[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Audit and Accountability?

[Assistant]
According to Summary of NIST SP 800-53, Revision 4_ Security and Privacy Controls for Federal Information Systems and Organizations:

- Authority and Purpose (AP);
- Accountability, Audit, and Risk Management (AR);
- Data Quality and Integrity (DI);
- Data Minimization and Retention (DM);
- Individual Participation and Redress (IP);
- Security (SE);
- Transparency (TR); and,
- Use Limitation (UL).


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Access Control?

[Assistant]
According to Status Report on the First Round of the Additional Digital Signature Schemes for the NIST Post-Quantum Cryptography Standardization Process:

3.1. CROSS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

3.1. CROSS

Status Report on the First Round of the Additional Digital Signature Schemes for the NIST Post-Quantum Cryptography Standardization Process


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Audit and Accountability?

[Assistant]
According to Contingency Planning Guide for Federal Information Systems:

1 While agencies are required to follow NIST guidance in accordance with OMB policy, there is flexibility within NIST's guidance in how agencies apply the guidance.  Unless otherwise specified by OMB, the 800-series guidance documents published by NIST generally allow agencies some latitude in the application.  Consequently, the application of NIST guidance by agencies can result in different security solutions that are equally acceptable, compliant with the guidance, and meet the OMB definition of adequate security for federal information systems.  When assessing federal agency compliance with NIST guidance, auditors, evaluators, and assessors should consider the intent of the security concepts and principles articulated within the particular guidance document and how the agency applied the guidance in the context of its specific mission responsibilities, operational environments, and unique organizational conditions.

Provide system functionality testing and/or validation procedures to ensure that the system is operating correctly.  This section may be combined with the Data Testing section if procedures test both the functionality and data validity.  Teams or persons responsible for each procedure should be identified. An example of a functional test for a low-impact system may be logging into the system and running a report or performing a transaction to see if the system is operating correctly.  Detailed functionality test procedures may be provided in Appendix E, System Validation Test Plan.

-  Keystroke-level recovery steps;
-  System installation instructions from tape, CD, or other media;
-  Required configuration settings or changes;
-  Recovery of data from tape and audit logs; and
-  Other system recovery procedures, as appropriate.

Contingency Planning Guide for Federal Information Systems


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Communications Protection?

[Assistant]
According to Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations:

| 3.4.3. Enhancing Practices....................................................................................................................49      |                                                                                |
|-------------------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------|
| 3.5.1. Measuring C-SCRM Through Performance Measures................................................................52                                |                                                                                |
| References.........................................................................................................................................57 |                                                                                |
| Appendix A. C-SCRM Security Controls............................................................................................... | 63                                                                                |
| A.1.1. C-SCRM Controls Summary........................................................................................................63              |                                                                                |
| A.1.1.1. C-SCRM Controls Throughout the Enterprise.......................................................................64                           |                                                                                |
| A.1.2.

Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Communications Protection?

[Assistant]
According to Secure Software Development Framework (SSDF) Version 1.1_ Recommendations for Mitigating the Risk of Software Vulnerabilities:

Few software development life cycle (SDLC) models explicitly address software security in detail, so secure software development practices usually need to be added to each SDLC model to ensure that the software being developed is well-secured. This document recommends the Secure Software Development Framework (SSDF) - a core set of high-level secure software development practices that can be integrated into each SDLC implementation. Following such practices should help software producers reduce the number of vulnerabilities in released software, reduce the potential impact of the exploitation of undetected or unaddressed vulnerabilities, and address the root causes of vulnerabilities to prevent future recurrences. Because the framework provides a common vocabulary for secure software development, software acquirers can also use it to foster communications with suppliers in acquisition processes and other management activities. This document provides a common language to describe fundamental secure software development practices. This is similar to the approach taken by the Framework for Improving Critical Infrastructure Cybersecurity , also known as the NIST Cybersecurity Framework [NISTCSF]. 2  Expertise in secure software development is not required to understand the practices.

Secure Software Development Framework (SSDF) Version 1.1_ Recommendations for Mitigating the Risk of Software Vulnerabilities


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Ascon-Based Lightweight Cryptography Standards for Constrained Devices_ Authenticated Encryption, Hash, and Extendable Output Functions provide? (Part 3)

[Assistant]
Publication Identifier Syntax

## Publication History

Approved by the NIST Editorial Review Board on 2025-07-09

## How to cite this NIST Technical Series Publication:

Meltem Sönmez Turan, Kerry A.
McKay, Donghoon Chang, Jinkeon Kang, John Kelsey (2025) Ascon-Based Lightweight Cryptography Standards for Constrained Devices. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) NIST SP 800-232. https://doi.org/10.6028/NIST.SP.800-232

## Author ORCID iDs

Meltem Sönmez Turan: 0000-0002-1950-7130 Kerry A. McKay: 0000-0002-5956-587X Donghoon Chang: 0000-0003-1249-2869 Jinkeon Kang: 0000-0003-2142-8236 John Kelsey: 0000-0002-3427-1744

## Contact Information

SP800-232-comments@list.nist.gov

## Additional Information

Additional information about this publication is available at https://csrc.nist.gov/pubs/sp/800/232/final, including related content, potential updates, and document history. ## All comments are subject to release under the Freedom of Information Act (FOIA). ## Abstract

In 2023, the National Institute of Standards and Technology (NIST) announced the selection of the Ascon family of algorithms designed by Dobraunig, Eichlseder, Mendel, and Schläffer to provide efficient cryptographic solutions for resource-constrained devices. This decision emerged from a rigorous, multi-round lightweight cryptography standardization process. The Ascon family includes a suite of cryptographic primitives that provide Authenticated Encryption with Associated Data (AEAD), hash function, and eXtendable Output Function (XOF) capabilities. The Ascon family is characterized by lightweight, permutation-based primitives and provides robust security, efficiency, and flexibility, making it ideal for resourceconstrained environments, such as Internet of Things (IoT) devices, embedded systems, and low-power sensors. The family is developed to offer a viable alternative when the Advanced Encryption Standard (AES) may not perform optimally.

Ascon-Based Lightweight Cryptography Standards for Constrained Devices_ Authenticated Encryption, Hash, and Extendable Output Functions

Audit and Accountability
System and Information Integrity
Security Assessment
Media Protection
Identification and Authentication
Awareness and Training
System and Communications Protection
Access Control
Planning
Incident Response
Risk Assessment
Personnel Security
System and Services Acquisition
Supply Chain Risk Management
Maintenance
Physical Protection
Configuration Management


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Physical Protection?

[Assistant]
According to Cryptographic Module Validation Program (CMVP)-Approved Sensitive Security Parameter Generation and Establishment Methods_ CMVP Validation Authority U:

The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the Nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology. ITL's responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in federal information systems. The Special Publication 800-series reports on ITL's research, guidelines, and outreach efforts in information system security, and its collaborative activities with industry, government, and academic organizations.

