[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What are the CMMC Level 3 requirements?

[Assistant]
According to Assessing Enhanced Security Requirements for Controlled Unclassified Information:

## Assessing Enhanced Security Requirements for Controlled Unclassified Information

RON ROSS VICTORIA PILLITTERI KELLEY DEMPSEY

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-172A

<!-- image -->

## NIST Special Publication 800-172A

## Assessing Enhanced Security Requirements for Controlled Unclassified Information

RON ROSS VICTORIA PILLITTERI KELLEY DEMPSEY

Computer Security Division Information Technology Laboratory

This publication is available free of charge from:

https://doi.org/10.6028/NIST.SP.800-172A

March 2022

<!-- image -->

U.S. Department of Commerce Gina M. Raimondo, Secretary

James K. Olthoff, Performing the Non-Exclusive Functions and Duties of the Under Secretary of Commerce for Standards and Technology & Director, National Institute of Standards and Technology

\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

## Authority

This publication has been developed by the National Institute of Standards and Technology (NIST) to further its statutory responsibilities under the Federal Information Security Modernization Act (FISMA), 44 U.S.C. § 3551 et seq. , Public Law (P.L.) 113-283. NIST is responsible for developing information security standards and guidelines, including minimum requirements for federal information systems, but such standards and guidelines shall not apply to national security systems without the express approval of the appropriate federal officials exercising policy authority over such systems. This guideline is consistent with requirements of the Office of Management and Budget (OMB) Circular A-130. Nothing in this publication should be taken to contradict the standards and guidelines made mandatory and binding on federal agencies by the Secretary of Commerce under statutory authority.

Assessing Enhanced Security Requirements for Controlled Unclassified Information


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for Risk Assessment?

[Assistant]
According to Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171:

ance. The decision to select a particular set of enhanced security requirements will be based on the mission and business needs of federal agencies and guided and informed by ongoing risk assessments.
The enhanced security requirements for nonfederal systems processing, storing, or transmitting CUI associated with critical programs or high value assets will be conveyed to nonfederal organizations by federal agencies in a contract, grant, or other agreement. The application of the enhanced security requirements to subcontractors will also be addressed by federal agencies in consultation with nonfederal organizations.

Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Approaches and Challenges of Federal Cybersecurity Awareness Programs provide? (Part 2)

[Assistant]
es  even  before  the  completion  of  such  companion  publications. Thus,  until  each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative.
For planning  and  transition  purposes,  federal  agencies  may  wish  to  closely  follow  the  development  of  these  new publications by NIST. Organizations are encouraged to review all draft publications during public comment periods and provide feedback to NIST. Many NIST cybersecurity publications, other than the ones noted above, are available at https://csrc.nist.gov/publications. \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

## Reports on Computer Systems Technology

The  Information  Technology  Laboratory  (ITL)  at  the  National  Institute  of  Standards  and Technology  (NIST)  promotes  the  U.S. economy  and  public  welfare  by  providing  technical leadership  for  the  Nation's  measurement  and  standards  infrastructure. ITL  develops  tests,  test methods, reference data, proof of concept implementations, and technical analyses to advance the development  and  productive  use  of  information  technology. ITL's  responsibilities  include  the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in federal information systems. ## Abstract

Organizational security awareness programs experience a number of challenges, including lack of resources, difficulty measuring the impact of the program, and perceptions among the workforce that training is a boring, 'check-the-box' activity. While prior surveys and research have examined programs in the private sector, there is little understanding of whether these findings also apply within the U.S. government.

Approaches and Challenges of Federal Cybersecurity Awareness Programs

Audit and Accountability
System and Information Integrity
Security Assessment
Media Protection
Identification and Authentication
Awareness and Training
System and Communications Protection
Access Control
Planning
Incident Response
Risk Assessment
Personnel Security
System and Services Acquisition
Supply Chain Risk Management
Maintenance
Physical Protection
Configuration Management


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Awareness and Training?

[Assistant]
According to Ascon-Based Lightweight Cryptography Standards for Constrained Devices_ Authenticated Encryption, Hash, and Extendable Output Functions:

| 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . |   1 |
|-----------------------------------------------------------------------------------------------------------------------------------------------------------------|-----|
| 2. Preliminaries.......................................................................... |   3 |
| 2.1. Auxiliary Functions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . |   7 |
| 3. Ascon Permutations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . |   8 |
| 3.1. Internal State . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . |   8 |
| 3.2. Constant-Addition Layer 𝑝 𝐶 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . |   8 |
| 3.3. Substitution Layer 𝑝 𝑆 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . |   9 |
| 3.4. Linear Diffusion Layer 𝑝 𝐿 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . |  10 |
| 4. Authenticated Encryption Scheme: Ascon-AEAD128 . . . . . . . . . . . . . . . . . . . . . . . . . . . . |  11 |
| 4.1. Specification of Ascon-AEAD128 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . |  11 |
| 4.1.1. Encryption . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . |  11 |
| 4.1.2. Decryption . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . |  15 |
| 4.2. Implementation Options . . . . . . . . . . . . . . . . . . . . . . . . . .

Ascon-Based Lightweight Cryptography Standards for Constrained Devices_ Authenticated Encryption, Hash, and Extendable Output Functions


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for Identification and Authentication?

[Assistant]
According to Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171:

............................................ 5                        |
| 2.1 DEVELOPMENTAPPROACH ......................................................................................................
| 5                                                                                |
| 2.2 ORGANIZATIONANDSTRUCTURE                                                                                | ............................................................................................. 7                                                  |
| 2.3 FLEXIBLE APPLICATION                                                                                | ............................................................................................................. 9                                  |
| CHAPTER THREE THE REQUIREMENTS......................................................................................... 11                       | CHAPTER THREE THE REQUIREMENTS......................................................................................... 11                       |
| 3.1 ACCESSCONTROL                                                                                | .................................................................................................................. 12                            |
| 3.2 AWARENESSANDTRAINING                                                                                | ...................................................................................................


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 1 require for Identification and Authentication?

[Assistant]
According to Summary Report for “Workshop on Updating Manufacturer Guidance for Securable Connected Product Development”:

Privacy is a complex and evolving concept that safeguards important values like human autonomy and dignity. It reflects various factors and individual preferences and is highly context-specific, differing between public and private activities. Effective privacy risk management must consider these contexts and the various ways to achieve privacy, such as seclusion, limiting observation, and controlling facets of identity. Gilbert emphasized that privacy could drive innovation and serve as a market differentiator. However, organizations need to have honest and risk-informed discussions about how best to balance optimizing data utility while protecting individuals' privacy, particularly in cases where privacy risk interacts with other risk domains such as cybersecurity. The NIST Privacy Framework helps organizations understand the relationship between privacy and cybersecurity risks in the context of the Internet of Things (IoT). Problematic data actions, such as deriving inferences about individuals, can pose significant privacy risks, particularly in consumer IoT. A key factor in managing privacy risks is an organization's role in t he data processing ecosystem, which includes the complex relationships among entities involved in data processing. An organization's role(s) in the IoT ecosystem can affect its legal obligations and the measures it should take to manage privacy risk. High-level goals for mitigating cybersecurity and privacy risks include protecting device security, data security, and individual privacy. The privacy engineering objectives of predictability, manageability, and disassociability can be useful to meet these goals by supporting the determination of privacy capabilities in IoT products. Gilbert also discussed specific privacy risks related to IoT, such as interactions with the physical world leading to reputational harm or safety issues.

