[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Report on the Design-A-Thon_ Designing Effective and Accessible Approaches for Digital Product Cybersecurity Education and Awareness provide? (Part 9)

[Assistant]
an provide critical support for the cybersecurity of digital products. Notably, the capability can inform and educate users about other cybersecurity capabilities, particularly technical capabilities.
For example, cybersecurity education and awareness can guide users on creating strong access control credentials and permissions for products where such features are supported. Other information can be delivered using this capability as well, such as expectations for use of the product and other cybersecurity expectations, which can reduce the possibility of a risk being missed or otherwise unaddressed when the product is deployed. For more information about cybersecurity education and awareness, please see NIST Internal/Interagency Reports 8259 [2], 8259B [1], 8425 [3], 8425A [4], and NIST Special Publication 800-213A [5]. ## Human-Factors Considerations for Cybersecurity

Particular care should be taken with the messaging and presentation of consumer education materials or users may not engage with or understand them. Users are more likely to read or interact with educational materials that are visually appealing or in alternative formats appropriate to the product (e.g., videos) [6]. Further, materials should be written in language that is understandable to a wide range of users, typically written at no more than an 8th grade reading level for adult users. Translations of education materials into common languages spoken across the customer base should be provided, as is the practice for US federal agencies

[7]. Additionally, materials should meet accessibility 1 standards and guidance (e.g., Americans with Disabilities Act (ADA) and Section 508 of the Rehabilitation Act of 1973) to support users with disabilities.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AT.L2-3.2.3 (NIST 3.2.3)?

[Assistant]
According to Digital Identity Guidelines_ Identity Proofing and Enrollment:

3.2.3. 3.2.3.

Digital Identity Guidelines_ Identity Proofing and Enrollment


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Communications Protection?

[Assistant]
According to Workshop on Enhancing Security of Devices and Components Across the Supply Chain:

Semiconductor-based hardware is the foundation of modern-day electronics - from smartphones, computers, and telecommunications to transportation and critical infrastructure. The semiconductor hardware supply chain is a complex network of companies that collectively provide intellectual property, designs, and raw materials and manufacture, test, package, and distribute products. Coordination among the components of a supply chain is required at different stages, including inception, deployment to end users, maintenance during use, and disposal or end of life. Securing semiconductor-based hardware and their supply chains help protect sensitive information, maintain the integrity of systems, and ensure overall stability across the infrastructure and connected world.

These activities range from physical protection mechanisms (e.g., tamper-resistant packaging) to strong encryption protocols to safeguard data. Secure boot processes ensure that only verified firmware runs, and maintaining supply chain integrity through verification and audits prevents counterfeit components. Life cycle management includes secure provisioning, updates, and end-of-life processes that are complemented by rigorous security testing and compliance with regulatory standards. Educating users on secure practices and continuously improving security measures further fortifies defenses against evolving threats and ensures that semiconductor devices operate securely throughout their life cycle.

Workshop on Enhancing Security of Devices and Components Across the Supply Chain


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Contingency Planning Guide for Federal Information Systems provide? (Part 4)

[Assistant]
FISMA requires that federal agencies comply with these standards, agencies may not waive their use. - Guidance documents and recommendations are issued in the NIST Special Publication (SP) 800series.
Office of Management and Budget (OMB) policies (including OMB FISMA Reporting Instructions for the Federal Information Security Management Act and Agency Privacy Management) state that, for other than national security programs and systems, agencies must follow NIST guidance. 1
- Other security-related publications, including NIST interagency and internal reports (NISTIRs) and ITL Bulletins, provide technical and other information about NIST's activities. These publications are mandatory only when so specified by OMB. 1 While agencies are required to follow NIST guidance in accordance with OMB policy, there is flexibility within NIST's guidance in how agencies apply the guidance. Unless otherwise specified by OMB, the 800-series guidance documents published by NIST generally allow agencies some latitude in the application. Consequently, the application of NIST guidance by agencies can result in different security solutions that are equally acceptable, compliant with the guidance, and meet the OMB definition of adequate security for federal information systems. When assessing federal agency compliance with NIST guidance, auditors, evaluators, and assessors should consider the intent of the security concepts and principles articulated within the particular guidance document and how the agency applied the guidance in the context of its specific mission responsibilities, operational environments, and unique organizational conditions. ## Acknowledgements

The authors, Marianne Swanson and Pauline Bowen of the National Institute of Standards and Technology (NIST), Amy Wohl Phillips, Dean Gallup, and David Lynes of Booz Allen Hamilton, wish to thank their colleagues who reviewed drafts of this document and contributed to its technical content.

Contingency Planning Guide for Federal Information Systems

Audit and Accountability
System and Information Integrity
Security Assessment
Media Protection
Identification and Authentication
Awareness and Training
System and Communications Protection
Access Control
Planning
Incident Response
Risk Assessment
Personnel Security
System and Services Acquisition
Supply Chain Risk Management
Maintenance
Physical Protection
Configuration Management


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Personnel Security?

[Assistant]
According to Planning for a Zero Trust Architecture_ A Planning Guide for Federal Administrators:

The enterprise architecture team should focus on identifying relevant business processes (workflows) and systems at the RMF mission/business level. A risk analysis should be done on each workflow including the possible impact of new operations or components added for the proposed ZTA.  The owners and key personnel involved in the workflow should be identified and have input in the analysis, as they may have knowledge and experience about the workflows that deviate from existing workflow or system documentation. This maps to the organization and mission/business process level tasks (P-3 to P-7) of the PREPARE step (table 1 of NIST SP 80037r2) [2]. System administrators and operators should focus on identifying the resources that are used to conduct the identified business processes. This focus maps to the system level tasks (P-8 through P-18) of the PREPARE step (table 2 of NIST SP 800-37r2) [2].

Planning for a Zero Trust Architecture_ A Planning Guide for Federal Administrators


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule_ A Cybersecurity Resource Guide provide? (Part 10)

[Assistant]
ions Crosswalk........................105                                                                                |
| Appendix E.
National Online Informative References (OLIR) Program..............................................106                                                                                |
| Appendix F. HIPAA Security Rule Resources (Informative)...............................................................109                                                                                |
| Appendix G. Change Log.................................................................................................................110                                                                                |
| List of Tables                                                                                |
| Table 1. Security Rule standards and implementation specifications .................................................12                                                                                |
| Table 2. Common threat sources ......................................................................................................17                                                                                |
| Table 3. Assessment scale for overall likelihood................................................................................19                                                                                |
| Table 4.

Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule_ A Cybersecurity Resource Guide


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Configuration Management?

[Assistant]
According to Security and Privacy Controls for Information Systems and Organizations:

organizations. It provides  guidance  for
tailoring  control  baselines  and  for  developing  overlays  to  support  the  security  and  privacy
requirements of stakeholders and their organizations.
CNSS Instruction 1253 provides control
baselines  and  guidance  for  security  categorization  and  security  control  selection  for  national
security systems.

Security and Privacy Controls for Information Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AC.L2-3.1.1 (NIST 3.1.1)?