Cryptographic Module Validation Program (CMVP)-Approved Sensitive Security Parameter Generation and Establishment Methods_ CMVP Validation Authority U


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171 provide? (Part 10)

[Assistant]
| ..................................................................................................................
4                             |
| 1.3 ORGANIZATIONOF THIS SPECIAL PUBLICATION                                                                                | .......................................................................... 4                                                                     |
| CHAPTERTWO THE FUNDAMENTALS............................................................................................ 5                        | CHAPTERTWO THE FUNDAMENTALS............................................................................................ 5                        |
| 2.1 DEVELOPMENTAPPROACH ...................................................................................................... | 5                                                                                |
| 2.2 ORGANIZATIONANDSTRUCTURE                                                                                | ............................................................................................. 7                                                  |
| 2.3 FLEXIBLE APPLICATION                                                                                | ............................................................................................................. 9                                  |
| CHAPTER THREE THE REQUIREMENTS......................................................................................... 11                       | CHAPTER THREE THE REQUIREMENTS.........................................................................................

Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Maintenance?

[Assistant]
According to Planning for a Zero Trust Architecture_ A Planning Guide for Federal Administrators:

and prove they meet the enterprise policy to be granted the session. This may include meeting requirements such as client software versions, patch level, geolocation, historical request patterns, etc.
Note that it may not be possible to perform all checks at the time of each access request, some policy check may be performed on an independent schedule (e.g., daily software versioning checks). - IV. The enterprise collects as much information as possible about the current state of assets, network infrastructure and communications and uses it to improve its security posture. Zero trust adds a dynamic response factor that was typically lacking (or not possible) in previous perimeter-based architectures. This requires the enterprise to monitor all traffic to the extent feasible and restricted (or required) by policy, regulation or legal requirement. System logs and threat intelligence are used to refine or change policy in response to new information. For example, a new vulnerability in a software component in use in the enterprise is announced. A zero trust enterprise could move quickly to quarantine the affected resources until they can be patched or modified to mitigate the newly discovered vulnerability. Administrators will need to set up and maintain a comprehensive monitoring and patching program for the enterprise and should consider how automated tools could assist in responding to newly discovered threats.

Planning for a Zero Trust Architecture_ A Planning Guide for Federal Administrators


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Communications Protection?

[Assistant]
According to The Federal Cybersecurity Awareness Workforce_ Professional Backgrounds, Knowledge, Skills, and Development Activities:

Security awareness programs aim to assist employees in recognizing and responding to security issues with a goal of achieving long-term behavior changes. Security awareness professionals are individuals who are tasked with managing and executing the security awareness programs within their organizations. Prior industry surveys and research studies have identified challenges security awareness professionals face. Many members of security awareness teams perform security awareness duties on a part-time basis without a job title that reflects their duties, and they may lack sufficient professional skills (e.g., communications, relationship-building) that were viewed as essential in security awareness roles. In addition, the lack of understanding that security awareness is a unique discipline may lead to ill-prepared awareness professionals. However, it is unclear if these challenges also apply to security awareness professionals in the United States (U.S.) government. other fields, including non-IT fields such as instructional design and education, communications, and human resources. We found that 40% of participants had only ever worked in a technical field (cybersecurity, IT, or software development). Cybersecurity awareness (hereafter shortened to 'security awareness') programs aim to help employees recognize and appropriately respond to security issues, with a goal of achieving longterm behavior change [WILSON]. Security awareness professionals are individuals who are tasked with managing and executing the security awareness programs within their organizations. Prior industry surveys and research studies have identified challenges security awareness professionals face. Many professionals perform security awareness duties on a part-time basis without a job title that reflects their duties, and they may lack sufficient professional skills (e.g., communications, relationship-building) that are viewed as essential in security awareness roles [SANS][WOELK].

The Federal Cybersecurity Awareness Workforce_ Professional Backgrounds, Knowledge, Skills, and Development Activities


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Recommendations for Federal Vulnerability Disclosure Guidelines provide? (Part 8)

[Assistant]
| Triage and Prioritize Source Vulnerability                                                                                | Report........................................................
9                                                                     |                                                                                |
| Determine the                                                                                | Reported Vulnerable System..............................................................10                                           |                                                                                |
| Identify the Reported Vulnerable                                                                                | Software.................................................................10                                                          |                                                                                |
| Verify and Remediate                                                                                | Vulnerability............................................................................10                                          |                                                                                |
| Determine Whether to                                                                                | Publish an Advisory................................................................11                                                |                                                                                |
| 2.7.1.

Recommendations for Federal Vulnerability Disclosure Guidelines


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Guide to Auditing for Controls and Security_ A System Development Life Cycle Approach provide? (Part 6)

[Assistant] Operational Audits of Automated Information Systems (AISs) | 4 | | | 1.1.5 | Relevant Laws and Regulations | Relevant Laws and Regulations | 4 | | | 1.1.5.1 | Requirements for Audit Involvement | Requirements for Audit Involvement | 4 | | | | 1.1.5.2 | Requirements for Internal Control | 5 | | 1.2 | RISKS GENERATED BY COMPUTER TECHNOLOGY | RISKS GENERATED BY COMPUTER TECHNOLOGY | RISKS GENERATED BY COMPUTER TECHNOLOGY | 6 | | | 1.2.1 Overview of Risks | 1.2.1 Overview of Risks | 1.2.1 Overview of Risks | 6 | | | 1.2.1.1 | | Definitions | 7 | | | | 1.2.1.2 | Vulnerability/Risk Related Requirements | 7 | | | 1.2.2 | Risks in a Computerized Environment | Risks in a Computerized Environment | 8 | | | | 1.2.2.1 | Additional Risks Present in a Computerized Environment | 8 | | | | 1.2.2.2 | Assessing Vulnerabilities Through the Audit Process | 9 | | 1.3 | CONTROL OBJECTIVES AND STANDARDS IN A COMPUTER ENVIRONMENT | CONTROL OBJECTIVES AND STANDARDS IN A COMPUTER ENVIRONMENT | CONTROL OBJECTIVES AND STANDARDS IN A COMPUTER ENVIRONMENT | 10 | | | 1.3.1 | Impact

Guide to Auditing for Controls and Security_ A System Development Life Cycle Approach


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for Audit and Accountability?

[Assistant]
According to Assessing Enhanced Security Requirements for Controlled Unclassified Information:

| ASSESSMENT PROCEDURES................................................................................................................
| 3   |
| 2.2                                                                                | ASSURANCE CASES.............................................................................................................................. | 4   |
| CHAPTER THREE THE PROCEDURES............................................................................................... | CHAPTER THREE THE PROCEDURES............................................................................................... | 7   |
| 3.1                                                                                | ACCESSCONTROL ............................................................................................................................... | 8   |
| 3.2                                                                                | AWARENESSANDTRAINING............................................................................................................... | 9   |
| 3.3                                                                                | AUDIT ANDACCOUNTABILITY........................................................................................................... | 10  |
| 3.4                                                                                | CONFIGURATION MANAGEMENT.....................................................................................................

Assessing Enhanced Security Requirements for Controlled Unclassified Information


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AT.L2-3.2.4 (NIST 3.2.4)?

[Assistant]
According to Audit and Evaluation of Computer Security II_ System Vulnerabilities and Controls:

3.2.4 Machine Utilization 3. 3.2.4 Machine Uti 1 ization .

Audit and Evaluation of Computer Security II_ System Vulnerabilities and Controls


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AC.L2-3.1.1 (NIST 3.1.1)?

[Assistant]
According to Protecting Information and System Integrity in Industrial Control System Environments_ Cybersecurity for the Manufacturing Sector:

3.1.1   | Configuration... 3.1.1 Configuration

-  Remote Access: Cisco VPN
- Configured to allow authorized VPN users to access to ConsoleWorks web interface.

