[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 2 require for System and Information Integrity?

[Assistant]
According to Assessing Security Requirements for Controlled Unclassified Information:

| Access Control                    | Maintenance         | Security Assessment and Monitoring   |
|-----------------------------------|---------------------|--------------------------------------|
| Awareness and Training            | Media Protection    | System and Communications Protection |
| Audit and Accountability          | Personnel Security  | System and Information Integrity     |
| Configuration Management          | Physical Protection | Planning                             |
| Identification and Authentication | Risk Assessment     | System and Services Acquisition      |
| Incident Response                 |                     | Supply Chain Risk Management         |

A.03.07.04.b: media with diagnostic and test programs are checked for malicious code before the media are used in the system.

[SELECT FROM: processes for approving, controlling, and monitoring maintenance tools; mechanisms for supporting or implementing the approval, control, or monitoring of maintenance tools; processes for preventing the unauthorized removal of information; processes for inspecting media for malicious code; mechanisms for supporting media sanitization or the destruction of equipment; mechanisms for supporting the verification of media sanitization; processes for inspecting maintenance tools; mechanisms for supporting or implementing the inspection of maintenance tools; mechanisms for supporting or implementing the inspection of media used for maintenance]

Assessing Security Requirements for Controlled Unclassified Information


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Configuration Management?

[Assistant]
According to Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule_ A Cybersecurity Resource Guide:

| 5.2.4. Device and Media Controls (§ 164.310(d)).................................................................................63                                                                                |
|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| 5.3.1. Access Control (§ 164.312(a)).....................................................................................................65                                                                                |
| 5.3.2. Audit Controls (§ 164.312(b)).....................................................................................................69                                                                                |
| 5.3.3. Integrity (§ 164.312(c))...............................................................................................................71                                                                                |
| 5.3.4. Person or Entity Authentication (§ 164.312(d)).........................................................................73                                                                                |
| 5.3.5. Transmission Security (§ 164.312(e)(1)).....................................................................................75                                                                                |
| 5.4.1.

Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule_ A Cybersecurity Resource Guide


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Incident Response?

[Assistant]
According to Risk Management Framework for Information Systems and Organizations_ A System Life Cycle Approach for Security and Privacy:

assessments. Such collaboration helps organizations leverage information from providers, reduce redundancy, identify potential courses of action for risk responses, and reduce the burden on providers.
Examples of different types of descriptive information that organizations can include in security and privacy plans include: descriptive name of the system and system identifier; system version or release number; manufacturer and supplier information; individual responsible for the system; system contact information; organization that manages, owns, or controls the system; system location; purpose of the system and missions/business processes supported; how the system is integrated into the enterprise architecture; SDLC phase; results of the categorization process and privacy risk assessment; authorization boundary; laws, directives, policies, regulations, or standards affecting individuals' privacy and the security of the system; architectural description of the system including network topology; information types; hardware, firmware, and software components that are part of the system; hardware, software, and system interfaces (internal and external); information flows within the system; network connection rules for communicating with external systems; interconnected systems and identifiers for those systems; physical or other processes, components and equipment controlled by system elements; system users (including affiliations, access rights, privileges, citizenship); system provenance in the supply chain; maintenance or other relevant agreements; potential suppliers for replacement components for the system; alternative compatible system components; number and location in inventory of replacement system components; ownership or operation of the system (government-owned, government-operated; government-owned, contractor-operated; contractor-owned, contractor-operated; nonfederal [state and local governments, grantees]); incident response points of contact; authorization date and authorization termination date; and ongoing authorization status.

Risk Management Framework for Information Systems and Organizations_ A System Life Cycle Approach for Security and Privacy


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Audit and Accountability?

[Assistant]
According to Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule_ A Cybersecurity Resource Guide:

## Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule

## Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule

Marron J (2024) Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule: A Cybersecurity Resource Guide. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) NIST SP 800-66r2. https://doi.org/10.6028/NIST.SP.800-66r2


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Ordered t-way Combinations for Testing State-based Systems provide? (Part 9)

[Assistant]
arting block is reset to 0 {0 = start from last position, 1 = start  from  block  0}. A  read  or  write  test  processes from the starting block indicated by p 2 and continues to the end of the file.
So tests 1 to 4 represent 'read from last read position,' 'read from start,' 'write from last write position,' and 'write from start.' State 1 is entered when the file is filled by writing to the end after  rewinding  to  start. The  failure  represented  by state 2 is only exposed when a write is attempted on a file starting from the end. Then, as noted previously,  running  tests  in  the  order  1..6  will  not detect the error. However, when test 4 is run before test  3,  the  error  will  be  detected  because a write is attempted  from  the  last  position  (end  of  file),  as indicated by the value of p 2 . When  tests  are  executed  in  sequence  with  each individual t-way combination considered an event, an order of tway combinations containing s combinations input in sequence with possible interleaving is an s -sequence of tway combinations. For  example,  a  2-sequence  of  3-way  combinations could be

<!-- formula-not-decoded -->

and  a  3-sequence  of  2-way  combinations  could  be

<!-- formula-not-decoded -->

An OCC covers all ssequences of t -way combinations  of  the v values  of  the p parameters. Because a t -tuple is included s times in an ssequence, and the number of t -way combinations of p parameters is 𝐶𝐶 ( 𝑝𝑝 , 𝑡𝑡 ), for v t settings of each combination, the total number of combination sequence tuples to be covered is

<!-- formula-not-decoded -->

The number of combination sequences to be covered grows  rapidly  with s and t ,  so  methods  for  the efficient construction of OCCs are of interest. Example. Fig. 6  shows a test array that covers all 2way combinations of values for four parameters, as well as all 2-sequences of 2-way parameter combinations. Fig.6.

