[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Guidelines for Media Sanitization provide? (Part 7)

[Assistant]
.......................................................24         |                                                                                |
| 4.7.1.
Program Managers/Agency Heads.............................................................................................27                      |                                                                                |
| 4.7.2. Chief Information Officer (CIO) ..................................................................................................27              |                                                                                |
| 4.7.3. Information System Owner........................................................................................................27                |                                                                                |
| 4.7.4. Information Owner/Steward......................................................................................................27                 |                                                                                |
| 4.7.5. Senior Agency Information Security Officer (SAISO)..................................................................27                            |                                                                                |
| 4.7.6. System Security Manager/Officer ..............................................................................................27                  |                                                                                |
| 4.7.7.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule_ A Cybersecurity Resource Guide provide? (Part 7)

[Assistant]
...........38                         |
| 5.1.5. Security Awareness and Training (§ 164.308(a)(5)) ...................................................................41                      |
| 5.1.6.
Security Incident Procedures (§ 164.308(a)(6)) .........................................................................44                   |
| 5.1.7. Contingency Plan (§ 164.308(a)(7))............................................................................................47             |
| 5.1.8. Evaluation (§ 164.308(a)(8)).......................................................................................................51        |
| 5.2.1. Facility Access Controls (§ 164.310(a)).......................................................................................56             |
| 5.1.9. Business Associate Contracts and Other Arrangements (§ 164.308(b)(1))................................54                                      |
| 5.2.2. Workstation Use (§ 164.310(b)).................................................................................................59            |
| 5.2.3. Workstation Security (§ 164.310(c)) ..........................................................................................61             |

| 5.2.4. Device and Media Controls (§ 164.310(d)).................................................................................63                                                                                |
|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| 5.3.1.

Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule_ A Cybersecurity Resource Guide

Audit and Accountability
System and Information Integrity
Security Assessment
Media Protection
Identification and Authentication
Awareness and Training
System and Communications Protection
Access Control
Planning
Incident Response
Risk Assessment
Personnel Security
System and Services Acquisition
Supply Chain Risk Management
Maintenance
Physical Protection
Configuration Management


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AU.L2-3.3.6 (NIST 3.3.6)?

[Assistant]
According to Audit and Evaluation of Computer Security:

3.3.6

Bulk Data Transmission

Data is often transmitted in bulk by mail or

Depending on the data sensitivity and/or

electronically.

Audit and Evaluation of Computer Security


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Services Acquisition?

[Assistant]
According to Automated Secure Configuration Guidance from the macOS Security Compliance Project (mSCP):

d to implement security baselines. This collaboration between federal agencies minimizes duplicate effort that would otherwise be needed for these agencies to administer individual security baselines.
Additionally, the secure baseline content provided is easily extensible by other parties to implement their own security requirements.

Automated Secure Configuration Guidance from the macOS Security Compliance Project (mSCP)


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Configuration Management?

[Assistant]
According to Protecting Information and System Integrity in Industrial Control System Environments_ Cybersecurity for the Manufacturing Sector:

Technology professionals who want to implement an approach like this can make use of NIST SP 180010C: How-To Guides . It provides specific product installation, configuration, and integration instructions for building the example implementation, allowing you to replicate all or parts of this project.

NIST Cybersecurity Practice Guides (Special Publication 1800 series) target specific cybersecurity challenges in the public and private sectors. They are practical, user-friendly guides that facilitate the adoption of standards-based approaches to cybersecurity. They show members of the information security community how to implement example solutions that help them align more easily with relevant standards and best practices, and provide users with the materials lists, configuration files, and other information they need to implement a similar approach.

integrity-checking, change control management, and user authentication and authorization. The solution was tested in two distinct lab settings: a discrete manufacturing workcell, which represents an assembly line production, and a continuous process control system (PCS), which represents chemical manufacturing industries.

Protecting Information and System Integrity in Industrial Control System Environments_ Cybersecurity for the Manufacturing Sector


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice IA.L2-3.5.2 (NIST 3.5.2)?

[Assistant]
According to Guide to Enterprise Patch Management Planning_ Preventive Maintenance for Technology:

3.5.2 Maintenance Plans for Scenario 2, Emergency Patching... 3.5.2 Maintenance Plans for Scenario 2, Emergency Patching

Organizations should consider using the same general approach for emergency patching as for routine patching, except with a highly accelerated schedule.

Guide to Enterprise Patch Management Planning_ Preventive Maintenance for Technology


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Identification and Authentication?

[Assistant]
According to Secure Software Development Practices for Generative AI and Dual-Use Foundation Models_ An SSDF Community Profile:

|                                                                                |            | C1: Consider periodic risk modeling updates for future AI model versions and derivatives after AI model release. C2: During risk modeling, consider checking that the AI model is not in a critical path to make significant security decisions without a human in the loop. | LLM07, LLM08, LLM09, LLM10                                                                |
| security requirements and risks during software design (secure by design) is key for improving software security and also helps improve development efficiency. | PW.1.2: Track and maintain the software's security requirements, risks, and design decisions. | Medium     | No additions to SSDF 1.1                                                                                | AI RMF: Govern 4.1, 4.2; Map 2.1, 2.2, 2.3, 3.2, 3.3, 4.1, 4.2, 5.2; Manage 1.2, 1.3, 1.4 |
| security requirements and risks during software design (secure by design) is key for improving software security and also helps improve development efficiency. | PW.1.3: Where appropriate, build in support for using standardized security features and services (e.g., enabling software to integrate with existing log management, identity management, access control, and vulnerability management systems) instead of creating proprietary implementations of security features and services.

Secure Software Development Practices for Generative AI and Dual-Use Foundation Models_ An SSDF Community Profile


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Maintenance?

[Assistant]
According to Overview and Considerations of Access Control Based on Attribute Encryption:

|
| [SP800-56A] | Barker EB, Chen L, Roginsky AL, Vassilev A, Davis R (2018) Recommendation for Pair-Wise Key-Establishment Schemes Using Discrete Logarithm Cryptography.
(National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) 800-56A, Rev. 3. https://doi.org/10.6028/NIST.SP.800-56Ar3                                    |
| [ST]        | Tahat N, Shatnawi S (2022) New Signature Scheme Based on Elliptic Curve and Factoring Problems Using Chaotic Map, Journal of Applied Security Research. Available at                                                                                |
| [SW]        | https://www.tandfonline.com/doi/full/10.1080/19361610.2022.2041157 Sahai A, Waters B (2005) Fuzzy Identity-Based Encryption Cryptology, Proceedings of the 24th annual international conference on Theory and Applications of Cryptographic Techniques 2005. Pages 457-473. https://doi.org/10.1007/11426639_27                                          |
| [TDN]       | Ţiplea FL, Dragan C, Nica A (2017) Key-Policy Attribute-Based Encryption from Bilinear Maps, International Conference for Information Technology and Communications. https://doi.org/10.1007/978-3-319-69284-5_3                                                                                |
| [TKN]       | Tomida J, Kawahara Y, and Nishimaki R (2021) Fast, Compact, and Expressive Attribute-Based Encryption, Designs, Codes and Cryptography (2021) 89:2577- 2626. https://doi.org/10.1007/s10623-021-00939-8                                                                                |
| [UMAS]      | Umashankar SKA (2016) A Review on Attribute-Based Encryption (ABE) and ABE Types, Semantic Scholar - Computer Science.

