[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Audit and Accountability?

[Assistant]
According to Zero Trust Architecture:

| | | 3.2.2.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 1 require for System and Information Integrity?

[Assistant]
According to IoT Device Cybersecurity Capability Core Baseline:

| 1. The ability to use demonstrably secure cryptographic modules for standardized cryptographic algorithms (e.g., encryption with authentication, cryptographic hashes, digital signature validation) to prevent the confidentiality and integrity of the device's stored and transmitted data from being compromised 2. The ability for authorized entities to render all data on the device inaccessible by all entities, whether previously authorized or not (e.g., through a wipe of internal storage, destruction of cryptographic keys for encrypted data) 3. Configuration settings for use with the Device Configuration capability including, but not limited to, the ability for authorized entities to configure the cryptography use itself, such as choosing a key length | • This capability supports access management, data protection, and incident detection. • Authorized entities (e.g, customers, administrators, users) often want the confidentiality of their data protected so unauthorized entities cannot access their data and misuse it. • Authorized entities often want the integrity of their data protected so it is not inadvertently or intentionally changed, which could have a variety of adverse consequences (e.g., issuing the wrong command to a piece of equipment, concealing malicious activity). | • AGELIGHT : 5, 7, 18, 24, 25, 34 • BITAG : 7.2, 7.10 • CSDE : 5.1.3, 5.1.4, 5.1.5, 5.1.8, 5.1.10 • CTIA : 4.8, 5.14, 5.15 • ENISA : GP-OP-04, GP-TM- 02, GP-TM-04, GP-TM-14, GP-TM-24, GP-TM-32, GP- TM-34, GP-TM-35, GP-TM- 39, GP-TM-40 • ETSI : 4.4-1, 4.5-1, 4.5-2, 4.11-1, 4.11-2, 4.11-3 • GSMA: CLP13_6.4.1.1, 6.11, 6.12.1.1, 6.19, 7.6.1, 8.10.1.1, 8.11.1 • IEC : CR 3.1, CR 3.4, CR 4.1, CR 4.2, CR 4.3 • IIC : 7.3, 7.4, 7.6, 7.7, 8.8, 8.11, 8.13, 9.1, 10.4, 11.9 • IoTSF : 2.4.6.5, 2.4.7, 2.4.8.8, 2.4.8.16, 2.4.9, 2.4.12.2, 2.4.16.1, 2.4.16.2 • ISOC/OTA : 2, 17, 33 • OCF: 8.2, 11.2.1, 11.3, 14.2.2 • PSA: C1.1, C1.4, C2.4, D5.2, R2.2, R2.3, R6.1, R7.1 |

IoT Device Cybersecurity Capability Core Baseline


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AT.L2-3.2.3 (NIST 3.2.3)?

[Assistant]
According to Multi-Factor Authentication for Criminal Justice Information Systems_ Implementation Considerations for Protecting Criminal Justice Information:

3.2.3. 3.2.3.

Multi-Factor Authentication for Criminal Justice Information Systems_ Implementation Considerations for Protecting Criminal Justice Information


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for Personnel Security?

[Assistant]
According to Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171:

............................................ 5                        |
| 2.1 DEVELOPMENTAPPROACH ......................................................................................................
| 5                                                                                |
| 2.2 ORGANIZATIONANDSTRUCTURE                                                                                | ............................................................................................. 7                                                  |
| 2.3 FLEXIBLE APPLICATION                                                                                | ............................................................................................................. 9                                  |
| CHAPTER THREE THE REQUIREMENTS......................................................................................... 11                       | CHAPTER THREE THE REQUIREMENTS......................................................................................... 11                       |
| 3.1 ACCESSCONTROL                                                                                | .................................................................................................................. 12                            |
| 3.2 AWARENESSANDTRAINING                                                                                | ...................................................................................................

Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What guidance does Audit and Evaluation of Computer Security provide?

[Assistant]
A111D3 DflTSbb

NATL INST OF STANDARDS & TfCH R.I.C. A1 11 03089566
NBS Invitational Wor/Aud^ and evaluatio
QC100 .U57 NO.500-19, 1977 C.2 NBS-PUB-O

IMCE & TECHNOLOGY:

UDIT AND EVALUATION
OF COMPUTER SECURITY

iO-19

NBS Special Publication 500-19
U.S. DEPARTMEMT OF COMMERCE
National Bureau of Standards

NATIONAL BUREAU OF STANDARDS

The National Bureau of Standards^ was established by an act of Congress March 3, 1901. The Bureau's overall goal is to
strengthen and advance the Nation's science and technology and facilitate their effective application for public benefit. To this
end, the Bureau conducts research and provides: (1) a basis for the Nation's physical measurement system, (2) scientific and
technological services for industry and government, (3) a technical basis for equity in trade, and (4) technical services to pro-
mote public safety. The Bureau consists of the Institute for Basic Standards, the Institute for Materials Research, the Institute
for Applied Technology, the Institute for Computer Sciences and Technology, the Office for Information Programs, and the
Office of Experimental Technology Incentives Program. THE INSTITUTE FOR BASIC STANDARDS provides the central basis within the United States of a complete and consist-
ent system of physical measurement; coordinates that system with measurement systems of other nations; and furnishes essen-
tial services leading to accurate and uniform physical measurements throughout the Nation's scientific community, industry,
and commerce. The Institute consists of the Office of Measurement Services, and the following center and divisions:

Applied Mathematics — Electricity — Mechanics — Heat — Optical Physics — Center for Radiation Research — Lab-
oratory Astrophysics- — Cryogenics^ — Electromagnetics — Time and Frequency'.

Audit and Evaluation of Computer Security

Audit and Accountability
System and Information Integrity
Security Assessment
Media Protection
Identification and Authentication
Awareness and Training
System and Communications Protection
Access Control
Planning
Incident Response
Risk Assessment
Personnel Security
System and Services Acquisition
Supply Chain Risk Management
Maintenance
Physical Protection
Configuration Management


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Services Acquisition?

[Assistant]
According to Ordered t-way Combinations for Testing State-based Systems:

rd with combinatorial interaction testing. Computer. 2013 Dec 11;47(2):37-45. - [30] Garn  B,  Simos  DE,  Zauner  S,  Kuhn  R,  Kacker  R. Browser fingerprinting using combinatorial sequence testing.
In Proceedings of the 6th Annual Symposium on Hot Topics in the Science of Security 2019 Apr 1 (pp. 1-9). - [31] Ozcan  M. An  Industrial  Study  on  Applications  of Combinatorial  Testing  in  Modern  Web  Development. In2019 IEEE International Conference on Software Testing, Verification and Validation Workshops (ICSTW) 2019 Apr 22 (pp. 210-213). - [32] Ratliff, Z. B. (2018). Black-box Testing Mobile Applications  Using  Sequence  Covering  Arrays. undergraduate thesis, Texas A&M University. - [33] Ratliff ZB, Kuhn DR, Ragsdale DJ. Detecting Vulnerabilities in Android Applications using Event Sequences. In2019 IEEE 19th International Conference on Software Quality, Reliability and Security (QRS) 2019 Jul 22 (pp. 159-166). IEEE. - [34] Elks DC, Deloglos C, Jayakumar A, Tantawy DA, Hite R, Gautham S. Realization Of An Automated T-Way Combinatorial Testing Approach For A Software Based Embedded  Digital  Device. Idaho  National  Lab.(INL),  Idaho Falls, ID (United States); 2019 Jun 17. - [35] Becci G, Dhadyalla G, Mouzakitis A, Marco J, Moore AD. Robustness testing of real-time automotive systems using sequence covering arrays. SAE International Journal of

Ordered t-way Combinations for Testing State-based Systems


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Personnel Security?

