[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for Maintenance?

[Assistant]
According to Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171:

| CHAPTERONE INTRODUCTION...................................................................................................... | CHAPTERONE INTRODUCTION...................................................................................................... |
|--------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------|
| 1.1 PURPOSEANDAPPLICABILITY                                                                                | ................................................................................................... 3                                            |
| 1.2 TARGET AUDIENCE                                                                                | .................................................................................................................. 4                             |
| 1.3 ORGANIZATIONOF THIS SPECIAL PUBLICATION                                                                                | .......................................................................... 4                                                                     |
| CHAPTERTWO THE FUNDAMENTALS............................................................................................ 5                        | CHAPTERTWO THE FUNDAMENTALS............................................................................................ 5                        |
| 2.1 DEVELOPMENTAPPROACH ......................................................................................................

Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Access Control?

[Assistant]
According to The Federal Cybersecurity Awareness Workforce_ Professional Backgrounds, Knowledge, Skills, and Development Activities:

| 1 INTRODUCTION.................................................................................................................
1                                                                                | 1 INTRODUCTION................................................................................................................. 1                                                                                |
| 2 REPORTING CONVENTIONS.......................................................................................... 2                                                                                | 2 REPORTING CONVENTIONS.......................................................................................... 2                                                                                | 2 REPORTING CONVENTIONS.......................................................................................... 2                                                                                |
| 3 PROFESSIONAL DEMOGRAPHICS............................................................................... 3                                                                                | 3 PROFESSIONAL DEMOGRAPHICS............................................................................... 3                                                                                | 3 PROFESSIONAL DEMOGRAPHICS...............................................................................

The Federal Cybersecurity Awareness Workforce_ Professional Backgrounds, Knowledge, Skills, and Development Activities


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Supply Chain Risk Management?

[Assistant]
According to Summary of NIST SP 800-53, Revision 4_ Security and Privacy Controls for Federal Information Systems and Organizations:

SP 800-53 Revision 4 has been updated to reflect the evolving technology and threat space. Example areas include issues particular to mobile and cloud computing; insider threats; applications security; supply chain risks; advanced persistent threat; and trustworthiness, assurance, and resilience of information systems. The revision also contains a new appendix of privacy controls, and related implementation guidance (Appendix J), based on the Fair Information Practice Principles (FIPPs), a widely accepted framework of defining principles to be used in the evaluation and consideration of systems, processes, or programs that affect individual privacy.

Summary of NIST SP 800-53, Revision 4_ Security and Privacy Controls for Federal Information Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Access Control?

[Assistant]
According to Validating the Integrity of Computing Devices:

| 4.3                                                                                | Supporting Platform Integrity Validation Systems......................................................24                  | Supporting Platform Integrity Validation Systems......................................................24                           |    |
|------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------|----|
|                                                                                | 4.3.1                                                                                | Host Integrity at Runtime and Start-up Attestation Certificate Authority (HIRS ACA)24                                              |    |
|                                                                                | 4.3.2                                                                                | Network Boot Services ............................................................................................... | 26 |
|                                                                                | 4.3.3                                                                                | Platform Manifest Correlation System.......................................................................

Validating the Integrity of Computing Devices


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Access Control?

[Assistant]
According to Multi-Factor Authentication for Criminal Justice Information Systems_ Implementation Considerations for Protecting Criminal Justice Information:

...........13                       |
| 3.2.1. MFA Users ..................................................................................................................................13 |
| 3.2.2.
IT Support Staff...........................................................................................................................14  |
| 3.2.3. Other Agencies ...........................................................................................................................14   |
| 3.2.4. Procurement Teams...................................................................................................................14         |
| 3.2.5. Compliance Teams .....................................................................................................................15       |
| 3.2.6. Legal Teams................................................................................................................................15  |
| 3.2.7. Technology Vendors...................................................................................................................15        |
| 3.4.1. Local Agency MFA Architectures................................................................................................17               |
| 3.4.2. State MFA Deployments.............................................................................................................21           |
| 3.4.3. Implementing MFA with VPNs ...................................................................................................25               |
| 4. Key Takeaways.............................................................................................................................29       |
| References.......................................................................................................................................31   |
| Appendix A.

Multi-Factor Authentication for Criminal Justice Information Systems_ Implementation Considerations for Protecting Criminal Justice Information


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Awareness and Training?

