[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Awareness and Training?

[Assistant]
According to Protecting Information and System Integrity in Industrial Control System Environments_ Cybersecurity for the Manufacturing Sector:

The security capabilities of the example solution are mapped to the NIST Cybersecurity Framework , the National Initiative for Cybersecurity Education Framework , and NIST Special Publication 800-53 . | D.2.2.1   | Configuration.......................................................................................................... |   18 |
|-----------|---------------------------------------------------------------------------------------------------------------------------|------|
| D.2.2.2   | Test Results............................................................................................................. |   18 |
| D.2.3     | Build 3 .............................................................................................................. |   24 |
| D.2.3.1   | Configuration.......................................................................................................... |   24 |
| D.2.3.2   | Test Results............................................................................................................. |   24 |
| D.2.4     | Build 4 .............................................................................................................. |   28 |
| D.2.4.1   | Configuration.......................................................................................................... |   28 |
| D.2.4.2   | Test Results............................................................................................................. |   28 |
| D.3.1     | Build 1 .............................................................................................................. |   33 |
| D.3.1.1   | Configuration.......................................................................................................... |   33 |
| D.3.1.2   | Test Results.............................................................................................................

Protecting Information and System Integrity in Industrial Control System Environments_ Cybersecurity for the Manufacturing Sector


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Services Acquisition?

[Assistant]
According to Validating the Integrity of Computing Devices:

Organizations currently lack the ability to cost effectively distinguish trustworthy products from others, meaning they are genuine and have not been inappropriately altered. Having this ability is a critical foundation of cyber supply chain risk management (C-SCRM). C-SCRM is the process of identifying, assessing, and mitigating risks associated with the distributed and interconnected nature of supply chains. C-SCRM presents challenges to many industries and sectors, requiring a coordinated set of technical and procedural controls to mitigate risks throughout the design, manufacturing, acquisition, provisioning, operations, and decommissioning stages of a product's life.

The authoritative source of information regarding the provenance and integrity of the components provides a strong basis for trust in a computing device. Hardware roots of trust are the foundation upon which the computing system's trust model is built, forming the basis in hardware for providing one or more security-specific functions for the system. Incorporating hardware roots of trust into acquisition and lifecycle management processes enables organizations to achieve better visibility into supply chain attacks and to detect advanced persistent threats and other attacks. By leveraging hardware roots of trust capabilities as a computing device traverses the supply chain, we can maintain trust in the computing device throughout its operational lifecycle.

Collaborators participating in this project submitted their capabilities in response to an open call in the Federal Register for all sources of relevant security capabilities from academia and industry (vendors and integrators). Those respondents with relevant capabilities or product components signed a Cooperative Research and Development Agreement (CRADA) to collaborate with NIST in a consortium to build this example solution.

Validating the Integrity of Computing Devices


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Cryptographic Module Validation Program (CMVP)-Approved Sensitive Security Parameter Generation and Establishment Methods_ CMVP Validation Authority U provide? (Part 4)

[Assistant]
6.16, within the context of the Cryptographic Module Validation Program (CMVP). As a validation authority, the CMVP may supersede Annex D in its entirety. This document also supersedes SP 800-140Dr1.
## Keywords

Cryptographic Module Validation Program; CMVP; FIPS 140 testing; FIPS 140-3; ISO/IEC 19790; ISO/IEC 24759; sensitive security parameter establishment methods; sensitive security parameter generation; testing requirement; vendor evidence; vendor documentation. ## Reports on Computer Systems Technology

The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the Nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology. ITL's responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in federal information systems. The Special Publication 800-series reports on ITL's research, guidelines, and outreach efforts in information system security, and its collaborative activities with industry, government, and academic organizations. ## Supplemental Content

See https://csrc.nist.gov/projects/cmvp/sp800-140-series-info for details about the SP 800-140x series publications and their relationships to ISO/IEC 19790 and ISO/IEC 24759. ## Audience

This document is intended for use by vendors, testing labs, and the CMVP.

Cryptographic Module Validation Program (CMVP)-Approved Sensitive Security Parameter Generation and Establishment Methods_ CMVP Validation Authority U

Audit and Accountability
System and Information Integrity
Security Assessment
Media Protection
Identification and Authentication
Awareness and Training
System and Communications Protection
Access Control
Planning
Incident Response
Risk Assessment
Personnel Security
System and Services Acquisition
Supply Chain Risk Management
Maintenance
Physical Protection
Configuration Management


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Federal Cybersecurity Role-Based Training Approaches, Successes, and Challenges provide? (Part 10)

[Assistant]
activities are implemented in the U.S. Federal Government, we conducted a study to answer the following questions:

- Q1. How do federal organizations determine which employees need to take RBT? - Q2.
How is RBT content obtained? - Q3. What approaches do federal organizations take in their RBT activities? - Q4. How do organizations determine the effectiveness of their RBT activities? - Q5. How do organizations approach compliance to government RBT mandates? - Q6. How well are RBT activities supported within organizations? - Q7. How do organizations determine the effectiveness of RBT? - Q8. What challenges do organizations face in implementing RBT activities? ## Our study results can serve as a resource for RBT implementers, organizational decision makers, guidance developers, and policy makers. This report documenting our study results can serve as a resource for federal professionals responsible for implementing, overseeing, or enacting policies related to RBT activities. In addition, our study is informing the update to NIST SP 800-50 Building a Cybersecurity and Privacy Learning Program , which will provide guidance to federal organizations. The report may also be valuable to organizations outside the U.S. Federal Government that implement similar training programs. ## METHODOLOGYGLYPH<c=2,font=/BAAAAA+HKGrotesk-Bold>

To gain a better understanding of RBT approaches and challenges within the government, it was important to hear directly from government employees who were responsible for implementing RBT activities within their organization as well as managers who oversaw those activities. Therefore, we conducted a two-phased study consisting of focus groups and a survey that allowed these professionals to tell us about their experiences. This report synthesizes the results from both the focus groups and survey. ## Focus groups provided important insights into role-based training challenges within organizations.

Federal Cybersecurity Role-Based Training Approaches, Successes, and Challenges


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Contingency Planning Guide for Federal Information Systems provide? (Part 9)

[Assistant] Information System Contingency Planning Process................................13                                | Chapter 3. Information System Contingency Planning Process................................13                                                                                | Chapter 3. Information System Contingency Planning Process................................13                                                                                | Chapter 3.

Contingency Planning Guide for Federal Information Systems


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 1 require for Supply Chain Risk Management?

IoT Non-Technical Supporting Capability Core Baseline


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 2 require for Configuration Management?

