[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Secure Software Development Practices for Generative AI and Dual-Use Foundation Models_ An SSDF Community Profile provide? (Part 2)

[Assistant]
ral agencies even before the completion of such companion publications. Thus, until each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative.
For planning and transition purposes, federal agencies may wish to closely follow the development of these new publications by NIST. Organizations are encouraged to review all draft publications during public comment periods and provide feedback to NIST. Many NIST cybersecurity publications, other than the ones noted above, are available at https://csrc.nist.gov/publications. ## Authority

This publication has been developed by NIST in accordance with its statutory responsibilities under the Federal Information Security Modernization Act (FISMA) of 2014, 44 U.S.C. § 3551 et seq., Public Law (P.L.) 113-283. NIST is responsible for developing information security standards and guidelines, including minimum requirements for federal information systems, but such standards and guidelines shall not apply to national security systems without the express approval of appropriate federal officials exercising policy authority over such systems. This guideline is consistent with the requirements of the Office of Management and Budget (OMB) Circular A-130. Nothing in this publication should be taken to contradict the standards and guidelines made mandatory and binding on federal agencies by the Secretary of Commerce under statutory authority. Nor should these guidelines be interpreted as altering or superseding the existing authorities of the Secretary of Commerce, Director of the OMB, or any other federal official. This publication may be used by nongovernmental organizations on a voluntary basis and is not subject to copyright in the United States. Attribution would, however, be appreciated by NIST.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for Security Assessment?

[Assistant]
According to Protecting Controlled Unclassified Information (CUI)_ NIST Special Publication 800-171, Revision 3. Small Business Primer:

| Access Control                    | Maintenance         | Security Assessment and Monitoring   |
|-----------------------------------|---------------------|--------------------------------------|
| Awareness and Training            | Media Protection    | System and Communications Protection |
| Audit and Accountability          | Personnel Security  | System and Information Integrity     |
| Configuration Management          | Physical Protection | Planning                             |
| Identification and Authentication | Risk Assessment     | System and Services Acquisition      |
| Incident Response                 |                     | Supply Chain Risk Management         |

Below is an example of the Incident Response Testing requirement, which is part of the Incident Response (IR) family. The structure and content of a typical security requirement includes:

ODPs support consistent security assessments in determining whether security requirements have been satisfied. If a federal agency or a consortium of agencies do not specify a particular value or range of values for an ODP, nonfederal organizations must assign the value or values to complete the security requirement.

Protecting Controlled Unclassified Information (CUI)_ NIST Special Publication 800-171, Revision 3. Small Business Primer


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Media Protection?

[Assistant]
According to Summary of NIST SP 800-53, Revision 4_ Security and Privacy Controls for Federal Information Systems and Organizations:

The NIST Risk Management Framework (RMF), described in NIST Special Publication 800-37 Revision 1, Guide for Applying the Risk Management Framework to Federal Information Systems: a Security Life Cycle Approach, is a methodology for implementing risk management at the information systems tier. The RMF (depicted in Figure 2) identifies six distinct steps that provide a disciplined and structured process to integrate information security risk management activities into the system development life cycle. The RMF addresses security concerns of organizations related to the design, development, implementation, operation, and disposal of information systems and the environments in which those systems operate.

Summary of NIST SP 800-53, Revision 4_ Security and Privacy Controls for Federal Information Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Analyzing Collusion Threats in the Semiconductor Supply Chain provide? (Part 9)

[Assistant]
facturer may have detailed design knowledge, while an end user typically has limited access and little insight into a system's internal functions. As a result, their capabilities differ significantly.
Thus, collusion between adversaries from different stages of the life cycle can make threats considerably more severe, which is why this stage is crucial in the context of security analysis. At this point in the analysis, we apply a linear scale to determine the severity of threats when adversaries from different stages of the supply chain collude. This scale ranges from 0 to 10 and represents the relative threat level of a group of colluding adversaries. Fig. 3 is an example of the scale developed in the context of the threat of hardware trojan insertion. The scale begins at 10, representing the highest threat severity level. This scenario assumes that all relevant adversaries are collaborating. From this point, we progressively remove one adversary at a time from the collusion and assess the resulting threat severity for each possible combination of remaining adversaries. As adversaries are removed, the threat severity decreases, depending on the number of adversaries and their specific roles. For instance, as shown in Fig. 3, if the manufacturer is removed from the collusion, the threat severity level drops to 8. However, if the designer is removed, the threat severity level decreases to 6. This suggests that a malicious designer poses a higher risk of hardware Trojan insertion compared to a malicious manufacturer. Fig. 3. Threat severity levels for colluding adversaries in the context of hardware Trojan insertion

<!-- image -->

This scale is relative, meaning it provides a context on the severity of the threat posed by different adversaries in a collusion but does not quantify the exact difference in severity. For example, Fig.

Analyzing Collusion Threats in the Semiconductor Supply Chain

Audit and Accountability
System and Information Integrity
Security Assessment
Media Protection
Identification and Authentication
Awareness and Training
System and Communications Protection
Access Control
Planning
Incident Response
Risk Assessment
Personnel Security
System and Services Acquisition
Supply Chain Risk Management
Maintenance
Physical Protection
Configuration Management


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AU.L2-3.3.3 (NIST 3.3.3)?

[Assistant]
According to The Federal Cybersecurity Awareness Workforce_ Professional Backgrounds, Knowledge, Skills, and Development Activities:

3.3.3 Industry-recognized Certifications

## Focus Groups

In an open-ended question, participants were asked what, if any, industry-recognized certifications they held (Figure 16). 3.3.3).

The Federal Cybersecurity Awareness Workforce_ Professional Backgrounds, Knowledge, Skills, and Development Activities


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Ascon-Based Lightweight Cryptography Standards for Constrained Devices_ Authenticated Encryption, Hash, and Extendable Output Functions provide? (Part 4)

[Assistant]
Internet of Things (IoT) devices, embedded systems, and low-power sensors. The family is developed to offer a viable alternative when the Advanced Encryption Standard (AES) may not perform optimally.
This standard outlines the technical specifications and security properties of Ascon-AEAD128 , Ascon-Hash256 , Ascon-XOF128 , and Ascon-CXOF128 . ## Keywords

Ascon; authenticated encryption; constrained devices; eXtendable Output Function (XOF); hash function; lightweight cryptography; permutation-based cryptography; standardization. ## Reports on Computer Systems Technology

The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the Nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology. ITL's responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national securityrelated information in federal information systems. The Special Publication 800-series reports on ITL's research, guidelines, and outreach efforts in information system security, and its collaborative activities with industry, government, and academic organizations. ## Patent Disclosure Notice

NOTICE: ITL has requested that holders of patent claims whose use may be required for compliance with the guidance or requirements of this publication disclose such patent claims to ITL. However, holders of patents are not obligated to respond to ITL calls for patents and ITL has not undertaken a patent search in order to identify which, if any, patents may apply to this publication.

Ascon-Based Lightweight Cryptography Standards for Constrained Devices_ Authenticated Encryption, Hash, and Extendable Output Functions


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AC.L2-3.1.1 (NIST 3.1.1)?

[Assistant]
According to Guidelines for Media Sanitization:

3.1.1. 3.1.1), purge (see Sec. 3.1.1.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Incident Response?