Ordered t-way Combinations for Testing State-based Systems

Audit and Accountability
System and Information Integrity
Security Assessment
Media Protection
Identification and Authentication
Awareness and Training
System and Communications Protection
Access Control
Planning
Incident Response
Risk Assessment
Personnel Security
System and Services Acquisition
Supply Chain Risk Management
Maintenance
Physical Protection
Configuration Management


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for Identification and Authentication?

[Assistant]
According to Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171:

............................................ 5                        |
| 2.1 DEVELOPMENTAPPROACH ......................................................................................................
| 5                                                                                |
| 2.2 ORGANIZATIONANDSTRUCTURE                                                                                | ............................................................................................. 7                                                  |
| 2.3 FLEXIBLE APPLICATION                                                                                | ............................................................................................................. 9                                  |
| CHAPTER THREE THE REQUIREMENTS......................................................................................... 11                       | CHAPTER THREE THE REQUIREMENTS......................................................................................... 11                       |
| 3.1 ACCESSCONTROL                                                                                | .................................................................................................................. 12                            |
| 3.2 AWARENESSANDTRAINING                                                                                | ...................................................................................................

Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Personnel Security?

[Assistant]
According to Federal Cybersecurity Awareness Programs_ A Mixed Methods Research Study:

| [OPM]     | U.S. Office of Personnel Management (2018) Guidance for Identifying, Addressing and Reporting Cybersecurity Work Roles of Critical Need. (U.S. Office of Personnel Management, Washington, DC). Available at https://chcoc.gov/content/guidance-identifying-addressing-and-reporting- cybersecurity-work-roles-critical-need   |
|-----------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| [SANS]    | SANS (2021). 2021 SANS Security Awareness Report: Managing Human Cyber Risk. Available at https://www.sans.org/security-awareness- training/resources/reports/sareport-2021/                                                                                |
| [SMAC]    | CIO.gov (2021) About the SACC and SMAC Councils . Available at https://www.cio.gov/about/members-and-leadership/SMACC/                                                                                |
| [STEWART] | Stewart, G, Lacey, D (2012) Death by a Thousand Facts: Criticising the Technocratic Approach to Information Security Awareness. Information Management &Computer Security 20(1):29-38. |
| [WILSON]  | Wilson M, Hash J (2003) Building an Information Technology Security Awareness and Training Program. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) 800-50.

Federal Cybersecurity Awareness Programs_ A Mixed Methods Research Study


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AT.L2-3.2.3 (NIST 3.2.3)?

[Assistant]
According to Digital Identity Guidelines:

3.2.3. 3.2.3. 3.2.3.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Protecting Controlled Unclassified Information (CUI)_ NIST Special Publication 800-171, Revision 3. Small Business Primer provide? (Part 9)

[Assistant]
NIST does not necessarily endorse the views expressed or the facts presented on those sites. Further, NIST does not endorse any commercial products that may be advertised or available on these sites.
ht ps:/

csrc.nist.gov/projects/protecting-control ed-unclas ified-information

## Introductory Tips for Implementers

<!-- image -->

## What's New in SP 800 -171, Revision 3? ## SP 800-171, Revision 3 was published in May 2024. Significant changes include:

## Updates to the Security Requirements and Families

- Based on NIST SP 800-53, Revision 5 and the NIST SP 800-53B moderate impact control baseline. - Applies updated tailoring criteria addressing stakeholder feedback (adding new, consolidating, and withdrawing requirements). - Includes increased specificity in security requirements. - Introduces organization-defined parameters (ODP) to increase flexibility to better manage organizationspecific risks. ## Additional Revision 3 Resources

- A CUI overlay (.xlsx) showing the direct link between SP 800-53 and SP 800171, including NIST's tailoring decisions. - Transitioning your organization from implementation of Revision 2 to Revision 3? Review this detailed analysis of the changes between Revision 2 and Revision 3 (.xlsx). - The SP 800-171 security requirements in multiple formats (Excel, JSON, and online) through the NIST Cybersecurity and Privacy Reference Tool. ht ps:/

csrc.nist.gov/projects/protecting-control ed-unclas ified-information

## Key Terms

<!-- image -->

<!-- image -->

Control Baseline: A set of controls you can implement to meet strategic, legal, regulatory, or contractual security and privacy requirements and manage risk. Organization-Defined Parameters (ODPs) are included in certain security requirements. ODPs provide the flexibility and specificity needed by organizations to clearly define their CUI security requirements, given the diverse nature of their missions, business functions, operational environments, and risk tolerance.

Protecting Controlled Unclassified Information (CUI)_ NIST Special Publication 800-171, Revision 3. Small Business Primer


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Awareness and Training?

