[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 1 require for Risk Assessment?

[Assistant]
According to IoT Device Cybersecurity Capability Core Baseline:

| Device Cybersecurity Capability | Common Elements | Rationale | IoT Reference Examples | |---------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | Device Identification : The IoT device can be uniquely identified logically and physically.

IoT Device Cybersecurity Capability Core Baseline


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Information Integrity?

[Assistant]
According to Recommendation for Pair-Wise Key-Establishment Using Integer Factorization Cryptography:

lishment schemes. | Additional input                    | Information known by two parties that is cryptographically bound to the secret keying material being protected using the encryption operation.
|
|-------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Algorithm                           | A clearly specified mathematical process for computation; a set of rules that, if followed, will give a prescribed result. |
| Approved                            | FIPS- approved or NIST-Recommended. An algorithm or technique that is either 1) specified in a FIPS or NIST Recommendation, or 2) adopted in a FIPS or NIST Recommendation and specified either (a) in an appendix to the FIPS or NIST Recommendation, or (b) in a document referenced by the FIPS or NIST Recommendation. |
| Assumption                          | Used to indicate the conditions that are required to be true when an approved key-establishment scheme is executed in accordance with this Recommendation. |
| Assurance of private key possession | Confidence that an entity possesses a private key associated with a given public key. |
| Assurance of validity               | Confidence that an RSA key pair is arithmetically correct.

Recommendation for Pair-Wise Key-Establishment Using Integer Factorization Cryptography


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for Audit and Accountability?

[Assistant]
According to Protecting Controlled Unclassified Information (CUI)_ NIST Special Publication 800-171, Revision 3. Small Business Primer:

| Access Control                    | Maintenance         | Security Assessment and Monitoring   |
|-----------------------------------|---------------------|--------------------------------------|
| Awareness and Training            | Media Protection    | System and Communications Protection |
| Audit and Accountability          | Personnel Security  | System and Information Integrity     |
| Configuration Management          | Physical Protection | Planning                             |
| Identification and Authentication | Risk Assessment     | System and Services Acquisition      |
| Incident Response                 |                     | Supply Chain Risk Management         |

| Identify the role(s) responsible for security and provide the necessary resources. | Whether it is just one person or multiple people within the business, ensure roles, responsibilities, and authorities related to cybersecurity risk management are established, communicated, understood, and enforced. Even if cybersecurity activities are outsourced to an external provider, someone within the business should still be designated to manage cybersecurity risk.

Protecting Controlled Unclassified Information (CUI)_ NIST Special Publication 800-171, Revision 3. Small Business Primer


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Summary of NIST SP 800-53, Revision 4_ Security and Privacy Controls for Federal Information Systems and Organizations provide? (Part 5)

[Assistant]
e of continuous improvement in the organization's risk-related activities, with effective communication among tiers and stakeholders. Figure 1 illustrates the three-tiered approach to risk management.
Figure 1: Risk Management 3-Tiered Approach

<!-- image -->

The NIST Risk Management Framework (RMF), described in NIST Special Publication 800-37 Revision 1, Guide for Applying the Risk Management Framework to Federal Information Systems: a Security Life Cycle Approach, is a methodology for implementing risk management at the information systems tier. The RMF (depicted in Figure 2) identifies six distinct steps that provide a disciplined and structured process to integrate information security risk management activities into the system development life cycle. The RMF addresses security concerns of organizations related to the design, development, implementation, operation, and disposal of information systems and the environments in which those systems operate. The security controls in SP 800-53 Rev. 4 support Step Two of the RMF, and a detailed catalog of these controls is provided in Appendix F. For ease of use in the security control selection and specification process, controls are organized into eighteen families, each containing security controls related to the general security topic of the family. Security controls involve aspects of policy, oversight, supervision, manual processes, individual actions, or automated mechanisms implemented by information systems/devices. The security control structure consists of the

following components: (i) a control section; (ii) a supplemental guidance section; (iii) a control enhancements section; (iv) a references section; and (v) a priority and baseline allocation section.

Summary of NIST SP 800-53, Revision 4_ Security and Privacy Controls for Federal Information Systems and Organizations

Audit and Accountability
System and Information Integrity
Security Assessment
Media Protection
Identification and Authentication
Awareness and Training
System and Communications Protection
Access Control
Planning
Incident Response
Risk Assessment
Personnel Security
System and Services Acquisition
Supply Chain Risk Management
Maintenance
Physical Protection
Configuration Management


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Organizational Views of NIST Cryptographic Standards and Testing and Validation Programs provide? (Part 10)

[Assistant]
ty. These standards can be found in formal documents from organizations such as the Internet Engineering Task Force (IETF) [8], International Organization for Standardization (ISO) [9], and NIST [10].
Likely due to the U.S. locations of most of the study organizations, the participants most often mentioned cryptographic requirements issued by NIST. As perhaps the best known government standard, the Federal Information Processing Standards Publication (FIPS) 140-2 'specifies the security requirements that will be satisfied by a cryptographic module utilized within a security system protecting sensitive but unclassified information" [7]. These requirements are mandatory for cryptographic products purchased by the U.S. Government, but also are used voluntarily outside the government. There are two testing and validation programs associated with FIPS 140-2. The NIST Cryptographic Algorithm Validation Program (CAVP) provides guidelines that support conformance testing of FIPS-approved and other NIST-recommended cryptographic algorithms specified in special publications (SPs) [11]. CAVP is a prerequisite of the Cryptographic Module Validation Program (CMVP) which provides the validation of cryptographic modules [12]. Under these programs, vendors may submit algorithm and module implementations to any testing laboratory accredited under the National Voluntary Laboratory Accreditation Program (NVLAP) [13]. Labs perform certification testing, and NIST validates lab results. ## Study Methodology

The research team conducted in-depth interviews of individuals working in organizations that develop products that use cryptography. The study was approved by the NIST institutional review board. Prior to the interviews, participants were informed of the purpose of the study and how their data would be used and protected. Interview data were collected and recorded without personal identifiers and not linked back to the participants or organizations.

Organizational Views of NIST Cryptographic Standards and Testing and Validation Programs


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Protecting Information and System Integrity in Industrial Control System Environments_ Cybersecurity for the Manufacturing Sector provide? (Part 10)

[Assistant]
materials may be identified by name or company logo or other insignia in order to acknowledge their participation in this collaboration or to describe an experimental procedure or concept adequately.
Such identification is not intended to imply special status or relationship with NIST or recommendation or endorsement by NIST or NCCoE; neither is it intended to imply that the entities, equipment, products, or materials are necessarily the best available for the purpose. Domain name and IP addresses shown in this guide represent an example domain and network environment to demonstrate the NCCoE project use case scenarios and the security capabilities. National Institute of Standards and Technology Special Publication 1800-10B, Natl. Inst. Stand. Technol. Spec. Publ. 1800-10B, 149 pages, March 2022, CODEN: NSPUE2

## FEEDBACK

As a private-public partnership, we are always seeking feedback on our practice guides. We are particularly interested in seeing how businesses apply NCCoE reference designs in the real world. If you have implemented the reference design, or have questions about applying it in your environment, please email us at manufacturing\_nccoe@nist.gov. All comments are subject to release under the Freedom of Information Act (FOIA). National Cybersecurity Center of Excellence National Institute of Standards and Technology 100 Bureau Drive Mailstop 2002 Gaithersburg, MD 20899

Email: nccoe@nist.gov

## NATIONAL CYBERSECURITY CENTER OF EXCELLENCE

The National Cybersecurity Center of Excellence (NCCoE), a part of the National Institute of Standards and Technology (NIST), is a collaborative hub where industry organizations, government agencies, and academic institutions work together to address businesses' most pressing cybersecurity issues. This public-private partnership enables the creation of practical cybersecurity solutions for specific industries, as well as for broad, cross-sector technology challenges.