[Assistant]
According to Digital Identity Guidelines:

• RPs and CSPs  SHALL  make human support personnel available to intervene and

• RPs and CSPs  SHALL  educate support personnel on issue handling procedures
for the digital identity management system, the avenues for redress, and the
alternatives available to gain access to services.

• RPs and CSPs  SHALL  implement a process for personnel and technologies that
provides support functions to report and address major barriers that end users
face and grievances they may have.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171 provide? (Part 7)

[Assistant]
tegrity, and availability protection. The enhanced security requirements are implemented in addition to the basic and derived requirements since those requirements are not designed to address the APT.
The enhanced security requirements apply to those components of nonfederal systems that process, store, or transmit CUI or that provide protection for such components. There is no expectation that all of the enhanced security requirements will be selected by federal agencies implementing this guidance. The decision to select a particular set of enhanced security requirements will be based on the mission and business needs of federal agencies and guided and informed by ongoing risk assessments. The enhanced security requirements for nonfederal systems processing, storing, or transmitting CUI associated with critical programs or high value assets will be conveyed to nonfederal organizations by federal agencies in a contract, grant, or other agreement. The application of the enhanced security requirements to subcontractors will also be addressed by federal agencies in consultation with nonfederal organizations. \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

## THE APPLICABILITY OF ENHANCED SECURITY REQUIREMENTS

The enhanced security requirements are only applicable to a nonfederal system or nonfederal organization as mandated by a federal agency in a contract, grant, or other agreement. The requirements apply to the components of nonfederal systems that process, store, or transmit CUI associated with a critical program or a high value asset or that provide protection for such components. The requirements also apply to services, including externally provided services, that process, store, or transmit CUI, or that provide security protections, for the system requiring enhanced protection.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice CM.L2-3.4.3 (NIST 3.4.3)?

[Assistant]
According to Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171:

3.4.3e Employ automated discovery and management tools to maintain an up-to-date, complete, accurate, and readily available inventory of system components. 3.4.3. 3.4.3e | Employ automated discovery and management tools to maintain an up-to-date, complete, accurate, and readily available inventory of system components.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for Identification and Authentication?

[Assistant]
According to Protecting Controlled Unclassified Information (CUI)_ NIST Special Publication 800-171, Revision 3. Small Business Primer:

| Access Control                    | Maintenance         | Security Assessment and Monitoring   |
|-----------------------------------|---------------------|--------------------------------------|
| Awareness and Training            | Media Protection    | System and Communications Protection |
| Audit and Accountability          | Personnel Security  | System and Information Integrity     |
| Configuration Management          | Physical Protection | Planning                             |
| Identification and Authentication | Risk Assessment     | System and Services Acquisition      |
| Incident Response                 |                     | Supply Chain Risk Management         |

- View all SP 800-171 Access Control Requirements and Assessment Procedures
- NIST Identity and Access Management Resources

- An understanding of the need for security (why is cybersecurity important to our business mission?).
- Specific actions required of users to maintain security (required use of multi-factor authentication, not sharing passwords, etc.).
- How to respond to confirmed or suspected incidents.
- How to securely handle CUI (training should be provided to staff before authorizing access to the system or CUI).
- How to recognize and report insider threats, social engineering, and social mining.

Protecting Controlled Unclassified Information (CUI)_ NIST Special Publication 800-171, Revision 3. Small Business Primer


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Personnel Security?

[Assistant]
According to Digital Identity Guidelines_ Identity Proofing and Enrollment:

3.9.

4.3.9. Notification of Proofing . . . . . . . . . . . . . . . . . . . . . .

• Visual and tactile inspection by trained personnel for on-site identity proofing

Digital Identity Guidelines_ Identity Proofing and Enrollment


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What guidance does Assessing Enhanced Security Requirements for Controlled Unclassified Information provide?

[Assistant]
## Assessing Enhanced Security Requirements for Controlled Unclassified Information

RON ROSS VICTORIA PILLITTERI KELLEY DEMPSEY

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-172A

<!-- image -->

## NIST Special Publication 800-172A

## Assessing Enhanced Security Requirements for Controlled Unclassified Information

RON ROSS VICTORIA PILLITTERI KELLEY DEMPSEY

Computer Security Division Information Technology Laboratory

This publication is available free of charge from:

https://doi.org/10.6028/NIST.SP.800-172A

March 2022

<!-- image -->

U.S. Department of Commerce Gina M. Raimondo, Secretary

James K. Olthoff, Performing the Non-Exclusive Functions and Duties of the Under Secretary of Commerce for Standards and Technology & Director, National Institute of Standards and Technology

\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

## Authority

This publication has been developed by the National Institute of Standards and Technology (NIST) to further its statutory responsibilities under the Federal Information Security Modernization Act (FISMA), 44 U.S.C. § 3551 et seq. , Public Law (P.L.) 113-283. NIST is responsible for developing information security standards and guidelines, including minimum requirements for federal information systems, but such standards and guidelines shall not apply to national security systems without the express approval of the appropriate federal officials exercising policy authority over such systems. This guideline is consistent with requirements of the Office of Management and Budget (OMB) Circular A-130. Nothing in this publication should be taken to contradict the standards and guidelines made mandatory and binding on federal agencies by the Secretary of Commerce under statutory authority.

Assessing Enhanced Security Requirements for Controlled Unclassified Information


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Secure Software Development Framework (SSDF) Version 1.1_ Recommendations for Mitigating the Risk of Software Vulnerabilities provide? (Part 7)

[Assistant]
ving inputs from a variety of software producers will be particularly helpful to us in refining and revising the SSDF. The publication will be updated periodically to reflect your inputs and feedback.
If you are from a standards-developing organization or another organization that has produced a set of secure practices and you would like to map your secure software development standard or guidance to the SSDF, please contact us at ssdf@nist.gov. We would like to introduce you to the National Online Informative References Program (OLIR) so that you can submit your mapping there to augment the existing set of informative references. ## Patent Disclosure Notice

NOTICE: The Information Technology Laboratory (ITL) has requested that holders of patent claims whose use may be required for compliance with the guidance or requirements of this publication disclose such patent claims to ITL. However, holders of patents are not obligated to respond to ITL calls for patents and ITL has not undertaken a patent search in order to identify which, if any, patents may apply to this publication. As of the date of publication and following call(s) for the identification of patent claims whose use may be required for compliance with the guidance or requirements of this publication, no such patent claims have been identified to ITL. No representation is made or implied by ITL that licenses are not required to avoid patent infringement in the use of this publication. ## Executive Summary

This document describes a set of fundamental, sound practices for secure software development called the Secure Software Development Framework (SSDF). Organizations should integrate the SSDF throughout their existing software development practices, express their secure software development requirements to third-party suppliers using SSDF conventions, and acquire software that meets the practices described in the SSDF.