[Assistant]
According to Assessing Security Requirements for Controlled Unclassified Information:

| Access Control                    | Maintenance         | Security Assessment and Monitoring   |
|-----------------------------------|---------------------|--------------------------------------|
| Awareness and Training            | Media Protection    | System and Communications Protection |
| Audit and Accountability          | Personnel Security  | System and Information Integrity     |
| Configuration Management          | Physical Protection | Planning                             |
| Identification and Authentication | Risk Assessment     | System and Services Acquisition      |
| Incident Response                 |                     | Supply Chain Risk Management         |

[SELECT FROM: access control policy and procedures; procedures for least privilege; list of system-generated privileged accounts; list of system administration personnel; system audit records; system configuration settings; system security plan; list of system-generated security functions or security-relevant information assigned to system accounts or roles; other relevant documents or records]

For example, many technical security requirements are satisfied by security capabilities that are examine the security functions of products and established configuration settings. Assessments built into commercial information technology products and systems. Product assessments are typically conducted by independent, third-party testing organizations. 5 These assessments can also be conducted to demonstrate compliance with industry, national, or international security standards as well as developer and vendor claims. Since many information technology

Assessing Security Requirements for Controlled Unclassified Information


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice CM.L2-3.4.2 (NIST 3.4.2)?

[Assistant]
According to Data Integrity_ Detecting and Responding to Ransomware and Other Destructive Events:

3.4.2 Security Control Map... 3.4.2, Security Control Map, maps the security characteristics of this example solution to cybersecurity standards and best practices. 3.4.2 Security Control Map

As explained in Section 3.

Data Integrity_ Detecting and Responding to Ransomware and Other Destructive Events


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for Configuration Management?

[Assistant]
According to Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171:

| CHAPTERONE INTRODUCTION...................................................................................................... | CHAPTERONE INTRODUCTION...................................................................................................... |
|--------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------|
| 1.1 PURPOSEANDAPPLICABILITY                                                                                | ................................................................................................... 3                                            |
| 1.2 TARGET AUDIENCE                                                                                | .................................................................................................................. 4                             |
| 1.3 ORGANIZATIONOF THIS SPECIAL PUBLICATION                                                                                | .......................................................................... 4                                                                     |
| CHAPTERTWO THE FUNDAMENTALS............................................................................................ 5                        | CHAPTERTWO THE FUNDAMENTALS............................................................................................ 5                        |
| 2.1 DEVELOPMENTAPPROACH ......................................................................................................

Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Physical Protection?

[Assistant]
According to Control Baselines for Information Systems and Organizations:

........................................................ 1               | CHAPTERONE INTRODUCTION......................................................................................................
1   |
|-----------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------|
| 1.1                                                                                | PURPOSEANDAPPLICABILITY ................................................................................................... | 1                                                                                |
| 1.2                                                                                | TARGET AUDIENCE .................................................................................................................. | 2                                                                                |
| 1.3                                                                                | ORGANIZATIONAL RESPONSIBILITIES .........................................................................................

Control Baselines for Information Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Access Control?

[Assistant]
According to Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule_ A Cybersecurity Resource Guide:

| Executive Summary............................................................................................................................1      |
|-----------------------------------------------------------------------------------------------------------------------------------------------------|
| 1. Introduction...................................................................................................................................4 |
| 2. HIPAA Security Rule .......................................................................................................................9     |
| 3. Risk Assessment Guidance............................................................................................................14           |
| 4. Risk Management Guidance .........................................................................................................24             |
| 5. Considerations When Implementing the HIPAA Security Rule........................................................28                               |
| 5.1.2. Assigned Security Responsibility (§ 164.308(a)(2)) ....................................................................35                    |
| 5.1.3. Workforce Security (§ 164.308(a)(3)).........................................................................................36              |
| 5.1.4. Information Access Management (§ 164.308(a)(4)) ..................................................................38                         |
| 5.1.5. Security Awareness and Training (§ 164.308(a)(5)) ...................................................................41                      |
| 5.1.6. Security Incident Procedures (§ 164.308(a)(6)) .........................................................................44                   |
| 5.1.7. Contingency Plan (§ 164.308(a)(7))............................................................................................47             |
| 5.1.8.

Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule_ A Cybersecurity Resource Guide


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AT.L2-3.2.5 (NIST 3.2.5)?

[Assistant]
According to Secure Software Development Framework (SSDF) Version 1.1_ Recommendations for Mitigating the Risk of Software Vulnerabilities:

3.2.5, 3. 3.2.5, 3.

Secure Software Development Framework (SSDF) Version 1.1_ Recommendations for Mitigating the Risk of Software Vulnerabilities


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Audit and Accountability?

[Assistant]
According to Incident Response Recommendations and Considerations for Cybersecurity Risk Management_ A CSF 2.0 Community Profile:

| CSF Element                                      | CSF Element Description                                                                                | Priority   | Recommendations, Considerations, Notes making on when to escalate or elevate incident response activities.

Incident Response Recommendations and Considerations for Cybersecurity Risk Management_ A CSF 2.0 Community Profile


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Maintenance?

[Assistant]
According to Recommendations for Federal Vulnerability Disclosure Guidelines:

Each FCB member should develop the ability to receive source vulnerability reports from reporters, maintain a database of received reports, and engage in secure communications (e.g., using a report tracking system). 2 The expectation for communication with the reporter should be established, including the initial acknowledgment, status updates, and agreed-upon method of communication. The actual receipt of a source vulnerability report may take multiple forms (e.g., email, web forms, or a phone hotline) and should be stated in a public policy. It is also

After the vulnerability remediation release, monitoring of the stability of the product or service should continue. The responsible VDPO should update remediations as appropriate until further updates are no longer needed. The information gained during the root cause analysis should be used to update development life cycle elements to prevent similar vulnerabilities in new or updated products or services.

Person or organization responsible for the development, procurement, integration, modification, operation, maintenance, and/or final disposition of an information system.

Recommendations for Federal Vulnerability Disclosure Guidelines


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AT.L2-3.2.3 (NIST 3.2.3)?

[Assistant]
According to Recommendation for Pair-Wise Key-Establishment Using Integer Factorization Cryptography:

3.2.3 rsakpg2-crt ... 3.2.3 rsakpg2-crt

rsakpg2-crt is the generator in the RSAKPG2 family such that the private key is in the Chinese Remainder Theorem format ( n , e , d , p , q , dP , dQ , qInv ).

Recommendation for Pair-Wise Key-Establishment Using Integer Factorization Cryptography


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Incident Response?

[Assistant]
According to Protecting Information and System Integrity in Industrial Control System Environments_ Cybersecurity for the Manufacturing Sector:

-  detect and prevent unauthorized software installation
-  protect ICS networks from potentially harmful applications
-  determine changes made to a network using change management tools
-  detect unauthorized use of systems
-  continuously monitor network traffic
-  leverage anti-malware tools

The NCCoE, in conjunction with the NIST EL, collaborated with cybersecurity technology providers to develop and implement example solutions that demonstrate how manufacturing organizations can protect the integrity of their data from destructive malware, insider threats, and unauthorized software within manufacturing environments that rely on ICS.

An organization that is interested in protecting the integrity of a manufacturing system and information from destructive malware, insider threats, and unauthorized software should first conduct a risk assessment and determine the appropriate security capabilities required to mitigate those risks. Once the security capabilities are identified, the sample architecture and solution presented in this document may be used.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 2 require for Risk Assessment?