Protecting Information and System Integrity in Industrial Control System Environments_ Cybersecurity for the Manufacturing Sector


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Risk Management Framework for Information Systems and Organizations_ A System Life Cycle Approach for Security and Privacy provide? (Part 10)

[Assistant]
nold Johnson, Donald Jones, Stuart Katzke, Eustace King, Mark Morrison, Sherrill Nicely, Karen Quigg, George Rogers, Cheryl Roby, Gary Stoneburner, Marianne Swanson, Glenda Turner, and Peter Williams.
\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

## Executive Summary

As we push computers to 'the edge,' building a complex world of interconnected information systems and devices, security and privacy risks (including supply chain risks) continue to be a large part of the national conversation and topics of great importance. The significant increase in the complexity of the hardware, software, firmware, and systems within the public and private sectors (including the U.S. critical infrastructure) represents a significant increase in attack surface that can be exploited by adversaries. Moreover, adversaries are using the supply chain as an attack vector and effective means of penetrating our systems, compromising the integrity of system elements, and gaining access to critical assets. The Defense Science Board Report, Resilient Military Systems and the Advanced Cyber Threat [DSB 2013], provides a sobering assessment of the vulnerabilities in the United States Government, the U.S. critical infrastructure, and the systems supporting the mission-essential operations and assets in the public and private sectors. '…The Task Force notes that the cyber threat to U.S. critical infrastructure is outpacing efforts to reduce pervasive vulnerabilities, so that for the next decade at least the United States must lean significantly on deterrence to address the cyber threat posed by the most capable U.S. adversaries. It is clear that a more proactive and systematic approach to U.S.

Risk Management Framework for Information Systems and Organizations_ A System Life Cycle Approach for Security and Privacy


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Protecting Controlled Unclassified Information (CUI)_ NIST Special Publication 800-171, Revision 3. Small Business Primer provide? (Part 2)

[Assistant]
ent, or possibly with other organizations like municipal governments, prime contractors, universities, etc., you will likely be required to demonstrate you are taking adequate measures to protect CUI.
Examples of CUI include:

<!-- image -->

|                      | When provided as part of a government contract, examples include:                                                                                | Marking 1     |
|----------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------|
| Controlled           | e.g., research and engineering data, engineering drawings, specifications, process sheets, manuals, technical reports, technical orders, catalog-item identifications, data sets, studies and analyses and related information, and computer software executable code and source code. | CUI//SP-CTI   |
| General Proprietary  | e.g., financial information, trade secrets, product research and development, existing and future product designs and performance specifications. | CUI//PROPIN   |
| Business Information | you do not handle CUI, implementing the security requirements in SP 800-171 will                                                                                | help you take |

1  For more information on types of CUI and markings, visit the National Archives and Records Administration (NARA) https://www.archives.gov/cui.

Protecting Controlled Unclassified Information (CUI)_ NIST Special Publication 800-171, Revision 3. Small Business Primer


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171 provide? (Part 6)

[Assistant]
chnology Laboratory (ITL) has requested that holders of patent claims whose use may be required for compliance with the guidance or requirements of this publication disclose such patent claims to ITL.
However, holders of patents are not obligated to respond to ITL calls for patents and ITL has not undertaken a patent search in order to identify which, if any, patents may apply to this publication. As of the date of publication and following call(s) for the identification of patent claims whose use may be required for compliance with the guidance or requirements of this publication, no such patent claims have been identified to ITL. No representation is made or implied by ITL that licenses are not required to avoid patent infringement in the use of this publication. \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

## HOW TO USE THIS PUBLICATION

This publication is a supplement to NIST Special Publication 800-171 [SP 800-171]. It contains recommendations  for  enhanced  security  requirements  to  provide  additional  protection  for Controlled Unclassified Information (CUI) in nonfederal systems and organizations when such information is  associated  with critical  programs  or  high  value  assets. The  enhanced  security requirements are designed to respond to the advanced persistent threat (APT) and supplement the basic and derived security requirements in [SP 800-171]. While the security requirements in [SP 800-171] focus primarily on confidentiality protection, the enhanced security requirements in this publication address confidentiality, integrity, and availability protection. The enhanced security requirements are implemented in addition to the basic and derived requirements since those requirements are not designed to address the APT.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for Configuration Management?

[Assistant]
According to Protecting Controlled Unclassified Information (CUI)_ NIST Special Publication 800-171, Revision 3. Small Business Primer:

| Access Control                    | Maintenance         | Security Assessment and Monitoring   |
|-----------------------------------|---------------------|--------------------------------------|
| Awareness and Training            | Media Protection    | System and Communications Protection |
| Audit and Accountability          | Personnel Security  | System and Information Integrity     |
| Configuration Management          | Physical Protection | Planning                             |
| Identification and Authentication | Risk Assessment     | System and Services Acquisition      |
| Incident Response                 |                     | Supply Chain Risk Management         |

- Based on NIST SP 800-53, Revision 5 and the NIST SP 800-53B moderate impact control baseline.
- Applies updated tailoring criteria addressing stakeholder feedback (adding new, consolidating, and withdrawing requirements).
- Includes increased specificity in security requirements.
- Introduces organization-defined parameters (ODP) to increase flexibility to better manage organizationspecific risks.

Control Baseline: A set of controls you can implement to meet strategic, legal, regulatory, or contractual security and privacy requirements and manage risk.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for System and Services Acquisition?

[Assistant]
According to Assessing Enhanced Security Requirements for Controlled Unclassified Information:

There may be references in this publication to other publications currently under development by  NIST  in  accordance  with  its  assigned  statutory  responsibilities. The  information  in  this publication, including concepts, practices, and methodologies, may be used by federal agencies even  before  the  completion  of  such  companion  publications. Thus,  until  each  publication  is completed,  current  requirements,  guidelines,  and  procedures,  where  they  exist,  remain operative. For planning and transition purposes, federal agencies may wish to closely follow the development of these new publications by NIST. The NIST Information Technology Laboratory (ITL) promotes the U.S. economy and public welfare by providing technical leadership for the Nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, implementations, proofs of concept, and technical analyses to advance the development and productive use of information technology (IT). ITL's responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security of other than national security-related information in federal information systems. The Special Publication 800-series reports on ITL's research, guidelines, and outreach efforts in information systems security and privacy and its collaborative activities with industry, government, and academic organizations. The purpose of this publication is to describe procedures for assessing the enhanced security requirements in [SP 800-172]. 3 Compliance with the security requirements is addressed in CUI guidance and the CUI Federal Acquisition Regulation (FAR) or as supplemented by federal agencies (e.g., Department of Defense Federal Acquisition Regulation). Organizations can use the assessment procedures to generate evidence to support the assertion that the enhanced security requirements have been satisfied.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Information Integrity?

[Assistant]
According to Strategies for the Integration of Software Supply Chain Security in DevSecOps CI_CD Pipelines:

| Executive Summary............................................................................................................................1        |
|-------------------------------------------------------------------------------------------------------------------------------------------------------|
| 1. Introduction...................................................................................................................................2   |
| 2. Software Supply Chain (SSC) -Definition and Model .....................................................................4                           |
| 2.4.1. Software Supply Chain Defects ....................................................................................................6            |
| 2.4.2. Software Supply Chain Attacks.....................................................................................................6            |
| SSC Security -Risk Factors and Mitigation Measures .....................................................................8                             |
| 3. |
| 3.1.1. Developer Environment ...............................................................................................................8         |
| 3.1.2. Threat Actors................................................................................................................................8 |
| 3.1.3. Attack Vectors ..............................................................................................................................9 |
| 3.1.4. Attack Targets (Assets).................................................................................................................9      |
| 3.1.5. Types of Exploits.........................................................................................................................10   |
| 3.2.1.