[Assistant]
According to Proceedings of the Cybersecurity in Cyber-Physical Systems Workshop, April 23-24, 2012:

This paper presents a rigorous research plan to study automated  response  within  the  unique  requirements  of  an  AMI.  The proposed solution will help utilities improve on services, operation costs, and reliability. Automated responses in AMI will reduce  the  maintenance  cost  for  utilities,  as  it  improves  the ability  to  troubleshoot  the  distribution  network  by  providing situational  awareness.  Moreover,  automated  response has  the potential to significantly reduce the load on human operators by  automatically  managing  low-level  alarms  generated  by sensors in the network.

Proceedings of the Cybersecurity in Cyber-Physical Systems Workshop, April 23-24, 2012


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 1 require for Risk Assessment?

[Assistant]
According to Summary Report for “Workshop on Updating Manufacturer Guidance for Securable Connected Product Development”:

cybersecurity baseline; Internet of Things (IoT); IoT products; manufacturing; privacy; risk management; securable products; security requirements; software development; threat modelling. |   1. | Government actions to support strengthening IoT cybersecurity need to be coordinated with industry. |
|------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
|    2 | The use of robust frameworks and the adoption of open standards are crucial for effectively managing risks across heterogeneous environments. |
|    3 | The dynamic nature of threats requires more context aware inputs, more proactive tracking and mitigation measures, and more examination into the inputs of the threat modeling approach. |
|    4 | There are market opportunities to securely design the next wave of products with cybersecurity through end of life and instill incentives into the maintenance of existing products. |
|    5 | The balance of shared responsibility between manufacturers and users for improving security varies by sector and needs the right incentives for both. |
|    6 | There are broad challenges to integrating privacy objectives into IoT cybersecurity risk management. |
|    7 | There is an increased awareness for evolving cybersecurity responsibilities across the players of the IoT ecosystem from manufacturers to users of the ecosystem. |

- Broaden the discussions from a focus on the IoT system device component to considerations of entire IoT products (and connected products) to better reflect the wide variety of applications and use cases that exist. - Develop the relationship between risk assessment and threat modeling activities.

Summary Report for “Workshop on Updating Manufacturer Guidance for Securable Connected Product Development”


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Risk Assessment?

[Assistant]
According to Security and Privacy Controls for Information Systems and Organizations:

This publication provides a catalog of security and privacy controls for information systems and
organizations to protect organizational operations and assets, individuals, other organizations,
and the Nation from a diverse set of threats and risks, including hostile attacks, human errors,
natural disasters, structural failures, foreign intelligence entities, and privacy risks. The controls
are flexible and customizable and implemented as part of an organization-wide process to
manage risk. The controls address diverse requirements derived from mission and business
needs, laws, executive orders, directives, regulations, policies, standards, and guidelines. Finally,
the consolidated control catalog addresses security and privacy from a functionality perspective
(i.e., the strength of functions and mechanisms provided by the controls) and from an assurance
perspective (i.e., the measure of confidence in the security or privacy capability provided by the
controls). Addressing functionality and assurance helps to ensure that information technology
products and the systems that rely on those products are sufficiently trustworthy. Organizations must exercise due diligence in managing information security and privacy risk. This
is accomplished, in part, by establishing a comprehensive risk management program that uses
the flexibility inherent in NIST publications to categorize systems, select and implement security
and  privacy  controls  that  meet  mission  and  business  needs,  assess  the  effectiveness  of  the
controls, authorize the systems for operation, and continuously monitor the systems. Exercising
due diligence and implementing robust and comprehensive information security and privacy risk
management  programs  can  facilitate  compliance  with  applicable  laws,  regulations,  executive
orders,  and  governmentwide  policies.

Security and Privacy Controls for Information Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Configuration Management?

[Assistant]
According to Incident Response Recommendations and Considerations for Cybersecurity Risk Management_ A CSF 2.0 Community Profile:

| CSF Element | CSF Element Description | Priority | Recommendations, Considerations, Notes | |---------------|-----------------------------------------------------------------------------------|------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | ID.RA-01 | Vulnerabilities in assets are identified, validated, and recorded | Medium | on cybersecurity risk assessment.

Incident Response Recommendations and Considerations for Cybersecurity Risk Management_ A CSF 2.0 Community Profile


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Ascon-Based Lightweight Cryptography Standards for Constrained Devices_ Authenticated Encryption, Hash, and Extendable Output Functions provide? (Part 7)

[Assistant]
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . |  21 |
| 5. Hash and eXtendable-Output Functions (XOFs) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
|  23 |
| 5.1. Specification of Ascon-Hash256 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . |  23 |
| 5.2. Specification of Ascon-XOF128 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . |  25 |
| 5.3. Specification of Ascon-CXOF128 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . |  28 |
| 5.4. Streaming API for XOF............................................................ |  30 |
| 5.5. Security Strengths . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . |  31 |
| 6. Conformance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . |  31 |

## Appendix A. Implementation Notes.................................................... 35

A.1. A.2. A.3. Conversion

Functions ............................................................ Implementing with

Integers ..................................................... 35

36

Precomputation .................................................................. 39

## Appendix B. Determination of the Initial Values....................................... 40

## List of Tables

| Table 1. Acronyms . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . |   3 |
|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-----|
| Table 2.

