[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Risk Assessment?

[Assistant]
According to NIST Cybersecurity Framework 2.0_ Quick-Start Guide for Cybersecurity Supply Chain Risk Management (C-SCRM):

- Integrate C-SCRM into cybersecurity and enterprise risk management, risk assessment, and improvement processes, and monitor the performance of C-SCRM practices throughout the technology lifecycle. [GV.SC-03, GV.SC-09] See the Enterprise Risk Management Quick-Start Guide for more information on C-SCRM integration.

☐ vet their employees and guard against insider threats

- Risk Assessment: The authenticity and integrity of hardware and software are assessed prior to acquisition and use [ID.RA-09]; Critical suppliers are assessed prior to acquisition [ID.RA-10]
- Improvement: Improvements are identified from security tests and exercises, including those done in coordination with suppliers and relevant third parties [ID.IM-02]

NIST Cybersecurity Framework 2.0_ Quick-Start Guide for Cybersecurity Supply Chain Risk Management (C-SCRM)


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Personnel Security?

[Assistant]
According to Control Baselines for Information Systems and Organizations:

| CHAPTERONE INTRODUCTION...................................................................................................... 1               | CHAPTERONE INTRODUCTION...................................................................................................... 1               | CHAPTERONE INTRODUCTION...................................................................................................... 1   |
|-----------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------|
| 1.1                                                                                | PURPOSEANDAPPLICABILITY ................................................................................................... | 1                                                                                |
| 1.2                                                                                | TARGET AUDIENCE .................................................................................................................. | 2                                                                                |
| 1.3                                                                                | ORGANIZATIONAL RESPONSIBILITIES .........................................................................................

Control Baselines for Information Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Information Integrity?

[Assistant]
According to Summary of NIST SP 800-53, Revision 4_ Security and Privacy Controls for Federal Information Systems and Organizations:

As the risk to an information system's confidentiality, integrity and/or availability increases, the need for additional controls to protect the system may also increase accordingly.  SP 800-53 Revision 4 provides the security control baselines as the starting point for the security control selection process. The baselines are chosen based on the security category and associated impact level of information systems as described in Federal Information Processing Standard Publication (FIPS) 199, Standards for Security Categorization of Federal Information and Information Systems, and FIPS Publication 200, Minimum Security Requirements for Federal Information and Information Systems .

- Authority and Purpose (AP);
- Accountability, Audit, and Risk Management (AR);
- Data Quality and Integrity (DI);
- Data Minimization and Retention (DM);
- Individual Participation and Redress (IP);
- Security (SE);
- Transparency (TR); and,
- Use Limitation (UL).

Summary of NIST SP 800-53, Revision 4_ Security and Privacy Controls for Federal Information Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Security Assessment?

[Assistant]
According to Audit and Evaluation of Computer Security II_ System Vulnerabilities and Controls:

## Audit and Evaluation of Computer Security II: System Vulnerabilities and Controls

## Audit and Evaluation of Computer Security II: System Vulnerabilities and Controls NATIOIVAX.

The National Bureau of Standards, with the support of the U.S. General Accounting Office, sponsored a second invitational workshop on computer security audit, entitled "Audit and Evaluation of Computer Security II: System Vulnerabilities and Controls," In Miami Beach, Florida, on November 28-30, 1978. A cross-section of highly qualified people In the computer science and EDP audit fields was assembled to develop material that would be directly usable for a Federal Information Processing Standard (FTPS) Guideline on the subject. Tn order to cover the material in a systematic fashion, the workshop was partitioned into three management sessions and five technical sessions. The management sessions addressed Managerial and Organizational Vulnerabilities and Controls at the Staff Level (1 session) and the Line Level (2 sessions). The technical sessions addressed vulnerabilities and controls in the areas of Terminal and Remote Peripherals, Communication Components, Operating Systems, Applications and Non- Integrated Data Files, and Data Base/ Data Base Management Systems. These Proceedings are the reports developed by the eight sessions of the workshop.

Audit and Evaluation of Computer Security II_ System Vulnerabilities and Controls


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice IR.L2-3.6.5 (NIST 3.6.5)?

[Assistant]
According to Audit and Evaluation of Computer Security II_ System Vulnerabilities and Controls:

3.6.5 Classification Schemes                                                                                | Encryption                                                                                | 10-12 10-12 |
| 3. 3.6.5 Encryption ; While access control and inference are discouraging, database encryption is thought (by some) to be a more promising tool in database security [6].


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Configuration Management?

[Assistant]
According to Analyzing Collusion Threats in the Semiconductor Supply Chain:

## 3.4. Analyze the Effect of Collusion Among Adversaries in Different Stages

Analyzing Collusion Threats in the Semiconductor Supply Chain


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Physical Protection?

[Assistant]
According to A Zero Trust Architecture Model for Access Control in Cloud-Native Applications in Multi-Cloud Environments:

et of cybersecurity paradigms that move defenses from static, network-based perimeters to focus on users and resources. It is a set of security primitives rather than a particular set of technologies.
Zero trust assumes that there is no implicit trust granted to user accounts based solely on their physical or network location (i.e., local area networks versus the internet) or to endpoints (devices) based on their ownership (e.g., enterprise or personally owned). Zero trust focuses on protecting resources (e.g., devices, services, workflows, network accounts) rather than network segments, as the network location is no longer seen as the prime component to the security posture of the resource. - A zero trust architecture uses zero trust principles to plan industrial and enterprise infrastructures and workflows.

A Zero Trust Architecture Model for Access Control in Cloud-Native Applications in Multi-Cloud Environments


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Planning?

[Assistant]
According to Audit and Evaluation of Computer Security:

the National Bureau of Standards.
rity audit project, Mrs. Ruthberg worked closely with Mr. McKenzie on
the planning, acted as the Workshop arrangements chairman, and is co-
editor of these Proceedings.
in computer science at NBS and most recently has become active in the
managerial procedures required for computer security.

Introduction
Planning by Management
Management Control .....
ADP Security
2.4.1
2.4.2
2.4.3
2.4.4
2.4.5

INITIATING THE WORKSHOP
PLANNING THE WORKSHOP
2.1
2.2
2.3
AT THE WORKSHOP
THE SESSION REPORTS

Audit and Evaluation of Computer Security


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations provide? (Part 5)

[Assistant]
ards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology.
ITL's responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in federal information systems. The Special Publication 800-series reports on ITL's research, guidelines, and outreach efforts in information system security, and its collaborative activities with industry, government, and academic organizations. ## Patent Disclosure Notice

NOTICE: ITL has requested that holders of patent claims whose use may be required for compliance with the guidance or requirements of this publication disclose such patent claims to ITL. However, holders of patents are not obligated to respond to ITL calls for patents and ITL has not undertaken a patent search in order to identify which, if any, patents may apply to this publication. As of the date of publication and following call(s) for the identification of patent claims whose use may be required for compliance with the guidance or requirements of this publication, no such patent claims have been identified to ITL. No representation is made or implied by ITL that licenses are not required to avoid patent infringement in the use of this publication. ## Table of Contents

| 1. Introduction.....................................................................................................................................1   |
|---------------------------------------------------------------------------------------------------------------------------------------------------------|
| 1.4.1. Enterprise Risk Management and C-SCRM Owners and Operators.............................................5                                         |
| 1.4.2.

Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations

Audit and Accountability
System and Information Integrity
Security Assessment
Media Protection
Identification and Authentication
Awareness and Training
System and Communications Protection
Access Control
Planning
Incident Response
Risk Assessment
Personnel Security
System and Services Acquisition
Supply Chain Risk Management
Maintenance
Physical Protection
Configuration Management


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Incident Response?

[Assistant]
According to Digital Identity Guidelines_ Authentication and Authenticator Management:

3.2.8. Authentication Intent
An authentication process demonstrates intent if it requires the claimant to respond
explicitly to each authentication or reauthentication request. The goal of authentication
intent is to make it more difficult for authenticators (e.g., multi-factor cryptographic
authenticators) to be used without the claimant’s knowledge, such as by malware on
the endpoint. The authenticator itself  SHALL  establish authentication intent. Multi-
factor authenticators  MAY  establish intent by reentry of the activation factor for the
authenticator.

Some technologies (e.g., the emerging device bound session credentials specification
[DBSC]) mitigate the risk of theft of session secrets by using cryptographic protocols
that prove the possession of a session secret rather than using them as bearer tokens.
These technologies might additionally store and use these session secrets in protected
keystores to reduce the risk of exfiltration by malware. Session secrets used with such
proof of possession techniques  MAY  persist. However, RPs and CSPs  SHALL  ensure that
the session lifetime limits described in Sec. 2.2.3 are enforced even when a knowledge of
the session secret is demonstrated.

Ensure the endpoint’s security
before use, especially with
respect to freedom from malware
(e.g., key loggers).

Digital Identity Guidelines_ Authentication and Authenticator Management


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 1 require for Configuration Management?

[Assistant]
According to IoT Non-Technical Supporting Capability Core Baseline:

## IoT Non-Technical Supporting Capability Core Baseline

## Internet of Things Non-Technical Supporting Capability Core Baseline

Non-technical supporting capabilities are actions a manufacturer or third-party organization performs in support of the cybersecurity of an IoT device. This publication defines an Internet of Things (IoT) device manufacturers' non-technical supporting capability core baseline , which is a set of non-technical supporting capabilities generally needed from manufacturers or other third parties to support common cybersecurity controls that protect an organization's devices as well as device data, systems, and ecosystems. The purpose of this publication is to provide organizations a starting point to use in identifying the non-technical supporting capabilities needed in relation to IoT devices they will manufacture, integrate, or acquire. This publication is intended to be used in conjunction with NISTIR 8259, Foundational Cybersecurity Activities for IoT Device Manufacturers and NISTIR 8259A, IoT Device Cybersecurity Capability Core Baseline.

IoT Non-Technical Supporting Capability Core Baseline


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Federal Cybersecurity Role-Based Training Approaches, Successes, and Challenges provide? (Part 9)

[Assistant]
y and Privacy Controls for Information Systems and Organizations , provides guidance for organizations in protecting their operations, assets, and personnel from security threats and risks [SP800-53].
Within the document, Awareness and Training Control (AT-3) 'Role-based Training' addresses training for personnel with 'responsibilities related to operations and supply chain risk management within the context of organizational security and privacy programs.' Furthermore, organizations are instructed to document, monitor, and retain records for their training activities. In addition to federal personnel, RBT applies to contractors providing services to federal organizations. NIST SP 800-53 is a major basis for the Federal Information Security Modernization Act of 2014 (FISMA) [FISMA2014], which requires federal organizations to implement RBT [CISA2022]. ## There was no clear picture of how federal organizations conduct RBT and what challenges they experience when implementing these training activities. We conducted a prior study that explored federal security awareness programs through focus groups and a survey [IR8420][IR8420A] [IR8420B]. In the focus groups, we found that security awareness professionals were often also assigned responsibilities for role-based training activities, for which they identified significant challenges. However, at the time, no one had taken a broader look across federal organizations to see how RBT activities were implemented and what issues organizations were experiencing. This lack of understanding hindered the development of improvements and resources for federal RBT. ## We conducted a research study to explore the approaches and challenges of federal RBT activities. To address the lack of understanding about how RBT activities are implemented in the U.S. Federal Government, we conducted a study to answer the following questions:

- Q1. How do federal organizations determine which employees need to take RBT? - Q2.

Federal Cybersecurity Role-Based Training Approaches, Successes, and Challenges


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for Media Protection?

[Assistant]
According to Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171:

| FAMILY                            | FAMILY                               |
|-----------------------------------|--------------------------------------|
| Access Control                    | Media Protection                     |
| Awareness and Training            | Personnel Security                   |
| Audit and Accountability          | Physical Protection                  |
| Configuration Management          | Risk Assessment                      |
| Identification and Authentication | Security Assessment                  |
| Incident Response                 | System and Communications Protection |
| Maintenance                       | System and Information Integrity     |

17  The Audit and Accountability, Maintenance, Media Protection, and Physical Protection families do not contain enhanced security requirements at this time.

## 3.8   MEDIA PROTECTION

Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Federal Cybersecurity Role-Based Training Approaches, Successes, and Challenges provide? (Part 3)

[Assistant]
organizations are required to conduct cybersecurity role-based training for federal government personnel and supporting contractors who are assigned roles having security and privacy responsibilities.
Despite the training mandate, there has been little prior effort to look broadly across federal organizations to see how they are implementing these training activities and what issues they are experiencing. This lack of understanding may be hindering the development of improvements and resources for training activities. To address this gap, the Usable Cybersecurity team at the National Institute of Standards and Technology conducted a research study consisting of focus groups and a survey to gain insights into the approaches of and challenges faced by federal organizations when implementing role-based training activities. This paper reports the results of the study and suggests actions that organizations can take to improve federal role-based training activities.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Incident Response?

[Assistant]
According to Secure Software Development Framework (SSDF) Version 1.1_ Recommendations for Mitigating the Risk of Software Vulnerabilities:

This includes requirements from internal sources (e.g., the organization's policies, business objectives, and risk management strategy) and external sources (e.g., applicable laws and regulations). | PO.1.1 : Identify and document all security requirements for the organization's software development infrastructures and processes, and maintain the requirements over time. | Example 1 : Define policies for securing software development infrastructures and their components, including development endpoints, throughout the SDLC and maintaining that security. Example 2 : Define policies for securing software development processes throughout the SDLC and maintaining that security, including for open-source and other third-party software components utilized by software being developed. Example 3 : Review and update security requirements at least annually, or sooner if there are new requirements from internal or external sources, or a major security incident targeting software development infrastructure has occurred. Example 4 : Educate affected individuals on impending changes to requirements.

Secure Software Development Framework (SSDF) Version 1.1_ Recommendations for Mitigating the Risk of Software Vulnerabilities


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Services Acquisition?

[Assistant]
According to Security and Privacy Controls for Information Systems and Organizations:

There may be references in this publication to other publications currently under development by
NIST in accordance with its assigned statutory responsibilities. The information in this publication,
including concepts, practices, and methodologies may be used by federal agencies even before the
completion  of  such  companion  publications.  Thus,  until  each  publication  is  completed,  current
requirements, guidelines,  and  procedures, where  they  exist,  remain  operative.  For  planning  and
transition  purposes,  federal  agencies  may  wish  to  closely  follow  the  development  of  these  new
publications by NIST.