[Assistant]
According to Recommendation for Pair-Wise Key-Establishment Using Integer Factorization Cryptography:

3.1.1 rsakpg1 - basic ... 3.1.1 rsakpg1 -basic

rsakpg1-basic is the generator in the RSAKPG1 family where the private key is in the basic format ( n , d ). 3.1.1) except that the private key is in the prime-factor format: ( p , q , d ).

Recommendation for Pair-Wise Key-Establishment Using Integer Factorization Cryptography


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 2 require for Configuration Management?

[Assistant]
According to Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations:

......................98      |
| Table 11. Maintenance (MA) ......................................................................................................................98      |
| Table 12.
Media Protection (MP)................................................................................................................99        |
| Table 13. Physical and Environmental Protection (PE)...............................................................................99                    |
| Table 14. Planning (PL)..............................................................................................................................100 |
| Table 15. Program Management (PM) .....................................................................................................100               |
| Table 16. Personnel Security (PS) .............................................................................................................101       |
| Table 17. PII Processing and Transparency (PT) .......................................................................................102                |
| Table 18. Risk Assessment (RA) ................................................................................................................102       |
| Table 19. System and Services Acquisition (SA)........................................................................................103                |
| Table 20. System and Communications Protection (SC)...........................................................................103                        |
| Table 21. System and Information Integrity (SI) .......................................................................................104               |
| Table 22. Supply Chain Risk Management (SR).........................................................................................105                  |
| Table 23.

Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Digital Identity Guidelines_ Authentication and Authenticator Management provide? (Part 9)

[Assistant]
on Strategies . . . . . . . . . . . . . . . . . . . . . . . . 6.3. Authenticator Recovery . . . . . . . . . . . . . . . . . . . . . . . . . . 6.4. Session Attacks . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . 7. Privacy Considerations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7.1. 7.2. Privacy Risk Assessment . . . . . . . . . . . . . . . . . . . . . . . . . . Privacy Controls

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7.3. Use Limitation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7.4. Agency-Specific Privacy Compliance . . . . . . . . . . . . . . . . . . . . 8. Customer Experience Considerations

. . . . . . . . . . . . . . . . . . . . . . 8.1. Usability . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8.1.1. Common Usability Considerations for Authenticators . . . . . . . 8.1.2. Usability Considerations by Authenticator Type . . . . . . . . . . 8.1.3. Summary of Usability Considerations . . . . . . . . . . . . . . . 8.1.4. Usability Considerations for Biometrics . . . . . . . . . . . . . . 8.2. Customer Success Considerations . . . . . . . . . . . . . . . . . . . . . References

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Appendix A. Strength of Passwords . . . . . . . . . . . . . . . . . . . . . . . . . A.1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A.2. Length . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A.3. Complexity . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A.4. Central vs. Local Verification . . . . . . . . . . . . . . . . . . . . . . . . A.5. Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53

53

55

55

56

57

58

58

62

65

65

66

66

66

66

67

68

68

69

71

76

76

79

81

87

87

87

88

89

90

v

NIST SP 800-63B-4
July 2025

Digital Identity Guidelines
Authentication and Authenticator Management

Appendix B.

Digital Identity Guidelines_ Authentication and Authenticator Management


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Digital Identity Guidelines_ Authentication and Authenticator Management provide? (Part 3)

[Assistant]
l official. This publication may be used by nongovernmental
organizations on a voluntary basis and is not subject to copyright in the United States. Attribution would, however, be appreciated by NIST.
NIST Technical Series Policies

Copyright, Fair Use, and Licensing Statements
NIST Technical Series Publication Identifier Syntax

Publication History

Approved by the NIST Editorial Review Board on 2025-05-30. Supersedes NIST SP 800-63B (June 2017; updated March 2, 2020) https://doi.org/10. 6028/NIST.SP.800-63b

How to Cite this NIST Technical Series Publication

Temoshok D, Fenton JL, Choong YY, Lefkovitz N, Regenscheid A, Galluzzo R, Richer JP
(2025) Digital Identity Guidelines: Authentication and Authenticator Management. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special
Publication (SP) NIST SP 800-63B-4. https://doi.org/10.6028/NIST.SP.800-63B-4

Author ORCID iDs

David Temoshok: 0000-0001-6195-0331
James L. Fenton: 0000-0002-2344-4291
Yee-Yin Choong: 0000-0002-3889-6047
Naomi Lefkovitz: 0000-0003-3777-3106
Andrew Regenscheid: 0000-0002-3930-527X
Ryan Galluzzo: 0000-0003-0304-4239
Justin P. Richer: 0000-0003-2130-5180

Contact Information

mailto:dig-comments@nist.gov

National Institute of Standards and Technology
Attn: Applied Cybersecurity Division, Information Technology Laboratory
100 Bureau Drive (Mail Stop 2000) Gaithersburg, MD 20899-2000

Additional Information

Additional information about this publication is available at https://csrc.nist.gov/pubs/
sp/800/63/B/4/final, including related content, potential updates, and document history. All comments are subject to release under the Freedom of Information Act (FOIA).


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Risk Assessment?

[Assistant]
According to Guide to Malware Incident Prevention and Handling for Desktops and Laptops:

. It also gives extensive recommendations for enhancing an organization's existing incident response capability so that it is better prepared to handle malware incidents, particularly widespread ones.
| Executive Summary................................................................................................................vii   | Executive Summary................................................................................................................vii                                                                                | Executive Summary................................................................................................................vii                                                                                |                                                                                |
|----------------------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------|
| 1. Introduction ...................................................................................................................... | 1. Introduction ...................................................................................................................... | 1.

Guide to Malware Incident Prevention and Handling for Desktops and Laptops


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Configuration Management?

[Assistant]
According to Cryptographic Module Validation Program (CMVP) Security Policy Requirements_ CMVP Validation Authority Updates to ISO_IEC 24759 and ISO_IEC 19790 Anne:

al requirements are listed for each section of the security policy, grouped by the source publication or document, and reference the specific section from the document where the requirement is stated.
Where possible, they are direct

- Description - Description of the module
- Purpose - The intended purpose or use of the module, including the intended use environment
- Module Type - Hardware, software, firmware, or hybrid designation
- Embodiment - Specific embodiment of the module (e.g., single-chip, multi-chip embedded, or multi-chip stand-alone) [Moved from Annex B Section 7]
- Tested Operational Environment's Physical Perimeter (TOEPP) - Location of the cryptographic module with respect to the TOEPP that is part of the module's tested configuration but may be outside the module's cryptographic boundary so that all of the logical and physical layers between the cryptographic module and the TOEPP are clearly defined. This also includes a description and components list of the TOEPP. - TOEPP and Cryptographic Boundary - Precise definition of the module's TOEPP and cryptographic boundary
- Diagram, Schematic, or Photograph - Illustrative diagram, schematic, or photograph of the module. If the security policy encompasses multiple versions of the module, each version is represented separately or annotated to note that the representation is illustrated for all versions. For a software, firmware, hybrid, or

Cryptographic Module Validation Program (CMVP) Security Policy Requirements_ CMVP Validation Authority Updates to ISO_IEC 24759 and ISO_IEC 19790 Anne


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Awareness and Training?