Ascon-Based Lightweight Cryptography Standards for Constrained Devices_ Authenticated Encryption, Hash, and Extendable Output Functions


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Assessing Security Requirements for Controlled Unclassified Information provide? (Part 8)

[Assistant]
gnificant contributions from individuals and organizations in the public and private sectors whose constructive comments improved the overall quality, thoroughness, and usefulness of this publication.
The authors also wish to thank the NIST technical editing and production staff - Jim Foti, Jeff Brewer, Eduardo Takamura, Isabel Van Wyk, Cristina Ritfeld, Derek Sappington, and Chris Enloe - for their outstanding support in preparing this document for publication. ## Historical Contributions

The authors wish to acknowledge the following individuals for their historic contributions to this publication: Jon Boyens, Devin Casey, Ned Goren, Gary Guissanie, Jody Jacobs, Jeff Marron, Vicki Michetti, Mark Riddle, Mary Thomas, Gary Stoneburner, Patricia Toth, and Patrick Viscuso. ## 1. Introduction

The security assessment process gathers information and produces evidence to determine the effectiveness of security requirements by:

- Identifying potential problems or shortfalls in security and risk management programs
- Identifying security weaknesses and deficiencies in systems and the environments in which those systems operate
- Prioritizing risk mitigation decisions and activities
- Confirming that identified security weaknesses and deficiencies in the system and environment of operation have been addressed
- Supporting continuous monitoring activities and providing information security situational awareness

## 1.1. Purpose and Applicability

The purpose of this publication is to provide procedures for assessing the security requirements in NIST Special Publication (SP) 800-171, Protecting Controlled Unclassified Information (CUI) in Nonfederal Systems and Organizations [3]. Organizations can use the assessment procedures to generate evidence that the security requirements have been satisfied.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What are the CMMC Level 1 requirements?

[Assistant]
According to IoT Device Cybersecurity Capability Core Baseline:

## NISTIR 8259A

## IoT Device Cybersecurity Capability Core Baseline

Michael Fagan Katerina N. Megas Karen Scarfone Matthew Smith

This publication is available free of charge from: https://doi.org/10.6028/NIST.IR.8259A

<!-- image -->

## NISTIR 8259A

## IoT Device Cybersecurity Capability Core Baseline

Michael Fagan Katerina N. Megas Applied Cybersecurity Division Information Technology Laboratory

Karen Scarfone Scarfone Cybersecurity Clifton, VA

Matthew Smith Huntington Ingalls Industries Annapolis Junction, MD

This publication is available free of charge from: https://doi.org/10.6028/NIST.IR.8259A

May 2020

<!-- image -->

U.S. Department of Commerce Wilbur L. Ross, Jr., Secretary

National Institute of Standards and Technology Walter Copan, NIST Director and Under Secretary of Commerce for Standards and Technology

## National Institute of Standards and Technology Interagency or Internal Report 8259A 23 pages (May 2020)

This publication is available free of charge from: https://doi.org/10.6028/NIST.IR.8259A

Certain commercial entities, equipment, or materials may be identified in this document in order to describe an experimental procedure or concept adequately. Such identification is not intended to imply recommendation or endorsement by NIST, nor is it intended to imply that the entities, materials, or equipment are necessarily the best available for the purpose. There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may be used by federal agencies even before the completion of such companion publications. Thus, until each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning and transition purposes, federal agencies may wish to closely follow the development of these new publications by NIST.

IoT Device Cybersecurity Capability Core Baseline


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Strategies for the Integration of Software Supply Chain Security in DevSecOps CI_CD Pipelines provide? (Part 7)

[Assistant]
.................................16 |
| 5.1.2. Secure Pull-Push Operations on Repositories............................................................................17                      |
| 5.1.3.
Integrity of Evidence Generation During Software Updates......................................................18                               |
| 5.1.4. Secure Code Commits ................................................................................................................19         |

| 5.2.1. Secure CD Pipeline -Case Study (GitOps) ................................................................................21                                                                                |
|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| 6. Summary and Conclusions............................................................................................................23                                                                                |
| References.......................................................................................................................................24                                                                                |
| Appendix A. Mapping of Recommended Security Tasks in CI/CD Pipelines to Recommended High-Level Practices in SSDF..............................................................................................................................26 |
| B.

Strategies for the Integration of Software Supply Chain Security in DevSecOps CI_CD Pipelines


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Access Control?

[Assistant]
According to Approaches and Challenges of Federal Cybersecurity Awareness Programs:

ECURITY AWARENESS APPROACHES..................................................................... | 3 SECURITY AWARENESS APPROACHES.....................................................................
| 3                                                                                |
| 3.1 ANNUAL REQUIRED TRAINING............................................................................................. | 3.1 ANNUAL REQUIRED TRAINING............................................................................................. |                                                                                |
| .................................................................................... | .................................................................................... | 3                                                                                |
| 3.1.1                                                                                | Required Training Fulfillment                                                                                | 3                                                                                |
| 3.1.2                                                                                | Obtaining Training Content........................................................................................

Approaches and Challenges of Federal Cybersecurity Awareness Programs


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Supply Chain Risk Management?

[Assistant]
According to High-Performance Computing Security_ Architecture, Threat Analysis, and Security Posture:

ow software quality. - Granular access control on databases: Since different research groups may have a need to know for different portions of data, granular access control capabilities are necessary.
Access control requirements may need to be dynamically adjusted as some scientific experiments may increase data needs based on the outcome of experiments.

High-Performance Computing Security_ Architecture, Threat Analysis, and Security Posture


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Services Acquisition?

