[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Personnel Security?

[Assistant]
According to The Federal Cybersecurity Awareness Workforce_ Professional Backgrounds, Knowledge, Skills, and Development Activities:

'For this relatively newer area, which has to do with the competency of privacy workforce, currently, outside of the International Association for Privacy Professionals, I don't think there exists a good mechanism or assessment for the privacy workforce as of yet. So, for example, we have cybersecurity personnel who may be inheriting privacy responsibilities, but we don't have a tool yet that will help us gauge what their level of knowledge is with regards to privacy.' (S11)

'There was also someone else that came on the team part time…that had the HR experience. So, they were very helpful in helping me to navigate whatever issues that may come from the personnel requirements and so forth.' (N09)

| [BADA]    | Bada, M, Sasse, AM, Nurse, JRC (2019) Cyber Security Awareness Campaigns: Why Do They Fail to Change Behaviour? arXiv preprint . https://arxiv.org/ftp/arxiv/papers/1901/1901.02672.pdf                                                                                |
|-----------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| [FISSEA]  | National Institute of Standards and Technology (2021) FISSEA - Federal Information Security Educators . Available at https://csrc.nist.gov/projects/fissea                                                                                |
| [INDEED]  | Indeed (2021) 15 Professional Skills (Plus Definition and Tips).

The Federal Cybersecurity Awareness Workforce_ Professional Backgrounds, Knowledge, Skills, and Development Activities


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Planning?

[Assistant]
According to Guide to Auditing for Controls and Security_ A System Development Life Cycle Approach:

| | 2.2.4 AIS Life Cycle Matrix | 2.2.4 AIS Life Cycle Matrix | 2.2.4 AIS Life Cycle Matrix | 24 | | 2.3 | LIFE CYCLE PHASES | LIFE CYCLE PHASES | LIFE CYCLE PHASES | 26 | | | 2.3.1 Initiation - Phase I | 2.3.1 Initiation - Phase I | 2.3.1 Initiation - Phase I | 27 | | | 2.3.2 Definition - Phase II | 2.3.2 Definition - Phase II | 2.3.2 Definition - Phase II | 27 | | | 2.3.3 System Design - Phase III | 2.3.3 System Design - Phase III | 2.3.3 System Design - Phase III | 27 | | | 2.3.4 Programming and Training - Phase IV | 2.3.4 Programming and Training - Phase IV | 2.3.4 Programming and Training - Phase IV | 28 | | | 2.3.5 Evaluation and Acceptance - Phase V | 2.3.5 Evaluation and Acceptance - Phase V | 2.3.5 Evaluation and Acceptance - Phase V | 28 | | | 2.3.6 Installation and Operation - Phase VI | 2.3.6 Installation and Operation - Phase VI | 2.3.6 Installation and Operation - Phase VI | 29 | | 2.4 | RESPONSIBLE PARTICIPANTS AND THEIR FUNCTION

Guide to Auditing for Controls and Security_ A System Development Life Cycle Approach


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Incident Response?

[Assistant]
According to Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule_ A Cybersecurity Resource Guide:

| Key Activities | Description | Sample Questions | |--------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | 1.

Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule_ A Cybersecurity Resource Guide


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Strategies for the Integration of Software Supply Chain Security in DevSecOps CI_CD Pipelines provide? (Part 2)

[Assistant]
ts, guidelines, and procedures, where they exist, remain operative. For planning and transition purposes, federal agencies may wish to closely follow the development of these new publications by NIST.
Organizations are encouraged to review all draft publications during public comment periods and provide feedback to NIST. Many NIST cybersecurity publications, other than the ones noted above, are available at https://csrc.nist.gov/publications. ## Authority

This publication has been developed by NIST in accordance with its statutory responsibilities under the Federal Information Security Modernization Act (FISMA) of 2014, 44 U.S.C. § 3551 et seq., Public Law (P.L.) 113-283. NIST is responsible for developing information security standards and guidelines, including minimum requirements for federal information systems, but such standards and guidelines shall not apply to national security systems without the express approval of appropriate federal officials exercising policy authority over such systems. This guideline is consistent with the requirements of the Office of Management and Budget (OMB) Circular A-130. Nothing in this publication should be taken to contradict the standards and guidelines made mandatory and binding on federal agencies by the Secretary of Commerce under statutory authority. Nor should these guidelines be interpreted as altering or superseding the existing authorities of the Secretary of Commerce, Director of the OMB, or any other federal official. This publication may be used by nongovernmental organizations on a voluntary basis and is not subject to copyright in the United States. Attribution would, however, be appreciated by NIST.

Strategies for the Integration of Software Supply Chain Security in DevSecOps CI_CD Pipelines

Audit and Accountability
System and Information Integrity
Security Assessment
Media Protection
Identification and Authentication
Awareness and Training
System and Communications Protection
Access Control
Planning
Incident Response
Risk Assessment
Personnel Security
System and Services Acquisition
Supply Chain Risk Management
Maintenance
Physical Protection
Configuration Management


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Identification and Authentication?

[Assistant]
According to Blockchain for Access Control Systems:

----------------|
| [BXANL]      | Bouras MA, Xia B, Abuassba AO, Ning H, Lu Q (2021) IoT-CCAC: A Blockchain-Based Consortium Capability Access Control Approach for IoT. PeerJ Computer Science 7:e455.
https://doi.org/10.7717/peerj-cs.455                                                                                |
| [DMMR]       | Di Francesco Maesa D, Mori P, Ricci L (2019) A Blockchain Based Approach for the Definition of Auditable Access Control Systems. Computers &Security 84(July):93-119. https://doi.org/10.1016/j.cose.2019.03.016                                                                                |
| [GBHC]       | Ghaffari F, Bertin F, Hatin J, Crespi N (2020) Authentication and Access Control Based on Distributed Ledger Technology: A survey. 2nd conference on Blockchain Research &Applications for Innovative Networks and Services ( BRAINS 2020) (IEEE, Paris), pp 79-86. https://doi.org/10.1109/BRAINS49436.2020.9223297 |
| [GMS]        | Guo H, Meamari E, Shen CC (2019). Multi-Authority Attribute-Based Access Control with Smart Contract. Proceedings of the 2019 International Conference on Blockchain Technology (ICBCT 2019) (ACM, Honolulu, Hawai'i), pp 6-11. https://doi.org/10.1145/3320154.3320164                                              |
| [GPR]        | Gusmeroli S, Piccione S, Rotondi D (2013) A Capability-Based Security Approach to Manage Access Control in the Internet of Things. Mathematical and Computer Modelling 58(5-6), pp 1189-1205 . https://doi.org/10.1016/j.mcm.2013.02.006                                                                             |
| [GT]         | Grant Thornton US (2020) Blockchain and Privacy: How Do You Protect Data That's Distributed?[video].


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Audit and Accountability?

[Assistant]
According to Approaches and Challenges of Federal Cybersecurity Awareness Programs:

We asked participants in what ways their organizations try to measure or determine the effectiveness of their security awareness program (Figure 24). Security awareness training completion rates (84%) and phishing simulation click rates (72%) were the most popular measures of effectiveness, followed by program audits/evaluations with 67% of participants. Less than 30% selected attendance at security awareness events, employee surveys, and online views of security awareness materials. Four percent said that they do not attempt to measure program effectiveness.