Summary Report for “Workshop on Updating Manufacturer Guidance for Securable Connected Product Development”


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Maintenance?

[Assistant]
According to Data Integrity_ Detecting and Responding to Ransomware and Other Destructive Events:

5.3.3 | Accidental VMDeletion via Maintenance Script ........................................................23 | | | 5.3.4 | Backdoor Creation via Email Vector ...........................................................................24 Insider..............................................................25 | | | 5.3.5 | Database Modification via Malicious |

Data Integrity_ Detecting and Responding to Ransomware and Other Destructive Events


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Configuration Management?

[Assistant]
According to Likely Exploited Vulnerabilities_ A Proposed Metric for Vulnerability Exploitation Probability:

## 3.4. Augmenting EPSS-Based Remediation Prioritization

Likely Exploited Vulnerabilities_ A Proposed Metric for Vulnerability Exploitation Probability


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Identification and Authentication?

[Assistant]
According to Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule_ A Cybersecurity Resource Guide:

.......................................................................75                                                                                |
| 5.4.1.
Business Associate Contracts or Other Arrangements (§ 164.314(a)).......................................77                                                                                |
| 5.4.2. Requirements for Group Health Plans (§ 164.314(b))................................................................79                                                                                |
| 5.5.1. Policies and Procedures (§ 164.316(a))......................................................................................81                                                                                |
| 5.5.2. Documentation (§ 164.316(b))...................................................................................................83                                                                                |
| References.......................................................................................................................................85                                                                                |
| Appendix A. List of Symbols, Abbreviations, and Acronyms...............................................................87                                                                                |
| Appendix B. Glossary .......................................................................................................................91                                                                                |
| Appendix C.

Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule_ A Cybersecurity Resource Guide


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Services Acquisition?

[Assistant]
According to Audit and Evaluation of Computer Security:

Standards Application and Analysis —• Electronic Technology — Center for Consumer Product Technology: Product
Systems Analysis; Product Engineering — Center for Building Technology; Structures, Materials, and Safety; Building
Environment; Technical Evaluation and Application — Center for Fire Research: Fire Science; Fire Safety Engineering. THE INSTITUTE FOR COMPUTER SCIENCES AND TECHNOLOGY conducts research and provides technical services
designed to aid Government agencies in improving cost effectiveness in the conduct of their programs through the selection,
acquisition, and effective utilization of automatic data processing equipment: and serves as the principal focus wthin the exec-
utive branch for the development of Federal standards for automatic data processing equipment, techniques, and computer
languages. The Institute consist of the following divisions:

THE OFFICE FOR INFORMATION PROGRAMS promotes optimum dissemination and accessibility of scientific informa-
tion generated within NBS; promotes the development of the National Standard Reference Data System and a system of in-
formation analysis centers dealing with the broader aspects of the National Measurement System; provides appropriate services
to ensure that the NBS staff has optimum accessibility to the scientific information of the world. The Office consists of the
following organizational units:

The National Bureau of Standards has a special responsibility within the Federal
Government for computer science and technology activities. The programs of the
NBS Institute for Computer Sciences and Technology are designed to provide ADP
standards, guidelines, and technical advisory services to improve the effectiveness of
computer utilization in the Federal sector, and to perform appropriate research and
development efforts as foundation for such activities and programs.

Audit and Evaluation of Computer Security


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Audit and Accountability?

[Assistant]
According to High-Performance Computing Security_ Architecture, Threat Analysis, and Security Posture:

1. The high-performance computing zone consists of a pool of compute nodes connected by one or more high-speed networks. The high-performance computing zone provides key services specifically designed to run parallel jobs at scale. 2. The data storage zone comprises one or multiple high-speed parallel file systems that provide data storage service for user data. The high-speed parallel file systems are designed to store very large data sets and provide fast access to data for reading and writing. 3. The access zone has one or more nodes that are connected to external networks, such as the broader organizational network or the internet. This zone provides the means for authenticating and authorizing the access and connections of users and administrators. The access zone provides various services, including interactive shells, web-based portals, data transfer, data visualization, and others. 4. The management zone comprises multiple management nodes and/or cloud service clusters through which HPC management services are provided. The management zone allows HPC system administrators to configure and manage the HPC system, including the configuration of compute nodes, storage, networks, provisioning, identity management, auditing, system monitoring, and vulnerability assessment. Various management software modules (e.g., job schedulers, workflow management, and the Domain Name System [DNS]) run in the management zone. ## 3.3. Other Threats

Containers bundle an application's code, related libraries, configuration files, and required dependencies to allow the applications to run seamlessly across environments. Containers provide the benefits of portability, reproducibility, and productivity, but they can hide software. By decoupling operating system dependencies from the host system, a container image may contain unknown vulnerable or insecure software, which poses a software supply chain risk.

High-Performance Computing Security_ Architecture, Threat Analysis, and Security Posture


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 2 require for Identification and Authentication?

[Assistant]
According to Assessing Security Requirements for Controlled Unclassified Information:

| Access Control                    | Maintenance         | Security Assessment and Monitoring   |
|-----------------------------------|---------------------|--------------------------------------|
| Awareness and Training            | Media Protection    | System and Communications Protection |
| Audit and Accountability          | Personnel Security  | System and Information Integrity     |
| Configuration Management          | Physical Protection | Planning                             |
| Identification and Authentication | Risk Assessment     | System and Services Acquisition      |
| Incident Response                 |                     | Supply Chain Risk Management         |

A.03.01.10.b: the device lock is retained until the user reestablishes access using established identification and authentication procedures.

[SELECT FROM: access control policy and procedures; procedures for session lock and identification and authentication; system design documentation; system configuration settings; display screen with session lock activated; system security plan; other relevant documents or records]

Assessing Security Requirements for Controlled Unclassified Information


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Assessing Security and Privacy Controls in Information Systems and Organizations provide? (Part 5)

[Assistant]
__________

Acknowledgments

This publication was developed by the Joint Task Force Interagency Working Group. The group
includes representatives from the civil, defense, and intelligence communities.
The National
Institute of Standards and Technology wishes to acknowledge and thank the senior leaders from
the Department of Commerce, Department of Defense, the Office of the Director of National
Intelligence, the Committee on National Security Systems, and the members of the interagency
working group whose dedicated efforts contributed significantly to this publication. Department of Defense

HON. John Sherman
Chief Information Officer

Dr. Kelly Fletcher
Principal Deputy Chief Information Officer

David McKeown
Deputy CIO for Cybersecurity and DoD CISO

Mark Hakun
Principal Deputy CIO for Cybersecurity

Kevin Dulany
Director, Cybersecurity Policy and Partnerships

Office of the Director of National
Intelligence

Michael E. Waschull
Acting Chief Information Officer

Michael E. Waschull
Deputy Chief Information Officer

C. Matthew Conner
Cybersecurity Group and IC CISO

Cheri Benedict
Director, Security Coordination Center

National Institute of Standards and
Technology

Committee on National Security
Systems

James St. Pierre
Acting Director, Information Technology Laboratory (ITL)

Mark G. Hakun
Chair

Kevin Stine
Cybersecurity Advisor, ITL

Matthew Scholl
Chief, Computer Security Division

Kevin Stine
Chief, Applied Cybersecurity Division

Dominic A.