Protecting Information and System Integrity in Industrial Control System Environments_ Cybersecurity for the Manufacturing Sector


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Guide to Enterprise Patch Management Planning_ Preventive Maintenance for Technology provide? (Part 3)

[Assistant]
h  to  closely  follow  the  development  of  these  new publications by NIST. Organizations are encouraged to review all draft publications during public comment periods and provide feedback to NIST.
Many NIST cybersecurity publications, other than the ones noted above, are available at https://csrc.nist.gov/publications. Submit comments on this publication to:

cyberhygiene@nist.gov

National Institute of Standards and Technology Attn: Applied Cybersecurity Division, Information Technology Laboratory 100 Bureau Drive (Mail Stop 2000) Gaithersburg, MD 20899-2000

All comments are subject to release under the Freedom of Information Act (FOIA). ## Reports on Computer Systems Technology

The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the Nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology. ITL's responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in federal information systems. The Special Publication 800-series reports on ITL's research, guidelines, and outreach efforts in information system security, and its collaborative activities with industry, government, and academic organizations. ## Abstract

Enterprise patch management is the process of identifying, prioritizing, acquiring, installing, and verifying the installation of patches, updates, and upgrades throughout an organization. Patching is more important than ever because of the increasing reliance on technology, but there is often a divide between business/mission owners and security/technology management about the value of patching.

Guide to Enterprise Patch Management Planning_ Preventive Maintenance for Technology


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice IA.L2-3.5.2 (NIST 3.5.2)?

[Assistant]
According to Guide to Auditing for Controls and Security_ A System Development Life Cycle Approach:

3.5.2                                                            | A Simple Scoring Approach                                        | A Simple Scoring Approach                                        | 60        |
|           | 3. 3.5.2                                                                                | Systems Initiation Phase Audit Tests Program                                                | 86   |
|       | 4. 3.5.2 A Simple Scoring Approach

The simple approach assigns a weight and a risk level to each dimension, based on a qualitative judgement with respect to the characteristics associated with each dimension.

Guide to Auditing for Controls and Security_ A System Development Life Cycle Approach


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Cryptographic Module Validation Program (CMVP)-Approved Sensitive Security Parameter Generation and Establishment Methods_ CMVP Validation Authority U provide? (Part 9)

[Assistant]
organization

## General

Section 6 of this document replaces the approved sensitive security parameter generation and establishment methods of ISO/IEC 19790 Annex D and ISO/IEC 24759 paragraph 6.16.
This document also supersedes SP 800-140Dr1. ## Modification

This publication is a complete replacement of the CMVP-approved sensitive security parameter generation and establishment methods of ISO/IEC 19790 Annex C and ISO/IEC 24759 paragraph 6.16. There are no other modifications, additions, or deletions. ## CMVP-approved sensitive security parameter generation and establishment requirements

## Purpose

This document identifies CMVP-approved sensitive security parameter generation and establishment methods. These are considered CMVP-approved security functions. It precludes the use of all other sensitive security parameter generation and establishment methods. ## Sensitive security parameter generation and establishment methods

For the current list of CMVP-approved sensitive security parameter generation and establishment methods, see https://csrc.nist.gov/projects/cmvp/sp800-140d. ## Appendix A.

Cryptographic Module Validation Program (CMVP)-Approved Sensitive Security Parameter Generation and Establishment Methods_ CMVP Validation Authority U


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 1 require for Planning?

[Assistant]
According to IoT Device Cybersecurity Capability Core Baseline:

There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may be used by federal agencies even before the completion of such companion publications. Thus, until each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning and transition purposes, federal agencies may wish to closely follow the development of these new publications by NIST.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AU.L2-3.3.1 (NIST 3.3.1)?

[Assistant]
According to Data Integrity_ Detecting and Responding to Ransomware and Other Destructive Events:

3.3.1 Scenario

The following scenario was simulated to test the architecture's defense against data integrity events that occur on virtual machines.

Data Integrity_ Detecting and Responding to Ransomware and Other Destructive Events


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for Planning?

[Assistant]
According to Assessing Enhanced Security Requirements for Controlled Unclassified Information:

There may be references in this publication to other publications currently under development by  NIST  in  accordance  with  its  assigned  statutory  responsibilities.  The  information  in  this publication, including concepts, practices, and methodologies, may be used by federal agencies even  before  the  completion  of  such  companion  publications.  Thus,  until  each  publication  is completed,  current  requirements,  guidelines,  and  procedures,  where  they  exist,  remain operative. For planning and transition purposes, federal agencies may wish to closely follow the development of these new publications by NIST.

The scope of the assessments conducted using the procedures described in this publication is guided and informed by the system security plans for the organizational systems processing, storing, or transmitting CUI. The assessments focus on the overall effectiveness of the security safeguards intended to satisfy the enhanced security requirements defined in [SP 800-172].

Assessments can be conducted by system developers, system integrators, system owners, evaluators, auditors, or the security staff of organizations. The assessors or assessment teams begin by obtaining and reviewing the results from individual component product or compliance assessments. The assessors then determine the additional system-level assessments required to achieve the needed assurance using the procedures and methods contained in this publication and based on the specific implementation information provided by nonfederal organizations in their system security plans. Assessments can be used to compile and evaluate the evidence needed by organizations to determine the effectiveness of the safeguards implemented to protect CUI, the actions needed to mitigate security-related risks, and compliance to the enhanced security requirements.

Assessing Enhanced Security Requirements for Controlled Unclassified Information


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for Security Assessment?

[Assistant]
According to Protecting Controlled Unclassified Information (CUI)_ NIST Special Publication 800-171, Revision 3. Small Business Primer:

| Access Control                    | Maintenance         | Security Assessment and Monitoring   |
|-----------------------------------|---------------------|--------------------------------------|
| Awareness and Training            | Media Protection    | System and Communications Protection |
| Audit and Accountability          | Personnel Security  | System and Information Integrity     |
| Configuration Management          | Physical Protection | Planning                             |
| Identification and Authentication | Risk Assessment     | System and Services Acquisition      |
| Incident Response                 |                     | Supply Chain Risk Management         |

Below is an example of the Incident Response Testing requirement, which is part of the Incident Response (IR) family. The structure and content of a typical security requirement includes:

ODPs support consistent security assessments in determining whether security requirements have been satisfied. If a federal agency or a consortium of agencies do not specify a particular value or range of values for an ODP, nonfederal organizations must assign the value or values to complete the security requirement.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for Access Control?

[Assistant]
According to Protecting Controlled Unclassified Information (CUI)_ NIST Special Publication 800-171, Revision 3. Small Business Primer:

| Access Control                    | Maintenance         | Security Assessment and Monitoring   |
|-----------------------------------|---------------------|--------------------------------------|
| Awareness and Training            | Media Protection    | System and Communications Protection |
| Audit and Accountability          | Personnel Security  | System and Information Integrity     |
| Configuration Management          | Physical Protection | Planning                             |
| Identification and Authentication | Risk Assessment     | System and Services Acquisition      |
| Incident Response                 |                     | Supply Chain Risk Management         |

## Family: Access Control

## Getting Started with Access Control


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 1 require for Maintenance?