In the focus groups and survey, participants provided more details on the variety of methods they employ to determine the effectiveness of their security awareness programs.  Training completion rates and independent inspector general (IG) audits were used to demonstrate compliance with security awareness training mandates (usually, FISMA):

'We have found that, yes, management pays attention to things with compliance, but that, in my mind, doesn't really identify effectiveness…We've also really found audits to be effective in helping push the cause. Now, that doesn't identify effectiveness either, but it does help increase management awareness and attention to supporting these programs.' (S11)

Approaches and Challenges of Federal Cybersecurity Awareness Programs


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Maintenance?

[Assistant]
According to Approaches and Challenges of Federal Cybersecurity Awareness Programs:

Participants indicated how often their organization updates security awareness training content, with 80% answering that they update it at least once a year. No participants said they updated content more than every three years, and 4% did not know how often content was updated (see Figure 3).

Updating required security awareness training content: Updates to required training were viewed as very/moderately challenging by 26% of survey participants.

'More frequent updates to online CBT [computer-based training].  Some courses are dated and 'corny' -  this doesn't represent the organization well as some CBT seems a little gimmicky bordering on childish.' (Q38)


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AU.L2-3.3.2 (NIST 3.3.2)?

[Assistant]
According to Data Integrity_ Detecting and Responding to Ransomware and Other Destructive Events:

3.3.2 Resolution

The build provides several methods for detecting and analyzing this use case.

Data Integrity_ Detecting and Responding to Ransomware and Other Destructive Events


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Identification and Authentication?

[Assistant]
According to Recommendation for Pair-Wise Key-Establishment Using Integer Factorization Cryptography:

| 2.
Scope and Purpose.................................................................................................................. 1                                                                                | 2. Scope and Purpose.................................................................................................................. 1                                                                                |
| 3. Definitions, Symbols and Abbreviations............................................................................... 2                                                                                | 3. Definitions, Symbols and Abbreviations............................................................................... 2                                                                                | 3. Definitions, Symbols and Abbreviations...............................................................................

Recommendation for Pair-Wise Key-Establishment Using Integer Factorization Cryptography


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Identification and Authentication?

[Assistant]
According to Federal Cybersecurity Awareness Programs_ A Mixed Methods Research Study:

□ Passwords and authentication

Federal Cybersecurity Awareness Programs_ A Mixed Methods Research Study


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Summary Report for “Workshop on Updating Manufacturer Guidance for Securable Connected Product Development” provide? (Part 10)

[Assistant]
Speaker Summaries

The summaries below highlight significant points from the speakers and identifies discussion topics. ## Jack Cyprus and David Keppler, MITRE Corporation, presented ' Building More Secure Devices Using Threat Modeling with MITRE EMB3D '

David Keppler and Jack Cyprus, both from the MITRE Corporation, discussed building more secure devices through threat modeling with MITRE EMB3D 1 . They emphasized that threat modeling is crucial for identifying potential vulnerabilities and determining appropriate security measures. This process, which is increasingly used in industries such as industrial automation, automotive, and medical, involves defining the device, identifying key components and trust boundaries, and measuring the return on investment (ROI) of defenses. There are various tools and processes for threat modeling, such as adversary models and attack trees. One prominent model, the MITRE EMB3D, fills gaps in existing data sources and offers a consistent understanding of threats and mitigations. This model categorizes threats based on device properties, such as hardware, system software, application software, and networking. It also includes references to the CWE and CVE databases for additional information and threat details. The EMB3D model provides a common language for device vendors, users, and security researchers to communicate threats and mitigations. It includes three mitigation tiers -foundational, intermediate, and leading -that guide actions throughout a device's lifecycle. These mitigations are grounded in real-world information and provide a defensive starting point as well as steps for ongoing security improvements. By adopting a comprehensive threat modeling process like EMB3D, organizations can better protect their devices against potential threats and build more secure systems.

Summary Report for “Workshop on Updating Manufacturer Guidance for Securable Connected Product Development”

Audit and Accountability
System and Information Integrity
Security Assessment
Media Protection
Identification and Authentication
Awareness and Training
System and Communications Protection
Access Control
Planning
Incident Response
Risk Assessment
Personnel Security
System and Services Acquisition
Maintenance
Physical Protection
Configuration Management


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Blockchain for Access Control Systems provide? (Part 6)

[Assistant]
control data/logs and system states to be seen and tracked. - The execution of arbitrary programs in smart contracts allows for controls on distributed access control data and authorization processes.
- Consensus  mechanisms  and  protocols  jointly  regulate  the  participating  access  control entities/organizations in determining policy rules through blocks or smart contracts.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Security Assessment?

[Assistant]
According to Access Control on NoSQL Databases:

) Access Control Policy Composition for Resource Federation Networks Using Semantic Web and Resource Description Framework (RDF), Proceeding of 2008 International Computer Symposium , pp 497-502 (v1).
Available at https://tsapps.nist.gov/publication/get\_pdf.cfm?pub\_id=890067
- [MO]   MongoDB (2023) What is NoSQL? Available at https://www.mongodb.com/nosqlexplained
- [NISTIR7316]   Hu VC, Ferraiolo DF, Kuhn DR (2006) Assessment of Access Control Systems. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Interagency or Internal Report (IR) 7316. https://doi.org/10.6028/NIST.IR.7316
- [NO] NoSQL (2020) Your Ultimate Guide to the Non-Relational Universe! Available at https://nextweb.gnoss.com/en/resource/nosql-databases-your-ultimate-guide-to-thenon--/479e0de7-8060-48d1-9670-bbdcd1df0610
- [OG] Okman L, Gal-Oz N, Gonen Y, Gudes E, Abramov J (2011) Security Issues\_in\_NoSQL\_Databases, International Joint Conference of IEEE TrustCom-11/IEEE ICESS-11/FCST-11 . https://doi.org/10.1109/TrustCom.2011.70
- [OW]   OWASP (2020) Web Security Testing Guide. Available at https://owasp.org/wwwproject-web-security-testing-guide
- [SF] Sandhu R, Ferraiolo DF, Kuhn D.R (2000) The NIST Model for Role Based Access Control: Toward a Unified Standard, 5th ACM Workshop Role-Based Access Control. pp 47-63. https://doi.org/10.1145/344287.344301


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Protecting Controlled Unclassified Information (CUI)_ NIST Special Publication 800-171, Revision 3. Small Business Primer provide? (Part 2)

[Assistant]
ent, or possibly with other organizations like municipal governments, prime contractors, universities, etc., you will likely be required to demonstrate you are taking adequate measures to protect CUI.
Examples of CUI include:

<!-- image -->

|                      | When provided as part of a government contract, examples include:                                                                                | Marking 1     |
|----------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------|
| Controlled           | e.g., research and engineering data, engineering drawings, specifications, process sheets, manuals, technical reports, technical orders, catalog-item identifications, data sets, studies and analyses and related information, and computer software executable code and source code. | CUI//SP-CTI   |
| General Proprietary  | e.g., financial information, trade secrets, product research and development, existing and future product designs and performance specifications. | CUI//PROPIN   |
| Business Information | you do not handle CUI, implementing the security requirements in SP 800-171 will                                                                                | help you take |

1  For more information on types of CUI and markings, visit the National Archives and Records Administration (NARA) https://www.archives.gov/cui.