Strategies for the Integration of Software Supply Chain Security in DevSecOps CI_CD Pipelines


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What guidance does Guide to Auditing for Controls and Security_ A System Development Life Cycle Approach provide?

[Assistant]
Ol

<!-- image -->

A11105 7flT13T

Nes PUBLICATIONS

## Computer Science and Technology

NBS Special Publication 500-153

Guide to Auditing for Controls and Security: A System Development Life Cycle Approach

<!-- image -->

m T he National Bureau of Standards' was established by an act of Congress on March 3, 1901. The Bureau's overall goal is to strengthen and advance the nation's science and technology and facilitate their effective application for public benefit. To this end, the Bureau conducts research to assure international competitiveness and leadership of U.S. industry, science arid technology. NBS work involves development and transfer of measurements, standards and related science and technology, in support of continually improving U.S. productivity, product quality and reliability, innovation and underlying science and engineering. The Bureau's technical work is performed by the National Measurement Laboratory, the National Engineering Laboratory, the Institute for Computer Sciences and Technology, and the Institute for Materials Science and Engineering. ## The National Measurement Laboratory

Provides the national system of physical and chemical measurement; coordinates the system with measurement systems of other nations and furnishes essential services leading to accurate and uniform physical and chemical measurement throughout the Nation's scientific community, industry, and commerce; provides advisory and research services to other Government agencies; conducts physical and chemical research; develops, produces, and distributes Standard Reference Materials; provides calibration services; and manages the National Standard Reference Data System.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Services Acquisition?

[Assistant]
According to Proceedings of the Cybersecurity in Cyber-Physical Systems Workshop, April 23-24, 2012:

the development of standards underpinning the nation's Smart Grid. In October 2011, Dr. Arnold added an additional role as Director of Cyber Physical Systems within NIST's Engineering Laboratory (EL).
Anticipating and meeting the measurement science and standards needs for technology-intensive manufacturing construction, and cyber-physical systems in ways that enhance economic prosperity and improve the quality of life , EL promotes U.S. innovation and industrial competitiveness in areas of critical national priority.

Proceedings of the Cybersecurity in Cyber-Physical Systems Workshop, April 23-24, 2012


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Awareness and Training?

[Assistant]
According to Recommendations for Federal Vulnerability Disclosure Guidelines:

|
| Federal Vulnerability Disclosure Coordination Body ....................................................
| 6                                                                                |                                                                                |
| Preparation................................................................................................................. | 7                                                                                |                                                                                |
| 2.1.1. Create Source Vulnerability                                                                                | Report Receipt Capability............................................. 7                                                             |                                                                                |
| 2.1.2. Determine Scope and Obtain Contacts .................................................................... | 8                                                                                |                                                                                |
| 2.1.3. Develop Technical Analysis Capability .....................................................................


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Awareness and Training?

[Assistant]
According to Audit and Evaluation of Computer Security II_ System Vulnerabilities and Controls:

| 3-7       |
|      | 3.5            | Establish Personnel Security Policies                                                                 | 3-7       |
| 4.
| ALLOCATE       | RESOURCES                                                                                | 3-7       |
|      | 4.1            | General                                                                                | 3-7 3-8   |
| 5. | REPORT         | ON SECURITY                                                                                |           |
|      | 5.1            | General                                                                                | 3-8       |
| Fig. | 1              | Responsibilities and Duties to Provide Security for Data Processing System .. | 3-5       |
| PART |                | SESSION 2 ~ MANAGERIAL AND ORGANIZATIONAL VULNERABILITIES AND CONTROLS ~ LINE LEVEL - DATA PROCESSING |           |
|      | IV:            |                                                                                | 4-1       |
|      |                |                                                                                | 4-2       |
| 1. | EDITOR'S       | NOTE INTRODUCTION 4-3                                                                                | 4-3 4-3   |
|      | 1.1 1.2 1.3    | The Charge Intent of Paper                                                                            | 4-3 4-3   |
| 2. | 1.4            | Elements of Discussion Comments                                                                       | 4-4       |
|      | DATA           | PROCESSING ".


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Configuration Management?

[Assistant]
According to Risk Management Framework for Information Systems and Organizations_ A System Life Cycle Approach for Security and Privacy:

assess; authorization to operate; authorization to use; authorizing official; categorize; common control; common control authorization; common control provider; continuous monitoring; control assessor; control baseline; cybersecurity framework profile; hybrid control; information owner or steward; information security; monitor; ongoing authorization; plan of action and milestones; privacy; privacy assessment report; privacy control; privacy plan; privacy risk; risk assessment; risk executive function; risk management; risk management framework; security; security assessment report; security control; security engineering; security plan; security risk; senior agency information security officer; senior agency official for privacy; supply chain risk management; system development life cycle; system owner; system privacy officer; system security officer; system-specific control.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for Maintenance?

[Assistant]
According to Assessing Enhanced Security Requirements for Controlled Unclassified Information:

| CHAPTERONE INTRODUCTION...................................................................................................... | CHAPTERONE INTRODUCTION...................................................................................................... | 1   |
|-----------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------|-----|
| 1.1                                                                                | PURPOSEANDAPPLICABILITY............................................................................................................. 1        | 2   |
| 1.2                                                                                | TARGET AUDIENCE.............................................................................................................................. |     |
| 1.3                                                                                | ORGANIZATIONOF THIS SPECIAL PUBLICATION................................................................................. | 2   |
| CHAPTERTWO THE FUNDAMENTALS............................................................................................ | CHAPTERTWO THE FUNDAMENTALS............................................................................................ | 3   |
| 2.1                                                                                | ASSESSMENT PROCEDURES................................................................................................................


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AU.L2-3.3.3 (NIST 3.3.3)?

[Assistant]
According to Recommendation for Pair-Wise Key-Establishment Schemes Using Discrete Logarithm Cryptography:

3.3.3                                                                                | C(0e, 2s) Scheme with Bilateral Key Confirmation ... 3.3.3  C(0e, 2s) Scheme with Bilateral Key Confirmation

Figure\_17 depicts a typical flow for a C(0e, 2s) scheme with bilateral key confirmation.

Recommendation for Pair-Wise Key-Establishment Schemes Using Discrete Logarithm Cryptography


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AT.L2-3.2.6 (NIST 3.2.6)?

[Assistant]
According to Assessing Security and Privacy Controls in Information Systems and Organizations:

3.2.6   FINALIZE ASSESSMENT PLAN AND OBTAIN APPROVAL TO EXECUTE PLAN

After selecting the assessment procedures (including developing necessary procedures not
contained in the SP 800-53A catalog of procedures), tailoring the procedures for
system/platform-specific and organization-specific conditions, optimizing the procedures for
efficiency, and addressing the potential for unexpected events that may impact the assessment,
the assessment plan is finalized and the schedule is established, including key milestones for the
assessment process.