[Assistant]
According to The Federal Cybersecurity Awareness Workforce_ Professional Backgrounds, Knowledge, Skills, and Development Activities:

## The Federal Cybersecurity Awareness Workforce

## The Federal Cybersecurity Awareness Workforce

Organizational cybersecurity awareness (hereafter shortened to 'security awareness') programs may experience a number of challenges, including lack of funding and staff with the appropriate knowledge and skills to manage an effective program. While prior surveys and research have examined programs in the private sector, there is little understanding of whether these findings also apply within the U.S. government. To address this gap and better understand the needs, challenges, practices, and necessary competencies of federal security awareness teams and programs, NIST conducted a research study that leveraged both qualitative and quantitative methodologies. This companion document to NISTIR 8420 'Federal Cybersecurity Awareness Programs: A Mixed Methods Research Study' reports on a subset of study results focused on identifying the current job classifications, roles, and desired knowledge and skills for security awareness professionals within the federal government. Insights gained from these results are informing guidance and other initiatives to aid federal organizations in building security awareness teams with the appropriate competencies. While focused on the U.S. government, findings may also have implications for organizational security awareness professionals in other sectors.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171 provide? (Part 3)

[Assistant]
efore  the  completion  of  such  companion  publications. Thus,  until  each  publication  is completed,  current  requirements,  guidelines,  and  procedures,  where  they  exist,  remain operative.
For planning and transition purposes, federal agencies may wish to closely follow the development of these new publications by NIST. Organizations are encouraged to review draft publications during the public comment periods and provide feedback to NIST. Many NIST publications, other than the ones noted above, are available at https://csrc.nist.gov/publications. ## Comments on this publication may be submitted to:

National Institute of Standards and Technology Attn: Computer Security Division, Information Technology Laboratory 100 Bureau Drive (Mail Stop 8930) Gaithersburg, MD 20899-8930

Email: sec-cert@nist.gov

All comments are subject to release under the Freedom of Information Act (FOIA) [FOIA96]. \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

## Reports on Computer Systems Technology

The National Institute of Standards and Technology (NIST) Information Technology Laboratory (ITL) promotes the U.S. economy and public welfare by providing technical leadership for the Nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology (IT). ITL's responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the costeffective security of other than national security-related information in federal information systems.

Audit and Accountability
System and Information Integrity
Security Assessment
Media Protection
Identification and Authentication
Awareness and Training
System and Communications Protection
Access Control
Planning
Incident Response
Risk Assessment
Personnel Security
System and Services Acquisition
Supply Chain Risk Management
Maintenance
Physical Protection
Configuration Management


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Workshop on Enhancing Security of Devices and Components Across the Supply Chain provide? (Part 5)

[Assistant]
.................................4 |
| 2.2.1. Speaker Viewpoints......................................................................................................................5       |
| 2.2.2.
Key Highlights ...............................................................................................................................6 |
| 2.3.1. Speaker Viewpoints......................................................................................................................6       |
| 2.3.2. Key Highlights ...............................................................................................................................8 |
| 2.4.1. Speaker Viewpoints......................................................................................................................9       |
| 2.4.2. Key Highlights .............................................................................................................................11  |
| 2.5.1. Speaker Viewpoints....................................................................................................................11        |
| 2.5.2. Key Highlights .............................................................................................................................13  |
| 3. Summary and Road Ahead ...........................................................................................................15                |
| Appendix A. Workshop Agenda........................................................................................................16                  |
| List of Figures                                                                                |
| Fig. 1. Components for securing microelectronics................................................................................1                      |
| Fig. 2.

Workshop on Enhancing Security of Devices and Components Across the Supply Chain


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Addressing Visibility Challenges with TLS 1.3 within the Enterprise_ High-Level Document provide? (Part 10)

[Assistant]
| DigiCert .........................................................................................................................
7                                                                            |
|     | 4.1.3                                                                                | F5 ................................................................................................................................... 8                                                                        |
|     | 4.1.4                                                                                | JPMorgan Chase &Co................................................................................................... 8                                                                                |
|     | 4.1.5                                                                                | Mira Security ................................................................................................................. 8                                                                               |
|     | 4.1.6                                                                                | NETSCOUT .....................................................................................................................