[Assistant]
According to Strategies for the Integration of Software Supply Chain Security in DevSecOps CI_CD Pipelines:

External attackers may include foreign adversaries, criminal organizations, and cyber-activists who target an SSC for various reasons, such as espionage or sabotage. Internal attackers pose a significant risk, as they may have insider access to sensitive information - often using legitimate access rights - that allow them to launch attacks or steal confidential information. Additionally, both categories of threat actors may use a variety of techniques to compromise the SDLC environment and steal or manipulate software, such as phishing, malware, social engineering, and physical access. Therefore, companies should be aware of these risks and take appropriate measures (see Sec. 3.2) to secure their SSC.

- Malware
- Code reuse or the ingest of libraries and dependencies
- Social engineering
- Network-based attacks
- Physical attacks

Attack vectors can originate from various sources, including malware attacks on developer workstations, social engineering attacks on developers, network-based attacks on the development environment, and physical attacks on the hardware or networks used by developers. These different attack vectors require distinct countermeasures, including endpoint protection software, network security controls, access control policies, and physical security measures. Companies should identify potential risks and vulnerabilities, assess their security posture, and implement appropriate defensive measures to mitigate threats to their SDLC environment.

Strategies for the Integration of Software Supply Chain Security in DevSecOps CI_CD Pipelines


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 1 require for Security Assessment?

[Assistant]
According to IoT Non-Technical Supporting Capability Core Baseline:

| 1. Document assumptions made during the development process and other expectations related to the IoT device, such as: a. Expected customers and use cases b. Physical use and characteristics c. Network access and requirements (e.g., bandwidth requirements) d. Data created and handled by the device e. Expected data inputs and outputs (including error codes, frequency, type/form, range of acceptable values, etc.) f. Assumed cybersecurity requirements for the IoT device g. Laws and regulations with which the IoT device and related support activities comply h. Expected lifespan, anticipated cybersecurity costs related to the IoT device (e.g., price of maintenance), and term of support 2. Document the device cybersecurity capabilities , such as those detailed within NISTIR 8259A, that are implemented within the IoT device and how to configure and use them. 3. Document device design and support considerations related to the IoT device, such as: 4 a. IoT platform 5 used in the development and operation of the IoT device and related documentation b. Protection of software and hardware components of the IoT device (e.g., secure boot, hardware root of trust, and secure enclave) c. Consideration of the known risks related to the IoT device and known potential misuses d. Secure software development and supply chain practices used e. Accreditation, certification, and/or evaluation results for cybersecurity-related practices | • This capability supports Information Dissemination and Education and Awareness. • Manufacturers and/or supporting entities should consider documentation throughout their development lifecycle in order to capture cybersecurity-relevant information when it is available so as to ensure access to this information when it is needed. Documentation will begin as internal resources for a manufacturer and/or supporting entity that can be used in various ways.

IoT Non-Technical Supporting Capability Core Baseline


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Services Acquisition?

[Assistant]
According to Guide to Malware Incident Prevention and Handling for Desktops and Laptops:

Tim Grance and Murugiah Souppaya of NIST and Lucinda Gagliano, Thomas Goff, and Pius Uzamere of Booz Allen Hamilton for their keen and insightful assistance throughout the development of the document.
The authors would also like to express their thanks to security experts Mike Danseglio (Microsoft), Kurt Dillard (Microsoft), Michael Gerdes (Getronics RedSiren Security Solutions), Peter Szor (Symantec), Miles Tracy (U.S. Federal Reserve System), and Lenny Zeltser (Gemini Systems LLC), as well as representatives from the General Accounting Office, and for their particularly valuable comments and suggestions.

Guide to Malware Incident Prevention and Handling for Desktops and Laptops


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Information Integrity?

[Assistant]
According to Ascon-Based Lightweight Cryptography Standards for Constrained Devices_ Authenticated Encryption, Hash, and Extendable Output Functions:

| Table 1. Acronyms . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . |   3 |
|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-----|
| Table 2. Terms and definitions........................................................... |   3 |
| Table 3. Notations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . |   5 |
| Table 4. Basic operations and functions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . |   6 |
| Table 5. The constants const 𝑖 to derive round constants of the Ascon permutations. |   9 |
| Table 6. Lookup table representation of SBOX . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . |  10 |
| Table 7. Security strength of Ascon-AEAD128 with 𝜆 -bit tag in the 𝑢 -key setting, where ( 𝑁 , 𝐴 ) pairs are distinct for encryption per key . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . |  21 |
| Table 8. Integrity security strength of Ascon-AEAD128 with 𝑢 keys in the nonce- misuse setting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . |  22 |
| Table 9. Security strengths of Ascon-Hash256 , Ascon-XOF128 , and Ascon-CXOF128 algorithms . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . |  31 |
| Table 10. Address for each byte of Ascon state word 𝑆 𝑖 in memory on little-endian and big-endian machines, where the word 𝑆 𝑖 begins at memory address 𝑎 . . . . . . . . . . |  36 |
| Table 11.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for System and Services Acquisition?

[Assistant]
According to Protecting Controlled Unclassified Information (CUI)_ NIST Special Publication 800-171, Revision 3. Small Business Primer:

|                      | When provided as part of a government contract, examples include:                                                                                | Marking 1     |
|----------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------|
| Controlled           | e.g., research and engineering data, engineering drawings, specifications, process sheets, manuals, technical reports, technical orders, catalog-item identifications, data sets, studies and analyses and related information, and computer software executable code and source code. | CUI//SP-CTI   |
| General Proprietary  | e.g., financial information, trade secrets, product research and development, existing and future product designs and performance specifications.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AT.L2-3.2.7 (NIST 3.2.7)?

[Assistant]
According to Multi-Factor Authentication for Criminal Justice Information Systems_ Implementation Considerations for Protecting Criminal Justice Information:

3.2.7. 3.2.7.

Multi-Factor Authentication for Criminal Justice Information Systems_ Implementation Considerations for Protecting Criminal Justice Information


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Configuration Management?

[Assistant]
According to Guide to Enterprise Patch Management Planning_ Preventive Maintenance for Technology:

ributing and installing a patch, purchasing cybersecurity insurance, deploying additional security controls, and changing asset configurations and state (e.g., software reset,

- Distribute the patch.
Distributing the patch to the assets that need to have it installed can be organization-controlled (and occur automatically, manually, or as scheduled) or vendor-controlled, such as delivered from the cloud. - Validate the patch. As discussed in Section 2.3.1, a patch's authenticity and integrity should be confirmed before installation, preferably through automated means. - Install the patch. Installation can occur in numerous ways, including automatically; manually when directed to do so by a user, administrator, vendor, or tool; as a result of other software being installed or updated; and through the replacement of removable media used by an asset. Some installations require administrator privileges, such as installing firmware patches for a system basic input/output system (BIOS). 3 Some patch installations require user participation or cooperation. - Change software configuration and state. In some cases, making a patch take effect necessitates implementing changes. Examples include restarting patched software, rebooting the operating system or platform on which the patched software runs, redeploying the applications, or altering software configuration settings. In other cases, no such changes are needed. - Resolve any issues. Installing a patch may cause side effects to occur, like inadvertently altering existing security configuration settings or adding new settings, and these side effects can inadvertently create a new security problem while fixing the original one. Patch installation can also cause operational issues that may necessitate uninstalling the patch, reverting to the previous version of the software, or restoring the software or asset from backups.

Guide to Enterprise Patch Management Planning_ Preventive Maintenance for Technology


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AT.L2-3.2.2 (NIST 3.2.2)?

[Assistant]
According to Assessing Security and Privacy Controls in Information Systems and Organizations:

3.2.2   SELECT PROCEDURES TO ASSESS THE SECURITY AND PRIVACY CONTROLS

SP 800-53A provides assessment procedures for each security and privacy control and control
enhancement in [SP 800-53].

