[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What guidance does Status Report on the First Round of the Additional Digital Signature Schemes for the NIST Post-Quantum Cryptography Standardization Process provide?

[Assistant]
NIST Internal Report
NIST IR 8528
Status Report on the First Round of the
Additional Digital Signature Schemes for
the NIST Post-Quantum Cryptography
Standardization Process

Gorjan Alagic
Maxime Bros
Pierre Ciadoux
David Cooper
Quynh Dang
Thinh Dang
John Kelsey
Jacob Lichtinger
Yi-Kai Liu
Carl Miller
Dustin Moody
Rene Peralta
Ray Perlner
Angela Robinson
Hamilton Silberg
Daniel Smith-Tone
Noah Waller

This publication is available free of charge from:
https://doi.org/10.6028/NIST.IR.8528

NIST Internal Report
NIST IR 8528

Status Report on the First Round of the
Additional Digital Signature Schemes for
the NIST Post-Quantum Cryptography
Standardization Process

Gorjan Alagic
Maxime Bros
Pierre Ciadoux
David Cooper
Quynh Dang
Thinh Dang
John Kelsey
Jacob Lichtinger

Carl Miller
Dustin Moody
Rene Peralta
Ray Perlner
Angela Robinson
Hamilton Silberg
Daniel Smith-Tone
Noah Waller
Computer Security Division
Information Technology Laboratory

Yi-Kai Liu
Applied and Computational Mathematics Division
Information Technology Laboratory

This publication is available free of charge from:
https://doi.org/10.6028/NIST.IR.8528

October 2024

National Institute of Standards and Technology
Laurie E. Locascio, NIST Director and Under Secretary of Commerce for Standards and Technology

U.S. Department of Commerce
Gina M. Raimondo, Secretary

Certain equipment, instruments, software, or materials, commercial or non-commercial, are identified in
this paper in order to specify the experimental procedure adequately. Such identification does not imply
recommendation or endorsement of any product or service by NIST, nor does it imply that the materials or
equipment identified are necessarily the best available for the purpose. There may be references in this publication to other publications currently under development by NIST in
accordance with its assigned statutory responsibilities.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Addressing Visibility Challenges with TLS 1.3 within the Enterprise_ High-Level Document provide? (Part 5)

[Assistant]
ryption; passive inspection; protocol; Transport Layer Security (TLS); visibility. ## ACKNOWLEDGMENTS

We are grateful to the following individuals for their generous contribu�ons of exper�se and �me.
| Name                      | Organization                      |
|---------------------------|-----------------------------------|
| Ravishankar Chamarajnagar | AppViewX                          |
| Michael Ackermann         | Blue Cross Blue Shield            |
| Jonathan Chen             | F5                                |
| Ryan Johnson              | F5                                |
| Brad Otlin                | F5                                |
| Kevin Stewart             | F5                                |
| Nanjaiah Vijayalakshmi    | NETSCOUT Corporation              |
| Gina Scinta               | Thales Trusted Cyber Technologies |
| Lauren Brown              | JPMorgan Chase& Company           |

The Technology Partners/Collaborators who participated in this build submitted their capabilities in response to a notice in the Federal Register. Respondents with relevant capabilities or product components were invited to sign a Cooperative Research and Development Agreement (CRADA) with NIST, allowing them to participate in a consortium to build this example solution. We worked with:

| Technology Partner/Collaborator   | Build Involvement                 |
|-----------------------------------|-----------------------------------|
| AppViewX                          | NETSCOUT Corporation              |
| DigiCert                          | Not for Radio LLC                 |
| F5                                | Thales Trusted Cyber Technologies |
| JPMorgan Chase& Company           | U.S. Bank Corporation             |

| Technology Partner/Collaborator   | Build Involvement   |
|-----------------------------------|---------------------|
| Mira Security, Inc.

Addressing Visibility Challenges with TLS 1.3 within the Enterprise_ High-Level Document

Audit and Accountability
System and Information Integrity
Security Assessment
Media Protection
Identification and Authentication
Awareness and Training
System and Communications Protection
Access Control
Planning
Incident Response
Risk Assessment
Personnel Security
System and Services Acquisition
Supply Chain Risk Management
Maintenance
Physical Protection
Configuration Management


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Physical Protection?

[Assistant]
According to Overview and Considerations of Access Control Based on Attribute Encryption:

|
| 2. | Fundamental Theories .....................................................................................................
| 4                                                                                |
| 2.1. | Elliptic Curve                                                                                | .............................................................................................................. 4                       |
| 2.2. | Elliptic-Curve Cryptography ........................................................................................ | 5                                                                                |
| 2.3. | Bilinear Pair Mapping.................................................................................................. | 7                                                                                |
| 2.4. | Bilinear Pairing for Cryptography................................................................................ | 9                                                                                |
| 3. | Identity-Based Encryption ..............................................................................................11                  |                                                                                |
| 4. | Attribute-Based Encryption............................................................................................13                    |                                                                                |
| 4.1.

Overview and Considerations of Access Control Based on Attribute Encryption


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Information Integrity?

[Assistant]
According to Control Baselines for Information Systems and Organizations:

| CHAPTERONE INTRODUCTION...................................................................................................... 1               | CHAPTERONE INTRODUCTION...................................................................................................... 1               | CHAPTERONE INTRODUCTION...................................................................................................... 1   |
|-----------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------|
| 1.1                                                                                | PURPOSEANDAPPLICABILITY ................................................................................................... | 1                                                                                |
| 1.2                                                                                | TARGET AUDIENCE .................................................................................................................. | 2                                                                                |
| 1.3                                                                                | ORGANIZATIONAL RESPONSIBILITIES .........................................................................................

Control Baselines for Information Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for System and Information Integrity?

[Assistant]
According to Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171:

This publication is a supplement to NIST Special Publication 800-171 [SP 800-171]. It contains recommendations  for  enhanced  security  requirements  to  provide  additional  protection  for Controlled Unclassified Information (CUI) in nonfederal systems and organizations when such information is  associated  with critical  programs  or  high  value  assets. The  enhanced  security requirements are designed to respond to the advanced persistent threat (APT) and supplement the basic and derived security requirements in [SP 800-171]. While the security requirements in [SP 800-171] focus primarily on confidentiality protection, the enhanced security requirements in this publication address confidentiality, integrity, and availability protection. The enhanced security requirements are implemented in addition to the basic and derived requirements since those requirements are not designed to address the APT. The enhanced security requirements apply to those components of nonfederal systems that process, store, or transmit CUI or that provide protection for such components. In addition to protecting CUI from unauthorized disclosure, the enhanced security requirements have been designed to protect the integrity and availability of CUI. This is achieved by promoting penetration-resistant architectures, damage-limiting operations, and designs to help achieve cyber resiliency and survivability. | CHAPTERONE INTRODUCTION...................................................................................................... | CHAPTERONE INTRODUCTION......................................................................................................

Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 1 require for System and Services Acquisition?

[Assistant]
According to Summary Report for “Workshop on Updating Manufacturer Guidance for Securable Connected Product Development”:

## Summary Report for ' Workshop on Updating Manufacturer Guidance for Securable Connected Product Development '

## Summary Report for ' Workshop on Updating Manufacturer Guidance for Securable Connected Product Development '

Megas K, Fagan M, Cuthill B, Hoehn N, and Petrella E  (2025) Summary Report for 'Workshop on Updating Manufacturer Guidance for Securable Connected Product Development' (National Institute of Standards and Technology, Gaithersburg, MD), NIST Interagency or Internal Report (IR) NIST IR 8562. https://doi.org/10.6028/NIST.IR.8562

Summary Report for “Workshop on Updating Manufacturer Guidance for Securable Connected Product Development”


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AC.L2-3.1.8 (NIST 3.1.8)?

[Assistant]
According to Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations:

3.1.8. 3.1.8.

Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Services Acquisition?

[Assistant]
According to Report on the Design-A-Thon_ Designing Effective and Accessible Approaches for Digital Product Cybersecurity Education and Awareness:

There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may be used by federal agencies even before the completion of such companion publications. Thus, until each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning and transition purposes, federal agencies may wish to closely follow the development of these new publications by NIST. The NIST team developed a series of Product Data Cards to support the Design-A-Thon. These cards served as the prompts for teams to design approaches for cybersecurity education and awareness related to the products described on the cards. Each of the Product Data Cards featured a mock IoT product and fictional information about the product, its development, and supported cybersecurity. Each card contained the following information:

This section presents observations and takeaways from the event and teams' designs that were generated after the event and can inform future research and standardization efforts. All three teams identified different approaches in their plans, showing the wide range of tools and concepts that can be used for cybersecurity education and awareness for IoT products. As teams discussed and identified their plans, they found that standardization of available approaches and selection of appropriate approaches could help increase the speed of material development. All teams deeply considered the expected customers of each product to ensure awareness and education approaches were adequately tailored. Teams indicated that any standardization effort should similarly be human-centric and consider the spectrum of potential users of a given application or product.

Report on the Design-A-Thon_ Designing Effective and Accessible Approaches for Digital Product Cybersecurity Education and Awareness


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 1 require for Identification and Authentication?

[Assistant]
According to IoT Device Cybersecurity Capability Core Baseline:

The following are the references used in Table 1: - o AGELIGHT : AgeLight Digital Trust Advisory Group, 'IoT Safety Architecture & Risk Toolkit (IoTSA) v3.1' [5] - o BITAG : Broadband Internet Technical Advisory Group (BITAG), 'Internet of Things (IoT) Security and Privacy Recommendations' [6] - o CSA : Cloud Security Alliance (CSA) IoT Working Group, 'Identity and Access Management for the Internet of Things' [7] - o CSDE : Council to Secure the Digital Economy (CSDE), 'The C2 Consensus on IoT Device Security Baseline Capabilities' [8] - o CTIA : CTIA, 'CTIA Cybersecurity Certification Test Plan for IoT Devices, Version 1.0.1' [9] | Device Cybersecurity Capability | Common Elements | Rationale | IoT Reference Examples | |---------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | Device Identification : The IoT device can be uniquely identified logically and physically.

IoT Device Cybersecurity Capability Core Baseline


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Security Assessment?

[Assistant]
According to Status Report on the Fourth Round of the NIST Post-Quantum Cryptography Standardization Process:

| 2.2.1. Security . . . . . . . . . . . . . . . . . . . . . .
| 4              |
|                                                                                | 2.2.2.Cost and Performance . . . . . . . . . . . . . | 5              |
|                                                                                | 2.2.3.Algorithm and Implementation Characteristics                                                                                | 8              |
| 2.3. | Selection of the Candidates for Standardization . . . | 8              |
| 3. Summary of the Fourth-Round Candidates . | . . . . . . . . | 10             |
| 3.1. | HQC . . . . . . . . . . . . . . . . . . . . . . . . . . . . | 10             |
| 3.2. | BIKE . . . . . . . . . . . . . . . . . . . . . . . . . . . . | 12             |
| 3.3. | Classic McEliece . . . . . . . . . . . . . . . . . . . . . | 14             |
| 3.4. | SIKE . . . . . . . . . . . . . . . . . . . . . . . . . . . . | 16             |
| 4. Conclusion . . | . . . . . . . . . . . . . . . . . . . . . . . . . . | 18             |
| References . . | . . . . . . . . . . . . . . . . . . . . . . . . . . . | 19             |
| Appendix A. List of Symbols, Abbreviations, and Acronyms                                                                                | .

Status Report on the Fourth Round of the NIST Post-Quantum Cryptography Standardization Process


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Personnel Security?

[Assistant]
According to Security and Privacy Controls for Information Systems and Organizations:

CHAPTER ONE   INTRODUCTION ...................................................................................................... 1
1.1   PURPOSE AND APPLICABILITY ................................................................................................... 2
1.2   TARGET AUDIENCE .................................................................................................................. 3
1.3   ORGANIZATIONAL RESPONSIBILITIES......................................................................................... 3
1.4   RELATIONSHIP TO OTHER PUBLICATIONS ................................................................................... 5
1.5   REVISIONS AND EXTENSIONS .................................................................................................... 5
1.6   PUBLICATION ORGANIZATION .................................................................................................. 5
CHAPTER TWO   THE FUNDAMENTALS ............................................................................................ 7
2.1   REQUIREMENTS AND CONTROLS .............................................................................................. 7
2.2   CONTROL STRUCTURE AND ORGANIZATION .............................................................................. 8
2.3   CONTROL IMPLEMENTATION APPROACHES ............................................................................. 11
2.4   SECURITY AND PRIVACY CONTROLS ......................................................................................... 13
2.5   TRUSTWORTHINESS AND ASSURANCE ..................................................................................... 14
CHAPTER THREE   THE CONTROLS ................................................................................................. 16
3.1   ACCESS CONTROL ..................................................................................................................

