[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Identification and Authentication?

[Assistant]
According to High-Performance Computing Security_ Architecture, Threat Analysis, and Security Posture:

rs or services in a direct way. Privileged users responsible for configuring, maintaining, and operating the HPC system access the management zone servers and switches through extra security controls.
For example, from the public-facing login nodes, they may go through a bastion host that is typically located in the management zone, or they may establish a virtual private network (VPN) with separate authentication and authorization or other appropriate security controls to reach the management zone. All systems are configured on networks that are not routed beyond the perimeter of the HPC system so that only nodes like compute nodes and storage nodes can access the services.

High-Performance Computing Security_ Architecture, Threat Analysis, and Security Posture


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice MA.L2-3.7.5 (NIST 3.7.5)?

[Assistant]
According to Audit and Evaluation of Computer Security II_ System Vulnerabilities and Controls:

3.7.5 Formulary                                                                             | 3. 3.7.5 Formulary                                                                             | 10-13 10-14 |
|                                                                                |                                                                                |                                                                                | 10-14       |
| 4. 3.7.5 Formulary ; Ihe formulary is the most general of all forms of data classification scheme.

Audit and Evaluation of Computer Security II_ System Vulnerabilities and Controls


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Awareness and Training?

[Assistant]
According to Summary of NIST SP 800-53, Revision 4_ Security and Privacy Controls for Federal Information Systems and Organizations:

The security control baselines address the security needs of a broad and diverse set of constituencies, and are developed based on a number of general assumptions, including common environmental, operational, and functional considerations. The baselines also assume typical threats facing common information systems.  Articulating the underlying assumptions is a key element in the initial risk framing step of the risk management process described in NIST SP 800-39.  To ensure that an appropriate set of controls is identified to provide security commensurate with risk, organizations tailor the controls to align with specific security needs. Organizations may perform tailoring at the organization level for all information systems, in support of a particular line of business or mission/business process, at the individual information system level, or by using a combination of the above. The tailoring process is comprised of several steps, as described in SP 800-53 Rev. 4 Section 3.2.  These actions include:

Summary of NIST SP 800-53, Revision 4_ Security and Privacy Controls for Federal Information Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Maintenance?

[Assistant]
According to Guide to Enterprise Patch Management Planning_ Preventive Maintenance for Technology:

Preventive Maintenance for Technology

Preventive Maintenance for Technology

Enterprise patch management is the process of identifying, prioritizing, acquiring, installing, and verifying the installation of patches, updates, and upgrades throughout an organization. Patching is more important than ever because of the increasing reliance on technology, but there is often a divide between business/mission owners and security/technology management about the value of patching. This publication frames patching as a critical component of preventive maintenance for computing technologies - a cost of doing business, and a necessary part of what organizations need to do in order to achieve their missions. This publication also discusses common factors that affect enterprise patch management and recommends creating an enterprise strategy to simplify and operationalize patching while also improving reduction of risk. Preventive maintenance through enterprise patch management helps prevent compromises, data breaches, operational disruptions, and other adverse events.

Guide to Enterprise Patch Management Planning_ Preventive Maintenance for Technology


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice CM.L2-3.4.3 (NIST 3.4.3)?

[Assistant]
According to Contingency Planning Guide for Federal Information Systems:

3.4.3                                                                                | Alternate Sites ... 3.4.3 Alternate Sites

As stated in Section 2.

Contingency Planning Guide for Federal Information Systems


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Guidelines for the Use of PIV Credentials in Facility Access provide? (Part 9)

[Assistant]
..........................................6                     |
| 3. | Threat Environment.............................................................................................................
7           |
| 3.1  | Identifier Collisions .......................................................................................................7              |
| 3.2  | Revoked PIV Cards .......................................................................................................8                  |
| 3.3  | Visual Counterfeiting ....................................................................................................8                 |
| 3.4  | Skimming.......................................................................................................................9            |
| 3.5  | Sniffing ..........................................................................................................................9        |
| 3.6  | Social Engineering.......................................................................................................10                 |
| 3.7  | Electronic Cloning.......................................................................................................10                 |
| 3.8  | Electronic Counterfeiting ............................................................................................10                    |
| 3.9  | Other Threats ...............................................................................................................11             |
| 4. | PIV Authentication Mechanisms in PACS Applications ................................................

Guidelines for the Use of PIV Credentials in Facility Access

Audit and Accountability
System and Information Integrity
Security Assessment
Media Protection
Identification and Authentication
Awareness and Training
System and Communications Protection
Access Control
Planning
Incident Response
Risk Assessment
Personnel Security
System and Services Acquisition
Supply Chain Risk Management
Maintenance
Physical Protection
Configuration Management


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Audit and Accountability?

[Assistant]
According to Incident Response Recommendations and Considerations for Cybersecurity Risk Management_ A CSF 2.0 Community Profile:

| Priority   | Recommendations, Considerations, Notes making on when to escalate or elevate incident response activities.
|
|--------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| GV.RM-07                                         | Strategic opportunities (i.e., positive risks) are characterized and are included in organizational cybersecurity risk discussions                                   | Low        |                                                                                |
| GV.RR (Roles, Responsibilities, and Authorities) | Cybersecurity roles, responsibilities, and authorities to foster accountability, performance assessment, and continuous improvement are established and communicated | Medium     | R1: Cybersecurity roles, responsibilities, and authorities should include incident response.

Incident Response Recommendations and Considerations for Cybersecurity Risk Management_ A CSF 2.0 Community Profile


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Personnel Security?

[Assistant]
According to Contingency Planning Guide for Federal Information Systems:

that govern actions to be taken following a system disruption. The Activation/Notification Phase describes the process of activating the plan based on outage impacts and notifying recovery personnel.
The Recovery Phase details a suggested course of action for recovery teams to restore system operations at an alternate site or using contingency capabilities. The final phase,


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Media Protection?

[Assistant]
According to Assessing Security and Privacy Controls in Information Systems and Organizations:

CHAPTER ONE INTRODUCTION ............................................................................................................... 1
1.1   PURPOSE AND APPLICABILITY .......................................................................................................... 1
1.2   TARGET AUDIENCE ............................................................................................................................ 4
1.3   RELATED PUBLICATIONS AND ASSESSMENT PROCESSES ............................................................... 4
1.4   ORGANIZATION OF THIS PUBLICATION ........................................................................................... 5
CHAPTER TWO THE FUNDAMENTALS ..................................................................................................... 6
2.1   ASSESSMENTS WITHIN THE SYSTEM DEVELOPMENT LIFE CYCLE .................................................. 6
2.2   CONTROL STRUCTURE AND ORGANIZATION .................................................................................. 7
2.3   BUILDING AN EFFECTIVE ASSURANCE CASE .................................................................................... 8
2.4   ASSESSMENT PROCEDURES: ASSESSMENT OBJECTS, METHODS AND OBJECTIVES ................... 11
CHAPTER THREE THE PROCESS ............................................................................................................. 19
3.1   PREPARE FOR SECURITY AND PRIVACY CONTROL ASSESSMENTS ............................................... 19
3.2   DEVELOP SECURITY AND PRIVACY ASSESSMENT PLANS .............................................................. 23
3.3   CONDUCT SECURITY AND PRIVACY CONTROL ASSESSMENTS ..................................................... 30
3.4   ANALYZE ASSESSMENT REPORT RESULTS .....................................................................................