Overview and Considerations of Access Control Based on Attribute Encryption


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Incident Response?

[Assistant]
According to Risk Management Framework for Information Systems and Organizations_ A System Life Cycle Approach for Security and Privacy:

Risk assessments are also conducted to determine the potential that the use of an external provider for the development, implementation, maintenance, management, operation, or disposition of a system, system element, or service could create a loss, and the potential impact of that loss. The impact may be immediate (e.g., physical theft) or on-going (e.g., the ability of adversaries to replicate critical equipment because of theft). The impact may be endemic (e.g., limited to a single system) or systemic (e.g., including any system that uses a specific type of system component). Supply chain risk assessments consider vulnerabilities which may arise related to the disposition of a system or system element and from the use of external providers. Vulnerabilities in the supply chain may include a lack of traceability or accountability leading to the potential use of counterfeits, insertion of malware, or poor-quality systems. The use of external providers may result in a loss of visibility and control over how systems, system elements, and services are developed, deployed, and maintained. A clear understanding of the threats, vulnerabilities, and potential impacts of an adverse supply chain event can help organizations appropriately balance supply chain risk with risk tolerance. Supply chain risk assessments can include information from supplier audits, reviews, and supply chain intelligence. Organizations develop a strategy for collecting information, including a strategy for collaborating with providers on supply chain risk assessments. Such collaboration helps organizations leverage information from providers, reduce redundancy, identify potential courses of action for risk responses, and reduce the burden on providers.

Risk Management Framework for Information Systems and Organizations_ A System Life Cycle Approach for Security and Privacy


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What are the CMMC Level 3 requirements?

[Assistant]
According to Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171:

## NIST Special Publication 800-172

## Enhanced Security Requirements for Protecting Controlled Unclassified Information

A Supplement to NIST Special Publication 800-171

RON ROSS VICTORIA PILLITTERI GARY GUISSANIE RYAN WAGNER RICHARD GRAUBART

DEB BODEAU

This publication is available free of charge from:

https://doi.org/10.6028/NIST.SP.800-172

<!-- image -->

## NIST Special Publication 800-172

## Enhanced Security Requirements for Protecting Controlled Unclassified Information

A Supplement to NIST Special Publication 800-171

## RON ROSS VICTORIA PILLITTERI

Computer Security Division

National Institute of Standards and Technology

## GARY GUISSANIE RYAN WAGNER

Institute for Defense Analyses

RICHARD GRAUBART DEB BODEAU

The MITRE Corporation

This publication is available free of charge from:

https://doi.org/10.6028/NIST.SP.800-172

## February 2021

<!-- image -->

U.S. Department of Commerce Wynn Coggins, Acting Secretary

National Institute of Standards and Technology James K. Olthoff, Performing the Non-Exclusive Functions and Duties of the Under Secretary of Commerce for Standards and Technology & Director, National Institute of Standards and Technology

\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

## Authority

This publication has been developed by NIST to further its statutory responsibilities under the Federal Information Security Modernization Act (FISMA), 44 U.S.C. § 3551 et seq. , Public Law (P.L.) 113-283. NIST is responsible for developing information security standards and guidelines, including minimum requirements for federal information systems, but such standards and guidelines shall not apply to national security systems without the express approval of the appropriate federal officials exercising policy authority over such systems.

Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AU.L2-3.3.1 (NIST 3.3.1)?

[Assistant]
According to Federal Cybersecurity Awareness Programs_ A Mixed Methods Research Study:

3.3.1                                                                                | Program Size... 3.3.1 Program Size

Participants in both the focus groups and survey were asked how many people (including federal employees and contractors) were covered by the organization's security awareness program (i.

Federal Cybersecurity Awareness Programs_ A Mixed Methods Research Study


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Maintenance?

[Assistant]
According to Secure Software Development Practices for Generative AI and Dual-Use Foundation Models_ An SSDF Community Profile:

| Practice | Task | Priority | Recommendations [R], Considerations [C], and Notes [N] Specific to AI Model Development | Informative References | |---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------| | security requirements and risks during software design (secure by design) is key for improving software security and also helps improve development efficiency.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Audit and Accountability?

[Assistant]
According to Security and Privacy Controls for Information Systems and Organizations:

............................................................. 16
3.1   ACCESS CONTROL ..................................................................................................................
18
3.2   AWARENESS AND TRAINING ................................................................................................... 59
3.3   AUDIT AND ACCOUNTABILITY ................................................................................................. 65
3.4   ASSESSMENT, AUTHORIZATION, AND MONITORING ................................................................. 83
3.5   CONFIGURATION MANAGEMENT ........................................................................................... 96
3.6   CONTINGENCY PLANNING .................................................................................................... 115
3.7   IDENTIFICATION AND AUTHENTICATION ............................................................................... 131
3.8   INCIDENT RESPONSE ............................................................................................................ 149
3.9   MAINTENANCE .................................................................................................................... 162
3.10   MEDIA PROTECTION .......................................................................................................... 171
3.11   PHYSICAL AND ENVIRONMENTAL PROTECTION .................................................................... 179
3.12   PLANNING ........................................................................................................................ 194
3.13   PROGRAM MANAGEMENT ................................................................................................. 203
3.14   PERSONNEL SECURITY ........................................................................................................ 222
3.15   PERSONALLY IDENTIFIABLE INFORMATION PROCESSING AND TRANSPARENCY .......................

Security and Privacy Controls for Information Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171 provide? (Part 6)

[Assistant]
chnology Laboratory (ITL) has requested that holders of patent claims whose use may be required for compliance with the guidance or requirements of this publication disclose such patent claims to ITL.
However, holders of patents are not obligated to respond to ITL calls for patents and ITL has not undertaken a patent search in order to identify which, if any, patents may apply to this publication. As of the date of publication and following call(s) for the identification of patent claims whose use may be required for compliance with the guidance or requirements of this publication, no such patent claims have been identified to ITL. No representation is made or implied by ITL that licenses are not required to avoid patent infringement in the use of this publication. \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

## HOW TO USE THIS PUBLICATION

This publication is a supplement to NIST Special Publication 800-171 [SP 800-171]. It contains recommendations  for  enhanced  security  requirements  to  provide  additional  protection  for Controlled Unclassified Information (CUI) in nonfederal systems and organizations when such information is  associated  with critical  programs  or  high  value  assets. The  enhanced  security requirements are designed to respond to the advanced persistent threat (APT) and supplement the basic and derived security requirements in [SP 800-171]. While the security requirements in [SP 800-171] focus primarily on confidentiality protection, the enhanced security requirements in this publication address confidentiality, integrity, and availability protection. The enhanced security requirements are implemented in addition to the basic and derived requirements since those requirements are not designed to address the APT.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AT.L2-3.2.1 (NIST 3.2.1)?

