[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Communications Protection?

[Assistant]
According to Audit and Evaluation of Computer Security II_ System Vulnerabilities and Controls:

| 4-15      |
| 5.6         | System Testing                                                                                | 4-15      |
| 5.7 6.
| Conversion                                                                                | 4-16      |
|             | INTERNAL CONTROL                                                                               | 4-16      |
| 6.1         | General                                                                                | 4-16 4-16 |
| 6.2         | Control Policies                                                                               | 4-17      |
| 6.3 7. | Control Procedures HARDWARE SUPPORT                                                            | 4-17      |
| 7.1         | General                                                                                | 4-17      |
| 7.2         | Introduction                                                                                | 4-17      |
| 7.3         | Control Policies                                                                               | 4-18      |
|             | BIBLIOGRAPHY                                                                                | 4-19      |
| 8. |                                                                                |           |
| PART V:     | SESSION 3 - MANAGERIAL AND ORGANIZATIONAL VULNERABILITIES AND CONTROLS - LINE LEVEL - GENERAL  | 5-1       |
| EDITOR'S 1. | NOTE INTRODUCTION                                                                              | 5-2 5-3   |
| 2.

Audit and Evaluation of Computer Security II_ System Vulnerabilities and Controls


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Planning?

[Assistant]
According to Workshop on Enhancing Security of Devices and Components Across the Supply Chain:

There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may be used by federal agencies even before the completion of such companion publications. Thus, until each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning and transition purposes, federal agencies may wish to closely follow the development of these new publications by NIST.

security architecture during the specification and planning phases. The dynamic nature of the IC development process may impact the metrics that need to be developed, and a security metric that is suitable for the register-transfer level (RTL) may not be appropriate at the gate or physical level. He noted that time-to-market constraints still run on an approximately six- to nine-month cycle, but complexity has increased, leading to the need for automation in security, reliability, and testing. This increased complexity also increases the number of assets to protect and the number of potential vulnerabilities to mitigate. Regardless of what security techniques and associated security metrics are used early in the development life cycle (i.e., pre-silicon), verification is still needed during the physical layout and post-silicon stages. Finally, he identified the need for the continued development of security solutions at the material, physical, and device levels of semiconductors.

Workshop on Enhancing Security of Devices and Components Across the Supply Chain


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Audit and Accountability?

[Assistant]
According to Recommendation for Pair-Wise Key-Establishment Using Integer Factorization Cryptography:

|    | 8.2 KAS1 Key Agreement...................................................................................................... | 75                                                                                |
|----|--------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------|
|    | 8.2.1 KAS1 Assumptions................................................................................................ | 75                                                                                |
|    | 8.2.2 KAS1-basic ............................................................................................................ | 76                                                                                |
|    | 8.2.3 KAS1 Key Confirmation........................................................................................ | 78                                                                                |
|    | 8.2.3.1 KAS1                                                                                | Key-Confirmation Components...................................................... 78               |
|    | 8.2.3.2                                                                                | KAS1-Party_V-confirmation ..................................................................... 78 |
|    | 8.3 KAS2 Key Agreement......................................................................................................

Recommendation for Pair-Wise Key-Establishment Using Integer Factorization Cryptography


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Services Acquisition?

[Assistant]
According to Federal Cybersecurity Role-Based Training Approaches, Successes, and Challenges:

0B]. In the focus groups, we found that security awareness professionals were often also assigned responsibilities for role-based training activities, for which they identified significant challenges.
However, at the time, no one had taken a broader look across federal organizations to see how RBT activities were implemented and what issues organizations were experiencing. This lack of understanding hindered the development of improvements and resources for federal RBT.

Federal Cybersecurity Role-Based Training Approaches, Successes, and Challenges


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Services Acquisition?

[Assistant]
According to Digital Identity Guidelines:

There may be references in this publication to other publications currently under
development by NIST in accordance with its assigned statutory responsibilities. The
information in this publication, including concepts and methodologies, may be used by
federal agencies even before the completion of such companion publications. Thus, until
each publication is completed, current requirements, guidelines, and procedures, where
they exist, remain operative. For planning and transition purposes, federal agencies may
wish to closely follow the development of these new publications by NIST. These guidelines cover the identity proofing, authentication, and federation of users
(e.g., employees, contractors, or private individuals) who interact with government
information systems over networks. They define technical requirements in each of
the areas of identity proofing, enrollment, authenticators, management processes,
authentication protocols, federation, and related assertions. They also offer technical
recommendations and other informative text as helpful suggestions. The guidelines are
not intended to constrain the development or use of standards outside of this purpose. This publication supersedes NIST Special Publication (SP) 800-63-3. The Information Technology Laboratory (ITL) at the National Institute of Standards and
Technology (NIST) promotes the U.S. economy and public welfare by providing technical
leadership for the Nation’s measurement and standards infrastructure. ITL develops
tests, test methods, reference data, proof of concept implementations, and technical
analyses to advance the development and productive use of information technology. ITL’s responsibilities include the development of management, administrative, technical,
and physical standards and guidelines for the cost-effective security and privacy of other
than national security-related information in federal information systems.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for Incident Response?

[Assistant]
According to Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171:

| CHAPTERONE INTRODUCTION...................................................................................................... | CHAPTERONE INTRODUCTION...................................................................................................... |
|--------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------|
| 1.1 PURPOSEANDAPPLICABILITY                                                                                | ................................................................................................... 3                                            |
| 1.2 TARGET AUDIENCE                                                                                | .................................................................................................................. 4                             |
| 1.3 ORGANIZATIONOF THIS SPECIAL PUBLICATION                                                                                | .......................................................................... 4                                                                     |
| CHAPTERTWO THE FUNDAMENTALS............................................................................................ 5                        | CHAPTERTWO THE FUNDAMENTALS............................................................................................ 5                        |
| 2.1 DEVELOPMENTAPPROACH ......................................................................................................

Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Maintenance?

[Assistant]
According to Protecting Information and System Integrity in Industrial Control System Environments_ Cybersecurity for the Manufacturing Sector:

| 5.2.1   | Scenario 1: Protect Host from Malware Infection via USB..................................... | 37     |
|---------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------|
| 5.2.2   | Scenario 2: Protect Host from Malware Infection via Network Vector.................. | 37     |
| 5.2.3   | Scenario 3: Protect Host from Malware via Remote Access Connections ............. | 39     |
| 5.2.4   | Scenario 4: Protect Host from Unauthorized Application Installation ................... | 40     |
| 5.2.5   | Scenario 5: Protect from Unauthorized Addition of a Device ................................ | 42     |
| 5.2.6   | Scenario 6: Detect Unauthorized Device-to-Device Communications................... | 43     |
| 5.2.7   | Scenario 7: Protect from Unauthorized Deletion of Files....................................... | 43     |
| 5.2.8   | Scenario 8: Detect Unauthorized Modification of PLC Logic.................................. | 45     |
| 5.2.9   | Scenario 9: Protect from Modification of Historian Data....................................... | 46     |
| 5.3.1   | PR.AC-1: Identities and Credentials are Issued, Managed, Verified, Revoked, and Audited for Authorized Devices, Users, and Processes........................ | 50     |
| 5.3.2   | PR.AC-3: Remote Access is Managed ..................................................................... | 50     |
| 5.3.3   | PR.AC-4: Access Permissions and Authorizations are Managed, Incorporating the Principles of Least Privilege and Separation of Duties .........................