Assessing Security and Privacy Controls in Information Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Cryptographic Module Validation Program (CMVP)-Approved Sensitive Security Parameter Generation and Establishment Methods_ CMVP Validation Authority U provide? (Part 6)

[Assistant]
| Terms and definitions ......................................................................................................
1                                                                                |
|                                                                                | Symbols and abbreviated terms...................................................................................... 1                                                                                |
|                                                                                | Document organization.................................................................................................... 1                                                                                |
|                                                                                | General....................................................................................................................... 1                                                                                |
|                                                                                | Modification ................................................................................................................

Cryptographic Module Validation Program (CMVP)-Approved Sensitive Security Parameter Generation and Establishment Methods_ CMVP Validation Authority U


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What guidance does Ascon-Based Lightweight Cryptography Standards for Constrained Devices_ Authenticated Encryption, Hash, and Extendable Output Functions provide?

[Assistant]
<!-- image -->

## NIST Special Publication 800 NIST SP 800-232

## Ascon-Based Lightweight Cryptography Standards for Constrained Devices

Authenticated Encryption, Hash, and Extendable Output Functions

Meltem Sönmez Turan Kerry A. McKay Donghoon Chang Jinkeon Kang John Kelsey

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-232

<!-- image -->

## NIST Special Publication 800 NIST SP 800-232

## Ascon-Based Lightweight Cryptography Standards for Constrained Devices

Authenticated Encryption, Hash, and Extendable Output Functions

Meltem Sönmez Turan Kerry A. McKay Jinkeon Kang* John Kelsey

Computer Security Division Information Technology Laboratory

* Former Foreign Guest Researcher; all work for this publication was done while at NIST. Donghoon Chang

Strativia

This publication is available free of charge from:

https://doi.org/10.6028/NIST.SP.800-232

August 2025

<!-- image -->

U.S. Department of Commerce Howard Lutnick, Secretary

Certain equipment, instruments, software, or materials, commercial or non-commercial, are identified in this paper in order to specify the experimental procedure adequately. Such identification does not imply recommendation or endorsement of any product or service by NIST, nor does it imply that the materials or equipment identified are necessarily the best available for the purpose. There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may be used by federal agencies even before the completion of such companion publications. Thus, until each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning and transition purposes, federal agencies may wish to closely follow the development of these new publications by NIST.

Ascon-Based Lightweight Cryptography Standards for Constrained Devices_ Authenticated Encryption, Hash, and Extendable Output Functions


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Personnel Security?

[Assistant]
According to Guidelines for Media Sanitization:

- The types (e.g., hard copy, ISM), physical sizes, density (e.g., high resolution film), or capacities (e.g., megabyte, gigabyte, terabyte for ISM) of the media to be sanitized
- The confidentiality requirement for the information recorded or stored on the media
- Whether the media will be processed in a controlled area
- Whether sanitization techniques should be conducted by the organization or a third party
- Whether sanitization is performed on-site or off-site 3
- The anticipated volume of media to be sanitized by type
- The availability of sanitization equipment and tools
- The training level of personnel with sanitization equipment or tools
- How much time the complete sanitization technique will take (i.e., duration)
- The cost of sanitization when considering tools, training, verification, and re-entering ISM into the supply stream

- Alignment of the organization's data classification scheme (e.g., low, medium, and high security categorizations) with minimum acceptable sanitization methods (i.e., clear, purge, and destroy)
- Requirements for the disposal and/or reuse of storage assets
- Expected outcomes from storage sanitization activities (e.g., identification of specific, acceptable sanitization techniques [13])
- Documentation or evidence associated with sanitization activities (see Sec. 4.6)
- The identification of roles and responsibilities (see Sec. 4.7) and personnel competencies, skills, and training
- The use of sanitization tools, including equipment calibration, testing, and maintenance
- Type of assurances (e.g., guarantees, assessment results, formal certifications) that the ISM vendor should provide for the sanitization capabilities

Varying data protection policies may be established within an organization.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What guidance does NIST provide for CMMC Level 2?

[Assistant]
According to Assessing Security Requirements for Controlled Unclassified Information:

<!-- image -->

## NIST Special Publication 800 NIST SP 800-171Ar3

## Assessing Security Requirements for Controlled Unclassified Information

Ron Ross Victoria Pillitteri

This publication is available free of charge from:

https://doi.org/10.6028/NIST.SP.800-171Ar3

<!-- image -->

## NIST Special Publication

## NIST SP 800-171Ar3

## Assessing Security Requirements for Controlled Unclassified Information

Ron Ross Victoria Pillitteri Computer Security Division

Information Technology Laboratory

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-171Ar3

May 2024

<!-- image -->

U.S. Department of Commerce Gina M. Raimondo, Secretary

National Institute of Standards and Technology

Certain equipment, instruments, software, or materials, commercial or non-commercial, are identified in this paper in order to specify the experimental procedure adequately. Such identification does not imply recommendation or endorsement of any product or service by NIST, nor does it imply that the materials or equipment identified are necessarily the best available for the purpose. There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may be used by federal agencies even before the completion of such companion publications. Thus, until each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning and transition purposes, federal agencies may wish to closely follow the development of these new publications by NIST. to NIST. Many NIST cybersecurity publications, other than the ones noted above, are available at

Organizations are encouraged to review all draft publications during public comment periods and provide feedback https://csrc.nist.gov/publications.

Assessing Security Requirements for Controlled Unclassified Information


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Services Acquisition?

[Assistant]
According to Ascon-Based Lightweight Cryptography Standards for Constrained Devices_ Authenticated Encryption, Hash, and Extendable Output Functions:

Certain equipment, instruments, software, or materials, commercial or non-commercial, are identified in this paper in order to specify the experimental procedure adequately. Such identification does not imply recommendation or endorsement of any product or service by NIST, nor does it imply that the materials or equipment identified are necessarily the best available for the purpose. There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may be used by federal agencies even before the completion of such companion publications. Thus, until each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning and transition purposes, federal agencies may wish to closely follow the development of these new publications by NIST. Organizations are encouraged to review all draft publications during public comment periods and provide feedback to NIST. Many NIST cybersecurity publications, other than the ones noted above, are available at https://csrc.nist.gov/publications

The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the Nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology. ITL's responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national securityrelated information in federal information systems.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Security Assessment?