Secure Software Development Framework (SSDF) Version 1.1_ Recommendations for Mitigating the Risk of Software Vulnerabilities


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Personnel Security?

[Assistant]
According to Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations:

.......24                         |
| 2.3.2. Level 1 -Enterprise...................................................................................................................27         |
| 2.3.3.
Level 2 -Mission and Business Process....................................................................................30                      |
| 2.3.4. Level 3 -Operational................................................................................................................32           |
| 2.3.5. C-SCRM PMO..............................................................................................................................33       |
| Critical Success Factors...................................................................................................................37           |
| 3. |
| 3.1.2. The Role of C-SCRM in the Acquisition Process .........................................................................40                        |
| 3.4.1. Foundational Practices ...............................................................................................................46         |

Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice IR.L2-3.6.1 (NIST 3.6.1)?

[Assistant]
According to Guide to Auditing for Controls and Security_ A System Development Life Cycle Approach:

3.6.1                                                     | Potential Deficiencies                                      | Potential Deficiencies                                      | 88     |
| 4. 3.6.1 Potential Deficiencies - The objective of the review is to determine whether the Initiation Phase contains deficiencies.

Guide to Auditing for Controls and Security_ A System Development Life Cycle Approach


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AT.L2-3.2.5 (NIST 3.2.5)?

[Assistant]
According to Digital Identity Guidelines_ Authentication and Authenticator Management:

3.2.5. 3.2.5) option. 3.2.5) with a non-exportable authentication
key (see Sec.

Digital Identity Guidelines_ Authentication and Authenticator Management


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Planning?

[Assistant]
According to Addressing Visibility Challenges with TLS 1.3 within the Enterprise_ High-Level Document:

|                                                                                | 5.4 Specific Details ........................................................................................................... | 5.4 Specific Details ........................................................................................................... | 5.4 Specific Details ...........................................................................................................

Addressing Visibility Challenges with TLS 1.3 within the Enterprise_ High-Level Document


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Status Report on the First Round of the Additional Digital Signature Schemes for the NIST Post-Quantum Cryptography Standardization Process provide? (Part 5)

[Assistant]
. . . . 2.2. 2.3. Evaluation Criteria . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2.4.
Cost and Performance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2.5. Algorithm and Implementation Characteristics . . . . . . . . . . . . . . . . . 2.6. Selection of the Candidates to Advance to the Second Round . . . . . . . . . 3. Summary of the Second-Round Candidates . . . . . . . . . . . . . . . . . . . . . . . 3.1. CROSS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.2. LESS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.3. HAWK . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.4. Mirath (MIRA/MiRitH)

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.5. MQOM . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.6. PERK . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.7. RYDE . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.8. SDitH . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.9. UOV . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.10. MAYO . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.11. QR-UOV . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.12. SNOVA . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.13. FAEST . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.14. SQIsign . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4. Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . References . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Status Report on the First Round of the Additional Digital Signature Schemes for the NIST Post-Quantum Cryptography Standardization Process


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Recommendations for Federal Vulnerability Disclosure Guidelines provide? (Part 6)

[Assistant]
|
| Federal Vulnerability Disclosure Coordination Body ....................................................
| 6                                                                                |                                                                                |
| Preparation................................................................................................................. | 7                                                                                |                                                                                |
| 2.1.1. Create Source Vulnerability                                                                                | Report Receipt Capability............................................. 7                                                             |                                                                                |
| 2.1.2. Determine Scope and Obtain Contacts .................................................................... | 8                                                                                |                                                                                |
| 2.1.3. Develop Technical Analysis Capability .....................................................................

Recommendations for Federal Vulnerability Disclosure Guidelines


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Cryptographic Module Validation Program (CMVP)-Approved Security Functions_ CMVP Validation Authority Updates to ISO_IEC 24759 provide? (Part 3)

[Assistant]
l official. This publication may be used by nongovernmental organizations on a voluntary basis and is not subject to copyright in the United States. Attribution would, however, be appreciated by NIST.
## NIST Technical Series Policies

Copyright, Use, and Licensing Statements NIST Technical Series Publication Identifier Syntax

## Publication History

Approved by the NIST Editorial Review Board on 2023-03-30 Supersedes NIST Special Publication (SP) 800-140Cr1 (May 2022) https://doi.org/10.6028/NIST.SP.800-140Cr1

## How to Cite this NIST Technical Series Publication:

Calis A (2023) Cryptographic Module Validation Program (CMVP)-Approved Security Functions: CMVP Validation Authority Updates to ISO/IEC 24759. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) NIST SP 800-140Cr2. https://doi.org/10.6028/NIST.SP.800-140Cr2

## Author ORCID iDs

Alexander Calis: 0000-0003-1937-8129

## Contact Information

sp800-140-comments@nist.gov

National Institute of Standards and Technology Attn: Computer Security Division, Information Technology Laboratory 100 Bureau Drive (Mail Stop 8930) Gaithersburg, MD 20899-8930

All comments are subject to release under the Freedom of Information Act (FOIA). ## Abstract

The approved security functions listed in this publication replace the ones listed in International Organization for Standardization/International Electrotechnical Commission (ISO/IEC) 19790 Annex C and ISO/IEC 24759 6.15, within the context of the Cryptographic Module Validation Program (CMVP). As a validation authority, the CMVP may supersede Annex C in its entirety. This document also supersedes SP 800-140Cr1. ## Keywords

Cryptographic Module Validation Program; CMVP; FIPS 140 testing; FIPS 140; ISO/IEC 19790; ISO/IEC 24759; testing requirement; vendor evidence; vendor documentation; security policy.

Cryptographic Module Validation Program (CMVP)-Approved Security Functions_ CMVP Validation Authority Updates to ISO_IEC 24759


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AU.L2-3.3.7 (NIST 3.3.7)?

[Assistant]
According to Audit and Evaluation of Computer Security:

3.3.7 Encryption

Enciphering may be indicated for very sensitive data

that must be passed outside the control of its owner.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Configuration Management?

[Assistant]
According to Guidelines for Media Sanitization:

| Executive Summary............................................................................................................................1      |
|-----------------------------------------------------------------------------------------------------------------------------------------------------|
| 1. Introduction...................................................................................................................................2 |
| 2. Background....................................................................................................................................5  |
| 3. Summary of Sanitization Methods..................................................................................................8               |
| 3.1.1. Clear Sanitization Method............................................................................................................8       |
| 3.1.2. Purge Sanitization Method.........................................................................................................10         |
| 3.1.3. Destroy Sanitization Method......................................................................................................11          |
| 3.2.1. Strength of Cryptography for CE ................................................................................................12           |
| 3.2.2. Applicability of CE.......................................................................................................................13 |
| 3.2.3. Sanitization of Keys ....................................................................................................................13  |
| 3.2.4. Quality of Cryptographic Implementations................................................................................15                   |
| 3.2.5.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Audit and Accountability?