Protecting Information and System Integrity in Industrial Control System Environments_ Cybersecurity for the Manufacturing Sector


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Risk Assessment?

[Assistant]
According to Transitioning to the Security Content Automation Protocol (SCAP) Version 2:

|
| 3.3 Adoption of International Standards                                                                                | in SCAP v2 ............................................
6                                                                    |
| 4 SCAP v2 Development                                                                                | Plan..................................................................................7                                      |
| List of Appendices                                                                                | List of Appendices                                                                                |
| Appendix A-Applications of the SCAP 2.0 Architecture.........................................9                          | Appendix A-Applications of the SCAP 2.0 Architecture.........................................9                               |
| A.1 Vulnerability Assessment................................................................................ | 9                                                                                |
| A.2 Configuration Setting Checklist                                                                                | Assessment ................................................

Transitioning to the Security Content Automation Protocol (SCAP) Version 2


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Supply Chain Risk Management?

[Assistant]
According to Digital Identity Guidelines_ Identity Proofing and Enrollment:

5. The CSP  SHALL  assess risks associated with its use of third-party services and apply
appropriate controls, as provided in the [SP800-161] Cybersecurity Supply Chain
Risk Management Practices for Systems and Organizations.

[SP800-161] Boyen H, Smith A, Bartol N, Winkler K, Holbrook A (2022) Cybersecurity
Supply Chain Risk Management Practices for Systems and Organizations. (National
Institute of Standards and Technology, Gaithersburg, MD) NIST Special Publication (SP)
NIST SP 800-161r1. https://doi.org/10.6028/NIST.SP.800-161r1

Digital Identity Guidelines_ Identity Proofing and Enrollment


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Identification and Authentication?

[Assistant]
According to Guide to Auditing for Controls and Security_ A System Development Life Cycle Approach:

| 3.4.5.1.1 Mission Impact/Strategic Value/Organization | 55 | | | (Business) Criticality and Sensitivity Factors 3.4.5.2 Level II: | (Business) Criticality and Sensitivity Factors 3.4.5.2 Level II: | (Business) Criticality and Sensitivity Factors 3.4.5.2 Level II: | | | | | | | 56 | | | 3.4.5.2.1 | 3.4.5.2.1 | System Size/Scale/Complexity | 56 | | | 3.4.5.2.2 | 3.4.5.2.2 | System Environment/Stability | 57 | | | 3.4.5.2.3 | 3.4.5.2.3 | Reliability/Integrity | 58 | | | 3.4.5.2.4 | 3.4.5.2.4 | Technology Integration | 59 | | 3.5 | RISK SCORING -- APPLICATION OF THE WORK PRIORITY SCHEME | RISK SCORING -- APPLICATION OF THE WORK PRIORITY SCHEME | RISK SCORING -- APPLICATION OF THE WORK PRIORITY SCHEME | 59 | | | 3.5.1 Implementation of the Scheme | 3.5.1 Implementation of the Scheme | 3.5.1 Implementation of the Scheme | 59 | | | 3.5.2 | A Simple Scoring Approach | A Simple Scoring Approach | 60 | | | 3.5.3 | A Detailed Scoring Approach | A Detailed Scoring Approach | 60 | | | 3.5.4 | Discretionary Audits | Discretionary Audits | 60 | | 3.6 | USES OF THE WORK PRIORITY SCHEME | USES

Guide to Auditing for Controls and Security_ A System Development Life Cycle Approach


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AU.L2-3.3.2 (NIST 3.3.2)?

[Assistant]
According to Digital Identity Guidelines_ Identity Proofing and Enrollment:

3.3.2. 3.3.2), and the purposes for collecting, using, and retaining biometrics
(see Sec. 3.3.2.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for Configuration Management?

[Assistant]
According to Assessing Enhanced Security Requirements for Controlled Unclassified Information:

| ASSESSMENT PROCEDURES................................................................................................................
| 3   |
| 2.2                                                                                | ASSURANCE CASES.............................................................................................................................. | 4   |
| CHAPTER THREE THE PROCEDURES............................................................................................... | CHAPTER THREE THE PROCEDURES............................................................................................... | 7   |
| 3.1                                                                                | ACCESSCONTROL ............................................................................................................................... | 8   |
| 3.2                                                                                | AWARENESSANDTRAINING............................................................................................................... | 9   |
| 3.3                                                                                | AUDIT ANDACCOUNTABILITY........................................................................................................... | 10  |
| 3.4                                                                                | CONFIGURATION MANAGEMENT.....................................................................................................

Assessing Enhanced Security Requirements for Controlled Unclassified Information


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AT.L2-3.2.4 (NIST 3.2.4)?

[Assistant]
According to Digital Identity Guidelines:

3.2.4. 3.2.4. 3.2.4) do not differentiate between identity
proofing, authentication, and federation risks, the selected initial xALs may still be
different.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Assessing Enhanced Security Requirements for Controlled Unclassified Information provide? (Part 3)

[Assistant]
may wish to closely follow the development of these new publications by NIST. Organizations are encouraged to review draft publications during the public comment periods and provide feedback to NIST.
Many NIST publications, other than the ones noted above, are available at https://csrc.nist.gov/publications. Submit comments on this publication to: sec-cert@nist.gov

National Institute of Standards and Technology Attn: Computer Security Division, Information Technology Laboratory 100 Bureau Drive (Mail Stop 8930) Gaithersburg, MD 20899-8930

All comments are subject to release under the Freedom of Information Act (FOIA) [FOIA96]. \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

## Reports on Computer Systems Technology

The NIST Information Technology Laboratory (ITL) promotes the U.S. economy and public welfare by providing technical leadership for the Nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, implementations, proofs of concept, and technical analyses to advance the development and productive use of information technology (IT). ITL's responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security of other than national security-related information in federal information systems. The Special Publication 800-series reports on ITL's research, guidelines, and outreach efforts in information systems security and privacy and its collaborative activities with industry, government, and academic organizations. ## Abstract

The protection of Controlled Unclassified Information (CUI) in nonfederal systems and organizations is important to federal agencies and can directly impact the ability of the Federal Government to successfully carry out its assigned missions and business operations.

Audit and Accountability
System and Information Integrity
Security Assessment
Media Protection
Identification and Authentication
Awareness and Training
System and Communications Protection
Access Control
Planning
Incident Response
Risk Assessment
Personnel Security
System and Services Acquisition
Supply Chain Risk Management
Maintenance
Physical Protection
Configuration Management


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 2 require for Risk Assessment?