[Assistant]
According to Contingency Planning Guide for Federal Information Systems:

| Chapter 1.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Configuration Management?

[Assistant]
According to Zero Trust Architecture:

| 1 INTRODUCCIÓN..................................................................................................................................................10 | 1 INTRODUCCIÓN..................................................................................................................................................10 | 1 INTRODUCCIÓN..................................................................................................................................................10 | |---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------| | 1.1 | HISTORIA DE LOS PROGRAMAS DE CONFIANZA CERO RELACIONADOS CON LAS AGENCIAS FEDERALES .................................11 | | | 1.2 | E STRUCTURA DEL DOCUMENTO .........................................................................................................................12 | | | CONCEPTOS BÁSICOS DE LA CONFIANZA CERO.................................................................................................13 | CONCEPTOS BÁSICOS DE LA CONFIANZA CERO.................................................................................................13 | | | 2.1 | PRINCIPIOS DE LA CONFIANZA CERO ....................................................................................................................15 | | | 2.2 | VISIÓN DE CONFIANZA CERO DE UNA RED .............................................................................................................17 | | | COMPONENTES LÓGICOS DE LA ARQUITECTURA DE CONFIANZA CERO..........................................................19 | COMPONENTES LÓGICOS DE LA ARQUITECTURA DE CONFIANZA CERO..........................................................19 | | | 3.1 VARIACIONES DE LOS ENFOQUES DE LA ARQUITECTURA DE CONFIANZA CERO ...............................................................21 | 3.1 VARIACIONES DE LOS ENFOQUES DE LA ARQUITECTURA DE CONFIANZA CERO ...............................................................21 | | | 3.1.1 | ZTA basada en una gobernanza de la identidad mejorada...................................................................22 | | | 3.1.2 | ZTA y el uso de la microsegmentación..................................................................................................23 | | | 3.1.3 | ZTA y el uso de una infraestructura de red y perímetros definidos a través de software....................23 | | | 3.2 | VARIANTES IMPLEMENTADAS DE LA ARQUITECTURA ABSTRACTA ...............................................................................24 | | | 3.2.1 | Despliegue basado en agentes y puertas de enlace de los dispositivos...............................................24


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for System and Communications Protection?

[Assistant]
According to Protecting Controlled Unclassified Information (CUI)_ NIST Special Publication 800-171, Revision 3. Small Business Primer:

| Access Control                    | Maintenance         | Security Assessment and Monitoring   |
|-----------------------------------|---------------------|--------------------------------------|
| Awareness and Training            | Media Protection    | System and Communications Protection |
| Audit and Accountability          | Personnel Security  | System and Information Integrity     |
| Configuration Management          | Physical Protection | Planning                             |
| Identification and Authentication | Risk Assessment     | System and Services Acquisition      |
| Incident Response                 |                     | Supply Chain Risk Management         |

- A business champion: Someone who is responsible for developing and maintaining the incident response plan.
- Who to call: List all the individuals who may be part of the incident response efforts. Include their contact information, roles, and responsibilities.
- What/when/how to report: List the business' communications/reporting responsibilities as required by laws, regulations, contracts, agreements, or policies.
- Also, most federal contracts will include specific reporting and notification requirements that should be included in the Incident Response Plan

Description: Monitor, control, and protect organizational communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of the systems; and employ architectural designs, software development techniques, and systems engineering principles that promote effective information security within organizational systems.

Protecting Controlled Unclassified Information (CUI)_ NIST Special Publication 800-171, Revision 3. Small Business Primer


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Risk Assessment?

[Assistant]
According to Validating the Integrity of Computing Devices:

| 1 | Summary.............................................................................................1 | Summary.............................................................................................1 | Summary.............................................................................................1 | |-----|---------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | | 1.1 | Challenge.......................................................................................................................2 | | | | 1.2 | Solution..........................................................................................................................3 | | | | 1.3 | Benefits..........................................................................................................................4 | | | 2 | How to Use This Guide.........................................................................4 | How to Use This Guide.........................................................................4 | | | | 2.1 | Typographic Conventions..............................................................................................5 | | | 3 | Approach.............................................................................................6 | Approach.............................................................................................6 | | | | 3.1 | Audience........................................................................................................................6 | | | | 3.2 | Scope .............................................................................................................................6 | | | | | 3.2.1 Scenario 1: Creation of Verifiable Platform | Artifacts ...................................................

Validating the Integrity of Computing Devices


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AC.L2-3.1.3 (NIST 3.1.3)?

[Assistant]
According to Digital Identity Guidelines_ Authentication and Authenticator Management:

3.1.3. 3.1.3): A secret sent or received through a separate

communication channel with the subscriber

• Single-factor one-time password (OTP) (Sec. 3.1.3.

Digital Identity Guidelines_ Authentication and Authenticator Management


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Services Acquisition?

[Assistant]
According to Status Report on the Fourth Round of the NIST Post-Quantum Cryptography Standardization Process:

lation mechanism (KEM) selected for standardization was CRYSTALS-Kyber (ML-KEM [3]). The digital signatures selected were CRYSTALS-Dilithium (ML-DSA [4]), Falcon (FN-DSA), and SPHINCS + (SLH-DSA [5]).
For a detailed explanation of NIST's choices, as well as a summary of the third round, see NIST IR 8413 [2].

Status Report on the Fourth Round of the NIST Post-Quantum Cryptography Standardization Process


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AU.L2-3.3.5 (NIST 3.3.5)?

[Assistant]
According to Recommendations for Federal Vulnerability Disclosure Guidelines:

3.3.5. 3.3.5.

Recommendations for Federal Vulnerability Disclosure Guidelines


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Analyzing Collusion Threats in the Semiconductor Supply Chain provide? (Part 2)

[Assistant]
0

## Additional Information

Additional information about this publication is available at https://csrc.nist.gov/publications/cswp, including related content, potential updates, and document history.
All comments are subject to release under the Freedom of Information Act (FOIA). ## Abstract

This work proposes a framework for analyzing threats related to the semiconductor supply chain. The framework introduces a metric that quantifies the severity of different threats subjected to a collusion of adversaries from different stages of the supply chain. Two different case studies are provided to describe the real-life application of the framework. The metrics and analysis aim to guide security efforts and optimize the trade-offs of hardware security and costs. ## Keywords

collusion; security metrics; supply chain life cycle; supply chain security. ## Table of Contents

| 1. Introduction...................................................................................................................................1   |
|-------------------------------------------------------------------------------------------------------------------------------------------------------|
| 2. Stages of Semiconductor Supply Chain Stages.................................................................................3                      |
| 3. Framework for Supply Chain Threat Analysis...................................................................................5                     |
| 4. Case Study .....................................................................................................................................8  |
| 5.

Analyzing Collusion Threats in the Semiconductor Supply Chain


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Maintenance?