[Assistant]
According to Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations:

.......24                         |
| 2.3.2. Level 1 -Enterprise...................................................................................................................27         |
| 2.3.3.
Level 2 -Mission and Business Process....................................................................................30                      |
| 2.3.4. Level 3 -Operational................................................................................................................32           |
| 2.3.5. C-SCRM PMO..............................................................................................................................33       |
| Critical Success Factors...................................................................................................................37           |
| 3. |
| 3.1.2. The Role of C-SCRM in the Acquisition Process .........................................................................40                        |
| 3.4.1. Foundational Practices ...............................................................................................................46         |

Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AU.L2-3.3.3 (NIST 3.3.3)?

[Assistant]
According to Data Integrity_ Detecting and Responding to Ransomware and Other Destructive Events:

3.3.3 Other Considerations

This solution will aid in identifying the script that causes a configuration change or deletion, but ultimately some things cannot be automated by the solution.

Data Integrity_ Detecting and Responding to Ransomware and Other Destructive Events


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What guidance does Status Report on the Fourth Round of the NIST Post-Quantum Cryptography Standardization Process provide?

[Assistant]
<!-- image -->

## NIST Internal Report NIST IR 8545

## Status Report on the Fourth Round of the NIST Post-Quantum Cryptography Standardization Process

Gorjan Alagic

Maxime Bros

Pierre Ciadoux

David Cooper

Quynh Dang

Thinh Dang

John Kelsey

Jacob Lichtinger

Yi-Kai Liu

Carl Miller

Dustin Moody

Rene Peralta

Ray Perlner

Angela Robinson

Hamilton Silberg

Daniel Smith-Tone

Noah Waller

This publication is available free of charge from: https://doi.org/10.6028/NIST.IR.8545

<!-- image -->

## NIST Internal Report NIST IR 8545

## Status Report on the Fourth Round of the NIST Post-Quantum Cryptography Standardization Process

Gorjan Alagic

Maxime Bros

Pierre Ciadoux

David Cooper

Quynh Dang

Thinh Dang

John Kelsey

Jacob Lichtinger

Carl Miller

Dustin Moody

Rene Peralta

Ray Perlner

Angela Robinson

Hamilton Silberg

Daniel Smith-Tone

Noah Waller

Computer Security Division Information Technology Laboratory

Yi-Kai Liu

Applied and Computational Mathematics Division Information Technology Laboratory

This publication is available free of charge from: https://doi.org/10.6028/NIST.IR.8545

March 2025

<!-- image -->

U.S. Department of Commerce Howard Lutnick, Secretary

Certain equipment, instruments, software, or materials, commercial or non-commercial, are identified in this paper in order to specify the experimental procedure adequately. Such identification does not imply recommendation or endorsement of any product or service by NIST, nor does it imply that the materials or equipment identified are necessarily the best available for the purpose. There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may be used by federal agencies even before the completion of such companion publications.

Status Report on the Fourth Round of the NIST Post-Quantum Cryptography Standardization Process


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does A Data Structure for Integrity Protection with Erasure Capability provide? (Part 7)

[Assistant]
blockchains are designed  to  ensure  that  block  contents  are  immutable. Any change  in  a  blockchain  will  invalidate  subsequent  hashes  in following  blocks,  losing  integrity  protection.
The  data  block matrix  structure  retains  integrity  protection  of  non-deleted blocks. Note  that  this  data  structure  could  also  be  extended beyond two dimensions to an arbitrary number of dimensions, with extensions to the algorithms above. ## ACKNOWLEDGMENTS

Many  thanks  to  Lee  Badger,  Jeff  Voas,  Sandy  Ressler, Dylan Yaga, and Peter Mell for review and discussion of the original  paper  on  this  work. Thanks  to  Peter  for  suggesting the alternative of hashing a concatenation of block hashes. ## REFERENCES

[1]  D Richard Kuhn. A data  structure  for  integrity  protection  with  erasure capability. NIST Cybersecurity Whitepaper ,  2018. ## NIST CSWP 25

- [2]  Matthias Berberich and Malgorzata Steiner. Blockchain technology and the gdpr-how to reconcile privacy and distributed ledgers. Eur. Data Prot. L. Rev. ,  2:422, 2016. - [3]  Henry Chang. Blockchain: Disrupting data protection? Privacy Law and Business International Report, November ,  2017. - [4]  O. Kharif. Is your blockchain doomed? Bloomberg Business Week, Mar. 22 ,  2018.

A Data Structure for Integrity Protection with Erasure Capability

Audit and Accountability
System and Information Integrity
Media Protection
Identification and Authentication
Awareness and Training
System and Communications Protection
Access Control
Planning
Incident Response
Risk Assessment
Personnel Security
System and Services Acquisition
Supply Chain Risk Management
Maintenance
Physical Protection
Security Assessment


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for System and Information Integrity?

[Assistant]
According to Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171:

........................................................................ | CHAPTERONE INTRODUCTION......................................................................................................
|
|--------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------|
| 1.1 PURPOSEANDAPPLICABILITY                                                                                | ................................................................................................... 3                                            |
| 1.2 TARGET AUDIENCE                                                                                | .................................................................................................................. 4                             |
| 1.3 ORGANIZATIONOF THIS SPECIAL PUBLICATION                                                                                | .......................................................................... 4                                                                     |
| CHAPTERTWO THE FUNDAMENTALS............................................................................................ 5                        | CHAPTERTWO THE FUNDAMENTALS............................................................................................ 5                        |
| 2.1 DEVELOPMENTAPPROACH ......................................................................................................

Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Configuration Management?

[Assistant]
According to A Zero Trust Architecture Model for Access Control in Cloud-Native Applications in Multi-Cloud Environments:

Each service mesh instance has two main logical components: 1) a control plane that implements the APIs needed to define various configurations and policies that govern access between various microservices in that cluster and 2) a data plane that enforces those policies at runtime. However, a uniform set of policies is also needed to govern access between any pair of microservices or services in the enterprise irrespective of their location or the service mesh instance of which they are a part. This requires a global control plane that can define a uniform set of policies applicable to the entire set of services that operate in the enterprise and disseminate them to the control planes of the individual service mesh instances. It is technically possible to have a single service mesh control plane instance (i.e., single service mesh instance) that manages multiple clusters spanning multiple environments (i.e., on-premises and on clouds). However, this architecture may make the multiple clusters a single failure domain and potentially defeat the very purpose of designing a multi-cluster configuration (i.e., availability). Thus, running a service mesh control plane instance for each cluster isolates the failure domain and improves availability and scalability. Further, providing the required underlying network connectivity to facilitate every workload (since each workload or application instance has an associated sidecar proxy that forms the data plane) to communicate with a single

Note on the above recommendation: In an ideal situation, services would be authenticated for each service request. Since this is highly disruptive from the point of view of application transaction response, this authentication is accomplished at the connection level via mutual Transport Layer Security  (mTLS) when a service makes an initial connection establishment as part of its inter-service call. This authentication is not performed again in subsequent calls.