Protecting Controlled Unclassified Information (CUI)_ NIST Special Publication 800-171, Revision 3. Small Business Primer


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Digital Identity Guidelines_ Authentication and Authenticator Management provide? (Part 2)

[Assistant]
signed statutory responsibilities. The
information in this publication, including concepts and methodologies, may be used by
federal agencies even before the completion of such companion publications.
Thus, until
each publication is completed, current requirements, guidelines, and procedures, where
they exist, remain operative. For planning and transition purposes, federal agencies may
wish to closely follow the development of these new publications by NIST. Organizations are encouraged to review all draft publications during public comment
periods and provide feedback to NIST. Many NIST cybersecurity publications, other than
the ones noted above, are available at https://csrc.nist.gov/publications. Authority

This publication has been developed by NIST in accordance with its statutory
responsibilities under the Federal Information Security Modernization Act (FISMA)
of 2014, 44 U.S.C. § 3551 et seq., Public Law (P.L.) 113-283. NIST is responsible
for developing information security standards and guidelines, including minimum
requirements for federal information systems, but such standards and guidelines shall
not apply to national security systems without the express approval of appropriate
federal officials exercising policy authority over such systems. This guideline is consistent
with the requirements of the Office of Management and Budget (OMB) Circular A-130. Nothing in this publication should be taken to contradict the standards and guidelines
made mandatory and binding on federal agencies by the Secretary of Commerce
under statutory authority. Nor should these guidelines be interpreted as altering or
superseding the existing authorities of the Secretary of Commerce, Director of the
OMB, or any other federal official. This publication may be used by nongovernmental
organizations on a voluntary basis and is not subject to copyright in the United States. Attribution would, however, be appreciated by NIST.

Digital Identity Guidelines_ Authentication and Authenticator Management


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Services Acquisition?

[Assistant]
According to Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule_ A Cybersecurity Resource Guide:

modify the Health Insurance Portability and Accountability Act of 1996 (HIPAA), the Health Information Technology for Economic and Clinical Health (HITECH) Act, or any other federal law or regulation.
The participation of other federal organizations with the National Institute of Standards and Technology (NIST) in the development of this Special Publication does not and shall not be deemed to constitute the endorsement, recommendation, or approval by those organizations of its contents. The use of this publication or any other NIST publication does not ensure or guarantee that an organization will be compliant with the Security Rule.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Security Assessment?

[Assistant]
According to Guidelines on Mobile Device Forensics:

The types of software available for mobile device examination include commercial and open source forensic tools, as well as non-forensic tools intended for device management, testing, and diagnostics. Forensic tools are typically designed to acquire data from the internal memory of handsets and UICCs without altering their content and to calculate integrity hashes for the acquired data. Both forensic and non-forensic software tools often use the same protocols and techniques to communicate with a device. However, non-forensic tools may allow unrestricted two-way flow of information and omit data integrity hash functions. Mobile device examiners typically assemble a collection of both forensic and non-forensic tools for their toolkit. The range of devices over which they operate is typically narrowed to: distinct platforms, a specific operating system family or even a single type of hardware architecture. Short product release cycles  are  the  norm  for  mobile  devices,  requiring  tool  manufacturers  to  continually  update their tools providing forensics examiners with an forensic solution. The task is formidable and tool manufacturers' support for newer models may lag significantly behind the introduction of a device into the marketplace. Models of older functioning mobile devices, though out of date, can remain in use for years after their initial release. Mobile device models introduced into one national market may also be used in areas by exchanging the UICC of one cellular carrier with that  from  another  carrier. The  current  state  is  likely  to  continue,  keeping  the  cost  of examination  significantly  higher  than  if  a  few  standard  operating  systems  and  hardware configurations prevailed. JTAG - Many manufacturers support the JTAG standard, which defines a common test interface for processor, memory, and other semiconductor chips.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Awareness and Training?

[Assistant]
According to Automated Secure Configuration Guidance from the macOS Security Compliance Project (mSCP):

| Relevance to NIST SP 800-70 and the National Checklist Program ...........................
| 2                                                                                |
|                                                                                | Document Structure.................................................................................................... | 2                                                                                |
| Project Description .......................................................................................................... | Project Description .......................................................................................................... | 3                                                                                |
|                                                                                | Project Goals.............................................................................................................. | 3                                                                                |
|                                                                                | mSCP Content Use                                                                                | ....................................................................................................

Automated Secure Configuration Guidance from the macOS Security Compliance Project (mSCP)


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Information Integrity?

[Assistant]
According to Guide to Malware Incident Prevention and Handling for Desktops and Laptops:

Malware, also known as malicious code, refers to a program that is covertly inserted into another program with the intent to destroy data, run destructive or intrusive programs, or otherwise compromise the confidentiality, integrity, or availability of the victim's data, applications, or operating system. Malware is the most common external threat to most hosts, causing widespread damage and disruption and necessitating extensive recovery efforts within most organizations. This publication provides recommendations for improving an organization's malware incident prevention measures. It also gives extensive recommendations for enhancing an organization's existing incident response capability so that it is better prepared to handle malware incidents, particularly widespread ones. Malware, also known as malicious code, refers to a program that is covertly inserted into another program with the intent to destroy data, run destructive or intrusive programs, or otherwise compromise the confidentiality, integrity, or availability of the victim's data, applications, or operating system. Malware is the most common external threat to most hosts, causing widespread damage and disruption and necessitating extensive recovery efforts within most organizations. Organizations also face similar threats from a few forms of non-malware threats that are often associated with malware. One of these forms that has become commonplace is phishing, which is using deceptive computer-based means to trick individuals into disclosing sensitive information. Organizations should perform threat mitigation to detect and stop malware before it can affect its targets. The most commonly used malware threat mitigation technical control is antivirus software; organizations should deploy antivirus software on all hosts for which satisfactory antivirus software is available.

Guide to Malware Incident Prevention and Handling for Desktops and Laptops


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Guidelines for the Use of PIV Credentials in Facility Access provide? (Part 2)

[Assistant]
lar A-130. Nothing in this publication should be taken to contradict the standards and guidelines made mandatory and binding on federal agencies by the Secretary of Commerce under statutory authority.
Nor should these guidelines be interpreted as altering or superseding the existing authorities of the Secretary of Commerce, Director of the OMB, or any other federal official. This publication may be used by nongovernmental organizations on a voluntary basis and is not subject to copyright in the United States. Attribution would, however, be appreciated by NIST. National Institute of Standards and Technology Special Publication 800-116 Revision 1 Natl. Inst. Stand. Technol. Spec. Publ. 800-116 Revision 1, 71 pages (June 2018) CODEN: NSPUE2

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-116r1

Certain  commercial  entities,  equipment,  or  materials  may  be  identified  in  this  document  in  order  to  describe  an experimental  procedure  or  concept  adequately. Such  identification  is  not  intended  to  imply  recommendation  or endorsement by NIST, nor is it intended to imply that the entities, materials, or equipment are necessarily the best available for the purpose. There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may  be  used  by  federal  agencies  even  before  the  completion  of  such  companion  publications. Thus,  until  each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning  and  transition  purposes,  Federal  agencies  may  wish  to  closely  follow  the  development  of  these  new publications by NIST. Organizations are encouraged to review all draft publications during public comment periods and provide feedback to NIST.

Guidelines for the Use of PIV Credentials in Facility Access


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 1 require for Risk Assessment?

IoT Non-Technical Supporting Capability Core Baseline


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 2 require for Personnel Security?