[Assistant]
According to Overview and Considerations of Access Control Based on Attribute Encryption:

In addition to functionalities like revocation, accountability, attribute privacy protection, policy updating, decentralization (multi-authorities), and key hierarchy for practical access control system deployments [ZDXSLZ], the applicable access policy structure for fundamental ABE is restricted to supporting non-monotone and stated policy rules [TKN]. For example, CP-ABE allows data owners to define their own access policies  by attributes and, thus, support complex access control policy structure. However, by only associating attributes, decryption keys are organized logically as a static set. Users can only use all possible combinations of attributes in the set of keys issued to compose their policies, and it has restrictions for specifying policies, attribute managements (e.g., applying environment conditions and dynamic attributes), and the application of deny rules. This may fail to satisfy the enterprise requirements of access control in terms of flexibility and dynamic properties [BS]. However, research has introduced methods to handle the non-monotone restriction [AG, AN, AT, TKN] to address the deny rule issue. The policy issue can be addressed by combining various technologies, such as refreshing user secret keys more frequently, shortening the expiration time interval, or allowing dynamic attributes to be updated closer to real-time. In KP-ABE, the secret key and ciphertext relate to a set of attributes to offer fine-grained access control [BCSES] for which permission evaluation depends only on the resources' attributes. The resource provider (i.e., data owner or encrypted) cannot specify the access policy except by choosing descriptive attributes for permissions. This means that there is no choice but to trust the key issuer. Such accountability for user secret keys provides fine-grained access without flexibility or scalability [BS].

Overview and Considerations of Access Control Based on Attribute Encryption


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Information Integrity?

[Assistant]
According to Guide to Enterprise Patch Management Planning_ Preventive Maintenance for Technology:

installations require administrator privileges, such as installing firmware patches for a system basic input/output system (BIOS). 3 Some patch installations require user participation or cooperation.
- Change software configuration and state. In some cases, making a patch take effect necessitates implementing changes. Examples include restarting patched software, rebooting the operating system or platform on which the patched software runs, redeploying the applications, or altering software configuration settings. In other cases, no such changes are needed. - Resolve any issues. Installing a patch may cause side effects to occur, like inadvertently altering existing security configuration settings or adding new settings, and these side effects can inadvertently create a new security problem while fixing the original one. Patch installation can also cause operational issues that may necessitate uninstalling the patch, reverting to the previous version of the software, or restoring the software or asset from backups.

Guide to Enterprise Patch Management Planning_ Preventive Maintenance for Technology


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Report on the Design-A-Thon_ Designing Effective and Accessible Approaches for Digital Product Cybersecurity Education and Awareness provide? (Part 4)

[Assistant]
oners in these fields, but since the report contains initial findings from a small group exercise, it is not intended as a specific recommendation or guideline for practice. ## Table of Contents

| 1.
Introduction.....................................................................................................................................1                                                                                |
|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| 2. Background......................................................................................................................................2                                                                                |
| 3. Report from the Design-A-Thon .......................................................................................................4                                                                                |
| 4. Designs ............................................................................................................................................6                                                                                |
| 5. Discussion......................................................................................................................................14                                                                                |
| References.........................................................................................................................................16                                                                                |
| Appendix A.

Report on the Design-A-Thon_ Designing Effective and Accessible Approaches for Digital Product Cybersecurity Education and Awareness


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Maintenance?

[Assistant]
According to Likely Exploited Vulnerabilities_ A Proposed Metric for Vulnerability Exploitation Probability:

Additional information about this publication is available at https://csrc.nist.gov/publications/cswp, including related content, potential updates, and document history.

Likely Exploited Vulnerabilities_ A Proposed Metric for Vulnerability Exploitation Probability


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for System and Services Acquisition?

[Assistant]
According to Protecting Controlled Unclassified Information (CUI)_ NIST Special Publication 800-171, Revision 3. Small Business Primer:

ource code. | CUI//SP-CTI   |
| General Proprietary  | e.g., financial information, trade secrets, product research and development, existing and future product designs and performance specifications.
| CUI//PROPIN   |
| Business Information | you do not handle CUI, implementing the security requirements in SP 800-171 will                                                                                | help you take |

| Access Control                    | Maintenance         | Security Assessment and Monitoring   |
|-----------------------------------|---------------------|--------------------------------------|
| Awareness and Training            | Media Protection    | System and Communications Protection |
| Audit and Accountability          | Personnel Security  | System and Information Integrity     |
| Configuration Management          | Physical Protection | Planning                             |
| Identification and Authentication | Risk Assessment     | System and Services Acquisition      |
| Incident Response                 |                     | Supply Chain Risk Management         |


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice CM.L2-3.4.3 (NIST 3.4.3)?

[Assistant]
According to Secure Software Development Framework (SSDF) Version 1.1_ Recommendations for Mitigating the Risk of Software Vulnerabilities:

3.4.3 SP800161 : SA-1, SA-8, SA-15, SR-3 SP800181 : T0414; K0003, K0039, K0044, K0157, K0168, K0177, K0211, K0260, K0261, K0262, K0524; S0010, S0357, S0368; A0033, A0123, A0151                                                                                |
| Define Security Requirements for Software Development (PO.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Risk Assessment?

[Assistant]
According to Guidelines for the Use of PIV Credentials in Facility Access:

..........................................6                     |
| 3. | Threat Environment.............................................................................................................
7           |
| 3.1  | Identifier Collisions .......................................................................................................7              |
| 3.2  | Revoked PIV Cards .......................................................................................................8                  |
| 3.3  | Visual Counterfeiting ....................................................................................................8                 |
| 3.4  | Skimming.......................................................................................................................9            |
| 3.5  | Sniffing ..........................................................................................................................9        |
| 3.6  | Social Engineering.......................................................................................................10                 |
| 3.7  | Electronic Cloning.......................................................................................................10                 |
| 3.8  | Electronic Counterfeiting ............................................................................................10                    |
| 3.9  | Other Threats ...............................................................................................................11             |
| 4. | PIV Authentication Mechanisms in PACS Applications ................................................

Guidelines for the Use of PIV Credentials in Facility Access


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Information Integrity?

[Assistant]
According to Guide to Auditing for Controls and Security_ A System Development Life Cycle Approach:

President's Council on Integrity and Efficiency | ^ | 3.2.2 | Size of Review Task | Size of Review Task | 49 | |-----------|------------------------------------------------------------------|------------------------------------------------------------------|------------------------------------------------------------------|-----------| | 3.3 | BACKGROUND ON THE METHODOLOGY | BACKGROUND ON THE METHODOLOGY | BACKGROUND ON THE METHODOLOGY | 49 | | | 3.3.1 | The Invitational Workshop | The Invitational Workshop | 49 | | | 3.3.2 | Workshop Points of Agreement | Workshop Points of Agreement | 49 | | 3.4 | AWORK PRIORITY SCHEME FOR THE ADP AUDITOR | AWORK PRIORITY SCHEME FOR THE ADP AUDITOR | AWORK PRIORITY SCHEME FOR THE ADP AUDITOR | 50 | | | 3.4.1 | Assumptions and Caveats | Assumptions and Caveats | 50 | | | 3.4.2 | Audit Planning/Prioritization Process | Audit Planning/Prioritization Process | 51 | | | 3.4.3 | Non-Discretionary Audits | Non-Discretionary Audits | 51 | | | 3.4.4 | Risk Evaluation Levels and Dimensions | Risk Evaluation Levels and Dimensions | 53 | | | 3.4.5 | Two Level Work Priority Dimensions/Characteristics | Two Level Work Priority Dimensions/Characteristics | 54 | | | 3.4.5.1 Level I: | 3.4.5.1 Level I: | 3.4.5.1 Level I: | .....55 | | | 3.4.5.1.1 Mission Impact/Strategic


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Personnel Security?