Assessing Security and Privacy Controls in Information Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Personnel Security?

[Assistant]
According to Approaches and Challenges of Federal Cybersecurity Awareness Programs:

'Since we have a lot of our personnel in remote areas, we've been doing it through our learning management system primarily for the annual security awareness training.' (D05)

'For our main enterprise network, it's computer-based training that's taken annually…But for those who don't have access to the enterprise network often for certain other networks that we might maintain,…those are physical briefings done by the ISSOs [information system security officers] to those personnel. And then they sign an acknowledgment form.' (D03)

'You've got IT security, physical security, personnel security, etc. And they have their own training requirements…It's inefficient.' (S11)

Approaches and Challenges of Federal Cybersecurity Awareness Programs


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Configuration Management?

[Assistant]
According to A Zero Trust Architecture Model for Access Control in Cloud-Native Applications in Multi-Cloud Environments:

via mutual Transport Layer Security  (mTLS) when a service makes an initial connection establishment as part of its inter-service call. This authentication is not performed again in subsequent calls.
However, the security of this operation is ensured by not allowing the connections to be very long (usually as long as the time to live [TTL] of the service's identity certificate or as short as 15-30 minutes, depending on the configuration).

A Zero Trust Architecture Model for Access Control in Cloud-Native Applications in Multi-Cloud Environments


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AC.L2-3.1.7 (NIST 3.1.7)?

[Assistant]
According to Digital Identity Guidelines_ Authentication and Authenticator Management:

3.1.7. 3.1.7): Proof of possession

and control via an authentication protocol of a cryptographic key held by the
subscriber that requires activation by a second authentication factor

2. 3.1.7)

When a combination of two single-factor authenticators is used, the combination  SHALL
include one physical authenticator (i.

Digital Identity Guidelines_ Authentication and Authenticator Management


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Supply Chain Risk Management?

[Assistant]
According to Summary of NIST SP 800-53, Revision 4_ Security and Privacy Controls for Federal Information Systems and Organizations:

SP 800-53 Revision 4 has been updated to reflect the evolving technology and threat space. Example areas include issues particular to mobile and cloud computing; insider threats; applications security; supply chain risks; advanced persistent threat; and trustworthiness, assurance, and resilience of information systems. The revision also contains a new appendix of privacy controls, and related implementation guidance (Appendix J), based on the Fair Information Practice Principles (FIPPs), a widely accepted framework of defining principles to be used in the evaluation and consideration of systems, processes, or programs that affect individual privacy.

Summary of NIST SP 800-53, Revision 4_ Security and Privacy Controls for Federal Information Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Personnel Security?

[Assistant]
According to Guide to a Secure Enterprise Network Landscape:

erprise to follow guidelines, such as the Center for Internet Security's (CIS) benchmarks for public cloud services, thus improving the overall security profile of the enterprise for cloud access [4].
Network security automation tools automate the life cycle processes involved in deployment, observability/monitoring, threat intelligence gathering/reporting (e.g., generating alerts of security violations for security personnel to take timely action), and - in some instances automatic remediation. These automated tools are an indispensable part of the current enterprise network landscape, especially those that consist of highly distributed on-premises and cloudbased IT resources.

Guide to a Secure Enterprise Network Landscape


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What guidance does Workshop on Enhancing Security of Devices and Components Across the Supply Chain provide?

[Assistant]
<!-- image -->

## NIST Internal Report NIST IR 8532

## Workshop on Enhancing Security of Devices and Components Across the Supply Chain

Sanjay (Jay) Rekhi D. Richard Kuhn Kim Schaffer Murugiah Souppaya A.J. Stein Noah Waller Nelson Hastings Michael Ogata

William C. Barker

This publication is available free of charge from:

https://doi.org/10.6028/NIST.IR.8532

<!-- image -->

## NIST Internal Report NIST IR 8532

## Workshop on Enhancing Security of Devices and Components Across the Supply Chain

Sanjay (Jay) Rekhi D. Richard Kuhn Kim Schaffer* Murugiah Souppaya A.J. Stein* Noah Waller

Computer Security Division Information Technology Laboratory

Nelson Hastings Michael Ogata Applied Cybersecurity Division Information Technology Laboratory

William C. Barker Dakota Consulting

*Former NIST employee; all work for this publication was done while at NIST. This publication is available free of charge from: https://doi.org/10.6028/NIST.IR.8532

February 2025

<!-- image -->

U.S. Department of Commerce Jeremy Pelter, Acting Secretary of Commerce

National Institute of Standards and Technology Craig Burkhardt, Acting Under Secretary of Commerce for Standards and Technology and Acting NIST Director

Certain equipment, instruments, software, or materials, commercial or non-commercial, are identified in this paper in order to specify the experimental procedure adequately. Such identification does not imply recommendation or endorsement of any product or service by NIST, nor does it imply that the materials or equipment identified are necessarily the best available for the purpose. There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may be used by federal agencies even before the completion of such companion publications.

Workshop on Enhancing Security of Devices and Components Across the Supply Chain


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Multi-Factor Authentication for Criminal Justice Information Systems_ Implementation Considerations for Protecting Criminal Justice Information provide? (Part 2)

[Assistant]
ral agencies even before the completion of such companion publications. Thus, until each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative.
For planning and transition purposes, federal agencies may wish to closely follow the development of these new publications by NIST. Organizations are encouraged to review all draft publications during public comment periods and provide feedback to NIST. Many NIST cybersecurity publications, other than the ones noted above, are available at https://csrc.nist.gov/publications. ## NIST Technical Series Policies

Copyright, Use, and Licensing Statements NIST Technical Series Publication Identifier Syntax

## Publication History

Approved by the NIST Editorial Review Board on YYYY-MM-DD [Will be added to final publication.]

## How to Cite this NIST Technical Series Publication

Fisher W, Ajmo J, Umarji S, Dog S, Russell M, Scarfone K (2025) Multi-Factor Authentication for Criminal Justice Information Systems: Implementation Considerations for Protecting Criminal Justice Information. (National Institute of Standards and Technology, Gaithersburg, MD), NIST internal Report (IR) NIST IR 8523. https://doi.org/10.6028/NIST.IR.8523

## Author ORCID iDs

William Fisher: 0009-0004-7569-5668

Jason Ajmo: 0009-0007-4046-6146

Sudhi Umarji: 0000-0001-6842-8167

Spike Dog: 0009-0000-0201-6776

Mark Russell: 0009-0004-1273-392X

Karen Scarfone: 0000-0001-6334-9486

## Contact Information

psfr-nccoe@nist.gov

National Institute of Standards and Technology Attn: Applied Cybersecurity Division, Information Technology Laboratory

100 Bureau Drive (Mail Stop 2000) Gaithersburg, MD 20899-2000

## Additional Information

Additional information about this publication is available at https://csrc.nist.gov/pubs/ir/8523/final, including related content, potential updates, and document history. All comments are subject to release under the Freedom of Information Act (FOIA).

