[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Machine Learning for Access Control Policy Verification provide? (Part 10)

[Assistant]
he detecting effort. In other words, instead of checking by retracing the interrelations between rules after the policy is completed, it only checks the new added rule against previous 'correct' ones.
Even though this method does not require comprehensive large numbers

of test cases, requirements, or an oracle, the translation or mapping process for implementing the simulated system is a challenge [VK13]. This report proposes an innovative technique that applies a classification algorithm of machine learning [ML] to answer challenges of capability due to the coverage of test cases or oracle and the difficulty of system translation from traditional access control policy verification methods. In this report, the Introduction describes the challenges of traditional policy verification methods. Section 2 explains how an ML Classification method can be applied to policy verification. Section 3  demonstrates  a  policy  verification  approach  for  an  ML  random  forest  classification  (RFC) algorithm. Section  4  describes  general  access  control  applications  that  can  benefit  from  the proposed method. The last section is the Conclusion. ## 2 Machine Learning for Access Control Verification

Machine learning has been used for device control, system analysis, and business forecasting. However, the use of ML for software testing is in the early stages [AWCS, CAT5]. In particular, ML applications for model proof are still elusive and have yet to be explored. ML classification allows for the generation or prediction of target classes for new input data using some sample training data produced by running the system instead of comprehensive input data. For access control policy verification, the training data is assigned attributes' values of policy rules, and the target for classification is access permissions (e.g., grant and deny) assigned to rules. The data is consumed by an ML classification algorithm to  generate a classification model .

Machine Learning for Access Control Policy Verification


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does NIST Cybersecurity Framework 2.0_ Quick-Start Guide for Cybersecurity Supply Chain Risk Management (C-SCRM) provide? (Part 7)

[Assistant]
ine if additional supplier requirements are needed based on existing criticality criteria, such as your mission or business, data type being processed, or digital product or service being provided. 2.
Create CSF Target Profiles for Each Supplier Criticality Level. The next page explains how to express supplier requirements for each supplier criticality level.

NIST Cybersecurity Framework 2.0_ Quick-Start Guide for Cybersecurity Supply Chain Risk Management (C-SCRM)

Audit and Accountability
System and Information Integrity
Security Assessment
Media Protection
Identification and Authentication
Awareness and Training
System and Communications Protection
Access Control
Planning
Incident Response
Risk Assessment
Personnel Security
System and Services Acquisition
Supply Chain Risk Management
Maintenance
Physical Protection
Configuration Management


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Configuration Management?

[Assistant]
According to Guide to a Secure Enterprise Network Landscape:

Access to multiple cloud services, the geographic spread of enterprise Information Technology (IT) resources (including multiple data centers), and the emergence of microservices-based applications (as opposed to monolithic ones) have significantly altered the enterprise network landscape. This document is meant to provide guidance to this new enterprise network landscape from a secure operations perspective. Hence, it starts by examining the security limitations of current network access solutions to the enterprise network. It then considers security feature enhancements to traditional network appliances in the form of point security solutions, network configurations for various security functions (e.g., application/services security, cloud services access security, device or endpoint security), security frameworks that integrate these individual network configurations (e.g., zero trust network access [ZTNA]), and the evolving wide area network (WAN) infrastructure to provide a comprehensive set of security services for the modern enterprise network landscape (e.g., secure access service edge [SASE]).

Guide to a Secure Enterprise Network Landscape


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Automated Secure Configuration Guidance from the macOS Security Compliance Project (mSCP) provide? (Part 5)

[Assistant]
and the project documentation wiki is at https://github.com/usnistgov/macos\_security/wiki. ## Trademark Information

All registered trademarks or trademarks belong to their respective organizations.
## Patent Disclosure Notice

NOTICE: ITL has requested that holders of patent claims whose use may be required for compliance with the guidance or requirements of this publication disclose such patent claims to ITL. However, holders of patents are not obligated to respond to ITL calls for patents and ITL has not undertaken a patent search in order to identify which, if any, patents may apply to this publication. As of the date of publication and following call(s) for the identification of patent claims whose use may be required for compliance with the guidance or requirements of this publication, no such patent claims have been identified to ITL. No representation is made or implied by ITL that licenses are not required to avoid patent infringement in the use of this publication. ## Table of Contents

|                                                                                | Introduction ...................................................................................................................... | Introduction ......................................................................................................................

Automated Secure Configuration Guidance from the macOS Security Compliance Project (mSCP)


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AT.L2-3.2.2 (NIST 3.2.2)?

[Assistant]
According to Data Integrity_ Detecting and Responding to Ransomware and Other Destructive Events:

3.2.2 Resolution

The build provides several mechanisms to detect and mitigate this use case.

Data Integrity_ Detecting and Responding to Ransomware and Other Destructive Events


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Planning?

[Assistant]
According to Guidelines on Mobile Device Forensics:

There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may be used by Federal agencies even before the completion of such companion publications. Thus, until each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning and transition purposes, Federal agencies may wish to closely follow the development of these new publications by NIST.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Identification and Authentication?

[Assistant]
According to Strategies for the Integration of Software Supply Chain Security in DevSecOps CI_CD Pipelines:

- Subverting, removing, or introducing a step within the SSC to maliciously modify or sabotage the resulting software product
- Stealing credentials from the build system to mint and sign unauthorized malicious software
- Causing naming collisions

- Source code
- Credentials
- Sensitive data
- Internal operations
- Build systems

A software developer's workstation typically contains various assets, including source code, credentials, and access to sensitive information, such as personally identifiable information (PII), protected health information (PHI), intellectual property (IP), cryptographic materials (e.g., software artifact signing keys), and proprietary information. Companies should identify critical assets and implement controls to protect them from unauthorized access, such as access controls, multi-factor authentication, encryption of data at rest and in transit, and data loss prevention (DLP) measures.

Strategies for the Integration of Software Supply Chain Security in DevSecOps CI_CD Pipelines


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Risk Management Framework for Information Systems and Organizations_ A System Life Cycle Approach for Security and Privacy provide? (Part 8)

[Assistant] Barrett, Kathleen Coupe, Jeff Eisensmith, Chris Enloe, Ned Goren, Matthew Halstead, Jody Jacobs, Ralph Jones, Martin Kihiko, Raquel Leone, and the scientists, engineers, and research staff from the Computer Security Division and the Applied Cybersecurity Division for their exceptional contributions in helping to improve the content of the publication.

Risk Management Framework for Information Systems and Organizations_ A System Life Cycle Approach for Security and Privacy


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Communications Protection?

[Assistant]
According to Digital Identity Guidelines_ Identity Proofing and Enrollment:

3.13. Requirements for the Validation of Physical Evidence . . . . . . . . . . .

• Physical or digital address: A physical (i.e., mailing address) or digital (e.g., phone
number or email) address at which the applicant can receive communications
related to the proofing process.

cryptographically protected and can be validated using approved cryptography
through verification of a digital signature applied by the issuing source.