[Assistant]
According to Profile of the IoT Core Baseline for Consumer IoT Products:

was configured for privacy. | Unauthorized Publication of Fitness Tracker Data - Fitness tracker location data for military personnel were publicly posted even when product was configured for privacy.
|
| Web application vulnerabilities                                                                                | Product configuration Cybersecurity State Awareness Documentation Information Dissemination                                                                                |
| Mobile application vulnerabilities                                                                                | Product Configuration Cybersecurity State Awareness Documentation Information Dissemination                                                                                |
| Ability for de-identified data to be re-identified                                                                                | Product Configuration Data Protection Documentation                                                                                |
| Unauthorized access to home security camera data - Unauthorized access to data and views of the inside and outside of buildings occurred with multiple brands of security cameras. | Unauthorized access to home security camera data - Unauthorized access to data and views of the inside and outside of buildings occurred with multiple brands of security cameras.

Profile of the IoT Core Baseline for Consumer IoT Products


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Organizational Views of NIST Cryptographic Standards and Testing and Validation Programs provide? (Part 4)

[Assistant]
| ..............................................................................................................
3                                                                                |
|                                                                                | Participant and Organization Demographics............................................................... 4                                                                                | Participant and Organization Demographics............................................................... 4                                                                                |
|                                                                                | NIST-Specific Findings ................................................................................................... 6                                                                           | NIST-Specific Findings ................................................................................................... 6                                                                           |
| 5.1. Standards ..................................................................................................................... | 5.1. Standards ..................................................................................................................... | 6                                                                                |
| 5.1.1. Benefits.................................................................................................................. | 5.1.1.

Organizational Views of NIST Cryptographic Standards and Testing and Validation Programs


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AT.L2-3.2.7 (NIST 3.2.7)?

[Assistant]
According to Audit and Evaluation of Computer Security II_ System Vulnerabilities and Controls:

3.2.7 Access Control                                                                                | 4-11      |
|      |                |                                                                                | 4-11      |
|      | 4. 3.2.7 Access Control .

Audit and Evaluation of Computer Security II_ System Vulnerabilities and Controls


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice CM.L2-3.4.2 (NIST 3.4.2)?

[Assistant]
According to Secure Software Development Framework (SSDF) Version 1.1_ Recommendations for Mitigating the Risk of Software Vulnerabilities:

3.4.2, 3.

Secure Software Development Framework (SSDF) Version 1.1_ Recommendations for Mitigating the Risk of Software Vulnerabilities


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Incident Response?

[Assistant]
According to Audit and Evaluation of Computer Security II_ System Vulnerabilities and Controls:

CONCLUSIONS                                                                           | 6. CONCLUSIONS                                                                                | 6.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AU.L2-3.3.4 (NIST 3.3.4)?

[Assistant]
According to Guide to Auditing for Controls and Security_ A System Development Life Cycle Approach:

3.3.4 Verify Information on Initiation Phase Status                                       | 4. 3.3.4 Verify Information on Initiation Phase Status                                       | 81   |
|       |                                                                                | 4. 3.3.4.

Guide to Auditing for Controls and Security_ A System Development Life Cycle Approach


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What guidance does Profile of the IoT Core Baseline for Consumer IoT Products provide?

[Assistant]
<!-- image -->

## NIST Internal Report NIST IR 8425

## Profile of the IoT Core Baseline for Consumer IoT Products

Michael Fagan Katerina Megas Paul Watrobski Jeffery Marron Barbara Cuthill

This publication is available free of charge from: https://doi.org/10.6028/NIST.IR.8425

<!-- image -->

## NIST Internal Report NIST IR 8425

## Profile of the IoT Core Baseline for Consumer IoT Products

Michael Fagan Katerina N. Megas Paul Watrobski Jeffrey Marron Barbara B. Cuthill

Applied Cybersecurity Division Information Technology Laboratory

This publication is available free of charge from: https://doi.org/10.6028/NIST.IR.8425

September 2022

<!-- image -->

U.S. Department of Commerce Gina M. Raimondo, Secretary

National Institute of Standards and Technology Laurie E. Locascio, NIST Director and Under Secretary of Commerce for Standards and Technology

Certain commercial entities, equipment, or materials may be identified in this document in order to describe an experimental procedure or concept adequately. Such identification is not intended to imply recommendation or endorsement by the National Institute of Standards and Technology (NIST), nor is it intended to imply that the entities, materials, or equipment are necessarily the best available for the purpose. There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may be used by federal agencies even before the completion of such companion publications. Thus, until each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning and transition purposes, federal agencies may wish to closely follow the development of these new publications by NIST. Organizations are encouraged to review all draft publications during public comment periods and provide feedback to NIST.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Security and Privacy Controls for Information Systems and Organizations provide? (Part 8)

[Assistant]
tions in the public and private sectors, both
nationally and internationally, whose insightful and constructive comments improved the
overall quality, thoroughness, and usefulness of this publication.
HISTORICAL CONTRIBUTIONS TO NIST SPECIAL PUBLICATION 800-53

The authors wanted to acknowledge the many individuals who contributed to previous versions
of Special Publication 800-53 since its inception in 2005. They include Marshall Abrams, Dennis
Bailey, Lee Badger, Curt Barker, Matthew Barrett, Nadya Bartol, Frank Belz, Paul Bicknell, Deb
Bodeau, Paul Brusil, Brett Burley, Bill Burr, Dawn Cappelli, Roger Caslow, Corinne Castanza, Mike
Cooper, Matt Coose, Dominic Cussatt, George Dinolt, Randy Easter, Kurt Eleam, Denise Farrar,
Dave Ferraiolo, Cita Furlani, Harriett Goldman, Peter Gouldmann, Tim Grance, Jennifer Guild,
Gary  Guissanie,  Sarbari  Gupta,  Priscilla  Guthrie,  Richard  Hale,  Peggy  Himes,  Bennett  Hodge,
William Hunteman, Cynthia Irvine, Arnold Johnson, Roger Johnson, Donald Jones, Lisa Kaiser,
Stuart  Katzke,  Sharon  Keller,  Tom  Kellermann,  Cass  Kelly,  Eustace  King,  Daniel  Klemm,  Steve
LaFountain, Annabelle Lee, Robert Lentz, Steven Lipner, William MacGregor, Thomas Macklin,
Thomas Madden, Robert Martin, Erika McCallister, Tim McChesney, Michael McEvilley, Rosalie
McQuaid,  Peter  Mell,  John  Mildner,  Pam  Miller,  Sandra  Miravalle,  Joji  Montelibano,  Douglas
Montgomery, George Moore, Rama Moorthy, Mark Morrison, Harvey Newstrom, Sherrill Nicely,
Robert  Niemeyer,  LouAnna  Notargiacomo,  Pat  O’Reilly,  Tim  Polk,  Karen  Quigg,  Steve  Quinn,
Mark Riddle, Ed Roback, Cheryl Roby, George Rogers, Scott Rose, Mike Rubin, Karen Scarfone,
Roger  Schell,  Jackie  Snouffer,  Ray  Snouffer,  Murugiah  Souppaya,  Gary  Stoneburner,  Keith
Stouffer,  Marianne  Swanson,  Pat  Toth,  Glenda  Turner,  Patrick  Viscuso,  Joe  Weiss,  Richard
Wilsher, Mark Wilson, John Woodward, and Carol Woody.