Assessing Security and Privacy Controls in Information Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations provide? (Part 6)

[Assistant]
However, holders of patents are not obligated to respond to ITL calls for patents and ITL has not undertaken a patent search in order to identify which, if any, patents may apply to this publication.
As of the date of publication and following call(s) for the identification of patent claims whose use may be required for compliance with the guidance or requirements of this publication, no such patent claims have been identified to ITL. No representation is made or implied by ITL that licenses are not required to avoid patent infringement in the use of this publication. ## Table of Contents

| 1. Introduction..............................................................................................................................1      | 1. Introduction..............................................................................................................................1      | 1. Introduction..............................................................................................................................1      |
|-----------------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------|
| 2. The Fundamentals.....................................................................................................................3           | 2. The Fundamentals.....................................................................................................................3           | 2. The Fundamentals.....................................................................................................................3           |
| 3.

Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AT.L2-3.2.2 (NIST 3.2.2)?

[Assistant]
According to Digital Identity Guidelines_ Identity Proofing and Enrollment:

3.2.2. 3.2.2. 3.2.2 of [SP800-63B].

Digital Identity Guidelines_ Identity Proofing and Enrollment


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Guidelines on Mobile Device Forensics provide? (Part 3)

[Assistant]
tions during public comment periods and provide feedback to NIST. All NIST Computer Security Division publications, other than the ones noted above, are available at http://csrc.nist.gov/publications.
## Reports on Computer Systems Technology

The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the Nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology. ITL's responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in Federal information systems. The Special Publication 800-series reports on ITL's research, guidelines, and outreach efforts in information system security, and its collaborative activities with industry, government, and academic organizations. ## Abstract

Mobile device forensics is the science of recovering digital evidence from a mobile device under forensically sound conditions using accepted methods. Mobile device forensics is an evolving specialty in the field of digital forensics. This guide attempts to bridge the gap by providing an indepth look into mobile devices and explaining technologies involved and their relationship to forensic procedures. This document covers mobile devices with features beyond simple voice communication and text messaging capabilities. This guide also discusses procedures for the validation, preservation, acquisition, examination, analysis, and reporting of digital information.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Planning?

[Assistant]
According to Guidelines for the Use of PIV Credentials in Facility Access:

There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may  be  used  by  federal  agencies  even  before  the  completion  of  such  companion  publications.  Thus,  until  each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning  and  transition  purposes,  Federal  agencies  may  wish  to  closely  follow  the  development  of  these  new publications by NIST.

Guidelines for the Use of PIV Credentials in Facility Access


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Risk Assessment?

[Assistant]
According to Secure Software Development Practices for Generative AI and Dual-Use Foundation Models_ An SSDF Community Profile:

AI model producers, AI system producers, AI system acquirers, and others can use the SSDF to foster their communications regarding secure AI model development throughout the software development life cycle. 2  Following SSDF practices should help AI model producers reduce the number of vulnerabilities in their AI models, reduce the potential impacts of the exploitation of undetected or unaddressed vulnerabilities, and address the root causes of vulnerabilities to prevent recurrences. AI system producers can use the SSDF's common vocabulary when communicating with AI model producers regarding their security practices for AI model development and when integrating AI models into the software they are developing. AI system acquirers can also use SSDF terms to better communicate their cybersecurity requirements and needs to AI model producers and AI system producers, such as during acquisition processes. The SSDF Community Profile is not a checklist to follow, but rather a starting point for planning and implementing a risk-based approach to adopting secure software development practices involving AI models. The contents of the Profile are meant to be adapted and customized, as not all practices and tasks are applicable to all use cases. Organizations should adopt a riskbased approach to determine what practices and tasks are relevant, appropriate, and effective to mitigate the threats to software development practices from the organization's perspective as an AI model producer, AI system producer, or AI system acquirer. Factors such as risk, cost, feasibility, and applicability should be considered when deciding which practices and tasks to use and how much time and resources to devote to each one. Cost models may need to be updated to effectively consider the costs inherent to AI model development.

Secure Software Development Practices for Generative AI and Dual-Use Foundation Models_ An SSDF Community Profile


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Planning?

[Assistant]
According to NIST Cybersecurity Framework 2.0_ Quick-Start Guide for Cybersecurity Supply Chain Risk Management (C-SCRM):

- Include your relevant suppliers in cybersecurity incident planning, response, and recovery activities. [GV.SC-08] See NIST's Computer Security Incident Handling Guide for more information on key practices for cybersecurity incidents.

☐ Identify one or more specific roles or positions that will be responsible and accountable for planning, resourcing, and executing C-SCRM activities.

NIST Cybersecurity Framework 2.0_ Quick-Start Guide for Cybersecurity Supply Chain Risk Management (C-SCRM)


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for Awareness and Training?

[Assistant]
According to Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171:

| CHAPTERONE INTRODUCTION...................................................................................................... | CHAPTERONE INTRODUCTION...................................................................................................... |
|--------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------|
| 1.1 PURPOSEANDAPPLICABILITY                                                                                | ................................................................................................... 3                                            |
| 1.2 TARGET AUDIENCE                                                                                | .................................................................................................................. 4                             |
| 1.3 ORGANIZATIONOF THIS SPECIAL PUBLICATION                                                                                | .......................................................................... 4                                                                     |
| CHAPTERTWO THE FUNDAMENTALS............................................................................................ 5                        | CHAPTERTWO THE FUNDAMENTALS............................................................................................ 5                        |
| 2.1 DEVELOPMENTAPPROACH ......................................................................................................


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Incident Response Recommendations and Considerations for Cybersecurity Risk Management_ A CSF 2.0 Community Profile provide? (Part 7)

[Assistant]
|
| Table 1. Previous incident response life cycle model's phases and corresponding CSF 2.0 Functions.....6                                             |
| Table 2.
CSF 2.0 Community Profile part 1: Preparation and Lessons Learned ....................................11                                   |
| Table 3. CSF 2.0 Community Profile part 2: Incident Response...........................................................23                           |
| List of Figures                                                                                |
| Fig. 1. Previous incident response life cycle model ..............................................................................4                 |
| Fig. 2. Incident response life cycle model based on CSF 2.0 Functions ..................................................5                           |

## Executive Summary

Incident response is a critical part of cybersecurity risk management and should be integrated across organizational operations. All six NIST Cybersecurity Framework (CSF) 2.0 Functions play vital roles in incident response:

- Govern, Identify, and Protect help organizations prevent some incidents, prepare to handle incidents that do occur, reduce the impact of those incidents, and improve incident response and cybersecurity risk management practices based on lessons learned from those incidents. - Detect, Respond, and Recover help organizations discover, manage, prioritize, contain, eradicate, and recover from cybersecurity incidents, as well as perform incident reporting, notification, and other incident-related communications. Many individuals, teams, and third parties hold a wide variety of roles and responsibilities across all of the Functions that support an organization's incident response.