Security and Privacy Controls for Information Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does A Data Structure for Integrity Protection with Erasure Capability provide? (Part 3)

[Assistant]
contain  a  single  record  or  multiple transactions. Every  row  or  column  is  terminated  with a  block  containing  a  hash  of  that  row  or  column  (e.g., H 0 , -is  the  hash  of  row  0).
Various  forms  of  the  hash structure are also possible. For example, the hash value can  be  stored  in  the  last  block  of  the  row  or  column instead  of  a  separate  hash  block. Another  alternative is  to  concatenate  hashes  of  each  block  in  a  row  or column, similar to the blockchain process. The hash of this  concatenation  would  then  serve  as  the  hash  value for that row or column. Figure 1. Basic block matrix

<!-- image -->

As an example of the process, the block labeled 'X' may  be  deleted  by  writing  all  zeroes  to  that  block,  or revised with different values. Either of these changes will affect the hash values of H 3 , -and H -, 2 for row 3 and column  2. However,  the  integrity  of  all  blocks  except the one containing 'X' is still ensured by the other hash values. That  is,  other  blocks  of  row  3  are  included  in the  hashes  for  columns  0,  1,  3,  and  4. Similarly,  other blocks of column 2 are included in the hashes for rows 0, 1, 2, and 4. Thus, the integrity of blocks that have not been  deleted  is  assured. An  algorithm  to  maintain  this structure is given below and its properties described. Within  the  data  structure,  blocks  are  numbered 1 ..k , and  are  added  to  the  data  structure  starting  with  cell 0 , 1 . (It  is  desirable  to  keep  cells  on  the  diagonal  null, for  reasons  explained  later.)  Variables i, j are  column indices, and swap ( i, j ) exchanges the values of i and j , i.e., i ′ = j and j ′ = i . With  this  algorithm,  cells  are filled as shown in Algorithm 1. ## Algorithm 1 Data block matrix construction

Figure 2. Block matrix with numbered cells

<!-- image -->

## III. PROPERTIES

Certain  desirable  properties  are  maintained  with  this data  structure.

A Data Structure for Integrity Protection with Erasure Capability

Audit and Accountability
System and Information Integrity
Media Protection
Identification and Authentication
Awareness and Training
System and Communications Protection
Access Control
Planning
Incident Response
Risk Assessment
Personnel Security
System and Services Acquisition
Supply Chain Risk Management
Maintenance
Physical Protection
Security Assessment


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Audit and Accountability?

[Assistant]
According to Federal Cybersecurity Awareness Programs_ A Mixed Methods Research Study:

|                                                                                | INTRODUCTION................................................................................................................. 1           | INTRODUCTION................................................................................................................. 1           |
|-------------------------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------|
| 2                                                                                | STUDY METHODOLOGY................................................................................................. 2                      | STUDY METHODOLOGY................................................................................................. 2                      |
| 2.1 FOCUS GROUP METHODOLOGY............................................................................................ 3                 | 2.1 FOCUS GROUP METHODOLOGY............................................................................................ 3                 | 2.1 FOCUS GROUP METHODOLOGY............................................................................................ 3                 |
| 2.1.1                                                                                | Focus Group Design...................................................................................................

Federal Cybersecurity Awareness Programs_ A Mixed Methods Research Study


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Configuration Management?

[Assistant]
According to Planning for a Zero Trust Architecture_ A Planning Guide for Federal Administrators:

- I. All data sources and computing services are considered resources. An enterprise relies on different resources to perform its mission: mobile devices, data stores, compute resources (including virtual), remote sensors/actuators, etc. All these components are resources and need to be considered in a ZTA. Some components (e.g., IoT sensors) may not be able to support some solutions such as configuration agents, application sandboxing, etc. so compensating technologies or alternative mitigations may be needed. If the resource lacks certain security capabilities, the enterprise may need to add a PEP component to provide that functionality. - II. The enterprise monitors and measures the integrity and security posture of all owned and associated resources. This tenet deals with the aspects of cyber hygiene for both enterprise-owned resources and those that may not be owned, but used in an enterprise workflow such as configuration, patching, application loading, etc. The state of resources should be monitored, and appropriate action taken when new information such as a new vulnerability or attack is reported or observed. The confidentiality and integrity of data on the resource should be protected. This requires enterprise admins to know how resources are configured, maintained, and monitored. Moving to a zero trust architecture will likely never start from scratch but will involve a series of upgrades and changes over time. Some changes may be simple configuration changes, and some may involve the purchase and deployment of new infrastructure; it all depends on what tools are currently used and available to the enterprise. This step also does not change in a zero trust planning process. The baseline controls for LOW, MODERATE and HIGH-impact systems are listed in NIST SP 800-53B [10].

Planning for a Zero Trust Architecture_ A Planning Guide for Federal Administrators


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice CM.L2-3.4.3 (NIST 3.4.3)?

[Assistant]
According to Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations:

3.4.3. 3.4.3.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Services Acquisition?

[Assistant]
According to Summary of NIST SP 800-53, Revision 4_ Security and Privacy Controls for Federal Information Systems and Organizations:

The NIST Risk Management Framework (RMF), described in NIST Special Publication 800-37 Revision 1, Guide for Applying the Risk Management Framework to Federal Information Systems: a Security Life Cycle Approach, is a methodology for implementing risk management at the information systems tier. The RMF (depicted in Figure 2) identifies six distinct steps that provide a disciplined and structured process to integrate information security risk management activities into the system development life cycle. The RMF addresses security concerns of organizations related to the design, development, implementation, operation, and disposal of information systems and the environments in which those systems operate. The criteria for whether a security control is assurance- or functionality-related is based on the overall characteristics of the control. In general, assurance-related controls are controls that: (i) define processes, procedures, techniques, or methodologies for designing and developing information systems and system components; (ii) provide supporting operational processes including improving the quality of systems, components, or processes; (iii) produce security evidence from developmental or operational activities; (iv) determine security control effectiveness or risk; or (v) improve personnel skills, expertise, and understanding. Many organizations use well-known international information security standards as the basis or as a supplemental source of security controls for risk management. To aid in selection and comparison, SP 800-53 Rev. 4 provides mapping tables to provide organizations with a general indication of security control coverage with respect to ISO/IEC 27001, Information technologySecurity techniques-Information security management systems-Requirements and ISO/IEC 15408, Information technology -- Security techniques -- Evaluation criteria for IT security .

Summary of NIST SP 800-53, Revision 4_ Security and Privacy Controls for Federal Information Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Awareness and Training?

[Assistant]
According to Guide to Malware Incident Prevention and Handling for Desktops and Laptops:

| Executive Summary................................................................................................................vii   | Executive Summary................................................................................................................vii                                                                                | Executive Summary................................................................................................................vii                                                                                |                                                                                |
|----------------------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------|
| 1. Introduction ...................................................................................................................... | 1. Introduction ...................................................................................................................... | 1. Introduction ......................................................................................................................

Guide to Malware Incident Prevention and Handling for Desktops and Laptops


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Information Integrity?

[Assistant]
According to Audit and Evaluation of Computer Security II_ System Vulnerabilities and Controls:

| 4-15      |
| 5.6         | System Testing                                                                                | 4-15      |
| 5.7 6.
| Conversion                                                                                | 4-16      |
|             | INTERNAL CONTROL                                                                               | 4-16      |
| 6.1         | General                                                                                | 4-16 4-16 |
| 6.2         | Control Policies                                                                               | 4-17      |
| 6.3 7. | Control Procedures HARDWARE SUPPORT                                                            | 4-17      |
| 7.1         | General                                                                                | 4-17      |
| 7.2         | Introduction                                                                                | 4-17      |
| 7.3         | Control Policies                                                                               | 4-18      |
|             | BIBLIOGRAPHY                                                                                | 4-19      |
| 8. |                                                                                |           |
| PART V:     | SESSION 3 - MANAGERIAL AND ORGANIZATIONAL VULNERABILITIES AND CONTROLS - LINE LEVEL - GENERAL  | 5-1       |
| EDITOR'S 1. | NOTE INTRODUCTION                                                                              | 5-2 5-3   |
| 2.