[Assistant]
According to Guide for Developing Security Plans for Federal Information Systems:

|
| 1.1 BACKGROUND............................................................................................................................
| 1                                                                                |
| 1.2 TARGET AUDIENCE.................................................................................................................... | 1                                                                                |
| 1.3 ORGANIZATION OF DOCUMENT.................................................................................................. | 1                                                                                |
| 1.4 SYSTEMS INVENTORY AND FEDERAL INFORMATION PROCESSING STANDARDS (FIPS 199)                                                              | ...... 2                                                                                |
| 1.5 MAJOR APPLICATIONS, GENERAL SUPPORT SYSTEMS, AND MINOR APPLICATIONS                                                                    | .................. 2                                                                                |
| 1.6 OTHER RELATED NIST PUBLICATIONS ..................................................................................... | 3                                                                                |
| 1.7 SYSTEM SECURITY PLAN RESPONSIBILITIES ..............................................................................

Guide for Developing Security Plans for Federal Information Systems


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Recommendation for Pair-Wise Key-Establishment Schemes Using Discrete Logarithm Cryptography provide? (Part 4)

[Assistant]
lishment schemes based on the discrete logarithm problem over finite fields and elliptic curves, including several variations of Diffie-Hellman and Menezes-Qu-Vanstone (MQV) key establishment schemes.
## Keywords

Diffie-Hellman; elliptic curve cryptography; finite field cryptography; key agreement; key confirmation; key derivation; key establishment; MQV. ## Acknowledgements

The authors gratefully acknowledge the contributions on previous versions of this document by Mike Hopper, Don Johnson, Sharon Keller, Laurie Law, and Miles Smid. ## Conformance Testing

Conformance testing for implementations of this Recommendation will be conducted within the framework of the Cryptographic Algorithm Validation Program (CAVP) and the Cryptographic Module Validation Program (CMVP). The requirements of this Recommendation are indicated by the word 'shall.' Some of these requirements may be out-of-scope for CAVP or CMVP validation testing, and thus are the responsibility of entities using, implementing, installing or configuring applications that incorporate this Recommendation. ## Table of Contents

| 1. Introduction.............................................................................................................. 1   | 1. Introduction.............................................................................................................. 1   | 1. Introduction.............................................................................................................. 1     | 1. Introduction..............................................................................................................

Recommendation for Pair-Wise Key-Establishment Schemes Using Discrete Logarithm Cryptography


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AC.L2-3.1.11 (NIST 3.1.11)?

[Assistant]
According to Digital Identity Guidelines_ Identity Proofing and Enrollment:

3.1.11)

3. 3.1.11 requires CSPs that collect or process biometric data to provide detailed,
publicly available information about this process. 3.1.11.

Digital Identity Guidelines_ Identity Proofing and Enrollment


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Proceedings of the Cybersecurity in Cyber-Physical Systems Workshop, April 23-24, 2012 provide? (Part 5)

[Assistant] Farnham Jahanian ...............................................................................45 | | 6 | Security Challenges and Requirements for Control Systems in the Semiconductor Manufacturing Sector....................................................................................72 | | 7 | Keynote Speaker: Tom Dion.................................................................................................94 | | 8 | Application of Dynamic System Models and State Estimation Technology to the Cyber Security of Physical Systems.........................................................96 | | 9 | Challenges of Cybersecurity Research in a Multi-user Cyber-Physical Testbed .................................................................................................................................119 | | 10 | Security of power grids: a European perspective .................................................................135 | | 11 | Understanding the Role of Automated Response Actions to Improve AMI Resiliency .............................................................................................................................157 | | 12 | Cyber-Physical Systems Security for the Smart Grid ..........................................................189 | | 13 | State Estimation and Contingency Analysis of the Power Grid in a Cyber- Adversarial Environment .....................................................................................................215 | | 14 | False Data Injection Attacks in Smart Grid: Challenges and Solutions...............................241 | | 15 | Conclusion............................................................................................................................269 | [This page left intentionally blank.] ## 1.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Risk Assessment?

[Assistant]
According to Overview and Considerations of Access Control Based on Attribute Encryption:

...................................................... | 5                                                                                |
| 2.3.
| Bilinear Pair Mapping.................................................................................................. | 7                                                                                |
| 2.4. | Bilinear Pairing for Cryptography................................................................................ | 9                                                                                |
| 3. | Identity-Based Encryption ..............................................................................................11                  |                                                                                |
| 4. | Attribute-Based Encryption............................................................................................13                    |                                                                                |
| 4.1. | Ciphertext-Policy Attribute-Based Encryption                                                                                | ............................................................13                                                                         |
| 4.2. | Key-Policy Attribute-Based Encryption ......................................................................18                              |                                                                                |
| 5.

Overview and Considerations of Access Control Based on Attribute Encryption


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Identification and Authentication?

[Assistant]
According to Report on the Design-A-Thon_ Designing Effective and Accessible Approaches for Digital Product Cybersecurity Education and Awareness:

Cybersecurity education and awareness can provide critical support for the cybersecurity of digital products. Notably, the capability can inform and educate users about other cybersecurity capabilities, particularly technical capabilities. For example, cybersecurity education and awareness can guide users on creating strong access control credentials and permissions for products where such features are supported. Other information can be delivered using this capability as well, such as expectations for use of the product and other cybersecurity expectations, which can reduce the possibility of a risk being missed or otherwise unaddressed when the product is deployed.

