NETWORK CHARACTERISTICS.......................................................................10                              |                                                                                |
| 2.5                                                                                | OTHER COMMUNICATIONS SYSTEMS                                                                                | ..............................................................................12                                            |
| 3. FORENSIC TOOLS.............................................................................................................15       | 3.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice MA.L2-3.7.1 (NIST 3.7.1)?

[Assistant]
According to Data Integrity_ Detecting and Responding to Ransomware and Other Destructive Events:

3.7.1 Scenario

The following scenario was simulated to test the architecture's defense against compromised update servers.

Data Integrity_ Detecting and Responding to Ransomware and Other Destructive Events


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Guide for Developing Security Plans for Federal Information Systems provide? (Part 5)

[Assistant]
| ...........................................................................................................
5                     |
| 1.7.4 Senior Agency Information Security Officer (SAISO) .................................................... | 6                                                                                |
| 1.7.5 Information System Security Officer ............................................................................... | 6                                                                                |
| 1.7.6 Authorizing Official                                                                                | .......................................................................................................... 7                      |
| 1.8 RULES OF BEHAVIOR                                                                                | ................................................................................................................. 7               |
| 1.9 SYSTEM SECURITY PLAN APPROVAL ......................................................................................... | 8                                                                                |
| 2. SYSTEM BOUNDARY ANALYSIS AND SECURITY CONTROLS.................................... 9                                                    | 2. SYSTEM BOUNDARY ANALYSIS AND SECURITY CONTROLS.................................... 9                                           |
| 2.1 SYSTEM BOUNDARIES................................................................................................................

Guide for Developing Security Plans for Federal Information Systems


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations provide? (Part 7)

[Assistant]
................................3           | 2. The Fundamentals.....................................................................................................................3           |
| 3.
The Security Requirements........................................................................................................6               | 3. The Security Requirements........................................................................................................6               | 3. The Security Requirements........................................................................................................6               |
| References.......................................................................................................................................75 | References.......................................................................................................................................75 | References.......................................................................................................................................75 |
| Appendix A. | Acronyms ................................................................................................................83                         |                                                                                |
| Appendix B. | Glossary...................................................................................................................85                       |                                                                                |
| Appendix C.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for Supply Chain Risk Management?

[Assistant]
According to Assessing Enhanced Security Requirements for Controlled Unclassified Information:

| |-----------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | | ASSESSMENT OBJECTIVE Determine if: | ASSESSMENT OBJECTIVE Determine if: | | | 3.11.6e[a] | Supply chain risks associated with organizational systems and system components are identified.

Assessing Enhanced Security Requirements for Controlled Unclassified Information


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for System and Services Acquisition?

[Assistant]
According to Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171:

........................................................................ | CHAPTERONE INTRODUCTION......................................................................................................
|
|--------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------|
| 1.1 PURPOSEANDAPPLICABILITY                                                                                | ................................................................................................... 3                                            |
| 1.2 TARGET AUDIENCE                                                                                | .................................................................................................................. 4                             |
| 1.3 ORGANIZATIONOF THIS SPECIAL PUBLICATION                                                                                | .......................................................................... 4                                                                     |
| CHAPTERTWO THE FUNDAMENTALS............................................................................................ 5                        | CHAPTERTWO THE FUNDAMENTALS............................................................................................ 5                        |
| 2.1 DEVELOPMENTAPPROACH ......................................................................................................


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Communications Protection?

[Assistant]
According to Guidelines for Media Sanitization:

| Executive Summary............................................................................................................................1      |
|-----------------------------------------------------------------------------------------------------------------------------------------------------|
| 1. Introduction...................................................................................................................................2 |
| 2. Background....................................................................................................................................5  |
| 3. Summary of Sanitization Methods..................................................................................................8               |
| 3.1.1. Clear Sanitization Method............................................................................................................8       |
| 3.1.2. Purge Sanitization Method.........................................................................................................10         |
| 3.1.3. Destroy Sanitization Method......................................................................................................11          |
| 3.2.1. Strength of Cryptography for CE ................................................................................................12           |
| 3.2.2. Applicability of CE.......................................................................................................................13 |
| 3.2.3. Sanitization of Keys ....................................................................................................................13  |
| 3.2.4. Quality of Cryptographic Implementations................................................................................15                   |
| 3.2.5.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Maintenance?