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Configuration Management?

[Assistant]
According to Transitioning to the Security Content Automation Protocol (SCAP) Version 2:

architecture; configuration; endpoint; endpoint security; SCAP; security automation; security content automation; Security Content Automation Protocol; software identification; SWID; vulnerability

| 1                                                                                | Introduction ............................................................................................................1   |
|-------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------|
| 2 Gaps in SCAP                                                                                | v1....................................................................................................2                      |
| 3 SCAP                                                                                | v2..................................................................................................................3        |
| 3.1 Design Goals for SCAP v2.............................................................................. | 3                                                                                |
| 3.2 The SCAP v2                                                                                | Architecture.............................................................................. 4                                 |
| 3.3 Adoption of International Standards                                                                                | in SCAP v2 ............................................

Transitioning to the Security Content Automation Protocol (SCAP) Version 2


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 1 require for System and Information Integrity?

[Assistant]
According to Summary Report for “Workshop on Updating Manufacturer Guidance for Securable Connected Product Development”:

The importance of privacy engineering and incorporating technical design requirements was also emphasized. Participants asked for clear, robust examples and informative references within documents to support best practices. Participants also highlighted the need for using an established taxonomy and terminology for consistency and clarity when discussing privacy. Participants also pointed out that a comprehensive understanding of the data processing ecosystem's complexity and interconnectedness is vital for integrating privacy objectives. This includes maintaining confidentiality, integrity, and availability in IoT, and proactively managing privacy risks.

Summary Report for “Workshop on Updating Manufacturer Guidance for Securable Connected Product Development”


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Security and Privacy Controls for Information Systems and Organizations provide? (Part 4)

[Assistant]
infrastructure. ITL develops tests, test methods, reference
data, proof of concept implementations, and technical analyses to advance the development
and productive use of information technology (IT).
ITL’s responsibilities include the development
of management, administrative, technical, and physical standards and guidelines for the cost-
effective security of other than national security-related information in federal information
systems. The Special Publication 800-series reports on ITL’s research, guidelines, and outreach
efforts in information systems security and privacy and its collaborative activities with industry,
government, and academic organizations. Abstract

This publication provides a catalog of security and privacy controls for information systems and
organizations to protect organizational operations and assets, individuals, other organizations,
and the Nation from a diverse set of threats and risks, including hostile attacks, human errors,
natural disasters, structural failures, foreign intelligence entities, and privacy risks. The controls
are flexible and customizable and implemented as part of an organization-wide process to
manage risk. The controls address diverse requirements derived from mission and business
needs, laws, executive orders, directives, regulations, policies, standards, and guidelines. Finally,
the consolidated control catalog addresses security and privacy from a functionality perspective
(i.e., the strength of functions and mechanisms provided by the controls) and from an assurance
perspective (i.e., the measure of confidence in the security or privacy capability provided by the
controls). Addressing functionality and assurance helps to ensure that information technology
products and the systems that rely on those products are sufficiently trustworthy.

Security and Privacy Controls for Information Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AT.L2-3.2.1 (NIST 3.2.1)?

[Assistant]
According to The Federal Cybersecurity Awareness Workforce_ Professional Backgrounds, Knowledge, Skills, and Development Activities:

3.2.1 Job Classifications... 3.2.1 Job Classifications... 3.2.1 Job Classifications...

The Federal Cybersecurity Awareness Workforce_ Professional Backgrounds, Knowledge, Skills, and Development Activities


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 1 require for System and Services Acquisition?

[Assistant]
According to IoT Non-Technical Supporting Capability Core Baseline:

There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may  be  used  by  federal  agencies  even  before  the  completion  of  such  companion  publications. Thus,  until  each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning  and  transition  purposes,  federal  agencies  may  wish  to  closely  follow  the  development  of  these  new publications by NIST. The  Information  Technology  Laboratory  (ITL)  at  the  National  Institute  of  Standards  and Technology  (NIST)  promotes  the  U.S. economy  and  public  welfare  by  providing  technical leadership  for  the  Nation's  measurement  and  standards  infrastructure. ITL  develops  tests,  test methods, reference data, proof of concept implementations, and technical analyses to advance the development  and  productive  use  of  information  technology. ITL's  responsibilities  include  the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in federal information systems.

IoT Non-Technical Supporting Capability Core Baseline


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171 provide? (Part 2)

[Assistant]
systems, but such standards and guidelines shall not apply to national security systems without the express approval of the appropriate federal officials exercising policy authority over such systems.
This guideline is consistent with requirements of the Office of Management and Budget (OMB) Circular A-130. Nothing in this publication should be taken to contradict the standards and guidelines made mandatory and binding on federal agencies by the Secretary of Commerce under statutory authority. Nor should these guidelines be interpreted as altering or superseding the existing authorities of the Secretary of Commerce, OMB Director, or any other federal official. This publication may be used by nongovernmental organizations on a voluntary basis and is not subject to copyright in the United States. Attribution would, however, be appreciated by NIST. National Institute of Standards and Technology Special Publication 800-172 Natl. Inst. Stand. Technol. Spec. Publ. 800-172, 84 pages (February 2021)

CODEN: NSPUE2

This publication is available free of charge from:

https://doi.org/10.6028/NIST.SP.800-172

Certain  commercial  entities,  equipment,  or  materials  may  be  identified  in  this  document  to describe an experimental procedure or concept adequately. Such identification is not intended to imply recommendation or endorsement by NIST, nor is it intended to imply that the entities, materials, or equipment are necessarily the best available for the purpose. There may be references in this publication to other publications currently under development by  NIST  in  accordance  with  its  assigned  statutory  responsibilities. The  information  in  this publication, including concepts, practices, and methodologies, may be used by federal agencies even  before  the  completion  of  such  companion  publications. Thus,  until  each  publication  is completed,  current  requirements,  guidelines,  and  procedures,  where  they  exist,  remain operative.

Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does IoT Non-Technical Supporting Capability Core Baseline provide? (Part 2)

[Assistant]
ory responsibilities. The information in this publication, including concepts and methodologies, may  be  used  by  federal  agencies  even  before  the  completion  of  such  companion  publications.
Thus,  until  each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning  and  transition  purposes,  federal  agencies  may  wish  to  closely  follow  the  development  of  these  new publications by NIST. Organizations are encouraged to review all draft publications during public comment periods and provide feedback to NIST. Many NIST cybersecurity publications, other than the ones noted above, are available at https://csrc.nist.gov/publications. ## Comments on this publication may be submitted to:

National Institute of Standards and Technology Attn: Applied Cybersecurity Division, Information Technology Laboratory 100 Bureau Drive (Mail Stop 2000) Gaithersburg, MD 20899-2000

Email: iotsecurity@nist.gov

All comments are subject to release under the Freedom of Information Act (FOIA). ## Reports on Computer Systems Technology

The  Information  Technology  Laboratory  (ITL)  at  the  National  Institute  of  Standards  and Technology  (NIST)  promotes  the  U.S. economy  and  public  welfare  by  providing  technical leadership  for  the  Nation's  measurement  and  standards  infrastructure. ITL  develops  tests,  test methods, reference data, proof of concept implementations, and technical analyses to advance the development  and  productive  use  of  information  technology. ITL's  responsibilities  include  the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in federal information systems. ## Abstract

Non-technical supporting capabilities are actions a manufacturer or third-party organization performs in support of the cybersecurity of an IoT device.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Information Integrity?