The National Institute of Standards and Technology (NIST) Information Technology Laboratory
(ITL) promotes the U.S. economy and public welfare by providing technical leadership for the
Nation’s measurement and standards infrastructure. ITL develops tests, test methods, reference
data, proof of concept implementations, and technical analyses to advance the development
and productive use of information technology (IT). ITL’s responsibilities include the development
of management, administrative, technical, and physical standards and guidelines for the cost-
effective security of other than national security-related information in federal information
systems. The Special Publication 800-series reports on ITL’s research, guidelines, and outreach
efforts in information systems security and privacy and its collaborative activities with industry,
government, and academic organizations.

DEVELOPMENT OF INFORMATION SYSTEMS, COMPONENTS, AND SERVICES

Security and Privacy Controls for Information Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Cryptographic Module Validation Program (CMVP)-Approved Sensitive Security Parameter Generation and Establishment Methods_ CMVP Validation Authority U provide? (Part 3)

[Assistant]
l official. This publication may be used by nongovernmental organizations on a voluntary basis and is not subject to copyright in the United States. Attribution would, however, be appreciated by NIST.
## NIST Technical Series Policies

Copyright, Use, and Licensing Statements NIST Technical Series Publication Identifier Syntax

## Publication History

Approved by the NIST Editorial Review Board on 2023-03-30 Supersedes NIST Special Publication (SP) 800-140Dr1 (May 2022) https://doi.org/10.6028/NIST.SP.800-140Dr1

## How to Cite this NIST Technical Series Publication:

Calis A (2023) Cryptographic Module Validation Program (CMVP)-Approved Sensitive Security Parameter Generation and Establishment Methods: CMVP Validation Authority Updates to ISO/IEC 24759. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) NIST SP 800-140Dr2. https://doi.org/10.6028/NIST.SP.800-140Dr2

## Author ORCID iDs

Alexander Calis: 0000-0003-1937-8129

## Contact Information

sp800-140-comments@nist.gov

National Institute of Standards and Technology Attn: Computer Security Division, Information Technology Laboratory 100 Bureau Drive (Mail Stop 8930) Gaithersburg, MD 20899-8930

All comments are subject to release under the Freedom of Information Act (FOIA). ## Abstract

The approved sensitive security parameter generation and establishment methods listed in this publication replace the ones listed in International Organization for Standardization/International Electrotechnical Commission (ISO/IEC) 19790 Annex D and ISO/IEC 24759 paragraph 6.16, within the context of the Cryptographic Module Validation Program (CMVP). As a validation authority, the CMVP may supersede Annex D in its entirety. This document also supersedes SP 800-140Dr1.

Cryptographic Module Validation Program (CMVP)-Approved Sensitive Security Parameter Generation and Establishment Methods_ CMVP Validation Authority U


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice IR.L2-3.6.2 (NIST 3.6.2)?

[Assistant]
According to Guide to Auditing for Controls and Security_ A System Development Life Cycle Approach:

3.6.2                                                     | Potential Effects of Deficiencies on Meeting System Mission | Potential Effects of Deficiencies on Meeting System Mission | ... 3.6.2 Potential Effects of Deficiencies on Meeting System Mission - The impact of the identified deficiencies on completing the system mission must be determined.

Guide to Auditing for Controls and Security_ A System Development Life Cycle Approach


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Audit and Evaluation of Computer Security provide? (Part 4)

[Assistant]
ional units:

Office of Standard Reference Data — Office of Information Activities — Office of Technical Publications — Library —
Office of International Standards — Office of International Relations.
' Headquarters and Laboratories at Gaithersburg, Maryland, imless otherwise noted; mailing address Washington, D.C. 20234. ^ Located at Boulder, Colorado 80302. ona! Bureau oi i>ianaarg®

OCT 2 6 1977

- COMPUTER SCIENCE & TECHNOLOGY:

>cioo

.)^^

1)6

Audit and Evaluation
of Computer Security ^

Proceedings of the NBS Invitational Workshop
held at Miami Beach, Florida, March 22-24, 1977

Edited by:

Zella G. Ruthberg

Institute for Computer Sciences and Technology
National Bureau of Standards
Washington, D. C. 20234

Robert G. McKenzie

General Accounting Office
Washington, D. C. 20548

Session Chairpersons;

William E. Perry

C. O. Smith

Blake Greenlee
Carl Hammer
W. H. Murray
Clark Weissman
Leonard 1. Krauss

Jerry FitzGerald
Richard D. Webb
Hart J. Will

^^^^^^ °' oo,

U.S. DEPARTMENT OF COMMERCE, Juanita M. Kreps, Secretary

Dr. Sidney Harman, Under Secretary
Jordan J. Baruch, Assistant Secretary for Science and Technology
U A . NATIONAL BUREAU OF STANDARDS, Ernest Ambler, Acting Director

Issued October 1977

Reports on Computer Science and Technology

The National Bureau of Standards has a special responsibility within the Federal
Government for computer science and technology activities. The programs of the
NBS Institute for Computer Sciences and Technology are designed to provide ADP
standards, guidelines, and technical advisory services to improve the effectiveness of
computer utilization in the Federal sector, and to perform appropriate research and
development efforts as foundation for such activities and programs. This publication
series will report these NBS efforts to the Federal computer community as well as to
interested specialists in the academic and private sectors.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Assessing Enhanced Security Requirements for Controlled Unclassified Information provide? (Part 6)

[Assistant]
However, holders of patents are not obligated to respond to ITL calls for patents and ITL has not undertaken a patent search in order to identify which, if any, patents may apply to this publication.
As of the date of publication and following call(s) for the identification of patent claims whose use may be required for compliance with the guidance or requirements of this publication, no such patent claims have been identified to ITL. No representation is made or implied by ITL that licenses are not required to avoid patent infringement in the use of this publication. \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

## CAUTIONARY NOTE

The generalized assessment procedures described in this publication provide a framework and starting point for developing specific procedures to assess the enhanced security requirements in NIST Special Publication 800-172. The assessment procedures can be used to help generate and evaluate the relevant evidence needed to determine if the security safeguards employed by organizations are implemented correctly, operating as intended, and satisfy the enhanced security requirements. Organizations have the flexibility to tailor the assessment procedures by selecting the assessment methods and objects needed to achieve the assessment objectives. There is no expectation that every assessment method and object in an assessment procedure will be used for every assessment. In addition, there is significant flexibility in the scope of the assessment and the degree of rigor applied during the assessment process. The assessment procedures can support self-assessments, third-party assessments, or assessments conducted by sponsoring organizations (e.g., government agencies). Such approaches may be specified in contracts or in agreements by participating parties.

Assessing Enhanced Security Requirements for Controlled Unclassified Information


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Access Control?

[Assistant]
According to Guidelines for Media Sanitization:

| Executive Summary............................................................................................................................1      |
|-----------------------------------------------------------------------------------------------------------------------------------------------------|
| 1. Introduction...................................................................................................................................2 |
| 2. Background....................................................................................................................................5  |
| 3. Summary of Sanitization Methods..................................................................................................8               |
| 3.1.1. Clear Sanitization Method............................................................................................................8       |
| 3.1.2. Purge Sanitization Method.........................................................................................................10         |
| 3.1.3. Destroy Sanitization Method......................................................................................................11          |
| 3.2.1. Strength of Cryptography for CE ................................................................................................12           |
| 3.2.2. Applicability of CE.......................................................................................................................13 |
| 3.2.3. Sanitization of Keys ....................................................................................................................13  |
| 3.2.4. Quality of Cryptographic Implementations................................................................................15                   |
| 3.2.5.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Information Integrity?