Multi-Factor Authentication for Criminal Justice Information Systems_ Implementation Considerations for Protecting Criminal Justice Information


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Protecting Controlled Unclassified Information (CUI)_ NIST Special Publication 800-171, Revision 3. Small Business Primer provide? (Part 3)

[Assistant]
| help you take |

1  For more information on types of CUI and markings, visit the National Archives and Records Administration (NARA) https://www.archives.gov/cui.
ht ps:/

csrc.nist.gov/projects/protecting-control ed-unclas ified-information

## Overview

## Audience

<!-- image -->

<!-- image -->

Pages 2-6 provide a general overview of SP 800-171, R3 -helpful to business leaders or those new to SP 800-171. Pages 7-27 are for those who are tasked with managing the implementation SP 800-171. It is not all-encompassing, but it does provide tips and resources to help with getting started. This section serves as a bridge to the larger SP 800-171 publication. ## Key Term: Confidentiality

<!-- image -->

Confidentiality refers to the protection of information from unauthorized access and disclosure . *Definitions in this document are intended as plain language. View the official definition within 32 CFR Part 2002 "Controlled Unclassified Information."

## A Suite of Guidance

NIST's suite of CUI guidance (shown in the table below) focuses on protecting the confidentiality 2 of CUI in nonfederal systems and organizations and recommends specific security requirements to achieve that objective. This guide will focus on SP 800-171, Revision 3 . <!-- image -->

<!-- image -->

<!-- image -->

NIST SP 800-171, Protecting Controlled Unclassified Information in Nonfederal Systems is a set of recommended security requirements for protecting the confidentiality of CUI. NIST SP 800-171A, Assessing Security Requirements for Controlled Unclassified Information provides assessment procedures and a methodology to conduct assessments of the CUI security requirements in SP 800-171.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Physical Protection?

[Assistant]
According to Recommendations for Federal Vulnerability Disclosure Guidelines:

The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the Nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology. ITL's responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in federal information systems. The Special Publication 800-series reports on ITL's research, guidelines, and outreach efforts in information system security, and its collaborative activities with industry, government, and academic organizations.

In the context of this document, the term 'vulnerability' refers to a security vulnerability in an information system. It does not refer to other kinds of vulnerabilities that may pertain to, for example, physical security, economic security, or foreign policy issues.

The terms 'should' and 'should not' indicate that - among several possibilities - one is recommended as particularly suitable without mentioning or excluding others, that a certain course of action is preferred but not necessarily required, or that (in the negative form) a certain possibility or course of action is discouraged but not prohibited. The terms 'may' and 'need not' indicate a course of action permissible within the limits of the publication. The terms 'can' and 'cannot' indicate a possibility and capability, whether material, physical, or causal.

Recommendations for Federal Vulnerability Disclosure Guidelines


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice CM.L2-3.4.1 (NIST 3.4.1)?

[Assistant]
According to Guide to Auditing for Controls and Security_ A System Development Life Cycle Approach:

3.4.1                                                            | Assumptions and Caveats                                          | Assumptions and Caveats                                          | 50        |
|           | 3. 3.4.1 Review Documents                                                                  | 81   |
|       | 4. 3.4.1                                                                                | SDLC Methodology Audit Considerations                                                       | 83   |
|       | 4.

Guide to Auditing for Controls and Security_ A System Development Life Cycle Approach


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Audit and Accountability?

[Assistant]
According to Audit and Evaluation of Computer Security:

Audit and Evaluation
of Computer Security ^

The auditing and evaluating of computer systems for adequate secu-

rity has been a natural outgrowth of this widening interest in this
area.
the financial and internal auditors and has been made a subject of spe-
cial consideration by organizations such as the Institute of Internal
Auditors, the American Institute of Certified Public Accountants, and
the EDP Auditors Associtation.

Audit and Evaluation of Computer Security


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What guidance does NIST provide for CMMC Level 3?

[Assistant]
According to Protecting Controlled Unclassified Information (CUI)_ NIST Special Publication 800-171, Revision 3. Small Business Primer:

<!-- image -->

<!-- image -->

Howard Lutnick, Secretary of Commerce

<!-- image -->

Protecting Controlled Unclassified Information (CUI): NIST Special Publication 800-171, Revision 3 Small Business Primer

## Purpose of this Primer

This guide provides small businesses with an overview of NIST Special Publication (SP) 800-171 Revision 3, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations . The following pages contain:

- An overview of foundational components of SP 800-171
- A list of frequently asked questions and their answers
- Tips for getting started
- Related resources

## What is Controlled Unclassified Information (CUI)?*

CUI is information the government creates or possesses, or that an entity creates or possesses on behalf of the government, that law, regulation, or governmentwide policy requires you to take technical and operational steps to protect. Systems that process, store, and transmit CUI often support government programs involving sensitive critical assets. As part of a contractual agreement with the federal government, or possibly with other organizations like municipal governments, prime contractors, universities, etc., you will likely be required to demonstrate you are taking adequate measures to protect CUI.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Digital Identity Guidelines_ Authentication and Authenticator Management provide? (Part 4)

[Assistant]
at https://csrc.nist.gov/pubs/
sp/800/63/B/4/final, including related content, potential updates, and document history. All comments are subject to release under the Freedom of Information Act (FOIA).
NIST SP 800-63B-4
July 2025

Abstract

Digital Identity Guidelines
Authentication and Authenticator Management

This guideline focuses on the authentication of subjects who interact with government
information systems over networks to establish that a given claimant is a subscriber
who has been previously authenticated. The result of the authentication process may
be used locally by the system performing the authentication or asserted elsewhere in a
federated identity system. This document defines technical requirements for each of the
three authentication assurance levels. The guidelines are not intended to constrain the
development or use of standards outside of this purpose. This publication supersedes
NIST Special Publication (SP) 800-63B. Keywords

authentication; authentication assurance; credential service provider; digital
authentication; passwords. Reports on Computer Systems Technology

The Information Technology Laboratory (ITL) at the National Institute of Standards and
Technology (NIST) promotes the U.S. economy and public welfare by providing technical
leadership for the Nation’s measurement and standards infrastructure. ITL develops
tests, test methods, reference data, proof of concept implementations, and technical
analyses to advance the development and productive use of information technology. ITL’s responsibilities include the development of management, administrative, technical,
and physical standards and guidelines for the cost-effective security and privacy of other
than national security-related information in federal information systems.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Awareness and Training?

[Assistant]
According to Guide for Developing Security Plans for Federal Information Systems:

- Develops the system security plan in coordination with information owners, the system administrator, the information system security officer, the senior agency information security officer, and functional "end users,"
- Maintains the system security plan and ensures that the system is deployed and operated according to the agreed-upon security requirements,
- Ensures that system users and support personnel receive the requisite security training (e.g., instruction in rules of behavior),
- Updates the system security plan whenever a significant change occurs, and
- Assists in the identification, implementation, and assessment of the common security controls. - Carries out the CIO's responsibilities for system security planning,
- Coordinates the development, review, and acceptance of system security plans with information system owners, information system security officers, and the authorizing official,
- Coordinates the identification, implementation, and assessment of the common security controls, and
- Possesses professional qualifications, including training and experience, required to develop and review system security plans. Many of the management and operational controls (e.g., contingency planning controls, incident response controls, security awareness and training controls, personnel security controls, and physical security controls) needed to protect an information system may be excellent candidates for common security control status. The objective is to reduce security costs by centrally managing the development, implementation, and assessment of the common security controls designated by the agency-and subsequently, sharing assessment results with the owners of information systems where those common security controls are applied. Security controls not designated as common controls are considered system-specific controls and are the responsibility of the information system owner.