[Assistant]
According to Recommendation for Pair-Wise Key-Establishment Schemes Using Discrete Logarithm Cryptography:

Many  U.S. Government  Information  Technology  (IT)  systems  need  to  employ  wellestablished cryptographic schemes to protect the integrity and confidentiality of the data that they process. Algorithms such as the Advanced Encryption Standard (AES) as defined in Federal  Information  Processing  Standard  (FIPS)  197, 1 and  the  Keyed-Hash  Message Authentication  Code  (HMAC)  as  defined  in  FIPS  198 2 make  attractive  choices  for  the provision of these services. These  algorithms have been standardized to facilitate interoperability  between  systems. However,  the  use  of  these  algorithms  requires  the establishment  of  keying  material  between  the  participating  entities  in  advance. Trusted couriers may manually distribute this secret keying material. However, as the number of entities  using  a  system  grows,  the  work  involved  in  the  distribution  of  the  secret  keying material could grow rapidly. Therefore, it is essential to support the cryptographic algorithms used in modern U.S. Government applications with automated key-establishment schemes. | Algorithm                           | A clearly specified mathematical process for computation; a set of rules that, if followed, will give a prescribed result.

Recommendation for Pair-Wise Key-Establishment Schemes Using Discrete Logarithm Cryptography


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Incident Response?

[Assistant]
According to Guide to Enterprise Patch Management Planning_ Preventive Maintenance for Technology:

er software or systems. A patch could even be compromised. - Unpatchable assets. This is the implementation of isolation or other methods to mitigate the risk of systems that cannot be easily patched.
This is typically required if routine patching is not able to accommodate these systems within a reasonable time frame. Examples of why an asset may be unpatchable include the vendor not providing patches (e.g., asset is at end-of-life, asset does not support updates) or an asset needing to run uninterrupted for an extended period of time because it provides mission-critical functions. Unpatchable assets need to be included in risk response planning because a new vulnerability in an asset might necessitate a change in the methods needed to mitigate its risk.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Configuration Management?

[Assistant]
According to Digital Identity Guidelines_ Identity Proofing and Enrollment:

3.4. General Customer Experience Requirements . . . . . . . . . . . . . . .

4.3.4. Evidence Validation . . . . . . . . . . . . . . . . . . . . . . . .

16. CSPs  MAY  implement fraud mitigation measures as compensating controls.
When this is done, these  SHALL  be documented as deviations from the
normative guidance of these guidelines and  SHALL  be conveyed to all RPs
through a Digital Identity Acceptance Statement (DIAS) prior to integration. See
Sec. 3.4.4 of [SP800-63] for more information about the DIAS.

Digital Identity Guidelines_ Identity Proofing and Enrollment


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Services Acquisition?

[Assistant]
According to Risk Management Framework for Information Systems and Organizations_ A System Life Cycle Approach for Security and Privacy:

ing security and privacy risk that includes information security categorization; control selection, implementation, and assessment; system and common control authorizations; and continuous monitoring.
The RMF includes activities to prepare organizations to execute the framework at appropriate risk management levels. The RMF also promotes near real-time risk management and ongoing information system and common control authorization through the implementation of continuous monitoring processes; provides senior leaders and executives with the necessary information to make efficient, cost-effective, risk management decisions about the systems supporting their missions and business functions; and incorporates security and privacy into the system development life cycle. Executing the RMF tasks links essential risk management processes at the system level to risk management processes at the organization level. In addition, it establishes responsibility and accountability for the controls implemented within an organization's information systems and inherited by those systems.

Risk Management Framework for Information Systems and Organizations_ A System Life Cycle Approach for Security and Privacy


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Contingency Planning Guide for Federal Information Systems provide? (Part 3)

[Assistant]
et (OMB) Circular A-130, Section 8b(3), 'Securing Agency Information Systems,' as analyzed in A-130, Appendix IV: Analysis of Key Sections. Supplemental information is provided in A-130, Appendix III.
This guideline has been prepared for use by federal agencies. It may be used by nongovernmental organizations on a voluntary basis and is not subject to copyright. Attribution would be appreciated by NIST. Nothing in this document should be taken to contradict standards and guidelines made mandatory and binding on federal agencies by the Secretary of Commerce under statutory authority. Nor should these guidelines be interpreted as altering or superseding the existing authorities of the Secretary of Commerce, Director of the OMB, or any other federal official. NIST Special Publication 800-34, Revision 1, 150 pages

(May 2010)

National Institute of Standards and Technology Attn: Computer Security Division, Information Technology Laboratory 100 Bureau Drive (Mail Stop 8930) Gaithersburg, MD 20899-8930

## Compliance with NIST Standards and Guidelines

NIST develops and issues standards, guidelines, and other publications to assist federal agencies in implementing the Federal Information Security Management Act (FISMA) of 2002 and in managing costeffective programs to protect their information and information systems. - Federal Information Processing Standards (FIPS) are developed by NIST in accordance with FISMA. FIPS are approved by the Secretary of Commerce and are compulsory and binding for federal agencies. Since FISMA requires that federal agencies comply with these standards, agencies may not waive their use. - Guidance documents and recommendations are issued in the NIST Special Publication (SP) 800series.

Contingency Planning Guide for Federal Information Systems


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Communications Protection?

[Assistant]
According to Analyzing Collusion Threats in the Semiconductor Supply Chain:

Mean for Your Hardware? Available at https://evernex.com/industry-guide/eol-meaning/
- [9] Vincent J (2018) Chinese spies reportedly inserted microchips into servers used by Apple, Amazon, and others.
Available at https://www.theverge.com/2018/10/4/17935868/-chinese-spies-microchip-hackservers-apple-amazon-supermicro
- [10] Yu S, Liu W, O'Neill M (2019) An improved automatic hardware Trojan generation platform. IEEE Computer Society Annual Symposium on VLSI (ISVLSI) (IEEE, Miami, Florida), pp 302-307. https://doi.org/10.1109/ISVLSI.2019.00062
- [11] Cruz J, Huang Y, Mishra P, Bhunia S (2018) An automated configurable Trojan insertion framework for dynamic trust benchmarks. Design, Automation & Test in Europe Conference & Exhibition (IEEE, Dresden, Germany) pp 1598-1603. https://doi.org/10.23919/DATE.2018.8342270
- [12] Perez TD, Pagliarini S (2023) Hardware Trojan insertion in finalized layouts: From methodology to a silicon demonstration. IEEE Transactions on Computer-Aided Design of Integrated Circuits and Systems (IEEE) 42(7): 2094-2107. https://doi.org/10.1109/TCAD.2022.3223846

Analyzing Collusion Threats in the Semiconductor Supply Chain


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Configuration Management?