[Assistant]
According to Assessing Security Requirements for Controlled Unclassified Information:

The purpose of this publication is to provide procedures for assessing the security requirements in NIST Special Publication (SP) 800-171, Protecting Controlled Unclassified Information (CUI) in Nonfederal Systems and Organizations [3]. Organizations can use the assessment procedures to generate evidence that the security requirements have been satisfied. The scope of the security assessments conducted using the procedures described in this publication is guided and informed by the system security plans for systems that process, store, or transmit CUI. The assessment procedures offer the flexibility to customize assessments based on organizational policies and requirements, known threat and vulnerability information, system and platform dependencies, operational considerations, and tolerance for risk. 1

| Access Control                    | Maintenance         | Security Assessment and Monitoring   |
|-----------------------------------|---------------------|--------------------------------------|
| Awareness and Training            | Media Protection    | System and Communications Protection |
| Audit and Accountability          | Personnel Security  | System and Information Integrity     |
| Configuration Management          | Physical Protection | Planning                             |
| Identification and Authentication | Risk Assessment     | System and Services Acquisition      |
| Incident Response                 |                     | Supply Chain Risk Management         |

A.03.02.01.a.03[01]: security literacy training is provided to system users on recognizing indicators of insider threat.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Communications Protection?

[Assistant]
According to Contingency Planning Guide for Federal Information Systems:

| Chapter 1.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Communications Protection?

[Assistant]
According to Control Baselines for Information Systems and Organizations:

| ORGANIZATIONAL RESPONSIBILITIES .........................................................................................
| 2                                                                                |
| 1.4                                                                                | RELATIONSHIPTOOTHERPUBLICATIONS ................................................................................... | 3                                                                                |
| 1.5                                                                                | REVISIONSANDEXTENSIONS .................................................................................................... | 3                                                                                |
| 1.6                                                                                | PUBLICATIONORGANIZATION .................................................................................................. | 3                                                                                |
| CHAPTERTWO THE FUNDAMENTALS............................................................................................ 5                     | CHAPTERTWO THE FUNDAMENTALS............................................................................................ 5                     | CHAPTERTWO THE FUNDAMENTALS............................................................................................


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Guidelines on Mobile Device Forensics provide? (Part 2)

[Assistant]
esources . Nothing in this publication should be taken to contradict the standards and guidelines made mandatory and binding on Federal agencies by the Secretary of Commerce under statutory authority.
Nor should these guidelines be interpreted as altering or superseding the existing authorities of the Secretary of Commerce, Director of the OMB, or any other Federal official. This publication may be used by nongovernmental organizations on a voluntary basis and is not subject to copyright in the United States. Attribution would, however, be appreciated by NIST. National Institute of Standards and Technology Special Publication 800-101r1 Natl. Inst. Stand. Technol. Spec. Publ. 800-101 Revision 1, 87 pages (May 2014) http://dx.doi.org/10.6028/NIST.SP. 800-101r1 CODEN: NSPUE2

Certain commercial entities, equipment, or materials may be identified in this document in order to describe an experimental procedure or concept adequately. Such identification is not intended to imply recommendation or endorsement by NIST, nor is it intended to imply that the entities, materials, or equipment are necessarily the best available for the purpose. There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may be used by Federal agencies even before the completion of such companion publications. Thus, until each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning and transition purposes, Federal agencies may wish to closely follow the development of these new publications by NIST. Organizations are encouraged to review all draft publications during public comment periods and provide feedback to NIST. All NIST Computer Security Division publications, other than the ones noted above, are available at http://csrc.nist.gov/publications.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Risk Assessment?

[Assistant]
According to Assessing Security and Privacy Controls in Information Systems and Organizations:

SP 800-53A provides a process that allows organizations to tailor the assessment procedures
outlined in the guidance. Tailoring involves customizing the assessment procedures to match
the characteristics of the system and its environment of operation more closely. The tailoring
process described in this guidance gives organizations the flexibility needed to avoid assessment
approaches that are unnecessarily complex or costly while simultaneously meeting the
assessment requirements and risk management principles established in the RMF. Tailoring
decisions are left to the discretion of the organization to maximize flexibility in developing
assessment plans – applying the results of risk assessments to determine the extent, rigor, and
level of intensity of the assessments needed to provide sufficient assurance about the security
and privacy posture of the system. CHAPTER ONE INTRODUCTION ............................................................................................................... 1
1.1   PURPOSE AND APPLICABILITY .......................................................................................................... 1
1.2   TARGET AUDIENCE ............................................................................................................................ 4
1.3   RELATED PUBLICATIONS AND ASSESSMENT PROCESSES ............................................................... 4
1.4   ORGANIZATION OF THIS PUBLICATION ........................................................................................... 5
CHAPTER TWO THE FUNDAMENTALS ..................................................................................................... 6
2.1   ASSESSMENTS WITHIN THE SYSTEM DEVELOPMENT LIFE CYCLE .................................................. 6
2.2   CONTROL STRUCTURE AND ORGANIZATION ..................................................................................

Assessing Security and Privacy Controls in Information Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Awareness and Training?

[Assistant]
According to Data Integrity_ Detecting and Responding to Ransomware and Other Destructive Events:

## 5.3.2.1 Scenario

## 5.3.2.2 Resolution

## 5.3.2.3 Other Considerations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Summary of NIST SP 800-53, Revision 4_ Security and Privacy Controls for Federal Information Systems and Organizations provide? (Part 4)

[Assistant]
additional controls to protect the system may also increase accordingly. SP 800-53 Revision 4 provides the security control baselines as the starting point for the security control selection process.
The baselines are chosen based on the security category and associated impact level of information systems as described in Federal Information Processing Standard Publication (FIPS) 199, Standards for Security Categorization of Federal Information and Information Systems, and FIPS Publication 200, Minimum Security Requirements for Federal Information and Information Systems . A separate guideline, SP 800-53A, Guide for Assessing the Security Controls in Federal Information Systems and Organizations, provides specific guidelines that facilitate periodic assessment of security controls to ensure that controls have been implemented correctly, are operating as intended, and are meeting the organization's security requirements. ## 2 NIST SP 800-53 Revision 4 and the Risk Management Framework (RMF)

NIST SP 800-39, Managing Information Security Risk , defines risk management as 'the program and supporting processes to manage information security risk to organizational operations (including mission, functions, and reputation), organizational assets, individuals, other organizations, and the Nation'. To integrate the risk management process throughout an organization and to address its mission and business concerns, a three-tiered approach is employed. The process is carried out across three tiers with the objective of continuous improvement in the organization's risk-related activities, with effective communication among tiers and stakeholders. Figure 1 illustrates the three-tiered approach to risk management.

Summary of NIST SP 800-53, Revision 4_ Security and Privacy Controls for Federal Information Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Access Control?

[Assistant]
According to Analyzing Collusion Threats in the Semiconductor Supply Chain:

## 3.1. Identify the Intent of the Adversary

Analyzing Collusion Threats in the Semiconductor Supply Chain


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Media Protection?