Assessing Security and Privacy Controls in Information Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Access Control?

[Assistant]
According to Strategies for the Integration of Software Supply Chain Security in DevSecOps CI_CD Pipelines:

| Executive Summary............................................................................................................................1        |
|-------------------------------------------------------------------------------------------------------------------------------------------------------|
| 1. Introduction...................................................................................................................................2   |
| 2. Software Supply Chain (SSC) -Definition and Model .....................................................................4                           |
| 2.4.1. Software Supply Chain Defects ....................................................................................................6            |
| 2.4.2. Software Supply Chain Attacks.....................................................................................................6            |
| SSC Security -Risk Factors and Mitigation Measures .....................................................................8                             |
| 3. |
| 3.1.1. Developer Environment ...............................................................................................................8         |
| 3.1.2. Threat Actors................................................................................................................................8 |
| 3.1.3. Attack Vectors ..............................................................................................................................9 |
| 3.1.4. Attack Targets (Assets).................................................................................................................9      |
| 3.1.5. Types of Exploits.........................................................................................................................10   |
| 3.2.1.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Ordered t-way Combinations for Testing State-based Systems provide? (Part 5)

[Assistant]
h possible interleaving. Note that the event sequence array has sequences of events in each row . Event sequences are made up of a value in a column followed by values in columns to the right. Fig. 1.
Event sequence

|   Test | p0   | p1   | p2   | p3   |
|--------|------|------|------|------|
|      1 | a    | d    | b    | c    |
|      2 | b    | a    | c    | d    |
|      3 | b    | d    | c    | a    |
|      4 | c    | a    | b    | d    |
|      5 | c    | d    | b    | a    |
|      6 | d    | a    | c    | b    |

Combinatorial testing with constraints on the order in which values and combinations are applied in tests was analyzed extensively in [5] . Extended covering arrays that consider the sequence of values in each test  were  defined  in  [6]  . Combination  sequences were studied in [20] , combining configuration and the  order  of  combinations  while  also  considering constraints. Another structure defined as a sequence covering  array  of t -way  combinations  has  been termed  a multi-valued sequence  covering  array, introduced in [25] . ## 3 Ordered Combination Covering

A  combination  order  is  different  from  an  event sequence. As noted in the previous section, an event sequence  is a possibly interleaved  sequence  of symbols in a single row of a test array. A combination order,  as  defined  below,  is  across  multiple  rows, given in the order in which tests will be executed. A t -way permutation of symbols is referred to as a t-way order ,  which  will  be  called  a t -order  for  brevity. The t events  in  the  order  may  be  interleaved  with others (i.e., the order a → b → c covers three 2-event orders: a followed by b and b followed by c , and a followed by c ). Denoting event a eventually followed by event b , possibly with other events interleaved, is written as a *→ b .

Ordered t-way Combinations for Testing State-based Systems


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Federal Cybersecurity Role-Based Training Approaches, Successes, and Challenges provide? (Part 8)

[Assistant]
disagreed that they have adequate staff for conducting RBT activities. - Measuring RBT effectiveness: Just over half of survey participants rated their RBT activities as moderately or very successful.
However, there is great variation in how organizations determine success, with most relying on compliance metrics, such as training completion rates, that do not necessarily measure impact on employee learning or behaviors. Close to 60% of survey participants rated measuring RBT success as challenging. These results suggest the need to provide more guidance and baseline standards for federal RBT activities. An upcoming NIST update to NIST SP 800-50 Building a Cybersecurity and Privacy Learning Program , which our research has informed, may address many of the suggestions for supporting organizations through guidance. Additionally, federal organizations may benefit from standard, government-wide RBT content that could then be tailored to unique mission needs. ## STUDYGLYPH<c=2,font=/GAAAAA+HKGrotesk-Bold> BACKGROUNDGLYPH<c=2,font=/GAAAAA+HKGrotesk-Bold> ANDGLYPH<c=2,font=/GAAAAA+HKGrotesk-Bold> PURPOSEGLYPH<c=2,font=/GAAAAA+HKGrotesk-Bold>

<!-- image -->

## What is cybersecurity role-based training (RBT)? Cybersecurity role-based training (RBT) includes specialized training on policies, procedures, tools, and methods for individuals who are assigned management, operational, and technical roles having security and privacy responsibilities [SP800-53]. RBT is tailored to specific roles within an organization and differs from the general cybersecurity awareness training targeted at all personnel within an organization. ## U.S. Federal Government organizations are required to conduct RBT. NIST Special Publication (SP) 800-53 Rev. 5, Security and Privacy Controls for Information Systems and Organizations , provides guidance for organizations in protecting their operations, assets, and personnel from security threats and risks [SP800-53].

Federal Cybersecurity Role-Based Training Approaches, Successes, and Challenges


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Guidelines on Mobile Device Forensics provide? (Part 6)

[Assistant]
|
| LIST OFTABLES....................................................................................................................
| LIST OFTABLES.................................................................................................................... | VIII                                                                                |
| EXECUTIVE SUMMARY........................................................................................................... | EXECUTIVE SUMMARY........................................................................................................... | 1                                                                                |
| 1. INTRODUCTION.................................................................................................................. | 1. INTRODUCTION.................................................................................................................. | 1                                                                                |
| 1.1                                                                                | PURPOSEAND SCOPE ......................................................................................................... | 1                                                                                |
| 1.2                                                                                | AUDIENCEAND ASSUMPTIONS ..........................................................................................


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Maintenance?

[Assistant]
According to Organizational Views of NIST Cryptographic Standards and Testing and Validation Programs:

## 5.1.2.3.Updates

Participants were asked how updates to standards impacted their product lifecycle. Sometimes, updates to standards specifications can be disruptive:

Two participants commented on interdependencies of standards, and that problems with updates to all applicable documents aren't always closely coordinated:

Organizational Views of NIST Cryptographic Standards and Testing and Validation Programs


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Information Integrity?

[Assistant]
According to Security and Privacy Controls for Information Systems and Organizations:

Assurance; availability; computer security; confidentiality; control; cybersecurity; FISMA;
information security; information system; integrity; personally identifiable information; Privacy
Act; privacy controls; privacy functions; privacy requirements; Risk Management Framework;
security controls; security functions; security requirements; system; system security. CHAPTER ONE   INTRODUCTION ...................................................................................................... 1
1.1   PURPOSE AND APPLICABILITY ................................................................................................... 2
1.2   TARGET AUDIENCE .................................................................................................................. 3
1.3   ORGANIZATIONAL RESPONSIBILITIES......................................................................................... 3
1.4   RELATIONSHIP TO OTHER PUBLICATIONS ................................................................................... 5
1.5   REVISIONS AND EXTENSIONS .................................................................................................... 5
1.6   PUBLICATION ORGANIZATION .................................................................................................. 5
CHAPTER TWO   THE FUNDAMENTALS ............................................................................................ 7
2.1   REQUIREMENTS AND CONTROLS .............................................................................................. 7
2.2   CONTROL STRUCTURE AND ORGANIZATION .............................................................................. 8
2.3   CONTROL IMPLEMENTATION APPROACHES ............................................................................. 11
2.4   SECURITY AND PRIVACY CONTROLS .........................................................................................