[Assistant]
According to Guidelines for the Use of PIV Credentials in Facility Access:

The PIV System protects the trustworthiness of the PIV Card data objects through PIV Card access rules and digital signatures. Overall trust in the execution of a PIV authentication mechanism is also dependent on correct operation of the PIV Card, the PACS, and the PIV Card validation infrastructure, and, to a degree, on protecting the confidentiality, integrity, and availability of the communication channels among them. Attacks may, therefore, be directed against any of these components, with varying difficulty and potential impact.

9  Secure messaging is an optional mechanism specified in [SP 800-73] that provides confidentiality and integrity protection for the card commands that are sent to the card as well as for the responses received from the PIV Card.

The PIV and PACS systems are complex, and this brief discussion has focused on properties of the PIV Card. A number of other attack vectors have not been discussed in detail, including sophisticated technical attacks against the integrity of the PIV Card, PIV System, or PACS components, and cryptanalysis of the PIV cryptographic algorithms. While the impact of successful attacks such as these could be moderate to high, the probability of success is believed to be extremely low.

Guidelines for the Use of PIV Credentials in Facility Access


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Planning?

[Assistant]
According to Analyzing Collusion Threats in the Semiconductor Supply Chain:

nd sensitive data are loaded into the manufactured IC. Standard data are generic and mostly available open source, but the sensitive data are anything whose disclosure would compromise IP or security.
For example, keys of crypto modules or logic locking keys are sensitive data. 7. Deployment and Use: This stage includes delivering the IC to customers and using the IC. Many hardware vulnerabilities are exploited at this stage. 8. End of Life: End-of-life for an IC is the stage where the manufacturer no longer sells or manufactures IC [8]. This is often because of technological advancements when new ICs exhibiting better performance have been launched. When a chip reaches its end-of-life, the deployed chips are gradually replaced and discarded. These discarded chips are


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Planning?

[Assistant]
According to Approaches and Challenges of Federal Cybersecurity Awareness Programs:

utomated means where we do tie it into our backend account management system so that, truly, people aren't getting access to things before they've taken that training and signed the rules of behavior.
So, automation is key because the level of effort for, particularly, smaller agencies, where they may not have access to tools or there's a single person, is really impactful and inefficient.' (S11)

| Type of Data                              | Example Responses                                                                                |   Number Participants |
|-------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-----------------------|
| Security incidents                        | 'We also need incidents more granularly analyzed and categorized as to the types of human actions/inactions that contributed, and who, so we can adjust both general training and targeted follow-up training with individuals (i.e.

Approaches and Challenges of Federal Cybersecurity Awareness Programs


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule_ A Cybersecurity Resource Guide provide? (Part 5)

[Assistant]
and 'need not' indicate a course of action permissible within the limits of the publication. The terms 'can' and 'cannot' indicate a possibility and capability, whether material, physical, or causal.
## Disclaimer

This publication offers general guidance and is provided for informational purposes. This publication should not be construed or relied upon as legal advice or guidance. This document does not modify the Health Insurance Portability and Accountability Act of 1996 (HIPAA), the Health Information Technology for Economic and Clinical Health (HITECH) Act, or any other federal law or regulation. The participation of other federal organizations with the National Institute of Standards and Technology (NIST) in the development of this Special Publication does not and shall not be deemed to constitute the endorsement, recommendation, or approval by those organizations of its contents. The use of this publication or any other NIST publication does not ensure or guarantee that an organization will be compliant with the Security Rule. ## Patent Disclosure Notice

NOTICE: ITL has requested that holders of patent claims whose use may be required for compliance with the guidance or requirements of this publication disclose such patent claims to ITL. However, holders of patents are not obligated to respond to ITL calls for patents and ITL has not undertaken a patent search in order to identify which, if any, patents may apply to this publication. As of the date of publication and following call(s) for the identification of patent claims whose use may be required for compliance with the guidance or requirements of this publication, no such patent claims have been identified to ITL. No representation is made or implied by ITL that licenses are not required to avoid patent infringement in the use of this publication.

Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule_ A Cybersecurity Resource Guide


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Planning for a Zero Trust Architecture_ A Planning Guide for Federal Administrators provide? (Part 9)

[Assistant]
afeguards should be in place to protect the confidentiality and integrity of data in transit. If a resource cannot provide this functionality natively, a separate PEP component may be necessary. - II.
Access to individual enterprise resources is granted on a per -session basis. In an ideal zero trust architecture, every unique operation would undergo authentication and authorization before the operation is performed. For example, a delete operation following a read operation to a database should trigger an additional authentication and authorization check. This level of granularity may not always possible and other mitigating solutions such as logging and backups, may be needed to detect and recover from unauthorized operations. Enterprise administrators will need to plan how to enforce fine grain access policies on individual resources. If the security tools used by

the enterprise do not allow this, other solutions such as logging, versioning tools, or backups may help achieve the desired access control outcome and manage this risk. - III. Access to resources is determined by dynamic policy-including the observable state of client identity, application/service, and the requesting asset-and may include other behavioral and environmental attributes. In zero trust, the default behavior for all resources is to deny all connections and only accept connections that are explicitly allowed by policy. Those authorized to access the resource must still authenticate themselves and prove they meet the enterprise policy to be granted the session. This may include meeting requirements such as client software versions, patch level, geolocation, historical request patterns, etc. Note that it may not be possible to perform all checks at the time of each access request, some policy check may be performed on an independent schedule (e.g., daily software versioning checks). - IV.

Planning for a Zero Trust Architecture_ A Planning Guide for Federal Administrators


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 1 require for Audit and Accountability?

[Assistant]
According to IoT Non-Technical Supporting Capability Core Baseline:

Documentation captures information potential customers and others in the ecosystem may need to know about the IoT devices and ways in which it, and associated data and systems, can be secured. Such documentation is also often necessary prior to purchase and throughout the IoT device's lifecycle for the customer and others in the ecosystem (e.g., auditors and assessors). This documentation supports the appropriate treatment of risk, compliance, and assurance from internal and external perspectives when the IoT device and associated systems are implemented within the customer environment. As shown in Figure 1, documentation acts as a pillar of support for other non-technical capabilities. This is because other non-technical capabilities, including those in the IoT non-technical supporting baseline, will use the information captured via documentation to customize their delivery.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Identification and Authentication?

[Assistant]
According to Recommendation for Pair-Wise Key-Establishment Schemes Using Discrete Logarithm Cryptography:

s, Symbols and Abbreviations ............................................................... | 3. Definitions, Symbols and Abbreviations ...............................................................
| 2                                                                                |
|                                                                                | 3.1                                                                                | Definitions........................................................................................................................ | 2                                                                                |
|                                                                                | 3.2                                                                                | Symbols and Abbreviations ............................................................................................. | 9                                                                                |
| 4. Overview of Key-Establishment Schemes........................................................... | 4. Overview of Key-Establishment Schemes........................................................... | 4. Overview of Key-Establishment Schemes...........................................................

Recommendation for Pair-Wise Key-Establishment Schemes Using Discrete Logarithm Cryptography


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 2 require for Planning?

[Assistant]
According to Profile of the IoT Core Baseline for Consumer IoT Products:

There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may be used by federal agencies even before the completion of such companion publications. Thus, until each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning and transition purposes, federal agencies may wish to closely follow the development of these new publications by NIST.

Profile of the IoT Core Baseline for Consumer IoT Products


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Awareness and Training?