[Assistant]
According to Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations:

| Table 1. Security Requirement Families .......................................................................................................4          |
|----------------------------------------------------------------------------------------------------------------------------------------------------------|
| Table 2. Security Control Tailoring Criteria.................................................................................................93          |
| Table 3. Access Control (AC) .......................................................................................................................93   |
| Table 4. Awareness and Training (AT).........................................................................................................94          |
| Table 5. Audit and Accountability (AU).......................................................................................................95          |
| Table 6. Assessment, Authorization, and Monitoring (CA).........................................................................95                       |
| Table 7. Configuration Management (CM).................................................................................................96                |
| Table 8. Contingency Planning (CP) ............................................................................................................96        |
| Table 9. Identification and Authentication (IA) ..........................................................................................97             |
| Table 10. Incident Response (IR).................................................................................................................98      |
| Table 11. Maintenance (MA) ......................................................................................................................98      |
| Table 12.

Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Guide for Developing Security Plans for Federal Information Systems provide? (Part 9)

[Assistant]
|
| 3.10 SYSTEM ENVIRONMENT .........................................................................................................
| 22                                                                                |
| 3.11 SYSTEM INTERCONNECTION/INFORMATION SHARING............................................................ | 23                                                                                |
| 3.12 LAWS, REGULATIONS, AND POLICIES AFFECTING THE SYSTEM............................................. | 23                                                                                |
| 3.13 SECURITY CONTROL SELECTION............................................................................................ | 24                                                                                |

v

| 3.14 MINIMUM SECURITY CONTROLS............................................................................................ | 24                                                                                |
|-----------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------|
| 3.15 COMPLETION AND APPROVAL DATES .................................................................................... | 26                                                                                |
| 3.16 ONGOING SYSTEM SECURITY PLAN MAINTENANCE ..............................................................

Guide for Developing Security Plans for Federal Information Systems


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does The Federal Cybersecurity Awareness Workforce_ Professional Backgrounds, Knowledge, Skills, and Development Activities provide? (Part 2)

[Assistant]
ory responsibilities. The information in this publication, including concepts and methodologies, may  be  used  by  federal  agencies  even  before  the  completion  of  such  companion  publications.
Thus,  until  each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning  and  transition  purposes,  federal  agencies  may  wish  to  closely  follow  the  development  of  these  new publications by NIST. Organizations are encouraged to review all draft publications during public comment periods and provide feedback to NIST. Many NIST cybersecurity publications, other than the ones noted above, are available at https://csrc.nist.gov/publications. \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

## Reports on Computer Systems Technology

The  Information  Technology  Laboratory  (ITL)  at  the  National  Institute  of  Standards  and Technology  (NIST)  promotes  the  U.S. economy  and  public  welfare  by  providing  technical leadership  for  the  Nation's  measurement  and  standards  infrastructure. ITL  develops  tests,  test methods, reference data, proof of concept implementations, and technical analyses to advance the development  and  productive  use  of  information  technology. ITL's  responsibilities  include  the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in federal information systems. ## Abstract

Organizational cybersecurity awareness (hereafter shortened to 'security awareness') programs may experience a number of challenges, including lack of funding and staff with the appropriate knowledge and skills to manage an effective program.

The Federal Cybersecurity Awareness Workforce_ Professional Backgrounds, Knowledge, Skills, and Development Activities

Audit and Accountability
System and Information Integrity
Media Protection
Identification and Authentication
Awareness and Training
System and Communications Protection
Access Control
Planning
Incident Response
Risk Assessment
Personnel Security
System and Services Acquisition
Supply Chain Risk Management
Maintenance
Physical Protection
Security Assessment


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Planning for a Zero Trust Architecture_ A Planning Guide for Federal Administrators provide? (Part 5)

[Assistant]
se IT infrastructure, this plan is called a zero trust architecture (ZTA). Enterprise administrators and system operators need to be involved in the planning and deployment for a ZTA to be successful.
ZTA planning requires input and analysis from system and workflow owners as well as professional security architects. Zero trust cannot be simply added onto an existing workflow but needs to be integrated into all aspects of the enterprise. This document introduces NIST Risk Management Framework (RMF) [2] concepts for administrators and operators who are in the process of migrating to a ZTA. The RMF lays out an approach that includes set of steps and tasks that is integrated into enterprise risk analysis, planning, development, and operations. Administrators who normally do not perform the steps and tasks detailed in the RMF may find that they will need to become familiar with them as they migrate to a ZTA. NIST Special Publication 800-207 [1] provides a conceptual framework for zero trust. While not comprehensive to all information technology this conceptual framework can be used as a tool to understand and develop a ZTA for an enterprise. This publication also provides an abstract logical architecture that can be used to map solutions and gaps upon. The abstract architecture is reproduced in figure 1 below. Figure 1: Core Zero Trust Logical Components

<!-- image -->

In this diagram, the components are depicted by logical function, and thus do not necessarily represent the composition of capabilities in operational systems. It is possible that multiple components may serve one logical function in a distributed manner, or a single solution may fulfill multiple logical roles. The roles are described in NIST SP 800-207, but are summarized below:

- Policy Engine (PE): The 'brain' of a ZTA implementation and the components that ultimately evaluate resource access requests.

Planning for a Zero Trust Architecture_ A Planning Guide for Federal Administrators


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Zero Trust Architecture provide? (Part 10)

[Assistant] | Implementación basada en enclaves....................................................................................................26 | | | 3.2.3 | Despliegue basado en un portal de recursos........................................................................................27 | | | 3.2.4 | Entorno de pruebas (sandbox) para aplicaciones en dispositivos........................................................28 | | | 3.3 | ALGORITMOS DE CONFIANZA .............................................................................................................................29 | | | 3.3.1 | Variaciones del algoritmo de confianza................................................................................................31 | | | 3.4 | COMPONENTES DE LA RED Y EL ENTORNO ............................................................................................................33 | | | 3.4.1 | Requisitos de la red para admitir una ZTA............................................................................................33 | | | ESCENARIOS DE IMPLEMENTACIÓN Y CASOS DE USO......................................................................................35 | ESCENARIOS DE IMPLEMENTACIÓN Y CASOS DE USO......................................................................................35 | | | 4.1 | E MPRESA CON INSTALACIONES SATÉLITES .............................................................................................................35 | | | 4.2 | E MPRESA MULTINUBE O NUBE A NUBE ................................................................................................................36 | | | 4.3 | E MPRESA CON SERVICIOS CONTRATADOS O ACCESO DE PERSONAL EXTERNO ................................................................37 | | | 4.4 | COLABORACIÓN MÁS ALLÁ DE LOS LÍMITES DE LA EMPRESA ......................................................................................39 | | | 4.5 | E MPRESA CON SERVICIOS ORIENTADOS AL PÚBLICO O AL CLIENTE ..............................................................................40 | | | 5 AMENAZAS ASOCIADAS A LA ARQUITECTURA DE CONFIANZA CERO..............................................................41 | 5 AMENAZAS ASOCIADAS A LA ARQUITECTURA DE CONFIANZA CERO..............................................................41 | | | 5.1 | S UBVERSIÓN DEL PROCESO DE DECISIONES DE LA ZTA............................................................................................41


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Maintenance?

[Assistant]
According to Status Report on the First Round of the Additional Digital Signature Schemes for the NIST Post-Quantum Cryptography Standardization Process:

Additional Information
Additional information about this publication is available at https://csrc.nist.gov/pubs/ir/8528/final,
including related content, potential updates, and document history.