[Assistant]
According to Digital Identity Guidelines:

3.2.1. 3.2.1. 3.2.1).


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Communications Protection?

[Assistant]
According to Proceedings of the Cybersecurity in Cyber-Physical Systems Workshop, April 23-24, 2012:

Cybersecurity is a critical cross-cutting discipline that provides confidence that cyber-physical systems, their information, and supporting communications and information infrastructures are adequately safeguarded.  CPS are increasingly being utilized in critical infrastructures and other settings.  However, CPS have many unique characteristics, including the need for real-time response and extremely high availability, predictability, and reliability, which impacts cybersecurity decisions.

Dr. Arnold joined the National Institute of Standards and Technology (NIST) in September 2006 as Deputy Director, Technology Services, after a 33-year career in the telecommunications and information technology industry. He was appointed National Coordinator for Smart Grid Interoperability at in April 2009. He has been responsible for leading the development of standards underpinning the nation's Smart Grid. In October 2011, Dr. Arnold added an additional role as Director of Cyber Physical Systems within NIST's Engineering Laboratory (EL). Anticipating and meeting the measurement science and standards needs for technology-intensive manufacturing construction, and cyber-physical systems in ways that enhance economic prosperity and improve the quality of life , EL promotes U.S. innovation and industrial competitiveness in areas of critical national priority.

Dr. Arnold previously served as a Vice-President at Lucent Technologies Bell Laboratories where he directed the company's global standards efforts. His organization played a leading role in the development of international standards for Intelligent Networks and IP-based Next Generation Networks. In previous assignments at AT&T Bell Laboratories he had responsibilities in network planning, systems engineering, and application of information technology to automate operations and maintenance of the nationwide telecommunications network.

Proceedings of the Cybersecurity in Cyber-Physical Systems Workshop, April 23-24, 2012


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 2 require for Supply Chain Risk Management?

[Assistant]
According to Assessing Security Requirements for Controlled Unclassified Information:

| Access Control                    | Maintenance         | Security Assessment and Monitoring   |
|-----------------------------------|---------------------|--------------------------------------|
| Awareness and Training            | Media Protection    | System and Communications Protection |
| Audit and Accountability          | Personnel Security  | System and Information Integrity     |
| Configuration Management          | Physical Protection | Planning                             |
| Identification and Authentication | Risk Assessment     | System and Services Acquisition      |
| Incident Response                 |                     | Supply Chain Risk Management         |

A.03.11.01.a: the risk (including supply chain risk) of unauthorized disclosure resulting from the processing, storage, or transmission of CUI is assessed.

[SELECT FROM: risk assessment policy and procedures; security planning policy and procedures; procedures for organizational assessments of risk; risk assessment; risk assessment results; risk assessment reviews; risk assessment updates; SCRM policy and procedures; inventory of critical systems, system components, and system services; procedures for organizational assessments of supply chain risk; acquisition policy; SCRM plan; system security plan; other relevant documents or records]

Assessing Security Requirements for Controlled Unclassified Information


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Communications Protection?

[Assistant]
According to Risk Management Framework for Information Systems and Organizations_ A System Life Cycle Approach for Security and Privacy:

This publication contains comprehensive updates to the Risk Management Framework . The updates include an alignment with the constructs in the NIST Cybersecurity Framework; the integration of privacy risk management processes; an alignment with system life cycle security engineering processes; and the incorporation of supply chain  risk  management  processes. Organizations  can use the frameworks and processes in a complementary manner within the RMF to effectively manage security and  privacy risks to organizational  operations  and assets, individuals, other organizations, and the Nation. Revision 2 includes a set of organization-wide RMF tasks that are designed to prepare information system owners to conduct system-level risk management activities. The intent  is  to  increase  the  effectiveness,  efficiency,  and cost-effectiveness  of  the  RMF  by  establishing  a  closer connection to the organization's missions and business functions  and  improving  the  communications  among senior leaders, managers, and operational personnel. 1  An information system is a discrete set of information resources organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of information [44 USC 3502]. The term information system includes, for example, general-purpose computing systems; industrial/process control systems; cyber-physical systems; weapons systems; super computers; command, control, and communications systems; devices such as smart phones and tablets; environmental control systems; embedded devices/sensors; and paper-based systems. 32  Different controls may need to be selected to mitigate the privacy risks associated with authorized processing of PII. For example, there may be a risk that individuals would be embarrassed or stigmatized if certain information is disclosed about them.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AC.L2-3.1.6 (NIST 3.1.6)?

[Assistant]
According to Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations:

3.1.6. 3.1.6.

Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Services Acquisition?

[Assistant]
According to Multi-Factor Authentication for Criminal Justice Information Systems_ Implementation Considerations for Protecting Criminal Justice Information:

There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may be used by federal agencies even before the completion of such companion publications. Thus, until each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning and transition purposes, federal agencies may wish to closely follow the development of these new publications by NIST.

The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the Nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology. ITL's responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of information other than national security-related information in federal information systems.

Section 3 of this document details MFA design principles, agency stakeholders that should be part of MFA requirements development, considerations for a phased MFA rollout, and examples of where agencies might choose to implement MFA.

Multi-Factor Authentication for Criminal Justice Information Systems_ Implementation Considerations for Protecting Criminal Justice Information


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Security Assessment?

[Assistant]
According to Automated Secure Configuration Guidance from the macOS Security Compliance Project (mSCP):

The authors wish to thank Jason Blake and Stephanie Roberts from NIST; Gary Gapinski, Elyse Anderson, and Joshua Glemza from NASA; and Jamie Richardson and Chris Stone from Apple for their contributions to the mSCP. The authors appreciate Bob McSulla and Ryan Jaynes from Tenable for developing audit files based on the mSCP, testing the baselines for different macOS versions, and contributing to Appendix C. The authors also thank Isabel Van Wyk from NIST for editing the document. Finally, portions of this document are based on content from the mSCP Wiki, so the work of all Wiki contributors is appreciated.

Organizations using any baseline example should take a risk-based approach for selecting the appropriate settings and organizationally defined values depending on the context under which the baseline will be applied. Organizations can tailor any of the baselines to include controls specific to their needs and to produce evidence of control enforcement. Additional information on baseline customization can be found in SP 800-70 [2], which discusses the importance of customizing and testing baselines before applying them to a production system.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for Planning?

[Assistant]
According to Protecting Controlled Unclassified Information (CUI)_ NIST Special Publication 800-171, Revision 3. Small Business Primer:

d, communicated, understood, and enforced. Even if cybersecurity activities are outsourced to an external provider, someone within the business should still be designated to manage cybersecurity risk.
|
|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| It's not all technology. | An important point to emphasize is that many requirements in SP 800-171 do not need investments in technology or services to implement. Many requirements can be achieved through the creation of processes and procedures. |
| Implement the requirements and document implementation in a system security plan. | Satisfying the security requirements won't be accomplished overnight. Implement in phases based upon your resources (includin g time, expertise, budget, etc.), starting with understanding what security requirements you may have already satisfied and building from there.