[Assistant]
According to Report on the Design-A-Thon_ Designing Effective and Accessible Approaches for Digital Product Cybersecurity Education and Awareness:

## Report on the Design-A-Thon: Designing Effective and Accessible Approaches for Digital Product Cybersecurity Education and Awareness

## Report on the Design-A-Thon: Designing Effective and Accessible Approaches for Digital Product Cybersecurity Education and Awareness

Fagan M, Haney J, Eliot D, Cuthill B, Rigopoulos K (2025) Report on the Design-A-Thon: Designing Effective and Accessible Approaches for Digital Product Cybersecurity Education and Awareness. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Interagency or Internal Report (IR) NIST IR 8558. https://doi.org/10.6028/NIST.IR.8558

Report on the Design-A-Thon_ Designing Effective and Accessible Approaches for Digital Product Cybersecurity Education and Awareness


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Services Acquisition?

[Assistant]
According to Recommendation for Pair-Wise Key-Establishment Using Integer Factorization Cryptography:

There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may  be  used  by  federal  agencies  even  before  the  completion  of  such  companion  publications.  Thus,  until  each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning  and  transition  purposes,  federal  agencies  may  wish  to  closely  follow  the  development  of  these  new publications by NIST.

The  Information  Technology  Laboratory  (ITL)  at  the  National  Institute  of  Standards  and Technology  (NIST)  promotes  the  U.S.  economy  and  public  welfare  by  providing  technical leadership  for  the  Nation's  measurement  and  standards  infrastructure.  ITL  develops  tests,  test methods, reference data, proof of concept implementations, and technical analyses to advance the development  and  productive  use  of  information  technology.  ITL's  responsibilities  include  the development of management, administrative, technical, and physical standards and guidelines for the  cost-effective  security  and  privacy  of  other  than  national  security-related  information  in Federal  information  systems.  The  Special  Publication  800-series  reports  on  ITL's  research, guidelines, and outreach efforts in information system security, and its collaborative activities with industry, government, and academic organizations.

This section describes the basic cryptographic elements that support the development of the keyestablishment schemes specified in this Recommendation. The schemes described herein are based upon the correct implementation of these elements.

Recommendation for Pair-Wise Key-Establishment Using Integer Factorization Cryptography


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Data Integrity_ Detecting and Responding to Ransomware and Other Destructive Events provide? (Part 4)

[Assistant]
curity Framework in April 2018 to help organizations better manage and reduce cybersecurity risk to critical infrastructure and other sectors. The framework core contains five functions, listed below.
-  Identify - develop an organizational understanding to manage cybersecurity risk to systems, people, assets, data, and capabilities
-  Protect - develop and implement appropriate safeguards to ensure delivery of critical services
-  Detect - develop and implement appropriate activities to identify the occurrence of a cybersecurity event
-  Respond - develop and implement appropriate activities to take action regarding a detected cybersecurity incident
-  Recover - develop and implement appropriate activities to maintain plans for resilience and to restore any capabilities or services that were impaired due to a cybersecurity incident

<!-- image -->

For more information, see the Framework for Improving Critical Infrastructure Cybersecurity v1.1. Applying the Cybersecurity Framework to data integrity, this practice guide informs organizations of how to quickly detect and respond to data integrity attacks by implementing appropriate activities that immediately inform about the data integrity events. The NCCoE developed and implemented a solution that incorporates multiple systems working in concert to detect an ongoing data integrity cybersecurity event. Additionally, the solution provides guidance on how to respond to the detected event. Addressing these functions together enables organizations to have the necessary tools to act during a data integrity attack. The NCCoE sought existing technologies that provided the following capabilities:

- event detection
- integrity monitoring
- logging
- reporting
- mitigation and containment
- forensics/analytics

-  While the NCCoE used a suite of commercial products to address this challenge, this guide does not endorse these particular products, nor does it guarantee compliance with any regulatory initiatives.

Data Integrity_ Detecting and Responding to Ransomware and Other Destructive Events


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Identification and Authentication?

[Assistant]
According to Risk Management Framework for Information Systems and Organizations_ A System Life Cycle Approach for Security and Privacy:

iving privacy inquiries from the public. Organizations identify and select the set of common controls and allocate those controls to the organizational entities designated as common control providers.
Common controls may differ based upon a variety of factors, such as hosting location, system architecture, and the structure of the organization. The organization-wide list of common controls takes these factors into account. Common controls can also be identified at different levels of the organization (e.g., corporate, department, or agency level; bureau or subcomponent level; or individual program level). Organizations may establish one or more lists of common controls that can be inherited by information systems. A requirement may not be fully met by a common control. In such cases, the control is considered a hybrid control and is noted as such by the organization, including specifying which parts of the control requirement are provided for inheritance by the common control and which parts are to be provided at the system level.

Risk Management Framework for Information Systems and Organizations_ A System Life Cycle Approach for Security and Privacy


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Risk Assessment?

[Assistant]
According to Ordered t-way Combinations for Testing State-based Systems:

Vulnerability and fault detection often depend on the specific  order  of  inputs  that  establish  states  which eventually lead to a failure. That is, many software processes  are  not  deterministic  functions  where  an input produces the same output whenever the process is invoked irrespective of previous invocations. This is  particularly  true  of  real-time  systems,  which  are designed  to  run  continuously,  maintain  states,  and respond to a changing series of inputs. Such systems are typically driven by a loop function that accepts input values, processes and responds to those inputs, and  updates  its  current  state.  Examples  include network protocols and data servers. The system state may change, depending on input, and the system may subsequently respond differently to the same input. That is, the response of the process to a particular set of input values may depend on its current state, such as whether a communication protocol is in a listen or connection-open state. The current state depends on the  order  of  input  values  that  were  contained  in previously received packets. The same sort of statedependent  behavior  occurs  in  many  other  types  of systems as well.

Ordered t-way Combinations for Testing State-based Systems


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What guidance does Protecting Controlled Unclassified Information (CUI)_ NIST Special Publication 800-171, Revision 3. Small Business Primer provide?

[Assistant]
<!-- image -->

<!-- image -->

Howard Lutnick, Secretary of Commerce

<!-- image -->

Protecting Controlled Unclassified Information (CUI): NIST Special Publication 800-171, Revision 3 Small Business Primer

## Purpose of this Primer

This guide provides small businesses with an overview of NIST Special Publication (SP) 800-171 Revision 3, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations . The following pages contain:

- An overview of foundational components of SP 800-171
- A list of frequently asked questions and their answers
- Tips for getting started
- Related resources

## What is Controlled Unclassified Information (CUI)?*

CUI is information the government creates or possesses, or that an entity creates or possesses on behalf of the government, that law, regulation, or governmentwide policy requires you to take technical and operational steps to protect. Systems that process, store, and transmit CUI often support government programs involving sensitive critical assets. As part of a contractual agreement with the federal government, or possibly with other organizations like municipal governments, prime contractors, universities, etc., you will likely be required to demonstrate you are taking adequate measures to protect CUI.

Protecting Controlled Unclassified Information (CUI)_ NIST Special Publication 800-171, Revision 3. Small Business Primer


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Maintenance?