Security and Privacy Controls for Information Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AT.L2-3.2.2 (NIST 3.2.2)?

[Assistant]
According to Guide to Auditing for Controls and Security_ A System Development Life Cycle Approach:

3.2.2                                                            | Size of Review Task                                              | Size of Review Task                                              | 49        |
|-----------|------------------------------------------------------------------|------------------------------------------------------------------|------------------------------------------------------------------|-----------|
| 3. 3.2.2 System Initiation Phase Documents                                                   | 4. 3.2.2 System Initiation Phase Documents                                                   | 79   |
|       | Audit 4.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does NIST Cybersecurity Framework 2.0_ Quick-Start Guide for Cybersecurity Supply Chain Risk Management (C-SCRM) provide? (Part 3)

[Assistant]
lly for organizations and for their vendors. ## Perform these activities to establish your organization's C-SCRM capability:

Activity 1: Create a C-SCRM strategy, objectives, policies, and processes.
[GV.SC-01]

Activity 2: Identify your organization's technology suppliers and determine how critical each one is to your organization. [GV.SC-04]

Activity 3: Establish C-SCRM roles and requirements and communicate them within and outside your organization. This includes identifying C-SCRM roles and responsibilities [GV.SC- 02] and C-SCRM requirements [GV.SC-05]. ## It is also important to coordinate and harmonize activities between your C-SCRM capability and other internal capabilities. Here are a few examples:

- Integrate C-SCRM into cybersecurity and enterprise risk management, risk assessment, and improvement processes, and monitor the performance of C-SCRM practices throughout the technology lifecycle. [GV.SC-03, GV.SC-09] See the Enterprise Risk Management Quick-Start Guide for more information on C-SCRM integration. - Include your relevant suppliers in cybersecurity incident planning, response, and recovery activities. [GV.SC-08] See NIST's Computer Security Incident Handling Guide for more information on key practices for cybersecurity incidents. ## Checklist of actions for Activity 1: Create a C-SCRM strategy, objectives, policies, and processes. - ☐ Establish a C-SCRM strategy that lays out the objectives of the capability. - ☐ Develop a C-SCRM plan (with milestones) and C-SCRM policies and procedures that guide implementation and improvement of the plan and the capability; socialize those policies and procedures with organizational stakeholders. - ☐ Develop and implement C-SCRM processes based on the strategy, objectives, policies, and procedures that are agreed upon and performed by the organizational stakeholders.

NIST Cybersecurity Framework 2.0_ Quick-Start Guide for Cybersecurity Supply Chain Risk Management (C-SCRM)


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What are the CMMC Level 1 requirements?

[Assistant]
According to IoT Non-Technical Supporting Capability Core Baseline:

ory responsibilities. The information in this publication, including concepts and methodologies, may  be  used  by  federal  agencies  even  before  the  completion  of  such  companion  publications.
Thus,  until  each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning  and  transition  purposes,  federal  agencies  may  wish  to  closely  follow  the  development  of  these  new publications by NIST. Organizations are encouraged to review all draft publications during public comment periods and provide feedback to NIST. Many NIST cybersecurity publications, other than the ones noted above, are available at https://csrc.nist.gov/publications. ## Comments on this publication may be submitted to:

National Institute of Standards and Technology Attn: Applied Cybersecurity Division, Information Technology Laboratory 100 Bureau Drive (Mail Stop 2000) Gaithersburg, MD 20899-2000

Email: iotsecurity@nist.gov

All comments are subject to release under the Freedom of Information Act (FOIA). ## Reports on Computer Systems Technology

The  Information  Technology  Laboratory  (ITL)  at  the  National  Institute  of  Standards  and Technology  (NIST)  promotes  the  U.S. economy  and  public  welfare  by  providing  technical leadership  for  the  Nation's  measurement  and  standards  infrastructure. ITL  develops  tests,  test methods, reference data, proof of concept implementations, and technical analyses to advance the development  and  productive  use  of  information  technology. ITL's  responsibilities  include  the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in federal information systems. ## Abstract

Non-technical supporting capabilities are actions a manufacturer or third-party organization performs in support of the cybersecurity of an IoT device.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Information Integrity?

[Assistant]
According to Transitioning to the Security Content Automation Protocol (SCAP) Version 2:

SWID tags support the identification of installed patches, extensible metadata attributes, and software integrity measurement data not supported by CPE.  Through these additional capabilities, SWID tags can support more comprehensive software inventory (including patch details), tamper detection, and application whitelisting. Through the fine-grained identification of software products and patches using SWID tags, improved automation of vulnerability and configuration management is possible in SCAP v2. NIST Internal Report (NISTIR) 8060 [5], provides details on the SWID tag format and discussion of the SWID tag operational model, which is intended to be used as part of SCAP v2.

Transitioning to the Security Content Automation Protocol (SCAP) Version 2


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Guide to Malware Incident Prevention and Handling for Desktops and Laptops provide? (Part 5)

[Assistant]
l Institute of Standards and Technology would also like to express its appreciation and thanks to the Department of Homeland Security for its sponsorship and support of NIST Special Publication 80083.
## Trademark Information

All product names are registered trademarks or trademarks of their respective companies. ## Table of Contents

| Executive Summary................................................................................................................vii   | Executive Summary................................................................................................................vii                                                                                | Executive Summary................................................................................................................vii                                                                                |                                                                                |
|----------------------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------|
| 1. Introduction ...................................................................................................................... | 1.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Proceedings of the Cybersecurity in Cyber-Physical Systems Workshop, April 23-24, 2012 provide? (Part 4)

[Assistant]
facturing

## Acknowledgements

The editor would like to thank Suzanne Lightman, Kevin Stine (both NIST), and Mark Enstrom (Neustar) for being reviewers for this document. ## Table of Contents

|   1.
| Introduction ..............................................................................................................................1                                                                     |
|------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
|    2 | Opening Remarks .....................................................................................................................2                                                                           |
|    3 | Implantable Medical Devices - Cyber Risks and Mitigation Approaches...............................9                                                                                |
|    4 | Safety-Critical Automotive and Industrial Data Security......................................................25                                                                                |
|    5 | Keynote Speaker: Dr.

Proceedings of the Cybersecurity in Cyber-Physical Systems Workshop, April 23-24, 2012


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for Incident Response?

[Assistant]
According to Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171:

| CHAPTERONE INTRODUCTION...................................................................................................... | CHAPTERONE INTRODUCTION...................................................................................................... |
|--------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------|
| 1.1 PURPOSEANDAPPLICABILITY                                                                                | ................................................................................................... 3                                            |
| 1.2 TARGET AUDIENCE                                                                                | .................................................................................................................. 4                             |
| 1.3 ORGANIZATIONOF THIS SPECIAL PUBLICATION                                                                                | .......................................................................... 4                                                                     |
| CHAPTERTWO THE FUNDAMENTALS............................................................................................ 5                        | CHAPTERTWO THE FUNDAMENTALS............................................................................................ 5                        |
| 2.1 DEVELOPMENTAPPROACH ......................................................................................................

Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AC.L2-3.1.1 (NIST 3.1.1)?

[Assistant]
According to Federal Cybersecurity Awareness Programs_ A Mixed Methods Research Study:

3.1.1                                                                                | Security Awareness Role... 3.1.1 Security Awareness Role

## Focus Groups

Figure 1 shows the distribution of focus group participants' roles with respect to their organizations' security awareness program.