[Assistant]
According to Risk Management Framework for Information Systems and Organizations_ A System Life Cycle Approach for Security and Privacy:

In addition to the responsibility to protect organizational assets from the threats that exist in today's environment, organizations have a responsibility to consider and manage the risks to individuals when information systems process personally identifiable information (PII). 6 7 The information security and privacy programs implemented by organizations have complementary objectives with respect to managing the confidentiality, integrity, and availability of PII. While many privacy risks arise from unauthorized activities that lead to the loss of confidentiality, integrity, or availability of PII, other privacy risks result from authorized activities involving the creation, collection, use, processing, storage, maintenance, dissemination, disclosure, or disposal of PII that enables an organization to meet its mission or business objectives. For example, organizations could fail to provide appropriate notice of PII processing depriving an individual of knowledge of such processing or an individual could be embarrassed or stigmatized

Executing the RMF requires close collaboration between information security programs and privacy programs. While information security programs and privacy programs have different objectives, those objectives are overlapping and complementary. Information security programs are responsible for protecting information and information systems from unauthorized access, use, disclosure, disruption, modification, or destruction (i.e., unauthorized system activity or behavior) in order to provide confidentiality, integrity, and availability. Privacy programs are responsible for ensuring compliance with applicable privacy requirements and for managing the risks to individuals associated with the creation, collection, use, processing, dissemination, storage, maintenance, disclosure, or disposal (collectively referred to as 'processing') of PII.

Risk Management Framework for Information Systems and Organizations_ A System Life Cycle Approach for Security and Privacy


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Blockchain for Access Control Systems provide? (Part 4)

[Assistant]
for  the  identification  of  patent  claims  whose  use  may  be  required  for compliance with the guidance or requirements of this publication, notice of one or more such claims has been received.
By publication, no position is taken by ITL with respect to the validity or scope of any patent claim or of any rights in connection therewith. The known patent holder(s) has (have), however, provided to NIST a letter of assurance stating either (1) a general disclaimer to the effect that it does (they do) not hold and does (do) not currently intend holding any essential patent claim(s), or (2) that it (they) will negotiate royalty-free or royalty-bearing licenses with other parties on a demonstrably nondiscriminatory basis with reasonable terms and conditions. Details may be obtained from ir8403-comments@nist.gov

No representation is made or implied that this is the only license that may be required to avoid patent infringement in the use of this publication. ## Executive Summary

Access  control  is  concerned  with  determining  the  allowed  activities  of  legitimate  users  and mediating every attempt by a user to access a resource in the system. The objectives of an access control system are often described in terms of protecting system resources against inappropriate or undesired user access. From a business perspective, this objective could just as well be described in  terms  of  the  optimal  sharing  of  information. As  current  information  systems  and  network architectures evolve to be more lightweight, pervasive, and interactive - such as the cloud and Internet  of  Things  (IoT)  -  there  is  need  for  an  access  control  mechanism  to  support  the requirements  of  decentralization,  scalability,  and  trust  for  accessing  objects,  all  of  which  are challenging for traditional mechanisms.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for Access Control?

[Assistant]
According to Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171:

- Applying a threat-centric approach to security requirements specification;
- Employing system and security architectures that support logical and physical isolation using system and network segmentation techniques, virtual machines, and containers; 16
- Implementing dual authorization controls for the most critical or sensitive operations;
- Limiting persistent storage to isolated enclaves or domains;
- Implementing a comply-to-connect approach for systems and networks;
- Extending configuration management requirements by establishing authoritative sources for addressing changes to systems and system components;
- Periodically refreshing or upgrading organizational systems and system components to a known state or developing new systems or components;
- Employing a security operations center with advanced analytics to support continuous monitoring and protection of organizational systems; and
- Using deception to confuse and mislead adversaries regarding the information they use for decision-making, the value and authenticity of the information they attempt to exfiltrate, or the environment in which they are operating.

| FAMILY                            | FAMILY                               |
|-----------------------------------|--------------------------------------|
| Access Control                    | Media Protection                     |
| Awareness and Training            | Personnel Security                   |
| Audit and Accountability          | Physical Protection                  |
| Configuration Management          | Risk Assessment                      |
| Identification and Authentication | Security Assessment                  |
| Incident Response                 | System and Communications Protection |
| Maintenance                       | System and Information Integrity     |

## 3.1   ACCESS CONTROL


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Overview and Considerations of Access Control Based on Attribute Encryption provide? (Part 3)

[Assistant]
of the data. However, some distributed or pervasive system environments wish to avoid the public-key encryption's all-or-nothing data access limitation when considering their performance requirements.
Attribute-based encryption incorporates access control policies and attributes with encryption and decryption functions and a one-to-many authorization scheme that requires fewer keys than public-key encryption. It also utilizes collusion-resistance, which provides a more efficient and flexible attribute-based access control mechanism that supports high-performance systems (e.g., cloud, IoT, disrupt-tolerant networks, wireless sensor networks, mobile ad-hoc networks, and public search service systems). ## Keywords

access control; attribute-based access control; attribute-based encryption; authorization; encryptions; identity-based encryption; public-key encryption. ## Reports on Computer Systems Technology

The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the Nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof-of-concept implementations, and technical analyses to advance the development and productive use of information technology. ITL's responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in federal information systems. ## Patent Disclosure Notice

NOTICE: ITL has requested that holders of patent claims whose use may be required for compliance with the guidance or requirements of this publication disclose such patent claims to ITL.

Overview and Considerations of Access Control Based on Attribute Encryption


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What guidance does Protecting Controlled Unclassified Information (CUI)_ NIST Special Publication 800-171, Revision 3. Small Business Primer provide?

[Assistant]
<!-- image -->

<!-- image -->

Howard Lutnick, Secretary of Commerce

<!-- image -->

Protecting Controlled Unclassified Information (CUI): NIST Special Publication 800-171, Revision 3 Small Business Primer

## Purpose of this Primer

This guide provides small businesses with an overview of NIST Special Publication (SP) 800-171 Revision 3, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations . The following pages contain:

- An overview of foundational components of SP 800-171
- A list of frequently asked questions and their answers
- Tips for getting started
- Related resources

## What is Controlled Unclassified Information (CUI)?*

CUI is information the government creates or possesses, or that an entity creates or possesses on behalf of the government, that law, regulation, or governmentwide policy requires you to take technical and operational steps to protect. Systems that process, store, and transmit CUI often support government programs involving sensitive critical assets. As part of a contractual agreement with the federal government, or possibly with other organizations like municipal governments, prime contractors, universities, etc., you will likely be required to demonstrate you are taking adequate measures to protect CUI.

Protecting Controlled Unclassified Information (CUI)_ NIST Special Publication 800-171, Revision 3. Small Business Primer


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Supply Chain Risk Management?