Protecting Controlled Unclassified Information (CUI)_ NIST Special Publication 800-171, Revision 3. Small Business Primer


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Access Control?

[Assistant]
According to Digital Identity Guidelines_ Authentication and Authenticator Management:

2.3.1. Permitted Authenticator Types

3.1.

3.1.1. Passwords

Digital Identity Guidelines_ Authentication and Authenticator Management


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does IoT Device Cybersecurity Capability Core Baseline provide? (Part 9)

[Assistant]
ents to be included in the core baseline. - The last column lists IoT reference examples that indicate existing sources of IoT device cybersecurity guidance specifying a similar or related capability.
Because the table only covers the basics of the capabilities, the references can be invaluable for understanding each capability in more detail and learning how to implement each capability in a reasonable manner.

IoT Device Cybersecurity Capability Core Baseline


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Awareness and Training?

[Assistant]
According to Control Baselines for Information Systems and Organizations:

| CHAPTERONE INTRODUCTION...................................................................................................... 1               | CHAPTERONE INTRODUCTION...................................................................................................... 1               | CHAPTERONE INTRODUCTION...................................................................................................... 1   |
|-----------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------|
| 1.1                                                                                | PURPOSEANDAPPLICABILITY ................................................................................................... | 1                                                                                |
| 1.2                                                                                | TARGET AUDIENCE .................................................................................................................. | 2                                                                                |
| 1.3                                                                                | ORGANIZATIONAL RESPONSIBILITIES .........................................................................................

Control Baselines for Information Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Security Assessment?

[Assistant]
According to Multi-Factor Authentication for Criminal Justice Information Systems_ Implementation Considerations for Protecting Criminal Justice Information:

| A representative cohort of general users can help test the MFA solution before a general user rollout. | • Take volunteers or a selection of the general cohort to test the MFA solution.
• Test IT support and help desk procedures. • Hold user feedback sessions. • Update communications and/or policy based on feedback. |
|       4 | General user rollout               | Once agencies are satisfied with testing from phases 1-3, it is time to proceed to a general rollout. This may not include some user populations that fall into corner cases. | • Provide multiple waves of communication around the MFA transition. • Allow for questions, answers, and feedback. • Provide a clear deadline for making the transition. • Update communications and/or policy based on feedback. • Monitor and grow adoption over time. |
|       5 | Corner case users                  | Corner case requirements may require alternate MFA solutions. | • Enumerate requirements and potential solutions for corner cases. • Test potential solutions with phases 1-3 before rolling out to corner case users. |


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Configuration Management?

[Assistant]
According to Guide to Malware Incident Prevention and Handling for Desktops and Laptops:

| Executive Summary................................................................................................................vii   | Executive Summary................................................................................................................vii                                                                                | Executive Summary................................................................................................................vii                                                                                |                                                                                |
|----------------------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------|
| 1. Introduction ...................................................................................................................... | 1. Introduction ...................................................................................................................... | 1. Introduction ......................................................................................................................

Guide to Malware Incident Prevention and Handling for Desktops and Laptops


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Supply Chain Risk Management?

[Assistant]
According to Assessing Security and Privacy Controls in Information Systems and Organizations:

CHAPTER ONE INTRODUCTION ............................................................................................................... 1
1.1   PURPOSE AND APPLICABILITY .......................................................................................................... 1
1.2   TARGET AUDIENCE ............................................................................................................................ 4
1.3   RELATED PUBLICATIONS AND ASSESSMENT PROCESSES ............................................................... 4
1.4   ORGANIZATION OF THIS PUBLICATION ........................................................................................... 5
CHAPTER TWO THE FUNDAMENTALS ..................................................................................................... 6
2.1   ASSESSMENTS WITHIN THE SYSTEM DEVELOPMENT LIFE CYCLE .................................................. 6
2.2   CONTROL STRUCTURE AND ORGANIZATION .................................................................................. 7
2.3   BUILDING AN EFFECTIVE ASSURANCE CASE .................................................................................... 8
2.4   ASSESSMENT PROCEDURES: ASSESSMENT OBJECTS, METHODS AND OBJECTIVES ................... 11
CHAPTER THREE THE PROCESS ............................................................................................................. 19
3.1   PREPARE FOR SECURITY AND PRIVACY CONTROL ASSESSMENTS ............................................... 19
3.2   DEVELOP SECURITY AND PRIVACY ASSESSMENT PLANS .............................................................. 23
3.3   CONDUCT SECURITY AND PRIVACY CONTROL ASSESSMENTS ..................................................... 30
3.4   ANALYZE ASSESSMENT REPORT RESULTS .....................................................................................

Assessing Security and Privacy Controls in Information Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for Physical Protection?

[Assistant]
According to Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171:

The National Institute of Standards and Technology (NIST) Information Technology Laboratory (ITL) promotes the U.S. economy and public welfare by providing technical leadership for the Nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology (IT). ITL's responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the costeffective security of other than national security-related information in federal information systems. The Special Publication 800-series reports on ITL's research, guidelines, and outreach efforts in information systems security and privacy and its collaborative activities with industry, government, and academic organizations. | CHAPTERONE INTRODUCTION...................................................................................................... | CHAPTERONE INTRODUCTION...................................................................................................... |
|--------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------|
| 1.1 PURPOSEANDAPPLICABILITY                                                                                | ...................................................................................................


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Automated Secure Configuration Guidance from the macOS Security Compliance Project (mSCP) provide? (Part 7)

[Assistant]
| Relevance to NIST SP 800-70 and the National Checklist Program ...........................
| 2                                                                                |
|                                                                                | Document Structure.................................................................................................... | 2                                                                                |
| Project Description .......................................................................................................... | Project Description .......................................................................................................... | 3                                                                                |
|                                                                                | Project Goals.............................................................................................................. | 3                                                                                |
|                                                                                | mSCP Content Use                                                                                | ....................................................................................................