Security and Privacy Controls for Information Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Cryptographic Module Validation Program (CMVP)-Approved Sensitive Security Parameter Generation and Establishment Methods_ CMVP Validation Authority U provide? (Part 2)

[Assistant]
ts, guidelines, and procedures, where they exist, remain operative. For planning and transition purposes, federal agencies may wish to closely follow the development of these new publications by NIST.
Organizations are encouraged to review all draft publications during public comment periods and provide feedback to NIST. Many NIST cybersecurity publications, other than the ones noted above, are available at https://csrc.nist.gov/publications. ## Authority

This publication has been developed by NIST in accordance with its statutory responsibilities under the Federal Information Security Modernization Act (FISMA) of 2014, 44 U.S.C. § 3551 et seq., Public Law (P.L.) 113-283. NIST is responsible for developing information security standards and guidelines, including minimum requirements for federal information systems, but such standards and guidelines shall not apply to national security systems without the express approval of appropriate federal officials exercising policy authority over such systems. This guideline is consistent with the requirements of the Office of Management and Budget (OMB) Circular A-130. Nothing in this publication should be taken to contradict the standards and guidelines made mandatory and binding on federal agencies by the Secretary of Commerce under statutory authority. Nor should these guidelines be interpreted as altering or superseding the existing authorities of the Secretary of Commerce, Director of the OMB, or any other federal official. This publication may be used by nongovernmental organizations on a voluntary basis and is not subject to copyright in the United States. Attribution would, however, be appreciated by NIST.

Cryptographic Module Validation Program (CMVP)-Approved Sensitive Security Parameter Generation and Establishment Methods_ CMVP Validation Authority U


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Planning?

[Assistant]
According to Data Integrity_ Detecting and Responding to Ransomware and Other Destructive Events:

- NIST Framework for Improving Critical Infrastructure Cybersecurity (commonly known as the NIST Cybersecurity Framework [1]
- NIST Interagency or Internal Report (NISTIR) 8050: Executive Technical Workshop on Improving Cybersecurity and Consumer Privacy [2]
- NIST Special Publication (SP) 800-30 Rev. 1: Guide for Conducting Risk Assessments [3]
- NIST SP 800-37 Rev. 1: Guide for Applying the Risk Management Framework to Federal Information Systems: A Security Life Cycle Approach [4]
- NIST SP 800-39: Managing Information Security Risk [5]
- NIST SP 800-40 Rev. 3: Guide to Enterprise Patch Management Technologies [6]
- NIST SP 800-53 Rev. 4: Security and Privacy Controls for Federal Information Systems and Organizations [7]
- Federal Information Processing Standard 140-2: Security Requirements for Cryptographic Modules [8]
- NIST SP 800-86: Guide to Integrating Forensic Techniques into Incident Response [9]
- NIST SP 800-92: Guide to Computer Security Log Management [10]
- NIST SP 800-100: Information Security Handbook: A Guide for Managers [11]
- NIST SP 800-34 Rev. 1: Contingency Planning Guide for Federal Information Systems [12]
- Office of Management and Budget, Circular Number A-130: Managing Information as a Strategic Resource [13]
- NIST SP 800-61 Rev. 2: Computer Security Incident Handling Guide [14]
- NIST SP 800-83 Rev.

Data Integrity_ Detecting and Responding to Ransomware and Other Destructive Events


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Maintenance?

[Assistant]
According to Cryptographic Module Validation Program (CMVP)-Approved Sensitive Security Parameter Generation and Establishment Methods_ CMVP Validation Authority U:

CMVP Validation Authority Updates to ISO/IEC 24759

CMVP Validation Authority Updates to ISO/IEC 24759

Calis A (2023) Cryptographic Module Validation Program (CMVP)-Approved Sensitive Security Parameter Generation and Establishment Methods: CMVP Validation Authority Updates to ISO/IEC 24759. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) NIST SP 800-140Dr2. https://doi.org/10.6028/NIST.SP.800-140Dr2


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Information Integrity?

[Assistant]
According to Status Report on the First Round of the Additional Digital Signature Schemes for the NIST Post-Quantum Cryptography Standardization Process:

3.14. SQIsign . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

3.14. SQIsign

Status Report on the First Round of the Additional Digital Signature Schemes for the NIST Post-Quantum Cryptography Standardization Process


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171 provide? (Part 4)

[Assistant]
pment of management, administrative, technical, and physical standards and guidelines for the costeffective security of other than national security-related information in federal information systems.
The Special Publication 800-series reports on ITL's research, guidelines, and outreach efforts in information systems security and privacy and its collaborative activities with industry, government, and academic organizations. ## Abstract

The protection of Controlled Unclassified Information (CUI) resident in nonfederal systems and organizations is of paramount importance to federal agencies and can directly impact the ability of the Federal Government to successfully conduct its essential missions and functions. This publication provides federal agencies with recommended enhanced security requirements for protecting the confidentiality of CUI: (1) when the information is resident in nonfederal systems and organizations; (2) when the nonfederal organization is not collecting or maintaining information on behalf of a federal agency or using or operating a system on behalf of an agency; and (3) where there are no specific safeguarding requirements for protecting the confidentiality of CUI prescribed by the authorizing law, regulation, or government-wide policy for the CUI category listed in the CUI Registry. The enhanced requirements apply to components of nonfederal systems that process, store, or transmit CUI or that provide security protection for such components when the designated CUI is associated with a critical program or high value asset. The enhanced requirements supplement the basic and derived security requirements in NIST Special Publication 800-171 and are intended for use by federal agencies in contractual vehicles or other agreements established between those agencies and nonfederal organizations.

Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 1 require for Planning?

[Assistant]
According to IoT Non-Technical Supporting Capability Core Baseline:

There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may  be  used  by  federal  agencies  even  before  the  completion  of  such  companion  publications.  Thus,  until  each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning  and  transition  purposes,  federal  agencies  may  wish  to  closely  follow  the  development  of  these  new publications by NIST.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Summary of NIST SP 800-53, Revision 4_ Security and Privacy Controls for Federal Information Systems and Organizations provide? (Part 10)

[Assistant]
parameters that organizations define, providing them with the ability to tailor security controls based on specific security requirements, environments of operation, and organizational risk tolerance.
Parameters assigned and/or selected by organizations for a given base control also apply to all control enhancements associated with that control. The first security control in each family (referred to as the dash-1control) addresses policies and procedures needed for effective implementation of all the other controls within each family. Therefore, requirements to develop policies and procedures are not repeated in individual controls. Many security controls and enhancements include supplemental guidance. The supplemental guidance provides additional information about a control or enhancement to help organizations define, develop, and/or implement security controls but does not include any additional requirements. SP 800-53 Rev. 4 includes many changes from SP 800-53 Rev. 3 - 295 controls and control enhancements were added while approximately 100 controls and control enhancements were withdrawn or incorporated into others. Of the eighteen security control families in SP 800-53 Rev. 4, seventeen families are described in the security control catalog in Appendix F, and are closely aligned with the seventeen minimum security requirements for federal information and information systems in FIPS Publication 200, Minimum Security Requirements for Federal Information and Information Systems . One additional family, the Program Management (PM) family, provides controls for information security programs themselves. This family is described in Appendix G of SP 800-53 Rev. 4. While it is not specifically referenced in FIPS 200, the PM section provides security controls at the organization level rather than the information system level. The PM controls are typically implemented at the organization level and not directed at individual organizational information systems.

Summary of NIST SP 800-53, Revision 4_ Security and Privacy Controls for Federal Information Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Security Assessment?