[Assistant]
According to Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations:

.......24                         |
| 2.3.2. Level 1 -Enterprise...................................................................................................................27         |
| 2.3.3.
Level 2 -Mission and Business Process....................................................................................30                      |
| 2.3.4. Level 3 -Operational................................................................................................................32           |
| 2.3.5. C-SCRM PMO..............................................................................................................................33       |
| Critical Success Factors...................................................................................................................37           |
| 3. |
| 3.1.2. The Role of C-SCRM in the Acquisition Process .........................................................................40                        |
| 3.4.1. Foundational Practices ...............................................................................................................46         |

Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does IoT Non-Technical Supporting Capability Core Baseline provide? (Part 3)

[Assistant]
ion in federal information systems. ## Abstract

Non-technical supporting capabilities are actions a manufacturer or third-party organization performs in support of the cybersecurity of an IoT device.
This publication defines an Internet of Things (IoT) device manufacturers' non-technical supporting capability core baseline , which is a set of non-technical supporting capabilities generally needed from manufacturers or other third parties to support common cybersecurity controls that protect an organization's devices as well as device data, systems, and ecosystems. The purpose of this publication is to provide organizations a starting point to use in identifying the non-technical supporting capabilities needed in relation to IoT devices they will manufacture, integrate, or acquire. This publication is intended to be used in conjunction with NISTIR 8259, Foundational Cybersecurity Activities for IoT Device Manufacturers and NISTIR 8259A, IoT Device Cybersecurity Capability Core Baseline. ## Keywords

cybersecurity baseline; Internet of Things (IoT); securable computing devices. ## Acknowledgments

The authors wish to thank all contributors to this publication, including the participants in workshops and other interactive sessions; the individuals and organizations from the public and private sectors, including manufacturers from various sectors as well as several manufacturer trade organizations, who provided feedback on the preliminary public content, and colleagues at NIST who offered invaluable inputs and feedback. Special thanks to Cybersecurity for IoT team members Brad Hoehn and David Lemire and the NIST FISMA (Federal Information Security Modernization Act) Implementation Project team for their extensive help. ## Audience

The main audience for this publication is IoT device manufacturers, especially with the emerging role of product security officers. This publication may also help IoT device customers or integrators.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171 provide? (Part 9)

[Assistant]
ework for Improving Critical Infrastructure Cybersecurity [NIST CSF] can find in Appendix C a mapping of the enhanced security requirements in this publication to the security controls in [SP 800-53].
The security control mappings can be useful to organizations that wish to demonstrate compliance to the security requirements in the context of their established information security programs when such programs have been built using the NIST security controls. \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

## Table of Contents

| CHAPTERONE INTRODUCTION...................................................................................................... | CHAPTERONE INTRODUCTION...................................................................................................... |
|--------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------|
| 1.1 PURPOSEANDAPPLICABILITY                                                                                | ................................................................................................... 3                                            |
| 1.2 TARGET AUDIENCE                                                                                | ..................................................................................................................


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Risk Assessment?

[Assistant]
According to Likely Exploited Vulnerabilities_ A Proposed Metric for Vulnerability Exploitation Probability:

A Proposed Metric for Vulnerability Exploitation Probability

Mell P, Spring J (2025) Likely Exploited Vulnerabilities: A Proposed Metric for Vulnerability Exploitation Probability. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Cybersecurity White Paper (CSWP) NIST CSWP 41. https://doi.org/10.6028/NIST.CSWP.41

This work presents a proposed security metric to determine the likelihood that a vulnerability has been observed to be exploited. Only a small fraction of the tens of thousands of software and hardware vulnerabilities that are published every year will be exploited. Predicting which ones is important for the efficiency and cost effectiveness of enterprise vulnerability remediation efforts. Currently, such remediation efforts rely on the Exploit Prediction Scoring System (EPSS), which has known inaccurate values, and Known Exploited Vulnerability (KEV) lists, which may not be comprehensive. The proposed likelihood metric may augment EPSS remediation (correcting some inaccuracies) and KEV lists (enabling measurements of comprehensiveness). However, collaboration with industry is necessary to provide necessary performance measurements.

Likely Exploited Vulnerabilities_ A Proposed Metric for Vulnerability Exploitation Probability


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Information Integrity?

[Assistant]
According to Addressing Visibility Challenges with TLS 1.3 within the Enterprise_ High-Level Document:

(e.g., draft -ietf-netconf-overtls13). | Analytics             | The discipline that applies logic and mathematics to data to provide insights for event recognition and for making response decisions.
In this project, the function is executed by a set of tools for examining unencrypted payloads to identify undesired char acteristics. |
|-----------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Bounded-Lifetime Key  | A key variable that is used within the enterprise for decryption in real time or is stored for a period established by an explicit enterprise policy to enable decryption for post- facto security analytics/forensics purposes and is then destroyed in accordan ce with the policy. |
| Break and Inspect     | A function that taps, decrypts, terminates, and re- encrypts/reinitiates network traffic. |
| Certificate           | A set of data that uniquely identifies a public key (which has a corresponding private key) and an owner that is authorized to use the key pair. The certificate contains the owner's public key and possibly other information and is digitally signed by a certificate authority (i.e., a trusted party), thereby binding the public key to the owner. |
| Certificate Authority | An authorized entity that stores, signs, and issues digital cryptographic key certificates. It acts to validate identities and bind them to cryptographic key pairs with digital certificates.

Addressing Visibility Challenges with TLS 1.3 within the Enterprise_ High-Level Document


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Ascon-Based Lightweight Cryptography Standards for Constrained Devices_ Authenticated Encryption, Hash, and Extendable Output Functions provide? (Part 10)

[Assistant]
. . . . . . . . . . . . . . . . . . . . . . . . . . . . |  30 |
| Figure 9. Mapping between state words, bytes, and bits . . . . . . . . . . . . . . . . . . . . . . . . . . . . . |  35 |
| Figure 10.
Representation of the Ascon state as 64-bit unsigned integers, byte se- quences, and bitstrings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . |  37 |

## Acknowledgments

The authors of the standard express their gratitude to the Ascon designers -Christoph Dobraunig, Maria Eichlseder, Florian Mendel, and Martin Schläffer -for their valuable comments and suggestions during the standardization process. The authors also acknowledge and appreciate contributions from their colleagues at NIST during the selection process, including Lawrence Bassham, Çağdaş Çalık, Deukjo Hong, and Noah Waller. The authors also thank Elaine Barker, Luís T. A. N. Brandão, Lily Chen, Andrew Regenscheid, Noah Ross, Sara Kerman, Yu Long Chen, and Yu Sasaki for their technical and administrative support. ## 1. Introduction

This standard specifies the Ascon family of algorithms to provide Authenticated Encryption with Associated Data (AEAD), a hash function, and two eXtendable Output Functions (XOFs). The Ascon family is designed to be efficient in constrained environments. The algorithms included in this standard are as follows:

1. Ascon-AEAD128 is a nonce-based AEAD scheme, offering 128-bit security strength in the single-key setting. 2. Ascon-Hash256 is a cryptographic hash function that produces a 256-bit hash of the input messages, offering a security strength of 128 bits. 3. Ascon-XOF128 is a XOF, where the output size of the hash of the message can be selected by the user, and the supported security strength is up to 128 bits. 4. Ascon-CXOF128 is a customized XOF that allows users to specify a customization string and choose the output size of the message hash. It supports a security strength of up to 128 bits.

Ascon-Based Lightweight Cryptography Standards for Constrained Devices_ Authenticated Encryption, Hash, and Extendable Output Functions


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Access Control on NoSQL Databases provide? (Part 7)

[Assistant]
..........................................................................................3                                                                                |
| Fig. 2.
Wide-column database model..................................................................................................4                                                                                |
| Fig. 3. Document database model.......................................................................................................5                                                                                |
| Fig. 4. Graph database model.............................................................................................................5                                                                                |
| Fig. 5. Hierarchical structure relationships of the key-value, wide-column, and document models .......8                                                                                |
| Fig. 6. Directed graph relationship structure of the graph model .........................................................9                                                                                |
| Fig. 7. Example of defining subject and object attributes for the key-value model..............................10                                                                                |
| Fig. 8. Example of defining subject and object attributes for wide-column and document models......11                                                                                |
| Fig. 9.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] How does Summary Report for “Workshop on Updating Manufacturer Guidance for Securable Connected Product Development” support CMMC certification?