Automated Secure Configuration Guidance from the macOS Security Compliance Project (mSCP)


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does NIST Cybersecurity Framework 2.0_ Quick-Start Guide for Cybersecurity Supply Chain Risk Management (C-SCRM) provide? (Part 2)

[Assistant]
cludes other third parties such as business partners and various data and digital service providers. Practices in this QSG can be applied to manage cybersecurity risks from such relationships as well.
## C-SCRM Overview

All types of technology rely on a complex, globally distributed, extensive, and interconnected supply chain ecosystem. Cybersecurity Supply Chain Risk Management (C-SCRM) is a systematic process for managing exposure to cybersecurity risk throughout supply chains and developing appropriate response strategies, policies, processes, and procedures. C-SCRM practitioners identify, assess, and mitigate cybersecurity risks throughout the supply chain at all levels of their organizations associated with information and communications technology (ICT) products and services. Potential risks include malicious functionality, counterfeit devices, or vulnerabilities derived from poor manufacturing and development practices within the supply chain. Effective C-SCRM requires stakeholders across the enterprise to actively collaborate, communicate, and take actions to secure favorable C-SCRM outcomes. ## NIST CSF 2.0: CYBERSECURITY SUPPLY CHAIN RISK MANAGEMENT (C-SCRM)

A QUICK-START GUIDE

## HOW TO USE THE CSF TO ESTABLISH AND OPERATE A C-SCRM CAPABILITY

<!-- image -->

## Establishing a C-SCRM Capability

The CSF has a Category within its Govern Function dedicated to C-SCRM: the Cybersecurity Supply Chain Risk Management (GV.SC) Category. GV.SC contains the key outcomes that every organization should achieve through its C-SCRM capability. Additionally, many of the subcategories within the remainder of the CSF can be used to identify and communicate C- SCRM-related requirements internally for organizations and for their vendors. ## Perform these activities to establish your organization's C-SCRM capability:

Activity 1: Create a C-SCRM strategy, objectives, policies, and processes.

NIST Cybersecurity Framework 2.0_ Quick-Start Guide for Cybersecurity Supply Chain Risk Management (C-SCRM)


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Access Control?

[Assistant]
According to Guide to Auditing for Controls and Security_ A System Development Life Cycle Approach:

| | 2.5.1.2 | 2.5.1.2 | Differences in Audit Approach | 34 | |-------------------------------------------|---------------------------------------------------------------|---------------------------------------------------------------|---------------------------------------------------------------|-----------| | | 2.5.2 Off-The-Shelf SoftwareATurnkey Systems | 2.5.2 Off-The-Shelf SoftwareATurnkey Systems | 2.5.2 Off-The-Shelf SoftwareATurnkey Systems | 35 | | | 2.5.2.1 | 2.5.2.1 | Differences from the AIS Life Cycle Matrix | 36 | | | 2.5.2.2 | 2.5.2.2 | Differences in Audit Approach | 37 | | | AIS | AIS | AIS | | | 2.6 | LIFE CYCLE DOCUMENTATION | LIFE CYCLE DOCUMENTATION | LIFE CYCLE DOCUMENTATION | 37 | | | 2.6.1 Needs Statement | 2.6.1 Needs Statement | 2.6.1 Needs Statement | 38 | | | 2.6.2 | Feasibility Study Document | Feasibility Study Document | 38 | | | 2.6.3 | Risk Analysis | Risk Analysis | 38 | | | 2.6.4 | Cost/Benefit Analysis | Cost/Benefit Analysis | 40 | | | 2.6.5 | System Decision Paper | System Decision Paper | 40 | | | 2.6.6 | Audit Plan | Audit Plan | 40 | | | 2.6.7 | Project Plan | Project Plan | 41 | | | 2.6.8 | Requirements Documents | Requirements Documents | 41 | | | | Functional Requirements Document | Functional

Guide to Auditing for Controls and Security_ A System Development Life Cycle Approach


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Access Control?

[Assistant]
According to Guide to Enterprise Patch Management Planning_ Preventive Maintenance for Technology:

2 OT refers to 'programmable systems or devices that interact with the physical environment (or manage devices that interact with the physical environment). These systems/devices detect or cause a direct change through the monitoring and/or control of devices, processes, and events. Examples include industrial control systems, building management systems, fire control systems, and physical access control mechanisms.' [from NIST SP 800-37 Rev. 2]

- Harden software, such as enforcing the principles of least privilege and least functionality (e.g., deactivating or uninstalling software services, features, and other components that are not needed). For additional information on hardening assets, especially those considered critical, see the NIST publication Security Measures for 'EO-Critical Software' Use Under Executive Order (EO) 14028 (July 9, 2021).
- Acquire software that is likely to have fewer vulnerabilities over time compared to other software.
- Work with software development partners that are likely to introduce fewer vulnerabilities into software over time, taking into consideration factors such as how rigorous their secure software development practices are, how quickly they address issues and release patches, how often problems are associated with their patches, and how transparent they are in their security-related communications.
- Use managed services instead of software when feasible.

Guide to Enterprise Patch Management Planning_ Preventive Maintenance for Technology


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Recommendation for Pair-Wise Key-Establishment Using Integer Factorization Cryptography provide? (Part 9)

[Assistant]
| Key-Establishment Schemes Overview...............................................................................
16                                                                                |
| 4.1 Key-Establishment Preparations....................................................................................... 17                                                                                | 4.1 Key-Establishment Preparations....................................................................................... 17                                                                                | 4.1 Key-Establishment Preparations....................................................................................... 17                                                                                |
| 4.2 Key-Agreement Process....................................................................................................

Recommendation for Pair-Wise Key-Establishment Using Integer Factorization Cryptography


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Approaches and Challenges of Federal Cybersecurity Awareness Programs provide? (Part 10)

[Assistant]
|
| 3.1 ANNUAL REQUIRED TRAINING.............................................................................................
| 3.1 ANNUAL REQUIRED TRAINING............................................................................................. |                                                                                |
| .................................................................................... | .................................................................................... | 3                                                                                |
| 3.1.1                                                                                | Required Training Fulfillment                                                                                | 3                                                                                |
| 3.1.2                                                                                | Obtaining Training Content........................................................................................ | 4                                                                                |
| 3.1.3                                                                                | Update Frequency.......................................................................................................

Approaches and Challenges of Federal Cybersecurity Awareness Programs


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for Supply Chain Risk Management?

[Assistant]
According to Assessing Enhanced Security Requirements for Controlled Unclassified Information:

| 3.11.6e   | ENHANCED SECURITY REQUIREMENT Assess, respond to, and monitor supply chain risks associated with organizational systems and system components. | ENHANCED SECURITY REQUIREMENT Assess, respond to, and monitor supply chain risks associated with organizational systems and system components.

Assessing Enhanced Security Requirements for Controlled Unclassified Information


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Communications Protection?