[Assistant]
According to Analyzing Collusion Threats in the Semiconductor Supply Chain:

Additional information about this publication is available at https://csrc.nist.gov/publications/cswp, including related content, potential updates, and document history.

Analyzing Collusion Threats in the Semiconductor Supply Chain


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for System and Communications Protection?

[Assistant]
According to Protecting Controlled Unclassified Information (CUI)_ NIST Special Publication 800-171, Revision 3. Small Business Primer:

| Access Control                    | Maintenance         | Security Assessment and Monitoring   |
|-----------------------------------|---------------------|--------------------------------------|
| Awareness and Training            | Media Protection    | System and Communications Protection |
| Audit and Accountability          | Personnel Security  | System and Information Integrity     |
| Configuration Management          | Physical Protection | Planning                             |
| Identification and Authentication | Risk Assessment     | System and Services Acquisition      |
| Incident Response                 |                     | Supply Chain Risk Management         |

- A business champion: Someone who is responsible for developing and maintaining the incident response plan.
- Who to call: List all the individuals who may be part of the incident response efforts. Include their contact information, roles, and responsibilities.
- What/when/how to report: List the business' communications/reporting responsibilities as required by laws, regulations, contracts, agreements, or policies.
- Also, most federal contracts will include specific reporting and notification requirements that should be included in the Incident Response Plan

Description: Monitor, control, and protect organizational communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of the systems; and employ architectural designs, software development techniques, and systems engineering principles that promote effective information security within organizational systems.

Protecting Controlled Unclassified Information (CUI)_ NIST Special Publication 800-171, Revision 3. Small Business Primer


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice CM.L2-3.4.4 (NIST 3.4.4)?

[Assistant]
According to Digital Identity Guidelines_ Authentication and Authenticator Management:

3.4.4 of [SP800-63])

3.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Maintenance?

[Assistant]
According to Access Control on NoSQL Databases:

Additional information about this publication is available at https://csrc.nist.gov/pubs/ir/8504/final, including related content, potential updates, and document history.

NoSQL databases provide flexible schemas that enable easy database changes and seamless integration with database applications. For example, in document-based systems, documents do not need to follow the same schema, which allows for faster creation and maintenance of documents with minimal overhead.

- Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) 800-162, Includes updates as of August 02, 2019. https://doi.org/10.6028/NIST.SP.800162
- [WT] WeAreTechies (2022) NoSQL database | key value | document | wide column | graph stores. Available at https://www.youtube.com/watch?v=zG6CHYCx6ag
- [ZA] Zaki AK (2014) NoSQL Databases: New Millennium Database for Big Data, Big Users, Cloud Computing and its Security Challenges, International Journal of Research in Engineering and Technology 3(3):403-409 (May).


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Digital Identity Guidelines_ Identity Proofing and Enrollment provide? (Part 3)

[Assistant]
l official. This publication may be used by nongovernmental
organizations on a voluntary basis and is not subject to copyright in the United States. Attribution would, however, be appreciated by NIST.
NIST Technical Series Policies

Copyright, Fair Use, and Licensing Statements
NIST Technical Series Publication Identifier Syntax

Publication History

Approved by the NIST Editorial Review Board on 2025-05-30. Supersedes NIST SP 800-63A (June 2017; updated March 2, 2020) https://doi.org/10. 6028/NIST.SP.800-63a

How to Cite this NIST Technical Series Publication

Temoshok D, Abruzzi C, Choong YY, Fenton JL, Galluzzo R, LaSalle C, Lefkovitz N,
Regenscheid A, Vachino M (2025) Digital Identity Guidelines: Identity Proofing and
Enrollment. (National Institute of Standards and Technology, Gaithersburg, MD), NIST
Special Publication (SP) NIST SP 800-63A-4. https://doi.org/10.6028/NIST.SP.800-63A-4

Author ORCID iDs

David Temoshok: 0000-0001-6195-0331
Christine Abruzzi: 0000-0001-8904-930X
Yee-Yin Choong: 0000-0002-3889-6047
James L. Fenton: 0000-0002-2344-4291
Ryan Galluzzo: 0000-0003-0304-4239
Connie LaSalle: 0000-0001-6031-7550
Naomi Lefkovitz: 0000-0003-3777-3106
Andrew Regenscheid: 0000-0002-3930-527X
Maria Vachino: 0000-0002-3494-5307