Report on the Design-A-Thon_ Designing Effective and Accessible Approaches for Digital Product Cybersecurity Education and Awareness


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Access Control?

[Assistant]
According to Incident Response Recommendations and Considerations for Cybersecurity Risk Management_ A CSF 2.0 Community Profile:

are are authenticated                                                                                | Medium     | N1: See the notes for PR.
|
| PR.AA-04                                                        | Identity assertions are protected, conveyed, and verified                                                                                | Medium     | N1: See the notes for PR. |
| PR.AA-05                                                        | Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties | Medium     | N1: See the notes for PR. |
| PR.AA-06                                                        | Physical access to assets is managed, monitored, and enforced commensurate with risk                                                                                | Medium     | N1: See the notes for PR. |
| PR.AT (Awareness and Training)                                  | The organization's personnel are provided with cybersecurity awareness and training so that they can perform their cybersecurity-related tasks                                            | Medium     | N1: See the notes for PR. |
| PR.AT-01                                                        | Personnel are provided with awareness and training so that they possess the knowledge and skills to perform general tasks with cybersecurity risks in mind                                | Medium     | N1: See the notes for PR.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Digital Identity Guidelines provide? (Part 3)

[Assistant]
l official. This publication may be used by nongovernmental
organizations on a voluntary basis and is not subject to copyright in the United States. Attribution would, however, be appreciated by NIST.
NIST Technical Series Policies

Copyright, Fair Use, and Licensing Statements
NIST Technical Series Publication Identifier Syntax

Publication History

Approved by the NIST Editorial Review Board on 2025-04-28. Supersedes NIST SP 800-63-3 (June 2017; updated March 2, 2020) https://doi.org/10. 6028/NIST.SP.800-63-3

How to Cite this NIST Technical Series Publication

Temoshok D, Galluzzo R, LaSalle C, Lefkovitz N, Regenscheid A, Choong YY, Proud-
Madruga D, Gupta S (2025) Digital Identity Guidelines. (National Institute of Standards
and Technology, Gaithersburg, MD), NIST Special Publication (SP) NIST SP 800-63-4. https://doi.org/10.6028/NIST.SP.800-63-4

Author ORCID iDs

David Temoshok: 0000-0001-6195-0331
Diana Proud-Madruga: 0000-0002-8972-7809
Yee-Yin Choong: 0000-0002-3889-6047
Ryan Galluzzo: 0000-0003-0304-4239
Sarbari Gupta: 0000-0003-1101-0856
Connie LaSalle: 0000-0001-6031-7550
Naomi Lefkovitz: 0000-0003-3777-3106
Andrew Regenscheid: 0000-0002-3930-527X

Contact Information

mailto:dig-comments@nist.gov

National Institute of Standards and Technology
Attn: Applied Cybersecurity Division, Information Technology Laboratory
100 Bureau Drive (Mail Stop 2000) Gaithersburg, MD 20899-2000

Additional Information

Additional information about this publication is available at https://csrc.nist.gov/pubs/
sp/800/63/4/final, including related content, potential updates, and document history. All comments are subject to release under the Freedom of Information Act (FOIA). NIST SP 800-63-4
July 2025

Abstract

Digital Identity Guidelines

These guidelines cover the identity proofing, authentication, and federation of users
(e.g., employees, contractors, or private individuals) who interact with government
information systems over networks.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 1 require for Supply Chain Risk Management?

[Assistant]
According to IoT Non-Technical Supporting Capability Core Baseline:

| 1. Document assumptions made during the development process and other expectations related to the IoT device, such as: a. Expected customers and use cases b. Physical use and characteristics c. Network access and requirements (e.g., bandwidth requirements) d. Data created and handled by the device e. Expected data inputs and outputs (including error codes, frequency, type/form, range of acceptable values, etc.) f. Assumed cybersecurity requirements for the IoT device g. Laws and regulations with which the IoT device and related support activities comply h. Expected lifespan, anticipated cybersecurity costs related to the IoT device (e.g., price of maintenance), and term of support 2. Document the device cybersecurity capabilities , such as those detailed within NISTIR 8259A, that are implemented within the IoT device and how to configure and use them. 3. Document device design and support considerations related to the IoT device, such as: 4 a. IoT platform 5 used in the development and operation of the IoT device and related documentation b. Protection of software and hardware components of the IoT device (e.g., secure boot, hardware root of trust, and secure enclave) c. Consideration of the known risks related to the IoT device and known potential misuses d. Secure software development and supply chain practices used e. Accreditation, certification, and/or evaluation results for cybersecurity-related practices | • This capability supports Information Dissemination and Education and Awareness. • Manufacturers and/or supporting entities should consider documentation throughout their development lifecycle in order to capture cybersecurity-relevant information when it is available so as to ensure access to this information when it is needed. Documentation will begin as internal resources for a manufacturer and/or supporting entity that can be used in various ways.

IoT Non-Technical Supporting Capability Core Baseline


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Configuration Management?