Digital Identity Guidelines_ Identity Proofing and Enrollment


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Access Control?

[Assistant]
According to Zero Trust Architecture:

| 1 INTRODUCCIÓN..................................................................................................................................................10 | 1 INTRODUCCIÓN..................................................................................................................................................10 | 1 INTRODUCCIÓN..................................................................................................................................................10 | |---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------| | 1.1 | HISTORIA DE LOS PROGRAMAS DE CONFIANZA CERO RELACIONADOS CON LAS AGENCIAS FEDERALES .................................11 | | | 1.2 | E STRUCTURA DEL DOCUMENTO .........................................................................................................................12 | | | CONCEPTOS BÁSICOS DE LA CONFIANZA CERO.................................................................................................13 | CONCEPTOS BÁSICOS DE LA CONFIANZA CERO.................................................................................................13 | | | 2.1 | PRINCIPIOS DE LA CONFIANZA CERO ....................................................................................................................15 | | | 2.2 | VISIÓN DE CONFIANZA CERO DE UNA RED .............................................................................................................17 | | | COMPONENTES LÓGICOS DE LA ARQUITECTURA DE CONFIANZA CERO..........................................................19 | COMPONENTES LÓGICOS DE LA ARQUITECTURA DE CONFIANZA CERO..........................................................19 | | | 3.1 VARIACIONES DE LOS ENFOQUES DE LA ARQUITECTURA DE CONFIANZA CERO ...............................................................21 | 3.1 VARIACIONES DE LOS ENFOQUES DE LA ARQUITECTURA DE CONFIANZA CERO ...............................................................21 | | | 3.1.1 | ZTA basada en una gobernanza de la identidad mejorada...................................................................22 | | | 3.1.2 | ZTA y el uso de la microsegmentación..................................................................................................23 | | | 3.1.3 | ZTA y el uso de una infraestructura de red y perímetros definidos a través de software....................23 | | | 3.2 | VARIANTES IMPLEMENTADAS DE LA ARQUITECTURA ABSTRACTA ...............................................................................24 | | | 3.2.1 | Despliegue basado en agentes y puertas de enlace de los dispositivos...............................................24


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Awareness and Training?

[Assistant]
According to Guidelines for Media Sanitization:

..................................13  |
| 3.2.4. Quality of Cryptographic Implementations................................................................................15                   |
| 3.2.5.
Traceability of CE Operations.....................................................................................................16         |
| Media Sanitization Program .........................................................................................................18              |
| 4. |
| 4.3.1. Information Decisions in the System Life Cycle..........................................................................20                   |
| 4.3.2. Determination of Security Categorization..................................................................................21                 |
| 4.3.3. Reuse of Media...........................................................................................................................22  |
| 4.3.4. Control of Media ........................................................................................................................22  |
| 4.3.5. Data Protection Level .................................................................................................................23    |
| 4.3.6. Sanitization and Disposal Decision.............................................................................................23            |


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Access Control?

[Assistant]
According to Guidelines for the Use of PIV Credentials in Facility Access:

credential; e-authentication; identity credential; issuance; personal identity verification (PIV); physical access control system (PACS); PIV authentication mechanisms; PIV cards; public key infrastructure (PKI); validation

This document is intended for government officials responsible for implementing Homeland Security Presidential Directive-12 (HSPD-12) compliant physical access control systems (PACS). Information in this document is also useful to government contractors and physical security vendors that provide HSPD-12 systems, products, and integration services. It is expected that readers have a general knowledge of PIV standards, including [FIPS 201-2], [SP800-73], and [SP800-78].

Many changes in this document were made to align SP 800-116 with revision 2 of FIPS 201 (FIPS 201-2). For example, credential validation is now required (see Section 4.4). The CHUID authentication mechanism has been deprecated due to security concerns. For this reason, this publication marks the authentication mechanism as deprecated to signify that it is not a viable authentication mechanism to deploy for physical access control system (PACS). The CHUID data element on the PIV Card, however, remains a mandatory element as the BIO(-A) and SYMCAK authentication mechanisms use the data element as a source for the card's expiration date. It also provides unique identifiers for PACS ACLs. The previous version of this document also included the combined VIS + CHUID authentication mechanism as an option to transitioning from Unrestricted to Controlled areas. VIS + CHUID, however, is not included in this version of the document since it provides 'LITTLE or NO' confidence in the identity of the cardholder.

Guidelines for the Use of PIV Credentials in Facility Access


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Access Control on NoSQL Databases provide? (Part 3)

[Assistant]
weak authorization mechanisms. As access control is a fundamental data protection requirement of any database management system DBMS, this document focuses on access control on NoSQL database systems.
## Keywords

access control; attribute-based access control; authorization; database systems; No-SQL; SQL. ## Reports on Computer Systems Technology

The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the Nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology. ITL's responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in federal information systems. ## Patent Disclosure Notice

NOTICE: ITL has requested that holders of patent claims whose use may be required for compliance with the guidance or requirements of this publication disclose such patent claims to ITL. However, holders of patents are not obligated to respond to ITL calls for patents and ITL has not undertaken a patent search in order to identify which, if any, patents may apply to this publication. As of the date of publication and following call(s) for the identification of patent claims whose use may be required for compliance with the guidance or requirements of this publication, no such patent claims have been identified to ITL. No representation is made or implied by ITL that licenses are not required to avoid patent infringement in the use of this publication.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Organizational Views of NIST Cryptographic Standards and Testing and Validation Programs provide? (Part 5)

[Assistant]
|
| 5.1.1. Benefits.................................................................................................................. | 5.1.1.
Benefits.................................................................................................................. | 6                                                                                |
| 5.1.2. Challenges ............................................................................................................. | 5.1.2. Challenges ............................................................................................................. | 8                                                                                |
| 5.2. Testing/Validation Programs and Certifications ....................................................... | 5.2. Testing/Validation Programs and Certifications ....................................................... | 15                                                                                |
| 5.2.1. Benefits................................................................................................................ | 5.2.1. Benefits................................................................................................................ | 15                                                                                |
| 5.2.2.

Organizational Views of NIST Cryptographic Standards and Testing and Validation Programs


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AC.L2-3.1.2 (NIST 3.1.2)?

[Assistant]
According to Validating the Integrity of Computing Devices:

3.1.2                                                                                | Asset Inventory and Discovery ... 3.1.2 Asset Inventory and Discovery

Organizational members with access to the enterprise database of computing devices can access a listing by authenticating to the Archer system. 3.1.2.

Validating the Integrity of Computing Devices


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Physical Protection?