Contact Information

mailto:dig-comments@nist.gov

National Institute of Standards and Technology
Attn: Applied Cybersecurity Division, Information Technology Laboratory
100 Bureau Drive (Mail Stop 2000) Gaithersburg, MD 20899-2000

Additional Information

Additional information about this publication is available at https://csrc.nist.gov/pubs/
sp/800/63/A/4/final, including related content, potential updates, and document
history. All comments are subject to release under the Freedom of Information Act (FOIA). NIST SP 800-63A-4
July 2025

Abstract

Digital Identity Guidelines
Identity Proofing and Enrollment

This guideline focuses on identity proofing and enrollment for use in digital
authentication.

Digital Identity Guidelines_ Identity Proofing and Enrollment


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for Audit and Accountability?

[Assistant]
According to Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171:

............................................ 5                        |
| 2.1 DEVELOPMENTAPPROACH ......................................................................................................
| 5                                                                                |
| 2.2 ORGANIZATIONANDSTRUCTURE                                                                                | ............................................................................................. 7                                                  |
| 2.3 FLEXIBLE APPLICATION                                                                                | ............................................................................................................. 9                                  |
| CHAPTER THREE THE REQUIREMENTS......................................................................................... 11                       | CHAPTER THREE THE REQUIREMENTS......................................................................................... 11                       |
| 3.1 ACCESSCONTROL                                                                                | .................................................................................................................. 12                            |
| 3.2 AWARENESSANDTRAINING                                                                                | ...................................................................................................


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Personnel Security?

[Assistant]
According to Guide to a Secure Enterprise Network Landscape:

- The primary function of the first generation of CASBs was the discovery of resources. They provided visibility into all of the cloud resources that the enterprise users accessed, thus preventing or minimizing the chances of shadow IT. Shadow IT is the practice of some users using cloud applications that are not authorized by the enterprise IT management from home or the office using enterprise desktops. An example of this is the use of unapproved software as-a-service (SaaS) applications for file sharing, social media, collaboration, and web conferencing [4]. This generation of CASBs also provides some statistics, such as software-as-a-service (SaaS) utilization. - The current generation of CASBs enforces security and governance policies for cloud applications, thus enabling enterprises to extend their on-premises policies to the cloud. Specific security services provided by CASBs include:
- o Protection of enterprise data that live in cloud service providers' servers (due to SaaS or IaaS subscriptions), as well as data inflow and data outflow (i.e., Data Loss Prevention [DLP] capabilities) from those servers. - o Tracking of threats, such as account hijacking and other malicious activities, some of which can detect anomalies in users' cloud access behavior (through robust User and Entity Behavior Analytics (UEBA) functionality) and stop insider threats and advanced cyberattacks [5]. - o Detection of misconfigurations in the enterprise's subscribed IaaS and cloud servers. These misconfigurations pose serious security risks, such as data breaches. Alerts generated by CASB due to misconfigurations in the enterprise's IaaS deployments direct the enterprise to follow guidelines, such as the Center for Internet Security's (CIS) benchmarks for public cloud services, thus improving the overall security profile of the enterprise for cloud access [4].

Guide to a Secure Enterprise Network Landscape


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for Physical Protection?

[Assistant]
According to Assessing Enhanced Security Requirements for Controlled Unclassified Information:

The NIST Information Technology Laboratory (ITL) promotes the U.S. economy and public welfare by providing technical leadership for the Nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, implementations, proofs of concept, and technical analyses to advance the development and productive use of information technology (IT). ITL's responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security of other than national security-related information in federal information systems. The Special Publication 800-series reports on ITL's research, guidelines, and outreach efforts in information systems security and privacy and its collaborative activities with industry, government, and academic organizations. Unless specified by legislation, regulation, or government-wide policy, the term system is used in this publication instead of information system . This change reflects a broad-based and holistic definition of systems that includes general-purpose systems, industrial control systems, cyberphysical systems, and individual devices that are part of the Internet of Things. As computing systems and information technologies are deployed ubiquitously worldwide and systems and components are increasingly connected through wired and wireless networks, the susceptibility of Controlled Unclassified Information to loss or compromise grows - as does the potential for adverse consequences resulting from such occurrences. | CHAPTERONE INTRODUCTION...................................................................................................... | CHAPTERONE INTRODUCTION......................................................................................................