Incident Response Recommendations and Considerations for Cybersecurity Risk Management_ A CSF 2.0 Community Profile


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Workshop on Enhancing Security of Devices and Components Across the Supply Chain provide? (Part 4)

[Assistant]
e cycle. This report summarizes the content that was presented and discussed at the workshop. ## Keywords

cybersecurity; hardware security; measurement; semiconductors; supply chain; vulnerabilities.
## Reports on Computer Systems Technology

The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the US economy and public welfare by providing technical leadership for the Nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology. ITL's responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in federal information systems. ## Table of Contents

| 1. Introduction...................................................................................................................................1    |
|--------------------------------------------------------------------------------------------------------------------------------------------------------|
| 2. Workshop Sessions ........................................................................................................................3         |
| 2.1.1. Speaker Viewpoints......................................................................................................................3       |
| 2.1.2. Key Highlights ...............................................................................................................................4 |
| 2.2.1. Speaker Viewpoints......................................................................................................................5       |
| 2.2.2.

Workshop on Enhancing Security of Devices and Components Across the Supply Chain


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AU.L2-3.3.3 (NIST 3.3.3)?

[Assistant]
According to Audit and Evaluation of Computer Security:

3.3.3

Media Control

For example, media labeled "secret"

In order to properly safeguard media (tapes, disks,
etc.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Access Control?

[Assistant]
According to Audit and Evaluation of Computer Security:

7-12
7-12
7-13
7-13
7-13
....... 7-13
Design Standards o
7-14
Organization Control .
7-14
Access Control .
7-15
Phase Review/Project Control
Testing/System Assurance ........ ^
7-16
7-16
Promotion Process
Documentation ............... 7-17
7-17
Auditor/Independent Party Involvement
Configuration Management .......... 7-17
Emergency Procedures ........... 7-18

Procedure Review
Organization Control
Access Control ....<, o
Contingency Plan

9c5.3
905.4
9.5.5
Security Administration (Interactive Environment) .
Access Control
Contingency Plan .....
Summary


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Awareness and Training?

[Assistant]
According to Multi-Factor Authentication for Criminal Justice Information Systems_ Implementation Considerations for Protecting Criminal Justice Information:

| Executive Summary............................................................................................................................1        |
|-------------------------------------------------------------------------------------------------------------------------------------------------------|
| 1. Introduction...................................................................................................................................3   |
| 2. An Overview of MFA Technologies and Concepts ............................................................................5                         |
| 2.4.1. Benefits of Identity Federation ....................................................................................................7          |
| 2.4.2. Benefits of Single Sign-On ............................................................................................................8       |
| 3. Choosing an MFA Implementation for Protecting CJI .....................................................................11                          |
| 3.1.1. Principle 1: Authenticator Reusability........................................................................................12               |
| 3.1.2. Principle 2: Authenticator Optionality .......................................................................................12               |
| 3.1.3. Principle 3: Minimize the Passing of Memorized Secrets ..........................................................12                            |
| 3.1.4. Principle 4: Ensure MFA Is Integrated to Protect CJI..................................................................13                       |
| 3.2.1. MFA Users ..................................................................................................................................13 |
| 3.2.2.

Multi-Factor Authentication for Criminal Justice Information Systems_ Implementation Considerations for Protecting Criminal Justice Information


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Physical Protection?

[Assistant]
According to NIST Cybersecurity Framework 2.0_ Quick-Start Guide for Cybersecurity Supply Chain Risk Management (C-SCRM):

y. 2. Verify the source of new software and the software's integrity before installing it. 3. Configure platforms to use only approved DNS services that block access to known malicious domains. 4. ...
| • NIST SP 800-161r1, control SI-3 • ISO 27002:2022, control 8.7 • … |
| …                                                                                |                   |                                                                                |                                                                     |


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Access Control?

[Assistant]
According to Federal Cybersecurity Role-Based Training Approaches, Successes, and Challenges:

- Training on specific tools required for employees to perform security-related job duties
- Training for employees who have privileged access to applications or systems
- Training for oversight roles such as information systems security officer (ISSO), information systems security manager (ISSM), or auditors
- Training for employees who manage access and authorizations to applications and systems
- Training on organizational policies and procedures related to security and privacy configurations, settings, controls, etc.
- Cybersecurity for employees in leadership positions, such as 'Cybersecurity for Executives,' Cybersecurity for System Owners,' or 'Becoming A Chief Information System Officer'

Federal Cybersecurity Role-Based Training Approaches, Successes, and Challenges


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Federal Cybersecurity Awareness Programs_ A Mixed Methods Research Study provide? (Part 5)

[Assistant]
| Focus Group Design...................................................................................................
| 3                                                                                |
| 2.1.2                                                                                | Focus Group Recruitment........................................................................................... | 3                                                                                |
| 2.1.3                                                                                | Focus Group Data Collection..................................................................................... | 3                                                                                |
| 2.1.4                                                                                | Focus Group Data Analysis........................................................................................ | 4                                                                                |
| 2.2 SURVEY METHODOLOGY ..................................................................................................... 4            | 2.2 SURVEY METHODOLOGY ..................................................................................................... 4            | 2.2 SURVEY METHODOLOGY .....................................................................................................

Federal Cybersecurity Awareness Programs_ A Mixed Methods Research Study


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Guide to Enterprise Patch Management Planning_ Preventive Maintenance for Technology provide? (Part 2)

[Assistant]
lar A-130. Nothing in this publication should be taken to contradict the standards and guidelines made mandatory and binding on federal agencies by the Secretary of Commerce under statutory authority.
Nor should these guidelines be interpreted as altering or superseding the existing authorities of the Secretary of Commerce, Director of the OMB, or any other federal official. This publication may be used by nongovernmental organizations on a voluntary basis and is not subject to copyright in the United States. Attribution would, however, be appreciated by NIST. National Institute of Standards and Technology Special Publication 800-40 Rev. 4 Natl. Inst. Stand. Technol. Spec. Publ. 800-40r4, 28 pages (April 2022) CODEN: NSPUE2

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-40r4

Certain  commercial  entities,  equipment,  or  materials  may  be  identified  in  this  document  in  order  to  describe  an experimental  procedure  or  concept  adequately. Such  identification  is  not  intended  to  imply  recommendation  or endorsement by NIST, nor is it intended to imply that the entities, materials, or equipment are necessarily the best available for the purpose. There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may  be  used  by  federal  agencies  even  before  the  completion  of  such  companion  publications. Thus,  until  each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning  and  transition  purposes,  federal  agencies  may  wish  to  closely  follow  the  development  of  these  new publications by NIST. Organizations are encouraged to review all draft publications during public comment periods and provide feedback to NIST.