[Assistant]
According to Guide for Developing Security Plans for Federal Information Systems:

The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology promotes the United States economy and public welfare by providing technical leadership for the Nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof-of-concept implementations, and technical analyses to advance the development and productive use of information technology. ITL's responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of non-national-security-related information in federal information systems. This Special Publication 800 series reports on ITL's research, guidelines, and outreach efforts in information system security and its collaborative activities with industry, government, and academic organizations. applications 3 are not required because the security controls for those applications are typically provided by the general support system or major application in which they operate. In those cases where the minor application is not connected to a major application or general support system, the minor application should be briefly described in a general support system plan that has either a common physical location or is supported by the same organization. Additional information is provided in Chapter 2. system to the high watermark or highest impact level must be applied when grouping minor applications/subsystems with varying FIPS 199 impact levels into a single general support system or major application unless there is adequate boundary protection, e.g., firewalls and encryption, around those subsystems or applications with the highest impact level. Additionally, there must be assurance that the shared resources, i.e., networks, communications, and physical access within the whole general support system or major application, are protected adequately for the highest impact level.

Guide for Developing Security Plans for Federal Information Systems


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Planning?

[Assistant]
According to Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule_ A Cybersecurity Resource Guide:

| Standard | Sections | Implementation Specifications (R) = Required, (A) = Addressable | |-----------------------------------------------------|---------------------------|-------------------------------------------------------------------| | Administrative Safeguards | Administrative Safeguards | Administrative Safeguards | | Security Management Process | 164.308(a)(1) | Risk Analysis (R) | | Security Management Process | 164.308(a)(1) | Risk Management (R) | | Security Management Process | 164.308(a)(1) | Sanction Policy (R) | | Security Management Process | 164.308(a)(1) | Information System Activity Review (R) | | Assigned Security Responsibility | 164.308(a)(2) | (R) | | Workforce Security | 164.308(a)(3) | Authorization and/or Supervision (A) | | Workforce Security | 164.308(a)(3) | Workforce Clearance Procedure (A) | | Workforce Security | 164.308(a)(3) | Termination Procedures (A) | | Information Access Management | 164.308(a)(4) | Isolating Health care Clearinghouse Function (R) | | Information Access Management | 164.308(a)(4) | Access Authorization (A) | | Information Access Management | 164.308(a)(4) | Access Establishment and Modification (A) | | Security Awareness and Training | 164.308(a)(5) | Security Reminders (A) | | Security Awareness and Training | 164.308(a)(5) | Protection from Malicious Software (A) | | Security Awareness and Training | 164.308(a)(5) | Log-in Monitoring (A) | | Security Awareness and Training | 164.308(a)(5) | Password Management (A) |

Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule_ A Cybersecurity Resource Guide


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Configuration Management?

[Assistant]
According to Guide to Enterprise Patch Management Planning_ Preventive Maintenance for Technology:

1. Know when new software vulnerabilities affect your organization's assets, including applications, operating systems, and firmware. This involves knowing what assets your organization uses and which software and software versions those assets run down to the level of packages and libraries, as well as keeping track of new vulnerabilities in that software. For example, your organization might subscribe to vulnerability feeds from software vendors, security researchers, and the National Vulnerability Database (NVD). 2. Plan the risk response. This involves assessing the risk the vulnerability poses to your organization, choosing which form of risk response (or combination of forms) to use, and deciding how to implement the risk response. For example, you might determine that risk is elevated because the vulnerability is present in many organization assets and is being exploited in the wild, then choose mitigation as the risk response and mitigate the vulnerability by upgrading the vulnerable software and altering the software's configuration settings. 3. Execute the risk response. This will vary depending on the nature of the selected risk response, but common phases include the following:
- a. Prepare the risk response. This encompasses any preparatory activities, such as acquiring, validating, and testing patches for the vulnerable software; deploying additional security controls to safeguard the vulnerable software; or acquiring a replacement for a legacy asset that cannot be patched. It might also include scheduling the risk response and coordinating deployment plans with enterprise change management, business units, and others. - b. Implement the risk response. Examples of this include distributing and installing a patch, purchasing cybersecurity insurance, deploying additional security controls, and changing asset configurations and state (e.g., software reset,

- Distribute the patch.

Guide to Enterprise Patch Management Planning_ Preventive Maintenance for Technology


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Federal Cybersecurity Awareness Programs_ A Mixed Methods Research Study provide? (Part 10)

[Assistant]
............................................................ 18 | REFERENCES............................................................................................................................
18 |
| List of Appendices                                                                                | List of Appendices                                                                                | List of Appendices                                                                                |
| APPENDIX A-ACRONYMS................................................................................................. 20                   | APPENDIX A-ACRONYMS................................................................................................. 20                   | APPENDIX A-ACRONYMS................................................................................................. 20                   |
| APPENDIXB-FOCUS GROUP DEMOGRAPHICS QUESTIONS................................. 21                                                          | APPENDIXB-FOCUS GROUP DEMOGRAPHICS QUESTIONS................................. 21                                                          | APPENDIXB-FOCUS GROUP DEMOGRAPHICS QUESTIONS................................. 21                                                          |
| APPENDIXC-FOCUS GROUP QUESTIONS.................................................................... 25                                    | APPENDIXC-FOCUS GROUP QUESTIONS.................................................................... 25                                    | APPENDIXC-FOCUS GROUP QUESTIONS....................................................................

Federal Cybersecurity Awareness Programs_ A Mixed Methods Research Study


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Configuration Management?

[Assistant]
According to Multi-Factor Authentication for Criminal Justice Information Systems_ Implementation Considerations for Protecting Criminal Justice Information:

| Executive Summary............................................................................................................................1        |
|-------------------------------------------------------------------------------------------------------------------------------------------------------|
| 1. Introduction...................................................................................................................................3   |
| 2. An Overview of MFA Technologies and Concepts ............................................................................5                         |
| 2.4.1. Benefits of Identity Federation ....................................................................................................7          |
| 2.4.2. Benefits of Single Sign-On ............................................................................................................8       |
| 3. Choosing an MFA Implementation for Protecting CJI .....................................................................11                          |
| 3.1.1. Principle 1: Authenticator Reusability........................................................................................12               |
| 3.1.2. Principle 2: Authenticator Optionality .......................................................................................12               |
| 3.1.3. Principle 3: Minimize the Passing of Memorized Secrets ..........................................................12                            |
| 3.1.4. Principle 4: Ensure MFA Is Integrated to Protect CJI..................................................................13                       |
| 3.2.1. MFA Users ..................................................................................................................................13 |
| 3.2.2.

Multi-Factor Authentication for Criminal Justice Information Systems_ Implementation Considerations for Protecting Criminal Justice Information


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 2 require for Personnel Security?

[Assistant]
According to Profile of the IoT Core Baseline for Consumer IoT Products:

| Vulnerability                                                                                | Relevant Consumer Profile Capabilities                                                                                |
|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Commands can be launched using the device                                                                                | Interface Access Control Documentation                                                                                |
| Unauthorized Publication of Fitness Tracker Data - Fitness tracker location data for military personnel were publicly posted even when product was configured for privacy. | Unauthorized Publication of Fitness Tracker Data - Fitness tracker location data for military personnel were publicly posted even when product was configured for privacy.