[Assistant]
According to Digital Identity Guidelines:

FISMA requires federal agencies to implement appropriate controls to protect federal
information and information systems from unauthorized access, use, disclosure,
disruption, or modification. The NIST RMF [NISTRMF] provides a process that integrates
security, privacy, and cyber supply chain risk management activities into the system
development life cycle. It is expected that federal agencies and organizations that
provide services under these guidelines have already implemented the controls and
processes required under FISMA and associated NIST risk management processes and
publications.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 2 require for Maintenance?

[Assistant]
According to Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations:

....................96        |
| Table 9. Identification and Authentication (IA) ..........................................................................................97             |
| Table 10.
Incident Response (IR).................................................................................................................98      |
| Table 11. Maintenance (MA) ......................................................................................................................98      |
| Table 12. Media Protection (MP)................................................................................................................99        |
| Table 13. Physical and Environmental Protection (PE)...............................................................................99                    |
| Table 14. Planning (PL)..............................................................................................................................100 |
| Table 15. Program Management (PM) .....................................................................................................100               |
| Table 16. Personnel Security (PS) .............................................................................................................101       |
| Table 17. PII Processing and Transparency (PT) .......................................................................................102                |
| Table 18. Risk Assessment (RA) ................................................................................................................102       |
| Table 19. System and Services Acquisition (SA)........................................................................................103                |
| Table 20. System and Communications Protection (SC)...........................................................................103                        |
| Table 21.

Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for Audit and Accountability?

[Assistant]
According to Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171:

| CHAPTERONE INTRODUCTION...................................................................................................... | CHAPTERONE INTRODUCTION...................................................................................................... |
|--------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------|
| 1.1 PURPOSEANDAPPLICABILITY                                                                                | ................................................................................................... 3                                            |
| 1.2 TARGET AUDIENCE                                                                                | .................................................................................................................. 4                             |
| 1.3 ORGANIZATIONOF THIS SPECIAL PUBLICATION                                                                                | .......................................................................... 4                                                                     |
| CHAPTERTWO THE FUNDAMENTALS............................................................................................ 5                        | CHAPTERTWO THE FUNDAMENTALS............................................................................................ 5                        |
| 2.1 DEVELOPMENTAPPROACH ......................................................................................................


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Personnel Security?

[Assistant]
According to Federal Cybersecurity Role-Based Training Approaches, Successes, and Challenges:

Most United States federal government organizations are required to conduct cybersecurity role-based training for federal government personnel and supporting contractors who are assigned roles having security and privacy responsibilities. Despite the training mandate, there has been little prior effort to look broadly across federal organizations to see how they are implementing these training activities and what issues they are experiencing. This lack of understanding may be hindering the development of improvements and resources for training activities. To address this gap, the Usable Cybersecurity team at the National Institute of Standards and Technology conducted a research study consisting of focus groups and a survey to gain insights into the approaches of and challenges faced by federal organizations when implementing role-based training activities. This paper reports the results of the study and suggests actions that organizations can take to improve federal role-based training activities.

Cybersecurity role-based training (RBT) includes specialized training on policies, procedures, and tools for individuals who are assigned roles having security and privacy responsibilities [SP800-53]. Most United States (U.S.) Federal Government organizations are required to conduct RBT for applicable federal government personnel and supporting contractors [CISA2022].

Cybersecurity role-based training (RBT) includes specialized training on policies, procedures, tools, and methods for individuals who are assigned management, operational, and technical roles having security and privacy responsibilities [SP800-53]. RBT is tailored to specific roles within an organization and differs from the general cybersecurity awareness training targeted at all personnel within an organization.

Federal Cybersecurity Role-Based Training Approaches, Successes, and Challenges


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AC.L2-3.1.13 (NIST 3.1.13)?

[Assistant]
According to Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations:

3.1.13. 3.1.13.

Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Blockchain for Access Control Systems provide? (Part 7)

[Assistant] ## Table of Contents | Introduction ...........................................................................................................1 | Introduction ...........................................................................................................1 | |------------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------| | Blockchain System Components and Advantages for Access Control | Blockchain System Components and Advantages for Access Control | | Systems .................................................................................................................3 | Systems .................................................................................................................3 | | Access Control Functions of Blockchain AC Systems......................................6 | Access Control Functions of Blockchain AC Systems......................................6 | | Access Control Model Support..........................................................................12 | Access Control Model Support..........................................................................12 | | Considerations....................................................................................................15 | Considerations....................................................................................................15 | | 5.1 Management Considerations ..................................................................................................15 | 5.1 Management Considerations ..................................................................................................15 | | Security Considerations ..........................................................................................................15 | Security Considerations ..........................................................................................................15 | | Privacy Considerations ...........................................................................................................16 | Privacy Considerations ...........................................................................................................16 | | 5.3 5.4 Performance Considerations...................................................................................................16 | 5.3 5.4 Performance Considerations...................................................................................................16 | | 5.5 Standardization Considerations ..............................................................................................17 | 5.5 Standardization Considerations ..............................................................................................17 | | Conclusion...........................................................................................................18 | Conclusion...........................................................................................................18 | | References ....................................................................................................................19 | References ....................................................................................................................19 | | 3 - Example 2 of access control function points implemented in a blockchain system ....................8 | 3 - Example 2 of access control function points implemented in a blockchain system ....................8 | | Figure Figure 4 - Example 3 of access control function points implemented in a blockchain system ....................8 | Figure Figure 4 - Example 3 of access control function points implemented in a


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Security Assessment?

[Assistant]
According to Incident Response Recommendations and Considerations for Cybersecurity Risk Management_ A CSF 2.0 Community Profile:

| CSF Element | CSF Element Description | Priority | Recommendations, Considerations, Notes assist with maintaining cross-references | |---------------------|-----------------------------------------------------------------------------------------------------------------------------------------------|------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | ID.RA-09 | The authenticity and integrity of hardware and software are assessed prior to acquisition and use | Medium | N1: See the notes for ID.RA.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Supply Chain Risk Management?

[Assistant]
According to Security and Privacy Controls for Information Systems and Organizations:

With a renewed emphasis on the use of trustworthy, secure information systems and supply
chain security, it is essential that organizations express their security and privacy requirements
with clarity and specificity in order to obtain the systems, components, and services necessary
for mission and business success. Accordingly, this publication provides controls in the System
and Services Acquisition (SA) and Supply Chain Risk Management (SR) families that are directed
at developers. The scope of the controls in those families includes information system, system
component,  and  system  service  development  and  the  associated  developers  whether  the
development is conducted internally by organizations or externally through the contracting and
acquisition processes. The affected controls in the control catalog include SA-8, SA-10, SA-11,
SA-15, SA-16, SA-17, SA-20, SA-21, SR-3, SR-4, SR-5, SR-6, SR-7, SR-8, SR-9, and SR-11. CHAPTER ONE   INTRODUCTION ...................................................................................................... 1
1.1   PURPOSE AND APPLICABILITY ................................................................................................... 2
1.2   TARGET AUDIENCE .................................................................................................................. 3
1.3   ORGANIZATIONAL RESPONSIBILITIES......................................................................................... 3
1.4   RELATIONSHIP TO OTHER PUBLICATIONS ................................................................................... 5
1.5   REVISIONS AND EXTENSIONS .................................................................................................... 5
1.6   PUBLICATION ORGANIZATION .................................................................................................. 5
CHAPTER TWO   THE FUNDAMENTALS ............................................................................................