[Assistant]
According to Summary of NIST SP 800-53, Revision 4_ Security and Privacy Controls for Federal Information Systems and Organizations:

8 (also known as the Common Criteria) provides functionality and assurance requirements for developers of information systems and information system components (i.e., information technology products).
Since many of the technical security controls defined in Appendix F are implemented in hardware, software, and firmware components of information systems, organizations can obtain significant benefit from the acquisition and employment of information technology products evaluated against the requirements of ISO/IEC 15408. The use of such products can provide evidence that certain security controls are implemented correctly, operating as intended, and producing the desired effect in satisfying stated security requirements.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Physical Protection?

[Assistant]
According to Report on the Design-A-Thon_ Designing Effective and Accessible Approaches for Digital Product Cybersecurity Education and Awareness:

Since many users may not fully understand cybersecurity risks to their IoT products, education materials should clearly communicate the relevance of product cybersecurity features (what the features do and why these are of importance) and what actions are expected of the users (e.g., changing settings or physically safeguarding the product). Instructions for setting cybersecurity preferences should be clear, simple, and achievable for those without cybersecurity expertise. To support diverse users with different cybersecurity and technical needs, skills, and interests, a layered approach for education materials may also be helpful; first present basic information, then provide links to more detail for those who need or want it.

The team identified that firmware updates are critical to the cybersecurity of a smart teddy bear. Team participants also noted that privacy was also noted as a critical concern. The team envisioned utilizing videos and physical manuals to communicate with customers and users. They developed two manuals: one for parents and another for children, allowing for a more targeted audience approach. The adult manual was detailed and focused on salient tips and direct, easy access to resources. The child manual was designed around the idea that the child could help drive cybersecurity and that the product could help teach good cyber hygiene. For example, the eyes of the bear can glow red when an update is needed, prompting the child to seek help, as the team describes in their mock-up of the story book in Fig. 2.

Report on the Design-A-Thon_ Designing Effective and Accessible Approaches for Digital Product Cybersecurity Education and Awareness


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Configuration Management?

[Assistant]
According to Recommendations for Federal Vulnerability Disclosure Guidelines:

|
| Federal Vulnerability Disclosure Coordination Body ....................................................
| 6                                                                                |                                                                                |
| Preparation................................................................................................................. | 7                                                                                |                                                                                |
| 2.1.1. Create Source Vulnerability                                                                                | Report Receipt Capability............................................. 7                                                             |                                                                                |
| 2.1.2. Determine Scope and Obtain Contacts .................................................................... | 8                                                                                |                                                                                |
| 2.1.3. Develop Technical Analysis Capability .....................................................................

Recommendations for Federal Vulnerability Disclosure Guidelines


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Services Acquisition?

[Assistant]
According to Assessing Security and Privacy Controls in Information Systems and Organizations:

ework. The assessment procedures, executed at various phases of the system
development life cycle, are consistent with the security and privacy controls in NIST Special
Publication 800-53, Revision 5.
The procedures are customizable and can be easily tailored to
provide organizations with the needed flexibility to conduct security and privacy control
assessments that support organizational risk management processes and are aligned with the
stated risk tolerance of the organization. Information on building effective security and privacy
assessment plans is also provided with guidance on analyzing assessment results.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Analyzing Collusion Threats in the Semiconductor Supply Chain provide? (Part 10)

[Assistant]
s scale is relative, meaning it provides a context on the severity of the threat posed by different adversaries in a collusion but does not quantify the exact difference in severity. For example, Fig.
3 illustrates that a collusion between an integrator and a designer presents a more severe threat than one involving a manufacturer and a designer, but the scale does not specify how much more severe the threat is. This relative approach is intentional, as different stakeholders may prioritize different metrics for evaluating threat severity. One analyst might prioritize attack completion time, while another may focus on the likelihood of attack success. This flexibility allows analysts to develop their own customized, non-linear scales based on the metrics they deem most important. These scales can provide a more detailed understanding,

such as quantitatively comparing the severity of a designer's threat versus that of a manufacturer. ## 3.5. Identify Security-Critical Stages for the Respective Threat

The final step involves determining the type and severity of each threat in relation to where it is located on the semiconductor supply chain. The choice of which stage in the semiconductor supply chain may and should be secured must be made at this step, taking into account all threat matrices. This inevitably comes down to weighing the cost-security trade-off. ## 4. Case Study

This framework for supply chain threat analysis is meant to adapt to different threat types. The following example scenarios consider IP theft and hardware infiltration. ## 4.1. Hardware Infiltration

- Step 1: A security analysis identifies an adversary's intent to infiltrate a chip. To that end, the adversary might take steps that make the hardware unusable, transmit sensitive information from the chip [9], or receive signals that can make the chip operate abnormally. - Step 2: One method of infiltrating hardware is through the insertion of hardware Trojans.

Analyzing Collusion Threats in the Semiconductor Supply Chain


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Report on the Design-A-Thon_ Designing Effective and Accessible Approaches for Digital Product Cybersecurity Education and Awareness provide? (Part 7)

[Assistant]
ach that could be used to support cybersecurity education and awareness.................................................................................. 12                                |
| Fig. 10.
Mock-up of how answers to the guided questions will impact what customers see and how the content will be gamified..........................................................................................................13              |

## Acknowledgments

NIST thanks all the organizers of USENIX SOUPS and the Tutorials and Workshops Co-Chairs, specifically, for the opportunity to bring our idea for a Design-A-Thon to the symposium. We also thank everyone who participated in the Design-A-Thon, giving their time and bringing the great ideas documented in this report. ## 1. Introduction

On August 11, 2024, National Institute of Standards and Technology (NIST) researchers facilitated a Design-A-Thon titled Designing Effective and Accessible Approaches for Digital Product Cybersecurity Education and Awareness which was hosted at the 2024 USENIX Symposium on Usable Privacy and Security (SOUPS). The Design-A-Thon was organized by Michael Fagan, Daniel Eliot, Barbara Cuthill, and Julie Haney with support from Kristina Rigopoulos, all members of the NIST Information Technology Lab (ITL). Background on the foundations for this project is provided in Section 2, while details about the planning and execution of the Design-A-Thon are discussed in Section 3. In total, eight conference attendees participated in the event, forming three teams. Each team selected a mock product based on a selection of five Product Data Cards developed by the NIST team. The Product Data Cards developed for the Design-A-Thon can be seen in Appendix B. Participants used the information on the Product Data Cards to develop a strategy for cybersecurity education and awareness for the product. The team's designs and ideas are documented in Section 4.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Security Assessment?

[Assistant]
According to Secure Software Development Practices for Generative AI and Dual-Use Foundation Models_ An SSDF Community Profile:

| Practice | Task | Priority | Recommendations [R], Considerations [C], and Notes [N] Specific to AI Model Development | Informative References | |----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------|------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------------------| | | | | R4: Permit indirect access only to model weights.

Secure Software Development Practices for Generative AI and Dual-Use Foundation Models_ An SSDF Community Profile


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Communications Protection?

[Assistant]
According to Security and Privacy Controls for Information Systems and Organizations:

CHAPTER ONE   INTRODUCTION ...................................................................................................... 1
1.1   PURPOSE AND APPLICABILITY ................................................................................................... 2
1.2   TARGET AUDIENCE .................................................................................................................. 3
1.3   ORGANIZATIONAL RESPONSIBILITIES......................................................................................... 3
1.4   RELATIONSHIP TO OTHER PUBLICATIONS ................................................................................... 5
1.5   REVISIONS AND EXTENSIONS .................................................................................................... 5
1.6   PUBLICATION ORGANIZATION .................................................................................................. 5
CHAPTER TWO   THE FUNDAMENTALS ............................................................................................ 7
2.1   REQUIREMENTS AND CONTROLS .............................................................................................. 7
2.2   CONTROL STRUCTURE AND ORGANIZATION .............................................................................. 8
2.3   CONTROL IMPLEMENTATION APPROACHES ............................................................................. 11
2.4   SECURITY AND PRIVACY CONTROLS ......................................................................................... 13
2.5   TRUSTWORTHINESS AND ASSURANCE ..................................................................................... 14
CHAPTER THREE   THE CONTROLS ................................................................................................. 16
3.1   ACCESS CONTROL ..................................................................................................................