Profile of the IoT Core Baseline for Consumer IoT Products


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Physical Protection?

[Assistant]
According to Approaches and Challenges of Federal Cybersecurity Awareness Programs:

The  Information  Technology  Laboratory  (ITL)  at  the  National  Institute  of  Standards  and Technology  (NIST)  promotes  the  U.S.  economy  and  public  welfare  by  providing  technical leadership  for  the  Nation's  measurement  and  standards  infrastructure.  ITL  develops  tests,  test methods, reference data, proof of concept implementations, and technical analyses to advance the development  and  productive  use  of  information  technology.  ITL's  responsibilities  include  the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in federal information systems.

'For our main enterprise network, it's computer-based training that's taken annually…But for those who don't have access to the enterprise network often for certain other networks that we might maintain,…those are physical briefings done by the ISSOs [information system security officers] to those personnel. And then they sign an acknowledgment form.' (D03)

'You've got IT security, physical security, personnel security, etc. And they have their own training requirements…It's inefficient.' (S11)

Approaches and Challenges of Federal Cybersecurity Awareness Programs


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for Identification and Authentication?

[Assistant]
According to Protecting Controlled Unclassified Information (CUI)_ NIST Special Publication 800-171, Revision 3. Small Business Primer:

| Access Control                    | Maintenance         | Security Assessment and Monitoring   |
|-----------------------------------|---------------------|--------------------------------------|
| Awareness and Training            | Media Protection    | System and Communications Protection |
| Audit and Accountability          | Personnel Security  | System and Information Integrity     |
| Configuration Management          | Physical Protection | Planning                             |
| Identification and Authentication | Risk Assessment     | System and Services Acquisition      |
| Incident Response                 |                     | Supply Chain Risk Management         |

- View all SP 800-171 Access Control Requirements and Assessment Procedures
- NIST Identity and Access Management Resources

- An understanding of the need for security (why is cybersecurity important to our business mission?).
- Specific actions required of users to maintain security (required use of multi-factor authentication, not sharing passwords, etc.).
- How to respond to confirmed or suspected incidents.
- How to securely handle CUI (training should be provided to staff before authorizing access to the system or CUI).
- How to recognize and report insider threats, social engineering, and social mining.

Protecting Controlled Unclassified Information (CUI)_ NIST Special Publication 800-171, Revision 3. Small Business Primer


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for System and Services Acquisition?

[Assistant]
According to Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171:

There may be references in this publication to other publications currently under development by  NIST  in  accordance  with  its  assigned  statutory  responsibilities. The  information  in  this publication, including concepts, practices, and methodologies, may be used by federal agencies even  before  the  completion  of  such  companion  publications. Thus,  until  each  publication  is completed,  current  requirements,  guidelines,  and  procedures,  where  they  exist,  remain operative. For planning and transition purposes, federal agencies may wish to closely follow the development of these new publications by NIST. The National Institute of Standards and Technology (NIST) Information Technology Laboratory (ITL) promotes the U.S. economy and public welfare by providing technical leadership for the Nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology (IT). ITL's responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the costeffective security of other than national security-related information in federal information systems. The Special Publication 800-series reports on ITL's research, guidelines, and outreach efforts in information systems security and privacy and its collaborative activities with industry, government, and academic organizations. | CHAPTERONE INTRODUCTION...................................................................................................... | CHAPTERONE INTRODUCTION......................................................................................................

Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What are the CMMC Level 2 requirements?

[Assistant]
According to Assessing Security Requirements for Controlled Unclassified Information:

other than the ones noted above, are available at

Organizations are encouraged to review all draft publications during public comment periods and provide feedback https://csrc.nist.gov/publications.
## Authority

This publication has been developed by NIST in accordance with its statutory responsibilities under the Federal Information Security Modernization Act (FISMA) of 2014, 44 U.S.C. § 3551 et seq., Public Law (P.L.) 113-283 [1]. NIST is responsible for developing information security standards and guidelines, including minimum requirements for federal information systems, but such standards and guidelines shall not apply to national security systems without the express approval of appropriate federal officials exercising policy authority over such systems. This guideline is consistent with the requirements of the Office of Management and Budget (OMB) Circular A-130 [2]. Nothing in this publication should be taken to contradict the standards and guidelines made mandatory and binding on federal agencies by the Secretary of Commerce under statutory authority. Nor should these guidelines be interpreted as altering or superseding the existing authorities of the Secretary of Commerce, Director of the OMB, or any other federal official. This publication may be used by nongovernmental organizations on a voluntary basis and is not subject to copyright in the United States. Attribution would, however, be appreciated by NIST. ## NIST Technical Series Policies

Copyright, Use, and Licensing Statements NIST Technical Series Publication Identifier Syntax

## Publication History

Approved by the NIST Editorial Review Board on 2024-04-23 Supersedes NIST Special Publication 800-171A (June 2018) https://doi.org/10.6028/NIST.SP.800-171A

## How to Cite this NIST Technical Series Publication:

Ross R, Pillitteri V (2024) Assessing Security Requirements for Controlled Unclassified Information and Organizations.

Assessing Security Requirements for Controlled Unclassified Information


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Security Assessment?

[Assistant]
According to Federal Cybersecurity Awareness Programs_ A Mixed Methods Research Study:

□ Audit reports or FISMA (Federal Information Security Modernization Act of 2014) evaluations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Guidelines on Mobile Device Forensics provide? (Part 10)

[Assistant]
| FORENSIC TOOL CAPABILITIES ........................................................................................
| 25                                                                                |
| 4. PRESERVATION................................................................................................................ | 4. PRESERVATION................................................................................................................ | 27                                                                                |
| 4.1                                                                                | SECURINGAND EVALUATINGTHE SCENE .......................................................................27                              |                                                                                |
| 4.2                                                                                | DOCUMENTINGTHE SCENE.............................................................................................. | 28                                                                                |
| 4.3                                                                                | ISOLATION                                                                                | ........................................................................................................................


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Security Assessment?

[Assistant]
According to Risk Management Framework for Information Systems and Organizations_ A System Life Cycle Approach for Security and Privacy:

assess; authorization to operate; authorization to use; authorizing official; categorize; common control; common control authorization; common control provider; continuous monitoring; control assessor; control baseline; cybersecurity framework profile; hybrid control; information owner or steward; information security; monitor; ongoing authorization; plan of action and milestones; privacy; privacy assessment report; privacy control; privacy plan; privacy risk; risk assessment; risk executive function; risk management; risk management framework; security; security assessment report; security control; security engineering; security plan; security risk; senior agency information security officer; senior agency official for privacy; supply chain risk management; system development life cycle; system owner; system privacy officer; system security officer; system-specific control. 9  Reciprocity is an agreement between organizations to accept one another's security assessment results in order to reuse system resources or to accept each other's assessed security posture in order to share information. 10  [SP 800-64] and [SP 800-160 v1] provide guidance on security considerations in the SDLC. Organizations may choose to divide security and privacy requirements into more granular categories depending on where the requirements are employed in the SDLC and for what purpose. Organizations may use the term capability requirement to describe a capability that the system or organization must provide to satisfy a stakeholder protection need. In addition, organizations may refer to system requirements that pertain to particular hardware, software, and firmware components of a system as specification requirements -that is, capabilities that implement all or part of a control and that may be assessed (i.e., as part of the verification, validation, testing, and evaluation processes).