Federal Cybersecurity Awareness Programs_ A Mixed Methods Research Study


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What guidance does Summary of NIST SP 800-53, Revision 4_ Security and Privacy Controls for Federal Information Systems and Organizations provide?

[Assistant]
## Summary of NIST SP 800-53 Revision 4, Security and Privacy Controls for Federal Information Systems and Organizations

Kelley Dempsey Computer Security Division Information Technology Laboratory

Greg Witte Doug Rike G2, Inc. Annapolis Junction, MD

February 19, 2014

<!-- image -->

## Abstract

This white paper provides an overview of NIST Special Publication (SP) 800-53 Revision 4, Security and Privacy Controls for Federal Information Systems and Organizations , which was published April 30, 2013. ## Keywords

assurance; computer security; FIPS Publication 199; FIPS Publication 200, FISMA; Privacy Act; Risk Management Framework; security controls; security requirements

## Disclaimer

Any mention of commercial products or reference to commercial organizations is for information only; it does not imply recommendation or endorsement by NIST, nor does it imply that the products mentioned are necessarily the best available for the purpose. ## Additional Information

For additional information on NIST's Computer Security Division programs, projects and publications, visit the Computer Security Resource Center, csrc.nist.gov. Information on other efforts at NIST and in the Information Technology Laboratory (ITL) is available at www.nist.gov and www.nist.gov/itl.

Summary of NIST SP 800-53, Revision 4_ Security and Privacy Controls for Federal Information Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Maintenance?

[Assistant]
According to High-Performance Computing Security_ Architecture, Threat Analysis, and Security Posture:

Additional information about this publication is available at https://csrc.nist.gov/pubs/sp/800/223/final, including related content, potential updates, and document history.

optimize network performance. The popular HPC interconnect networking includes InfiniBand [2], Omni-Path [3], Slingshot [4], Ethernet, and others. A high-performance computing zone typically utilizes non-high-performance communication networks, like ethernet, as cluster internal networks that connect the high-performance computing zone with the management zone and access zone for traffic associated with maintenance activities as opposed to HPC traffic.

Both GPFS and Lustre-based PFSs are prone to performance degradation when a certain capacity threshold is reached. These file systems may be regularly pruned of unwanted files with a strategy decided by the file system administrators. Some deployments will delete files older than a certain age, which forces HPC users to transfer job output to a longer-term file system, such as campaign storage. PFSs tends to be somewhat unreliable, depending on the types of activities being performed by running jobs and users. Because these are distributed file systems, file-system software must solve distributed locking of files to ensure deterministic file updates when multiple clients are writing to the same file at once. Additionally, PFSs are susceptible to denial-of-service conditions even during legitimate user operations, such as listing a directory with millions of files or applications that perform poor file locking semantics.

High-Performance Computing Security_ Architecture, Threat Analysis, and Security Posture


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Configuration Management?

[Assistant]
According to Ordered t-way Combinations for Testing State-based Systems:

Combinatorial testing with constraints on the order in which values and combinations are applied in tests was analyzed extensively in [5] . Extended covering arrays that consider the sequence of values in each test  were  defined  in  [6]  . Combination  sequences were studied in [20] , combining configuration and the  order  of  combinations  while  also  considering constraints. Another structure defined as a sequence covering  array  of t -way  combinations  has  been termed  a multi-valued sequence  covering  array, introduced in [25] . - [20] James  M. Higdon,  Gerald  Oveson,  Efficient  Test  of Configurations  and  Orders  of  Complex  Operating  Procedures Tech. Rpt.,  COLSA North Florida Ops, 96th Cyberspace Test Group, AFMC, Eglin AFB, FL, 4 Apr 2018. - [21] Duan F, Lei Y, Kacker RN, Kuhn DR. An Approach to T-Way Test Sequence Generation With Constraints. 2019 IEEE Intl Conference on Software Testing, Verification and Validation Workshops (ICSTW) 2019 Apr 22 (pp. 241-250). IEEE. - [22] Garn B, Simos DE, Duan F, Lei Y, Bozic J, Wotawa F. Weighted Combinatorial Sequence Testing for the TLS Protocol. In2019  IEEE  International  Conference  on  Software  Testing, Verification and Validation Workshops (ICSTW) 2019 Apr 22 (pp. 46-51). IEEE. - [23] Oetsch  J,  Nieves  JC. Stable-Ordered  Models  for Propositional Theories with Order Operators. InEuropean Conference on Logics in Artificial Intelligence 2019 May 7 (pp. 794-802). Springer, Cham. - [24] Yuster R. Perfect sequence covering arrays. Designs, Codes and Cryptography. 2020 Mar;88(3):585-93. - [25] Younis MI. MVSCA: Multi-Valued Sequence Covering Array. Journal of Engineering. 2019 Oct 29;25(11):8291. - [26] D.R. Kuhn,  I. Dominguez,  R.N. Kacker  and  Y. Lei. "Combinatorial Coverage Measurement Concepts and Applications", 2nd  Intl  Workshop  on  Combinatorial  Testing , Luxembourg, IWCT2013, IEEE, Mar. 2013. - [27] Zamli KZ, Othman RR, Zabil MH. On sequence based interaction  testing.

Ordered t-way Combinations for Testing State-based Systems


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 1 require for System and Communications Protection?

[Assistant]
According to IoT Non-Technical Supporting Capability Core Baseline:

ing the non-technical support capability. - The last column lists IoT reference examples that indicate existing sources of IoT device cybersecurity guidance specifying a similar or related capability.
Because the table only covers the basics of the capabilities, the references can be invaluable for understanding each capability in more detail and learning how to implement each capability in a reasonable manner. The following are the references used in Table 1:
- o AGELIGHT : AgeLight Digital Trust Advisory Group, 'IoT Safety Architecture & Risk Toolkit v4.0' [7]
- o CTA : Consumer Technology Association, 'American National Standards Institute (ANSI)/CTA Standard - Baseline Cybersecurity Standard for Devices and Device Systems: ANSI/CTA-2088' [8]
- o CSDE : Council to Secure the Digital Economy (CSDE), 'The C2 Consensus on IoT Device Security Baseline Capabilities' [9]
- o ETSI : European Telecommunications Standards Institute, 'Cyber Security for Consumer Internet of Things: Baseline Requirements v2.1.0' [10]
- o IoTSF : IoT Security Foundation (IoTSF), 'IoT Security Compliance Framework v2.1' [11]


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 2 require for Planning?

[Assistant]
According to Assessing Security Requirements for Controlled Unclassified Information:

Certain equipment, instruments, software, or materials, commercial or non-commercial, are identified in this paper in order to specify the experimental procedure adequately. Such identification does not imply recommendation or endorsement of any product or service by NIST, nor does it imply that the materials or equipment identified are necessarily the best available for the purpose. There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may be used by federal agencies even before the completion of such companion publications. Thus, until each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning and transition purposes, federal agencies may wish to closely follow the development of these new publications by NIST. to NIST. Many NIST cybersecurity publications, other than the ones noted above, are available at

The purpose of this publication is to provide procedures for assessing the security requirements in NIST Special Publication (SP) 800-171, Protecting Controlled Unclassified Information (CUI) in Nonfederal Systems and Organizations [3]. Organizations can use the assessment procedures to generate evidence that the security requirements have been satisfied. The scope of the security assessments conducted using the procedures described in this publication is guided and informed by the system security plans for systems that process, store, or transmit CUI. The assessment procedures offer the flexibility to customize assessments based on organizational policies and requirements, known threat and vulnerability information, system and platform dependencies, operational considerations, and tolerance for risk.