Audit and Evaluation of Computer Security II_ System Vulnerabilities and Controls


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AC.L2-3.1.2 (NIST 3.1.2)?

[Assistant]
According to Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations:

3.1.2. 3.1.2. 3.1.2.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Media Protection?

[Assistant]
According to Digital Identity Guidelines:

3.8. Artificial Intelligence and Machine Learning in Identity Systems

– The IdP is provisioned either directly by the CSP or indirectly through
access to attributes of the subscriber account. The CSP maintains the
subscriber account, its status, and the enrollment data collected in
accordance with the records retention and disposal requirements described
in Sec. 3.1 of [SP800-63A]. The subscriber maintains their authenticators. The
IdP maintains its view of the subscriber account, any federated identifiers
assigned to the subscriber account, and any policies and decisions regarding
the release of attributes and information to RPs.

3.8. Artificial Intelligence and Machine Learning in Identity Systems
Identity solutions use artificial intelligence (AI) and machine learning (ML) in various
ways, such as improving the performance of biometric matching systems, automating
evidence or attribute validation, detecting fraud, and even assisting users (e.g.,
chatbots). While the potential applications of AI and ML are extensive, these
technologies may also introduce new risks or produce unintended negative outcomes.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Maintenance?

[Assistant]
According to Contingency Planning Guide for Federal Information Systems:

| Chapter 1.

Contingency Planning Guide for Federal Information Systems


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice IA.L2-3.5.2 (NIST 3.5.2)?

[Assistant]
According to Contingency Planning Guide for Federal Information Systems:

3.5.2                                                                                | Training... 3.5.2 Training

Training for personnel with contingency plan responsibilities should focus on familiarizing them with ISCP roles and teaching skills necessary to accomplish those roles.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Communications Protection?

[Assistant]
According to Protecting Information and System Integrity in Industrial Control System Environments_ Cybersecurity for the Manufacturing Sector:

| 5.2.1   | Scenario 1: Protect Host from Malware Infection via USB..................................... | 37     |
|---------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------|
| 5.2.2   | Scenario 2: Protect Host from Malware Infection via Network Vector.................. | 37     |
| 5.2.3   | Scenario 3: Protect Host from Malware via Remote Access Connections ............. | 39     |
| 5.2.4   | Scenario 4: Protect Host from Unauthorized Application Installation ................... | 40     |
| 5.2.5   | Scenario 5: Protect from Unauthorized Addition of a Device ................................ | 42     |
| 5.2.6   | Scenario 6: Detect Unauthorized Device-to-Device Communications................... | 43     |
| 5.2.7   | Scenario 7: Protect from Unauthorized Deletion of Files....................................... | 43     |
| 5.2.8   | Scenario 8: Detect Unauthorized Modification of PLC Logic.................................. | 45     |
| 5.2.9   | Scenario 9: Protect from Modification of Historian Data....................................... | 46     |
| 5.3.1   | PR.AC-1: Identities and Credentials are Issued, Managed, Verified, Revoked, and Audited for Authorized Devices, Users, and Processes........................ | 50     |
| 5.3.2   | PR.AC-3: Remote Access is Managed ..................................................................... | 50     |
| 5.3.3   | PR.AC-4: Access Permissions and Authorizations are Managed, Incorporating the Principles of Least Privilege and Separation of Duties .........................

Protecting Information and System Integrity in Industrial Control System Environments_ Cybersecurity for the Manufacturing Sector


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Media Protection?

[Assistant]
According to Protecting Information and System Integrity in Industrial Control System Environments_ Cybersecurity for the Manufacturing Sector:

The Tenable.OT (Version 3.8.17) appliance is installed in a rack with network connections for the Management/Query traffic on Port 1 and SPAN traffic on Port 2 of the appliance. Documentation for Tenable.OT is available at https://docs.tenable.com/Tenableot.htm.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Audit and Accountability?

[Assistant]
According to Risk Management Framework for Information Systems and Organizations_ A System Life Cycle Approach for Security and Privacy:

This publication describes the Risk Management Framework (RMF) and provides guidelines for applying the RMF to information systems and organizations. The RMF provides a disciplined, structured, and flexible process for managing security and privacy risk that includes information security categorization; control selection, implementation, and assessment; system and common control authorizations; and continuous monitoring. The RMF includes activities to prepare organizations to execute the framework at appropriate risk management levels. The RMF also promotes near real-time risk management and ongoing information system and common control authorization through the implementation of continuous monitoring processes; provides senior leaders and executives with the necessary information to make efficient, cost-effective, risk management decisions about the systems supporting their missions and business functions; and incorporates security and privacy into the system development life cycle. Executing the RMF tasks links essential risk management processes at the system level to risk management processes at the organization level. In addition, it establishes responsibility and accountability for the controls implemented within an organization's information systems and inherited by those systems.

Risk Management Framework for Information Systems and Organizations_ A System Life Cycle Approach for Security and Privacy


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AT.L2-3.2.1 (NIST 3.2.1)?

[Assistant]
According to Strategies for the Integration of Software Supply Chain Security in DevSecOps CI_CD Pipelines:

3.2.1. 3.2.1.

Strategies for the Integration of Software Supply Chain Security in DevSecOps CI_CD Pipelines


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Incident Response?

[Assistant]
According to Secure Software Development Framework (SSDF) Version 1.1_ Recommendations for Mitigating the Risk of Software Vulnerabilities:

- Securely Provision (SP): Risk Management (RSK), Software Development (DEV), Systems Requirements Planning (SRP), Test and Evaluation (TST), Systems Development (SYS) - Operate and Maintain (OM): Systems Analysis (ANA) - Oversee and Govern (OV): Training, Education, and Awareness (TEA); Cybersecurity Management (MGT); Executive Cyber Leadership (EXL); Program/Project Management (PMA) and Acquisition - Protect and Defend (PR): Incident Response (CIR), Vulnerability Assessment and Management (VAM) - Analyze (AN): Threat Analysis (TWA), Exploitation Analysis (EXP) | Practices | Tasks | Notional Implementation Examples | References | |-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | Prepare the Organization (PO) | | | | | Define Security Requirements for Software Development (PO.1) : Ensure that security requirements for software development are known at all times so that they can be taken into account throughout the SDLC and duplication of effort can be minimized because the requirements information can be collected once and shared.

Secure Software Development Framework (SSDF) Version 1.1_ Recommendations for Mitigating the Risk of Software Vulnerabilities


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AT.L2-3.2.4 (NIST 3.2.4)?