A Zero Trust Architecture Model for Access Control in Cloud-Native Applications in Multi-Cloud Environments


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Likely Exploited Vulnerabilities_ A Proposed Metric for Vulnerability Exploitation Probability provide? (Part 10)

[Assistant]
e United States National Vulnerability Database (NVD) provides information and references for all CVEs [8]. ## 2.2. Exploit Prediction Scoring System

EPSS provides a daily updated score for each CVE.
These scores are estimated probabilities that each CVE will be observed to be exploited in the wild within the next 30 days. The EPSS scores are widely accepted by the security industry as shown by the scores being incorporated into 111 security products as of January 2025 [10]. However, security experts debate the pros and cons of using it (e.g., [11], [12]). The scores are created using a machine learning model trained with several thousand inputs. Training data is provided by a small number of enterprise security monitoring companies, each of which has a large, deployed sensor net to observe exploitation activity for their enterprise customers. Discussed more thoroughly in Sec. 5.1, EPSS was designed to not include past vulnerability exploitation as an input into its model. This makes the model blind to past exploitation, resulting in inaccurate scores (i.e., probabilities) for vulnerabilities that have been previously exploited. The scores will be too low. A vulnerability that is exploited in a 30-day period will NOT receive a bump up in EPSS score in the subsequent 30-day period. This is not an error as it enables the model to be predictive and have more accurate results for vulnerabilities that have not been previously exploited. EPSS version 1 was first released 2021-4-14; it was updated to version 2 on 2022-2-04. A much more accurate version 3 was released on 2023-3-07. A research paper explaining EPSS is available at [4]. ## 2.3. Known Exploited Vulnerability Lists

KEV lists identify vulnerabilities that are known to have been exploited in the past. Typically, once a vulnerability is added to a KEV list, it stays on the list permanently. Vulnerabilities not on a list have an unknown status relative to past exploitation.

Likely Exploited Vulnerabilities_ A Proposed Metric for Vulnerability Exploitation Probability


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Transitioning to the Security Content Automation Protocol (SCAP) Version 2 provide? (Part 9)

[Assistant]
transport layer interoperability, forces redundant posture information collection and evaluation that adds to system and network load, reduces modularity of solutions, and increases integration costs.
Difficult Content Creation and Limited Content Availability: Development of content in SCAP v1 usually requires 1) familiarity with complex SCAP v1 languages; and 2) knowledge of the low-level system artifacts needed to direct collection and evaluate endpoint posture. Finding SCAP content developers that have the necessary skills and knowledge to do both can be challenging. This has increased the time and expense necessary to create content, causing limited content availability. Limited Software Inventory and Patch Support: In SCAP v1, the Common Platform Enumeration (CPE) [3] provides the ability to identify the software product vendor, name, and version, along with a limited set of additional metadata. Unfortunately, CPEs inadequately express granular metadata about software releases and version ranges needed to accurately identify vulnerable software. Another limitation of CPE is the inability to identify software patches, which further hampers software inventory and vulnerability management capabilities. A revised SCAP approach is needed to address these gaps. Such an effort is larger than what can be realistically accomplished in a minor SCAP v1 revision. Due to the scope of these changes, a major revision of SCAP, SCAP v2, is needed. ## 3 SCAP v2

SCAP v2 is the next major release of SCAP. SCAP v2 will focus on addressing the SCAP v1 gaps identified in section 2. SCAP v.2 will continue to support the same use cases of SCAP v1 while also adding support for use cases not supported by SCAP v1. SCAP v2 will be developed iteratively. The first version of SCAP v2, SCAP 2.0, will focus on improving support for software inventory and vulnerability management use cases.

Transitioning to the Security Content Automation Protocol (SCAP) Version 2


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Incident Response?

[Assistant]
According to Security and Privacy Controls for Information Systems and Organizations:

............................................................. 16
3.1   ACCESS CONTROL ..................................................................................................................
18
3.2   AWARENESS AND TRAINING ................................................................................................... 59
3.3   AUDIT AND ACCOUNTABILITY ................................................................................................. 65
3.4   ASSESSMENT, AUTHORIZATION, AND MONITORING ................................................................. 83
3.5   CONFIGURATION MANAGEMENT ........................................................................................... 96
3.6   CONTINGENCY PLANNING .................................................................................................... 115
3.7   IDENTIFICATION AND AUTHENTICATION ............................................................................... 131
3.8   INCIDENT RESPONSE ............................................................................................................ 149
3.9   MAINTENANCE .................................................................................................................... 162
3.10   MEDIA PROTECTION .......................................................................................................... 171
3.11   PHYSICAL AND ENVIRONMENTAL PROTECTION .................................................................... 179
3.12   PLANNING ........................................................................................................................ 194
3.13   PROGRAM MANAGEMENT ................................................................................................. 203
3.14   PERSONNEL SECURITY ........................................................................................................ 222
3.15   PERSONALLY IDENTIFIABLE INFORMATION PROCESSING AND TRANSPARENCY .......................


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Communications Protection?

[Assistant]
According to Zero Trust Architecture:

El NCPS (por su nombre en inglés National Cybersecurity Protection System y conocido operativamente como Einstein) es un sistema integrado que incluye subsistemas. Este ofrece servicios de detección de intrusiones, análisis avanzados, intercambio de información y prevención de intrusiones para defender al Gobierno Federal de las ciberamenazas. Los objetivos del NCPS, que se alinean con los objetivos generales de la confianza cero, consisten en gestionar el riesgo cibernético, mejorar la ciberprotección y capacitar a los socios para asegurar el ciberespacio. Los sensores de Einstein permiten al Centro Nacional de Integración de la Ciberseguridad y las Comunicaciones (NCCIC, por su nombre en inglés National Cybersecurity and Communications Integration Center) de la Agencia de Seguridad de Infraestructura y Ciberseguridad CISA (por su nombre en inglés Cybersecurity and Infrastructure Security Agency) responder a incidentes significativos en las agencias federales y defender sus redes.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Services Acquisition?

[Assistant]
According to Risk Management Framework for Information Systems and Organizations_ A System Life Cycle Approach for Security and Privacy:

There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts, practices, and methodologies, may be used by federal agencies even before the completion  of  such  companion  publications. Thus,  until  each  publication  is  completed,  current requirements, guidelines, and procedures, where they exist, remain operative. For planning and transition purposes, federal agencies may wish to closely follow the development of these new publications by NIST. The National Institute of Standards and Technology (NIST) Information Technology Laboratory (ITL) promotes the U.S. economy and public welfare by providing technical leadership for the Nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology (IT). ITL's responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the costeffective security of other than national security-related information in federal information systems. The Special Publication 800-series reports on ITL's research, guidelines, and outreach efforts in information systems security and privacy and its collaborative activities with industry, government, and academic organizations. This publication describes the Risk Management Framework (RMF) and provides guidelines for applying the RMF to information systems and organizations. The RMF provides a disciplined, structured, and flexible process for managing security and privacy risk that includes information security categorization; control selection, implementation, and assessment; system and common control authorizations; and continuous monitoring.