[Assistant]
According to Summary Report for “Workshop on Updating Manufacturer Guidance for Securable Connected Product Development”:

<!-- image -->

## NIST Interagency Report NIST IR 8562

## Summary Report for ' Workshop on Updating Manufacturer Guidance for Securable Connected Product Development '

Katerina N. Megas Michael Fagan Barbara Cuthill Brad Hoehn Evie Petrella

This publication is available free of charge from:

https://doi.org/10.6028/NIST.IR.8562

<!-- image -->

## NIST Interagency Report NIST IR 8562

## Summary Report for ' Workshop on Updating Manufacturer Guidance for Securable Connected Product Development '

Katerina N. Megas Michael Fagan Barbara Cuthill

Applied Cybersecurity Division Information Technology Laboratory

Brad Hoehn HII

Evie Petrella Electrosoft Services, Inc. This publication is available free of charge from: https://doi.org/10.6028/NIST.IR.8562

April 2025

<!-- image -->

U.S. Department of Commerce Howard Lutnick, Secretary

National Institute of Standards and Technology

Craig S. Burkhardt, Acting NIST Director and Under Secretary of Commerce for Standards and Technology

Certain equipment, instruments, software, or materials, commercial or non-commercial, are identified in this paper in order to specify the experimental procedure adequately. Such identification does not imply recommendation or endorsement of any product or service by NIST, nor does it imply that the materials or equipment identified are necessarily the best available for the purpose. ## NIST Technical Series Policies

Copyright, Use, and Licensing Statements NIST Technical Series Publication Identifier Syntax

## Publication History

Approved by the NIST Editorial Review Board on 2025-03-21

## How to Cite this NIST Technical Series Publication

Megas K, Fagan M, Cuthill B, Hoehn N, and Petrella E  (2025) Summary Report for 'Workshop on Updating Manufacturer Guidance for Securable Connected Product Development' (National Institute of Standards and Technology, Gaithersburg, MD), NIST Interagency or Internal Report (IR) NIST IR 8562.

Audit and Accountability
System and Information Integrity
Security Assessment
Media Protection
Identification and Authentication
Awareness and Training
System and Communications Protection
Access Control
Planning
Incident Response
Risk Assessment
Personnel Security
System and Services Acquisition
Maintenance
Physical Protection
Configuration Management


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Media Protection?

[Assistant]
According to Guide to Auditing for Controls and Security_ A System Development Life Cycle Approach:

| ^ | 3.2.2 | Size of Review Task | Size of Review Task | 49 | |-----------|------------------------------------------------------------------|------------------------------------------------------------------|------------------------------------------------------------------|-----------| | 3.3 | BACKGROUND ON THE METHODOLOGY | BACKGROUND ON THE METHODOLOGY | BACKGROUND ON THE METHODOLOGY | 49 | | | 3.3.1 | The Invitational Workshop | The Invitational Workshop | 49 | | | 3.3.2 | Workshop Points of Agreement | Workshop Points of Agreement | 49 | | 3.4 | AWORK PRIORITY SCHEME FOR THE ADP AUDITOR | AWORK PRIORITY SCHEME FOR THE ADP AUDITOR | AWORK PRIORITY SCHEME FOR THE ADP AUDITOR | 50 | | | 3.4.1 | Assumptions and Caveats | Assumptions and Caveats | 50 | | | 3.4.2 | Audit Planning/Prioritization Process | Audit Planning/Prioritization Process | 51 | | | 3.4.3 | Non-Discretionary Audits | Non-Discretionary Audits | 51 | | | 3.4.4 | Risk Evaluation Levels and Dimensions | Risk Evaluation Levels and Dimensions | 53 | | | 3.4.5 | Two Level Work Priority Dimensions/Characteristics | Two Level Work Priority Dimensions/Characteristics | 54 | | | 3.4.5.1 Level I: | 3.4.5.1 Level I: | 3.4.5.1 Level I: | .....55 | | | 3.4.5.1.1 Mission Impact/Strategic Value/Organization | 3.4.5.1.1 Mission Impact/Strategic Value/Organization

Guide to Auditing for Controls and Security_ A System Development Life Cycle Approach


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Supply Chain Risk Management?

[Assistant]
According to Recommendations for Federal Vulnerability Disclosure Guidelines:

The VDPO should also notify the FCB if a vulnerability is found in an information system, product, or service used by others (e.g., other agencies, organizations, or the general public). Remediating such vulnerabilities typically requires the involvement of the product or service owner (e.g., vendor, supplier, provider) to produce and distribute a patch or update. VDPOs may also notify the product or service owner directly through existing support channels. In turn, the product or service owner should assist stakeholders in dealing with vulnerabilities until a product has reached the end of service. If the product or service owner chooses not to remediate all supported versions, a reasonable upgrade path to a version that has remediations should be provided. |                | Part 1: Overview and Concepts (ISO, Geneva, Switzerland). Available at https://www.iso.org/standard/44378.html                                                                                |
|----------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| [ISOIEC_27035] | International Organization for Standardization/International Electrotechnical Commission (2016) ISO/IEC 27035-1:2016 - Information technology - Security Techniques - Information security incident management - Part 1: Principles of incident management (ISO, Geneva, Switzerland).

Recommendations for Federal Vulnerability Disclosure Guidelines


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Awareness and Training?

[Assistant]
According to Likely Exploited Vulnerabilities_ A Proposed Metric for Vulnerability Exploitation Probability:

The scores are created using a machine learning model trained with several thousand inputs. Training data is provided by a small number of enterprise security monitoring companies, each of which has a large, deployed sensor net to observe exploitation activity for their enterprise customers.

## 3.2. Measurement of the Comprehensiveness of KEV Lists

This is not a mistake or flaw in the EPSS design; the documentation states that this is necessary to create a predictive machine learning model. The EPSS maintainers do use the knowledge of when vulnerabilities are observed to be exploited in training the EPSS model. However, they do not provide such knowledge as input to the model. That data is just used to train the probability output [1].


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Protecting Controlled Unclassified Information (CUI)_ NIST Special Publication 800-171, Revision 3. Small Business Primer provide? (Part 6)

[Assistant]
ents in SP 800-171. If you have questions regarding requirements to protect CUI or other regulatory requirements, please contact your prime contractor and/or federal point of contact for the contract.
|
|----------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| How do I know if I have CUI? | It is the responsibility of the federal agency to ensure that requirements to protect CUI are identified in applicable contracts or agreements, and CUI is marked by the federal agency. |
| How do I get a 'NIST SP 800 -171 Assessment'? | The term 'NIST Assessment' and 'NIST SP 800 - 171 Assessment' is frequently used to describe the Department of Defense (DOD) proce ss used to complete its NIST SP 800-171 Assessment Module through the Supplier Performance Risk System (SPRS). NIST develops the underlying technical guidelines (SP 800-171, SP 800-171A, SP 800-172, and SP 800- 172A) on which the 'NIST Assessment' is based, but NIST does not have a role in DOD's implementation of its programs . For additional guidance on NIST's methodology to plan, prepare for, and conduct security requirement assessments, refer to SP 800-171A. |
| What products, vendors, or solutions are 'NIST SP 800 -171 compliant' or 'CMMC - certified'? | NIST does not identify or track implementation of or compliance with the security requirements.