[Assistant]
According to Protecting Information and System Integrity in Industrial Control System Environments_ Cybersecurity for the Manufacturing Sector:

Although the integration of IT and OT networks is helping manufacturers boost productivity and gain efficiencies, it has also provided malicious actors, including nation states, common criminals, and insider threats a fertile landscape where they can exploit cybersecurity vulnerabilities to compromise the integrity of ICS and ICS data to reach their end goal. The motivations behind these attacks can range from degrading manufacturing capabilities to financial gain, and causing reputational harm.

The NCCoE, in conjunction with the NIST EL, collaborated with cybersecurity technology providers to develop and implement example solutions that demonstrate how manufacturing organizations can protect the integrity of their data from destructive malware, insider threats, and unauthorized software within manufacturing environments that rely on ICS.

An organization that is interested in protecting the integrity of a manufacturing system and information from destructive malware, insider threats, and unauthorized software should first conduct a risk assessment and determine the appropriate security capabilities required to mitigate those risks. Once the security capabilities are identified, the sample architecture and solution presented in this document may be used.

Protecting Information and System Integrity in Industrial Control System Environments_ Cybersecurity for the Manufacturing Sector


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AT.L2-3.2.1 (NIST 3.2.1)?

[Assistant]
According to Secure Software Development Framework (SSDF) Version 1.1_ Recommendations for Mitigating the Risk of Software Vulnerabilities:

3.2.1, 3. 3.2.1, 3. 3.2.1, 3.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Risk Assessment?

[Assistant]
According to Digital Identity Guidelines_ Authentication and Authenticator Management:

6. Threats and Security Considerations . . . . . . . . . . . . . . . . . . . . . . .

6.1. Authenticator Threats . . . . . . . . . . . . . . . . . . . . . . . . . . .

Threat Mitigation Strategies . . . . . . . . . . . . . . . . . . . . . . . .


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does NIST Cybersecurity Framework 2.0_ Quick-Start Guide for Cybersecurity Supply Chain Risk Management (C-SCRM) provide? (Part 10)

[Assistant] 1. Scope the Target Profile. Decide which of your supplier criticality levels it will apply to, and determine any other restrictions to be placed on the Profile's scope, such as suppliers of a particular type of product or service only. You can create as many Target Profiles as you need to specify the requirements for all of your suppliers. 2. Select the CSF Categories to include. Identify which CSF Categories and Subcategories correspond to your requirements, and only include those Categories and Subcategories in the Target Profile. 3. Determine what types of information to include in your Target Profile. Target Profiles are flexible and can contain whatever types of information you want to communicate to your suppliers. The notional Profile excerpt below captures each selected Category's and Subcategory's relative priority, the internal practices that the supplier must follow, and references to additional sources of information on achieving the Category and Subcategory. 4. Fill in the columns, and share the Target Profile. Once the contents of the Target Profile have been internally reviewed and finalized, it can be shared with your suppliers as your set of C-SCRM requirements for them.

NIST Cybersecurity Framework 2.0_ Quick-Start Guide for Cybersecurity Supply Chain Risk Management (C-SCRM)


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 1 require for Audit and Accountability?

[Assistant]
According to Summary Report for “Workshop on Updating Manufacturer Guidance for Securable Connected Product Development”:

rs. ' Zombie devices ' are those that no longer receive software support and security updates. Higginbotham noted that unsupportive owners can neglect cybersecurity issues, leading to vulnerabilities.
Herd immunity in cybersecurity requires collective action from manufacturers and consumers. Most consumers are unaware or indifferent to the end of life status of their products, resulting in ' zombie hordes ' . Communicating end of life status and dates is crucial, including proactive notification to consumers, retailers, and third parties. Companies should track devices to address critical vulnerabilities and create structured options for off-ramping zombie devices. Higginbotham emphasized that company priorities often overlook device security. Manufacturers should implement vulnerability disclosure programs, track issues, conduct comprehensive security audits, and allocate budgets for security maintenance. Buyers must keep products updated or segmented, and legislation should clarify responsibility to ensure herd immunity. Companies should have a dedicated point of contact for security researchers and consider recalls for insecure devices. Stacey also addressed secure repairs, both before and after end of life. Good hardware should not end up in landfills, but unpatched zombie devices pose risks. Consumer Reports advocates for designing products for longevity, including features like hardware upgrades, crypto agility, and increased memory.

Summary Report for “Workshop on Updating Manufacturer Guidance for Securable Connected Product Development”


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Access Control?

[Assistant]
According to Proceedings of the Cybersecurity in Cyber-Physical Systems Workshop, April 23-24, 2012:

Some of the threats to wireless IMDs include device reprogramming,  data  extraction,  data  tampering,  repeated  access attempts  and  data  flooding. Vulnerabilities  include  unsecured communication channels, inadequate authentication and access control,  weak  audit  mechanisms  and  meager  storage. The  resulting risks include patient safety compromise resulting from firmware malfunction or therapy misconfiguration, device unavailability due to battery power depletion, patient privacy loss due to data leakage to unauthorized parties, and inappropriate medical follow-up due to tampering of patient readings. While some cyber threats may be unintentional, various motivations exist  for  deliberate  cyber  attacks,  such  as  patient  information gathering, negative impact to patient health status, ego satisfaction of the attacker, as well as gaining competitive advantage over another vendor through negative press. ## C. Authentication and Access Control Mechanisms

For each type of data identified, the authentication and access control mechanisms applicable for extracting or updating the data type need to be reviewed to determine adequacy of the protection  mechanisms  while  balancing  the  needs  of  patient safety in emergency situations and the utility of the IMD within a patient's environment. This is a non-trivial exercise since the security and privacy requirements for IMDs frequently conflict with  the  requirements  stemming  from  emergency  access  to patient  data  and  device  utility  in  hospital  and  home  settings. Creative approaches may be devised to decouple data essential for patient safety in emergency conditions from patient personally identifiable information/data to allow different authentication and access control mechanisms to apply to each group of data.

Proceedings of the Cybersecurity in Cyber-Physical Systems Workshop, April 23-24, 2012


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Maintenance?

[Assistant]
According to Security and Privacy Controls for Information Systems and Organizations:

September 2020
INCLUDES UPDATES AS OF 12-10-2020; SEE PAGE XVII

CHAPTER ONE   INTRODUCTION ...................................................................................................... 1
1.1   PURPOSE AND APPLICABILITY ................................................................................................... 2
1.2   TARGET AUDIENCE .................................................................................................................. 3
1.3   ORGANIZATIONAL RESPONSIBILITIES......................................................................................... 3
1.4   RELATIONSHIP TO OTHER PUBLICATIONS ................................................................................... 5
1.5   REVISIONS AND EXTENSIONS .................................................................................................... 5
1.6   PUBLICATION ORGANIZATION .................................................................................................. 5
CHAPTER TWO   THE FUNDAMENTALS ............................................................................................ 7
2.1   REQUIREMENTS AND CONTROLS .............................................................................................. 7
2.2   CONTROL STRUCTURE AND ORGANIZATION .............................................................................. 8
2.3   CONTROL IMPLEMENTATION APPROACHES ............................................................................. 11
2.4   SECURITY AND PRIVACY CONTROLS ......................................................................................... 13
2.5   TRUSTWORTHINESS AND ASSURANCE ..................................................................................... 14
CHAPTER THREE   THE CONTROLS .................................................................................................