Risk Management Framework for Information Systems and Organizations_ A System Life Cycle Approach for Security and Privacy


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Identification and Authentication?

[Assistant]
According to Data Integrity_ Detecting and Responding to Ransomware and Other Destructive Events:

• Provides ability to enforce policy across the enterprise. • Provides ability to quarantine devices across the enter- prise. • Provides ability to sanitize files through file reconstruc- tion. • Provides ability to revert changes to domain services. | DE.CM-5, RS.RP-1, RS.MI-1, RS.MI-2        |
| Reporting                  | Micro Focus ArcSight ESM v7.0 Patch 2                                                                   | • Provides ability to send security alerts based on organi- zational policy. • Provides ability to provide reports of enterprise health. • Provides ability to provide reports of malware detection across the enterprise. | DE.AE-5, RS.RP-1, RS.CO-2                 |


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Configuration Management?

[Assistant]
According to Control Baselines for Information Systems and Organizations:

## Control Baselines for Information Systems and Organizations

## Control Baselines for Information Systems and Organizations

This publication provides security and privacy control baselines for the Federal Government. There are three security control baselines (one for each system impact level-low-impact, moderate-impact, and high-impact), as well as a privacy baseline that is applied to systems irrespective of impact level. In addition to the control baselines, this publication provides tailoring guidance and a set of working assumptions that help guide and inform the control selection process. Finally, this publication provides guidance on the development of overlays to facilitate control baseline customization for specific communities of interest, technologies, and environments of operation.

Control Baselines for Information Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Media Protection?

[Assistant]
According to Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations:

...........................................................64                           |                                                                                |
| A.1.2.
Selecting, Tailoring, and Implementing C-SCRM Security Controls ...........................................67                                  |                                                                                |
| A.2.3. FAMILY: ACCESS CONTROL.........................................................................................................69              |                                                                                |
| A.2.4. FAMILY: AWARENESS AND TRAINING........................................................................................76                       |                                                                                |
| A.2.5. FAMILY: AUDIT AND ACCOUNTABILITY......................................................................................79                       |                                                                                |
| A.2.6. FAMILY: ASSESSMENT, AUTHORIZATION, AND MONITORING..................................................84                                          |                                                                                |
| A.2.7. FAMILY: CONFIGURATION MANAGEMENT................................................................................87                             |                                                                                |
| A.2.8. FAMILY: CONTINGENCY PLANNING ...........................................................................................98                     |                                                                                |
| A.2.9.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Incident Response?

[Assistant]
According to Secure Software Development Practices for Generative AI and Dual-Use Foundation Models_ An SSDF Community Profile:

| Practice | Task | Priority | Recommendations [R], Considerations [C], and Notes [N] Specific to AI Model Development | Informative References | |------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------| | | requirements, as defined by the organization, throughout their life cycles.

Secure Software Development Practices for Generative AI and Dual-Use Foundation Models_ An SSDF Community Profile


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AC.L2-3.1.3 (NIST 3.1.3)?

[Assistant]
According to Audit and Evaluation of Computer Security II_ System Vulnerabilities and Controls:

3.1.3                                            | Vulnerabilities of Media                                                        | 6-7       |
|               | 3. 3.1.3 Threats from Within and Threats from Without                                                                            | 3. 3.1.3).

Audit and Evaluation of Computer Security II_ System Vulnerabilities and Controls


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AC.L2-3.1.2 (NIST 3.1.2)?

[Assistant]
According to Approaches and Challenges of Federal Cybersecurity Awareness Programs:

3.1.2                                                                                | Obtaining Training Content... 3.1.2 Obtaining Training Content

We asked how the participant's organization obtained required security awareness training content (select all that apply) (see Figure 2).

Approaches and Challenges of Federal Cybersecurity Awareness Programs


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Maintenance?

[Assistant]
According to Overview and Considerations of Access Control Based on Attribute Encryption:

September 2023 INCLUDES UPDATES AS OF 12-20-2023; SEE APPENDIX A

Hu VC (2023) Overview and Considerations of Access Control Based on Attribute Encryption. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Interagency or Internal Report (IR) NIST IR 8450-upd1, Includes updates as of December 20, 2023. https://doi.org/10.6028/NIST.IR.8450-upd1

| [SHINDE]    | Shinde S (2020) Privacy Teaching Series: What is Functional Encryption? OpenMined Functional Encryption. Available at https://blog.openmined.org/privacy-teaching-series-what-is-functional-encryption                                                                                |
|-------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| [SP800-162] | Hu VC, Ferraiolo D, Kuhn R, Schnitzer A, Sandlin K, Miller R, Scarfone K (2014) Guide to Attribute-Based Access Control (ABAC) Definition and Considerations. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) 800-162, Includes updates as of August 02, 2019. https://doi.org/10.6028/NIST.SP.800-162 |
| [SP800-186] | Chen L, Moody D, Regenscheid AR, Robinson AY, Randall K (2023) Recommendations for Discrete Logarithm-based Cryptography: Elliptic Curve Domain Parameters. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) NIST SP 800-186. https://doi.org/10.6028/NIST.SP.800-186                                   |
| [SP800-56A] | Barker EB, Chen L, Roginsky AL, Vassilev A, Davis R (2018) Recommendation for Pair-Wise Key-Establishment Schemes Using Discrete Logarithm Cryptography.

Overview and Considerations of Access Control Based on Attribute Encryption


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice CM.L2-3.4.3 (NIST 3.4.3)?

[Assistant]
According to Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171:

3.4.3e Employ automated discovery and management tools to maintain an up-to-date, complete, accurate, and readily available inventory of system components. 3.4.3. 3.4.3e | Employ automated discovery and management tools to maintain an up-to-date, complete, accurate, and readily available inventory of system components.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice IA.L2-3.5.2 (NIST 3.5.2)?

[Assistant]
According to Digital Identity Guidelines_ Identity Proofing and Enrollment:

3.5.2 of SP 800-63

16.