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Guidelines for Media Sanitization provide? (Part 3)

[Assistant]
-88r1 (Revision 1) (December 2014) https://doi.org/10.6028/NIST.SP.800-88r1

## How to Cite this NIST Technical Series Publication

Chandramouli R, Hibbard EA (2025) Guidelines for Media Sanitization.
(National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) NIST SP 800-88r2. https://doi.org/10.6028/NIST.SP.800-88r2

## Author ORCID iDs

Ramaswamy Chandramouli: 0000-0002-7387-5858 Eric Hibbard: 0009-0001-8112-1263

## Contact Information

sp800-88-comments@nist.gov

National Institute of Standards and Technology Attn: Computer Security Division, Information Technology Laboratory 100 Bureau Drive (Mail Stop 8930) Gaithersburg, MD 20899-8930

## Additional Information

Additional information about this publication is available at https://csrc.nist.gov/pubs/sp/800/88/r2/final, including related content, potential updates, and document history. All comments are subject to release under the Freedom of Information Act (FOIA). ## Abstract

Media sanitization refers to a process that renders access to target data on the media infeasible for a given level of effort. This guide will assist organizations and system owners in setting up a media sanitization program with proper and applicable techniques and controls for sanitization and disposal based on the sensitivity of their information. ## Keywords

Cryptographic erase; ensuring confidentiality; media sanitization; media sanitization program; media types; sanitization methods; secure erase. ## Reports on Computer Systems Technology

The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the Nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Maintenance?

[Assistant]
According to Validating the Integrity of Computing Devices:

Further, this project is not intended to cover the entire supply chain risk management process; it focuses on the acceptance testing portion of a more holistic defense-in-depth/defense-in breadth supply chain risk management strategy. The project enables verification of the identity of computing devices (including replacement parts and updates or upgrades) once they have been acquired but before they are implemented or installed.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Transitioning to the Security Content Automation Protocol (SCAP) Version 2 provide? (Part 4)

[Assistant]
|
| 3.3 Adoption of International Standards                                                                                | in SCAP v2 ............................................
6                                                                    |
| 4 SCAP v2 Development                                                                                | Plan..................................................................................7                                      |
| List of Appendices                                                                                | List of Appendices                                                                                |
| Appendix A-Applications of the SCAP 2.0 Architecture.........................................9                          | Appendix A-Applications of the SCAP 2.0 Architecture.........................................9                               |
| A.1 Vulnerability Assessment................................................................................ | 9                                                                                |
| A.2 Configuration Setting Checklist                                                                                | Assessment ................................................

Transitioning to the Security Content Automation Protocol (SCAP) Version 2


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for Configuration Management?

[Assistant]
According to Protecting Controlled Unclassified Information (CUI)_ NIST Special Publication 800-171, Revision 3. Small Business Primer:

| Access Control                    | Maintenance         | Security Assessment and Monitoring   |
|-----------------------------------|---------------------|--------------------------------------|
| Awareness and Training            | Media Protection    | System and Communications Protection |
| Audit and Accountability          | Personnel Security  | System and Information Integrity     |
| Configuration Management          | Physical Protection | Planning                             |
| Identification and Authentication | Risk Assessment     | System and Services Acquisition      |
| Incident Response                 |                     | Supply Chain Risk Management         |

- Based on NIST SP 800-53, Revision 5 and the NIST SP 800-53B moderate impact control baseline.
- Applies updated tailoring criteria addressing stakeholder feedback (adding new, consolidating, and withdrawing requirements).
- Includes increased specificity in security requirements.
- Introduces organization-defined parameters (ODP) to increase flexibility to better manage organizationspecific risks.

Control Baseline: A set of controls you can implement to meet strategic, legal, regulatory, or contractual security and privacy requirements and manage risk.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Identification and Authentication?

[Assistant]
According to Guidelines for the Use of PIV Credentials in Facility Access:

## Guidelines for the Use of PIV Credentials in Facility Access

## Guidelines for the Use of PIV Credentials in Facility Access

This recommendation provides a technical guideline to use Personal Identity Verification (PIV) Cards in facility access; enabling federal agencies to operate as government-wide interoperable enterprises. These guidelines cover the risk-based strategy to select appropriate PIV authentication mechanisms as expressed within Federal Information Processing Standard (FIPS) 201.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Risk Assessment?

[Assistant]
According to Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule_ A Cybersecurity Resource Guide:

The HIPAA Security Rule focuses on safeguarding electronic protected health information (ePHI) held or maintained by regulated entities. The ePHI that a regulated entity creates, receives, maintains, or transmits must be protected against reasonably anticipated threats, hazards, and impermissible uses and/or disclosures. This publication provides practical guidance and resources that can be used by regulated entities of all sizes to safeguard ePHI and better understand the security concepts discussed in the HIPAA Security Rule. administrative safeguards; Health Insurance Portability and Accountability Act; implementation specification; physical safeguards; risk assessment; risk management; Security Rule; standards; technical safeguards. | Executive Summary............................................................................................................................1      |
|-----------------------------------------------------------------------------------------------------------------------------------------------------|
| 1. Introduction...................................................................................................................................4 |
| 2. HIPAA Security Rule .......................................................................................................................9     |
| 3. Risk Assessment Guidance............................................................................................................14           |
| 4. Risk Management Guidance .........................................................................................................24             |
| 5. Considerations When Implementing the HIPAA Security Rule........................................................28                               |
| 5.1.2. Assigned Security Responsibility (§ 164.308(a)(2)) ....................................................................35                    |
| 5.1.3.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Access Control?