[Assistant]
According to Ordered t-way Combinations for Testing State-based Systems:

rd with combinatorial interaction testing. Computer. 2013 Dec 11;47(2):37-45. - [30] Garn  B,  Simos  DE,  Zauner  S,  Kuhn  R,  Kacker  R. Browser fingerprinting using combinatorial sequence testing.
In Proceedings of the 6th Annual Symposium on Hot Topics in the Science of Security 2019 Apr 1 (pp. 1-9). - [31] Ozcan  M. An  Industrial  Study  on  Applications  of Combinatorial  Testing  in  Modern  Web  Development. In2019 IEEE International Conference on Software Testing, Verification and Validation Workshops (ICSTW) 2019 Apr 22 (pp. 210-213). - [32] Ratliff, Z. B. (2018). Black-box Testing Mobile Applications  Using  Sequence  Covering  Arrays. undergraduate thesis, Texas A&M University. - [33] Ratliff ZB, Kuhn DR, Ragsdale DJ. Detecting Vulnerabilities in Android Applications using Event Sequences. In2019 IEEE 19th International Conference on Software Quality, Reliability and Security (QRS) 2019 Jul 22 (pp. 159-166). IEEE. - [34] Elks DC, Deloglos C, Jayakumar A, Tantawy DA, Hite R, Gautham S. Realization Of An Automated T-Way Combinatorial Testing Approach For A Software Based Embedded  Digital  Device. Idaho  National  Lab.(INL),  Idaho Falls, ID (United States); 2019 Jun 17. - [35] Becci G, Dhadyalla G, Mouzakitis A, Marco J, Moore AD. Robustness testing of real-time automotive systems using sequence covering arrays. SAE International Journal of

Ordered t-way Combinations for Testing State-based Systems


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Planning?

[Assistant]
According to Validating the Integrity of Computing Devices:

This section describes the installation of the Archer IRM system for this demonstration. Our instantiation of Archer IRM is viable for a lab environment, but the reader is encouraged to refer to the architecture planning guide on the Archer IRM website for specific guidance for your environment. We elected to install the Archer IRM system across two virtual machines -one hosting a Microsoft SQL database and the other hosting the remainder of the Archer IRM services. Note that the screenshots below are from our original installation of Archer IRM 6.9. During the course of the project, we updated our Archer IRM instance to version 6.10. As a result, some screenshots may differ in your implementation from what is presented in this document.

This section describes the installation of the IBM QRadar system for this demonstration. Our instantiation of IBM QRadar is viable for a lab environment, but the reader is encouraged to refer to the architecture planning guide on the IBM website for specific guidance for your environment.

Validating the Integrity of Computing Devices


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Services Acquisition?

[Assistant]
According to Digital Identity Guidelines_ Authentication and Authenticator Management:

gement, administrative, technical,
and physical standards and guidelines for the cost-effective security and privacy of other
than national security-related information in federal information systems.
The Special
Publication 800-series reports on ITL’s research, guidelines, and outreach efforts in
information system security, and its collaborative activities with industry, government,
and academic organizations.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Information Integrity?

[Assistant]
According to Planning for a Zero Trust Architecture_ A Planning Guide for Federal Administrators:

- I. All data sources and computing services are considered resources. An enterprise relies on different resources to perform its mission: mobile devices, data stores, compute resources (including virtual), remote sensors/actuators, etc. All these components are resources and need to be considered in a ZTA. Some components (e.g., IoT sensors) may not be able to support some solutions such as configuration agents, application sandboxing, etc. so compensating technologies or alternative mitigations may be needed. If the resource lacks certain security capabilities, the enterprise may need to add a PEP component to provide that functionality. - II. The enterprise monitors and measures the integrity and security posture of all owned and associated resources. This tenet deals with the aspects of cyber hygiene for both enterprise-owned resources and those that may not be owned, but used in an enterprise workflow such as configuration, patching, application loading, etc. The state of resources should be monitored, and appropriate action taken when new information such as a new vulnerability or attack is reported or observed. The confidentiality and integrity of data on the resource should be protected. This requires enterprise admins to know how resources are configured, maintained, and monitored. - I. All communication is secured regardless of network location. In zero trust, the network is always considered contested. A ZTA should be designed with the assumption that an attacker is present on the network and could observe/modify communications. Appropriate safeguards should be in place to protect the confidentiality and integrity of data in transit. If a resource cannot provide this functionality natively, a separate PEP component may be necessary. - II. Access to individual enterprise resources is granted on a per -session basis. In an ideal zero trust architecture, every unique operation would undergo authentication and authorization before the operation is performed.

Planning for a Zero Trust Architecture_ A Planning Guide for Federal Administrators


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for Personnel Security?

[Assistant]
According to Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171:

| CHAPTERONE INTRODUCTION...................................................................................................... | CHAPTERONE INTRODUCTION...................................................................................................... |
|--------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------|
| 1.1 PURPOSEANDAPPLICABILITY                                                                                | ................................................................................................... 3                                            |
| 1.2 TARGET AUDIENCE                                                                                | .................................................................................................................. 4                             |
| 1.3 ORGANIZATIONOF THIS SPECIAL PUBLICATION                                                                                | .......................................................................... 4                                                                     |
| CHAPTERTWO THE FUNDAMENTALS............................................................................................ 5                        | CHAPTERTWO THE FUNDAMENTALS............................................................................................ 5                        |
| 2.1 DEVELOPMENTAPPROACH ......................................................................................................

Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice IA.L2-3.5.1 (NIST 3.5.1)?

[Assistant]
According to Guide to Malware Incident Prevention and Handling for Desktops and Laptops:

3.5.1 3. 3.5.1 BIOS Protection

Unauthorized modification of BIOS firmware by malicious software constitutes a significant threat because of the BIOS's unique and privileged position within the PC architecture.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Assessing Security Requirements for Controlled Unclassified Information provide? (Part 7)

[Assistant]
...103                         |
| Appendix D. Organization-Defined Parameters...............................................................................107                         |
| Appendix E.
Change Log .................................................................................................................112           |

## List of Tables

| Table 1. Security Requirement Families ..............................................................................................3   |
|------------------------------------------------------------------------------------------------------------------------------------------|
| Table 2. Summary of Assessment Preparation Phase.......................................................................104               |
| Table 3. Summary of Assessment Plan Development Phase.............................................................105                    |
| Table 4. Summary of Assessment Execution Phase..........................................................................106              |
| Table 5. Summary of Assessment Analysis, Documentation, and Reporting Phase ...........................106                               |
| Table 6. Organization-Defined Parameters......................................................................................107        |

Table 7. Change Log ....................................................................................................................... 113

## Acknowledgments

The authors gratefully acknowledge and appreciate the significant contributions from individuals and organizations in the public and private sectors whose constructive comments improved the overall quality, thoroughness, and usefulness of this publication.

Assessing Security Requirements for Controlled Unclassified Information


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Information Integrity?

[Assistant]
According to High-Performance Computing Security_ Architecture, Threat Analysis, and Security Posture:

in threats: The HPC supply chain faces a variety of threats, from the theft of proprietary information to attacks on critical hardware components and software manipulation to gain unauthorized access.
Some HPC software (e.g., OS, applications), firmware, and hardware components have limited manufacturers, suppliers, and integrators, which makes diversification difficult. Limited suppliers also lead to shortages in the qualified workforce who can provide required technical support. - Insider threats: Insider threats come from people within the organization who have internal information and may have the privileges needed to access the HPC system. Insider threats can be classified into accidental/unintentional threats and malicious/intentional threats. Unintentional threats come from the unintended side effects of normal actions and activity. In contrast, a malicious insider may intentionally upload malicious code into the HPC system.