3.7. RYDE . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

As with the PQC Standardization Process,  security was the most important factor when
evaluating the candidate signature algorithms. NIST intends to standardize post-quantum
signatures for use in a wide variety of internet protocols (e.g., TLS, SSH, IKE, IPsec, OCSP,
and DNSSEC) and other applications (e.g., certificate transparency, document signing, code
signing, and firmware updates).

Status Report on the First Round of the Additional Digital Signature Schemes for the NIST Post-Quantum Cryptography Standardization Process


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Transitioning to the Security Content Automation Protocol (SCAP) Version 2 provide? (Part 7)

[Assistant]
formats. SCAP tools use these formats to drive the collection and evaluation of posture information to determine if software vulnerabilities and misconfigurations exist on a specific managed endpoint.
By identifying endpoints with these problems, organizations can make informed decisions about how to remediate these issues. The initial release of SCAP v2, SCAP 2.0, will enhance the range of security automation capabilities supported by SCAP. This document presents a core SCAP 2.0 architecture and key components. In addition to the architecture, several design goals for SCAP v2 are identified that, when addressed, will increase the interoperability, modularity, and usability of SCAP tools. SCAP v2 implementations will enhance the assessment of network hygiene while providing a strong standardized foundation for more advanced cyber defense techniques. To support the SCAP 2.0 architecture and SCAP v2 design goals, some existing specifications used in SCAP 1.3 need to be revised, and new standards and extensions need to be defined. The remainder of this document is organized as follows:

- Section 2 presents a set of gaps in the existing SCAP v1 specifications;
- Section 3 presents SCAP v2 design goals, an initial draft SCAP architecture, and how existing international standards can be leveraged to support the SCAP v2 design goals;
- Section 4 describes a transition plan for migrating from SCAP v1 to SCAP v2; and
- The appendices include additional supporting information, including how SCAP v2 can support vulnerability and configuration setting management use cases. ## 2 Gaps in SCAP v1

SCAP was created as a NIST program in 2006, and the first SCAP v1 specification, SCAP 1.0, was published in 2009. Since this initial version, there have been three SCAP v1 revisions. The current revision, SCAP 1.3, was released in February 2018 as NIST Special Publication (SP) 800-126 Revision 3 [2].


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Digital Identity Guidelines provide? (Part 2)

[Assistant]
ral agencies even before the completion of such companion publications. Thus, until
each publication is completed, current requirements, guidelines, and procedures, where
they exist, remain operative.
For planning and transition purposes, federal agencies may
wish to closely follow the development of these new publications by NIST. Organizations are encouraged to review all draft publications during public comment
periods and provide feedback to NIST. Many NIST cybersecurity publications, other than
the ones noted above, are available at https://csrc.nist.gov/publications. Authority

This publication has been developed by NIST in accordance with its statutory
responsibilities under the Federal Information Security Modernization Act (FISMA)
of 2014, 44 U.S.C. § 3551 et seq., Public Law (P.L.) 113-283. NIST is responsible
for developing information security standards and guidelines, including minimum
requirements for federal information systems, but such standards and guidelines shall
not apply to national security systems without the express approval of appropriate
federal officials exercising policy authority over such systems. This guideline is consistent
with the requirements of the Office of Management and Budget (OMB) Circular A-130. Nothing in this publication should be taken to contradict the standards and guidelines
made mandatory and binding on federal agencies by the Secretary of Commerce
under statutory authority. Nor should these guidelines be interpreted as altering or
superseding the existing authorities of the Secretary of Commerce, Director of the
OMB, or any other federal official. This publication may be used by nongovernmental
organizations on a voluntary basis and is not subject to copyright in the United States. Attribution would, however, be appreciated by NIST.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Awareness and Training?

[Assistant]
According to Access Control on NoSQL Databases:

| Executive Summary............................................................................................................................1         |
|--------------------------------------------------------------------------------------------------------------------------------------------------------|
| 1. Introduction...................................................................................................................................2    |
| 2. Overview of NoSQL Database Systems............................................................................................3                     |
| 2.1.1. Key-Value Model ..........................................................................................................................3     |
| 2.1.2. Wide-Column Model....................................................................................................................4          |
| 2.1.3. Document Model..........................................................................................................................4       |
| 2.1.4. Graph Model.................................................................................................................................5   |
| 2.2.1. Flexible Data Model......................................................................................................................6      |
| 2.2.2. Horizontal Scalability....................................................................................................................6     |
| 2.2.3. Fast Queries..................................................................................................................................6 |
| 2.2.4. Security Deficiencies.....................................................................................................................7     |
| 3.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice MA.L2-3.7.2 (NIST 3.7.2)?

[Assistant]
According to Data Integrity_ Detecting and Responding to Ransomware and Other Destructive Events:

3.7.2 Resolution

The build has several layers of defense against this use case.

Data Integrity_ Detecting and Responding to Ransomware and Other Destructive Events


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Configuration Management?

[Assistant]
According to Report on the Design-A-Thon_ Designing Effective and Accessible Approaches for Digital Product Cybersecurity Education and Awareness:

s://doi.org/10.6028/NIST.IR.8425
- [4] Fagan M, Megas KN, Watrobski P, Marron J, Cuthill B, Lemire D, Hoehn B, Evans C (2024) Recommended Cybersecurity Requirements for Consumer-Grade Router Products.
(National Institute of Standards and Technology, Gaithersburg, MD), NIST Interagency or Internal Report (IR) NIST IR 8425A. https://doi.org/10.6028/NIST.IR.8425A
- [5] Fagan MJ, Megas KN, Marron JA, Brady KG, Jr., Cuthill BB, Herold R, Lemire D, Hoehn B (2021) IoT Device Cybersecurity Guidance for the Federal Government: IoT Device Cybersecurity Requirement Catalog. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) 800-213A. https://doi.org/10.6028/NIST.SP.800-213A
- [6] Zhang-Kennedy L and Chiasson S. (2021) "A systematic review of multimedia tools for cybersecurity awareness and education." ACM Computing Surveys (CSUR) 54, no. 1, pp. 139. https://dl.acm.org/doi/abs/10.1145/3427920
- [7] Plain Writing Act of 2010, Pub. L. No. 111-274, 124 Stat. 2861, 2862 and 2863 (2010) Available at https://www.govinfo.gov/app/details/PLAW-111publ274
- [8] Balash DG, Ali MM, Kanich C, and Aviv AJ. (2024) " I would not install an app with this label": Privacy Label Impact on Risk Perception and Willingness to Install {iOS} Apps. (USENIX, Berkeley, CA) Twentieth Symposium on Usable Privacy and Security (SOUPS 2024), pp. 413-432. Available at https://www.usenix.org/system/files/soups2024balash.pdf
- [9] Prange S, Knierim P, Knoll G, Dietz F, De Luca A, and Alt F. (2024) {'I} do (not) need that {Feature!'}-Understanding {Users'} Awareness and Control of Privacy Permissions on Android Smartphones. (USENIX, Berkeley, CA) Twentieth Symposium on Usable Privacy and Security (SOUPS 2024), pp. 453-472. Available at https://www.usenix.org/system/files/soups2024-prange.pdf
- [10] Chen X, Doublet S, Sergeeva A, Lenzini G, Koenig V, and Distler V.