[Assistant]
According to Workshop on Enhancing Security of Devices and Components Across the Supply Chain:

This session began with Lok Yan from DARPA's Microsystems Technology Office (MTO), whose portfolio includes the Automatic Implementation of Secure Silicon (AISS) program. Lok provided a high-level overview of why the semiconductor community needs to recognize security metrics. Meaningful metrics require assets, use cases, and threats to be clearly identified within the context of a threat model. The value of assets, associated potential threats, and the consequences of an asset's compromise must be quantifiable to support the design decisionmaking process. Understanding and identifying a minimum acceptable security baseline within the context of a particular use case would help bring various security metrics together. Due to the continuously evolving threat space, Lok emphasized that establishing an initial set of metrics and an associated minimum security baseline is not a one-time process. Rather, they must be continuously measured, monitored, and updated as assets, threats, vulnerabilities, and use cases evolve over time. Finally, security metrics could support decisions related to the threat and vulnerability space versus the time to test or implement countermeasures. More time must be allocated to implement and test countermeasures that address the most important threats and vulnerabilities for a particular use case. Jason Oberg, Cycuity CTO and co-founder, described how metrics can be used in the hardware security space based on his organization's experiences. Since different metrics are relevant to different people within an organization (e.g., metrics that work for a designer or tester may not translate to executives), there need to be different tiers of metrics based on the audience or user. For example, the CWE structure could be used to define security requirements that lead to associated security metrics.

Workshop on Enhancing Security of Devices and Components Across the Supply Chain


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] How does Assessing Enhanced Security Requirements for Controlled Unclassified Information support CMMC certification?

[Assistant]
According to Assessing Enhanced Security Requirements for Controlled Unclassified Information:

lar A-130. Nothing in this publication should be taken to contradict the standards and guidelines made mandatory and binding on federal agencies by the Secretary of Commerce under statutory authority.
Nor should these guidelines be interpreted as altering or superseding the existing authorities of the Secretary of Commerce, OMB Director, or any other federal official. This publication may be used by nongovernmental organizations on a voluntary basis and is not subject to copyright in the United States. Attribution would, however, be appreciated by NIST. National Institute of Standards and Technology Special Publication 800-172A Natl. Inst. Stand. Technol. Spec. Publ. 800-172A, 62 pages (March 2022)

CODEN: NSPUE2

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-172A

Certain  commercial  entities,  equipment,  or  materials  may  be  identified  in  this  document  to describe an experimental procedure or concept adequately. Such identification is not intended to imply recommendation or endorsement by NIST, nor is it intended to imply that the entities, materials, or equipment are necessarily the best available for the purpose. There may be references in this publication to other publications currently under development by  NIST  in  accordance  with  its  assigned  statutory  responsibilities. The  information  in  this publication, including concepts, practices, and methodologies, may be used by federal agencies even  before  the  completion  of  such  companion  publications. Thus,  until  each  publication  is completed,  current  requirements,  guidelines,  and  procedures,  where  they  exist,  remain operative. For planning and transition purposes, federal agencies may wish to closely follow the development of these new publications by NIST. Organizations are encouraged to review draft publications during the public comment periods and provide feedback to NIST.

Assessing Enhanced Security Requirements for Controlled Unclassified Information


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Planning?

[Assistant]
According to Status Report on the First Round of the Additional Digital Signature Schemes for the NIST Post-Quantum Cryptography Standardization Process:

There may be references in this publication to other publications currently under development by NIST in
accordance with its assigned statutory responsibilities. The information in this publication, including
concepts and methodologies, may be used by federal agencies even before the completion of such
companion publications. Thus, until each publication is completed, current requirements, guidelines, and
procedures, where they exist, remain operative. For planning and transition purposes, federal agencies
may wish to closely follow the development of these new publications by NIST.

Status Report on the First Round of the Additional Digital Signature Schemes for the NIST Post-Quantum Cryptography Standardization Process


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Risk Assessment?

[Assistant]
According to Workshop on Enhancing Security of Devices and Components Across the Supply Chain:

ir life cycle. Furthermore, Jonathan stressed the importance and continued need for public-private partnerships, like the Semiconductor Research Corporation and the Semiconductor Industry Association.
He also stressed the need for continued conversations concerning advanced metrology for supply chain trust and assurance, guidelines for security analytics and automation, vulnerability management across all product life cycles, and the use of machine learning in chip design and manufacturing.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Audit and Accountability?

[Assistant]
According to A Zero Trust Architecture Model for Access Control in Cloud-Native Applications in Multi-Cloud Environments:

- Sidecar - Beside each application instance to intercept all traffic into and out of the application and handles east-west internal communication between services in the infrastructure. This is the primary use case of the service mesh.
- Ingress gateway - Controls how applications in the cluster are exposed outside (e.g., managing what names, certificates, ports, protocols, and application endpoints are served to the world outside of the cluster). Think of this as the service mesh control plane that manages a traditional reverse proxy similar to Spring Cloud Gateway, NGINX, or HAProxy.
- Egress gateway - Controls how applications in the cluster communicate with the outside world. This can be used for traditional egress filtering and logging, like a Squid proxy, but can also implement an identity-based policy for what is allowed to call out and perform credential exchange , or present a set of credentials (e.g., an mTLS certificate for a partner API), on behalf of the application so that the application does not need to handle them (e.g., communicating via mTLS with the partner API). Think of this as a nextgeneration identity-aware Squid proxy.
- Edge gateway - Accepts external traffic before the ingress gateway and performs finegrained load balancing across clusters or sites. It is used to terminate external traffic, enable infrastructure-level failover, deploy blue-green clusters, and facilitate ingressgateway-per-team deployments without requiring each of those teams to have publicly routable ingress gateways. Think of this as a modern software-based local traffic manager, like F5, that can apply policy per-request rather than per-connection.