Addressing Visibility Challenges with TLS 1.3 within the Enterprise_ High-Level Document


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Secure Software Development Practices for Generative AI and Dual-Use Foundation Models_ An SSDF Community Profile provide? (Part 6)

[Assistant]
Examples and Informative References to add to this document. All feedback should be sent to ssdf@nist.gov. ## Trademark Information

All registered trademarks belong to their respective organizations.
## Acknowledgments

The authors thank all of the organizations and individuals who provided numerous public comments and other thoughtful input for this publication. In response to Executive Order (EO) 14110, Safe, Secure, and Trustworthy Development and Use of Artificial Intelligence , NIST held a January 2024 workshop, where speakers and attendees shared suggestions for adapting secure software development practices and tasks to accommodate the unique aspects of AI model development and the software that leverages them. The authors also thank all of their NIST colleagues and external experts who provided suggestions and feedback that helped shape this publication. 1  The terms 'producer' and 'acquirer' were selected for consistency with the Audience statement in NIST SP 800-218. ## Patent Disclosure Notice

NOTICE: ITL has requested that holders of patent claims whose use may be required for compliance with the guidance or requirements of this publication disclose such patent claims to ITL. However, holders of patents are not obligated to respond to ITL calls for patents and ITL has not undertaken a patent search in order to identify which, if any, patents may apply to this publication. As of the date of publication and following call(s) for the identification of patent claims whose use may be required for compliance with the guidance or requirements of this publication, no such patent claims have been identified to ITL. No representation is made or implied by ITL that licenses are not required to avoid patent infringement in the use of this publication. ## Table of Contents

| 1.

Secure Software Development Practices for Generative AI and Dual-Use Foundation Models_ An SSDF Community Profile


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Planning?

[Assistant]
According to Cryptographic Module Validation Program (CMVP) Security Policy Requirements_ CMVP Validation Authority Updates to ISO_IEC 24759 and ISO_IEC 19790 Anne:

There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may be used by federal agencies even before the completion of such companion publications. Thus, until each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning and transition purposes, federal agencies may wish to closely follow the development of these new publications by NIST.

Cryptographic Module Validation Program (CMVP) Security Policy Requirements_ CMVP Validation Authority Updates to ISO_IEC 24759 and ISO_IEC 19790 Anne


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Addressing Visibility Challenges with TLS 1.3 within the Enterprise_ High-Level Document provide? (Part 2)

[Assistant]
Jake Wills US Bank Corporation

Jane Gilbert D'Nan Godfrey Thales TCT

Dean Cocklin Avesta Hojjati DigiCert

*Contributed while a NIST Employee

David Wells

Final September 2025

<!-- image -->

U.S.
Department of Commerce Howard Lutnick, Secretary

National Institute of Standards and Technology

Craig Burkhardt, Acting Under Secretary of Commerce for Standards and Technology and Acting NIST Director

## DISCLAIMER

Certain commercial en��es, equipment, products, or materials may be iden�fied by name or company logo or other insignia in order to acknowledge their par�cipa�on in this collabora�on or to describe an experimental procedure or concept adequately. Such iden�fica�on is not intended to imply special status or rela�onship with NIST or recommenda�on or endorsement by NIST or NCCoE; neither is it intended to imply that the en��es, equipment, products, or materials are necessarily the best available fo r the purpose. While NIST and the NCCoE address goals of improving management of cybersecurity and privacy risk through outreach and applica�on of standards and best prac�ces, it is the stakeholder's responsibility to fully perform a risk assessment to include the current threat, vulnerabili�es, likelihood of a compromise , and the impact should the threat be realized before adop�ng cybersecurity measures such as this recommenda�on. Na�onal Ins�tute of Standards and Technology Special Publica�on 1800 -37 , Natl. Inst. Stand. Technol. Spec. Publ. 1800 -37 , 63 pages, ( September 2025 ), CODEN: NSPUE2

## NATIONAL CYBERSECURITY CENTER OF EXCELLENCE

The Na�onal Cybersecurity Center of Excellence (NCCoE), a part of the Na�onal Ins�tute of Standards and Technology (NIST), is a collabora�ve hub where industry organiza�ons, government agencies, and academic ins�tu�ons work together to address businesses' most pressing cybersecurity issues.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 1 require for Awareness and Training?