Report on the Design-A-Thon_ Designing Effective and Accessible Approaches for Digital Product Cybersecurity Education and Awareness


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Guide to Malware Incident Prevention and Handling for Desktops and Laptops provide? (Part 6)

[Assistant]
---------------------------------------------------------|
| 1. Introduction ...................................................................................................................... | 1.
Introduction ...................................................................................................................... | 1. Introduction ......................................................................................................................

Guide to Malware Incident Prevention and Handling for Desktops and Laptops


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 1 require for Security Assessment?

IoT Non-Technical Supporting Capability Core Baseline


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What guidance does Access Control on NoSQL Databases provide?

[Assistant]
<!-- image -->

## NIST Internal Report NIST IR 8504

## Access Control on NoSQL Databases

Vincent C. Hu

This publication is available free of charge from: https://doi.org/10.6028/NIST.IR.8504

<!-- image -->

## NIST Internal Report

## NIST IR 8504

## Access Control on NoSQL Databases

Vincent C. Hu Computer Security Division Information Technology Laboratory

This publication is available free of charge from: https://doi.org/10.6028/NIST.IR.8504

May 2024

<!-- image -->

National Institute of Standards and Technology Laurie E. Locascio, NIST Director and Under Secretary of Commerce for Standards and Technology

Certain equipment, instruments, software, or materials, commercial or non-commercial, are identified in this paper in order to specify the experimental procedure adequately. Such identification does not imply recommendation or endorsement of any product or service by NIST, nor does it imply that the materials or equipment identified are necessarily the best available for the purpose. There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may be used by federal agencies even before the completion of such companion publications. Thus, until each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning and transition purposes, federal agencies may wish to closely follow the development of these new publications by NIST. Organizations are encouraged to review all draft publications during public comment periods and provide feedback to NIST. Many NIST cybersecurity publications, other than the ones noted above, are available at https://csrc.nist.gov/publications.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Recommendations for Federal Vulnerability Disclosure Guidelines provide? (Part 9)

[Assistant]
.....11                                                |                                                                                |
| 2.7.1.
Determine                                                                                | Whether Public Disclosure is Warranted ................................................11                                            |                                                                                |
| 2.7.2. Produce                                                                                | Advisory ....................................................................................................12                      |                                                                                |
| 2.7.3.

Recommendations for Federal Vulnerability Disclosure Guidelines


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Identification and Authentication?

[Assistant]
According to Guide to a Secure Enterprise Network Landscape:

| Executive Summary....................................................................................................................1 | Executive Summary....................................................................................................................1 | Executive Summary....................................................................................................................1 | |------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------| | Introduction .........................................................................................................................2 | Introduction .........................................................................................................................2 | | | Structural Implications of Drivers on the Enterprise Network Landscape .....................2 | Structural Implications of Drivers on the Enterprise Network Landscape .....................2 | | | Security Implications of Drivers on the Enterprise Network Landscape........................3 | Security Implications of Drivers on the Enterprise Network Landscape........................3 | | | The Need for a Security Guide......................................................................................3 | The Need for a Security Guide......................................................................................3 | | | Scope............................................................................................................................4 | Scope............................................................................................................................4 | | | Target Audience............................................................................................................4 | Target Audience............................................................................................................4 | | | Organization of This Document.....................................................................................4 | Organization of This Document.....................................................................................4 | | | Traditional Enterprise Network Access Approaches and Their Limitations .................5 | Traditional Enterprise Network Access Approaches and Their Limitations .................5 | Traditional Enterprise Network Access Approaches and Their Limitations .................5 | | Limitations of Network Perimeter-based Protections ....................................................5 | Limitations of Network Perimeter-based Protections ....................................................5 | | | Limitations of VPN-based Access .................................................................................5 | Limitations of VPN-based Access .................................................................................5 | | | 2.3 Limitation of MPLS Technology as Enterprise WANs.............................................................6 | 2.3 Limitation of MPLS Technology as Enterprise WANs.............................................................6 | 2.3 Limitation of MPLS Technology as Enterprise WANs.............................................................6 | | 2.4 Limitation of

Guide to a Secure Enterprise Network Landscape


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice PL.L2-3.15.5 (NIST 3.15.5)?

[Assistant]
According to Digital Identity Guidelines_ Identity Proofing and Enrollment:

3.15.5. 3.15.5.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does A Zero Trust Architecture Model for Access Control in Cloud-Native Applications in Multi-Cloud Environments provide? (Part 2)

[Assistant]
ts, guidelines, and procedures, where they exist, remain operative. For planning and transition purposes, federal agencies may wish to closely follow the development of these new publications by NIST.
Organizations are encouraged to review all draft publications during public comment periods and provide feedback to NIST. Many NIST cybersecurity publications, other than the ones noted above, are available at https://csrc.nist.gov/publications. ## Authority

This publication has been developed by NIST in accordance with its statutory responsibilities under the Federal Information Security Modernization Act (FISMA) of 2014, 44 U.S.C. § 3551 et seq., Public Law (P.L.) 113-283. NIST is responsible for developing information security standards and guidelines, including minimum requirements for federal information systems, but such standards and guidelines shall not apply to national security systems without the express approval of appropriate federal officials exercising policy authority over such systems. This guideline is consistent with the requirements of the Office of Management and Budget (OMB) Circular A-130. Nothing in this publication should be taken to contradict the standards and guidelines made mandatory and binding on federal agencies by the Secretary of Commerce under statutory authority. Nor should these guidelines be interpreted as altering or superseding the existing authorities of the Secretary of Commerce, Director of the OMB, or any other federal official. This publication may be used by nongovernmental organizations on a voluntary basis and is not subject to copyright in the United States. Attribution would, however, be appreciated by NIST.

A Zero Trust Architecture Model for Access Control in Cloud-Native Applications in Multi-Cloud Environments


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Physical Protection?

[Assistant]
According to Workshop on Enhancing Security of Devices and Components Across the Supply Chain:

The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the US economy and public welfare by providing technical leadership for the Nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology. ITL's responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in federal information systems.

These activities range from physical protection mechanisms (e.g., tamper-resistant packaging) to strong encryption protocols to safeguard data. Secure boot processes ensure that only verified firmware runs, and maintaining supply chain integrity through verification and audits prevents counterfeit components. Life cycle management includes secure provisioning, updates, and end-of-life processes that are complemented by rigorous security testing and compliance with regulatory standards. Educating users on secure practices and continuously improving security measures further fortifies defenses against evolving threats and ensures that semiconductor devices operate securely throughout their life cycle.

The National Strategy on Microelectronics Research has emphasized the prioritization of hardware integrity and security. In response, NIST convened its inaugural workshop, 'Enhancing Security of Devices and Components Across the Supply Chain' 1 on February 27, 2024, at the National Cybersecurity Center of Excellence (NCCoE) facility. At this workshop,

Workshop on Enhancing Security of Devices and Components Across the Supply Chain


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AC.L2-3.1.1 (NIST 3.1.1)?