Protecting Controlled Unclassified Information (CUI)_ NIST Special Publication 800-171, Revision 3. Small Business Primer


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Awareness and Training?

[Assistant]
According to Federal Cybersecurity Role-Based Training Approaches, Successes, and Challenges:

## NIST Special Publication (SP) 1288GLYPH<c=2,font=/BAAAAA+HKGrotesk-SemiBold> FEDERAL CYBERSECURITY ROLE-BASEDGLYPH<c=2,font=/BAAAAA+HKGrotesk-SemiBold> TRAINING APPROACHES, SUCCESSES,GLYPH<c=2,font=/BAAAAA+HKGrotesk-SemiBold> AND CHALLENGESGLYPH<c=2,font=/BAAAAA+HKGrotesk-SemiBold>

## NIST Special Publication (SP) 1288GLYPH<c=2,font=/BAAAAA+HKGrotesk-SemiBold> FEDERAL CYBERSECURITY ROLE-BASEDGLYPH<c=2,font=/BAAAAA+HKGrotesk-SemiBold> TRAINING APPROACHES, SUCCESSES,GLYPH<c=2,font=/BAAAAA+HKGrotesk-SemiBold> AND CHALLENGESGLYPH<c=2,font=/BAAAAA+HKGrotesk-SemiBold>

Haney, JM, Jacobs, JL, Furman, SM (2023) Federal Cybersecurity Role-Based Training Approaches, Successes, and Challenges (National Institute of Standards and Technology Gaithers b urg, MD) NIST Special Publication (SP) 1288. https://doi.org/10.6028/NIST.SP.1288

Federal Cybersecurity Role-Based Training Approaches, Successes, and Challenges


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Incident Response?

[Assistant]
According to Guide to a Secure Enterprise Network Landscape:

- Packet filters and network address translation: Packet filtering and Network address translation (NAT) are used to monitor and control packets moving across a network interface, apply predetermined security rules, and obscure the internal network from the public internet. - Stateful inspection: Stateful firewalling, also known as dynamic packet filtering, monitors the state of connections and makes determinations as to what types of data packets belong to a known active connection and can be allowed to pass through the firewall. - Deep packet inspection (DPI): This feature, also known as packet sniffing, examines the content of packets (both the header and the payload, unlike the stateful inspection that inspects only the packet header). In addition to the capability provided by stateful inspection, this has capabilities related to finding hidden threats within the data stream, such as attempts at data exfiltration, violations of content policies, malware, and more. - Threat detection and response: Modern firewalls can gather and analyze enough data across multiple packets and sessions to detect threats and security incidents targeted at a particular system or a family of systems. These data from multiple firewalls can also be directed toward security information and event management (SIEM) and correlated with data from other security tools and IT systems to detect enterprise-wide attacks that span multiple systems and network layers. In addition, these data can be used to understand evolving threats and define new access rules, attack patterns, and defensive strategies [6]. - Logging and auditing capabilities: Logging and auditing capabilities result in the construction of network events that can be used to identify patterns of performance and security issues. - Access control functions: Access control functions enforce granular sophisticated access control policies.

Guide to a Secure Enterprise Network Landscape


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Communications Protection?

[Assistant]
According to The Federal Cybersecurity Awareness Workforce_ Professional Backgrounds, Knowledge, Skills, and Development Activities:

title that reflects their duties, and they may lack sufficient professional skills (e.g., communications, relationship-building) that are viewed as essential in security awareness roles [SANS][WOELK].
In addition, the lack of understanding that security awareness is a unique discipline may lead to ill-prepared awareness professionals [BADA]. However, it is unclear if these challenges also apply to security awareness professionals in the United States (U.S.) government.

The Federal Cybersecurity Awareness Workforce_ Professional Backgrounds, Knowledge, Skills, and Development Activities


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] How does Profile of the IoT Core Baseline for Consumer IoT Products support CMMC certification?

[Assistant]
According to Profile of the IoT Core Baseline for Consumer IoT Products:

<!-- image -->

## NIST Internal Report NIST IR 8425

## Profile of the IoT Core Baseline for Consumer IoT Products

Michael Fagan Katerina Megas Paul Watrobski Jeffery Marron Barbara Cuthill

This publication is available free of charge from: https://doi.org/10.6028/NIST.IR.8425

<!-- image -->

## NIST Internal Report NIST IR 8425

## Profile of the IoT Core Baseline for Consumer IoT Products

Michael Fagan Katerina N. Megas Paul Watrobski Jeffrey Marron Barbara B. Cuthill

Applied Cybersecurity Division Information Technology Laboratory

This publication is available free of charge from: https://doi.org/10.6028/NIST.IR.8425

September 2022

<!-- image -->

U.S. Department of Commerce Gina M. Raimondo, Secretary

National Institute of Standards and Technology Laurie E. Locascio, NIST Director and Under Secretary of Commerce for Standards and Technology

Certain commercial entities, equipment, or materials may be identified in this document in order to describe an experimental procedure or concept adequately. Such identification is not intended to imply recommendation or endorsement by the National Institute of Standards and Technology (NIST), nor is it intended to imply that the entities, materials, or equipment are necessarily the best available for the purpose. There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may be used by federal agencies even before the completion of such companion publications. Thus, until each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning and transition purposes, federal agencies may wish to closely follow the development of these new publications by NIST. Organizations are encouraged to review all draft publications during public comment periods and provide feedback to NIST.

Profile of the IoT Core Baseline for Consumer IoT Products


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Identification and Authentication?

[Assistant]
According to Ascon-Based Lightweight Cryptography Standards for Constrained Devices_ Authenticated Encryption, Hash, and Extendable Output Functions:

| Notation | Definition | |---------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------| | 𝐾 | 128-bit secret key | | 𝑁 | 128-bit nonce | | 𝐴 | Associated data | | 𝐴 𝑖 | 𝑖 th block of associated data 𝐴 | | 𝑃 | Plaintext | | 𝑃 𝑖 | 𝑖 th block of plaintext 𝑃 | | 𝐶 | Ciphertext | | 𝐶 𝑖 | 𝑖 th block of ciphertext 𝐶 | | 𝑍 | Customization string | | 𝑍 𝑖 | 𝑖 th block of customization string 𝑍 | | 𝑇 | 128-bit authentication tag | | 𝐼𝑉 | 64-bit constant initial value | | fail | Error message to indicate that the verification of authenticated cipher- text failed | | 𝑀 | Message | | 𝑀 𝑖 | 𝑖 th block of message 𝑀 | | 𝐻 | Hash value 𝐻 | | 𝐻 𝑖 | 𝑖 th block of hash value 𝐻 | | S | 320-bit internal state of the underlying permutation | | 𝑆 0 ,…,𝑆 4 | The five 64-bit words of the internal state S , where S = 𝑆 0 ‖ 𝑆 1 ‖ … ‖ 𝑆 4 | | 𝑠 (𝑖,𝑗) | 𝑗 th


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Services Acquisition?