Security and Privacy Controls for Information Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Audit and Evaluation of Computer Security provide? (Part 7)

[Assistant]
ation Processing Guidelines. latter effort will be carried out by a working group convened for this
purpose and will result in a FIPS publication by NBS. These Proceedings are the result of phase one.
Task Group 15

This

The General Chairman and organizer of the Workshop was Robert G. General Accounting Office. McKenzie of the U.S. project on computer security auditing, he initiated and planned the
Workshop and co-edited these Proceedings. Mr. McKenzie is an audit
manager at GAG and has conducted a number of reviews of computer securi-
ty of proposed and on-going systems in the Federal Government. As leader of the TG-15

The General Vice-Chairman of the Workshop was Zella G. Ruthberg of

the National Bureau of Standards. rity audit project, Mrs. Ruthberg worked closely with Mr. McKenzie on
the planning, acted as the Workshop arrangements chairman, and is co-
editor of these Proceedings. in computer science at NBS and most recently has become active in the
managerial procedures required for computer security. She has conducted a wide range of projects

As NBS coordinator of the TG-15 secu-

Mr. S. Jeffery, Chief of the Systems and Software Division of the

Institute for Computer Sciences and Technology of NBS, headed the NBS
Mr. Jeffery has been active in the formulation
staff at the Workshop. of policy concerning the effective utilization of computers within the
Federal Government and is manager of the computer program at NBS. program provided the needed technical and administrative support for
this Workshop. This

I would like to thank all of the particitpants in this Workshop,
the Chairmen and Recorders of the sessions, and the three individuals
named above for the success of the Workshop. from the Workshop and subsequent efforts in this area will have far-
reaching, beneficial effects on the use of computers throughout the
country

The products to be derived

Dennis K.

Audit and Evaluation of Computer Security


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Profile of the IoT Core Baseline for Consumer IoT Products provide? (Part 6)

[Assistant]
IoT Product Capabilities..............................................................................................5                                                                                | 2.2.1. IoT Product Capabilities..............................................................................................5                                                                                |                                                                                |
| 2.2.2. IoT Product                                                                                | 2.2.2.

Profile of the IoT Core Baseline for Consumer IoT Products


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Digital Identity Guidelines provide? (Part 5)

[Assistant]
blication 800-series reports on ITL’s research, guidelines, and outreach efforts in
information system security, and its collaborative activities with industry, government,
and academic organizations.
i

NIST SP 800-63-4
July 2025

Patent Disclosure Notice

Digital Identity Guidelines

NOTICE: ITL has requested that holders of patent claims whose use may be required for
compliance with the guidance or requirements of this publication disclose such patent
claims to ITL. However, holders of patents are not obligated to respond to ITL calls for
patents and ITL has not undertaken a patent search in order to identify which, if any,
patents may apply to this publication. As of the date of publication and following call(s) for the identification of patent claims
whose use may be required for compliance with the guidance or requirements of this
publication, no such patent claims have been identified to ITL. No representation is made or implied by ITL that licenses are not required to avoid
patent infringement in the use of this publication. ii

NIST SP 800-63-4
July 2025

Table of Contents

Digital Identity Guidelines

1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1.1. Scope and Applicability

. . . . . . . . . . . . . . . . . . . . . . . . . . 1.2. How to Use This Suite of SPs . . . . . . . . . . . . . . . . . . . . . . . . 1.3. Enterprise Risk Management Requirements and Considerations . . . . . 1.3.1. Security, Fraud, and Threat Prevention . . . . . . . . . . . . . . 1.3.2. Privacy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1.3.3. Customer Experience . . . . . . . . . . . . . . . . . . . . . . . 1.4. Notations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1.5. Document Structure . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2. Digital Identity Model

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2.1. Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . .


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AC.L2-3.1.1 (NIST 3.1.1)?

[Assistant]
According to Zero Trust Architecture:

3.1.1                                                                                | ZTA basada en una gobernanza de la identidad mejorada... 3.1.1 ZTA basada en una gobernanza de la identidad mejorada

Para desarrollar una ZTA, el enfoque de la gobernanza de la identidad mejorada utiliza la identidad de los actores como el componente clave de la creación de las políticas.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Access Control?

[Assistant]
According to Strategies for the Integration of Software Supply Chain Security in DevSecOps CI_CD Pipelines:

.............................9      |
| 3.1.5. Types of Exploits.........................................................................................................................10   |
| 3.2.1.
Baseline Security ........................................................................................................................11   |
| 3.2.2. Controls for Interacting With SCM Systems...............................................................................12                     |
| 4. CI/CD Pipelines -Background, Security Goals, and Entities to be Trusted .....................................13                                    |
| 5. Integrating SSC Security Into CI/CD Pipelines.................................................................................15                   |
| 5.1.1. Secure Build................................................................................................................................16 |
| 5.1.2. Secure Pull-Push Operations on Repositories............................................................................17                      |
| 5.1.3. Integrity of Evidence Generation During Software Updates......................................................18                               |
| 5.1.4. Secure Code Commits ................................................................................................................19         |

Strategies for the Integration of Software Supply Chain Security in DevSecOps CI_CD Pipelines


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for Incident Response?

[Assistant]
According to Protecting Controlled Unclassified Information (CUI)_ NIST Special Publication 800-171, Revision 3. Small Business Primer:

| Access Control                    | Maintenance         | Security Assessment and Monitoring   |
|-----------------------------------|---------------------|--------------------------------------|
| Awareness and Training            | Media Protection    | System and Communications Protection |
| Audit and Accountability          | Personnel Security  | System and Information Integrity     |
| Configuration Management          | Physical Protection | Planning                             |
| Identification and Authentication | Risk Assessment     | System and Services Acquisition      |
| Incident Response                 |                     | Supply Chain Risk Management         |

Below is an example of the Incident Response Testing requirement, which is part of the Incident Response (IR) family. The structure and content of a typical security requirement includes:

## Family: Incident Response

Protecting Controlled Unclassified Information (CUI)_ NIST Special Publication 800-171, Revision 3. Small Business Primer


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 1 require for Media Protection?

[Assistant]
According to IoT Non-Technical Supporting Capability Core Baseline:

| 1. The ability for the manufacturer and/or supporting entity to receive maintenance and vulnerability information (e.g., bug reporting capabilities and bug bounty programs) from their customers and others in the IoT device ecosystem 2. The ability for the manufacturer and/or supporting entity to respond to customer and third-party queries about cybersecurity of the IoT device (e.g., customer support). | • This capability provides input from customers and others in the IoT device ecosystem for the manufacturer to use in the Information Dissemination and Education and Awareness non- technical supporting capabilities. • Customers and others in the IoT device ecosystem may want, or be required, to report vulnerabilities they identify in an IoT device. • Manufacturers can use reports of common queries and vulnerabilities to identify ways to improve the cybersecurity of the IoT device. • Some customers may need additional support to securely provision and use an IoT device. • Supports the customers' responsibilities related to cybersecurity, such as enabling them to obtain specialized cybersecurity information that may be used proactively for cybersecurity (e.g., threat intelligence and mitigation, digital forensics investigations, and secure reprovisioning and disposal). | • CTA : VUL-002, VUL-003 • AGELIGHT : 9 • ETSI : Provision 5.2-1 • IoTSF : 2.4.3.11, 2.4.3.12 • CSDE : 5.2.1, 5.2.2 |

IoT Non-Technical Supporting Capability Core Baseline


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] How does Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations support CMMC certification?