[Assistant]
According to Audit and Evaluation of Computer Security II_ System Vulnerabilities and Controls:

3.1.1 Functional Responsibilities                                                             | 4-9       |
|      |                | Control Requirements                                                                                | 4-9 4-9   |
|      | 3. 3.1.1                                                  | Vul nerabl llties of Data and Prog ranis •••••••••••«••«•••••••«•••••••••       | 6~5       |
|               |                                                        | Vulnerabilities of Terminals                                                    | 6-7       |
|               | 3. 3.1.1 The Data Base Management System as as Operating System | Implementation Issues relevant to Secure Data Management Systems 3.

Audit and Evaluation of Computer Security II_ System Vulnerabilities and Controls


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 2 require for Risk Assessment?

[Assistant]
According to Profile of the IoT Core Baseline for Consumer IoT Products:

Cybersecurity utility: The ability to change aspects of how the IoT product functions can help customers tailor the IoT product's functionality to their needs and goals. Customers can configure their IoT products to avoid specific threats and risk they know about based on their risk appetite. 1. Throughout the development lifecycle, the IoT product developer creates or gathers and stores information relevant to the cybersecurity of the IoT product and its product components, including :
- a. Assumptions made during the development process and other expectations related to the IoT product, including :
- i. Expected customers and use cases. - ii. Physical use and characteristics, including security of the location of the IoT product and its product components (e.g., a camera for use inside the home that has an off switch on the device vs. a security camera for use outside the home that does not have an off switch on the device). - iii. Network access and requirements (e.g., bandwidth requirements). - iv. Data created and handled by the IoT product. - v. Any expected data inputs and outputs (including error codes, frequency, type/form, range of acceptable values, etc.). - vi. The IoT product developer's assumed cybersecurity requirements for the IoT product. - vii. Any laws and regulations with which the IoT product and related support activities comply. - viii. Expected lifespan and anticipated cybersecurity costs related to the IoT product (e.g., price of maintenance) and length and terms of support. - b. All IoT components, including but not limited to the IoT device, that are part of the IoT product. - c. How the baseline product criteria are met by the IoT product across its product components, including which baseline product criteria are not met by IoT product components and why (e.g., the capability is not needed based on risk assessment). - d. Product design and support considerations related to the IoT product, for example :
- i.

Profile of the IoT Core Baseline for Consumer IoT Products


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Audit and Accountability?

[Assistant]
According to Status Report on the Fourth Round of the NIST Post-Quantum Cryptography Standardization Process:

| 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . | . . . | 1              |
|------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------|
| 1.1. | Purpose and Organization of This Document . . . . | 3              |
| 2. Evaluation Criteria and Selection Process . . | . . . . . . . . | 4              |
| 2.1. | Acceptance of the Fourth-Round Candidates . . . . | 4              |
| 2.2. | Evaluation Criteria . . . . . . . . . . . . . . . . . . . . | 4              |
|                                                                                | 2.2.1. Security . . . . . . . . . . . . . . . . . . . . . . | 4              |
|                                                                                | 2.2.2.Cost and Performance . . . . . . . . . . . . . | 5              |
|                                                                                | 2.2.3.Algorithm and Implementation Characteristics                                                                                | 8              |
| 2.3. | Selection of the Candidates for Standardization . . . | 8              |
| 3. Summary of the Fourth-Round Candidates . | . . . . . . . . | 10             |
| 3.1. | HQC . . . . . . . . . . . . . . . . . . . . . . . . . . . . | 10             |
| 3.2. | BIKE . . . . . . . . . . . . . . . . . . . . . . . . . . . . | 12             |
| 3.3. | Classic McEliece . . . . . . . . . . . . . . . . . .

Status Report on the Fourth Round of the NIST Post-Quantum Cryptography Standardization Process


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Services Acquisition?

[Assistant]
According to Addressing Visibility Challenges with TLS 1.3 within the Enterprise_ High-Level Document:

The Na�onal Cybersecurity Center of Excellence (NCCoE), a part of the Na�onal Ins�tute of Standards and Technology (NIST), is a collabora�ve hub where industry organiza�ons, government agencies, and academic ins�tu�ons work together to address businesses' most pressing cybersecurity issues. This public -private partnership enables the crea�on of prac�cal cybersecurity solu�ons for specific industries, as well as for broad, cross -sector technology challenges. Through consor�a under Coopera�ve Research and Development Agreements (CRADAs), including technology partners-from Fortune 50 market leaders to smaller companies specializing in informa�on technology securitythe NCCoE applies standards and best prac�ces to develop modular, adaptable example cybersecurity solu�ons using commercially available technology. The NCCoE documents these example solu�ons in the NIST Special Publica�on 1800 series, which maps capabili�es to the NIST Cyber security Framework and details the steps needed for another en�ty to re -create the example solu�on. The NCCoE was established in 2012 by NIST in partnership with the State of Maryland and Montgomery County, M aryland .

The Technology Partners/Collaborators who participated in this build submitted their capabilities in response to a notice in the Federal Register. Respondents with relevant capabilities or product components were invited to sign a Cooperative Research and Development Agreement (CRADA) with NIST, allowing them to participate in a consortium to build this example solution. We worked with:

A significant constraint in meeting the visibility challenges attendant on TLS 1.3 is the lack of workable approaches that don 't change the current TLS 1.3 standard or require the development or adoption of additional or alternative standards.

Addressing Visibility Challenges with TLS 1.3 within the Enterprise_ High-Level Document


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Blockchain for Access Control Systems provide? (Part 5)

[Assistant]
r  an  access  control  mechanism  to  support  the requirements  of  decentralization,  scalability,  and  trust  for  accessing  objects,  all  of  which  are challenging for traditional mechanisms.
Blockchains  are  tamper-evident  and  tamper-resistant  cryptographically  linked  blocks  of  data (which  create  digital  ledgers)  implemented  in  a  distributed  fashion  (i.e.,  without  a  central repository) and usually without a central authority (i.e., a bank, company, or government). It uses replicated,  shared,  and  synchronized  digital  blocks  between  the  users  of  a  private  or  public distributed computer network located in different sites or organizations. Blockchain can be utilized for access control systems as a trustable alternative for a single entity/organization or a member of a large-scale system to enforce access control policies. The robust, distributed nature of blockchain technology can overcome the limitations of traditional access control systems in a decentralized and efficient way. It is supported by the following infrastructural properties that are not included in traditional access control mechanisms unless specifically implemented:

- Tamper-evident and tamper-resistant design prevents the alteration of access control data (i.e.,  attributes,  policy  rules,  environment  conditions,  and  access  requests)  and access control logs (i.e., request permissions and previous access control data) and reduces the probability of frauds. - The control of authorization processing is decentralized, and the storage of access control data/logs  has  no  single  point  of  failure,  thus  providing  more  system  tolerance  and availability. - The traceability of blocks allows access control data/logs and system states to be seen and tracked. - The execution of arbitrary programs in smart contracts allows for controls on distributed access control data and authorization processes.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Organizational Views of NIST Cryptographic Standards and Testing and Validation Programs provide? (Part 3)

[Assistant]
| Background: NIST Cryptographic Standards and Testing/Validation Programs ...
1 Methodology.......................................................................................................... 2 | Background: NIST Cryptographic Standards and Testing/Validation Programs ... 1 Methodology.......................................................................................................... 2 |
| Study                                                                                | Study                                                                                | 2                                                                                |
| 3.2. Data Collection............................................................................................................ | 3.2. Data Collection............................................................................................................ | ................................................................................................................. 3                                                                                |
| 3.3. Data Analysis                                                                                | 3.3. Data Analysis                                                                                | ..............................................................................................................