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AT.L2-3.2.12 (NIST 3.2.12)?

[Assistant]
According to Digital Identity Guidelines_ Authentication and Authenticator Management:

3.2.12. 3.2.12,
cryptographic authenticators used at AAL3 are required to provide a hardware-
protected, isolated environment to prevent authentication keys from being leaked or

8

NIST SP 800-63B-4
July 2025

Digital Identity Guidelines
Authentication and Authenticator Management

extracted. 3.2.12.

Digital Identity Guidelines_ Authentication and Authenticator Management


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Awareness and Training?

[Assistant]
According to Recommendations for Federal Vulnerability Disclosure Guidelines:

| Executive Summary................................................................................................................. | Executive Summary................................................................................................................. | Executive Summary................................................................................................................. |
|--------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------|
| U.S. Government Vulnerability Disclosure..................................................................... | 2                                                                                |                                                                                |
| Usage of Document Terminology................................................................................ | 5                                                                                |                                                                                |
| Federal Vulnerability Disclosure Coordination Body ....................................................

Recommendations for Federal Vulnerability Disclosure Guidelines


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Cryptographic Module Validation Program (CMVP) Security Policy Requirements_ CMVP Validation Authority Updates to ISO_IEC 24759 and ISO_IEC 19790 Anne provide? (Part 2)

[Assistant]
ts, guidelines, and procedures, where they exist, remain operative. For planning and transition purposes, federal agencies may wish to closely follow the development of these new publications by NIST.
Organizations are encouraged to review all draft publications during public comment periods and provide feedback to NIST. Many NIST cybersecurity publications, other than the ones noted above, are available at https://csrc.nist.gov/publications. ## Authority

This publication has been developed by NIST in accordance with its statutory responsibilities under the Federal Information Security Modernization Act (FISMA) of 2014, 44 U.S.C. § 3551 et seq., Public Law (P.L.) 113-283. NIST is responsible for developing information security standards and guidelines, including minimum requirements for federal information systems, but such standards and guidelines shall not apply to national security systems without the express approval of appropriate federal officials exercising policy authority over such systems. This guideline is consistent with the requirements of the Office of Management and Budget (OMB) Circular A-130. Nothing in this publication should be taken to contradict the standards and guidelines made mandatory and binding on federal agencies by the Secretary of Commerce under statutory authority. Nor should these guidelines be interpreted as altering or superseding the existing authorities of the Secretary of Commerce, Director of the OMB, or any other federal official. This publication may be used by nongovernmental organizations on a voluntary basis and is not subject to copyright in the United States. Attribution would, however, be appreciated by NIST.

Cryptographic Module Validation Program (CMVP) Security Policy Requirements_ CMVP Validation Authority Updates to ISO_IEC 24759 and ISO_IEC 19790 Anne


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Awareness and Training?

[Assistant]
According to Incident Response Recommendations and Considerations for Cybersecurity Risk Management_ A CSF 2.0 Community Profile:

uld be developed for narrower audiences, such as federal agencies, small businesses, or educational institutions. For more information on CSF 2.0 Community Profiles, see the Framework Resource Center.
| CSF Element                                                     | CSF Element Description                                                                                | Priority   | Recommendations, Considerations, Notes                                                              |
|-----------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------|-----------------------------------------------------------------------------------------------------|
| PR.AA (Identity Management, Authentication, and Access Control) | Access to physical and logical assets is limited to authorized users, services, and hardware and managed commensurate with the assessed risk of unauthorized access                       | Medium     | N1: See the notes for PR. |
| PR.AA-01                                                        | Identities and credentials for authorized users, services, and hardware are managed by the organization                                                                                | Medium     | N1: See the notes for PR. |
| PR.AA-02                                                        | Identities are proofed and bound to credentials based on the context of interactions                                                                                | Medium     | N1: See the notes for PR.