High-Performance Computing Security_ Architecture, Threat Analysis, and Security Posture


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Guide to Auditing for Controls and Security_ A System Development Life Cycle Approach provide? (Part 5)

[Assistant] GOVERNMENT PRINTING OFFICE WASHINGTON: 1988 ^ ## Table of Contents | EXECUTIVE SUMMARY | EXECUTIVE SUMMARY | EXECUTIVE SUMMARY | EXECUTIVE SUMMARY | xiii | |-------------------------|------------------------------------------------------------|------------------------------------------------------------|------------------------------------------------------------|--------| | CHAPTER 1 | CHAPTER 1 | CHAPTER 1 | CHAPTER 1 | | | GENERALADP AUDIT ISSUES | GENERALADP AUDIT ISSUES | GENERALADP AUDIT ISSUES | GENERALADP AUDIT ISSUES | 1 | | 1.1 | INTRODUCTION | INTRODUCTION | INTRODUCTION | 1 | | | 1.1.1 | Scope of the Audit Guide | Scope of the Audit Guide | 1 | | | 1.1.2 | How to Use the Audit Guide | How to Use the Audit Guide | 2 | | | 1.1.3 | Auditor Skills Needed | Auditor Skills Needed | 2 | | | 1.1.4 | Auditing in a Computerized Environment | Auditing in a Computerized Environment | 3 | | | 1.1.4.1 | 1.1.4.1 | The Need | 3 | | | 1.1.4.2 | 1.1.4.2 | The Scope of Audit in a Computerized Environment | 3 | | | 1.1.4.3 | 1.1.4.3 | Relationship Between Systems Development Audits and | | | | Operational Audits of Automated Information Systems (AISs) | Operational Audits of Automated Information Systems (AISs) |


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Incident Response Recommendations and Considerations for Cybersecurity Risk Management_ A CSF 2.0 Community Profile provide? (Part 3)

[Assistant]
l official. This publication may be used by nongovernmental organizations on a voluntary basis and is not subject to copyright in the United States. Attribution would, however, be appreciated by NIST.
## NIST Technical Series Policies

Copyright, Use, and Licensing Statements NIST Technical Series Publication Identifier Syntax

## Publication History

Approved by the NIST Editorial Review Board on 2025-03-25 Supersedes NIST SP 800-61r2 (August 2012) https://doi.org/10.6028/NIST.SP.800-61r2

## How to Cite this NIST Technical Series Publication

Nelson A, Rekhi S, Souppaya M, Scarfone K (2025) Incident Response Recommendations and Considerations for Cybersecurity Risk Management: A CSF 2.0 Community Profile. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) NIST SP 800-61r3. https://doi.org/10.6028/NIST.SP.800-61r3

## Author ORCID iDs

Alex Nelson: 0000-0002-3771-570X

Sanjay Rekhi: 0009-0008-8711-4030

Murugiah Souppaya: 0000-0002-8055-8527

Karen Scarfone: 0000-0001-6334-9486

## Contact Information

800-61-comments@nist.gov

National Institute of Standards and Technology Attn: Computer Security Division, Information Technology Laboratory

100 Bureau Drive (Mail Stop 8930) Gaithersburg, MD 20899-8930

## Additional Information

Additional information about this publication is available at https://csrc.nist.gov/pubs/sp/800/61/r3/final, including related content, potential updates, and document history. All comments are subject to release under the Freedom of Information Act (FOIA). ## Abstract

This publication seeks to assist organizations with incorporating cybersecurity incident response recommendations and considerations throughout their cybersecurity risk management activities as described by the NIST Cybersecurity Framework (CSF) 2.0.

Incident Response Recommendations and Considerations for Cybersecurity Risk Management_ A CSF 2.0 Community Profile


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for System and Services Acquisition?

[Assistant]
According to Protecting Controlled Unclassified Information (CUI)_ NIST Special Publication 800-171, Revision 3. Small Business Primer:

|                      | When provided as part of a government contract, examples include:                                                                                | Marking 1     |
|----------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------|
| Controlled           | e.g., research and engineering data, engineering drawings, specifications, process sheets, manuals, technical reports, technical orders, catalog-item identifications, data sets, studies and analyses and related information, and computer software executable code and source code. | CUI//SP-CTI   |
| General Proprietary  | e.g., financial information, trade secrets, product research and development, existing and future product designs and performance specifications.

Protecting Controlled Unclassified Information (CUI)_ NIST Special Publication 800-171, Revision 3. Small Business Primer


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Security Assessment?

[Assistant]
According to Summary of NIST SP 800-53, Revision 4_ Security and Privacy Controls for Federal Information Systems and Organizations:

SP 800-53 Revision 4 has been updated to reflect the evolving technology and threat space. Example areas include issues particular to mobile and cloud computing; insider threats; applications security; supply chain risks; advanced persistent threat; and trustworthiness, assurance, and resilience of information systems. The revision also contains a new appendix of privacy controls, and related implementation guidance (Appendix J), based on the Fair Information Practice Principles (FIPPs), a widely accepted framework of defining principles to be used in the evaluation and consideration of systems, processes, or programs that affect individual privacy. Many organizations use well-known international information security standards as the basis or as a supplemental source of security controls for risk management. To aid in selection and comparison, SP 800-53 Rev. 4 provides mapping tables to provide organizations with a general indication of security control coverage with respect to ISO/IEC 27001, Information technologySecurity techniques-Information security management systems-Requirements and ISO/IEC 15408, Information technology -- Security techniques -- Evaluation criteria for IT security . ISO/IEC 27001 applies to all types of organizations and specifies requirements for establishing, implementing, operating, monitoring, reviewing, maintaining, and improving a documented information security management system (ISMS) within the context of business risks. ISO/IEC 15408 (also known as the Common Criteria) provides functionality and assurance requirements for developers of information systems and information system components (i.e., information technology products).

Summary of NIST SP 800-53, Revision 4_ Security and Privacy Controls for Federal Information Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Communications Protection?

[Assistant]
According to Blockchain for Access Control Systems:

contract language requires  changes  to  secure  programming  practices,  or  changing  a  legacy  protocol  to Hypertext Transfer Protocol Secure (HTTPS) requires new communications acknowledgements.
Storing AC data and logs on the blockchain raises questions of privacy as all subjects can see all entries,  and  auditable  access  history  in  the  blockchain  can  violate  user  privacy. The  exposed information may also provide information for attacking systems or users. If regulations require AC data owners who are accountable for all data privacy, then instead of storing private data on the blockchain, consider storing index numbers that are tied to private data in an off-the-chain system. Thus, subjects can own, secure, and even delete their privacy data. Otherwise, methods or tools facilitating cryptography need to be considered for privacy protection [GT].


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AU.L2-3.3.0 (NIST 3.3.0)?