Assessing Security Requirements for Controlled Unclassified Information


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Awareness and Training?

[Assistant]
According to Guidelines on Mobile Device Forensics:

logical store (e.g., a

file system partition). Level 3, Hex Dumping/JTAG Extraction methods, entail performing a 'physical acquisition' of mobile device memory in situ and require advanced training.
Level 4 Chip-Off methods involve the physical removal of memory from a mobile device to extract data, requiring extensive training in electronic engineering and file system forensics. Level 5, Micro Read methods involve the use of a high-powered microscope to view the physical state of gates. Level 5 methods are the most invasive, sophisticated, technical, expensive, and time consuming of all the methodologies.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for Incident Response?

[Assistant]
According to Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171:

............................................ 5                        |
| 2.1 DEVELOPMENTAPPROACH ......................................................................................................
| 5                                                                                |
| 2.2 ORGANIZATIONANDSTRUCTURE                                                                                | ............................................................................................. 7                                                  |
| 2.3 FLEXIBLE APPLICATION                                                                                | ............................................................................................................. 9                                  |
| CHAPTER THREE THE REQUIREMENTS......................................................................................... 11                       | CHAPTER THREE THE REQUIREMENTS......................................................................................... 11                       |
| 3.1 ACCESSCONTROL                                                                                | .................................................................................................................. 12                            |
| 3.2 AWARENESSANDTRAINING                                                                                | ...................................................................................................


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice CM.L2-3.4.3 (NIST 3.4.3)?

[Assistant]
According to Multi-Factor Authentication for Criminal Justice Information Systems_ Implementation Considerations for Protecting Criminal Justice Information:

3.4.3. 3.4.3 provides more detail about integrating MFA with VPN services. 3.4.3 discusses implementing MFA with VPNs.

Multi-Factor Authentication for Criminal Justice Information Systems_ Implementation Considerations for Protecting Criminal Justice Information


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Media Protection?

[Assistant]
According to Audit and Evaluation of Computer Security II_ System Vulnerabilities and Controls:

ion level)
- Retention back-up and destruction
- Usage logs
- Cleaning of media
- Storage and custody of supplies and media, and
- Disposal of sensitive media remnants. - 3.2.4 Machine Uti 1 ization .
To detect excessive rerun time, excessive machine down-time, unsatisfactory throughput times and/or excessive user charges, appropriate policies should be established regarding:
- Regular production of pertinent utilization statistics. - Approval of job classifications and priorities, and
- Machine scheduling
- 3.2.5 Output Handling . To ensure the detection of processing errors in the output and to prevent output from being distributed inappropriately, appropriate policies should be established regarding:
- The identification of all printed and other output
- The quality control procedures over output for detection of errors and/or unacceptable conditions
- Standard procedures for the physical handling (decollating, binding, etc.) and delivery of output and the disposal of remnants (e.g., extraneous copies, carbon)
- Standard procedures and assigned accountability for handling of negotiable instruments (e.g., signed checks, purchase orders)
- 3.2.6 Environment Control . To prevent intentional and/or unintentional damage by human attack or natural phenomena, appropriate policies designed to maintain an appropriate physical environment for the equipment, media, and personnel should be established regarding:
- The use and testing of protective devices (e.g., smoke alarms) and procedures (e.g., guards), and
- Installation housekeeping procedures. - 3.2.7 Access Control . To prevent unauthorized disclosure, retrieval, or modification of data or programs, appropriate policies should be established regarding:
- Restriction of physical access to the particular equipment, media, and premises to authorized personnel only.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Risk Assessment?

[Assistant]
According to Planning for a Zero Trust Architecture_ A Planning Guide for Federal Administrators:

- Policy Engine (PE): The 'brain' of a ZTA implementation and the components that ultimately evaluate resource access requests. The PE relies on information from the various data sources (access logs, threat intelligence, endpoint health, and network ID authentication, etc.)
- Policy Administrator (PA): The executor function of the PE. The PA's role is to establish, maintain and ultimately terminate sessions 1 in the data plane between the subject and the resource. The PA, PE and PEP communicate on a logically (or physically) separate set of channels called the control plane. The control plane is used to establish and configure the data plane channels used to send application traffic. - Policy Enforcement Point (PEP): The component that applications, endpoints, etc. will interact with to be granted access permission to a resource. The PEP is responsible for gathering information for the PE and following the instructions issued by the PA to establish and terminate communication sessions. All data plane communications between enterprise resources must be managed by a PEP. - Information feeds (left and right ): Sometimes called policy information points (PIPs). These are not 'core' functional ZTA components themselves but used to support the PE. These feeds include the set of codified policies, identity and endpoint attributes, environmental factors and historical data used by the PE to generate resource access decisions. - I. All data sources and computing services are considered resources. An enterprise relies on different resources to perform its mission: mobile devices, data stores, compute resources (including virtual), remote sensors/actuators, etc. All these components are resources and need to be considered in a ZTA. Some components (e.g., IoT sensors) may not be able to support some solutions such as configuration agents, application sandboxing, etc. so compensating technologies or alternative mitigations may be needed.

Planning for a Zero Trust Architecture_ A Planning Guide for Federal Administrators


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What are the CMMC Level 1 requirements?

[Assistant]
According to IoT Non-Technical Supporting Capability Core Baseline:

## NISTIR 8259B

## IoT Non-Technical Supporting Capability Core Baseline

Michael Fagan Jeffrey Marron Kevin G. Brady, Jr. Barbara B. Cuthill Katerina N. Megas Rebecca Herold

This publication is available free of charge from:

https://doi.org/10.6028/NIST.IR.8259B

<!-- image -->

## NISTIR 8259B

## Internet of Things Non-Technical Supporting Capability Core Baseline

Michael Fagan Jeffrey Marron Kevin G. Brady, Jr. Barbara B. Cuthill Katerina N. Megas

Applied Cybersecurity Division Information Technology Laboratory

Rebecca Herold

The Privacy Professor

Des Moines, IA

This publication is available free of charge from: https://doi.org/10.6028/NIST.IR.8259B

August 2021

<!-- image -->

U.S. Department of Commerce Gina M. Raimondo, Secretary

National Institute of Standards and Technology James K. Olthoff, Performing the Non-Exclusive Functions and Duties of the Under Secretary of Commerce for Standards and Technology & Director, National Institute of Standards and Technology

## National Institute of Standards and Technology Interagency or Internal Report 8259B 21 pages (August 2021)

## This publication is available free of charge from: https://doi.org/10.6028/NIST.IR.8259B

Certain  commercial  entities,  equipment,  or  materials  may  be  identified  in  this  document  in  order  to  describe  an experimental  procedure  or  concept  adequately. Such  identification  is  not  intended  to  imply  recommendation  or endorsement by NIST, nor is it intended to imply that the entities, materials, or equipment are necessarily the best available for the purpose. There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may  be  used  by  federal  agencies  even  before  the  completion  of  such  companion  publications.

IoT Non-Technical Supporting Capability Core Baseline


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Configuration Management?