Incident Response Recommendations and Considerations for Cybersecurity Risk Management_ A CSF 2.0 Community Profile


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is NIST SP 800-171 control 3.0.47?

[Assistant]
According to Protecting Information and System Integrity in Industrial Control System Environments_ Cybersecurity for the Manufacturing Sector:

3.0.47
-  PI Processbook 2015 R3 Patch 1 version 3.

Protecting Information and System Integrity in Industrial Control System Environments_ Cybersecurity for the Manufacturing Sector


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Risk Assessment?

[Assistant]
According to Organizational Views of NIST Cryptographic Standards and Testing and Validation Programs:

ink one of the main reasons is this inability to quickly and agilely address vulnerabilities. So that needs to be fixed. They need to find some process.' (C19)

'Now, certification is a problem there.
It's the same for medical equipment and for security equipment, that you get your certification and you're not allowed to change it. If you change the product you lose the certification for that product. And so you can have a vulnerability baked into a product and you're not even allowed to fix it because you're not then allowed to use it if it loses its certification. And there was a discussion by ICMC 2016, the International Cryptographic Module Conference, which basically FIPS 140 vendors, and certification houses, and NIST get together. And there was a discussion about this and we had [someone] stand up and say, 'Well, that's not true, the recommendation to the government departments is to put the patch in. If there's a patch and it's a vulnerability, put the patch in.' Then everybody else stood up and said, 'Yeah, but that's all right for you. We're not the government, we lose our certification. What do you think about that?' He didn't respond. And I think that got to the core of frustration in the vendor space with the way that the government does its certifications with respect to how do we address vulnerabilities and updates. A certification probably should be a-- how do I say? A process of state where you get something into this program where it's a certified design, and then the process of rolling out updates is part of the certification. So we might have an update and you have a vulnerability, and we have a change or a bug fix and that would go to NIST, and that would be a fairly lightweight, or the certification house and there would be a fairly lightweight mechanism of getting that checked and stamped

Organizational Views of NIST Cryptographic Standards and Testing and Validation Programs


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Media Protection?

[Assistant]
According to Guide for Developing Security Plans for Federal Information Systems:

The information owner is the agency official with statutory or operational authority for specified information and responsibility for establishing the controls for its generation, collection, processing, dissemination, and disposal.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] How does Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171 support CMMC certification?

[Assistant]
According to Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171:

## NIST Special Publication 800-172

## Enhanced Security Requirements for Protecting Controlled Unclassified Information

A Supplement to NIST Special Publication 800-171

RON ROSS VICTORIA PILLITTERI GARY GUISSANIE RYAN WAGNER RICHARD GRAUBART

DEB BODEAU

This publication is available free of charge from:

https://doi.org/10.6028/NIST.SP.800-172

<!-- image -->

## NIST Special Publication 800-172

## Enhanced Security Requirements for Protecting Controlled Unclassified Information

A Supplement to NIST Special Publication 800-171

## RON ROSS VICTORIA PILLITTERI

Computer Security Division

National Institute of Standards and Technology

## GARY GUISSANIE RYAN WAGNER

Institute for Defense Analyses

RICHARD GRAUBART DEB BODEAU

The MITRE Corporation

This publication is available free of charge from:

https://doi.org/10.6028/NIST.SP.800-172

## February 2021

<!-- image -->

U.S. Department of Commerce Wynn Coggins, Acting Secretary

National Institute of Standards and Technology James K. Olthoff, Performing the Non-Exclusive Functions and Duties of the Under Secretary of Commerce for Standards and Technology & Director, National Institute of Standards and Technology

\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

## Authority

This publication has been developed by NIST to further its statutory responsibilities under the Federal Information Security Modernization Act (FISMA), 44 U.S.C. § 3551 et seq. , Public Law (P.L.) 113-283. NIST is responsible for developing information security standards and guidelines, including minimum requirements for federal information systems, but such standards and guidelines shall not apply to national security systems without the express approval of the appropriate federal officials exercising policy authority over such systems.

Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What guidance does Digital Identity Guidelines_ Identity Proofing and Enrollment provide?