[Assistant]
According to Multi-Factor Authentication for Criminal Justice Information Systems_ Implementation Considerations for Protecting Criminal Justice Information:

Additional information about this publication is available at https://csrc.nist.gov/pubs/ir/8523/final, including related content, potential updates, and document history. State agencies that have already implemented MFA may decide to offer an MFA service to local agencies within their jurisdiction, as shown in Fig. 9. This model might be offered only to small or rural agencies who may lack the necessary funding and/or knowledge to implement MFA on their own, or the state might consider a shared service model where identity services are offered to all eligible and interested agencies within the state. Such an approach could result in economies of scale that could save costs for both state and local agencies and could also reduce the number of MFA architectures and implementations needed across the state. Establishing a state-shared service might also afford agencies greater ability to influence vendor capabilities and updates, including updates to support standards and best practices for MFA. - [1] U.S. Department of Justice (2024) Criminal Justice Information Services (CJIS) Security Policy, Version 6.0. CJISSECPOL v6.0. Available at https://le.fbi.gov/filerepository/cjis\_security\_policy\_v6-0\_20241227.pdf
- [2] Wisconsin Law Enforcement Network (2024) Public Safety Threat Report: 2024 Threat Landscape. https://wilenet.widoj.gov/sites/default/files/public\_files-2025-02/ijis2024-threat-landscape-report.pdf
- [3] Temoshok D, Proud-Madruga D, Choong YY, Galluzzo R, Gupta S, LaSalle C, Lefkovitz N, Regenscheid A (2025) Digital Identity Guidelines. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) 800-63-4. https://doi.org/10.6028/NIST.SP.800-63-4
- [4] Temoshok D, Fenton JL, Choong YY, Lefkovitz N, Regenscheid A, Galluzzo R, Richer JP (2025) Digital Identity Guidelines: Authentication and Authenticator Management.

Multi-Factor Authentication for Criminal Justice Information Systems_ Implementation Considerations for Protecting Criminal Justice Information


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Communications Protection?

[Assistant]
According to Guidelines on Mobile Device Forensics:

.................................................................... | LIST OFTABLES....................................................................................................................
| VIII                                                                                |
| EXECUTIVE SUMMARY........................................................................................................... | EXECUTIVE SUMMARY........................................................................................................... | 1                                                                                |
| 1. INTRODUCTION.................................................................................................................. | 1. INTRODUCTION.................................................................................................................. | 1                                                                                |
| 1.1                                                                                | PURPOSEAND SCOPE ......................................................................................................... | 1                                                                                |
| 1.2                                                                                | AUDIENCEAND ASSUMPTIONS ..........................................................................................


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice IA.L2-3.5.3 (NIST 3.5.3)?

[Assistant]
According to Guide to Auditing for Controls and Security_ A System Development Life Cycle Approach:

3.5.3                                                            | A Detailed Scoring Approach                                      | A Detailed Scoring Approach                                      | 60        |
|           | 3. 3.5.3                                                                                | Survey Questionnaire - Initiation Phase                                                     | 86   |

| 4. 3.5.3 A Detailed Scoring Approach

The more detailed approach looks in depth at the characteristics associated with each dimension.

Guide to Auditing for Controls and Security_ A System Development Life Cycle Approach


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Summary of NIST SP 800-53, Revision 4_ Security and Privacy Controls for Federal Information Systems and Organizations provide? (Part 6)

[Assistant]
following components: (i) a control section; (ii) a supplemental guidance section; (iii) a control enhancements section; (iv) a references section; and (v) a priority and baseline allocation section.
Figure 2: The Risk Management Framework

<!-- image -->

## 3 Control Baselines and Tailoring

To assist organizations in making the appropriate selection of security controls for information systems, the concept of security control baselines is introduced. Security control baselines are the starting point for the security control selection process and are chosen based on the security category and associated impact level of information systems determined in accordance with FIPS Publication 199 and FIPS Publication 200, respectively (Step One of the RMF). SP 800-53 Rev. 4 states that 'the security controls and control enhancements listed in the initial baselines are not a minimum- but rather a proposed starting point from which controls and controls enhancements may be removed or added.' Appendix D provides a listing of baseline security controls corresponding to the low-impact, moderate-impact, and high-impact information systems, using the high water mark defined in FIPS Publication 200. The security control baselines address the security needs of a broad and diverse set of constituencies, and are developed based on a number of general assumptions, including common environmental, operational, and functional considerations. The baselines also assume typical threats facing common information systems. Articulating the underlying assumptions is a key element in the initial risk framing step of the risk management process described in NIST SP 800-39. To ensure that an appropriate set of controls is identified to provide security commensurate with risk, organizations tailor the controls to align with specific security needs.

Summary of NIST SP 800-53, Revision 4_ Security and Privacy Controls for Federal Information Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Protecting Controlled Unclassified Information (CUI)_ NIST Special Publication 800-171, Revision 3. Small Business Primer provide? (Part 7)

[Assistant]
171A. |
| What products, vendors, or solutions are 'NIST SP 800 -171 compliant' or 'CMMC - certified'? | NIST does not identify or track implementation of or compliance with the security requirements.
|
| What is the relationship between NIST and CMMC? | The Cybersecurity Maturity Model Certification (CMMC) is a DOD program that references the security requirements in NIST SP 800-171 and SP 800-172. NIST is not involved in the design, development, or implementation of the CMMCmodel, accreditation body, or certification process. It is important to note that CMMCis currently based on SP 800-171, Revision 2. Contractors should check for specific requirements in their contracts to understand which version they are required to use. |

<!-- image -->

View more FAQs here. If you still have a question after reviewing all our FAQs , send your question to: sec-cert@nist.gov. ht ps:/

csrc.nist.gov/projects/protecting-control ed-unclas ified-information

<!-- image -->

<!-- image -->

## Additional Resources

## Online Introductory Courses Available for the NIST SP 800-53 Series

<!-- image -->

SP 800-171 requirements are focused on protecting confidentiality and are based on a subset of controls found in SP 800-53, which is a catalog of security and privacy controls for systems and organizations. With that in mind, it is important to have a basic understanding of the SP 800-53 series. To assist, NIST has released three self-guided online introductory courses to provide a high-level overview of foundational security and privacy risk management concepts. The online introductory courses are between 45-60 minutes, are available at no cost, and registration is not required. Access the courses. ## Roles of Different Federal Agencies

- The National Archives and Records Administration (NARA) , per 32 CFR Part 2002 "Controlled Unclassified Information," determines what CUI is and lists CUI types at archives.gov/cui.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Configuration Management?