Organizational Views of NIST Cryptographic Standards and Testing and Validation Programs


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Risk Assessment?

[Assistant]
According to Guide for Developing Security Plans for Federal Information Systems:

Title III of the E-Government Act, entitled the Federal Information Security Management Act (FISMA), requires each federal agency to develop, document, and implement an agency-wide information security program to provide information security for the information and information systems that support the operations and assets of the agency, including those provided or managed by another agency, contractor, or other source. System security planning is an important activity that supports the system development life cycle (SDLC) and should be updated as system events trigger the need for revision in order to accurately reflect the most current state of the system. The system security plan provides a summary of the security requirements for the information system and describes the security controls in place or planned for meeting those requirements. The plan also may reference other key security-related documents for the information system such as a risk assessment, plan of action and milestones, accreditation decision letter, privacy impact assessment, contingency plan, configuration management plan, security configuration checklists, and system interconnection agreements as appropriate. During the security certification and accreditation process, the system security plan is analyzed, updated, and accepted. The certification agent confirms that the security controls described in the system security plan are consistent with the FIPS 199 security category determined for the information system, and that the threat and vulnerability identification and initial risk determination are identified and documented in the system security plan, risk assessment, or equivalent document.

Guide for Developing Security Plans for Federal Information Systems


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AU.L2-3.3.2 (NIST 3.3.2)?

[Assistant]
According to Guidelines on Mobile Device Forensics:

3.3.2 Investigative Methods

Investigative  methods  are  procedures  the  investigative  team  can  apply,  which  require  no forensic software or hardware tools.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Risk Assessment?

[Assistant]
According to Audit and Evaluation of Computer Security II_ System Vulnerabilities and Controls:

| | | | 6-4 | |---------------|--------------------------------------------------------|---------------------------------------------------------------------------------|-----------| | 2.3 | Quantity of Terminals | Quantity of Terminals | 6-4 | | 2.4 | Terminal Characteristics | Terminal Characteristics | 6-4 | | | 2.4.1 | Portability | 6-4 6-4 | | | 2.4.2 | Bandwidth | 6-4 | | | 2.4.3 | Storage | 6-4 | | | 2.4.4 | Value | 6-4 | | | 2.4.5 | Construction, Modularity and Assembly | 6-5 | | | 2.4.6 | Intelligence | 6-5 | | | 2.4.7 | Emanations | 6-5 | | | 2.4.8 | Media | 6-5 | | 3.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Security Assessment?

[Assistant]
According to Recommendations for Federal Vulnerability Disclosure Guidelines:

systems). If a VDPO chooses to conduct its own vulnerability research and testing, it should forward all pertinent information to its FCB member for inclusion in an FCB vulnerability report database.
This capability may be used to generate vulnerability reports for internally discovered vulnerabilities (i.e., reporters within the agency) or for external reports sent directly to the ITSO closest to the affected system (i.e., reporters that notify an IT system of a vulnerability in that system). By doing this, agencies can choose to handle vulnerability disclosure duties themselves for their own systems while keeping their associated FCB member apprised of incoming reports and leveraging them for vulnerability advisory publications.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Personnel Security?

[Assistant]
According to Assessing Security and Privacy Controls in Information Systems and Organizations:

NTROL ASSESSMENTS ..................................................... 30
3.4   ANALYZE ASSESSMENT REPORT RESULTS .....................................................................................
32
3.5   ASSESS SECURITY AND PRIVACY CAPABILITIES .............................................................................. 34
CHAPTER FOUR SECURITY AND PRIVACY ASSESSMENT PROCEDURES ................................................. 37
4.1   ACCESS CONTROL............................................................................................................................ 40
4.2   AWARENESS AND TRAINING ........................................................................................................ 118
4.3   AUDIT AND ACCOUNTABILITY ...................................................................................................... 128
4.4   ASSESSMENT, AUTHORIZATION, AND MONITORING ................................................................. 160
4.5   CONFIGURATION MANAGEMENT ................................................................................................ 177
4.6   CONTINGENCY PLANNING ............................................................................................................ 215
4.7   IDENTIFICATION AND AUTHENTICATION .................................................................................... 243
4.8   INCIDENT RESPONSE ............................................................................................................... 275
4.9   MAINTENANCE ........................................................................................................................ 298
4.10   MEDIA PROTECTION .............................................................................................................. 316
4.11   PHYSICAL AND ENVIRONMENTAL PROTECTION .......................................................................

Assessing Security and Privacy Controls in Information Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Access Control?

[Assistant]
According to Guide to Auditing for Controls and Security_ A System Development Life Cycle Approach:

Requirements Document | 41 | | | | 2.6.8.1 | | | | | 2.6.8.2 Functional Security and Internal Control Requirements | 2.6.8.2 Functional Security and Internal Control Requirements | 2.6.8.2 Functional Security and Internal Control Requirements | | | | | Document | Document | 42 | | | | 2.6.8.3 Data Requirements Document | 2.6.8.3 Data Requirements Document | 42 | | | | 2.6.8.4 Data Sensitivity/Criticality Description | 2.6.8.4 Data Sensitivity/Criticality Description | 42 | | | 2.6.9 | Specifications Documents | Specifications Documents | 42 | | | 2.6.9.1 | | System/Subsystem, Program and Data Base Specifications | 42 | | | 2.6.9.2 | Security and Internal Control Related Specifications | Security and Internal Control Related Specifications | 43 | | | 2.6.10 | Validation, Verification and Testing Plan and Specifications | Validation, Verification and Testing Plan and Specifications | 43 | | | 2.6.11 | User Manual | User Manual | 44 | | | 2.6.12 | Operations/Maintenance Manual | Operations/Maintenance Manual | 44 | | | 2.6.13 | Installation and Conversion Plan | Installation and Conversion Plan | 44 | | | 2.6.14 | Test Analysis and Security Evaluation Report | Test Analysis and

Guide to Auditing for Controls and Security_ A System Development Life Cycle Approach


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Protecting Information and System Integrity in Industrial Control System Environments_ Cybersecurity for the Manufacturing Sector provide? (Part 4)

[Assistant]
urers and is looking to reclaim expenses that include repairing its computer networks and the costs associated with interruptions to its operations. They are seeking more than $1.3 billion in damages.
To address the cybersecurity challenges facing the manufacturing sector, the National Institute of Standards and Technology's (NIST's) National Cybersecurity Center of Excellence (NCCoE) launched this project in collaboration with NIST's Engineering Laboratory (EL) and cybersecurity technology providers. Together, we have built example solutions that manufacturing organizations can use to mitigate ICS integrity risks, strengthen the cybersecurity of OT systems, and protect the data that these systems process. ## CHALLENGE

The manufacturing industry is critical to the economic well-being of the nation, and is constantly seeking ways to modernize its systems, boost productivity, and raise efficiency. To meet these goals, manufacturers are modernizing their OT systems by making them more interconnected and integrated with other IT systems and introducing automated methods to strengthen their overall OT asset management capabilities. As OT and IT systems become increasingly interconnected, manufacturers have become a major target of more widespread and sophisticated cybersecurity attacks, which can disrupt these processes and

cause damage to equipment and/or injuries to workers. Furthermore, these incidents could significantly impact productivity and raise operating costs, depending on the extent of a cyber attack.