[Assistant]
According to Protecting Information and System Integrity in Industrial Control System Environments_ Cybersecurity for the Manufacturing Sector:

.................. | 50     |
| 5.3.3   | PR.AC-4: Access Permissions and Authorizations are Managed, Incorporating the Principles of Least Privilege and Separation of Duties .........................
50                                                          |        |
| 5.3.4   | PR.AC-7: Users, Devices, and Other Assets are Authenticated (e.g., single-factor, multi-factor) Commensurate with the Risk of the Transaction (e.g., Individual Security and Privacy Risks and Other Organizational Risks) | 50     |
| 5.3.5   | PR.DS-1: Data-at-Rest is Protected......................................................................... | 51     |
| 5.3.6   | PR.DS-6: Integrity Checking Mechanisms are Used to Verify Software, Firmware, and Information Integrity ..................................................................... | 51     |
| 5.3.7   | PR.IP-4: Backups of Information are Conducted, Maintained, and Tested............ | 51     |
| 5.3.8   | PR.MA-1: Maintenance and Repair of Organizational Assets are Performed and Logged, with Approved and Controlled Tools ...................................... | 51     |
| 5.3.9   | PR.MA-2: Remote Maintenance of Organizational Assets is Approved, Logged, and Performed in a Manner that Prevents Unauthorized Access............... | 51     |
| 5.3.10  | DE.AE-1: A Baseline of Network Operations and Expected Data Flows for Users Systems is Established and Managed................................................... | and 52 |
| 5.3.11  | DE.AE-2: Detected Events are Analyzed to Understand Attack Targets And Methods                                                                                |        |

Protecting Information and System Integrity in Industrial Control System Environments_ Cybersecurity for the Manufacturing Sector


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Digital Identity Guidelines provide? (Part 9)

[Assistant]
ibutions
and review. The authors would also like to acknowledge the past contributions of Donna
F. Dodson, Elaine M. Newton, Ray A. Perlner, W. Timothy Polk, Emad A. Nabbus, Paul A. Grassi, Michael E.
Garcia, Kaitlin Boeckl, Joni Brennan, Ellen Nadeau, Ben Piccarreta, and
Danna Gabel O’Rourke. vi

NIST SP 800-63-4
July 2025

1. Introduction

This section is informative. Digital Identity Guidelines

The rapid proliferation of online services over the past few years has heightened the
need for reliable, secure, and privacy-protective digital identity solutions. A digital
identity is always unique in the context of an online service. However, a person could
have multiple digital identities and, while a digital identity could relay a unique and
specific meaning within the context of an online service, the real-life identity of the
individual behind the digital identity might not be known. When confidence in a person’s
real-life identity is not required to provide access to an online service, organizations can
use anonymous or pseudonymous accounts. In all other use cases, a digital identity is
intended to establish trust between the holder of the digital identity and the person,
organization, or system interacting with the online service. However, this process can
present challenges. There are multiple opportunities for mistakes, miscommunication,
and attacks that fraudulently claim another person’s identity. Additionally, given the
broad range of individual needs, constraints, capacities, and preferences, online services
must be designed with flexibility and customer experience in mind to support broad and
enduring participation and access to online services. Digital identity risks are dynamic and exist along a continuum. Consequently, a digital
identity risk management approach should seek to manage risks using outcome-based
approaches that are designed to meet the organization’s unique needs.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Strategies for the Integration of Software Supply Chain Security in DevSecOps CI_CD Pipelines provide? (Part 9)

[Assistant]
eats can arise from attack vectors unleashed by malicious actors during SSC activities as well as defects introduced when due diligence practices are not followed by legitimate actors during the SDLC.
Executive Order (EO) 14028, NIST's Secure Software Development Framework (SSDF) [2], other government initiatives, and industry forums have discussed the security of SSC and provided a roadmap to enhance the security of all deployed software. This document uses this roadmap as the basis for developing actionable measures to integrate the various building blocks of SSC security assurance into CI/CD pipelines to enhance the preparedness of organizations to address SSC security in the development and deployment of cloud-native applications. To demonstrate that the SSC security integration strategies for CI/CD pipelines meet the objectives of SSDF, a mapping of these strategies to the high-level practices in the SSDF has also been provided. Building a robust SSC security edifice requires various artifacts, such as a software bill of materials (SBOM) and frameworks for the attestation of software components. Since the specification of these artifacts, their mandatory constituents, and the requirements that processes using them must satisfy are continually evolving through projects in government organizations and various industry forums, they are beyond the scope of this document. ## 1. Introduction

Cloud-native applications typically consist of multiple loosely coupled services or microservices and are sometimes accompanied by an integrated application service infrastructure, such as a service mesh. The applications are developed through an agile software development life cycle (SDLC) paradigm called DevSecOps, which uses flow processes called Continuous Integration/ Continuous Delivery (CI/CD) pipelines.

Strategies for the Integration of Software Supply Chain Security in DevSecOps CI_CD Pipelines


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Services Acquisition?

[Assistant]
According to Guidelines for the Use of PIV Credentials in Facility Access:

perform provisioning, enrollment, and finalization. + Fewer credentials. A single PIV Card provides a small set of authentication methods that are applicable to many applications and in many contexts.
This means significantly fewer identity credentials that need to be issued and significantly fewer account enrollments.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What guidance does Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations provide?

[Assistant]
<!-- image -->

## NIST Special Publication 800 NIST SP 800-171r3

## Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations

Ron Ross Victoria Pillitteri

This publication is available free of charge from:

https://doi.org/10.6028/NIST.SP.800-171r3

<!-- image -->

## NIST Special Publication 800 NIST SP 800-171r3

## Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations

Ron Ross Victoria Pillitteri Computer Security Division

Information Technology Laboratory

This publication is available free of charge from:

https://doi.org/10.6028/NIST.SP.800-171r3

May 2024

<!-- image -->

U.S. Department of Commerce Gina M. Raimondo, Secretary

Certain equipment, instruments, software, or materials, commercial or non-commercial, are identified in this paper in order to specify the experimental procedure adequately. Such identification does not imply recommendation or endorsement of any product or service by NIST, nor does it imply that the materials or equipment identified are necessarily the best available for the purpose. There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may be used by federal agencies even before the completion of such companion publications. Thus, until each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning and transition purposes, federal agencies may wish to closely follow the development of these new publications by NIST. Organizations are encouraged to review all draft publications during public comment periods and provide feedback to NIST. Many NIST cybersecurity publications, other than the ones noted above, are available at https://csrc.nist.gov/publications.

Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Personnel Security?

[Assistant]
According to Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule_ A Cybersecurity Resource Guide:

2. Identify reasonably anticipated threats. The regulated entity identifies the potential threat events and threat sources that are applicable to it and its operating environment. The list of threat events and threat sources should include reasonably anticipated and probable human and natural incidents that can negatively impact the regulated entity's ability to protect ePHI. Use the information gathered from Step 1 (i.e., the preparation step) to identify reasonably anticipated threats to ePHI. Be sure to consider threats to the confidentiality, integrity, and availability of ePHI via phishing, ransomware, or insider threat.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AU.L2-3.3.4 (NIST 3.3.4)?

[Assistant]
According to Recommendations for Federal Vulnerability Disclosure Guidelines:

3.3.4. 3.3.4.

Recommendations for Federal Vulnerability Disclosure Guidelines


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Communications Protection?