Guide to Enterprise Patch Management Planning_ Preventive Maintenance for Technology


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Services Acquisition?

[Assistant]
According to Approaches and Challenges of Federal Cybersecurity Awareness Programs:

There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may  be  used  by  federal  agencies  even  before  the  completion  of  such  companion  publications.  Thus,  until  each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning  and  transition  purposes,  federal  agencies  may  wish  to  closely  follow  the  development  of  these  new publications by NIST.

The  Information  Technology  Laboratory  (ITL)  at  the  National  Institute  of  Standards  and Technology  (NIST)  promotes  the  U.S.  economy  and  public  welfare  by  providing  technical leadership  for  the  Nation's  measurement  and  standards  infrastructure.  ITL  develops  tests,  test methods, reference data, proof of concept implementations, and technical analyses to advance the development  and  productive  use  of  information  technology.  ITL's  responsibilities  include  the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in federal information systems.

'They [the Department team] start with the same approach every year where they are developing the annual training at the Department level and the agencies are providing input for improvement and development before it's released to users, so we can provide ideas for topics directly for the training.' (S05)

Approaches and Challenges of Federal Cybersecurity Awareness Programs


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for Supply Chain Risk Management?

[Assistant]
According to Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171:

The system component inventory includes system-specific information required for component accountability and to provide support to identify, control, monitor, and verify configuration items in accordance with the authoritative source. The information necessary for effective accountability of system components includes the system name, hardware and software component owners, hardware inventory specifications, software license information, software version numbers, andfor networked components-the machine names and network addresses. Inventory specifications include the manufacturer, supplier information, component type, date of receipt, cost, model, serial number, and physical location. Organizations also use automated mechanisms to implement and maintain authoritative (i.e., up-to-date, complete, accurate, and available) baseline configurations  for  systems  that  include  hardware  and  software  inventory  tools,  configuration management tools, and network management tools. Tools can be used to track version numbers on operating systems, applications, types of software installed, and current patch levels.

- 3.11.6e  Assess, respond to, and monitor supply chain risks associated with organizational systems and system components.

Supply chain events include disruption, use of defective components, insertion of counterfeits, theft,  malicious development practices, improper delivery practices, and insertion of malicious code. These events can have a significant impact on a system and its information and, therefore, can also adversely impact organizational operations (i.e., mission, functions, image, or reputation), organizational assets, individuals, other organizations, and the Nation. The supply chain-related events may be unintentional or malicious and can occur at any point during the system life cycle. An analysis of supply chain risk can help an organization identify systems or components for which additional supply chain risk mitigations are required.

Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Security Assessment?

[Assistant]
According to Guide to Malware Incident Prevention and Handling for Desktops and Laptops:

Organizations should use centrally managed antivirus software that is controlled and monitored regularly by antivirus administrators, who are also typically responsible for acquiring, testing, approving, and delivering antivirus signature and software updates throughout the organization. Users should not be able to disable or delete antivirus software from their hosts, nor should they be able to alter critical settings. Antivirus administrators should perform continuous monitoring to confirm that hosts are using current antivirus software and that the software is configured properly. Implementing all of these recommendations should strongly support an organization in having a strong and consistent antivirus deployment across the organization.

| Resource Name                                                                                | URL                                                    |
|-----------------------------------------------------------------------------------------------|--------------------------------------------------------|
| NIST, SP 800-94, Guide to Intrusion Detection and Prevention Systems (IDPS)                   | http://csrc.nist.gov/publications/PubsSPs.html#800-94  |
| NIST, SP 800-115, Technical Guide to Information Security Testing and Assessment              | http://csrc.nist.gov/publications/PubsSPs.html#800-115 |
| NIST, SP 800-117, Guide to Adopting and Using the Security Content Automation Protocol (SCAP) | http://csrc.nist.gov/publications/PubsSPs.html#800-117 |
| NIST, SP 800-128, Guide for Security-Focused Configuration Management of Information Systems  | http://csrc.nist.gov/publications/PubsSPs.html#800-128 |
| NIST, SP 800-147. BIOS Protection Guidelines                                                  | http://csrc.nist.gov/publications/PubsSPs.html#800-147 |

Guide to Malware Incident Prevention and Handling for Desktops and Laptops


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Services Acquisition?

[Assistant]
According to Control Baselines for Information Systems and Organizations:

espective of impact level. In addition to the control baselines, this publication provides tailoring guidance and a set of working assumptions that help guide and inform the control selection process.
Finally, this publication provides guidance on the development of overlays to facilitate control baseline customization for specific communities of interest, technologies, and environments of operation.

Control Baselines for Information Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Recommendations for Federal Vulnerability Disclosure Guidelines provide? (Part 7)

[Assistant]
|
| 2.1.3. Develop Technical Analysis Capability .....................................................................
| 9                                                                                |                                                                                |
| Receive Source Vulnerability                                                                                | Report .......................................................................... 9                                                  |                                                                                |
| Triage and Prioritize Source Vulnerability                                                                                | Report........................................................

Recommendations for Federal Vulnerability Disclosure Guidelines


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice CM.L2-3.4.2 (NIST 3.4.2)?

[Assistant]
According to Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations:

3.4.2.

Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Guide for Developing Security Plans for Federal Information Systems provide? (Part 7)

[Assistant]
|
| 2.5.2 Compensating Controls ..................................................................................................
| 15                                                                                |
| 2.5.3 Common Security Controls ............................................................................................. | 16                                                                                |
| 3. PLAN DEVELOPMENT........................................................................................................... 19          | 3. PLAN DEVELOPMENT........................................................................................................... 19 |
| 3.1 SYSTEM NAMEAND I DENTIFIER............................................................................................... | 19                                                                                |
| 3.2 SYSTEM CATEGORIZATION ...................................................................................................... | 19                                                                                |
| 3.3 SYSTEM OWNER ...................................................................................................................... | 19                                                                                |
| 3.4 AUTHORIZING OFFICIAL ..........................................................................................................

Guide for Developing Security Plans for Federal Information Systems


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Overview and Considerations of Access Control Based on Attribute Encryption provide? (Part 10)

[Assistant]
|
| Fig. 5. Basic process steps of KP-ABE scheme........................................................................19                      | Fig. 5.
Basic process steps of KP-ABE scheme........................................................................19                      |                                                                                |
| List of Tables                                                                                | List of Tables                                                                                | List of Tables                                                                                |
| Table 1. Elliptic curve used for general ECC and bilinear pairing..............................................10                           | Table 1. Elliptic curve used for general ECC and bilinear pairing..............................................10                           |                                                                                |

## Acknowledgments

The author would like to express his thanks to Lily Chen, Isabel Van Wyk, and Jim Foti of NIST, Alex Leadbeater of Maketh Secure, Giovanni Bartolomeo of CNIT, and Laure Pourcin of ETSI for their reviews of both the public comment version as well as the final publication. ## Executive Summary

Traditional public-key encryption (PKE) requires different data to have different keys that can be distributed to users who satisfy access control policies along with the encrypted version of the data.