[Assistant]
According to Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations:

aft publications during public comment periods and provide feedback to NIST. Many NIST cybersecurity publications, other than the ones noted above, are available at https://csrc.nist.gov/publications.
## Authority

This publication has been developed by NIST in accordance with its statutory responsibilities under the Federal Information Security Modernization Act (FISMA) of 2014, 44 U.S.C. § 3551 et seq., Public Law (P.L.) 113-283. NIST is responsible for developing information security standards and guidelines, including minimum requirements for federal information systems, but such standards and guidelines shall not apply to national security systems without the express approval of appropriate federal officials exercising policy authority over such systems. This guideline is consistent with the requirements of the Office of Management and Budget (OMB) Circular A-130. Nothing in this publication should be taken to contradict the standards and guidelines made mandatory and binding on federal agencies by the Secretary of Commerce under statutory authority. Nor should these guidelines be interpreted as altering or superseding the existing authorities of the Secretary of Commerce, Director of the OMB, or any other federal official. This publication may be used by nongovernmental organizations on a voluntary basis and is not subject to copyright in the United States. Attribution would, however, be appreciated by NIST. ## NIST Technical Series Policies

Copyright, Use, and Licensing Statements NIST Technical Series Publication Identifier Syntax

## Publication History

Approved by the NIST Editorial Review Board on 2024-04-23 Supersedes NIST Special Publication 800-171r2 (February 2020; Includes updates as of 01-28-2021) https://doi.org/10.6028/NIST.SP.800-171r2

## How to Cite this NIST Technical Series Publication:

Ross R, Pillitteri V (2024) Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations.

Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Supply Chain Risk Management?

[Assistant]
According to Recommendations for Federal Vulnerability Disclosure Guidelines:

Commission (2016) ISO/IEC 27035-1:2016 - Information technology - Security Techniques - Information security incident management - Part 1: Principles of incident management (ISO, Geneva, Switzerland).
Available at https://www.iso.org/standard/60803.html      |
| [ISOIEC_27036] | International Organization for Standardization/International Electrotechnical Commission (2013) ISO/IEC 27036-3:2013 - Information technology - Security Techniques - Information security for supplier relationships - Part 3: Guidelines for information and communication technology supply chain security (ISO, Geneva,                      |
| [ISOIEC_29147] | Switzerland). Available at https://www.iso.org/standard/59688.html International Organization for Standardization/International Electrotechnical Commission (2018) ISO/IEC 29147:2018 - Information technology - Security techniques - Vulnerability disclosure (ISO, Geneva, Switzerland). Available at https://www.iso.org/standard/72311.html |
| [ISOIEC_30111] | International Organization for Standardization/International Electrotechnical Commission (2019) ISO/IEC 30111:2019 - Information technology - Security techniques - Vulnerability handling processes (ISO, Geneva, Switzerland). Available at https://www.iso.org/standard/69725.html                                                            |
| [NIST_TBF]     | National Institute of Standards and Technology (2021) The Bugs Framework (BF) . Available at https://samate.nist.gov/BF/Home/Approach.html                                                                                |
| [NIST_VULN]    | National Institute of Standards and Technology (2021) Vulnerability Data Ontology .

Recommendations for Federal Vulnerability Disclosure Guidelines


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 2 require for Maintenance?

[Assistant]
According to Profile of the IoT Core Baseline for Consumer IoT Products:

ts related to the IoT product (e.g., price of maintenance) and length and terms of support. - b. All IoT components, including but not limited to the IoT device, that are part of the IoT product. - c.
How the baseline product criteria are met by the IoT product across its product components, including which baseline product criteria are not met by IoT product components and why (e.g., the capability is not needed based on risk assessment). - d. Product design and support considerations related to the IoT product, for example :
- i. All hardware and software components, from all sources (e.g., open source, propriety third-party, internally developed) used to


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Overview and Considerations of Access Control Based on Attribute Encryption provide? (Part 6)

[Assistant]
.....................................11                  |                                                                                |
| 4.
| Attribute-Based Encryption............................................................................................13                    |                                                                                |
| 4.1. | Ciphertext-Policy Attribute-Based Encryption                                                                                | ............................................................13                                                                         |
| 4.2. | Key-Policy Attribute-Based Encryption ......................................................................18                              |                                                                                |
| 5. | ABE System Considerations ..........................................................................................22                      |                                                                                |
| 5.1. | Security .....................................................................................................................22            |                                                                                |
| 5.1.1. | Key Management....................................................................................................22                        |                                                                                |
| 5.1.2.

Overview and Considerations of Access Control Based on Attribute Encryption


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Maintenance?

[Assistant]
According to Cryptographic Module Validation Program (CMVP) Security Policy Requirements_ CMVP Validation Authority Updates to ISO_IEC 24759 and ISO_IEC 19790 Anne:

CMVP Validation Authority Updates to ISO/IEC 24759 and ISO/IEC 19790 Annex B

CMVP Validation Authority Updates to ISO/IEC 24759 and ISO/IEC 19790 Annex B

Hawes D, Calis A, Crombie R (2023) Cryptographic Module Validation Program (CMVP) Security Policy Requirements: CMVP Validation Authority Updates to ISO/IEC 24759 and ISO/IEC 19790 Annex B. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) NIST SP 800-140Br1. https://doi.org/10.6028/NIST.SP.800-140Br1

Cryptographic Module Validation Program (CMVP) Security Policy Requirements_ CMVP Validation Authority Updates to ISO_IEC 24759 and ISO_IEC 19790 Anne


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 2 require for Risk Assessment?

[Assistant]
According to Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations:

......................98      |
| Table 11. Maintenance (MA) ......................................................................................................................98      |
| Table 12.
Media Protection (MP)................................................................................................................99        |
| Table 13. Physical and Environmental Protection (PE)...............................................................................99                    |
| Table 14. Planning (PL)..............................................................................................................................100 |
| Table 15. Program Management (PM) .....................................................................................................100               |
| Table 16. Personnel Security (PS) .............................................................................................................101       |
| Table 17. PII Processing and Transparency (PT) .......................................................................................102                |
| Table 18. Risk Assessment (RA) ................................................................................................................102       |
| Table 19. System and Services Acquisition (SA)........................................................................................103                |
| Table 20. System and Communications Protection (SC)...........................................................................103                        |
| Table 21. System and Information Integrity (SI) .......................................................................................104               |
| Table 22. Supply Chain Risk Management (SR).........................................................................................105                  |
| Table 23.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Services Acquisition?