[Assistant]
NIST Special Publication
NIST SP 800-63A-4

Digital Identity Guidelines
Identity Proofing and Enrollment

David Temoshok
Christine Abruzzi
Yee-Yin Choong
James L. Fenton
Ryan Galluzzo
Connie LaSalle
Naomi Lefkovitz
Andrew Regenscheid
Maria Vachino

This publication is available free of charge from:
https://doi.org/10.6028/NIST.SP.800-63A-4

NIST Special Publication
NIST SP 800-63A-4

Digital Identity Guidelines
Identity Proofing and Enrollment

David Temoshok
Ryan Galluzzo
Connie LaSalle
Naomi Lefkovitz *
Applied Cybersecurity Division
Information Technology Laboratory

Yee-Yin Choong
Information Access Division
Information Technology Laboratory

Andrew Regenscheid
Computer Security Division
Information Technology Laboratory

Christine Abruzzi
Cacapon Cyber Solutions

James L. Fenton
Altmode Networks

Maria Vachino
Calvert Consulting LLC

* Former NIST employee; all work for this publication was done while at NIST. This publication is available free of charge from:
https://doi.org/10.6028/NIST.SP.800-63A-4

July 2025

National Institute of Standards and Technology
Craig Burkhardt, Acting Under Secretary for Standards and Technology and Acting NIST Director

U.S. Department of Commerce
Howard Lutnick, Secretary

Certain equipment, instruments, software, or materials, commercial or non-commercial,
are identified in this paper in order to specify the experimental procedure adequately. Such identification does not imply recommendation or endorsement of any product
or service by NIST, nor does it imply that the materials or equipment identified are
necessarily the best available for the purpose. There may be references in this publication to other publications currently under
development by NIST in accordance with its assigned statutory responsibilities. The
information in this publication, including concepts and methodologies, may be used by
federal agencies even before the completion of such companion publications.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 1 require for Physical Protection?

[Assistant]
According to IoT Device Cybersecurity Capability Core Baseline:

The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the Nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology. ITL's responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in federal information systems. Computing devices that integrate physical and/or sensing capabilities and network interface capabilities are being designed, developed, and deployed at an ever-increasing pace. These devices are fulfilling customer needs in all sectors of the economy. Many of these computing devices are connected to the internet. A novel characteristic of these devices is the combination of connectivity and the ability to sense and/or affect the physical world. As devices become smaller and more complex, with an increasing number of features, the security of those devices also becomes more complex. This publication defines a baseline set of device cybersecurity capabilities that organizations should consider when confronting the challenge of the Internet of Things (IoT).

IoT Device Cybersecurity Capability Core Baseline


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What guidance does Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations provide?

[Assistant]
<!-- image -->

## NIST Special Publication 800

## NIST SP 800-161r1-upd1

## Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations

Jon Boyens Angela Smith Nadya Bartol Kris Winkler Alex Holbrook Matthew Fallon

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-161r1-upd1

<!-- image -->

## NIST Special Publication 800 NIST SP 800-161r1-upd1

## Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations

Jon Boyens Angela Smith Computer Security Division Information Technology Laboratory

Nadya Bartol Kris Winkler Alex Holbrook Matthew Fallon Boston Consulting Group

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-161r1-upd1

May 2022

INCLUDES UPDATES AS OF 1 1 -01 -2024; SEE APPENDIX K

<!-- image -->

U.S. Department of Commerce Gina M. Raimondo, Secretary

National Institute of Standards and Technology

Laurie E. Locascio, NIST Director and Under Secretary of Commerce for Standards and Technology

Certain equipment, instruments, software, or materials, commercial or non-commercial, are identified in this paper in order to specify the experimental procedure adequately. Such identification does not imply recommendation or endorsement of any product or service by NIST, nor does it imply that the materials or equipment identified are necessarily the best available for the purpose. There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may be used by federal agencies even before the completion of such companion publications. Thus, until each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative.

Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AU.L2-3.3.1 (NIST 3.3.1)?

[Assistant]
According to Secure Software Development Framework (SSDF) Version 1.1_ Recommendations for Mitigating the Risk of Software Vulnerabilities:

3.3.1, 3. 3.3.1 SP800161 : SA-8, SA-15, SR-3 SP800181 : T0414; K0003, K0039, K0044, K0157, K0168, K0177, K0211, K0260, K0261, K0262, K0524; S0010, S0357, S0368; A0033, A0123, A0151 |
| Define Security Requirements for Software Development (PO. 3.3.1 SP800161 : SA-3 SP800181 : K0233                                                                                |
| Implement Roles and Responsibilities (PO.