Guide for Developing Security Plans for Federal Information Systems


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Blockchain for Access Control Systems provide? (Part 3)

[Assistant]
. This document presents general information for blockchain access control systems from the views of blockchain system properties, components, functions, and supports for access control policy models.
Considerations for implementing blockchain access control systems are also included. ## Keywords

access control; blockchain; authorization; ABAC; policy. ## Acknowledgments

The author, Vincent C. Hu of the National Institute of Standards and Technology (NIST), wishes to thank Dylan Yaga, David Ferraiolo, Isabel Van Wyk, Jim Foti (NIST), and Antonios Gouglidis (Lancaster  University,  UK)  who  reviewed  drafts  of  this  document. The  author  also  gratefully acknowledges and appreciates the comments and contributions made by government agencies, private organizations, and individuals in providing direction and assistance in the development of this document. ## Audience

This document assumes that readers are access control system experts who also have basic network and blockchain expertise. Because of the constantly changing nature of the information technology (IT) industry, readers are strongly encouraged to take advantage of other resources (including those referred in this document) for more current and detailed information. ## Patent Disclosure Notice

NOTICE: The Information Technology Laboratory (ITL) has requested  that  holders  of  patent claims  whose  use  may  be  required  for  compliance  with  the  guidance  or  requirements  of  this publication disclose such patent claims to ITL. However, holders of patents are not obligated to respond to ITL calls for patents and ITL has not undertaken a patent search in order to identify which, if any, patents may apply to this publication. Following  the  ITL  call  for  the  identification  of  patent  claims  whose  use  may  be  required  for compliance with the guidance or requirements of this publication, notice of one or more such claims has been received.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Digital Identity Guidelines_ Identity Proofing and Enrollment provide? (Part 9)

[Assistant]
. . . . . . . . . . . . . . . . . . 4.3. Identity Assurance Level 3 . . . . . . . . . . . . . . . . . . . . . . . . . 4.3.1. Proofing Types . . . . . . . . . . . . . . . . . . . . . . . . . . . 4.3.2.
Evidence Collection . . . . . . . . . . . . . . . . . . . . . . . . 4.3.3. Attribute Requirements . . . . . . . . . . . . . . . . . . . . . . 4.3.4. Evidence Validation . . . . . . . . . . . . . . . . . . . . . . . . 4.3.5. Attribute Validation . . . . . . . . . . . . . . . . . . . . . . . . 4.3.6. Verification Requirements . . . . . . . . . . . . . . . . . . . . . 4.3.7. On-Site Attended Requirements — Colocated Agent

. . . . . . . 4.3.8. On-Site Attended Requirements — Kiosk-Based . . . . . . . . . 4.3.9. Notification of Proofing . . . . . . . . . . . . . . . . . . . . . . 4.3.10. Initial Authenticator Binding . . . . . . . . . . . . . . . . . . . . 4.4. Summary of Requirements . . . . . . . . . . . . . . . . . . . . . . . . . 5. Subscriber Accounts

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5.1. 5.2. 5.3. 5.4. Subscriber Accounts . . . . . . . . . . . . . . . . . . . . . . . . . . . . Subscriber Account Access . . . . . . . . . . . . . . . . . . . . . . . . . Subscriber Account Maintenance and Updates . . . . . . . . . . . . . . Subscriber Account Suspension or Termination . . . . . . . . . . . . . . 44

45

45

45

45

46

46

49

49

50

51

51

51

52

52

52

52

53

53

53

54

55

55

56

56

58

58

59

59

59

v

NIST SP 800-63A-4
July 2025

Digital Identity Guidelines
Identity Proofing and Enrollment

5.5. Data Breach Notification . . . . . . . . . . . . . . . . . . . . . . . . . . 5.6. Multiple Subscriber Account Scenarios

. . . . . . . . . . . . . . . . . . 6. Threats and Security Considerations . . . . . . . . . . . . . . . . . . . . . . . 6.1. 6.2. Threat Mitigation Strategies . . . . . . . . . . . . . . . . . . . . . . . . Collaboration With Adjacent Programs

. . . . . . . . . . . . . . . . . . 7. Privacy Considerations . . . . .

Digital Identity Guidelines_ Identity Proofing and Enrollment


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Awareness and Training?

[Assistant]
According to Audit and Evaluation of Computer Security:

THE INSTITUTE FOR MATERIALS RESEARCH conducts materials research leading to improved methods of measure-
ment, standards, and data on the properties of well-characterized materials needed by industry, commerce, educational insti-
tutions, and Government: provides advisory and research services to other Government agencies; and develops, produces, and
distributes standard reference materials. The Institute consists of the Office of Standard Reference Materials, the Office of Air
and Water Measurement, and the following divisions:

The National Bureau of Standards, with the support of the U.S. Gen-
eral Accounting Office, sponsored an invitational workshop on "Audit and
Evaluation of Computer Security," held in Miami Beach, Florida on March
22-24, 1977.
area and define appropriate subjects for future research.
perts in the audit and computer communities were invited to discuss the
subject in one of ten sessions, each of which considered a different as-
pect.
these reports form the body of these Proceedings.
The ten topics re-
ported on are: Internal Audit Standards, Qualifications and Training,
Security Administration, Audit Considerations in Various System Environ-
ments, Administrative and Physical Controls, Program Integrity, Data In-
tegrity, Communications, Post-Processing Audit Tools and Techniques, and
Interactive Audit Tools and Techniques.

KEYWORDS:
training, communications security, computer controls, computer
security, data integrity, interactive audit, internal audit, post-
processing audit, program integrity.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice IA.L2-3.5.4 (NIST 3.5.4)?

[Assistant]
According to Guide to Enterprise Patch Management Planning_ Preventive Maintenance for Technology:

3.5.4 Maintenance Plans for Scenario 4, Unpatchable Assets... 3.5.4 Maintenance Plans for Scenario 4, Unpatchable Assets

Organizations should plan to implement multiple types of long-term risk mitigation methods besides patching to protect vulnerable assets.

Guide to Enterprise Patch Management Planning_ Preventive Maintenance for Technology


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Security Assessment?

[Assistant]
According to Machine Learning for Access Control Policy Verification:

rexample generation of found faults. It would be more efficient if the policy model error can be verified without composing security requirements to discover faults that already exist in the model. 2.
Verification for policy with numerical attributes -Some context-aware access control policies,  such  as  Policy  Based  Access  Control  (PBAC)  [PBAC]  or  situation-awarded access control systems, have attributes as numerical variables. These non-binary attributes measure values such as numbers, volumes, and other measurable counts to make access decisions for policy rules, such as ' if the current security level is greater than 3, then the user has subject attribute X and is allowed to access resource with object attribute Y ,' or ' if  the  total  amount  of  spending  is  higher  than  $50,  then  the  discount  is  accessible  to customers but not accessible to employees. ' These policies cannot be verified by traditional verification methods, including an infinite number of attribute values in test cases/oracle. The  RFC  verification  method  for  these  policies  is  especially  useful  because  an  RFC algorithm is fundamentally equipped for the evaluation of regression values. Its branch factors for subtree nodes test the limitations of attribute values, as shown in Figure 7, where the time and  the temperature attribute  values  can  vary  to  an  unlimited  real  number depending on the resolutions of the variables.

Machine Learning for Access Control Policy Verification


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice IA.L2-3.5.3 (NIST 3.5.3)?