[Assistant]
According to Data Integrity_ Detecting and Responding to Ransomware and Other Destructive Events:

- zero-day vulnerabilities
- vulnerabilities due to outdated or unpatched systems
- custom software vulnerabilities/errors
- social engineering and user-driven events
- poor access control

| Cybersecurity Framework v1.1   | Cybersecurity Framework v1.1   | Cybersecurity Framework v1.1                                                                                | Cybersecurity Framework v1.1       | Standards & Best Practices                       | Standards & Best Practices   |
|--------------------------------|--------------------------------|-----------------------------------------------------------------------------------------------------------------------|------------------------------------|--------------------------------------------------|------------------------------|
| Function                       | Category                       | Subcategory                                                                                | NIST SP 800- 53 R4                 | ISO/IEC 27001:2013                               | NIST SP 800- 181             |
| PROTECT (PR)                   | Data Security (PR.DS)          | PR.DS-6: Integrity check- ing mechanisms are used to verify software, firmware, and infor- mation integrity. | SC-16, SI-7                        | A.12.2.1, A.12.5.1, A.14.1.2, A.14.1.3, A.14.2.4 | OM-DTA-001                   |
| DETECT (DE)                    | Anomalies and Events (DE.AE)   | DE.AE-1: A baseline of network operations and expected data flows for users and systems is es- tablished and managed. | AC-4, CA-3, CM-2, SI-4             | A.12.1.1, A.12.1.2, A.13.1.1, A.13.1.2           | SP-ARC-001                   |
| DETECT (DE)                    | Anomalies and Events (DE.AE)   | DE.AE-2: Detected events are analyzed to understand attack tar- gets and methods.

Data Integrity_ Detecting and Responding to Ransomware and Other Destructive Events


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Information Integrity?

[Assistant]
According to Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule_ A Cybersecurity Resource Guide:

.......................................................................75                                                                                |
| 5.4.1.
Business Associate Contracts or Other Arrangements (§ 164.314(a)).......................................77                                                                                |
| 5.4.2. Requirements for Group Health Plans (§ 164.314(b))................................................................79                                                                                |
| 5.5.1. Policies and Procedures (§ 164.316(a))......................................................................................81                                                                                |
| 5.5.2. Documentation (§ 164.316(b))...................................................................................................83                                                                                |
| References.......................................................................................................................................85                                                                                |
| Appendix A. List of Symbols, Abbreviations, and Acronyms...............................................................87                                                                                |
| Appendix B. Glossary .......................................................................................................................91                                                                                |
| Appendix C.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Access Control?

[Assistant]
According to Zero Trust Architecture:

| | | 3.2.2.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Information Integrity?

[Assistant]
According to Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule_ A Cybersecurity Resource Guide:

| 5.2.4. Device and Media Controls (§ 164.310(d)).................................................................................63                                                                                |
|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| 5.3.1. Access Control (§ 164.312(a)).....................................................................................................65                                                                                |
| 5.3.2. Audit Controls (§ 164.312(b)).....................................................................................................69                                                                                |
| 5.3.3. Integrity (§ 164.312(c))...............................................................................................................71                                                                                |
| 5.3.4. Person or Entity Authentication (§ 164.312(d)).........................................................................73                                                                                |
| 5.3.5. Transmission Security (§ 164.312(e)(1)).....................................................................................75                                                                                |
| 5.4.1.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Configuration Management?

[Assistant]
According to Guidelines for the Use of PIV Credentials in Facility Access:

PACS readers come in varying configurations and offer multiple interface options for the card and the controller. [FIPS201] standardizes the use of the [ISO/IEC 14443] interface for the contactless reader to card communication. Note that the card reader may require additional conformance testing for federal acquisition. An authority for such conformance testing is the General Services Administration (GSA) FIPS 201 Evaluation Program [FIPS 201 EP], which defines tests and maintains a list of approved products. Not all existing PACS use this interface, so some agencies may have to plan to migrate from their legacy environment to the [ISO/IEC 14443] conformant interface. Alternatively, an agency may use the PIV Card's contact interface based on [ISO/IEC 7816].

The interface from the door reader to the controller also comes in different configurations. [FIPS201] does not specify which protocols can be used for this interface, as long as the necessary data can be communicated to the controller. Typical deployed implementations support transmitting a small amount of data (on the order of 10 to 15 bytes), but [FIPS201] defines data elements that are much larger. Therefore, depending on the agency's implementation strategy, an upgrade to the door reader to controller interface may also be required. At a minimum, a 14-decimal-digit FASC-N Identifier or the full 16-byte Card UUID will be supported. Note that any change to this interface may also necessitate changes to the physical wiring and cabling infrastructures.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Audit and Accountability?

[Assistant]
According to Guide to Auditing for Controls and Security_ A System Development Life Cycle Approach:

| Operational Audits of Automated Information Systems (AISs) | Operational Audits of Automated Information Systems (AISs) | Operational Audits of Automated Information Systems (AISs) | 4 | | | 1.1.5 | Relevant Laws and Regulations | Relevant Laws and Regulations | 4 | | | 1.1.5.1 | Requirements for Audit Involvement | Requirements for Audit Involvement | 4 | | | | 1.1.5.2 | Requirements for Internal Control | 5 | | 1.2 | RISKS GENERATED BY COMPUTER TECHNOLOGY | RISKS GENERATED BY COMPUTER TECHNOLOGY | RISKS GENERATED BY COMPUTER TECHNOLOGY | 6 | | | 1.2.1 Overview of Risks | 1.2.1 Overview of Risks | 1.2.1 Overview of Risks | 6 | | | 1.2.1.1 | | Definitions | 7 | | | | 1.2.1.2 | Vulnerability/Risk Related Requirements | 7 | | | 1.2.2 | Risks in a Computerized Environment | Risks in a Computerized Environment | 8 | | | | 1.2.2.1 | Additional Risks Present in a Computerized Environment | 8 | | | | 1.2.2.2 | Assessing Vulnerabilities Through the Audit Process | 9 | | 1.3 | CONTROL OBJECTIVES AND STANDARDS IN A COMPUTER ENVIRONMENT | CONTROL OBJECTIVES AND STANDARDS IN A COMPUTER ENVIRONMENT

Guide to Auditing for Controls and Security_ A System Development Life Cycle Approach


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for Personnel Security?

[Assistant]
According to Protecting Controlled Unclassified Information (CUI)_ NIST Special Publication 800-171, Revision 3. Small Business Primer:

| Access Control                    | Maintenance         | Security Assessment and Monitoring   |
|-----------------------------------|---------------------|--------------------------------------|
| Awareness and Training            | Media Protection    | System and Communications Protection |
| Audit and Accountability          | Personnel Security  | System and Information Integrity     |
| Configuration Management          | Physical Protection | Planning                             |
| Identification and Authentication | Risk Assessment     | System and Services Acquisition      |
| Incident Response                 |                     | Supply Chain Risk Management         |

Description: Ensuring personnel are made aware of the security risks associated with their activities and of the applicable laws, directives, policies, standards, regulations, or procedures related to the security of organizational systems; and ensuring that organizational personnel are adequately trained to carry out their assigned information security-related duties and responsibilities.

Regularly provide basic and advanced security literacy training to new and existing staff. Customize the content to make it relevant -based on the systems that personnel have authorized access to, contextualized to the work environments of personnel (e.g., telework, shop floor), and tailored to the specific roles of personnel. The content should include:


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AT.L2-3.2.2 (NIST 3.2.2)?