[Assistant]
According to Data Integrity_ Detecting and Responding to Ransomware and Other Destructive Events:

Prevention of damage to, protection of, and restoration of computers, electronic communications systems, electronic communications services, wire communication, and electronic communication, including information contained therein, to ensure its availability, integrity, authentication, confidentiality, and nonrepudiation. 1. Ensure that you have a current version of Oracle Java. You must install both the Java Runtime Environment (JRE) and the Java Cryptography Extension (JCE). 2. Download and run the JRE installer. 3. Click Install. 4. Download the JCE, and extract the files. 5. Copy the local\_policy.jar and US\_export\_policy.jar files to /lib/security/Unlimited/ and /lib/security/Limited in the Java installation directory. 6. Run install-server-windows-amd64. 7. Select the Java runtime that was just installed. 8. Click OK.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Recommendation for Pair-Wise Key-Establishment Schemes Using Discrete Logarithm Cryptography provide? (Part 9)

[Assistant]
| 5.2.1 MACTag Computation for Key Confirmation .................................................
| 20                                                                                |
|                                                                                |                                                                                | 5.2.2 MACTag Verification for Key Confirmation................................................... | 21                                                                                |
| 5.3                                                                                | Random Number Generation......................................................................................... | Random Number Generation......................................................................................... | 21                                                                                |
| 5.4                                                                                | Nonce............................................................................................................................ | Nonce............................................................................................................................


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Digital Identity Guidelines_ Authentication and Authenticator Management provide? (Part 10)

[Assistant]
5

65

66

66

66

66

67

68

68

69

71

76

76

79

81

87

87

87

88

89

90

v

NIST SP 800-63B-4
July 2025

Digital Identity Guidelines
Authentication and Authenticator Management

Appendix B.
Syncable Authenticators . . . . . . . . . . . . . . . . . . . . . . . . B.1. B.2. B.3. B.4. B.5. B.6. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Cloning Authentication Keys . . . . . . . . . . . . . . . . . . . . . . . . Implementation Requirements

. . . . . . . . . . . . . . . . . . . . . . Sharing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Example . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Security Considerations

. . . . . . . . . . . . . . . . . . . . . . . . . . Appendix C. List of Symbols, Abbreviations, and Acronyms . . . . . . . . . . . . 91

91

91

92

94

95

96

99

Appendix D. Glossary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 102

Appendix E. Change Log . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 117

List of Tables
Summary of requirements by AAL . . . . . . . . . . . . . . . . . . . . Table 1. Summary of secrets (non-normative)
. . . . . . . . . . . . . . . . . . Table 2. Authenticator threats . . . . . . . . . . . . . . . . . . . . . . . . . . . Table 3. Table 4. Mitigating authenticator threats . . . . . . . . . . . . . . . . . . . . . . . . . . . Syncable authenticator threats, challenges, and mitigations
Table 5. List of Figures
Fig. 1. Fig. 2. Fig. 3. Transfer of secret to primary device . . . . . . . . . . . . . . . . . . . . Transfer of secret to out-of-band device . . . . . . . . . . . . . . . . . . Usability considerations by authenticator type . . . . . . . . . . . . . .

Digital Identity Guidelines_ Authentication and Authenticator Management


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Recommendation for Pair-Wise Key-Establishment Using Integer Factorization Cryptography provide? (Part 3)

[Assistant]
aft publications during public comment periods and provide feedback to NIST. Many NIST cybersecurity publications, other than the ones noted above, are available at https://csrc.nist.gov/publications.
## Comments on this publication may be submitted to:

National Institute of Standards and Technology Attn: Computer Security Division, Information Technology Laboratory 100 Bureau Drive (Mail Stop 8930) Gaithersburg, MD 20899-8930 Email: SP800-56b\_comments@nist.gov

All comments are subject to release under the Freedom of Information Act (FOIA). ## Reports on Computer Systems Technology

The  Information  Technology  Laboratory  (ITL)  at  the  National  Institute  of  Standards  and Technology  (NIST)  promotes  the  U.S. economy  and  public  welfare  by  providing  technical leadership  for  the  Nation's  measurement  and  standards  infrastructure. ITL  develops  tests,  test methods, reference data, proof of concept implementations, and technical analyses to advance the development  and  productive  use  of  information  technology. ITL's  responsibilities  include  the development of management, administrative, technical, and physical standards and guidelines for the  cost-effective  security  and  privacy  of  other  than  national  security-related  information  in Federal  information  systems. The  Special  Publication  800-series  reports  on  ITL's  research, guidelines, and outreach efforts in information system security, and its collaborative activities with industry, government, and academic organizations. ## Abstract

This Recommendation specifies key-establishment schemes using integer factorization cryptography (in particular, RSA). Both key-agreement and key transport schemes are specified for pairs of entities, and methods for key confirmation are included to provide assurance that both parties share the same keying material. In addition, the security properties associated with each scheme are provided.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice CM.L2-3.4.4 (NIST 3.4.4)?

[Assistant]
According to Digital Identity Guidelines_ Identity Proofing and Enrollment:

3.4.4 of [SP800-63] for more information about the DIAS.

Digital Identity Guidelines_ Identity Proofing and Enrollment


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice CM.L2-3.4.2 (NIST 3.4.2)?

[Assistant]
According to Approaches and Challenges of Federal Cybersecurity Awareness Programs:

3.4.2 Handling Repeat Clickers... 3.4.2 Handling Repeat Clickers... 3.4.2 Handling Repeat Clickers

We also asked participants what happens to repeat clickers in their organization (those who repeatedly fall victim to phishing).

Approaches and Challenges of Federal Cybersecurity Awareness Programs


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AC.L2-3.1.10 (NIST 3.1.10)?

[Assistant]
According to Automated Secure Configuration Guidance from the macOS Security Compliance Project (mSCP):

3.1.10 cis: benchmark: - 2.

Automated Secure Configuration Guidance from the macOS Security Compliance Project (mSCP)


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Risk Assessment?

[Assistant]
According to Guide to Enterprise Patch Management Planning_ Preventive Maintenance for Technology:

enterprise patch management; patch; risk management; update; upgrade; vulnerability management. Leadership at all levels of the organization, business/mission owners, and security/technology management teams should jointly create an enterprise patch management strategy that simplifies and operationalizes patching while also improving its reduction of risk. This will strengthen organizational resiliency to active threats and minimize business and mission impacts. This publication provides recommendations for enterprise patch management planning. | Executive Summary..................................................................................................... | Executive Summary..................................................................................................... | Executive Summary.....................................................................................................

Guide to Enterprise Patch Management Planning_ Preventive Maintenance for Technology


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Control Baselines for Information Systems and Organizations provide? (Part 5)

[Assistant]
ce

Matthew A. Kozma Chief Information Officer

Dana Deasy

Chief Information Officer

John Sherman

Michael E. Waschull Deputy Chief Information Officer

Principal Deputy CIO

Mark Hakun

Clifford M.
Conner

Deputy CIO for Cybersecurity and DoD SISO

Cybersecurity Group and IC CISO

Kevin Dulany

Vacant

Director, Cybersecurity Policy and Partnerships

Director, Security Coordination Center

## National Institute of Standards and Technology

## Committee on National Security Systems

Charles H. Romine

Mark G.

Control Baselines for Information Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Services Acquisition?

[Assistant]
According to Cryptographic Module Validation Program (CMVP)-Approved Security Functions_ CMVP Validation Authority Updates to ISO_IEC 24759:

There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may be used by federal agencies even before the completion of such companion publications. Thus, until each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning and transition purposes, federal agencies may wish to closely follow the development of these new publications by NIST.

The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the Nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology. ITL's responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in federal information systems. The Special Publication 800-series reports on ITL's research, guidelines, and outreach efforts in information system security, and its collaborative activities with industry, government, and academic organizations.

Cryptographic Module Validation Program (CMVP)-Approved Security Functions_ CMVP Validation Authority Updates to ISO_IEC 24759


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Awareness and Training?