[Assistant]
According to Workshop on Enhancing Security of Devices and Components Across the Supply Chain:

ives), there need to be different tiers of metrics based on the audience or user. For example, the CWE structure could be used to define security requirements that lead to associated security metrics.
Jason noted that CWEs for hardware are relatively new, starting around 2020, compared to CWEs' long track record for software, which started around 2006. Since CWEs point out common root cause weaknesses that lead to vulnerabilities, they foster a more proactive approach by allowing security issues to be discovered and mitigated earlier in the hardware development life cycle, thus lowering the financial impact. Having good metrics that can be used to inform design and business decisions would be helpful to the semiconductor community. Finally, Mark Tehranipoor from the University of Florida emphasized the importance of thinking about security and associated metrics in the early stages of the hardware development life cycle. Specifically, this involves conducting a security and risk assessment and developing a

Workshop on Enhancing Security of Devices and Components Across the Supply Chain


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Identification and Authentication?

[Assistant]
According to Audit and Evaluation of Computer Security II_ System Vulnerabilities and Controls:

Data administration is viewed as responsible for successful management and controls of data files and data bases necessary to support the information processing system. It is supported by data management systems and data base management systems. The control policies revolve around the three concepts of identification, authorization, and authentication and Include consideration of access policies, detection of unauthorized statistical disclosure, the maintaining of appropriate transaction trails, and the integrity of data and programs.

Top management should require a security check of individuals participating in the design, operation, and maintenance of its data processing systems. (See section 3.5.) It is appropriate to assign responsibility for screening to the agency personnel office.

Authentication is a measure designed to increase protection against fraudulent transmissions by establishing the validity of a transmission, message, station, or originator.

Audit and Evaluation of Computer Security II_ System Vulnerabilities and Controls


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for System and Communications Protection?

[Assistant]
According to Assessing Enhanced Security Requirements for Controlled Unclassified Information:

| CHAPTERONE INTRODUCTION...................................................................................................... | CHAPTERONE INTRODUCTION...................................................................................................... | 1   |
|-----------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------|-----|
| 1.1                                                                                | PURPOSEANDAPPLICABILITY............................................................................................................. 1        | 2   |
| 1.2                                                                                | TARGET AUDIENCE.............................................................................................................................. |     |
| 1.3                                                                                | ORGANIZATIONOF THIS SPECIAL PUBLICATION................................................................................. | 2   |
| CHAPTERTWO THE FUNDAMENTALS............................................................................................ | CHAPTERTWO THE FUNDAMENTALS............................................................................................ | 3   |
| 2.1                                                                                | ASSESSMENT PROCEDURES................................................................................................................

Assessing Enhanced Security Requirements for Controlled Unclassified Information


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Services Acquisition?

[Assistant]
According to Protecting Information and System Integrity in Industrial Control System Environments_ Cybersecurity for the Manufacturing Sector:

he State of Maryland and Montgomery County, Maryland. The Technology Partners/Collaborators who participated in this build submitted their capabilities in response to a notice in the Federal Register.
Respondents with relevant capabilities or product components were invited to sign a Cooperative Research and Development Agreement (CRADA) with NIST, allowing them to participate in a consortium to build this example solution. We worked with:

Protecting Information and System Integrity in Industrial Control System Environments_ Cybersecurity for the Manufacturing Sector


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Personnel Security?

[Assistant]
According to Security and Privacy Controls for Information Systems and Organizations:

............................................................. 16
3.1   ACCESS CONTROL ..................................................................................................................
18
3.2   AWARENESS AND TRAINING ................................................................................................... 59
3.3   AUDIT AND ACCOUNTABILITY ................................................................................................. 65
3.4   ASSESSMENT, AUTHORIZATION, AND MONITORING ................................................................. 83
3.5   CONFIGURATION MANAGEMENT ........................................................................................... 96
3.6   CONTINGENCY PLANNING .................................................................................................... 115
3.7   IDENTIFICATION AND AUTHENTICATION ............................................................................... 131
3.8   INCIDENT RESPONSE ............................................................................................................ 149
3.9   MAINTENANCE .................................................................................................................... 162
3.10   MEDIA PROTECTION .......................................................................................................... 171
3.11   PHYSICAL AND ENVIRONMENTAL PROTECTION .................................................................... 179
3.12   PLANNING ........................................................................................................................ 194
3.13   PROGRAM MANAGEMENT ................................................................................................. 203
3.14   PERSONNEL SECURITY ........................................................................................................ 222
3.15   PERSONALLY IDENTIFIABLE INFORMATION PROCESSING AND TRANSPARENCY .......................

Security and Privacy Controls for Information Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Cryptographic Module Validation Program (CMVP) Security Policy Requirements_ CMVP Validation Authority Updates to ISO_IEC 24759 and ISO_IEC 19790 Anne provide? (Part 3)

[Assistant]
l official. This publication may be used by nongovernmental organizations on a voluntary basis and is not subject to copyright in the United States. Attribution would, however, be appreciated by NIST.
## NIST Technical Series Policies

Copyright, Use, and Licensing Statements NIST Technical Series Publication Identifier Syntax

## Publication History

Approved by the NIST Editorial Review Board on 2023-11-13

## How to Cite this NIST Technical Series Publication:

Hawes D, Calis A, Crombie R (2023) Cryptographic Module Validation Program (CMVP) Security Policy Requirements: CMVP Validation Authority Updates to ISO/IEC 24759 and ISO/IEC 19790 Annex B. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) NIST SP 800-140Br1. https://doi.org/10.6028/NIST.SP.800-140Br1

## Author ORCID iDs

David Hawes: 0000-0002-0173-6795 Alexander Calis: 0000-0003-1937-8129

## Contact Information

sp800-140-comments@nist.gov

National Institute of Standards and Technology Attn: Computer Security Division, Information Technology Laboratory 100 Bureau Drive (Mail Stop 8930) Gaithersburg, MD 20899-8930

All comments are subject to release under the Freedom of Information Act (FOIA). ## Abstract

NIST Special Publication (SP) 800-140Br1 is to be used in conjunction with ISO/IEC 19790 Annex B and ISO/IEC 24759 Section 6.14. This Special Publication modifies only those requirements identified in this document. NIST SP 800-140Br1 also specifies the content of the information required in ISO/IEC 19790 Annex B. As a validation authority, the Cryptographic Module Validation Program (CMVP) may modify, add, or delete Vendor Evidence (VE) and/or Test Evidence (TE) specified under paragraph 6.14 of the ISO/IEC 24759 and specify the order of the security policy as stated in ISO/IEC 19790:2012 B.1.