Digital Identity Guidelines_ Identity Proofing and Enrollment


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Guidelines for Media Sanitization provide? (Part 5)

[Assistant]
------------------------------------------|
| 1. Introduction...................................................................................................................................2 |
| 2.
Background....................................................................................................................................5  |
| 3. Summary of Sanitization Methods..................................................................................................8               |
| 3.1.1. Clear Sanitization Method............................................................................................................8       |
| 3.1.2. Purge Sanitization Method.........................................................................................................10         |
| 3.1.3. Destroy Sanitization Method......................................................................................................11          |
| 3.2.1. Strength of Cryptography for CE ................................................................................................12           |
| 3.2.2. Applicability of CE.......................................................................................................................13 |
| 3.2.3. Sanitization of Keys ....................................................................................................................13  |
| 3.2.4. Quality of Cryptographic Implementations................................................................................15                   |
| 3.2.5. Traceability of CE Operations.....................................................................................................16         |
| Media Sanitization Program .........................................................................................................18              |
| 4. |
| 4.3.1.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Access Control on NoSQL Databases provide? (Part 9)

[Assistant]
tructured data like documents, emails, and social media. NoSQL databases are particularly useful for managing unstructured or very large data objects stored across distributed and cooperating devices.
Use cases for retrieving such data range from critical scenarios (e.g., storing financial data and healthcare records) to more casual applications (e.g., chat log data, video, and images, readings from smart devices). Major Web 2.0 companies have developed or adopted different flavors of NoSQL databases to meet their growing data and infrastructure needs. NoSQL database systems and data stores often outperform traditional RDBMS in various aspects, such as data analysis efficiency, system performance, ease of deployment, flexibility/scalability of data management, and users' availability. However, with an increasing number of people storing sensitive data in NoSQL databases, security issues have become critical concerns. NoSQL databases suffer from vulnerabilities, particularly due to the lack of effective support for data protection, including weak authorization mechanisms. As access control is a fundamental data protection requirement of any database management system (DBMS), this document discusses access control on NoSQL database systems by illustrating the NoSQL database types along with their support for access control models and describing considerations from the perspective of access control. ## 1. Introduction

NoSQL stands for 'not only SQL' or 'non-SQL,' which typically refers to any non-relational database that stores data in a format other than relational tables. It emerged in the late 2000s, triggered by the growing popularity of distributed systems, such as cloud computing and big data, which required a shift away from relational databases (RDBMS) toward NoSQL databases.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Identification and Authentication?

[Assistant]
According to Security and Privacy Controls for Information Systems and Organizations:

CHAPTER ONE   INTRODUCTION ...................................................................................................... 1
1.1   PURPOSE AND APPLICABILITY ................................................................................................... 2
1.2   TARGET AUDIENCE .................................................................................................................. 3
1.3   ORGANIZATIONAL RESPONSIBILITIES......................................................................................... 3
1.4   RELATIONSHIP TO OTHER PUBLICATIONS ................................................................................... 5
1.5   REVISIONS AND EXTENSIONS .................................................................................................... 5
1.6   PUBLICATION ORGANIZATION .................................................................................................. 5
CHAPTER TWO   THE FUNDAMENTALS ............................................................................................ 7
2.1   REQUIREMENTS AND CONTROLS .............................................................................................. 7
2.2   CONTROL STRUCTURE AND ORGANIZATION .............................................................................. 8
2.3   CONTROL IMPLEMENTATION APPROACHES ............................................................................. 11
2.4   SECURITY AND PRIVACY CONTROLS ......................................................................................... 13
2.5   TRUSTWORTHINESS AND ASSURANCE ..................................................................................... 14
CHAPTER THREE   THE CONTROLS ................................................................................................. 16
3.1   ACCESS CONTROL ..................................................................................................................

Security and Privacy Controls for Information Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice CM.L2-3.4.2 (NIST 3.4.2)?

[Assistant]
According to Guide to Malware Incident Prevention and Handling for Desktops and Laptops:

3.4.2                                                                                | Intrusion Prevention Systems... 3.4.2 Intrusion Prevention Systems

Network-based intrusion prevention systems (IPS) perform packet sniffing and analyze network traffic to identify and stop suspicious activity.

Guide to Malware Incident Prevention and Handling for Desktops and Laptops


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Services Acquisition?

[Assistant]
According to Secure Software Development Practices for Generative AI and Dual-Use Foundation Models_ An SSDF Community Profile:

## Secure Software Development Practices for Generative AI and Dual-Use Foundation Models

## Secure Software Development Practices for Generative AI and Dual-Use Foundation Models

There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may be used by federal agencies even before the completion of such companion publications. Thus, until each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning and transition purposes, federal agencies may wish to closely follow the development of these new publications by NIST.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Federal Cybersecurity Awareness Programs_ A Mixed Methods Research Study provide? (Part 2)

[Assistant]
es  even  before  the  completion  of  such  companion  publications. Thus,  until  each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative.
For planning  and  transition  purposes,  federal  agencies  may  wish  to  closely  follow  the  development  of  these  new publications by NIST. Organizations are encouraged to review all draft publications during public comment periods and provide feedback to NIST. Many NIST cybersecurity publications, other than the ones noted above, are available at https://csrc.nist.gov/publications. \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

## Reports on Computer Systems Technology

The  Information  Technology  Laboratory  (ITL)  at  the  National  Institute  of  Standards  and Technology  (NIST)  promotes  the  U.S. economy  and  public  welfare  by  providing  technical leadership  for  the  Nation's  measurement  and  standards  infrastructure. ITL  develops  tests,  test methods, reference data, proof of concept implementations, and technical analyses to advance the development  and  productive  use  of  information  technology. ITL's  responsibilities  include  the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in federal information systems. ## Abstract

Prior  industry  surveys  and  research  studies  have  revealed  that  organizational  cybersecurity awareness  (hereafter  shortened  to  'security  awareness')  programs  may  face  a  number  of challenges, including lack of: leadership support; resources; and staff with sufficient background and  skills  to  implement  an  effective  and  engaging  program.

Federal Cybersecurity Awareness Programs_ A Mixed Methods Research Study


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Physical Protection?

[Assistant]
According to Guide to Malware Incident Prevention and Handling for Desktops and Laptops:

The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the Nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology. ITL's responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in Federal information systems. The Special Publication 800-series reports on ITL's research, guidelines, and outreach efforts in information system security, and its collaborative activities with industry, government, and academic organizations. - -Organizations should be prepared to shut down or block services used by malware to contain an incident and should understand the consequences of doing so. Organizations should also be prepared to respond to problems caused by other organizations disabling their own services in response to a malware incident. - -Organizations should be prepared to place additional temporary restrictions on network connectivity to contain a malware incident, such as suspending Internet access or physically disconnecting hosts from networks, recognizing the impact that the restrictions might have on organizational functions. -  Eradication. The primary goal of eradication is to remove malware from infected hosts. Because of the potential need for extensive eradication efforts, organizations should be prepared to use various combinations of eradication techniques simultaneously for different situations.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Validating the Integrity of Computing Devices provide? (Part 6)

[Assistant]
ompliance with any regulatory initiatives. Your organization's information security experts should identify the products that will best integrate with your existing tools and IT system infrastructure.
Your organization can adopt this solution or one that adheres to these guidelines in whole, or you can use this guide as a starting point for tailoring and implementing parts of a solution. ## HOW TO USE THIS GUIDE

Depending on your role in your organization, you might use this guide in different ways:

Business decision makers, including chief information security and technology officers can use this part of the guide, NIST SP 1800-34a: Executive Summary , to understand the drivers for the guide, the cybersecurity challenge we address, our approach to solving this challenge, and how the solution could benefit your organization. Technology, security, and privacy program managers who are concerned with how to identify, understand, assess, and mitigate risk can use NIST SP 1800-34b: Approach, Architecture, and Security Characteristics . It describes what we built and why, including the risk analysis performed and the security/privacy control mappings. IT professionals who want to implement an approach like this can make use of NIST SP 1800-34c: HowTo Guides . It provides specific product installation, configuration, and integration instructions for building the example implementation, allowing you to replicate all or parts of this project. ## SHARE YOUR FEEDBACK

You can view or download the guide at https://www.nccoe.nist.gov/supply-chain-assurance. Help the NCCoE make this guide better by sharing your thoughts with us as you read the guide. If you adopt this solution for your own organization, please share your experience and advice with us.