[Assistant]
According to Organizational Views of NIST Cryptographic Standards and Testing and Validation Programs:

Cryptography is an essential component of modern computing. Unfortunately, implementing cryptography correctly is a non-trivial undertaking. Past research studies have supported this observation by revealing a multitude of errors and pitfalls in the cryptographic implementations of software products. However, the emphasis of these studies was on the practices of less-experienced, individual developers. Therefore, there is little understanding of the cryptographic development practices of organizations, including the benefits and challenges of using cryptographic resources such as standards specifications and libraries. To address this gap, a research team led by the National Institute of Standards and Technology (NIST) Information Technology Laboratory Visualization and Usability Group conducted a qualitative investigation into the processes and resources that organizations employ in the development and testing of cryptographic products. The study involved 21 in-depth interviews of 29 participants representing organizations that develop either a security product that uses cryptography or a non-security product that heavily relies on cryptography. This report categorizes and enumerates a subset of findings that document participant comments specific to NIST cryptographic publications and testing/validation programs, with a goal of informing future decisions of NIST and other standards bodies working in this space. cryptography; development; standards; testing; validation

Cryptography is an essential component of modern computing. Unfortunately, implementing cryptography correctly is a non-trivial undertaking. Past research studies have supported this observation by revealing a multitude of errors and developer pitfalls in the cryptographic implementations of software products [1-5]. However, these studies focused on the practices of less-experienced, individual developers.

Organizational Views of NIST Cryptographic Standards and Testing and Validation Programs


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Risk Assessment?

Secure Software Development Framework (SSDF) Version 1.1_ Recommendations for Mitigating the Risk of Software Vulnerabilities


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Organizational Views of NIST Cryptographic Standards and Testing and Validation Programs provide? (Part 2)

[Assistant]
Laboratory Visualization and Usability Group conducted a qualitative investigation into the processes and resources that organizations employ in the development and testing of cryptographic products.
The study involved 21 in-depth interviews of 29 participants representing organizations that develop either a security product that uses cryptography or a non-security product that heavily relies on cryptography. This report categorizes and enumerates a subset of findings that document participant comments specific to NIST cryptographic publications and testing/validation programs, with a goal of informing future decisions of NIST and other standards bodies working in this space. ## Key words

cryptography; development; standards; testing; validation

## Table of Contents

|                                                                                | Introduction ..................................................................................................................... | Introduction ..................................................................................................................... |
|------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
|                                                                                | Background: NIST Cryptographic Standards and Testing/Validation Programs ...


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for Risk Assessment?

[Assistant]
According to Protecting Controlled Unclassified Information (CUI)_ NIST Special Publication 800-171, Revision 3. Small Business Primer:

NIST SP 800-172, Enhanced Security Requirements for Protecting Controlled Unclassified Information provides enhanced security requirements to help protect CUI associated with critical programs or high value assets in nonfederal systems and organizations from the advanced persistent threat (APT). The SP 800-172 enhanced security requirements are designed to protect confidentiality, integrity and availability of information.

| Access Control                    | Maintenance         | Security Assessment and Monitoring   |
|-----------------------------------|---------------------|--------------------------------------|
| Awareness and Training            | Media Protection    | System and Communications Protection |
| Audit and Accountability          | Personnel Security  | System and Information Integrity     |
| Configuration Management          | Physical Protection | Planning                             |
| Identification and Authentication | Risk Assessment     | System and Services Acquisition      |
| Incident Response                 |                     | Supply Chain Risk Management         |

- An understanding of the need for security (why is cybersecurity important to our business mission?).
- Specific actions required of users to maintain security (required use of multi-factor authentication, not sharing passwords, etc.).
- How to respond to confirmed or suspected incidents.
- How to securely handle CUI (training should be provided to staff before authorizing access to the system or CUI).
- How to recognize and report insider threats, social engineering, and social mining.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What guidance does NIST provide for CMMC Level 3?

[Assistant]
According to Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171:

systems, but such standards and guidelines shall not apply to national security systems without the express approval of the appropriate federal officials exercising policy authority over such systems.
This guideline is consistent with requirements of the Office of Management and Budget (OMB) Circular A-130. Nothing in this publication should be taken to contradict the standards and guidelines made mandatory and binding on federal agencies by the Secretary of Commerce under statutory authority. Nor should these guidelines be interpreted as altering or superseding the existing authorities of the Secretary of Commerce, OMB Director, or any other federal official. This publication may be used by nongovernmental organizations on a voluntary basis and is not subject to copyright in the United States. Attribution would, however, be appreciated by NIST. National Institute of Standards and Technology Special Publication 800-172 Natl. Inst. Stand. Technol. Spec. Publ. 800-172, 84 pages (February 2021)

CODEN: NSPUE2

This publication is available free of charge from:

https://doi.org/10.6028/NIST.SP.800-172

Certain  commercial  entities,  equipment,  or  materials  may  be  identified  in  this  document  to describe an experimental procedure or concept adequately. Such identification is not intended to imply recommendation or endorsement by NIST, nor is it intended to imply that the entities, materials, or equipment are necessarily the best available for the purpose. There may be references in this publication to other publications currently under development by  NIST  in  accordance  with  its  assigned  statutory  responsibilities. The  information  in  this publication, including concepts, practices, and methodologies, may be used by federal agencies even  before  the  completion  of  such  companion  publications. Thus,  until  each  publication  is completed,  current  requirements,  guidelines,  and  procedures,  where  they  exist,  remain operative.

Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Approaches and Challenges of Federal Cybersecurity Awareness Programs provide? (Part 8)

[Assistant]
ht that security was a priority for the organization, that security was understood by leadership and employees as important, and that leadership and employees supported the security awareness program.
However, only 35% of survey participants thought the program had been provided adequate funding and staff. Study results can inform federal security awareness professionals, organizational decision makers, policy makers, and guidance developers in their efforts to improve and advocate for federal security awareness programs. The results may also be valuable to security awareness professionals outside of the government who face similar challenges. Additionally, although this study refers to security awareness programs, its focus is not only relevant to awareness but also to security training issues as well. \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

## Table of Contents

| EXECUTIVE SUMMARY......................................................................................................... iii             | EXECUTIVE SUMMARY......................................................................................................... iii                                                                           | EXECUTIVE SUMMARY.........................................................................................................

Approaches and Challenges of Federal Cybersecurity Awareness Programs


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 2 require for Risk Assessment?

[Assistant]
According to Profile of the IoT Core Baseline for Consumer IoT Products:

e not met by IoT product components and why (e.g., the capability is not needed based on risk assessment). - d. Product design and support considerations related to the IoT product, for example :
- i.
All hardware and software components, from all sources (e.g., open source, propriety third-party, internally developed) used to


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What guidance does NIST provide for CMMC Level 3?

[Assistant]
According to Protecting Controlled Unclassified Information (CUI)_ NIST Special Publication 800-171, Revision 3. Small Business Primer:

ent, or possibly with other organizations like municipal governments, prime contractors, universities, etc., you will likely be required to demonstrate you are taking adequate measures to protect CUI.
Examples of CUI include:

<!-- image -->

|                      | When provided as part of a government contract, examples include:                                                                                | Marking 1     |
|----------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------|
| Controlled           | e.g., research and engineering data, engineering drawings, specifications, process sheets, manuals, technical reports, technical orders, catalog-item identifications, data sets, studies and analyses and related information, and computer software executable code and source code. | CUI//SP-CTI   |
| General Proprietary  | e.g., financial information, trade secrets, product research and development, existing and future product designs and performance specifications. | CUI//PROPIN   |
| Business Information | you do not handle CUI, implementing the security requirements in SP 800-171 will                                                                                | help you take |

1  For more information on types of CUI and markings, visit the National Archives and Records Administration (NARA) https://www.archives.gov/cui.