[Assistant]
According to Protecting Information and System Integrity in Industrial Control System Environments_ Cybersecurity for the Manufacturing Sector:

3.2.2   | Test Results... 3.2.2 Test Results

The user connects to the Dispel VDI as shown in Figure D-33 and then connects to the PCS workstation as shown in Figure D-34. 3.2.2 Forescout Console

Forescout Console was installed following the standard installation procedures.

Protecting Information and System Integrity in Industrial Control System Environments_ Cybersecurity for the Manufacturing Sector


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice IA.L2-3.5.1 (NIST 3.5.1)?

[Assistant]
According to Validating the Integrity of Computing Devices:

3.5.1 DE.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Supply Chain Risk Management?

[Assistant]
According to Proceedings of the Cybersecurity in Cyber-Physical Systems Workshop, April 23-24, 2012:

As  advances  in  technology  permit  automatic  control  of more and more of the functions of physical systems, the opportunity  for  cyber  attacks  that  include  exploitation  of  such automation capabilities  becomes a greater risk. For example, in  the  2010  Stuxnet  attack  an  embedded  infection  in  control systems  was  used  to  successfully  damage  a  large  number  of nuclear  power  related  centrifuges  in  Iran.  While  the  application  of  perimeter  security  technologies  have  been  applied  to help manage the likelihood of SCADA-based cyber attackers exploiting  highly  automated  physical  systems,  successful  attacks have occurred, and furthermore, perimeter solutions do not address important classes of insider and supply chain initiated attacks. As a result, it has been recognized that perimeter security  needs  to  be  augmented  by  other  approaches  for  addressing potential cyber attacks [1].

Proceedings of the Cybersecurity in Cyber-Physical Systems Workshop, April 23-24, 2012


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AT.L2-3.2.2 (NIST 3.2.2)?

[Assistant]
According to Approaches and Challenges of Federal Cybersecurity Awareness Programs:

3.2.2                                                                                | Communication Channels... 3.2.2 Communication Channels

Participants indicated how their organizations communicate and disseminate security awareness information.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Awareness and Training?

[Assistant]
According to Federal Cybersecurity Awareness Programs_ A Mixed Methods Research Study:

## Federal Cybersecurity Awareness Programs

## Federal Cybersecurity Awareness Programs

Prior  industry  surveys  and  research  studies  have  revealed  that  organizational  cybersecurity awareness  (hereafter  shortened  to  'security  awareness')  programs  may  face  a  number  of challenges, including lack of: leadership support; resources; and staff with sufficient background and  skills  to  implement  an  effective  and  engaging  program.  However,  no  prior  research  has explored security awareness programs specifically in the United States (U.S.) government (federal) sector.  To  address  this  gap,  NIST  conducted  a  two-phase,  mixed  methods  research  study  to understand the needs, challenges, and practices of federal security awareness programs. This report describes  the  research  background  and  methodology,  along  with  the  characteristics  of  the participants, organizations, and programs represented in the study. Research results can serve as a resource  for  federal  security  awareness  professionals,  managers,  and  organizational  decision makers to improve and advocate for their organizations' security awareness programs. Results can also inform the development of federal security awareness guidance, policies, sharing forums, and initiatives  meant  to  aid  programs  in  becoming  more  effective.  While  focused  on  the  U.S. government, findings may also have implications for organizational security awareness programs in other sectors.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Configuration Management?

[Assistant]
According to Zero Trust Architecture:

| | | 3.2.2.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Services Acquisition?

[Assistant]
According to Guidelines for Media Sanitization:

There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may be used by federal agencies even before the completion of such companion publications. Thus, until each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning and transition purposes, federal agencies may wish to closely follow the development of these new publications by NIST. The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the Nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology. ITL's responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in federal information systems. The Special Publication 800-series reports on ITL's research, guidelines, and outreach efforts in information system security, and its collaborative activities with industry, government, and academic organizations. Information disposition and sanitization decisions occur throughout the information system life cycle. Critical factors that affect information disposition and media sanitization are decided at the start of a system's development. Initial system requirements should include hardware and software specifications as well as interconnections and data flow documents that will assist the system owner in identifying the types of ISM used in the system.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Security Assessment?

[Assistant]
According to Security and Privacy Controls for Information Systems and Organizations:

Control AC-19 Discussion: Change “Many controls for mobile
devices are reflected in other controls allocated to the initial control
baselines as starting points for the development of security plans
and overlays using the tailoring process.

Security and Privacy Controls for Information Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 2 require for System and Communications Protection?

[Assistant]
According to Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations:

| Table 1. Security Requirement Families .......................................................................................................4          |
|----------------------------------------------------------------------------------------------------------------------------------------------------------|
| Table 2. Security Control Tailoring Criteria.................................................................................................93          |
| Table 3. Access Control (AC) .......................................................................................................................93   |
| Table 4. Awareness and Training (AT).........................................................................................................94          |
| Table 5. Audit and Accountability (AU).......................................................................................................95          |
| Table 6. Assessment, Authorization, and Monitoring (CA).........................................................................95                       |
| Table 7. Configuration Management (CM).................................................................................................96                |
| Table 8. Contingency Planning (CP) ............................................................................................................96        |
| Table 9. Identification and Authentication (IA) ..........................................................................................97             |
| Table 10. Incident Response (IR).................................................................................................................98      |
| Table 11. Maintenance (MA) ......................................................................................................................98      |
| Table 12.

Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Protecting Controlled Unclassified Information (CUI)_ NIST Special Publication 800-171, Revision 3. Small Business Primer provide? (Part 5)

[Assistant]
s and disclosure

Preventing disruption in how information is accessed

<!-- image -->

2 SP 800-171 does not explicitly cover integrity and availability so it is not a comprehensive security program.
## Overview

## Structure of SP 800-171

SP 800-171 security requirements are organized into 17 families, as illustrated in the table below. Each family is further broke n down into requirements related to the family's general security topic (see the example at the bottom of the page). | Access Control                    | Maintenance         | Security Assessment and Monitoring   |
|-----------------------------------|---------------------|--------------------------------------|
| Awareness and Training            | Media Protection    | System and Communications Protection |
| Audit and Accountability          | Personnel Security  | System and Information Integrity     |
| Configuration Management          | Physical Protection | Planning                             |
| Identification and Authentication | Risk Assessment     | System and Services Acquisition      |
| Incident Response                 |                     | Supply Chain Risk Management         |

## Understanding the Security Requirements in SP 800-171

Below is an example of the Incident Response Testing requirement, which is part of the Incident Response (IR) family. The structure and content of a typical security requirement includes:

<!-- image -->

ht ps:/

csrc.nist.gov/projects/protecting-control ed-unclas ified-information

## Overview

<!-- image -->

## Top 5 Frequently Asked Questions

## Top five questions NIST receives on SP 800-171:

| How can I 'comply' with SP 800-171? | NIST does not have a role in determining compliance with the security requirements in SP 800-171. If you have questions regarding requirements to protect CUI or other regulatory requirements, please contact your prime contractor and/or federal point of contact for the contract.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Recommendation for Pair-Wise Key-Establishment Schemes Using Discrete Logarithm Cryptography provide? (Part 8)

[Assistant]
|
| 5. Cryptographic Elements .......................................................................................
| 5. Cryptographic Elements ....................................................................................... | 5. Cryptographic Elements ....................................................................................... | 20                                                                                |
| 5.1                                                                                |                                                                                | Cryptographic Hash Functions ...................................................................................... | 20                                                                                |
|                                                                                | 5.2                                                                                | Message Authentication Code (MAC) Algorithm......................................................... | 20                                                                                |
|                                                                                |                                                                                | 5.2.1 MACTag Computation for Key Confirmation .................................................