[Assistant]
According to Guidelines on Mobile Device Forensics:

3.3.0, GSM Association, Permanent Reference Document TW.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Summary of NIST SP 800-53, Revision 4_ Security and Privacy Controls for Federal Information Systems and Organizations provide? (Part 8)

[Assistant]
sions. This documentation is essential when examining the security considerations for organizational information systems with respect to the potential impact on an organization's mission and business.
The resulting tailored baseline set of security controls and the supporting rationale for the selection decisions (including any information system use restrictions required by organizations) are documented in system security plans. Documenting significant risk management decisions in the security control selection process is imperative so that authorizing officials have access to necessary information to make informed authorization decisions for organizational information systems, as demonstrated in Figure 3. Figure 3: Security Control Selection Process

<!-- image -->

## 5 Assurance

Appendix E in SP 800-53 Revision 4 provides an update to guidance regarding security assurance. This section outlines methods for agencies to establish measures of confidence that the implemented security controls provide the security capability required to protect critical missions and business operations. The criteria for whether a security control is assurance- or functionality-related is based on the overall characteristics of the control. In general, assurance-related controls are controls that: (i) define processes, procedures, techniques, or methodologies for designing and developing information systems and system components; (ii) provide supporting operational processes including improving the quality of systems, components, or processes; (iii) produce security evidence from developmental or operational activities; (iv) determine security control effectiveness or risk; or (v) improve personnel skills, expertise, and understanding. Appendix E provides three tables that identify specific assurance-related controls that are included in the low-, moderate-, and high-impact baselines described in Appendix D.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Protecting Information and System Integrity in Industrial Control System Environments_ Cybersecurity for the Manufacturing Sector provide? (Part 9)

[Assistant]
ip with NIST or recommendation or endorsement by NIST or NCCoE; neither is it intended to imply that the entities, equipment, products, or materials are necessarily the best available for the purpose.
## NIST SPECIAL PUBLICATION 1800-10B

\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

## Protecting Information and System Integrity in Industrial Control System Environments:

Cybersecurity for the Manufacturing Sector

\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

## Volume B:

Approach, Architecture, and Security Characteristics

## Michael Powell

National Cybersecurity Center of Excellence National Institute of Standards and Technology

Michael Pease Keith Stouffer CheeYee Tang Timothy Zimmerman

Engineering Laboratory National Institute of Standards and Technology

## Matthew Zopf

Strativia Largo, Maryland

FINAL

March 2022

This publication is available free of charge from https://doi.org/10.6028/NIST.SP.1800-10

The first draft of this publication is available free of charge from https://www.nccoe.nist.gov/publications/practice-guide/protecting-information-and-systemintegrity-industrial-control-system-draft

<!-- image -->

Joseph Brule Chelsea Deane John Hoyt Mary Raguso Aslam Sherule Kangmin Zheng

The MITRE Corporation McLean, Virginia

## DISCLAIMER

Certain commercial entities, equipment, products, or materials may be identified by name or company logo or other insignia in order to acknowledge their participation in this collaboration or to describe an experimental procedure or concept adequately.

Protecting Information and System Integrity in Industrial Control System Environments_ Cybersecurity for the Manufacturing Sector


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Access Control?

[Assistant]
According to Automated Secure Configuration Guidance from the macOS Security Compliance Project (mSCP):

```
id: sysprefs_screensaver_timeout_enforce title: "Enforce Screen Saver Timeout" discussion: | The screen saver timeout _MUST_ be set to $ODV seconds or a shorter length of time. This rule ensures that a full session lock is triggered within no more than $ODV seconds of inactivity. check: | /usr/bin/osascript -l JavaScript << EOS function run() { let timeout = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.screensaver') \ .objectForKey('idleTime')) if ( timeout <= $ODV ) { return("true") } else { return("false") } } EOS result: string: "true" fix: | This is implemented by a Configuration Profile. references: cce: -CCE-91074-5 cci: -CCI-000057 800-53r5: -AC-11 -IA-11 800-53r4: -AC-11 srg: -SRG-OS-000029-GPOS-00010 disa_stig: -APPL-12-000004 800-171r2: -3.1.10 cis: benchmark: - 2.3.1 (level 1) controls v8: - 4.3 macOS: - "12.0" odv: hint: "Number of seconds." default: 1200 stig: 900 cis_lvl1: 1200 cis_lvl2: 1200
```

Automated Secure Configuration Guidance from the macOS Security Compliance Project (mSCP)


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Summary Report for “Workshop on Updating Manufacturer Guidance for Securable Connected Product Development” provide? (Part 4)

[Assistant]
introduce and discuss potential areas to update as the NIST Cybersecurity for Internet of Things (IoT) program revises Foundational Cybersecurity Activities for IoT Device Manufacturers, NIST IR 8259.
The workshop was structured into two portions: a morning colloquium of plenary speakers and afternoon discussion sessions to dive deeper into the topics highlighted in the morning. The workshop yielded many discussions and significant feedback for NIST. This report summarizes what was discussed at the workshop and provides these insights to the broader public. The table of takeaways below illustrates the takeaways from the workshop from Section 3. Table 1 - Table of Takeaways

|   1. | Government actions to support strengthening IoT cybersecurity need to be coordinated with industry. |
|------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
|    2 | The use of robust frameworks and the adoption of open standards are crucial for effectively managing risks across heterogeneous environments. |
|    3 | The dynamic nature of threats requires more context aware inputs, more proactive tracking and mitigation measures, and more examination into the inputs of the threat modeling approach. |
|    4 | There are market opportunities to securely design the next wave of products with cybersecurity through end of life and instill incentives into the maintenance of existing products. |
|    5 | The balance of shared responsibility between manufacturers and users for improving security varies by sector and needs the right incentives for both. |
|    6 | There are broad challenges to integrating privacy objectives into IoT cybersecurity risk management. |
|    7 | There is an increased awareness for evolving cybersecurity responsibilities across the players of the IoT ecosystem from manufacturers to users of the ecosystem.

Summary Report for “Workshop on Updating Manufacturer Guidance for Securable Connected Product Development”

Audit and Accountability
System and Information Integrity
Security Assessment
Media Protection
Identification and Authentication
Awareness and Training
System and Communications Protection
Access Control
Planning
Incident Response
Risk Assessment
Personnel Security
System and Services Acquisition
Maintenance
Physical Protection
Configuration Management


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does High-Performance Computing Security_ Architecture, Threat Analysis, and Security Posture provide? (Part 7)

[Assistant]
....7                            |
| 2.1.12. HPC Software..............................................................................................................................8     |
| 2.1.13.
User Software.............................................................................................................................8     |
| 2.1.14. Site-Provided Software and Vendor Software ...........................................................................8                         |
| 2.1.15. Containerized Software in HPC ..................................................................................................9               |
| 3. HPC Threat Analysis......................................................................................................................10          |
| 3.2.1. Access Zone Threats...................................................................................................................11         |
| 3.2.2. Management Zone Threats........................................................................................................11                |
| 3.2.3. High-Performance Computing Zone Threats..............................................................................12                          |
| 3.2.4. Data Storage Zone Threats.........................................................................................................12             |
| 4. HPC Security Posture, Challenges, and Recommendations.............................................................14                                 |
| 5.