[Assistant]
According to Status Report on the Fourth Round of the NIST Post-Quantum Cryptography Standardization Process:

There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may be used by federal agencies even before the completion of such companion publications. Thus, until each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning and transition purposes, federal agencies may wish to closely follow the development of these new publications by NIST. The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the Nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology. ITL's responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in federal information systems. The National Institute of Standards and Technology (NIST) initiated the Post-Quantum Cryptography (PQC) Standardization Process in December 2016 to select quantum-resistant public-key cryptographic algorithms for standardization in response to the substantial development and advancement of quantum computing. After three rounds of evaluation and analysis, NIST announced the selection of the first algorithms to be standardized [2]. The key encapsulation mechanism (KEM) selected for standardization was CRYSTALS-Kyber (ML-KEM [3]). The digital signatures selected were CRYSTALS-Dilithium (ML-DSA [4]), Falcon (FN-DSA), and SPHINCS + (SLH-DSA [5]).

Status Report on the Fourth Round of the NIST Post-Quantum Cryptography Standardization Process


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Access Control?

[Assistant]
According to Guide for Developing Security Plans for Federal Information Systems:

In order for the plans to adequately reflect the protection of the resources, a senior management official must authorize a system to operate.  The authorization of a system to process information, granted by a management official, provides an important quality control.  By authorizing processing in a system, the manager accepts its associated risk.

Management authorization should be based on an assessment of management, operational, and technical controls.  Since the system security plan establishes and documents the security controls, it should form the basis for the authorization, supplemented by the assessment report and the plan of actions and milestones.  In addition, a periodic review of controls should also contribute to future authorizations.  Re-authorization should occur whenever there is a significant change in processing, but at least every three years.

- Approves system security plans,
- Authorizes operation of an information system,
- Issues an interim authorization to operate the information system under specific terms and conditions, or
- Denies authorization to operate the information system (or if the system is already operational, halts operations) if unacceptable security risks exist.

Guide for Developing Security Plans for Federal Information Systems


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AT.L2-3.2.1 (NIST 3.2.1)?

[Assistant]
According to Multi-Factor Authentication for Criminal Justice Information Systems_ Implementation Considerations for Protecting Criminal Justice Information:

3.2.1. 3.2.1.

Multi-Factor Authentication for Criminal Justice Information Systems_ Implementation Considerations for Protecting Criminal Justice Information


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What guidance does Summary of NIST SP 800-53, Revision 4_ Security and Privacy Controls for Federal Information Systems and Organizations provide?

[Assistant]
## Summary of NIST SP 800-53 Revision 4, Security and Privacy Controls for Federal Information Systems and Organizations

Kelley Dempsey Computer Security Division Information Technology Laboratory

Greg Witte Doug Rike G2, Inc. Annapolis Junction, MD

February 19, 2014

<!-- image -->

## Abstract

This white paper provides an overview of NIST Special Publication (SP) 800-53 Revision 4, Security and Privacy Controls for Federal Information Systems and Organizations , which was published April 30, 2013. ## Keywords

assurance; computer security; FIPS Publication 199; FIPS Publication 200, FISMA; Privacy Act; Risk Management Framework; security controls; security requirements

## Disclaimer

Any mention of commercial products or reference to commercial organizations is for information only; it does not imply recommendation or endorsement by NIST, nor does it imply that the products mentioned are necessarily the best available for the purpose. ## Additional Information

For additional information on NIST's Computer Security Division programs, projects and publications, visit the Computer Security Resource Center, csrc.nist.gov. Information on other efforts at NIST and in the Information Technology Laboratory (ITL) is available at www.nist.gov and www.nist.gov/itl.

Summary of NIST SP 800-53, Revision 4_ Security and Privacy Controls for Federal Information Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Maintenance?

[Assistant]
According to Proceedings of the Cybersecurity in Cyber-Physical Systems Workshop, April 23-24, 2012:

low the audit logs  through  certain  types  of  attacks  on  the  IMD. Creative techniques for selective overwriting of audit records based on significance of each type of audit record may be useful.
Alert mechanisms when audit log storage space nears depletion may also be useful for alerting the patient or the remote monitoring facility so that appropriate steps can be taken in a timely manner prior to audit space exhaustion.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Strategies for the Integration of Software Supply Chain Security in DevSecOps CI_CD Pipelines provide? (Part 5)

[Assistant]
osure Notice

NOTICE: ITL has requested that holders of patent claims whose use may be required for compliance with the guidance or requirements of this publication disclose such patent claims to ITL.
However, holders of patents are not obligated to respond to ITL calls for patents and ITL has not undertaken a patent search in order to identify which, if any, patents may apply to this publication. As of the date of publication and following call(s) for the identification of patent claims whose use may be required for compliance with the guidance or requirements of this publication, no such patent claims have been identified to ITL. No representation is made or implied by ITL that licenses are not required to avoid patent infringement in the use of this publication. ## Table of Contents

| Executive Summary............................................................................................................................1        |
|-------------------------------------------------------------------------------------------------------------------------------------------------------|
| 1. Introduction...................................................................................................................................2   |
| 2. Software Supply Chain (SSC) -Definition and Model .....................................................................4                           |
| 2.4.1. Software Supply Chain Defects ....................................................................................................6            |
| 2.4.2. Software Supply Chain Attacks.....................................................................................................6            |
| SSC Security -Risk Factors and Mitigation Measures .....................................................................8                             |
| 3. |
| 3.1.1.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Services Acquisition?

[Assistant]
According to Guide to Enterprise Patch Management Planning_ Preventive Maintenance for Technology:

There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may  be  used  by  federal  agencies  even  before  the  completion  of  such  companion  publications. Thus,  until  each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning  and  transition  purposes,  federal  agencies  may  wish  to  closely  follow  the  development  of  these  new publications by NIST. The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the Nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology. ITL's responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in federal information systems. The Special Publication 800-series reports on ITL's research, guidelines, and outreach efforts in information system security, and its collaborative activities with industry, government, and academic organizations. - Prioritize the patch. A patch may be a higher priority to deploy than others because its deployment would reduce cybersecurity risk more than other patches would. Another patch may be a lower priority because it addresses a low-risk vulnerability on a small number of low-importance assets. - Schedule patch deployment. Many organizations schedule patch deployments as part of their enterprise change management activities. - Acquire the patch.

Guide to Enterprise Patch Management Planning_ Preventive Maintenance for Technology


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Media Protection?

[Assistant]
According to Security and Privacy Controls for Information Systems and Organizations:

CHAPTER ONE   INTRODUCTION ...................................................................................................... 1
1.1   PURPOSE AND APPLICABILITY ................................................................................................... 2
1.2   TARGET AUDIENCE .................................................................................................................. 3
1.3   ORGANIZATIONAL RESPONSIBILITIES......................................................................................... 3
1.4   RELATIONSHIP TO OTHER PUBLICATIONS ................................................................................... 5
1.5   REVISIONS AND EXTENSIONS .................................................................................................... 5
1.6   PUBLICATION ORGANIZATION .................................................................................................. 5
CHAPTER TWO   THE FUNDAMENTALS ............................................................................................ 7
2.1   REQUIREMENTS AND CONTROLS .............................................................................................. 7
2.2   CONTROL STRUCTURE AND ORGANIZATION .............................................................................. 8
2.3   CONTROL IMPLEMENTATION APPROACHES ............................................................................. 11
2.4   SECURITY AND PRIVACY CONTROLS ......................................................................................... 13
2.5   TRUSTWORTHINESS AND ASSURANCE ..................................................................................... 14
CHAPTER THREE   THE CONTROLS ................................................................................................. 16
3.1   ACCESS CONTROL ..................................................................................................................