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 2 require for System and Information Integrity?

[Assistant]
According to Profile of the IoT Core Baseline for Consumer IoT Products:

use that device in DDOS and other attacks. | Mirai Malware Variants Attacks - Use of weak authentication to enable the loading of malware onto the device and use that device in DDOS and other attacks.
|
| Unauthorized access to the IoT device                                                                                | Asset Identification Interface Access Control Information Dissemination Education and Awareness                                                             |
| Malicious code can be loaded on the IoT device                                                                                | Software Update Cybersecurity State Awareness Education and Awareness                                                                                |

Profile of the IoT Core Baseline for Consumer IoT Products


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What guidance does Guide to a Secure Enterprise Network Landscape provide?

[Assistant]
<!-- image -->

## NIST Special Publication NIST SP 800-215

## Guide to a Secure Enterprise Network Landscape

Ramaswamy Chandramouli

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-215

<!-- image -->

## NIST Special Publication NIST SP 800-215

## Guide to a Secure Enterprise Network Landscape

Ramaswamy Chandramouli

Computer Security Division Information Technology Laboratory

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-215

November 2022

<!-- image -->

U.S. Department of Commerce Gina M. Raimondo, Secretary

National Institute of Standards and Technology

Laurie E. Locascio, NIST Director and Under Secretary of Commerce for Standards and Technology

Certain commercial entities, equipment, or materials may be identified in this document in order to describe an experimental procedure or concept adequately. Such identification is not intended to imply recommendation or endorsement by the National Institute of Standards and Technology (NIST), nor is it intended to imply that the entities, materials, or equipment are necessarily the best available for the purpose. There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may be used by federal agencies even before the completion of such companion publications. Thus, until each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning and transition purposes, federal agencies may wish to closely follow the development of these new publications by NIST. Organizations are encouraged to review all draft publications during public comment periods and provide feedback to NIST.

Guide to a Secure Enterprise Network Landscape


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for Supply Chain Risk Management?

[Assistant]
According to Protecting Controlled Unclassified Information (CUI)_ NIST Special Publication 800-171, Revision 3. Small Business Primer:

deral agency to ensure that requirements to protect CUI are identified in applicable contracts or agreements, and CUI is marked by the federal agency. |
| How do I get a 'NIST SP 800 -171 Assessment'?
| The term 'NIST Assessment' and 'NIST SP 800 - 171 Assessment' is frequently used to describe the Department of Defense (DOD) proce ss used to complete its NIST SP 800-171 Assessment Module through the Supplier Performance Risk System (SPRS). NIST develops the underlying technical guidelines (SP 800-171, SP 800-171A, SP 800-172, and SP 800- 172A) on which the 'NIST Assessment' is based, but NIST does not have a role in DOD's implementation of its programs . For additional guidance on NIST's methodology to plan, prepare for, and conduct security requirement assessments, refer to SP 800-171A. |
| What products, vendors, or solutions are 'NIST SP 800 -171 compliant' or 'CMMC - certified'? | NIST does not identify or track implementation of or compliance with the security requirements. |
| What is the relationship between NIST and CMMC? | The Cybersecurity Maturity Model Certification (CMMC) is a DOD program that references the security requirements in NIST SP 800-171 and SP 800-172. NIST is not involved in the design, development, or implementation of the CMMCmodel, accreditation body, or certification process. It is important to note that CMMCis currently based on SP 800-171, Revision 2. Contractors should check for specific requirements in their contracts to understand which version they are required to use. |

Protecting Controlled Unclassified Information (CUI)_ NIST Special Publication 800-171, Revision 3. Small Business Primer


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Digital Identity Guidelines_ Identity Proofing and Enrollment provide? (Part 8)

[Assistant]
. . . . . . . . . . . . . . . . . . . . . 4.1.5. Attribute Validation . . . . . . . . . . . . . . . . . . . . . . . . 4.1.6. Verification Requirements . . . . . . . . . . . . . . . . . . . . . 4.1.7.
Remote Unattended Requirements . . . . . . . . . . . . . . . . 4.1.8. Remote Attended Requirements

. . . . . . . . . . . . . . . . . 4.1.9. On-Site Attended Requirements . . . . . . . . . . . . . . . . . . 4.1.10. On-Site Unattended Requirements

. . . . . . . . . . . . . . . . 4.1.11. Notification of Proofing . . . . . . . . . . . . . . . . . . . . . . 4.1.12. Initial Authenticator Binding . . . . . . . . . . . . . . . . . . . . iv

24

25

26

27

27

30

31

33

34

35

36

36

37

38

38

39

40

40

40

40

40

41

41

41

42

42

43

43

44

44

NIST SP 800-63A-4
July 2025

Digital Identity Guidelines
Identity Proofing and Enrollment

4.2. Identity Assurance Level 2 Requirements . . . . . . . . . . . . . . . . . 4.2.1. Proofing Types . . . . . . . . . . . . . . . . . . . . . . . . . . . 4.2.2. Evidence Collection . . . . . . . . . . . . . . . . . . . . . . . . 4.2.3. Attribute Collection . . . . . . . . . . . . . . . . . . . . . . . . 4.2.4. Evidence Validation . . . . . . . . . . . . . . . . . . . . . . . . 4.2.5. Attribute Validation . . . . . . . . . . . . . . . . . . . . . . . . 4.2.6. Verification Requirements . . . . . . . . . . . . . . . . . . . . . 4.2.7. Remote Unattended Requirements . . . . . . . . . . . . . . . . 4.2.8. Remote Attended Requirements

. . . . . . . . . . . . . . . . . 4.2.9. On-Site Attended Requirements . . . . . . . . . . . . . . . . . . 4.2.10. On-Site Unattended Requirements

. . . . . . . . . . . . . . . . 4.2.11. Notification of Proofing . . . . . . . . . . . . . . . . . . . . . . 4.2.12. Initial Authenticator Binding . . . . . . . . . . . . . . . . . . . . 4.3. Identity Assurance Level 3 . . . . . . . . . . . . . . . . . . . . . . . . . 4.3.1. Proofing Types . . . . . . . . . . . . . . . . . . . . . . . . . . . 4.3.2.

Digital Identity Guidelines_ Identity Proofing and Enrollment


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What guidance does Addressing Visibility Challenges with TLS 1.3 within the Enterprise_ High-Level Document provide?