[Assistant]
According to Secure Software Development Framework (SSDF) Version 1.1_ Recommendations for Mitigating the Risk of Software Vulnerabilities:

3.2.4, 3. 3.2.4, 3.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AC.L2-3.1.1 (NIST 3.1.1)?

[Assistant]
According to Strategies for the Integration of Software Supply Chain Security in DevSecOps CI_CD Pipelines:

3.1.1. 3.1.1.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Status Report on the First Round of the Additional Digital Signature Schemes for the NIST Post-Quantum Cryptography Standardization Process provide? (Part 9)

[Assistant]
nts with respect to the Additional Digital Signatures
for the NIST PQC Standardization Process to date. 1

NIST IR 8528
October 2024

Additional Digital Signatures
First Round Status Report

Table 1.
Timeline of the Additional Digital Signatures for the NIST PQC Standardization
Process

Date
July 2022

September 2022

June 2023

July 2023

April 2024

October 2024

Event
NIST announced a forthcoming Call for Proposals for Additional
Digital Signatures to diversify its portfolio [1]. The Call for Proposals for Additional Digital Signatures was pub-
lished, outlining the submission requirements and evaluation cri-
teria [2]. Submission  deadline  for  the  Additional  Digital  Signatures  pro-
cess. NIST announced 40 First-Round candidates. The public comment
period for the first-round candidates began. The  Fifth  NIST  PQC  Standardization  Conference  was  held  in
Rockville,  Maryland. Submission  teams  presented  posters  for
their candidate algorithms. NIST announced 14 Second-Round candidates. NIST IR 8528, Sta-
tus Report on the First Round of the Additional Digital Signature
Schemes for the NIST Post-Quantum Cryptography Standardiza-
tion Process, was released. The public comment period for the
second-round candidates began. 1.1. Purpose and Organization of This Document

The purpose of this document is to report on the first round of the NIST PQC Standardiza-
tion Process. Section 2 enumerates the candidates that were included in the first round. It also describes
the evaluation criteria and selection process used to ultimately select the second-round
candidates. Section 3 summarizes each of the second-round candidates with a brief description of the
algorithm, the properties of interest, and characteristics that might cause some concern. This report focuses on the reasons why candidate algorithms were selected rather than
providing detailed justifications for why candidate algorithms were not selected.

Status Report on the First Round of the Additional Digital Signature Schemes for the NIST Post-Quantum Cryptography Standardization Process


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Configuration Management?

[Assistant]
According to Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations:

| 1. Introduction.....................................................................................................................................1   |
|---------------------------------------------------------------------------------------------------------------------------------------------------------|
| 1.4.1. Enterprise Risk Management and C-SCRM Owners and Operators.............................................5                                         |
| 1.4.2. Enterprise, Agency, and Mission and Business Process Owners and Operators .........................5                                             |
| 1.4.3. Acquisition and Procurement Owners and Operators.................................................................6                               |
| 1.4.4. Information Security, Privacy, or Cybersecurity Operators .........................................................6                             |
| 1.4.5. System Development, System Engineering, and System Implementation Personnel.................7                                                    |
| 1.5.1. Enterprise's Supply Chain.............................................................................................................9          |
| 1.5.2. Supplier Relationships Within Enterprises .................................................................................10                    |
| 2. Integration of C-SCRM Into Enterprise-Wide Risk Management...................................................... 18                                  |
| 2.3.1. Roles and Responsibilities Across the Three Levels ...................................................................24                         |
| 2.3.2. Level 1 -Enterprise...................................................................................................................27         |
| 2.3.3.

Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Risk Management Framework for Information Systems and Organizations_ A System Life Cycle Approach for Security and Privacy provide? (Part 4)

[Assistant]
Technology Laboratory 100 Bureau Drive (Mail Stop 8930) Gaithersburg, MD 20899-8930

Email: sec-cert@nist.gov

All comments are subject to release under the Freedom of Information Act (FOIA) [FOIA96].
\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

## Reports on Computer Systems Technology

The National Institute of Standards and Technology (NIST) Information Technology Laboratory (ITL) promotes the U.S. economy and public welfare by providing technical leadership for the Nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology (IT). ITL's responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the costeffective security of other than national security-related information in federal information systems. The Special Publication 800-series reports on ITL's research, guidelines, and outreach efforts in information systems security and privacy and its collaborative activities with industry, government, and academic organizations. ## Abstract

This publication describes the Risk Management Framework (RMF) and provides guidelines for applying the RMF to information systems and organizations. The RMF provides a disciplined, structured, and flexible process for managing security and privacy risk that includes information security categorization; control selection, implementation, and assessment; system and common control authorizations; and continuous monitoring. The RMF includes activities to prepare organizations to execute the framework at appropriate risk management levels.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Personnel Security?

[Assistant]
According to Summary of NIST SP 800-53, Revision 4_ Security and Privacy Controls for Federal Information Systems and Organizations:

SP 800-53 Revision 4 has been updated to reflect the evolving technology and threat space. Example areas include issues particular to mobile and cloud computing; insider threats; applications security; supply chain risks; advanced persistent threat; and trustworthiness, assurance, and resilience of information systems. The revision also contains a new appendix of privacy controls, and related implementation guidance (Appendix J), based on the Fair Information Practice Principles (FIPPs), a widely accepted framework of defining principles to be used in the evaluation and consideration of systems, processes, or programs that affect individual privacy.

The criteria for whether a security control is assurance- or functionality-related is based on the overall characteristics of the control. In general, assurance-related controls are controls that: (i) define processes, procedures, techniques, or methodologies for designing and developing information systems and system components; (ii) provide supporting operational processes including improving the quality of systems, components, or processes; (iii) produce security evidence from developmental or operational activities; (iv) determine security control effectiveness or risk; or (v) improve personnel skills, expertise, and understanding.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Incident Response?

[Assistant]
According to The Federal Cybersecurity Awareness Workforce_ Professional Backgrounds, Knowledge, Skills, and Development Activities:

In an open-ended question, we also asked what other job functions or roles the participants had in addition to their security awareness responsibilities. All but two participants had other substantial cybersecurity duties beyond awareness training, for example, incident response, supply chain risk management, audits and compliance, policy, information systems security management, privacy awareness and training, cybersecurity role-based training, and project management.

'I think you need someone who is able to converse with network engineers, incident response teams, and when those people start talking about like FIPS [Federal Information Processing Standards] encryption or cloud infrastructure or something like that.' (S06)

'We have one annual course, and we've bundled a lot of training requirements in this one course. It's security awareness, privacy, incident response, rules of behavior, all these things in one course.' (S06)

The Federal Cybersecurity Awareness Workforce_ Professional Backgrounds, Knowledge, Skills, and Development Activities


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Awareness and Training?