Cryptographic Module Validation Program (CMVP) Security Policy Requirements_ CMVP Validation Authority Updates to ISO_IEC 24759 and ISO_IEC 19790 Anne


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Access Control on NoSQL Databases provide? (Part 10)

[Assistant]
the late 2000s, triggered by the growing popularity of distributed systems, such as cloud computing and big data, which required a shift away from relational databases (RDBMS) toward NoSQL databases.
Organizations now deal with enormous and constantly growing data and infrastructure needs or increasingly use the Web 3.0 framework for big data and real-time web applications, including handling unstructured data like documents, emails, and social media [AA, NO]. NoSQL databases are particularly useful for managing unstructured or very large data objects stored across distributed and cooperating devices. Use cases for retrieving such data range from critical scenarios (e.g., storing financial data and healthcare records) to more casual applications (e.g., chat log data, video, images, and readings from smart devices). Major Web (Cassandra) have developed or adopted different flavors of NoSQL databases to meet their growing data and infrastructure needs. Their success has inspired many of today's NoSQL applications [AA, CJ]. NoSQL database systems and data stores often outperform traditional RDBMS in various aspects, such as data analysis efficiency, system performance, ease of deployment, flexibility/scalability of data management, and users' availability. However, with an increasing number of people storing sensitive data in NoSQL databases, security issues have become critical concerns. NoSQL databases suffer from vulnerabilities, particularly due to the lack of effective support for data protection, including weak authorization mechanisms. As access control is a fundamental data protection requirement of any database management system the NoSQL database types along with their support for access control models and describing store and manage access control data (e.g., subjects, objects, actions, and attributes) in external systems rather than the NoSQL database itself, which has a wide range of different implementations not discussed in this document.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Federal Cybersecurity Awareness Programs_ A Mixed Methods Research Study provide? (Part 3)

[Assistant]
programs  may  face  a  number  of challenges, including lack of: leadership support; resources; and staff with sufficient background and  skills  to  implement  an  effective  and  engaging  program.
However,  no  prior  research  has explored security awareness programs specifically in the United States (U.S.) government (federal) sector. To  address  this  gap,  NIST  conducted  a  two-phase,  mixed  methods  research  study  to understand the needs, challenges, and practices of federal security awareness programs. This report describes  the  research  background  and  methodology,  along  with  the  characteristics  of  the participants, organizations, and programs represented in the study. Research results can serve as a resource  for  federal  security  awareness  professionals,  managers,  and  organizational  decision makers to improve and advocate for their organizations' security awareness programs. Results can also inform the development of federal security awareness guidance, policies, sharing forums, and initiatives  meant  to  aid  programs  in  becoming  more  effective. While  focused  on  the  U.S. government, findings may also have implications for organizational security awareness programs in other sectors. ## Keywords

cybersecurity; cybersecurity awareness; focus groups; mixed methods; security professionals; survey; training; usable cybersecurity

\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

## Table of Contents

|                                                                                | INTRODUCTION.................................................................................................................

Federal Cybersecurity Awareness Programs_ A Mixed Methods Research Study


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Services Acquisition?

[Assistant]
According to Recommendation for Pair-Wise Key-Establishment Schemes Using Discrete Logarithm Cryptography:

There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may  be  used  by  federal  agencies  even  before  the  completion  of  such  companion  publications.  Thus,  until  each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning  and  transition  purposes,  federal  agencies  may  wish  to  closely  follow  the  development  of  these  new publications by NIST.

The  Information  Technology  Laboratory  (ITL)  at  the  National  Institute  of  Standards  and  Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the Nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology. ITL's responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national securityrelated information in Federal information systems. The Special Publication 800-series reports on ITL's research, guidelines, and outreach efforts in information system security, and its collaborative activities with industry, government, and academic organizations.

Recommendation for Pair-Wise Key-Establishment Schemes Using Discrete Logarithm Cryptography


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What guidance does Automated Secure Configuration Guidance from the macOS Security Compliance Project (mSCP) provide?

[Assistant]
<!-- image -->

## NIST Special Publication NIST SP 800-219r1

## Automated Secure Configuration Guidance from the macOS Security Compliance Project (mSCP)

Mark Trapnell

Eric Trapnell

Murugiah Souppaya

Bob Gendler

Dan Brodjieski

Allen Golbig

Karen Scarfone

Blair Heiserman

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-219r1

<!-- image -->

## NIST Special Publication NIST SP 800-219r1

## Automated Secure Configuration Guidance from the macOS Security Compliance Project (mSCP)

Mark Trapnell Eric Trapnell Murugiah Souppaya Computer Security Division Information Technology Laboratory

## Bob Gendler

Customer Access and Support Division Office of Information Systems Management

Dan Brodjieski

NASA

Allen Golbig

Jamf

Karen Scarfone

Scarfone Cybersecurity

Blair Heiserman

Information Technology Security & Networking Division Office of Information Systems Management

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-219r1

July 2023

<!-- image -->

U.S. Department of Commerce Gina M. Raimondo, Secretary

Certain commercial equipment, instruments, software, or materials, commercial or non-commercial, are identified in this paper in order to specify the experimental procedure adequately. Such identification does not imply recommendation or endorsement of any product or service by NIST, nor does it imply that the materials or equipment identified are necessarily the best available for the purpose. There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may be used by federal agencies even before the completion of such companion publications. Thus, until each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative.

Automated Secure Configuration Guidance from the macOS Security Compliance Project (mSCP)


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Configuration Management?

[Assistant]
According to Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule_ A Cybersecurity Resource Guide:

.......................................................................75                                                                                |
| 5.4.1.
Business Associate Contracts or Other Arrangements (§ 164.314(a)).......................................77                                                                                |
| 5.4.2. Requirements for Group Health Plans (§ 164.314(b))................................................................79                                                                                |
| 5.5.1. Policies and Procedures (§ 164.316(a))......................................................................................81                                                                                |
| 5.5.2. Documentation (§ 164.316(b))...................................................................................................83                                                                                |
| References.......................................................................................................................................85                                                                                |
| Appendix A. List of Symbols, Abbreviations, and Acronyms...............................................................87                                                                                |
| Appendix B. Glossary .......................................................................................................................91                                                                                |
| Appendix C.

Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule_ A Cybersecurity Resource Guide


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Configuration Management?

[Assistant]
According to Multi-Factor Authentication for Criminal Justice Information Systems_ Implementation Considerations for Protecting Criminal Justice Information:

...........13                       |
| 3.2.1. MFA Users ..................................................................................................................................13 |
| 3.2.2.
IT Support Staff...........................................................................................................................14  |
| 3.2.3. Other Agencies ...........................................................................................................................14   |
| 3.2.4. Procurement Teams...................................................................................................................14         |
| 3.2.5. Compliance Teams .....................................................................................................................15       |
| 3.2.6. Legal Teams................................................................................................................................15  |
| 3.2.7. Technology Vendors...................................................................................................................15        |
| 3.4.1. Local Agency MFA Architectures................................................................................................17               |
| 3.4.2. State MFA Deployments.............................................................................................................21           |
| 3.4.3. Implementing MFA with VPNs ...................................................................................................25               |
| 4. Key Takeaways.............................................................................................................................29       |
| References.......................................................................................................................................31   |
| Appendix A.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for Maintenance?