[Assistant]
According to IoT Non-Technical Supporting Capability Core Baseline:

To complement the core baseline from NISTIR 8259A, the IoT non-technical supporting capability core baseline is a set of actions performed by manufacturers and/or designated supporting third parties (called supporting parties ). These actions will help others (e.g., customers, end-users) use the cybersecurity capabilities of IoT devices, and support the on-going cybersecurity of the IoT device and the system and networks the device connects to (the digital ecosystem). Providing such non-technical cybersecurity support through educational materials or other types of non-technical tools and actions can benefit the entire IoT device ecosystem and allow manufacturers to better support the cybersecurity of devices throughout the entire device lifecycle. Both device cybersecurity capabilities and non-technical supporting capabilities are vital to customers' abilities to achieve their needs and goals. Similar to the IoT device cybersecurity capability core baseline in NISTIR 8259A, this IoT non-technical supporting capability core baseline is intended to give organizations a starting point for establishing nontechnical actions to support IoT device cybersecurity risk management. Specifically, this publication describes four recommended non-technical supporting capabilities related to the full lifecycle of cybersecurity management that manufacturers should  implement to support the IoT devices they make for the full length of life: 1) Documentation; 2) Information and Query Reception; 3) Information Dissemination; and 4) Education and Awareness. Education and Awareness provides the educational content required to support customers and others in the secure use and safeguarding of IoT devices and associated systems, software, and hardware.

IoT Non-Technical Supporting Capability Core Baseline


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Access Control?

[Assistant]
According to Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations:

.......24                         |
| 2.3.2. Level 1 -Enterprise...................................................................................................................27         |
| 2.3.3.
Level 2 -Mission and Business Process....................................................................................30                      |
| 2.3.4. Level 3 -Operational................................................................................................................32           |
| 2.3.5. C-SCRM PMO..............................................................................................................................33       |
| Critical Success Factors...................................................................................................................37           |
| 3. |
| 3.1.2. The Role of C-SCRM in the Acquisition Process .........................................................................40                        |
| 3.4.1. Foundational Practices ...............................................................................................................46         |

Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Risk Assessment?

[Assistant]
According to Approaches and Challenges of Federal Cybersecurity Awareness Programs:

Participant quotes from the focus groups and open-ended questions in the survey provide insights into the range of responses. Participants' comments reflect motivators for regularly updating annual training, such as addressing emerging threats and organizational feedback:

'For me, usually my first go-to is what is CISA [Cybersecurity and Infrastructure Security Agency] about, right, because they kind of got the scope on the entire .gov space. At the same time, they work with industry as well. So, anything that they are bringing to light, I try to emulate that and try to kind of go, 'Hey, this is something that CISA's saying is important as a threat. You, as an individual, need to know that this is a threat. This way you are aware of what's going on the other way'.' (N10)

'We annually meet with [an external organization's] computer security incident response center, and I get them to produce a list of user-induced or incidents that could have been prevented by users, kind of by category. And I take a compilation of those, the most recent Verizon data breach report, and the IBM threat report and kind of take a mix of the top threats from those three sources and kind of whittle them down into about eight or so topics for the cybersecurity awareness training.' (D06)

Approaches and Challenges of Federal Cybersecurity Awareness Programs


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for Risk Assessment?

[Assistant]
According to Assessing Enhanced Security Requirements for Controlled Unclassified Information:

| ASSESSMENT PROCEDURES................................................................................................................
| 3   |
| 2.2                                                                                | ASSURANCE CASES.............................................................................................................................. | 4   |
| CHAPTER THREE THE PROCEDURES............................................................................................... | CHAPTER THREE THE PROCEDURES............................................................................................... | 7   |
| 3.1                                                                                | ACCESSCONTROL ............................................................................................................................... | 8   |
| 3.2                                                                                | AWARENESSANDTRAINING............................................................................................................... | 9   |
| 3.3                                                                                | AUDIT ANDACCOUNTABILITY........................................................................................................... | 10  |
| 3.4                                                                                | CONFIGURATION MANAGEMENT.....................................................................................................