[Assistant]
According to Analyzing Collusion Threats in the Semiconductor Supply Chain:

## 3.2. Identify Hardware Threats

Analyzing Collusion Threats in the Semiconductor Supply Chain


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Summary of NIST SP 800-53, Revision 4_ Security and Privacy Controls for Federal Information Systems and Organizations provide? (Part 8)

[Assistant]
sions. This documentation is essential when examining the security considerations for organizational information systems with respect to the potential impact on an organization's mission and business.
The resulting tailored baseline set of security controls and the supporting rationale for the selection decisions (including any information system use restrictions required by organizations) are documented in system security plans. Documenting significant risk management decisions in the security control selection process is imperative so that authorizing officials have access to necessary information to make informed authorization decisions for organizational information systems, as demonstrated in Figure 3. Figure 3: Security Control Selection Process

<!-- image -->

## 5 Assurance

Appendix E in SP 800-53 Revision 4 provides an update to guidance regarding security assurance. This section outlines methods for agencies to establish measures of confidence that the implemented security controls provide the security capability required to protect critical missions and business operations. The criteria for whether a security control is assurance- or functionality-related is based on the overall characteristics of the control. In general, assurance-related controls are controls that: (i) define processes, procedures, techniques, or methodologies for designing and developing information systems and system components; (ii) provide supporting operational processes including improving the quality of systems, components, or processes; (iii) produce security evidence from developmental or operational activities; (iv) determine security control effectiveness or risk; or (v) improve personnel skills, expertise, and understanding. Appendix E provides three tables that identify specific assurance-related controls that are included in the low-, moderate-, and high-impact baselines described in Appendix D.

Summary of NIST SP 800-53, Revision 4_ Security and Privacy Controls for Federal Information Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AT.L2-3.2.3 (NIST 3.2.3)?

[Assistant]
According to Guidelines for Media Sanitization:

3.2.3. 3.2.3. 3.2.3).


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What guidance does Secure Software Development Practices for Generative AI and Dual-Use Foundation Models_ An SSDF Community Profile provide?

[Assistant]
<!-- image -->

## NIST Special Publication 800 NIST SP 800-218A

## Secure Software Development Practices for Generative AI and Dual-Use Foundation Models

An SSDF Community Profile

Harold Booth Murugiah Souppaya Apostol Vassilev Michael Ogata Martin Stanley

Karen Scarfone

This publication is available free of charge from:

https://doi.org/10.6028/NIST.SP.800-218A

<!-- image -->

## NIST Special Publication 800 NIST SP 800-218A

## Secure Software Development Practices for Generative AI and Dual-Use Foundation Models

An SSDF Community Profile

Harold Booth Murugiah Souppaya Apostol Vassilev

Computer Security Division Information Technology Laboratory

Michael Ogata

Applied Cybersecurity Division Information Technology Laboratory

Martin Stanley Cybersecurity and Infrastructure Security Agency (CISA)

Karen Scarfone Scarfone Cybersecurity

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-218A

July 2024

<!-- image -->

U.S. Department of Commerce Gina M. Raimondo, Secretary

National Institute of Standards and Technology

Certain equipment, instruments, software, or materials, commercial or non-commercial, are identified in this paper in order to specify the experimental procedure adequately. Such identification does not imply recommendation or endorsement of any product or service by NIST, nor does it imply that the materials or equipment identified are necessarily the best available for the purpose. There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may be used by federal agencies even before the completion of such companion publications. Thus, until each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative.

Secure Software Development Practices for Generative AI and Dual-Use Foundation Models_ An SSDF Community Profile


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Audit and Accountability?

[Assistant]
According to Guidelines on Mobile Device Forensics:

## 3.3.1 Software and Hardware Based Methods

## 3.3.2 Investigative Methods

- [GSM04] IMEI Allocation and Approval Guidelines, Version 3.3.0, GSM Association, Permanent Reference Document TW.06, December 2004, <URL: http://www.gsmworld.com/documents/twg/tw06.pdf>. - [GSM05] GSME Position On Data Retention - Implications for The Mobile Industry, GSM Europe, GSM Association, 23 August 2005, <URL: http://www.gsmworld.com/gsmeurope/documents/positions/2005/gsme\_position\_d ata\_retention.pdf#search=%22GSME%20POSITION%20ON%20DATA%20RET ENTION%22>. - [Haa04] Job de Haas, Reverse Engineering ARM Based Devices, Black Hat Europe, May 2004, <URL: https://www.blackhat.com/presentations/bh-europe-04/bh-eu-04dehaas/bh-eu-04-dehaas.pdf>. - [Hoo11] Andrew Hoog, Katie Strzempka, 2011, iPhone and iOS Forensics: Investigation, Analysis and Mobile Security for Apple iPhone, iPad and iOS Devices, Elsevier, Jul 25, 2011>. - [ITU06] ITU-T (2006), Automatic International Telephone Credit Cards, International Telecommunications Union, Telecommunication Standardization Sector (ITU-T), Recommendation E.118, (02/01). - [INT06] Mobile Phone Forensics, 47th EWPITC meeting - Final report, European Working Party on IT Crime, INTERPOL, September 7, 2006. - [Jan09] Wayne Jansen, Aurélien Delaitre, Mobile Forensic Reference Materials: A Methodology and Reification, NIST Interagency Report IR-7617, October 2009, <URL: http://csrc.nist.gov/publications/nistir/ir7617/nistir-7617.pdf>. - [Jon10] Kevin Jonkers, The forensic use of mobile phone flasher boxes5, digital investigation 6 (2010) 168-178, <URL: http://www.sciencedirect.com>. - [Kat10] Eric Katz, A Field Test of Mobile Phone Shielding Devices, 2010, College of Technology Masters Thesis, Paper 33, <URL: http://docs.lib.purdue.eud/techmasters/33>.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for Configuration Management?

[Assistant]
According to Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171:

............................................ 5                        |
| 2.1 DEVELOPMENTAPPROACH ......................................................................................................
| 5                                                                                |
| 2.2 ORGANIZATIONANDSTRUCTURE                                                                                | ............................................................................................. 7                                                  |
| 2.3 FLEXIBLE APPLICATION                                                                                | ............................................................................................................. 9                                  |
| CHAPTER THREE THE REQUIREMENTS......................................................................................... 11                       | CHAPTER THREE THE REQUIREMENTS......................................................................................... 11                       |
| 3.1 ACCESSCONTROL                                                                                | .................................................................................................................. 12                            |
| 3.2 AWARENESSANDTRAINING                                                                                | ...................................................................................................

Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Audit and Accountability?

[Assistant]
According to Guidelines for Media Sanitization:

| Executive Summary............................................................................................................................1      |
|-----------------------------------------------------------------------------------------------------------------------------------------------------|
| 1. Introduction...................................................................................................................................2 |
| 2. Background....................................................................................................................................5  |
| 3. Summary of Sanitization Methods..................................................................................................8               |
| 3.1.1. Clear Sanitization Method............................................................................................................8       |
| 3.1.2. Purge Sanitization Method.........................................................................................................10         |
| 3.1.3. Destroy Sanitization Method......................................................................................................11          |
| 3.2.1. Strength of Cryptography for CE ................................................................................................12           |
| 3.2.2. Applicability of CE.......................................................................................................................13 |
| 3.2.3. Sanitization of Keys ....................................................................................................................13  |
| 3.2.4. Quality of Cryptographic Implementations................................................................................15                   |
| 3.2.5.