Recommendation for Pair-Wise Key-Establishment Schemes Using Discrete Logarithm Cryptography


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Communications Protection?

[Assistant]
According to Guide to Malware Incident Prevention and Handling for Desktops and Laptops:

-  Custom Network-Based IPS or IDS Signature. Writing a custom IPS or IDS signature that identifies infected hosts is often a highly effective technique. Some organizations have separate IPS or IDS sensors with strong signature-writing capabilities that can be dedicated to identifying malware infections. This provides a high-quality source of information while keeping other sensors from becoming overloaded with malware alerts.
-  Packet Sniffers and Protocol Analyzers. Configuring packet sniffers and protocol analyzers to look only for network traffic matching the characteristics of a particular malware threat can be effective at identifying infected hosts. An example of what to monitor is to look for botnet command and control communications being carried over IRC. These packet examination techniques are most helpful if most or all malware-generated network traffic attempts to pass through the same network device or a few devices.

Guide to Malware Incident Prevention and Handling for Desktops and Laptops


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Protecting Controlled Unclassified Information (CUI)_ NIST Special Publication 800-171, Revision 3. Small Business Primer provide? (Part 3)

[Assistant]
| help you take |

1  For more information on types of CUI and markings, visit the National Archives and Records Administration (NARA) https://www.archives.gov/cui.
ht ps:/

csrc.nist.gov/projects/protecting-control ed-unclas ified-information

## Overview

## Audience

<!-- image -->

<!-- image -->

Pages 2-6 provide a general overview of SP 800-171, R3 -helpful to business leaders or those new to SP 800-171. Pages 7-27 are for those who are tasked with managing the implementation SP 800-171. It is not all-encompassing, but it does provide tips and resources to help with getting started. This section serves as a bridge to the larger SP 800-171 publication. ## Key Term: Confidentiality

<!-- image -->

Confidentiality refers to the protection of information from unauthorized access and disclosure . *Definitions in this document are intended as plain language. View the official definition within 32 CFR Part 2002 "Controlled Unclassified Information."

## A Suite of Guidance

NIST's suite of CUI guidance (shown in the table below) focuses on protecting the confidentiality 2 of CUI in nonfederal systems and organizations and recommends specific security requirements to achieve that objective. This guide will focus on SP 800-171, Revision 3 . <!-- image -->

<!-- image -->

<!-- image -->

NIST SP 800-171, Protecting Controlled Unclassified Information in Nonfederal Systems is a set of recommended security requirements for protecting the confidentiality of CUI. NIST SP 800-171A, Assessing Security Requirements for Controlled Unclassified Information provides assessment procedures and a methodology to conduct assessments of the CUI security requirements in SP 800-171.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AT.L2-3.2.13 (NIST 3.2.13)?

[Assistant]
According to Digital Identity Guidelines_ Authentication and Authenticator Management:

3.2.13. 3.2.13). 3.2.13) or non-
exportable.

Digital Identity Guidelines_ Authentication and Authenticator Management


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Access Control?

[Assistant]
According to Status Report on the Fourth Round of the NIST Post-Quantum Cryptography Standardization Process:

| 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . | . . . | 1              |
|------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------|
| 1.1. | Purpose and Organization of This Document . . . . | 3              |
| 2. Evaluation Criteria and Selection Process . . | . . . . . . . . | 4              |
| 2.1. | Acceptance of the Fourth-Round Candidates . . . . | 4              |
| 2.2. | Evaluation Criteria . . . . . . . . . . . . . . . . . . . . | 4              |
|                                                                                | 2.2.1. Security . . . . . . . . . . . . . . . . . . . . . . | 4              |
|                                                                                | 2.2.2.Cost and Performance . . . . . . . . . . . . . | 5              |
|                                                                                | 2.2.3.Algorithm and Implementation Characteristics                                                                                | 8              |
| 2.3. | Selection of the Candidates for Standardization . . . | 8              |
| 3. Summary of the Fourth-Round Candidates . | . . . . . . . . | 10             |
| 3.1. | HQC . . . . . . . . . . . . . . . . . . . . . . . . . . . . | 10             |
| 3.2. | BIKE . . . . . . . . . . . . . . . . . . . . . . . . . . . . | 12             |
| 3.3. | Classic McEliece . . . . . . . . . . . . . . . . . .

Status Report on the Fourth Round of the NIST Post-Quantum Cryptography Standardization Process


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What guidance does Cryptographic Module Validation Program (CMVP)-Approved Security Functions_ CMVP Validation Authority Updates to ISO_IEC 24759 provide?

[Assistant]
<!-- image -->

## NIST Special Publication NIST SP 800-140Cr2

## Cryptographic Module Validation Program (CMVP)-Approved Security Functions:

CMVP Validation Authority Updates to ISO/IEC 24759

Alexander Calis

This publication is available free of charge from:

https://doi.org/10.6028/NIST.SP.800-140Cr2

<!-- image -->

## NIST Special Publication NIST SP 800-140Cr2

## Cryptographic Module Validation Program (CMVP)-Approved Security Functions:

CMVP Validation Authority Updates to ISO/IEC 24759

Alexander Calis

Computer Security Division Information Technology Laboratory

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-140Cr2

July 2023

<!-- image -->

U.S. Department of Commerce Gina M. Raimondo, Secretary

National Institute of Standards and Technology

Laurie E. Locascio, NIST Director and Under Secretary of Commerce for Standards and Technology

Certain commercial equipment, instruments, software, or materials, commercial or non-commercial, are identified in this paper in order to specify the experimental procedure adequately. Such identification does not imply recommendation or endorsement of any product or service by NIST, nor does it imply that the materials or equipment identified are necessarily the best available for the purpose. There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may be used by federal agencies even before the completion of such companion publications. Thus, until each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning and transition purposes, federal agencies may wish to closely follow the development of these new publications by NIST.

Cryptographic Module Validation Program (CMVP)-Approved Security Functions_ CMVP Validation Authority Updates to ISO_IEC 24759