Security and Privacy Controls for Information Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Workshop on Enhancing Security of Devices and Components Across the Supply Chain provide? (Part 3)

[Assistant]
413

D. Richard Kuhn:  0000-0003-0050-1596

Michael Ogata: 0000-0002-8457-2430

Sanjay (Jay) Rekhi: 0009-0008-8711-4030

Kim Schaffer: 0000-0003-3073-2395

Murugiah Souppaya: 0000-0002-8055-8527

A.J.
Stein: 0000-0003-1092-2642

Noah Waller: 0000-0002-6979-9725

## Contact Information

hwsec@nist.gov

National Institute of Standards and Technology Attn: Computer Security Division, Information Technology Laboratory 100 Bureau Drive (Mail Stop 8930) Gaithersburg, MD 20899-8930

## Additional Information

Additional information about this publication is available at https://csrc.nist.gov/pubs/ir/8532/final, including related content, potential updates, and document history. All comments are subject to release under the Freedom of Information Act (FOIA). ## Abstract

The National Institute of Standards and Technology (NIST) hosted an in-person, all-day workshop on February 27, 2024, to discuss existing and emerging cybersecurity threats and mitigation techniques for semiconductors throughout their life cycle. The workshop obtained valuable feedback from industry, academia, and government to inform NIST's development of cybersecurity and supply chain standards, guidance, and recommended practices. The discussion focused on semiconductor development and highlighted cybersecurity measurements and metrics that utilize reference data sets to facilitate the testing, attestation, certification, verification, and validation of semiconductor components. It also emphasized the use of automated cybersecurity tools and techniques to secure manufacturing environments throughout the development life cycle. This report summarizes the content that was presented and discussed at the workshop. ## Keywords

cybersecurity; hardware security; measurement; semiconductors; supply chain; vulnerabilities.

Workshop on Enhancing Security of Devices and Components Across the Supply Chain


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Access Control?

[Assistant]
According to Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule_ A Cybersecurity Resource Guide:

.................44                   |
| 5.1.7. Contingency Plan (§ 164.308(a)(7))............................................................................................47             |
| 5.1.8.
Evaluation (§ 164.308(a)(8)).......................................................................................................51        |
| 5.2.1. Facility Access Controls (§ 164.310(a)).......................................................................................56             |
| 5.1.9. Business Associate Contracts and Other Arrangements (§ 164.308(b)(1))................................54                                      |
| 5.2.2. Workstation Use (§ 164.310(b)).................................................................................................59            |
| 5.2.3. Workstation Security (§ 164.310(c)) ..........................................................................................61             |


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for Awareness and Training?

[Assistant]
According to Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171:

............................................ 5                        |
| 2.1 DEVELOPMENTAPPROACH ......................................................................................................
| 5                                                                                |
| 2.2 ORGANIZATIONANDSTRUCTURE                                                                                | ............................................................................................. 7                                                  |
| 2.3 FLEXIBLE APPLICATION                                                                                | ............................................................................................................. 9                                  |
| CHAPTER THREE THE REQUIREMENTS......................................................................................... 11                       | CHAPTER THREE THE REQUIREMENTS......................................................................................... 11                       |
| 3.1 ACCESSCONTROL                                                                                | .................................................................................................................. 12                            |
| 3.2 AWARENESSANDTRAINING                                                                                | ...................................................................................................

Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Audit and Accountability?

[Assistant]
According to Workshop on Enhancing Security of Devices and Components Across the Supply Chain:

semiconductor industry since 1970 and provides global advocacy and technical leadership. It currently meets the cybersecurity needs of the industry, from material and equipment suppliers to end users.
In November 2023, the SMCC and NIST met to identify key areas and seek volunteers for both internal leadership and action. Attendees represented all semiconductor-related industries. Starting with about 40 in-person and almost 70 online attendees, the volunteers from that group have grown to about 50+ since January 2024 and have support from several CSOs from major organizations. Jennifer Lynn continued the SEMI presentation and stated that the SMCC is gaining momentum. The two days of whiteboard sessions at the November 2023 meeting established seven working groups: 1) factory cybersecurity implementation, 2) compliance readiness, 3) supply chain cybersecurity, 4) regulation and other specs, 5) threat sharing, 6) cybersecurity pre-standards engineering, and 7) outreach. Jennifer is leading working group 4, which will co-author the industry profile to map SEMI requirements to CSF 2.0. Anyone who wishes to aid in these efforts is encouraged to email cybersecurity@semi.org to talk to the working group leads and discuss how you might help. This work will establish the requirements for moving forward as well as how the existing structure can be protected for the rest of its lifetime. The SAE G-32 is working on integrating cybersecurity assurance into a CPS systems engineering and product-focused process. The SEMI SMCC will transition the design and manufacturing floor to one that incorporates auditable cybersecurity. A comment from the audience suggested that the SEMI standards for traceability at the wafer manufacturing are a good basis for forming a liaison activity between SEMI, IPC, and SAE. NIST


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Protecting Controlled Unclassified Information (CUI)_ NIST Special Publication 800-171, Revision 3. Small Business Primer provide? (Part 5)

[Assistant]
s and disclosure

Preventing disruption in how information is accessed

<!-- image -->

2 SP 800-171 does not explicitly cover integrity and availability so it is not a comprehensive security program.
## Overview

## Structure of SP 800-171

SP 800-171 security requirements are organized into 17 families, as illustrated in the table below. Each family is further broke n down into requirements related to the family's general security topic (see the example at the bottom of the page). | Access Control                    | Maintenance         | Security Assessment and Monitoring   |
|-----------------------------------|---------------------|--------------------------------------|
| Awareness and Training            | Media Protection    | System and Communications Protection |
| Audit and Accountability          | Personnel Security  | System and Information Integrity     |
| Configuration Management          | Physical Protection | Planning                             |
| Identification and Authentication | Risk Assessment     | System and Services Acquisition      |
| Incident Response                 |                     | Supply Chain Risk Management         |

## Understanding the Security Requirements in SP 800-171

Below is an example of the Incident Response Testing requirement, which is part of the Incident Response (IR) family. The structure and content of a typical security requirement includes:

<!-- image -->

ht ps:/

csrc.nist.gov/projects/protecting-control ed-unclas ified-information

## Overview

<!-- image -->

## Top 5 Frequently Asked Questions

## Top five questions NIST receives on SP 800-171:

| How can I 'comply' with SP 800-171? | NIST does not have a role in determining compliance with the security requirements in SP 800-171. If you have questions regarding requirements to protect CUI or other regulatory requirements, please contact your prime contractor and/or federal point of contact for the contract.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Maintenance?