Secure Software Development Framework (SSDF) Version 1.1_ Recommendations for Mitigating the Risk of Software Vulnerabilities


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AU.L2-3.3.2 (NIST 3.3.2)?

[Assistant]
According to Federal Cybersecurity Awareness Programs_ A Mixed Methods Research Study:

3.3.2                                                                                | Team Size ... 3.3.2 Team Size

In both phases of the research project, we asked several questions to collect data on the number of individuals having security awareness duties within the surveyed organizations.

Federal Cybersecurity Awareness Programs_ A Mixed Methods Research Study


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Incident Response?

[Assistant]
According to Guide to Enterprise Patch Management Planning_ Preventive Maintenance for Technology:

Being proactive means doing more work now to reduce the likelihood of incidents in the future. It also means that if a patch fails, that disruption can be managed and remediated on the organization's schedule. Being reactive means that if a compromise of an unpatched vulnerability occurs (e.g., a data breach, a ransomware infection), the organization will have to perform incident response, their reputation may be damaged, and/or they may potentially be fined or sued. As part of incident response efforts, the missing patch will probably need to be installed anyway in addition to installing all the preceding patches it is dependent upon, as well as performing other prerequisite recovery actions such as reverting to a good known state or rebuilding the environment from scratch. - Emergency patching. This is the procedure to address patching emergencies in a crisis situation, such as a severe vulnerability or a vulnerability being actively exploited. If one or more of the organization's vulnerable assets have already been compromised, emergency patching may be part of incident response efforts. Emergency patching needs to be handled as efficiently as possible to prevent the imminent exploitation of vulnerable assets. - Emergency mitigation. This is the emergency procedure in a crisis situation, like those described above for the emergency patching scenario, to temporarily mitigate vulnerabilities before a patch is available. The mitigation can vary and may or may not need to be rolled back afterward. Emergency mitigations are sometimes needed because of issues with a patch. For example, a patch might be flawed and not actually correct a vulnerability, or a patch might inadvertently disrupt the operation of other software or systems. A patch could even be compromised. - Unpatchable assets. This is the implementation of isolation or other methods to mitigate the risk of systems that cannot be easily patched.

Guide to Enterprise Patch Management Planning_ Preventive Maintenance for Technology


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What guidance does NIST provide for CMMC Level 3?

[Assistant]
According to Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171:

systems, but such standards and guidelines shall not apply to national security systems without the express approval of the appropriate federal officials exercising policy authority over such systems.
This guideline is consistent with requirements of the Office of Management and Budget (OMB) Circular A-130. Nothing in this publication should be taken to contradict the standards and guidelines made mandatory and binding on federal agencies by the Secretary of Commerce under statutory authority. Nor should these guidelines be interpreted as altering or superseding the existing authorities of the Secretary of Commerce, OMB Director, or any other federal official. This publication may be used by nongovernmental organizations on a voluntary basis and is not subject to copyright in the United States. Attribution would, however, be appreciated by NIST. National Institute of Standards and Technology Special Publication 800-172 Natl. Inst. Stand. Technol. Spec. Publ. 800-172, 84 pages (February 2021)

CODEN: NSPUE2

This publication is available free of charge from:

https://doi.org/10.6028/NIST.SP.800-172

Certain  commercial  entities,  equipment,  or  materials  may  be  identified  in  this  document  to describe an experimental procedure or concept adequately. Such identification is not intended to imply recommendation or endorsement by NIST, nor is it intended to imply that the entities, materials, or equipment are necessarily the best available for the purpose. There may be references in this publication to other publications currently under development by  NIST  in  accordance  with  its  assigned  statutory  responsibilities. The  information  in  this publication, including concepts, practices, and methodologies, may be used by federal agencies even  before  the  completion  of  such  companion  publications. Thus,  until  each  publication  is completed,  current  requirements,  guidelines,  and  procedures,  where  they  exist,  remain operative.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AT.L2-3.2.6 (NIST 3.2.6)?