[Assistant]
According to Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171:

............................................ 5                        |
| 2.1 DEVELOPMENTAPPROACH ......................................................................................................
| 5                                                                                |
| 2.2 ORGANIZATIONANDSTRUCTURE                                                                                | ............................................................................................. 7                                                  |
| 2.3 FLEXIBLE APPLICATION                                                                                | ............................................................................................................. 9                                  |
| CHAPTER THREE THE REQUIREMENTS......................................................................................... 11                       | CHAPTER THREE THE REQUIREMENTS......................................................................................... 11                       |
| 3.1 ACCESSCONTROL                                                                                | .................................................................................................................. 12                            |
| 3.2 AWARENESSANDTRAINING                                                                                | ...................................................................................................

Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Information Integrity?

[Assistant]
According to Data Integrity_ Detecting and Responding to Ransomware and Other Destructive Events:

## Data Integrity:

This publication is available free of charge from https://www.nccoe.nist.gov/projects/building-blocks/data-integrity/detect-respond.

## Data Integrity: Detecting and Responding to Ransomware and Other Destructive Events

Data Integrity_ Detecting and Responding to Ransomware and Other Destructive Events


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for Security Assessment?

[Assistant]
According to Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171:

Advanced Persistent Threat; Basic Security Requirement; Contractor Systems; Controlled Unclassified Information; CUI Registry; Derived Security Requirement; Enhanced Security Requirement; Executive Order 13556; FIPS Publication 199; FIPS Publication 200; FISMA; NIST Special Publication 800-53; Nonfederal Organizations; Nonfederal Systems; Security Assessment; Security Control; Security Requirement. | CHAPTERONE INTRODUCTION...................................................................................................... | CHAPTERONE INTRODUCTION...................................................................................................... |
|--------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------|
| 1.1 PURPOSEANDAPPLICABILITY                                                                                | ................................................................................................... 3                                            |
| 1.2 TARGET AUDIENCE                                                                                | .................................................................................................................. 4                             |
| 1.3 ORGANIZATIONOF THIS SPECIAL PUBLICATION                                                                                | .......................................................................... 4                                                                     |
| CHAPTERTWO THE FUNDAMENTALS............................................................................................


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Digital Identity Guidelines provide? (Part 4)

[Assistant]
e guidelines cover the identity proofing, authentication, and federation of users
(e.g., employees, contractors, or private individuals) who interact with government
information systems over networks.
They define technical requirements in each of
the areas of identity proofing, enrollment, authenticators, management processes,
authentication protocols, federation, and related assertions. They also offer technical
recommendations and other informative text as helpful suggestions. The guidelines are
not intended to constrain the development or use of standards outside of this purpose. This publication supersedes NIST Special Publication (SP) 800-63-3. Keywords

assertions; authentication; authentication assurance; authenticator; credential service
provider; digital authentication; identity proofing; federation; passwords; PKI. Reports on Computer Systems Technology

The Information Technology Laboratory (ITL) at the National Institute of Standards and
Technology (NIST) promotes the U.S. economy and public welfare by providing technical
leadership for the Nation’s measurement and standards infrastructure. ITL develops
tests, test methods, reference data, proof of concept implementations, and technical
analyses to advance the development and productive use of information technology. ITL’s responsibilities include the development of management, administrative, technical,
and physical standards and guidelines for the cost-effective security and privacy of other
than national security-related information in federal information systems. The Special
Publication 800-series reports on ITL’s research, guidelines, and outreach efforts in
information system security, and its collaborative activities with industry, government,
and academic organizations.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Assessing Security and Privacy Controls in Information Systems and Organizations provide? (Part 9)

[Assistant]
privacy” is universally used since the
guidance is applicable to both security and privacy control assessments. For certain systems,
however, the guidance may only be relevant for security or privacy.
Organizations make their
own determinations on when to manage security and privacy control assessments together or
separately. SP 800-53A provides guidance on assessing controls in information security program plans,
privacy program plans, system security plans, and privacy plans. Where the guidance refers to all
plans listed above, the term “security and privacy plans” is used. If the guidance is specific to a
single type of plan (e.g., system security plan), the specific type of plan is specified. Supplemental Content

The assessment procedures in Chapter 4 are published in multiple data formats, including
comma-separated values (CSV), plain text, and Open Security Controls Assessment (OSCAL). The
available data formats are accessible from the NIST SP 800-53A Revision 5, publication details
page at https://csrc.nist.gov/publications/detail/sp/800-53a/rev-5/final. The OSCAL Content Git
Repository is available at https://github.com/usnistgov/oscal-content. The CSV, plain text, and OSCAL formats represent derivative formats of the (normative)
assessment procedures in this publication. If there are any discrepancies between the content in
derivative formats and this publication, please contact sec-cert@nist.gov. Patent Disclosure Notice

NOTICE: The Information Technology Laboratory (ITL) has requested that holders of patent
claims whose use may be required for compliance with the guidance or requirements of this
publication disclose such patent claims to ITL. However, holders of patents are not obligated to
respond to ITL calls for patents and ITL has not undertaken a patent search in order to identify
which, if any, patents may apply to this publication.

Assessing Security and Privacy Controls in Information Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AC.L2-3.1.2 (NIST 3.1.2)?

[Assistant]
According to The Federal Cybersecurity Awareness Workforce_ Professional Backgrounds, Knowledge, Skills, and Development Activities:

3.1.2 Years of Security Awareness Experience... 3.1.2 Years of Security Awareness Experience... 3.1.2 Years of Security Awareness Experience...

The Federal Cybersecurity Awareness Workforce_ Professional Backgrounds, Knowledge, Skills, and Development Activities


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Incident Response?

[Assistant]
According to Security and Privacy Controls for Information Systems and Organizations:

CHAPTER ONE   INTRODUCTION ...................................................................................................... 1
1.1   PURPOSE AND APPLICABILITY ................................................................................................... 2
1.2   TARGET AUDIENCE .................................................................................................................. 3
1.3   ORGANIZATIONAL RESPONSIBILITIES......................................................................................... 3
1.4   RELATIONSHIP TO OTHER PUBLICATIONS ................................................................................... 5
1.5   REVISIONS AND EXTENSIONS .................................................................................................... 5
1.6   PUBLICATION ORGANIZATION .................................................................................................. 5
CHAPTER TWO   THE FUNDAMENTALS ............................................................................................ 7
2.1   REQUIREMENTS AND CONTROLS .............................................................................................. 7
2.2   CONTROL STRUCTURE AND ORGANIZATION .............................................................................. 8
2.3   CONTROL IMPLEMENTATION APPROACHES ............................................................................. 11
2.4   SECURITY AND PRIVACY CONTROLS ......................................................................................... 13
2.5   TRUSTWORTHINESS AND ASSURANCE ..................................................................................... 14
CHAPTER THREE   THE CONTROLS ................................................................................................. 16
3.1   ACCESS CONTROL ..................................................................................................................