Assessing Enhanced Security Requirements for Controlled Unclassified Information


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Validating the Integrity of Computing Devices provide? (Part 3)

[Assistant]
re authorized and expected. Provenance is the comprehensive history of a device throughout the entire life cycle from creation to ownership, including changes made within the device or its components.
Assuming without verification that all acquired computing devices are genuine and unmodified increases the risk that a compromise will affect products in an organization's supply chain and go unnoticed at the time, which in turn increases risks to customers and end users. Organizations currently lack the ability to cost effectively distinguish trustworthy products from others, meaning they are genuine and have not been inappropriately altered. Having this ability is a critical foundation of cyber supply chain risk management (C-SCRM). C-SCRM is the process of identifying, assessing, and mitigating risks associated with the distributed and interconnected nature of supply chains. C-SCRM presents challenges to many industries and sectors, requiring a coordinated set of technical and procedural controls to mitigate risks throughout the design, manufacturing, acquisition, provisioning, operations, and decommissioning stages of a product's life. ## This practice guide can help your organization:

-  Avoid using untrustworthy technology components in your products
-  Enable your customers to readily verify that your products are genuine
-  Prevent compromises of your own information and systems caused by acquiring and using compromised technology products

## SOLUTION

To address these challenges, the NCCoE collaborated with technology vendors to develop a prototype implementation in harmony with the National Initiative for Improving Cybersecurity in Supply Chains (NIICS), which emphasizes tools, technologies, and guidance focused on the developers and providers of technology. NIICS' mission is to help organizations build, evaluate, and assess the cybersecurity of

products and services in their supply chains.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Physical Protection?

[Assistant]
According to Digital Identity Guidelines_ Identity Proofing and Enrollment:

The Information Technology Laboratory (ITL) at the National Institute of Standards and
Technology (NIST) promotes the U.S. economy and public welfare by providing technical
leadership for the Nation’s measurement and standards infrastructure. ITL develops
tests, test methods, reference data, proof of concept implementations, and technical
analyses to advance the development and productive use of information technology.
ITL’s responsibilities include the development of management, administrative, technical,
and physical standards and guidelines for the cost-effective security and privacy of other
than national security-related information in federal information systems. The Special
Publication 800-series reports on ITL’s research, guidelines, and outreach efforts in
information system security, and its collaborative activities with industry, government,
and academic organizations.

3.10. Requirements for Notifications of Identity Proofing . . . . . . . . . . . .

3.13. Requirements for the Validation of Physical Evidence . . . . . . . . . . .

Digital Identity Guidelines_ Identity Proofing and Enrollment


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Cryptographic Module Validation Program (CMVP) Security Policy Requirements_ CMVP Validation Authority Updates to ISO_IEC 24759 and ISO_IEC 19790 Anne provide? (Part 7)

[Assistant]
............................................24                  |
| Appendix B. List of Symbols, Abbreviations, and Acronyms...........................................25                  | Appendix B.
List of Symbols, Abbreviations, and Acronyms...........................................25                                   |

## Introduction

## Scope

This document specifies the Cryptographic Module Validation Program (CMVP) modifications of the methods to be used by a Cryptographic and Security Testing Laboratory (CSTL) to demonstrate conformance. This document also specifies the modification of documentation for providing evidence to demonstrate conformity. Unless otherwise specified in this document, the test requirements are specified in ISO/IEC 19790 Annex B and ISO/IEC 24759 Section 6.14. ## Normative References

This section identifies the normative references cited as ISO/IEC 19790 and ISO/IEC 24759. The specific editions to be used are ISO/IEC 19790:2012 and ISO/IEC 24759:2017. The version 19790:2012 referenced here includes the corrections made in 2015. National Institute of Standards and Technology (2019) Security Requirements for Cryptographic Modules. (U.S. Department of Commerce, Washington, DC), Federal Information Processing Standards Publication (FIPS) 140-3. https://doi.org/10.6028/NIST.FIPS.140-3

## Document Organization

## General

Section 3.1 of this document specifies any modifications to ISO/IEC 19790 Annex B and ISO/IEC 24759 Section 6.14. Section 3.2 identifies any additional requirements for the security policy that are documented in other publications. Section 3.3 describes the security policy structure and how the requirements in Sections 3.1 and 3.2 map into that structure. The requirements statements are presented as originally written in ISO/IEC 19790 Annex B and ISO/IEC 24759. These often include acronyms and abbreviations spelled out earlier within those documents.