[Assistant]
According to Status Report on the Fourth Round of the NIST Post-Quantum Cryptography Standardization Process:

Additional information about this publication is available at https://csrc.nist.gov/pubs/ir/8545/final, including related content, potential updates, and document history. The fourth round began in July 2022 and involved a thorough analysis of the theoretical and empirical evidence used to justify the security of the candidates. During this time, the submitters of SIKE acknowledged its insecurity and recommended against its further use. The submission teams of the unbroken fourth-round candidates were invited to present updates for their candidate algorithms at the Fifth NIST PQC Standardization Conference in Rockville, Maryland, on April 10-12, 2024. The submitters participated in a joint panel to discuss the candidates' merits, and several researchers presented work that was relevant to the PQC standardization process. - [1] Open quantum safe (OQS) algorithm performance visualizations. Available at https: //openquantumsafe.org/benchmarking. - [2] Alagic G, Apon D, Cooper DA, Dang QH, Dang T, Kelsey JM, Lichtinger J, Liu YK, Miller CA, Moody D, Peralta R, Perlner RA, Robinson A, Smith-Tone D (2022) Status Report on the Third Round of the NIST Post-Quantum Cryptography Standardization Process. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Interagency or Internal Report (IR) NIST IR 8413-upd1, Includes updates as of September 26, 2022. https://doi.org/10.6028/NIST.IR.8413-upd1
- [3] National Institute of Standards and Technology (2015) SHA-3 Standard: PermutationBased Hash and Extendable-Output Functions. (Department of Commerce, Washington, DC), Federal Information Processing Standards Publication (FIPS) NIST FIPS 202. https://doi.org/10.6028/NIST.FIPS.202
- [4] National Institute of Standards and Technology (2024) Module-Lattic-Based Digital Signature Standard. (Department of Commerce, Washington, DC), Federal Information Processing Standards Publication (FIPS) NIST FIPS 204.

Status Report on the Fourth Round of the NIST Post-Quantum Cryptography Standardization Process


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice MP.L2-3.8.17 (NIST 3.8.17)?

[Assistant]
According to Protecting Information and System Integrity in Industrial Control System Environments_ Cybersecurity for the Manufacturing Sector:

3.8.17) appliance is installed in a rack with network connections for the Management/Query traffic on Port 1 and SPAN traffic on Port 2 of the appliance.

Protecting Information and System Integrity in Industrial Control System Environments_ Cybersecurity for the Manufacturing Sector


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Approaches and Challenges of Federal Cybersecurity Awareness Programs provide? (Part 9)

[Assistant]
i                                                                           | EXECUTIVE SUMMARY.........................................................................................................
iii   |
|--------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------|
| 1 INTRODUCTION................................................................................................................. | 1 INTRODUCTION................................................................................................................. | 1                                                                                |
| 2 REPORTING CONVENTIONS.......................................................................................... | 2 REPORTING CONVENTIONS.......................................................................................... | 2                                                                                |
| 3 SECURITY AWARENESS APPROACHES..................................................................... | 3 SECURITY AWARENESS APPROACHES..................................................................... | 3                                                                                |
| 3.1 ANNUAL REQUIRED TRAINING.............................................................................................

Approaches and Challenges of Federal Cybersecurity Awareness Programs


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice CM.L2-3.4.5 (NIST 3.4.5)?

[Assistant]
According to Automated Secure Configuration Guidance from the macOS Security Compliance Project (mSCP):

3.4.5. 3.4.5. 3.4.5) enhances portability between compliance frameworks.

Automated Secure Configuration Guidance from the macOS Security Compliance Project (mSCP)


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Access Control?

[Assistant]
According to Status Report on the Fourth Round of the NIST Post-Quantum Cryptography Standardization Process:

. . . . . . . . . . . . . . . | 10             |
| 3.2. | BIKE . . . . . . . . . . . . . . . . . . . . . . . . . . . . | 12             |
| 3.3. | Classic McEliece . . . . . . . . . . . . . . . . . .
. . . | 14             |
| 3.4. | SIKE . . . . . . . . . . . . . . . . . . . . . . . . . . . . | 16             |
| 4. Conclusion . . | . . . . . . . . . . . . . . . . . . . . . . . . . . | 18             |
| References . . | . . . . . . . . . . . . . . . . . . . . . . . . . . . | 19             |
| Appendix A. List of Symbols, Abbreviations, and Acronyms                                                                                | . | 26             |
| List of Tables                                                                                | List of Tables                                                                                | List of Tables |
| Table 1. Timeline of the NIST Post-Quantum Cryptography Standardization Process                                                                                | Table 1. Timeline of the NIST Post-Quantum Cryptography Standardization Process                                                                                | 2              |
| Table 2. Fourth-round KEM candidates organized by category, with the candidate se- lected for standardization bolded and in blue . . . . . . . . . . . . . . . . | Table 2. Fourth-round KEM candidates organized by category, with the candidate se- lected for standardization bolded and in blue . . . . . . . . . . . . . . . . | 4              |
| Table 3. Performance of BIKE in thousands of cycles on x86_64 [1] . . . | Table 3. Performance of BIKE in thousands of cycles on x86_64 [1] . . . | 6              |
| Table 4. Performance of HQC in thousands of cycles on x86_64 [1] . . . | Table 4.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Workshop on Enhancing Security of Devices and Components Across the Supply Chain provide? (Part 9)

[Assistant]
across all product life cycles, and the use of machine learning in chip design and manufacturing. The second speaker for the panel was Adam Golodner, advisor to the Semiconductor Industry Association.
Adam spoke about the importance of leveraging and adapting NIST resources, like the Cybersecurity Framework (CSF). Adam highlighted four key reasons why a similar framework for hardware security and supply chains would be useful to the semiconductor industry:

1. Frameworks like the CSF enable thoughtful, flexible, and configurable approaches to security and allow enterprises to adopt the processes and maturity levels that best move security forward for them. 2. A hardware security and supply chain framework can benefit from the recognition and adoption that the CSF has already earned. 3. The CSF and NIST have global reach and acceptance. Similarly, establishing an internationally recognized set of best practices will enhance security and innovation in a global hardware and supply chain environment. 4. NIST has the pedigree for getting security 'right.'

Furthermore, Adam reflected that while security is core to many company brands, quantifying its return on investment is a C-suite and Board of Directors issue. The last panel member was Matthew Areno, Senior Principal Engineer for Intel Corporation. Matthew admitted that there is no industry standard to describe the phases of the supply chain for ICs. However, his expertise and history with the industry have enabled him to develop his own conceptual model that is divided into seven stages: concept, development, integration, manufacturing, testing, provisioning, and deployment. During his time at Intel, Matthew has worked to develop a threat model for Intel's supply chain. Intel discovered that each of their teams approached the exercise of threat modeling in different ways, which made it difficult and time-consuming for them to exchange information.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Configuration Management?