Protecting Information and System Integrity in Industrial Control System Environments_ Cybersecurity for the Manufacturing Sector


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Awareness and Training?

[Assistant]
According to Multi-Factor Authentication for Criminal Justice Information Systems_ Implementation Considerations for Protecting Criminal Justice Information:

...........13                       |
| 3.2.1. MFA Users ..................................................................................................................................13 |
| 3.2.2.
IT Support Staff...........................................................................................................................14  |
| 3.2.3. Other Agencies ...........................................................................................................................14   |
| 3.2.4. Procurement Teams...................................................................................................................14         |
| 3.2.5. Compliance Teams .....................................................................................................................15       |
| 3.2.6. Legal Teams................................................................................................................................15  |
| 3.2.7. Technology Vendors...................................................................................................................15        |
| 3.4.1. Local Agency MFA Architectures................................................................................................17               |
| 3.4.2. State MFA Deployments.............................................................................................................21           |
| 3.4.3. Implementing MFA with VPNs ...................................................................................................25               |
| 4. Key Takeaways.............................................................................................................................29       |
| References.......................................................................................................................................31   |
| Appendix A.

Multi-Factor Authentication for Criminal Justice Information Systems_ Implementation Considerations for Protecting Criminal Justice Information


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Security Assessment?

[Assistant]
According to Strategies for the Integration of Software Supply Chain Security in DevSecOps CI_CD Pipelines:

Threat actors may seek to compromise various components of the SDLC process, including source code, testing environments, development tools, and build pipelines. They may introduce vulnerabilities, malware, or stolen credentials to gain access to other systems or compromise sensitive data. Such threats can result in financial losses, reputational damage, physical damage and legal consequences. DevSecOps is an agile paradigm used for the development and deployment of cloud-native repositories (e.g., first-party or in-house, third parties or open-source/commercial) to perform tasks or activities, such as building, packaging, testing, and deploying. applications. This paradigm consists of a series of stages that takes code from variously sourced In this document, the term 'artifacts' denotes source code as well as the things generated from it, such as builds and packages. Each of the artifacts is associated with an owner. The logical containers that hold these artifacts are called repositories. The build process is based on application logic-driven dependencies and generates builds using many individual source-code artifacts that are stored in build repositories. The build artifacts are tested and used to generate packages whose artifacts are then stored in designated repositories and scanned before being deployed in testing or production environments. These stages and the various tasks performed at each stage are collectively called CI/CD pipelines. In other words, CI/CD pipelines use processes called workflows to transform source artifacts to deployable packages in production environments. A common approach to SSC security in all of these workflows is to generate as much provenance data as possible. Provenance data are associated with the chronology of the origin, development, ownership, location, and changes to a system or system component, including the personnel and processes that enabled those changes or modifications.

Strategies for the Integration of Software Supply Chain Security in DevSecOps CI_CD Pipelines


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Access Control?

[Assistant]
According to Risk Management Framework for Information Systems and Organizations_ A System Life Cycle Approach for Security and Privacy:

esses at the organization level. In addition, it establishes responsibility and accountability for the controls implemented within an organization's information systems and inherited by those systems.
assess; authorization to operate; authorization to use; authorizing official; categorize; common control; common control authorization; common control provider; continuous monitoring; control assessor; control baseline; cybersecurity framework profile; hybrid control; information owner or steward; information security; monitor; ongoing authorization; plan of action and milestones; privacy; privacy assessment report; privacy control; privacy plan; privacy risk; risk assessment; risk executive function; risk management; risk management framework; security; security assessment report; security control; security engineering; security plan; security risk; senior agency information security officer; senior agency official for privacy; supply chain risk management; system development life cycle; system owner; system privacy officer; system security officer; system-specific control.

Risk Management Framework for Information Systems and Organizations_ A System Life Cycle Approach for Security and Privacy


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for Supply Chain Risk Management?

[Assistant]
According to Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171:

The system component inventory includes system-specific information required for component accountability and to provide support to identify, control, monitor, and verify configuration items in accordance with the authoritative source. The information necessary for effective accountability of system components includes the system name, hardware and software component owners, hardware inventory specifications, software license information, software version numbers, andfor networked components-the machine names and network addresses. Inventory specifications include the manufacturer, supplier information, component type, date of receipt, cost, model, serial number, and physical location. Organizations also use automated mechanisms to implement and maintain authoritative (i.e., up-to-date, complete, accurate, and available) baseline configurations  for  systems  that  include  hardware  and  software  inventory  tools,  configuration management tools, and network management tools. Tools can be used to track version numbers on operating systems, applications, types of software installed, and current patch levels.

- 3.11.6e  Assess, respond to, and monitor supply chain risks associated with organizational systems and system components.

Supply chain events include disruption, use of defective components, insertion of counterfeits, theft,  malicious development practices, improper delivery practices, and insertion of malicious code. These events can have a significant impact on a system and its information and, therefore, can also adversely impact organizational operations (i.e., mission, functions, image, or reputation), organizational assets, individuals, other organizations, and the Nation. The supply chain-related events may be unintentional or malicious and can occur at any point during the system life cycle. An analysis of supply chain risk can help an organization identify systems or components for which additional supply chain risk mitigations are required.

Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Access Control on NoSQL Databases provide? (Part 4)

[Assistant]
publication, no such patent claims have been identified to ITL. No representation is made or implied by ITL that licenses are not required to avoid patent infringement in the use of this publication.
## Table of Contents

| Executive Summary............................................................................................................................1         |
|--------------------------------------------------------------------------------------------------------------------------------------------------------|
| 1. Introduction...................................................................................................................................2    |
| 2. Overview of NoSQL Database Systems............................................................................................3                     |
| 2.1.1. Key-Value Model ..........................................................................................................................3     |
| 2.1.2. Wide-Column Model....................................................................................................................4          |
| 2.1.3. Document Model..........................................................................................................................4       |
| 2.1.4. Graph Model.................................................................................................................................5   |
| 2.2.1. Flexible Data Model......................................................................................................................6      |
| 2.2.2. Horizontal Scalability....................................................................................................................6     |
| 2.2.3. Fast Queries..................................................................................................................................6 |
| 2.2.4.