[Assistant]
## NIST SPECIAL PUBLICATION 1800-37

## Addressing Visibility Challenges with TLS 1.3 within the Enterprise High-Level Document

Bill Newhouse Murugiah Souppaya David Cooper Tim Polk*

National Institute of Standards

William Barker

Stratvia LLC

Karen Scarfone

Scarfone Cybersecurity

John Kent Julian Sexton Michael Dimond Josh Klosterman Ryan Williams

The Mitre Corporation

David Wells Johann Tonsing

Mira Security

Sean Turner

sn3rd

Patrick Kelsey

Not for Radio

Russ Housley

Vigil Security LLC

Tim Cahill

JPMorgan Chase & Company

Muralidharan Palanisamy

AppViewX

Dung Lam

F5

Paul Barrett Ray Jones Sandeep Jha

Netscout

Steven Fenter Jake Wills

US Bank Corporation

Jane Gilbert D'Nan Godfrey

Thales TCT

Dean Cocklin Avesta Hojjati

DigiCert

*Contributed while a NIST Employee

September 2025

FINAL

This publication is available free of charge from htps://www.nccoe.nist.gov/addressing -visibility-challenges-tls-13

<!-- image -->

<!-- image -->

## NIST SPECIAL PUBLICATION 1800-37

## Addressing Visibility Challenges with TLS 1.3 within the Enterprise High-Level Document

Bill Newhouse Murugiah Souppaya David Cooper Tim Polk* National Institute of Standards

William Barker Stratvia LLC

Karen Scarfone Scarfone Cybersecurity

John Kent Julian Sexton Michael Dimond Josh Klosterman Ryan Williams The Mitre Corporation

Johann Tonsing Mira Security

Sean Turner sn3rd

Patrick Kelsey Not for Radio

Russ Housley Vigil Security LLC

Tim Cahill

JPMorgan Chase & Company

Muralidharan Palanisamy AppViewX

Dung Lam F5

Paul Barrett Ray Jones Sandeep Jha Netscout

Steven Fenter Jake Wills US Bank Corporation

Jane Gilbert D'Nan Godfrey Thales TCT

Dean Cocklin Avesta Hojjati DigiCert

*Contributed while a NIST Employee

David Wells

Final September 2025

<!-- image -->

U.S.

Addressing Visibility Challenges with TLS 1.3 within the Enterprise_ High-Level Document


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Planning?

[Assistant]
According to Secure Software Development Framework (SSDF) Version 1.1_ Recommendations for Mitigating the Risk of Software Vulnerabilities:

There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may  be  used  by  federal  agencies  even  before  the  completion  of  such  companion  publications.  Thus,  until  each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning  and  transition  purposes,  federal  agencies  may  wish  to  closely  follow  the  development  of  these  new publications by NIST.

- Securely Provision (SP): Risk Management (RSK), Software Development (DEV), Systems Requirements Planning (SRP), Test and Evaluation (TST), Systems Development (SYS)
- Operate and Maintain (OM): Systems Analysis (ANA)
- Oversee and Govern (OV): Training, Education, and Awareness (TEA); Cybersecurity Management (MGT); Executive Cyber Leadership (EXL); Program/Project Management (PMA) and Acquisition
- Protect and Defend (PR): Incident Response (CIR), Vulnerability Assessment and Management (VAM)
- Analyze (AN): Threat Analysis (TWA), Exploitation Analysis (EXP)

Factors such as risk, cost, feasibility, and applicability should be considered when deciding which practices to use and how much time and resources to devote to each practice. 4 Automatability is also an important factor to consider, especially for implementing practices at scale. The practices, tasks, and implementation examples represent a starting point to consider; they are meant to be changed and customized, and they are not prioritized. Any stated frequency for performing practices is notional. The intention of the SSDF is not to create a checklist to follow, but to provide a basis for planning and implementing a risk-based approach to adopting secure software development practices.

Secure Software Development Framework (SSDF) Version 1.1_ Recommendations for Mitigating the Risk of Software Vulnerabilities


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 2 require for Physical Protection?

[Assistant]
According to Profile of the IoT Core Baseline for Consumer IoT Products:

The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the Nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology. ITL's responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in federal information systems.

Complex IoT products may contain multiple physical IoT devices, contain other kinds of equipment, or connect to multiple backends or companion applications as components. Though there are possibly a large number of component combinations that may create an IoT product, it is helpful to think of three specific kinds of IoT product components (other than the IoT device itself, which is always present in an IoT product):

4 'In the box' components, particularly the IoT device(s) that serves as the product end point can be considered the face of the IoT product since these are what a customer will physically handle, manage, and use. Though other components may be vital to operation of the IoT product (including cybersecurity), the IoT device(s) plays a central role to the IoT product and, in general, is the focus of the operation of the IoT product. 5 Some 'outside the box' components may be entirely remote relative to the customer, while others may be physically present in the customer's environment (e.g., inside their home), but, nonetheless, come separate from the IoT device(s).


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Incident Response?

[Assistant]
According to Recommendations for Federal Vulnerability Disclosure Guidelines:

Vulnerabilities are discovered by a variety of sources. Developers of software may find security bugs in already deployed code. Security researchers and penetration testers may find vulnerabilities by scanning or manually testing software and accessible systems (following published rules of behavior). While identifying an issue, users of systems may stumble across a vulnerability. Malicious actors may seek out unknown or unpublished vulnerabilities and use them in malware. Evidence of these attacks may then be discovered and analyzed by security experts, resulting in an identified vulnerability being reported. Regardless of who finds these vulnerabilities, it is critical that they are reported so that the owners of vulnerable software and systems can resolve or identify ways to mitigate the reported vulnerabilities. In many cases, owners should issue advisories to notify users of any actions to be taken (e.g., patches to be installed) or of potential damage to systems (i.e., potential consequences of the vulnerability having existed).


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Configuration Management?

[Assistant]
According to Validating the Integrity of Computing Devices:

IT professionals who want to implement an approach like this can make use of NIST SP 1800-34c: HowTo Guides . It provides specific product installation, configuration, and integration instructions for building the example implementation, allowing you to replicate all or parts of this project. NIST Cybersecurity Practice Guides (Special Publication 1800 series) target specific cybersecurity challenges in the public and private sectors. They are practical, user-friendly guides that facilitate the adoption of standards-based approaches to cybersecurity. They show members of the information security community how to implement example solutions that help them align with relevant standards and best practices, and provide users with the materials lists, configuration files, and other information they need to implement a similar approach.

Validating the Integrity of Computing Devices


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AT.L2-3.2.1 (NIST 3.2.1)?

[Assistant]
According to Approaches and Challenges of Federal Cybersecurity Awareness Programs:

3.2.1                                                                                | Number of Additional Activities... 3.2.1 Number of Additional Activities

We asked participants how many other security awareness activities or events their organizations offered per year in addition to required annual training (see Figure 6).

Approaches and Challenges of Federal Cybersecurity Awareness Programs


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Security Assessment?

[Assistant]
According to A Zero Trust Architecture Model for Access Control in Cloud-Native Applications in Multi-Cloud Environments:

- The global control plane can be leveraged to perform the functions of individual control planes at the enterprise level rather than at the cluster level (e.g., issuing identities to all services in the enterprise by leveraging the enterprise Public Key Infrastructure (PKI) system).
- The global control plane can also be used to shut down a specific control plane if all cluster nodes under the jurisdiction of that control plane have been compromised.
- The management plane provides the human-computer interfaces (e.g., user interfaces, such as command line interfaces and APIs) that enable enterprise-level systems to work by encoding organizational processes related to the usage of various tools (e.g., policy definition and evaluation tools, telemetry tools) at the lower layer.

- Identity-tier policies enable the automated testing of policies. Policies that are independent of infrastructure can be tested by merely exercising the application and observing the outcomes (e.g., trace the sequence of service calls and requests or responses instead of configuring the infrastructure correctly for test runs).
- Identity-tier policies enable 'policy as code' (PaC). With the availability of tools for the declarative specification of policies through PaC, identity-tier policies can be defined and implemented by incorporating the code into automated workflows, such as continuous integration/continuous delivery (CI/CD) pipelines.
- Identity-tier policies enable fine-grained access control by providing visibility into application call sequences/interdependencies and data flows through request-level tracking, which enables the enforcement of security policies for application traffic that is both north-south and east-west, irrespective of the environment (e.g., corporate data center or cloud infrastructure).