[Assistant]
According to Multi-Factor Authentication for Criminal Justice Information Systems_ Implementation Considerations for Protecting Criminal Justice Information:

3.2.6. 3.2.6.

Multi-Factor Authentication for Criminal Justice Information Systems_ Implementation Considerations for Protecting Criminal Justice Information


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Access Control?

[Assistant]
According to Likely Exploited Vulnerabilities_ A Proposed Metric for Vulnerability Exploitation Probability:

## 3.1. Measurement of the Expected Proportion of Exploited CVEs

```
CVE-2023-1730, published 2023-05-02 The SupportCandy WordPress plugin before 3.1.5 does not validate and escape user input before using ... LEV probability: 0.70 Peak EPSS: 0.16, Peak date: 2024-01-27 EPSS scores: 0.00 0.00 0.00 0.05 0.06 0.06 0.06 0.10 0.13 0.16 0.08 0.05 0.05 0.04 0.05 0.05 0.05 0.05 0.05 0.06 EPSS dates: 2023-05-02 2023-06-01 2023-07-01 2023-07-31 2023-08-30 2023-09-29 2023-10-29 2023-11-28 2023-12-28 2024-01-27 2024-02-26 2024-03-27 2024-04-26 2024-05-26 2024-06-25 2024-07-25 2024-08-24 2024-09-23 2024-10-23 2024-11-22 Note: final EPSS score adjusted for window size of 21
```

Likely Exploited Vulnerabilities_ A Proposed Metric for Vulnerability Exploitation Probability


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Risk Assessment?

[Assistant]
According to Secure Software Development Practices for Generative AI and Dual-Use Foundation Models_ An SSDF Community Profile:

deciding which practices and tasks to use and how much time and resources to devote to each one. Cost models may need to be updated to effectively consider the costs inherent to AI model development.
A risk-based approach to secure software development may change over time as an organization responds to new or elevated capabilities and risks associated with an AI model or system. Generative AI and dual-use foundation models present additional challenges in tracking model versioning and lineage. Source code for defining the model architecture and building model binaries is amenable to secure software engineering practices for versioning, lineage, and reproducibility. However, the final model weights are defined only after the model is trained and fine-tuned; this is where limitations in tracking all aspects of collection, processing, and training arise. Organizations should follow secure software development practices for the parts of a model that can be covered fully and strive to introduce secure practices to the extent possible for the stages and corresponding artifacts where obtaining such security guarantees is hard to achieve. Organizations should document the parts and artifacts that are not covered by the secure software development practices. The Profile's practices, tasks, recommendations, and considerations can be integrated into machine learning operations (MLOps) along with other software assets within a continuous integration/continuous delivery (CI/CD) pipeline. organizations. For example, an AI model could be produced by one organization and executed

Secure Software Development Practices for Generative AI and Dual-Use Foundation Models_ An SSDF Community Profile


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Media Protection?

[Assistant]
According to Addressing Visibility Challenges with TLS 1.3 within the Enterprise_ High-Level Document:

- Break and Inspect Middlebox : Decrypts, inspects, and re -encrypts traffic to identify threats before the data is transmitted into or out of the network.
- Real-Time Decryption : Decrypts and forwards traffic with minimal delay to support real -time security needs.
- Real-Time Analytics : Processes data quickly for immediate threat detection and response, providing insights on network performance and potential anomalies.
- Post-Facto Decryption and Analytics : Decrypts and stores encrypted data for later analysis, such as forensic investigations, ensuring secure handling and disposal of data.
- Key Management Agent : Provides a secure interface for provisioning TLS server keys and implementing policies for key activation and expiration.
-  Key Capture and Registration Agent: Captures the session keys at the time they are generated and registers the session keys with the Key Governance Platform.
- Enterprise PKI : Manages digital certificates and validates identities, binding them to cryptographic keys for secure communication. The trust anchors for an Enterprise PKI are not expected to be known outside the enterprise.
- Key Governance : Oversees the lifecycle of certificates and keys, including issuance, renewal, revocation, and secure storage.
- Key Source : A secure, FIPS 140 -validated component that generates cryptographic keys for use within the TLS 1.3 project.

Addressing Visibility Challenges with TLS 1.3 within the Enterprise_ High-Level Document