[Assistant]
According to Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule_ A Cybersecurity Resource Guide:

| Executive Summary............................................................................................................................1      |
|-----------------------------------------------------------------------------------------------------------------------------------------------------|
| 1. Introduction...................................................................................................................................4 |
| 2. HIPAA Security Rule .......................................................................................................................9     |
| 3. Risk Assessment Guidance............................................................................................................14           |
| 4. Risk Management Guidance .........................................................................................................24             |
| 5. Considerations When Implementing the HIPAA Security Rule........................................................28                               |
| 5.1.2. Assigned Security Responsibility (§ 164.308(a)(2)) ....................................................................35                    |
| 5.1.3. Workforce Security (§ 164.308(a)(3)).........................................................................................36              |
| 5.1.4. Information Access Management (§ 164.308(a)(4)) ..................................................................38                         |
| 5.1.5. Security Awareness and Training (§ 164.308(a)(5)) ...................................................................41                      |
| 5.1.6. Security Incident Procedures (§ 164.308(a)(6)) .........................................................................44                   |
| 5.1.7. Contingency Plan (§ 164.308(a)(7))............................................................................................47             |
| 5.1.8.

Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule_ A Cybersecurity Resource Guide


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Information Integrity?

[Assistant]
According to Guidelines on Mobile Device Forensics:

The types of software available for mobile device examination include commercial and open source forensic tools, as well as non-forensic tools intended for device management, testing, and diagnostics. Forensic tools are typically designed to acquire data from the internal memory of handsets and UICCs without altering their content and to calculate integrity hashes for the acquired data. Both forensic and non-forensic software tools often use the same protocols and techniques to communicate with a device. However, non-forensic tools may allow unrestricted two-way flow of information and omit data integrity hash functions. Mobile device examiners typically assemble a collection of both forensic and non-forensic tools for their toolkit. The range of devices over which they operate is typically narrowed to: distinct platforms, a specific operating system family or even a single type of hardware architecture. Short product release cycles  are  the  norm  for  mobile  devices,  requiring  tool  manufacturers  to  continually  update their tools providing forensics examiners with an forensic solution. The task is formidable and tool manufacturers' support for newer models may lag significantly behind the introduction of a device into the marketplace. Models of older functioning mobile devices, though out of date, can remain in use for years after their initial release. Mobile device models introduced into one national market may also be used in areas by exchanging the UICC of one cellular carrier with that  from  another  carrier. The  current  state  is  likely  to  continue,  keeping  the  cost  of examination  significantly  higher  than  if  a  few  standard  operating  systems  and  hardware configurations prevailed. An  important  characteristic  of  a  forensic  tool  is  its  ability  to  maintain  the  integrity  of  the original data source being acquired and also that of the extracted data.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Personnel Security?

[Assistant]
According to Incident Response Recommendations and Considerations for Cybersecurity Risk Management_ A CSF 2.0 Community Profile:

The target audience for this publication includes cybersecurity program leadership, cybersecurity personnel, and others who are responsible for preparing for, detecting, responding to, or recovering from cybersecurity incidents. This publication is intended for use by most organizations, regardless of sector, size, or other factors.

At that time, incidents were relatively rare, the scope of most incidents was narrow and welldefined, and incident response and recovery was usually completed within a day or two. Under those conditions, it was realistic to treat incident response as a separate set of activities performed by a separate team of personnel and to depict all incident response activities as part of a circular life cycle. Formal post-incident activities would identify needed improvements and feed them into the preparation stage, thus starting the cycle again. Incident response activities were typically intermittent rather than continuous.

(e.g., detecting the presence of a new threat and characterizing its behavior) and communicate those lessons to the appropriate personnel so that the organization's incident response and other cybersecurity risk management policies, processes, and practices can be adjusted as needed.

Incident Response Recommendations and Considerations for Cybersecurity Risk Management_ A CSF 2.0 Community Profile


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Strategies for the Integration of Software Supply Chain Security in DevSecOps CI_CD Pipelines provide? (Part 4)

[Assistant]
astructure, such as a service mesh, that provides all application services. This class of applications is generally developed using a flexible and agile software development paradigm called DevSecOps.
A salient feature of this paradigm is the use of flow processes called continuous integration and continuous deployment (CI/CD) pipelines, which initially take the software through various stages (e.g., build, test, package, and deploy) in the form of source code through operations that constitute the software supply chain (SSC) in order to deliver a new version of software . This document outlines strategies for integrating SSC security measures into CI/CD pipelines. ## Keywords

actor; artifact; attestation; CI/CD pipeline; package; provenance; repository; SBOM; SDLC; SLSA; software supply chain. ## Reports on Computer Systems Technology

The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the Nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology. ITL's responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in federal information systems. The Special Publication 800-series reports on ITL's research, guidelines, and outreach efforts in information system security, and its collaborative activities with industry, government, and academic organizations. ## Patent Disclosure Notice

NOTICE: ITL has requested that holders of patent claims whose use may be required for compliance with the guidance or requirements of this publication disclose such patent claims to ITL.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Personnel Security?

[Assistant]
According to Secure Software Development Framework (SSDF) Version 1.1_ Recommendations for Mitigating the Risk of Software Vulnerabilities:

Example 5 : Establish and follow processes to address risk when there are security requirements that third-party software components to be acquired do not meet; this should include periodic reviews of all approved exceptions to requirements. | SCAGILE : Tasks Requiring the Help of Security Experts 8 SCFPSSD : Manage Security Risk Inherent in the Use of Third-Party Components SCSIC : Vendor Sourcing Integrity Controls SP80053 : SA-4, SA-9, SA-10, SA-10(1), SA-15, SR-3, SR-4, SR-5 SP800160 : 3.1.1, 3.1.2 SP800161 : SA-4, SA-9, SA-9(1), SA-9(3), SA-10, SA-10(1), SA-15, SR-3, SR-4, SR-5 SP800181 : T0203, T0415; K0039; S0374; A0056, A0161                                                                                |
| Implement Roles and Responsibilities (PO.2) : Ensure that everyone inside and outside of the organization involved in the SDLC is prepared to perform their SDLC-related roles and responsibilities throughout the SDLC. | PO.2.1 : Create new roles and alter responsibilities for existing roles as needed to encompass all parts of the SDLC. Periodically review and maintain the defined roles and responsibilities, updating them as needed. | Example 1 : Define SDLC-related roles and responsibilities for all members of the software development team. Example 2 : Integrate the security roles into the software development team. Example 3 : Define roles and responsibilities for cybersecurity staff, security champions, project managers and leads, senior management, software developers, software testers, software assurance leads and staff, product owners, operations and platform engineers, and others involved in the SDLC. Example 4 : Conduct an annual review of all roles and responsibilities.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AT.L2-3.2.8 (NIST 3.2.8)?

[Assistant]
According to Digital Identity Guidelines_ Authentication and Authenticator Management:

3.2.8. 3.2.8. 3.2.8.

Digital Identity Guidelines_ Authentication and Authenticator Management


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice IA.L2-3.5.4 (NIST 3.5.4)?