Validating the Integrity of Computing Devices


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Workshop on Enhancing Security of Devices and Components Across the Supply Chain provide? (Part 10)

[Assistant]
tel's supply chain. Intel discovered that each of their teams approached the exercise of threat modeling in different ways, which made it difficult and time-consuming for them to exchange information.
As a result, Intel has been developing and deploying a unified Threat Modeling Tool that utilizes vulnerability resources like MITRE Common Weakness Enumeration (CWE) to automatically make design-based suggestions on potential vulnerabilities and mitigations. The tool also forms a closed loop that incorporates knowledge learned from Intel's own design processes. Matthew also described Intel's Transparent Supply Chain Initiative, whose goal is to provide customers with provenance and integrity data for various components during the supply chain process. He highlighted Project Amber - Intel's Trust Authority for validating execution environments. ## 2.1.2. Key Highlights

The following key points were identified during the speakers' presentations and the Q&A portion:

- There is a definite need for continued public-private partnerships. - There is a need for more standards to guide how the supply chain process is structured. - There is a need for more standardized methods for threat modeling. - Quantifying the return on investment for security in the supply chain is still difficult, making it challenging for those who observe deficiencies to justify addressing them to higher-level management. Possible avenues of advancement include:
- o Developing more standardized security metrics
- o Continuing to leverage and develop CSF-style resources to better communicate risk
- o Framing security as a service that can be used as a revenue stream

- There is a tension between hardware security and software security due to the vastly different costs in remediating vulnerabilities at the hardware level. ## 2.2.

Workshop on Enhancing Security of Devices and Components Across the Supply Chain


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Awareness and Training?

[Assistant]
According to Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule_ A Cybersecurity Resource Guide:

.................44                   |
| 5.1.7. Contingency Plan (§ 164.308(a)(7))............................................................................................47             |
| 5.1.8.
Evaluation (§ 164.308(a)(8)).......................................................................................................51        |
| 5.2.1. Facility Access Controls (§ 164.310(a)).......................................................................................56             |
| 5.1.9. Business Associate Contracts and Other Arrangements (§ 164.308(b)(1))................................54                                      |
| 5.2.2. Workstation Use (§ 164.310(b)).................................................................................................59            |
| 5.2.3. Workstation Security (§ 164.310(c)) ..........................................................................................61             |

Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule_ A Cybersecurity Resource Guide


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Identification and Authentication?

[Assistant]
According to Assessing Security and Privacy Controls in Information Systems and Organizations:

CHAPTER ONE INTRODUCTION ............................................................................................................... 1
1.1   PURPOSE AND APPLICABILITY .......................................................................................................... 1
1.2   TARGET AUDIENCE ............................................................................................................................ 4
1.3   RELATED PUBLICATIONS AND ASSESSMENT PROCESSES ............................................................... 4
1.4   ORGANIZATION OF THIS PUBLICATION ........................................................................................... 5
CHAPTER TWO THE FUNDAMENTALS ..................................................................................................... 6
2.1   ASSESSMENTS WITHIN THE SYSTEM DEVELOPMENT LIFE CYCLE .................................................. 6
2.2   CONTROL STRUCTURE AND ORGANIZATION .................................................................................. 7
2.3   BUILDING AN EFFECTIVE ASSURANCE CASE .................................................................................... 8
2.4   ASSESSMENT PROCEDURES: ASSESSMENT OBJECTS, METHODS AND OBJECTIVES ................... 11
CHAPTER THREE THE PROCESS ............................................................................................................. 19
3.1   PREPARE FOR SECURITY AND PRIVACY CONTROL ASSESSMENTS ............................................... 19
3.2   DEVELOP SECURITY AND PRIVACY ASSESSMENT PLANS .............................................................. 23
3.3   CONDUCT SECURITY AND PRIVACY CONTROL ASSESSMENTS ..................................................... 30
3.4   ANALYZE ASSESSMENT REPORT RESULTS .....................................................................................

Assessing Security and Privacy Controls in Information Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Awareness and Training?

[Assistant]
According to Access Control on NoSQL Databases:

.....................................6 |
| 2.2.4. Security Deficiencies.....................................................................................................................7     |
| 3.
Access Control Model on NoSQL Database Systems.........................................................................8                            |
| 3.2.1. Key-Value Model ........................................................................................................................10      |
| 3.2.2. Wide-Column and Document Models........................................................................................10                       |
| 3.2.3. Graph Model...............................................................................................................................12    |
| 4. Considerations of Access Control for NoSQL Systems.....................................................................15                           |
| 5. Conclusion ...................................................................................................................................19    |
| References.......................................................................................................................................20    |
| Appendix A......................................................................................................................................22     |


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 2 require for Media Protection?

[Assistant]
According to Assessing Security Requirements for Controlled Unclassified Information:

| Access Control                    | Maintenance         | Security Assessment and Monitoring   |
|-----------------------------------|---------------------|--------------------------------------|
| Awareness and Training            | Media Protection    | System and Communications Protection |
| Audit and Accountability          | Personnel Security  | System and Information Integrity     |
| Configuration Management          | Physical Protection | Planning                             |
| Identification and Authentication | Risk Assessment     | System and Services Acquisition      |
| Incident Response                 |                     | Supply Chain Risk Management         |

[SELECT FROM: maintenance policy and procedures; procedures for system maintenance tools; system maintenance tools; maintenance tool inspection records; equipment sanitization records; media sanitization records; system security plan; other relevant documents or records]

[SELECT FROM: personnel with system maintenance responsibilities; personnel responsible for media sanitization; personnel with information security responsibilities]

Assessing Security Requirements for Controlled Unclassified Information


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Maintenance?

[Assistant]
According to Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule_ A Cybersecurity Resource Guide:

ns that a regulated entity must make regarding addressable implementation specifications, and requires the maintenance of security measures to continue reasonable and appropriate protection of ePHI
2.
Administrative Safeguards - Defined in the Security Rule as the 'administrative actions and policies, and procedures to manage the selection, development, implementation, and maintenance of security measures to protect electronic protected health information and to manage the conduct of the covered entity's workforce in relation to the protection of that information'
3. Physical Safeguards - Defined as the 'physical measures, policies, and procedures to protect a covered entity's electronic information systems and related buildings and equipment, from natural and environmental hazards, and unauthorized intrusion'


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Guidelines for the Use of PIV Credentials in Facility Access provide? (Part 8)

[Assistant]
d facilities. It does not address non-PIV credentials that may be issued to populations that do not fall under the scope of HSPD-12 but require access to federal facilities. ## Table of Contents

| 1.
| Introduction........................................................................................................................... 1   |
|------|---------------------------------------------------------------------------------------------------------------------------------------------|
| 1.1  | Background....................................................................................................................1             |
| 1.2  | Purpose and Scope.........................................................................................................1                 |
| 2. | Characteristics of PIV Implementations ............................................................................ 3                       |
| 2.1  | Benefits of the Complete Implementation.....................................................................3                               |
| 2.2  | Qualities of the Complete Implementation....................................................................4                               |
| 2.3  | Interoperability Qualities...............................................................................................5                  |
| 2.4  | Infrastructure Requirements ..........................................................................................6                     |
| 3. | Threat Environment.............................................................................................................