Overview and Considerations of Access Control Based on Attribute Encryption


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Communications Protection?

[Assistant]
According to Risk Management Framework for Information Systems and Organizations_ A System Life Cycle Approach for Security and Privacy:

te the privacy risks associated with authorized processing of PII. For example, there may be a risk that individuals would be embarrassed or stigmatized if certain information is disclosed about them.
While encryption could prevent unauthorized disclosure of PII, it would not address any privacy risks related to disclosures to parties that are authorized to decrypt and access the PII. To mitigate this privacy risk, organizations would need to assess the risk of allowing authorized parties to decrypt the information and potentially select controls that would mitigate that risk. In such an example, an organization might select controls to enable individuals to understand the organization's disclosure practices and exercise choices about this access or use differential privacy or privacy-enhancing cryptographic techniques to disassociate the information from an individual.

Risk Management Framework for Information Systems and Organizations_ A System Life Cycle Approach for Security and Privacy


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Communications Protection?

[Assistant]
According to Blockchain for Access Control Systems:

1. The semantic and syntactic correctness (i.e., veracity of AC data) needs to be ensured or trusted. If such data are from out-of-the-chain sources, an authority for oracle needs to be applied to validate and oversee the correctness of the data. However, if it is provided by different  AC  nodes,  then  multiple  authorities  working  in  coordination  can  take  part  in validating different sources or functions embedded in the smart contracts that need to be developed for the tasks [GMS]. 2. In addition to secure transmission and repositories of AC data in the blockchain, inherited hash cypher schemes may be required to avoid exposing vulnerabilities or other types of malicious actions performed by unauthorized entities in AC notes or smart contracts. Smart contracts may also be created to define the secure communications between AC notes for AC data owners, creators, or managers. 3. Cache synchronization and failover/backup capabilities for readiness of the AC system refers to the frequency of refresh for AC data change. A blockchain AC system needs to adequately perform AC data update and retrieval frequencies to ensure that a recent set of AC  data  in  question  is  cached  in  the  blockchain  if  the  most  current  AC  data  from authoritative sources or repositories cannot be accessed during an emergency (e.g., low bandwidth, loss of service). Migrating  from  a  legacy  centralized  system  to  a  blockchain  AC  system  needs  to  address  the changes in security assumptions and the assurances of tools and communication protocols for the new decentralized  architecture. For  example,  reimplementing  a  system  using  a  smart  contract language requires  changes  to  secure  programming  practices,  or  changing  a  legacy  protocol  to Hypertext Transfer Protocol Secure (HTTPS) requires new communications acknowledgements.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Physical Protection?

[Assistant]
According to Recommendation for Pair-Wise Key-Establishment Schemes Using Discrete Logarithm Cryptography:

forward            | A telecommunications technique in which information is sent to an intermediate station where it is kept and later sent to the final destination or to another intermediate station.
|
| Support (a security strength) | A security strength of s bits is said to be supported by a particular choice of algorithm, primitive, auxiliary function, parameters (etc.) for use in the implementation of a cryptographic mechanism if that choice will not prevent the resulting implementation from attaining a security strength of at least s bits. In this Recommendation, it is assumed that implementation choices are intended to support a security strength of 112 bits or more (see SP 800-57 6 and SP 800-131A 7 ). |
| Symmetric key                 | A cryptographic key that is shared between two or more entities and used with a cryptographic application to process information. |
| Symmetric-key algorithm       | A cryptographic algorithm that uses secret keying material that is shared between authorized parties. |
| Targeted security strength    | The security strength that is intended to be supported by one or more implementation-related choices (such as algorithms, primitives, auxiliary functions, parameter sizes and/or actual parameters) for the purpose of instantiating a cryptographic mechanism. In this Recommendation, it is assumed that the targeted security strength of any instantiation of an approved key-establishment scheme has a value greater than or equal to 112 bits and less than or equal to 256 bits. |
| Trusted association           | Assurance of the integrity of an asserted relationship between items of information that may be provided by cryptographic or non- cryptographic (e.g., physical) means. Also see Binding. |
| Trusted party                 | A party that is trusted by an entity to faithfully perform certain services for that entity. An entity could be a trusted party for itself.

Recommendation for Pair-Wise Key-Establishment Schemes Using Discrete Logarithm Cryptography


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Services Acquisition?

[Assistant]
According to Proceedings of the Cybersecurity in Cyber-Physical Systems Workshop, April 23-24, 2012:

The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the Nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology. ITL's responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in Federal information systems. There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may be used by Federal agencies even before the completion of such companion publications. Thus, until each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning and transition purposes, Federal agencies may wish to closely follow the development of these new publications by NIST. Dr. Arnold joined the National Institute of Standards and Technology (NIST) in September 2006 as Deputy Director, Technology Services, after a 33-year career in the telecommunications and information technology industry. He was appointed National Coordinator for Smart Grid Interoperability at in April 2009. He has been responsible for leading the development of standards underpinning the nation's Smart Grid. In October 2011, Dr. Arnold added an additional role as Director of Cyber Physical Systems within NIST's Engineering Laboratory (EL).

Proceedings of the Cybersecurity in Cyber-Physical Systems Workshop, April 23-24, 2012


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 2 require for System and Communications Protection?

[Assistant]
According to Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations:

......................98      |
| Table 11. Maintenance (MA) ......................................................................................................................98      |
| Table 12.
Media Protection (MP)................................................................................................................99        |
| Table 13. Physical and Environmental Protection (PE)...............................................................................99                    |
| Table 14. Planning (PL)..............................................................................................................................100 |
| Table 15. Program Management (PM) .....................................................................................................100               |
| Table 16. Personnel Security (PS) .............................................................................................................101       |
| Table 17. PII Processing and Transparency (PT) .......................................................................................102                |
| Table 18. Risk Assessment (RA) ................................................................................................................102       |
| Table 19. System and Services Acquisition (SA)........................................................................................103                |
| Table 20. System and Communications Protection (SC)...........................................................................103                        |
| Table 21. System and Information Integrity (SI) .......................................................................................104               |
| Table 22. Supply Chain Risk Management (SR).........................................................................................105                  |
| Table 23.

Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Services Acquisition?