[Assistant]
According to Ordered t-way Combinations for Testing State-based Systems:

ement Concepts and Applications", 2nd  Intl  Workshop  on  Combinatorial  Testing , Luxembourg, IWCT2013, IEEE, Mar. 2013. - [27] Zamli KZ, Othman RR, Zabil MH. On sequence based interaction  testing.
In2011  IEEE  Symposium  on  Computers  & Informatics 2011 Mar 20 (pp. 662-667). IEEE. - [28] Kuhn DR, Higdon JM, Lawrence JF, Kacker RN, Lei Y. Efficient  methods  for  interoperability  testing  using  event sequences. FLIGHT TEST SQUADRON (46TH) EGLIN AFB FL; 2012 Aug 1. - [29] Yilmaz C, Fouche S, Cohen MB, Porter A, Demiroz G, Koc U. Moving forward with combinatorial interaction testing. Computer. 2013 Dec 11;47(2):37-45. - [30] Garn  B,  Simos  DE,  Zauner  S,  Kuhn  R,  Kacker  R. Browser fingerprinting using combinatorial sequence testing. In Proceedings of the 6th Annual Symposium on Hot Topics in the Science of Security 2019 Apr 1 (pp. 1-9). - [31] Ozcan  M. An  Industrial  Study  on  Applications  of Combinatorial  Testing  in  Modern  Web  Development. In2019 IEEE International Conference on Software Testing, Verification and Validation Workshops (ICSTW) 2019 Apr 22 (pp. 210-213). - [32] Ratliff, Z. B. (2018). Black-box Testing Mobile Applications  Using  Sequence  Covering  Arrays. undergraduate thesis, Texas A&M University. - [33] Ratliff ZB, Kuhn DR, Ragsdale DJ. Detecting Vulnerabilities in Android Applications using Event Sequences. In2019 IEEE 19th International Conference on Software Quality, Reliability and Security (QRS) 2019 Jul 22 (pp. 159-166). IEEE. - [34] Elks DC, Deloglos C, Jayakumar A, Tantawy DA, Hite R, Gautham S. Realization Of An Automated T-Way Combinatorial Testing Approach For A Software Based Embedded  Digital  Device. Idaho  National  Lab.(INL),  Idaho Falls, ID (United States); 2019 Jun 17. - [35] Becci G, Dhadyalla G, Mouzakitis A, Marco J, Moore AD. Robustness testing of real-time automotive systems using sequence covering arrays. SAE International Journal of

Ordered t-way Combinations for Testing State-based Systems


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AT.L2-3.2.3 (NIST 3.2.3)?

[Assistant]
According to Assessing Security and Privacy Controls in Information Systems and Organizations:

3.2.3   TAILOR ASSESSMENT PROCEDURES

In a manner similar to how the controls from [SP 800-53] are tailored for the organization’s
mission, business functions, characteristics of the system, and operating environment,
organizations tailor the assessment procedures in Chapter 4 to meet specific organizational
needs. 3.2.3. 3.2.3.

Assessing Security and Privacy Controls in Information Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice CM.L2-3.4.1 (NIST 3.4.1)?

[Assistant]
According to Validating the Integrity of Computing Devices:

3.4.1                                                                                | Threats... 3.4.1 Threats

NIST SP 800-161 Revision 1 provides a framework of ICT supply chain threats including insertion of counterfeits, unauthorized production, tampering, theft, and insertion of malicious software and hardware, as well as poor manufacturing and development practices in the ICT supply chain. 3.4.1 PR.

Validating the Integrity of Computing Devices


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Recommendation for Pair-Wise Key-Establishment Using Integer Factorization Cryptography provide? (Part 6)

[Assistant]
| 2. Scope and Purpose..................................................................................................................
1                                                                                | 2. Scope and Purpose.................................................................................................................. 1                                                                                |
| 3. Definitions, Symbols and Abbreviations............................................................................... 2                                                                                | 3. Definitions, Symbols and Abbreviations............................................................................... 2                                                                                | 3. Definitions, Symbols and Abbreviations...............................................................................

Recommendation for Pair-Wise Key-Establishment Using Integer Factorization Cryptography


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Supply Chain Risk Management?

[Assistant]
According to The Federal Cybersecurity Awareness Workforce_ Professional Backgrounds, Knowledge, Skills, and Development Activities:

In an open-ended question, we also asked what other job functions or roles the participants had in addition to their security awareness responsibilities. All but two participants had other substantial cybersecurity duties beyond awareness training, for example, incident response, supply chain risk management, audits and compliance, policy, information systems security management, privacy awareness and training, cybersecurity role-based training, and project management.

The Federal Cybersecurity Awareness Workforce_ Professional Backgrounds, Knowledge, Skills, and Development Activities


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Digital Identity Guidelines_ Authentication and Authenticator Management provide? (Part 7)

[Assistant]
s . . . . . . . . . . . . . . . . . . . . . . . . 3.1.4. Single-Factor OTP . . . . . . . . . . . . . . . . . . . . . . . . . 3.1.5. Multi-Factor OTPs

. . . . . . . . . . . . . . . . . . . . . . . . .
1

2

3

4

4

5

5

5

6

6

7

7

8

8

8

9

9

9

9

9

10

11

12

13

13

17

18

23

25

iii

NIST SP 800-63B-4
July 2025

Digital Identity Guidelines
Authentication and Authenticator Management

3.1.6. Single-Factor Cryptographic Authentication . . . . . . . . . . . . 3.1.7. Multi-Factor Cryptographic Authentication . . . . . . . . . . . . 3.2. General Authenticator Requirements . . . . . . . . . . . . . . . . . . . 3.2.1. Physical Authenticators

. . . . . . . . . . . . . . . . . . . . . . 3.2.2. Rate Limiting (Throttling)

. . . . . . . . . . . . . . . . . . . . . 3.2.3. Use of Biometrics

. . . . . . . . . . . . . . . . . . . . . . . . . 3.2.4. Attestation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.2.5. Phishing Resistance . . . . . . . . . . . . . . . . . . . . . . . . 3.2.6. Verifier-CSP or IdP Communications . . . . . . . . . . . . . . . . 3.2.7. Replay Resistance . . . . . . . . . . . . . . . . . . . . . . . . . 3.2.8. Authentication Intent

. . . . . . . . . . . . . . . . . . . . . . . 3.2.9. Restricted Authenticators . . . . . . . . . . . . . . . . . . . . . 3.2.10. Activation Secrets

. . . . . . . . . . . . . . . . . . . . . . . . . 3.2.11. Connected Authenticators . . . . . . . . . . . . . . . . . . . . . 3.2.12. Random Values . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.2.13. Exportability . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4. Authenticator Event Management . . . . . . . . . . . . . . . . . . . . . . . . 4.1. Authenticator Binding . . . . . . . . . . . . . . . . . . . . . . . . . . . 4.1.1. Binding at Enrollment

. . . . . . . . . . . . . . . . . . . . . . . 4.1.2. Post-Enrollment Binding . . . . . . . . . . . . . . . . . . . . . . 4.1.3. Binding to a Subscriber-Provided Authenticator . . . . . . . .

Digital Identity Guidelines_ Authentication and Authenticator Management