Guidelines for the Use of PIV Credentials in Facility Access


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Identification and Authentication?

[Assistant]
According to Assessing Security and Privacy Controls in Information Systems and Organizations:

NTROL ASSESSMENTS ..................................................... 30
3.4   ANALYZE ASSESSMENT REPORT RESULTS .....................................................................................
32
3.5   ASSESS SECURITY AND PRIVACY CAPABILITIES .............................................................................. 34
CHAPTER FOUR SECURITY AND PRIVACY ASSESSMENT PROCEDURES ................................................. 37
4.1   ACCESS CONTROL............................................................................................................................ 40
4.2   AWARENESS AND TRAINING ........................................................................................................ 118
4.3   AUDIT AND ACCOUNTABILITY ...................................................................................................... 128
4.4   ASSESSMENT, AUTHORIZATION, AND MONITORING ................................................................. 160
4.5   CONFIGURATION MANAGEMENT ................................................................................................ 177
4.6   CONTINGENCY PLANNING ............................................................................................................ 215
4.7   IDENTIFICATION AND AUTHENTICATION .................................................................................... 243
4.8   INCIDENT RESPONSE ............................................................................................................... 275
4.9   MAINTENANCE ........................................................................................................................ 298
4.10   MEDIA PROTECTION .............................................................................................................. 316
4.11   PHYSICAL AND ENVIRONMENTAL PROTECTION .......................................................................


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 1 require for Access Control?

[Assistant]
According to IoT Device Cybersecurity Capability Core Baseline:

T)\_Security\_and\_Privacy\_Recommendations.pdf
- [7] Cloud Security Alliance (CSA) IoT Working Group (2015) Identity and Access Management for the Internet of Things. (Cloud Security Alliance [CSA]).
https://cloudsecurityalliance.org/download/identity-and-access-management-for-the-iot/
- [8] Council to Secure the Digital Economy (CSDE) (2019) The C2 Consensus on IoT Device Security Baseline Capabilities. (Council to Secure the Digital Economy [CSDE]). https://securingdigitaleconomy.org/wp-content/uploads/2019/09/CSDE\_IoT-C2-Consensus-Report\_FINAL.pdf
- [9] CTIA (2018) CTIA Cybersecurity Certification Test Plan for IoT Devices, Version 1.0.1. (CTIA, Washington, DC). https://www.ctia.org/about-ctia/test-plans/
- [10] European Union Agency for Network and Information Security (ENISA) (2017) Baseline Security Recommendations for IoT in the context of Critical Information Infrastructures. (European Union Agency for Network and Information Security [ENISA], Athens, Greece). https://www.enisa.europa.eu/publications/baseline-securityrecommendations-for-iot

IoT Device Cybersecurity Capability Core Baseline


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 2 require for Access Control?

[Assistant]
According to Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations:

......................98      |
| Table 11. Maintenance (MA) ......................................................................................................................98      |
| Table 12.
Media Protection (MP)................................................................................................................99        |
| Table 13. Physical and Environmental Protection (PE)...............................................................................99                    |
| Table 14. Planning (PL)..............................................................................................................................100 |
| Table 15. Program Management (PM) .....................................................................................................100               |
| Table 16. Personnel Security (PS) .............................................................................................................101       |
| Table 17. PII Processing and Transparency (PT) .......................................................................................102                |
| Table 18. Risk Assessment (RA) ................................................................................................................102       |
| Table 19. System and Services Acquisition (SA)........................................................................................103                |
| Table 20. System and Communications Protection (SC)...........................................................................103                        |
| Table 21. System and Information Integrity (SI) .......................................................................................104               |
| Table 22. Supply Chain Risk Management (SR).........................................................................................105                  |
| Table 23.

Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 1 require for Maintenance?

[Assistant]
According to Summary Report for “Workshop on Updating Manufacturer Guidance for Securable Connected Product Development”:

| | Time | Title | Speaker(s)/Facilitators | |-------------------|--------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------| | 9:00AM - 9:15AM | Welcome, Agenda, Goals for the day | Michael Fagan, NIST | | 9:15AM - 9:55AM | Building More Secure Devices Using Threat Modeling with MITRE EMB3D | David Keppler, Senior Principal Cybersecurity Engineer, MITRE Jack Cyprus, Cybersecurity Engineer, MITRE | | 9:55AM - 10:35AM | Secure by Design considerations for OT | Matthew Rogers, Industrial Control System (ICS) Expert, CISA | | 10:35AM - 11:15AM | Life in Maintenance Mode: What it means to keep connected devices secure | Stacey Higginbotham, Policy Fellow at Consumer Reports | | 11:15AM - 11:55AM | Getting Smart: An Overview of IoT Privacy | Dylan Gilbert, Privacy Policy Advisor, NIST | | 11:55AM - 12:00PM | Closing of the Morning Hybrid Session | Michael Fagan, NIST | | 12:00PM - 1:00PM | Break | Break | | 1:00PM - 2:00PM | Discussion Session 1 - NIST IR 8259 Post-Market Activities update | Greg Witte, Palydin, Facilitator | | 2:00PM - 2:15PM | Break | Break | | 2:15PM - 3:15PM | Discussion Session 2 - NIST IR 8259 Pre-Market Activities | Christine Abruzzi, Cacapon Cyber Solutions, Facilitator | | 3:15PM

Summary Report for “Workshop on Updating Manufacturer Guidance for Securable Connected Product Development”


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does The Federal Cybersecurity Awareness Workforce_ Professional Backgrounds, Knowledge, Skills, and Development Activities provide? (Part 7)

[Assistant]
reness positions; and advocate for federal security awareness professionals. The results may also be valuable to security awareness professionals outside of the government who face similar challenges.
\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

## PROFESSIONAL BACKGROUNDS, KNOWLEDGE, SKILLS,  AND DEVELOPMENT ACTIVITIES

## Table of Contents

| EXECUTIVE SUMMARY........................................................................................................III                                                                                | EXECUTIVE SUMMARY........................................................................................................III                                                                                | EXECUTIVE SUMMARY........................................................................................................III                                                                                |
|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| 1 INTRODUCTION.................................................................................................................

The Federal Cybersecurity Awareness Workforce_ Professional Backgrounds, Knowledge, Skills, and Development Activities