[Assistant]
According to Digital Identity Guidelines_ Authentication and Authenticator Management:

There may be references in this publication to other publications currently under
development by NIST in accordance with its assigned statutory responsibilities. The
information in this publication, including concepts and methodologies, may be used by
federal agencies even before the completion of such companion publications. Thus, until
each publication is completed, current requirements, guidelines, and procedures, where
they exist, remain operative. For planning and transition purposes, federal agencies may
wish to closely follow the development of these new publications by NIST. This guideline focuses on the authentication of subjects who interact with government
information systems over networks to establish that a given claimant is a subscriber
who has been previously authenticated. The result of the authentication process may
be used locally by the system performing the authentication or asserted elsewhere in a
federated identity system. This document defines technical requirements for each of the
three authentication assurance levels. The guidelines are not intended to constrain the
development or use of standards outside of this purpose. This publication supersedes
NIST Special Publication (SP) 800-63B. The Information Technology Laboratory (ITL) at the National Institute of Standards and
Technology (NIST) promotes the U.S. economy and public welfare by providing technical
leadership for the Nation’s measurement and standards infrastructure. ITL develops
tests, test methods, reference data, proof of concept implementations, and technical
analyses to advance the development and productive use of information technology. ITL’s responsibilities include the development of management, administrative, technical,
and physical standards and guidelines for the cost-effective security and privacy of other
than national security-related information in federal information systems.

Digital Identity Guidelines_ Authentication and Authenticator Management


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Information Integrity?

[Assistant]
According to Risk Management Framework for Information Systems and Organizations_ A System Life Cycle Approach for Security and Privacy:

As we push computers to 'the edge,' building a complex world of interconnected information systems and devices, security and privacy risks (including supply chain risks) continue to be a large part of the national conversation and topics of great importance. The significant increase in the complexity of the hardware, software, firmware, and systems within the public and private sectors (including the U.S. critical infrastructure) represents a significant increase in attack surface that can be exploited by adversaries. Moreover, adversaries are using the supply chain as an attack vector and effective means of penetrating our systems, compromising the integrity of system elements, and gaining access to critical assets.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Likely Exploited Vulnerabilities_ A Proposed Metric for Vulnerability Exploitation Probability provide? (Part 7)

[Assistant]
elihood that a vulnerability has been observed to be exploited. Only a small fraction of the tens of thousands of software and hardware vulnerabilities that are published every year will be exploited.
Predicting which ones is important for the efficiency and cost effectiveness of enterprise vulnerability remediation efforts. One study shows that only 5 % of vulnerabilities have been observed to be exploited in the wild [2], while the monthly vulnerability remediation rate for companies is 16 % [3]. The remediation rate is so low because it is expensive for companies to address vulnerabilities. Security patches must be tested with enterprise software to ensure continuity of operations; some vulnerabilities require non-patch remediations that require human deployment. This situation would not be a problem if the 16 % were to cover the 5 %, but metrology is lacking to accurately make that calculation. Thus, predicting which vulnerabilities will be exploited is critically important for the efficiency and cost-effectiveness of enterprise vulnerability remediation efforts. One effort that has made great progress towards this goal is the Exploit Prediction Scoring System (EPSS). EPSS provides probabilities that a vulnerability will be observed to be exploited in the wild within the next 30 days [4]. However, its probabilities are known to be inaccurate for vulnerabilities that have been previously observed to be exploited; this is stated in the EPSS documentation itself [1]. Fortunately, the probabilities are not randomly inaccurate; they underestimate the true probability. Another area that is foundational for vulnerability remediation prioritization are Known Exploited Vulnerability (KEV) lists. KEV lists are enumerations of vulnerabilities that have definitively been exploited in the past (e.g., [5] and [6]). However, such lists may not be comprehensive, and prior to this research, metrology did not exist to measure their coverage.

Likely Exploited Vulnerabilities_ A Proposed Metric for Vulnerability Exploitation Probability


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Guide for Developing Security Plans for Federal Information Systems provide? (Part 2)

[Assistant]
lines, including minimum requirements, for providing adequate information security for all agency operations and assets, but such standards and guidelines shall not apply to national security systems.
This guideline is consistent with the requirements of the Office of Management and Budget (OMB) Circular A-130, Section 8b(3), Securing Agency Information Systems, as analyzed in A-130, Appendix IV: Analysis of Key Sections. Supplemental information is provided in A-130, Appendix III. This guideline has been prepared for use by federal agencies. It may be used by nongovernmental organizations on a voluntary basis and is not subject to copyright. (Attribution would be appreciated by NIST.)

Nothing in this document should be taken to contradict standards and guidelines made mandatory and binding on federal agencies by the Secretary of Commerce under statutory authority. Nor should these guidelines be interpreted as altering or superseding the existing authorities of the Secretary of Commerce, Director of the OMB, or any other federal official. Certain commercial entities, equipment, or materials may be identified in this document in order to describe an experimental procedure or concept adequately. Such identification is not intended to imply recommendation or endorsement by the National Institute of Standards and Technology, nor is it intended to imply that the entities, materials, or equipment are necessarily the best available for the purpose. iii

## Acknowledgements

The National Institute of Standards and Technology would like to acknowledge the authors of the original NIST Special Publication 800-18, Guide for Developing Security Plans for Information Technology System. The original document was used as the foundation for this revision. Additionally, thank you to all the NIST staff that reviewed and commented on the document.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Ordered t-way Combinations for Testing State-based Systems provide? (Part 7)

[Assistant]
y combinations in other rows. For three Boolean parameters a,  b,  c in  Fig. 3, ab =00 is  followed  by ab =10 ab =00 ac =11 ac =01 bc =01 ( ac =01 and bc =01 are also followed by this group). Fig 3.
Ordered combinations of parameter values

|   a |   b |   c |
|-----|-----|-----|
|   0 |   0 |   1 |
|   1 |   0 |   1 |
|   0 |   0 |   1 |

Combinations of parameter values such as this can be significant in protocol verification and testing, such as  with  combinations  of  values  in  each  packet affecting the state where  later packets  produce different responses depending  on  the state that resulted from previous packet orders. Definition 2. An ordered combination cover , OCC( N,s,t,p,v ), covers all s -orders of t -way combinations of the v values of p parameters, where t is the number of parameters in combinations and s is the number of combinations in an ordered series. Permutations of parameter value combinations may appear  multiple  times  in  a  combination  order. For example, a particular 2-order of 2-way combinations may be ( p 1 p 2 = 01) *→ ( p 2 p 4 = 11). The  utility  of  combination  order  covering  can  be illustrated  with  an  example. Consider  the  covering array in Fig. 4, which includes all 2-way combinations of four Boolean variables. Fig. 4. 2-way covering array of Boolean variables. |   Test |   p 1 |   p 2 |   p 3 |   p 4 |
|--------|-------|-------|-------|-------|
|      1 |     0 |     0 |     1 |     0 |
|      2 |     0 |     1 |     0 |     1 |
|      3 |     1 |     0 |     0 |     1 |
|      4 |     1 |     1 |     1 |     0 |
|      5 |     0 |     1 |     0 |     0 |
|      6 |     0 |     0 |     1 |     1 |

Suppose  these  six  tests  are  applied  to  the  system modeled with a finite state machine diagram in Fig. 5, and tests are run in the order 1..6. If condition A = 'p1 ∧ p2' and condition B = 'p1 ∧ ~p2', then the error in state 2 will not be discovered.

Ordered t-way Combinations for Testing State-based Systems


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Security Assessment?