[Assistant]
According to Audit and Evaluation of Computer Security II_ System Vulnerabilities and Controls:

| | | | 6-4 | |---------------|--------------------------------------------------------|---------------------------------------------------------------------------------|-----------| | 2.3 | Quantity of Terminals | Quantity of Terminals | 6-4 | | 2.4 | Terminal Characteristics | Terminal Characteristics | 6-4 | | | 2.4.1 | Portability | 6-4 6-4 | | | 2.4.2 | Bandwidth | 6-4 | | | 2.4.3 | Storage | 6-4 | | | 2.4.4 | Value | 6-4 | | | 2.4.5 | Construction, Modularity and Assembly | 6-5 | | | 2.4.6 | Intelligence | 6-5 | | | 2.4.7 | Emanations | 6-5 | | | 2.4.8 | Media | 6-5 | | 3.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 2 require for Personnel Security?

[Assistant]
According to Assessing Security Requirements for Controlled Unclassified Information:

| Access Control                    | Maintenance         | Security Assessment and Monitoring   |
|-----------------------------------|---------------------|--------------------------------------|
| Awareness and Training            | Media Protection    | System and Communications Protection |
| Audit and Accountability          | Personnel Security  | System and Information Integrity     |
| Configuration Management          | Physical Protection | Planning                             |
| Identification and Authentication | Risk Assessment     | System and Services Acquisition      |
| Incident Response                 |                     | Supply Chain Risk Management         |

A.03.01.06.ODP[01]: personnel or roles to which privileged accounts on the system are to be restricted are defined .

A.03.01.06.a: privileged accounts on the system are restricted to <A.03.01.06.ODP[01]: personnel or roles> .


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Personnel Security?

[Assistant]
According to Digital Identity Guidelines_ Authentication and Authenticator Management:

5.3.
Session monitoring (sometimes called continuous authentication) is the ongoing
evaluation of session characteristics to detect possible fraud during a session. Session
monitoring  MAY  be performed by the RP in coordination with the CSP or IdP and
associated verifier as a risk reduction measure. When potential fraud is detected
during a session, the RP  SHOULD  act in conjunction with the CSP, IdP, or verifier to
reauthenticate, terminate the session, or notify appropriate support personnel. Session
characteristics that  MAY  be evaluated include:

Insider Threats

Digital Identity Guidelines_ Authentication and Authenticator Management


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Awareness and Training?

[Assistant]
According to Workshop on Enhancing Security of Devices and Components Across the Supply Chain:

| 1. Introduction...................................................................................................................................1    |
|--------------------------------------------------------------------------------------------------------------------------------------------------------|
| 2. Workshop Sessions ........................................................................................................................3         |
| 2.1.1. Speaker Viewpoints......................................................................................................................3       |
| 2.1.2. Key Highlights ...............................................................................................................................4 |
| 2.2.1. Speaker Viewpoints......................................................................................................................5       |
| 2.2.2. Key Highlights ...............................................................................................................................6 |
| 2.3.1. Speaker Viewpoints......................................................................................................................6       |
| 2.3.2. Key Highlights ...............................................................................................................................8 |
| 2.4.1. Speaker Viewpoints......................................................................................................................9       |
| 2.4.2. Key Highlights .............................................................................................................................11  |
| 2.5.1. Speaker Viewpoints....................................................................................................................11        |
| 2.5.2.

Workshop on Enhancing Security of Devices and Components Across the Supply Chain


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Status Report on the Fourth Round of the NIST Post-Quantum Cryptography Standardization Process provide? (Part 2)

[Assistant]
signed statutory responsibilities. The information in this publication, including concepts and methodologies, may be used by federal agencies even before the completion of such companion publications.
Thus, until each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning and transition purposes, federal agencies may wish to closely follow the development of these new publications by NIST. Organizations are encouraged to review all draft publications during public comment periods and provide feedback to NIST. Many NIST cybersecurity publications, other than the ones noted above, are available at https://csrc.nist.gov/publications. ## NIST Technical Series Policies

Copyright, Use, and Licensing Statements NIST Technical Series Publication Identifier Syntax

## Publication History

Approved by the NIST Editorial Review Board on 2025-03-05

## How to cite this NIST Technical Series Publication:

Alagic G, Bros M, Ciadoux P, Cooper D, Dang Q, Dang T, Kelsey J, Lichtinger J, Liu YK, Miller C, Moody D, Peralta R, Perlner R, Robinson A, Silberg H, Smith-Tone D, Waller N (2025) Status Report on the Fourth Round of the NIST Post-Quantum Cryptography Standardization Process. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Internal Report (IR) NIST IR 8545.

Status Report on the Fourth Round of the NIST Post-Quantum Cryptography Standardization Process


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Guide to Enterprise Patch Management Planning_ Preventive Maintenance for Technology provide? (Part 6)

[Assistant]
ates, and upgrades throughout an organization. In past perimeter-based security architectures, most software was operated on internal networks protected by several layers of network security controls.
While patching was generally considered important for reducing the likelihood of compromise and was a common compliance requirement, patching was not always considered a priority. In today's environments, patching has become more important, often rising to the level of mission criticality. As part of a zero trust approach to security, it is now recognized that the perimeter largely does not exist anymore, and most technologies are directly exposed to the internet, putting systems at significantly greater risk of compromise. This dynamic applies across all computing technologies, whether they are information technology (IT), operational technology (OT), Internet of Things (IoT), mobile, cloud, virtual machine, container, or other types of assets. Zero trust architectures emphasize business asset-specific security over just protecting a network with assets on it, so patching is vital for reducing risk to those individual assets and determining the assets' trust status. There is often a divide between business/mission owners and security/technology management. Business/mission owners may believe that patching negatively affects productivity, since it requires scheduled downtime for maintenance and introduces the risk of additional downtime if something goes wrong and disrupts operations. Leadership and business/mission owners should reconsider the priority of enterprise patch management in light of today's risks. Patching should be considered a standard cost of doing business and should be rigorously followed and tracked. Just as preventive maintenance on corporate fleet vehicles can help avoid costly breakdowns, patching should be viewed as a normal and necessary part of reliably achieving the organization's missions.

Guide to Enterprise Patch Management Planning_ Preventive Maintenance for Technology


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Services Acquisition?

[Assistant]
According to Overview and Considerations of Access Control Based on Attribute Encryption:

There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may be used by federal agencies even before the completion of such companion publications. Thus, until each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning and transition purposes, federal agencies may wish to closely follow the development of these new publications by NIST.

The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the Nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof-of-concept implementations, and technical analyses to advance the development and productive use of information technology. ITL's responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in federal information systems.

Overview and Considerations of Access Control Based on Attribute Encryption


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Communications Protection?

[Assistant]
According to Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule_ A Cybersecurity Resource Guide:

| Standard | Sections | Implementation Specifications (R) = Required, (A) = Addressable | |---------------------------------|---------------|-----------------------------------------------------------------------| | | | Emergency Access Procedure (R) | | | | Automatic Logoff (A) | | | | Encryption and Decryption (A) | | Audit Controls | 164.312(b) | (R) | | Integrity | 164.312(c)(1) | Mechanism to Authenticate Electronic Protected Health Information (A) | | Person or Entity Authentication | 164.312(d) | (R) | | Transmission Security | 164.312(e)(1) | Integrity Controls (A) | | Transmission Security | 164.312(e)(1) | Encryption (A) | | Key Activities | Description | Sample Questions | |--------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | 1.

Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule_ A Cybersecurity Resource Guide