[Assistant]
According to Contingency Planning Guide for Federal Information Systems:

3.5.4 TT&E                                                                                | Exercises... 3.5.4 provides guidance on the type of TT&E identified for each FIPS 199 impact level. 3.5.4 TT&E Program Summary

A TT&E program provides an overall framework for determining, scheduling, and setting objectives for TT&E activities.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171 provide? (Part 3)

[Assistant]
efore  the  completion  of  such  companion  publications. Thus,  until  each  publication  is completed,  current  requirements,  guidelines,  and  procedures,  where  they  exist,  remain operative.
For planning and transition purposes, federal agencies may wish to closely follow the development of these new publications by NIST. Organizations are encouraged to review draft publications during the public comment periods and provide feedback to NIST. Many NIST publications, other than the ones noted above, are available at https://csrc.nist.gov/publications. ## Comments on this publication may be submitted to:

National Institute of Standards and Technology Attn: Computer Security Division, Information Technology Laboratory 100 Bureau Drive (Mail Stop 8930) Gaithersburg, MD 20899-8930

Email: sec-cert@nist.gov

All comments are subject to release under the Freedom of Information Act (FOIA) [FOIA96]. \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

## Reports on Computer Systems Technology

The National Institute of Standards and Technology (NIST) Information Technology Laboratory (ITL) promotes the U.S. economy and public welfare by providing technical leadership for the Nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology (IT). ITL's responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the costeffective security of other than national security-related information in federal information systems.

Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 1 require for Awareness and Training?

[Assistant]
According to Summary Report for “Workshop on Updating Manufacturer Guidance for Securable Connected Product Development”:

end of life devices, supported devices with unsupportive owners, and herd immunity against malicious actors. ' Zombie devices ' are those that no longer receive software support and security updates.
Higginbotham noted that unsupportive owners can neglect cybersecurity issues, leading to vulnerabilities. Herd immunity in cybersecurity requires collective action from manufacturers and consumers. Most consumers are unaware or indifferent to the end of life status of their products, resulting in ' zombie hordes ' . Communicating end of life status and dates is crucial, including proactive notification to consumers, retailers, and third parties. Companies should track devices to address critical vulnerabilities and create structured options for off-ramping zombie devices. Higginbotham emphasized that company priorities often overlook device security. Manufacturers should implement vulnerability disclosure programs, track issues, conduct comprehensive security audits, and allocate budgets for security maintenance. Buyers must keep products updated or segmented, and legislation should clarify responsibility to ensure herd immunity. Companies should have a dedicated point of contact for security researchers and consider recalls for insecure devices. Stacey also addressed secure repairs, both before and after end of life. Good hardware should not end up in landfills, but unpatched zombie devices pose risks. Consumer Reports advocates for designing products for longevity, including features like hardware upgrades, crypto agility, and increased memory.

Summary Report for “Workshop on Updating Manufacturer Guidance for Securable Connected Product Development”


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 2 require for Media Protection?

[Assistant]
According to Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations:

......................98      |
| Table 11. Maintenance (MA) ......................................................................................................................98      |
| Table 12.
Media Protection (MP)................................................................................................................99        |
| Table 13. Physical and Environmental Protection (PE)...............................................................................99                    |
| Table 14. Planning (PL)..............................................................................................................................100 |
| Table 15. Program Management (PM) .....................................................................................................100               |
| Table 16. Personnel Security (PS) .............................................................................................................101       |
| Table 17. PII Processing and Transparency (PT) .......................................................................................102                |
| Table 18. Risk Assessment (RA) ................................................................................................................102       |
| Table 19. System and Services Acquisition (SA)........................................................................................103                |
| Table 20. System and Communications Protection (SC)...........................................................................103                        |
| Table 21. System and Information Integrity (SI) .......................................................................................104               |
| Table 22. Supply Chain Risk Management (SR).........................................................................................105                  |
| Table 23.

Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AT.L2-3.2.3 (NIST 3.2.3)?

[Assistant]
According to Access Control on NoSQL Databases:

3.2.3. 3.2.3.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Maintenance?

[Assistant]
According to Risk Management Framework for Information Systems and Organizations_ A System Life Cycle Approach for Security and Privacy:

This publication contains comprehensive updates to the Risk Management Framework . The updates include an alignment with the constructs in the NIST Cybersecurity Framework; the integration of privacy risk management processes; an alignment with system life cycle security engineering processes; and the incorporation of supply chain  risk  management  processes. Organizations  can use the frameworks and processes in a complementary manner within the RMF to effectively manage security and  privacy risks to organizational  operations  and assets, individuals, other organizations, and the Nation. Revision 2 includes a set of organization-wide RMF tasks that are designed to prepare information system owners to conduct system-level risk management activities. The intent  is  to  increase  the  effectiveness,  efficiency,  and cost-effectiveness  of  the  RMF  by  establishing  a  closer connection to the organization's missions and business functions  and  improving  the  communications  among senior leaders, managers, and operational personnel. * Note: The publication pertains to information systems, which are discrete sets of information resources organized  for  the  collection,  processing,  maintenance,  use,  sharing,  dissemination,  or  disposition  of information, whether such information is in digital or non-digital form. Information resources include information and related resources, such as personnel, equipment, funds, and information technology. Therefore, information systems may or may not include hardware, firmware, and software. This publication is intended to help organizations manage security and privacy risk, and to satisfy the requirements in the Federal Information Security Modernization Act of 2014 (FISMA), the Privacy Act of 1974, OMB policies, and Federal Information Processing Standards, among other laws,  regulations,  and  policies.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations provide? (Part 6)

[Assistant]
----------------------------------|
| 1.4.1. Enterprise Risk Management and C-SCRM Owners and Operators.............................................5                                         |
| 1.4.2.
Enterprise, Agency, and Mission and Business Process Owners and Operators .........................5                                             |
| 1.4.3. Acquisition and Procurement Owners and Operators.................................................................6                               |
| 1.4.4. Information Security, Privacy, or Cybersecurity Operators .........................................................6                             |
| 1.4.5. System Development, System Engineering, and System Implementation Personnel.................7                                                    |
| 1.5.1. Enterprise's Supply Chain.............................................................................................................9          |
| 1.5.2. Supplier Relationships Within Enterprises .................................................................................10                    |
| 2. Integration of C-SCRM Into Enterprise-Wide Risk Management...................................................... 18                                  |
| 2.3.1. Roles and Responsibilities Across the Three Levels ...................................................................24                         |
| 2.3.2. Level 1 -Enterprise...................................................................................................................27         |
| 2.3.3. Level 2 -Mission and Business Process....................................................................................30                      |
| 2.3.4. Level 3 -Operational................................................................................................................32           |
| 2.3.5.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Validating the Integrity of Computing Devices provide? (Part 2)