[Assistant]
According to Access Control on NoSQL Databases:

Just like RDMBS, NoSQL databases are susceptible to injection attacks, which allow attackers to add malicious data to the NoSQL and cause unavailability and corrupt data. NoSQL injection attacks typically occur when the attack string is parsed, evaluated, or concatenated into a NoSQL API call. Attackers who are familiar with the syntax, data model, and underlying programming language of the target database can design specific exploits, especially in cases where server-side middleware (e.g., JavaScript, PHP) is heavily used to enhance database performance. For example, an internal operator '$where,' designed to be used like the 'where' clause in SQL, can accept sophisticated JavaScript functions to filter data. An attacker can exploit this by passing arbitrary code or commands into the $where operator as part of the query. The Open Worldwide Application Security Project (OWASP) Test Guide (v4) [OW] plans to include new procedures for testing NoSQL injections to assess NoSQL systems built upon JavaScript and/or PHP engines that may possess similar vulnerabilities [CJ]. - [CJ] Crawford J (2014) Current Data Security Issues of NoSQL Databases, Fidelis Cybersecurity Volume 17 . Available at https://silo.tips/download/current-data-security-issues-ofnosql-databases
- [FA] Fullstack Academy (2017) RDF Tutorial - An Introduction to the Resource Description Framework. Available at https://www.youtube.com/watch?v=zeYfT1cNKQg
- [FF] Colombo P, Ferrari E. (2016) Fine-Grained Access Control Within NoSQL DocumentOriented Datastores, Data Sci. Eng. 1, pp 127-138. https://doi.org/10.1007/s41019-0160015-z
- [HI] hiteshreddy2181(2023) Types of NoSQL Databases, Geeksforgeeks . Available at https://www.geeksforgeeks.org/types-of-nosql-databases/
- [HS] Hu VC, Quirolgico S, Scarfone K (2008) Access Control Policy Composition for Resource Federation Networks Using Semantic Web and Resource Description Framework (RDF), Proceeding of 2008 International Computer Symposium , pp 497-502 (v1).


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AT.L2-3.2.4 (NIST 3.2.4)?

[Assistant]
According to Multi-Factor Authentication for Criminal Justice Information Systems_ Implementation Considerations for Protecting Criminal Justice Information:

3.2.4. 3.2.4.

Multi-Factor Authentication for Criminal Justice Information Systems_ Implementation Considerations for Protecting Criminal Justice Information


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for Risk Assessment?

[Assistant]
According to Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171:

Advanced Persistent Threat; Basic Security Requirement; Contractor Systems; Controlled Unclassified Information; CUI Registry; Derived Security Requirement; Enhanced Security Requirement; Executive Order 13556; FIPS Publication 199; FIPS Publication 200; FISMA; NIST Special Publication 800-53; Nonfederal Organizations; Nonfederal Systems; Security Assessment; Security Control; Security Requirement. This publication is a supplement to NIST Special Publication 800-171 [SP 800-171]. It contains recommendations  for  enhanced  security  requirements  to  provide  additional  protection  for Controlled Unclassified Information (CUI) in nonfederal systems and organizations when such information is  associated  with critical  programs  or  high  value  assets. The  enhanced  security requirements are designed to respond to the advanced persistent threat (APT) and supplement the basic and derived security requirements in [SP 800-171]. While the security requirements in [SP 800-171] focus primarily on confidentiality protection, the enhanced security requirements in this publication address confidentiality, integrity, and availability protection. The enhanced security requirements are implemented in addition to the basic and derived requirements since those requirements are not designed to address the APT. The enhanced security requirements apply to those components of nonfederal systems that process, store, or transmit CUI or that provide protection for such components. There is no expectation that all of the enhanced security requirements will be selected by federal agencies implementing this guidance. The decision to select a particular set of enhanced security requirements will be based on the mission and business needs of federal agencies and guided and informed by ongoing risk assessments.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Identification and Authentication?

[Assistant]
According to Guide to Malware Incident Prevention and Handling for Desktops and Laptops:

| 1 | | 1.1 | | Purpose and Scope...................................................................................................1 | | | | 1.2 | Audience ...................................................................................................................1 | | | | 1.3 | Document Structure | ..................................................................................................1 | | 2.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171 provide? (Part 8)

[Assistant]
e requirements also apply to services, including externally provided services, that process, store, or transmit CUI, or that provide security protections, for the system requiring enhanced protection.
The protection of a specific service to include CUI that is processed, stored or transmitted during the provision of that service, is achieved by implementing the enhanced security  requirements  for  the  service,  or  the  system  or  system  components  responsible  for providing that service. In addition to protecting CUI from unauthorized disclosure, the enhanced security requirements have been designed to protect the integrity and availability of CUI. This is achieved by promoting penetration-resistant architectures, damage-limiting operations, and designs to help achieve cyber resiliency and survivability. The term organizational system is used in many of the enhanced security requirements. It has a specific meaning regarding the applicability of the enhanced requirements as described above. Appropriate scoping considerations for the requirements are important factors in determining protection-related investment decisions and managing security risk for nonfederal organizations that have the responsibility of protecting CUI associated with critical programs and high value assets. \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

## FRAMEWORK FOR IMPROVING CRITICAL INFRASTRUCTURE CYBERSECURITY

Organizations that have implemented or plan to implement the NIST Framework for Improving Critical Infrastructure Cybersecurity [NIST CSF] can find in Appendix C a mapping of the enhanced security requirements in this publication to the security controls in [SP 800-53].


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Summary of NIST SP 800-53, Revision 4_ Security and Privacy Controls for Federal Information Systems and Organizations provide? (Part 3)

[Assistant] The guide was developed and is maintained by the Joint Task Force Transformation Initiative Interagency Working Group, part of an ongoing information security partnership among the U.S. Department of Defense, the Intelligence Community, the Committee on National Security Systems, the Department of Homeland Security, and U.S. federal civil agencies. SP 800-53 Revision 4 has been updated to reflect the evolving technology and threat space. Example areas include issues particular to mobile and cloud computing; insider threats; applications security; supply chain risks; advanced persistent threat; and trustworthiness, assurance, and resilience of information systems. The revision also contains a new appendix of privacy controls, and related implementation guidance (Appendix J), based on the Fair Information Practice Principles (FIPPs), a widely accepted framework of defining principles to be used in the evaluation and consideration of systems, processes, or programs that affect individual privacy. SP 800-53 Revision 4 is part of the NIST Special Publication 800-series that reports on the NIST Information Technology Laboratory's (ITL) computer security-related research, guidelines, and outreach. The publication provides a comprehensive set of security controls, three security control baselines (low, moderate, and high impact), and guidance for tailoring the appropriate baseline to specific needs according to the organization's missions, environments of operation, and technologies used. As the risk to an information system's confidentiality, integrity and/or availability increases, the need for additional controls to protect the system may also increase accordingly. SP 800-53 Revision 4 provides the security control baselines as the starting point for the security control selection process.

Summary of NIST SP 800-53, Revision 4_ Security and Privacy Controls for Federal Information Systems and Organizations