[Assistant]
According to Guide to Malware Incident Prevention and Handling for Desktops and Laptops:

3.5.3                                                                                | Browser Separation... 3.5.3 Browser Separation

Multiple brands of Web browsers (e.

Guide to Malware Incident Prevention and Handling for Desktops and Laptops


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Physical Protection?

[Assistant]
According to High-Performance Computing Security_ Architecture, Threat Analysis, and Security Posture:

ntific data formatting library with only seven dependencies, while Data Mining Classification and Regression Methods (rminer) [21] - an R-based data mining application - has 150 software dependencies.
The full software stack can be split into three general categories that differ based on the maintainer: user software, facility software, and vendor software.

High-Performance Computing Security_ Architecture, Threat Analysis, and Security Posture


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Services Acquisition?

[Assistant]
According to Federal Cybersecurity Awareness Programs_ A Mixed Methods Research Study:

lls  to  implement  an  effective  and  engaging  program. However,  no  prior  research  has explored security awareness programs specifically in the United States (U.S.) government (federal) sector.
To  address  this  gap,  NIST  conducted  a  two-phase,  mixed  methods  research  study  to understand the needs, challenges, and practices of federal security awareness programs. This report describes  the  research  background  and  methodology,  along  with  the  characteristics  of  the participants, organizations, and programs represented in the study. Research results can serve as a resource  for  federal  security  awareness  professionals,  managers,  and  organizational  decision makers to improve and advocate for their organizations' security awareness programs. Results can also inform the development of federal security awareness guidance, policies, sharing forums, and initiatives  meant  to  aid  programs  in  becoming  more  effective. While  focused  on  the  U.S. government, findings may also have implications for organizational security awareness programs in other sectors.

Federal Cybersecurity Awareness Programs_ A Mixed Methods Research Study


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Transitioning to the Security Content Automation Protocol (SCAP) Version 2 provide? (Part 6)

[Assistant] It identifies a set of issues to address from the previous versions of SCAP, presents a draft SCAP v2 architecture, and outlines an iterative development process for SCAP v2. This document is intended to drive consensus around a vision for SCAP v2, and to identify how the security automation community can collaborate in a public-private partnership to achieve this vision. Some work on the underlying specifications that support SCAP v2 has started; however, much of the work on defining SCAP v2 still needs to be accomplished. This document outlines an approach for SCAP v2 to support a broad range of cyber defense capabilities and requests community input to improve this approach. Knowing the state of your network is at the heart of all cyber defense capabilities-to know what endpoints are connected to it, if those endpoints are authorized to be on the network, what software is installed on each endpoint, and how that software is configured. In today's networks, endpoints encompass a wide range of connected devices including servers, workstations, network, mobile, and Internet of Things (IoT) devices. Understanding endpoint posture provides the information needed to automate management decisions that support proper network hygiene. Network hygiene practices, as identified by the NIST Framework for Improving Critical Infrastructure Cybersecurity Version 1.1 [1],  are important foundational aspects of any enterprise strategy to identify, protect, detect, respond to, and recover from network attacks. SCAP is a suite of specifications for expressing, exchanging, and processing security automation content. SCAP content describes what endpoint posture information to collect and how to compare this information against a desired state using implementation-neutral, standardized formats. SCAP tools use these formats to drive the collection and evaluation of posture information to determine if software vulnerabilities and misconfigurations exist on a specific managed endpoint.

Transitioning to the Security Content Automation Protocol (SCAP) Version 2


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Physical Protection?

[Assistant]
According to Federal Cybersecurity Role-Based Training Approaches, Successes, and Challenges:

The term security will be used as a shorthand for 'cybersecurity' or 'information security.' Reference to physical security or personnel security is different and will be labeled as such.

Federal Cybersecurity Role-Based Training Approaches, Successes, and Challenges


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Access Control?

[Assistant]
According to Secure Software Development Practices for Generative AI and Dual-Use Foundation Models_ An SSDF Community Profile:

| Practice | Task | Priority | Recommendations [R], Considerations [C], and Notes [N] Specific to AI Model Development | Informative References | |------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------|------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------| | | PO.3.3: Configure tools to generate artifacts of their support of secure software development practices as defined by the organization.

Secure Software Development Practices for Generative AI and Dual-Use Foundation Models_ An SSDF Community Profile


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What guidance does Control Baselines for Information Systems and Organizations provide?

[Assistant]
## Control Baselines for Information Systems and Organizations

JOINT TASK FORCE

This publication is available free of charge from:

https://doi.org/10.6028/NIST.SP.800-53B

<!-- image -->

## NIST Special Publication 800-53B

## Control Baselines for Information Systems and Organizations

## JOINT TASK FORCE

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-53B

## October 2020

INCLUDES UPDATES AS OF 12-10-2020; SEE PAGE XI

<!-- image -->

U.S. Department of Commerce Wilbur L. Ross, Jr., Secretary

National Institute of Standards and Technology Walter Copan, NIST Director and Under Secretary of Commerce for Standards and Technology

\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

## Authority

This publication has been developed by NIST to further its statutory responsibilities under the Federal Information Security Modernization Act (FISMA), 44 U.S.C. § 3551 et seq. , Public Law (P.L.) 113-283. NIST is responsible for developing information security standards and guidelines, including minimum requirements for federal information systems. Such information security standards and guidelines shall not apply to national security systems without the express approval of the appropriate federal officials exercising policy authority over such systems. This guideline is consistent with the requirements of the Office of Management and Budget (OMB) Circular A-130. Nothing in this publication should be taken to contradict the standards and guidelines made mandatory and binding on federal agencies by the Secretary of Commerce under statutory authority. Nor should these guidelines be interpreted as altering or superseding the existing authorities of the Secretary of Commerce, OMB Director, or any other federal official.

Control Baselines for Information Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Information Integrity?

[Assistant]
According to Guide to Enterprise Patch Management Planning_ Preventive Maintenance for Technology:

- Prioritize the patch. A patch may be a higher priority to deploy than others because its deployment would reduce cybersecurity risk more than other patches would. Another patch may be a lower priority because it addresses a low-risk vulnerability on a small number of low-importance assets. - Schedule patch deployment. Many organizations schedule patch deployments as part of their enterprise change management activities. - Acquire the patch. Patches may be downloaded from the internet, built internally by developers or system administrators, or provided through removable media. - Validate the patch. A patch's authenticity and integrity should be confirmed, preferably by automated means, before the patch is tested or installed. The patch could have been acquired from a rogue source or tampered with in transit or after acquisition. - Test the patch. A patch may be tested before deployment. This is intended to reduce operational risk by identifying problems with a patch before placing it into production. Testing may be performed manually or through automated methods. - Distribute the patch. Distributing the patch to the assets that need to have it installed can be organization-controlled (and occur automatically, manually, or as scheduled) or vendor-controlled, such as delivered from the cloud. - Validate the patch. As discussed in Section 2.3.1, a patch's authenticity and integrity should be confirmed before installation, preferably through automated means. - Install the patch. Installation can occur in numerous ways, including automatically; manually when directed to do so by a user, administrator, vendor, or tool; as a result of other software being installed or updated; and through the replacement of removable media used by an asset. Some installations require administrator privileges, such as installing firmware patches for a system basic input/output system (BIOS). 3 Some patch installations require user participation or cooperation.