[Assistant]
ds and Technology

## NIST SPECIAL PUBLICATION 1800-34A

## Validating the Integrity of Computing Devices

Volume A: Executive Summary

Jon Boyens Tyler Diamond* Nakia Grayson Celia Paulsen William T.
Polk Andrew Regenscheid Murugiah Souppaya

National Institute of Standards and Technology Information Technology Laboratory

## Karen Scarfone

Scarfone Cybersecurity Clifton, Virginia

*Former employee; all work for this publication was done while at employer

## December 2022

FINAL

This publication is available free of charge from https://doi.org/10.6028/NIST.SP.1800-34

<!-- image -->

## Executive Summary

The supply chains of information and communications technologies are increasingly at risk of compromise. Additional risks causing supply chain disruptions include counterfeiting, unauthorized production, tampering, theft, and insertion of unexpected software and hardware. Managing these risks requires ensuring the integrity of the supply chain and its products and services. This project demonstrates how organizations can verify that the internal components and system firmware of the computing devices they acquire are genuine and have not been unexpectedly altered during manufacturing, distribution, or operational use. ## CHALLENGE

Technologies today rely on complex, globally distributed and interconnected supply chain ecosystems to provide highly refined, cost-effective, and reusable solutions. Most organizations' security processes consider only the visible state of computing devices. The provenance and integrity of a delivered device and its components are typically accepted without validating through technology that there were no unexpected modifications. A delivered device has integrity if it is genuine and all changes to the device were authorized and expected. Provenance is the comprehensive history of a device throughout the entire life cycle from creation to ownership, including changes made within the device or its components.

Validating the Integrity of Computing Devices


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Identification and Authentication?

[Assistant]
According to Overview and Considerations of Access Control Based on Attribute Encryption:

................................................ 4                       |
| 2.2. | Elliptic-Curve Cryptography ........................................................................................
| 5                                                                                |
| 2.3. | Bilinear Pair Mapping.................................................................................................. | 7                                                                                |
| 2.4. | Bilinear Pairing for Cryptography................................................................................ | 9                                                                                |
| 3. | Identity-Based Encryption ..............................................................................................11                  |                                                                                |
| 4. | Attribute-Based Encryption............................................................................................13                    |                                                                                |
| 4.1. | Ciphertext-Policy Attribute-Based Encryption                                                                                | ............................................................13                                                                         |
| 4.2.

Overview and Considerations of Access Control Based on Attribute Encryption


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Risk Assessment?

[Assistant]
According to Guide to a Secure Enterprise Network Landscape:

tection and response (EDR) solutions that collect security telemetry data on endpoints. Any threat that is already inside of a network can move laterally and remain undetected for days or even months.
- Edge computing [1], where much of the computing takes place close to the location of multiple IoT devices that may be geographically dispersed
- Users located both within and outside of the corporate network, such as in homes, remote branch offices, and public locations (e.g., hotels, pubs); some enterprises must also provide access to ecosystem partners, who may be on their own corporate networks

Guide to a Secure Enterprise Network Landscape


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Incident Response?

[Assistant]
According to Secure Software Development Practices for Generative AI and Dual-Use Foundation Models_ An SSDF Community Profile:

|            | reward models; adaptation layers; and configuration parameters -before using them. R2: Scan and thoroughly test acquired AI models and their components for vulnerabilities and malicious content before use. |                                                                                |
| Create Source Code by Adhering to Secure Coding Practices (PW.5): Decrease the number of security vulnerabilities in the software, and reduce costs by minimizing vulnerabilities introduced during source code creation that meet or exceed organization-defined vulnerability severity criteria. | PW.5.1: Follow all secure coding practices that are appropriate to the development languages and environment to meet the organization's requirements. | High       | R1: Expand secure coding practices to include AI technology-specific considerations. R2: Code the handling of inputs (including prompts and user data) and outputs carefully. All inputs and outputs should be logged, analyzed, and validated within the context of the AI model, and those with issues should be sanitized or dropped. R3: Encode inputs and outputs to prevent the execution of unauthorized code. | AI RMF: Manage 1.2, 1.3, 1.4 OWASP: LLM01, LLM02, LLM04-1, LLM06, LLM07, LLM09-9, LLM10 |
| Configure the Compilation, Interpreter, and Build Processes to Improve Executable Security (PW.6): Decrease the number of security vulnerabilities in the software and reduce costs by eliminating vulnerabilities before testing occurs. | PW.6.1: Use compiler, interpreter, and build tools that offer features to improve executable security. | Low        | C1: Consider using secure model serialization mechanisms that reduce or eliminate vectors for the introduction of malicious content.

Secure Software Development Practices for Generative AI and Dual-Use Foundation Models_ An SSDF Community Profile


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Services Acquisition?

[Assistant]
According to Data Integrity_ Detecting and Responding to Ransomware and Other Destructive Events:

Organizations participating in this project submitted their capabilities in response to an open call in the Federal Register for all sources of relevant security capabilities from academia and industry (vendors and integrators). The following respondents with relevant capabilities or product components (identified as 'Technology Partners/Collaborators' herein) signed a Cooperative Research and Development Agreement (CRADA) to collaborate with NIST in a consortium to build this example solution. The National Cybersecurity Center of Excellence (NCCoE), a part of the National Institute of Standards and Technology (NIST), is a collaborative hub where industry organizations, government agencies, and academic institutions work together to address businesses' most pressing cybersecurity issues. This public-private partnership enables the creation of practical cybersecurity solutions for specific industries, as well as for broad, cross-sector technology challenges. Through consortia under Cooperative Research and Development Agreements (CRADAs), including technology partners-from Fortune 50 market leaders to smaller companies specializing in information technology security-the NCCoE applies standards and best practices to develop modular, adaptable example cybersecurity solutions using commercially available technology. The NCCoE documents these example solutions in the NIST Special Publication 1800 series, which maps capabilities to the NIST Cybersecurity Framework and details the steps needed for another entity to re-create the example solution. The NCCoE was established in 2012 by NIST in partnership with the State of Maryland and Montgomery County, Maryland. The Technology Partners/Collaborators who participated in this build submitted their capabilities in response to a notice in the Federal Register.

Data Integrity_ Detecting and Responding to Ransomware and Other Destructive Events


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Media Protection?

[Assistant]
According to Workshop on Enhancing Security of Devices and Components Across the Supply Chain:

Semiconductor-based hardware is the foundation of modern-day electronics - from smartphones, computers, and telecommunications to transportation and critical infrastructure. The semiconductor hardware supply chain is a complex network of companies that collectively provide intellectual property, designs, and raw materials and manufacture, test, package, and distribute products. Coordination among the components of a supply chain is required at different stages, including inception, deployment to end users, maintenance during use, and disposal or end of life. Securing semiconductor-based hardware and their supply chains help protect sensitive information, maintain the integrity of systems, and ensure overall stability across the infrastructure and connected world.

Workshop on Enhancing Security of Devices and Components Across the Supply Chain