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Planning?

[Assistant]
According to Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations:

There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may be used by federal agencies even before the completion of such companion publications. Thus, until each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning and transition purposes, federal agencies may wish to closely follow the development of these new publications by NIST. | 3.4.3. Enhancing Practices....................................................................................................................49      |                                                                                |
|-------------------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------|
| 3.5.1. Measuring C-SCRM Through Performance Measures................................................................52                                |                                                                                |
| References.........................................................................................................................................57 |                                                                                |
| Appendix A. C-SCRM Security Controls............................................................................................... | 63                                                                                |
| A.1.1.

Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Awareness and Training?

[Assistant]
According to Workshop on Enhancing Security of Devices and Components Across the Supply Chain:

...............................11  |
| 2.5.1. Speaker Viewpoints....................................................................................................................11        |
| 2.5.2.
Key Highlights .............................................................................................................................13  |
| 3. Summary and Road Ahead ...........................................................................................................15                |
| Appendix A. Workshop Agenda........................................................................................................16                  |
| List of Figures                                                                                |
| Fig. 1. Components for securing microelectronics................................................................................1                      |
| Fig. 2. Distribution of workshop participants.......................................................................................2                  |


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Protecting Controlled Unclassified Information (CUI)_ NIST Special Publication 800-171, Revision 3. Small Business Primer provide? (Part 10)

[Assistant]
and specificity needed by organizations to clearly define their CUI security requirements, given the diverse nature of their missions, business functions, operational environments, and risk tolerance.
ODPs support consistent security assessments in determining whether security requirements have been satisfied. If a federal agency or a consortium of agencies do not specify a particular value or range of values for an ODP, nonfederal organizations must assign the value or values to complete the security requirement. Tailoring: The process by which control baselines are modified to achieve certain organizational goals and objectives. Definitions provided are intended as plain language. Review the NIST Glossary for official NIST definitions. Determine if your business has CUI. ## General Tips for Getting Started with NIST SP 800-171

Everyone will have different approaches to getting started, but here are a few tips to get you started down the right path:

Understand current (or future) legal, regulatory, or contractual requirements for protecting CUI. The federal agency is responsible for communicating what CUI the business is responsible for protecting as part of the contractual arrangement. If there are questions, reach out to the contracting officer. The business may also have additional compliance requirements beyond SP 800-171. If so, an initial task might be to understand where the requirements overlap and where they differ. With that information, the business can begin addressing requirements that meet multiple compliance requirements. Understand how CUI flows into, within, and out of the business. <!-- image -->

Inventorying what systems or components the business has, and how the data flows into, within, and out of those systems or components, helps practitioners understand the scope of applicability of SP 800-171 security requirements to business systems. <!-- image -->

Scope and Applicability of SP 800-171.

Protecting Controlled Unclassified Information (CUI)_ NIST Special Publication 800-171, Revision 3. Small Business Primer


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Maintenance?

[Assistant]
According to Proceedings of the Cybersecurity in Cyber-Physical Systems Workshop, April 23-24, 2012:

Dr. Arnold previously served as a Vice-President at Lucent Technologies Bell Laboratories where he directed the company's global standards efforts. His organization played a leading role in the development of international standards for Intelligent Networks and IP-based Next Generation Networks. In previous assignments at AT&T Bell Laboratories he had responsibilities in network planning, systems engineering, and application of information technology to automate operations and maintenance of the nationwide telecommunications network. Deployment rates for implantable medical devices (IMDs) have skyrocketed over the past decade. Devices such as pacemakers,  cardiac  defibrillators,  heart  monitors,  cochlear  implants, insulin pumps, infusion pumps and other similar devices are  routinely  used  to  monitor  and  treat  a  plethora  of  medical conditions. These  IMDs  have  been  increasingly  accessible through  wireless  channels  to  support  functions  such  as  emergency extraction of patient health history, remote monitoring of health  status,  firmware  updates  and  local  as  well  as  remote therapy  reprogramming. As  with  all  things  connected  to  the cyber world, there are known and unknown threats lurking that threaten the reliability and safety of these devices as well the privacy of patients who depends on them. Audit  logs  are  essential  for  tracking  patient  history  and IMD behavior over a period of time. The audit records provide information needed for adequate patient care as well as updates to patient therapy delivered through the IMD. Given the limited storage capabilities of IMDs, it is possible to overflow the audit logs  through  certain  types  of  attacks  on  the  IMD. Creative techniques for selective overwriting of audit records based on significance of each type of audit record may be useful.

Proceedings of the Cybersecurity in Cyber-Physical Systems Workshop, April 23-24, 2012


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Access Control?

[Assistant]
According to Guidelines for Media Sanitization:

..................................13  |
| 3.2.4. Quality of Cryptographic Implementations................................................................................15                   |
| 3.2.5.
Traceability of CE Operations.....................................................................................................16         |
| Media Sanitization Program .........................................................................................................18              |
| 4. |
| 4.3.1. Information Decisions in the System Life Cycle..........................................................................20                   |
| 4.3.2. Determination of Security Categorization..................................................................................21                 |
| 4.3.3. Reuse of Media...........................................................................................................................22  |
| 4.3.4. Control of Media ........................................................................................................................22  |
| 4.3.5. Data Protection Level .................................................................................................................23    |
| 4.3.6. Sanitization and Disposal Decision.............................................................................................23            |


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Awareness and Training?

[Assistant]
According to Risk Management Framework for Information Systems and Organizations_ A System Life Cycle Approach for Security and Privacy:

- '…The executive branch operates its information technology (IT) on behalf of the American people. Its IT and data should be secured responsibly using all United States Government capabilities...'
- '…Cybersecurity risk management comprises the full range of activities undertaken to protect IT and data from unauthorized access and other cyber threats, to maintain awareness of cyber threats, to detect anomalies and incidents adversely affecting IT and data, and to mitigate the impact of, respond to, and recover from incidents…'

The RMF emphasizes risk management by promoting the development of security and privacy capabilities into information systems throughout the system development life cycle (SDLC); 10 by maintaining situational awareness of the security and privacy posture of those systems on an ongoing basis through continuous monitoring processes; and by providing information to senior leaders and executives to facilitate decisions regarding the acceptance of risk to organizational operations and assets, individuals, other organizations, and the Nation arising from the use and operation of their systems. The RMF:

- Chapter Two describes the concepts associated with managing information system-related security and privacy risk. This includes an organization-wide view of risk management; the RMF steps and task structure; the relationship between information security and privacy programs and how these programs are addressed in the RMF; information resources as system and system elements; authorization boundaries; security and privacy posture; and security and privacy considerations related to supply chain risk management.

Risk Management Framework for Information Systems and Organizations_ A System Life Cycle Approach for Security and Privacy