A Zero Trust Architecture Model for Access Control in Cloud-Native Applications in Multi-Cloud Environments


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Communications Protection?

[Assistant]
According to Audit and Evaluation of Computer Security II_ System Vulnerabilities and Controls:

| 4.2         | Access Policies                                                                                | 4-12      |
|-------------|------------------------------------------------------------------------------------------------|-----------|
| 4.3         | Unauthorized Statistical Disclosure                                                            | 4-12      |
| 4.4         | Transaction Trail                                                                              | 4-13      |
|             | 4.4.1 Automated Journals                                                                       | 4-13      |
| 4.5         | Data Checks and Integrity                                                                      | 4-13      |
| 5. | APPLICATIONS INTERFACE                                                                         | 4-14      |
| 5.1         | General                                                                                | 4-14      |
| 5.2         | System Development Controls                                                                    | 4-14      |
| 5.3         | Project Definition                                                                             | 4-14      |
| 5.4         | System Design                                                                                | 4-15      |
| 5.5         | Detailed Design and Programming                                                                | 4-15      |
| 5.6         | System Testing                                                                                | 4-15      |
| 5.7 6.

Audit and Evaluation of Computer Security II_ System Vulnerabilities and Controls


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Access Control?

[Assistant]
According to Contingency Planning Guide for Federal Information Systems:

ous monitoring strategy/program can guide the scope of the reauthorization to focus on those environment/facility controls and any other controls which would be impacted by the reconstitution efforts.
Assessment and authorization guidance is available in NIST SP 800-37, Rev. 1 Guide for Applying the Risk Management Framework to Federal Information Systems: A Security Life Cycle Approach.

Contingency Planning Guide for Federal Information Systems


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AT.L2-3.2.5 (NIST 3.2.5)?

[Assistant]
According to Audit and Evaluation of Computer Security II_ System Vulnerabilities and Controls:

3.2.5 Output Handling                                                       | 4-11      |
|      |                |                                                                                | 4-11      |
|      |                | 3. 3.2.5 Output Handling .


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice CM.L2-3.4.3 (NIST 3.4.3)?

[Assistant]
According to Protecting Information and System Integrity in Industrial Control System Environments_ Cybersecurity for the Manufacturing Sector:

3.4.3                                                                                | Risk ... 3.4.3 Risk

The risk to an organization is the intersection of:

-  the vulnerabilities and threats to the organization
-  the likelihood that the vulnerability and threat event will be realized
-  the impact to the organization should the event be realized

A meaningful risk assessment must be performed in the context of the cyber-ecosystem and the impact to an organization should a loss or degradation occur.

Protecting Information and System Integrity in Industrial Control System Environments_ Cybersecurity for the Manufacturing Sector


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Services Acquisition?

[Assistant]
According to Audit and Evaluation of Computer Security:

dvisory services to improve the effectiveness of
computer utilization in the Federal sector, and to perform appropriate research and
development efforts as foundation for such activities and programs.
This publication
series will report these NBS efforts to the Federal computer community as well as to
interested specialists in the academic and private sectors. Those wishing to receive
notices of publications in this series should complete and return the form at the end
of this publication.

Audit and Evaluation of Computer Security


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What are the CMMC Level 3 requirements?

[Assistant]
According to Assessing Enhanced Security Requirements for Controlled Unclassified Information:

lar A-130. Nothing in this publication should be taken to contradict the standards and guidelines made mandatory and binding on federal agencies by the Secretary of Commerce under statutory authority.
Nor should these guidelines be interpreted as altering or superseding the existing authorities of the Secretary of Commerce, OMB Director, or any other federal official. This publication may be used by nongovernmental organizations on a voluntary basis and is not subject to copyright in the United States. Attribution would, however, be appreciated by NIST. National Institute of Standards and Technology Special Publication 800-172A Natl. Inst. Stand. Technol. Spec. Publ. 800-172A, 62 pages (March 2022)

CODEN: NSPUE2

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-172A

Certain  commercial  entities,  equipment,  or  materials  may  be  identified  in  this  document  to describe an experimental procedure or concept adequately. Such identification is not intended to imply recommendation or endorsement by NIST, nor is it intended to imply that the entities, materials, or equipment are necessarily the best available for the purpose. There may be references in this publication to other publications currently under development by  NIST  in  accordance  with  its  assigned  statutory  responsibilities. The  information  in  this publication, including concepts, practices, and methodologies, may be used by federal agencies even  before  the  completion  of  such  companion  publications. Thus,  until  each  publication  is completed,  current  requirements,  guidelines,  and  procedures,  where  they  exist,  remain operative. For planning and transition purposes, federal agencies may wish to closely follow the development of these new publications by NIST. Organizations are encouraged to review draft publications during the public comment periods and provide feedback to NIST.

Assessing Enhanced Security Requirements for Controlled Unclassified Information


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Communications Protection?

[Assistant]
According to High-Performance Computing Security_ Architecture, Threat Analysis, and Security Posture:

xample, a user network contains the nodes in the access zone and the computer nodes in the high-performance computing zone. Cryptographic mechanisms are an effective means of providing data integrity.
HPC data storage systems typically support uniform encryption at the file level or block level. Such data encryption at the file system level protects data from unauthorized access. However, it does not provide granular access (i.e., segmenting one user from others). Granular access can be achieved using user-level or group-level encryption. Not even a system administrator can access a user's data with granular access since they do not have access to the decryption key. Additionally, file systems do not authorize users. Rather, users access the file system via the HPC access zone, which is responsible for authenticating the users and their access rights. In general, file systems should not be mounted outside of their local security boundaries unless the file system protocol appropriately authenticates users. For example, an attacker-controlled

High-Performance Computing Security_ Architecture, Threat Analysis, and Security Posture


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Maintenance?

[Assistant]
According to Planning for a Zero Trust Architecture_ A Planning Guide for Federal Administrators:

- I. All data sources and computing services are considered resources. An enterprise relies on different resources to perform its mission: mobile devices, data stores, compute resources (including virtual), remote sensors/actuators, etc. All these components are resources and need to be considered in a ZTA. Some components (e.g., IoT sensors) may not be able to support some solutions such as configuration agents, application sandboxing, etc. so compensating technologies or alternative mitigations may be needed. If the resource lacks certain security capabilities, the enterprise may need to add a PEP component to provide that functionality. - II. The enterprise monitors and measures the integrity and security posture of all owned and associated resources. This tenet deals with the aspects of cyber hygiene for both enterprise-owned resources and those that may not be owned, but used in an enterprise workflow such as configuration, patching, application loading, etc. The state of resources should be monitored, and appropriate action taken when new information such as a new vulnerability or attack is reported or observed. The confidentiality and integrity of data on the resource should be protected. This requires enterprise admins to know how resources are configured, maintained, and monitored. - III. Access to resources is determined by dynamic policy-including the observable state of client identity, application/service, and the requesting asset-and may include other behavioral and environmental attributes. In zero trust, the default behavior for all resources is to deny all connections and only accept connections that are explicitly allowed by policy. Those authorized to access the resource must still authenticate themselves and prove they meet the enterprise policy to be granted the session. This may include meeting requirements such as client software versions, patch level, geolocation, historical request patterns, etc.

Planning for a Zero Trust Architecture_ A Planning Guide for Federal Administrators