A Zero Trust Architecture Model for Access Control in Cloud-Native Applications in Multi-Cloud Environments


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Audit and Accountability?

[Assistant]
According to Digital Identity Guidelines_ Identity Proofing and Enrollment:

3.3. General Privacy Requirements . . . . . . . . . . . . . . . . . . . . . . .

3.3.1. Privacy Risk Assessment . . . . . . . . . . . . . . . . . . . . . .

3.3.2. Additional Privacy Protective Measures . . . . . . . . . . . . . .


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Incident Response Recommendations and Considerations for Cybersecurity Risk Management_ A CSF 2.0 Community Profile provide? (Part 8)

[Assistant]
ident-related communications. Many individuals, teams, and third parties hold a wide variety of roles and responsibilities across all of the Functions that support an organization's incident response.
Organizations have no direct control over the tactics and techniques used by their adversaries, nor are they certain about the timing of a future incident other than knowing that another incident is inevitable. However, organizations can use an incident response life cycle framework or model that best suits them to develop strong cybersecurity risk management practices that reduce their risks to acceptable levels. This publication uses the CSF 2.0 Functions, Categories, and Subcategories to organize its recommendations, considerations, and other information regarding incident response as a CSF 2.0 Community Profile. Doing so provides a common taxonomy that is already widely used for communicating about incident response and cybersecurity risk management and governance. This also enables organizations to access a range of online resources mapped to each Function, Category, and Subcategory through the NIST Cybersecurity and Privacy Reference Tool (CPRT). These resources include mappings to other incident response and cybersecurity risk management standards and guidance, as well as sources of implementation guidance that organizations can choose to utilize as needed. Organizations should use the incident response life cycle framework or model that suits them best. The model in this document is based on CSF 2.0 to take advantage of the wealth of resources available for CSF 2.0 and aid organizations that are already using the CSF. Regardless of the incident response life cycle framework or model used, every organization should take incident response into consideration throughout their cybersecurity risk management activities. ## 1.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for System and Information Integrity?

[Assistant]
According to Assessing Enhanced Security Requirements for Controlled Unclassified Information:

| CHAPTERONE INTRODUCTION...................................................................................................... | CHAPTERONE INTRODUCTION...................................................................................................... | 1   |
|-----------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------|-----|
| 1.1                                                                                | PURPOSEANDAPPLICABILITY............................................................................................................. 1        | 2   |
| 1.2                                                                                | TARGET AUDIENCE.............................................................................................................................. |     |
| 1.3                                                                                | ORGANIZATIONOF THIS SPECIAL PUBLICATION................................................................................. | 2   |
| CHAPTERTWO THE FUNDAMENTALS............................................................................................ | CHAPTERTWO THE FUNDAMENTALS............................................................................................ | 3   |
| 2.1                                                                                | ASSESSMENT PROCEDURES................................................................................................................


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What are the CMMC Level 3 requirements?

[Assistant]
According to Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171:

## NIST Special Publication 800-172

## Enhanced Security Requirements for Protecting Controlled Unclassified Information

A Supplement to NIST Special Publication 800-171

RON ROSS VICTORIA PILLITTERI GARY GUISSANIE RYAN WAGNER RICHARD GRAUBART

DEB BODEAU

This publication is available free of charge from:

https://doi.org/10.6028/NIST.SP.800-172

<!-- image -->

## NIST Special Publication 800-172

## Enhanced Security Requirements for Protecting Controlled Unclassified Information

A Supplement to NIST Special Publication 800-171

## RON ROSS VICTORIA PILLITTERI

Computer Security Division

National Institute of Standards and Technology

## GARY GUISSANIE RYAN WAGNER

Institute for Defense Analyses

RICHARD GRAUBART DEB BODEAU

The MITRE Corporation

This publication is available free of charge from:

https://doi.org/10.6028/NIST.SP.800-172

## February 2021

<!-- image -->

U.S. Department of Commerce Wynn Coggins, Acting Secretary

National Institute of Standards and Technology James K. Olthoff, Performing the Non-Exclusive Functions and Duties of the Under Secretary of Commerce for Standards and Technology & Director, National Institute of Standards and Technology

\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

## Authority

This publication has been developed by NIST to further its statutory responsibilities under the Federal Information Security Modernization Act (FISMA), 44 U.S.C. § 3551 et seq. , Public Law (P.L.) 113-283. NIST is responsible for developing information security standards and guidelines, including minimum requirements for federal information systems, but such standards and guidelines shall not apply to national security systems without the express approval of the appropriate federal officials exercising policy authority over such systems.

Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Status Report on the Fourth Round of the NIST Post-Quantum Cryptography Standardization Process provide? (Part 6)

[Assistant]
|
| 4. Conclusion . . | . . . . . . . . . . . . . . . . . . . . . . . . . . | 18             |
| References . . | . . . . . . . . . . . . . . . . . . . . . . . . . . . | 19             |
| Appendix A.
List of Symbols, Abbreviations, and Acronyms                                                                                | . | 26             |
| List of Tables                                                                                | List of Tables                                                                                | List of Tables |
| Table 1. Timeline of the NIST Post-Quantum Cryptography Standardization Process                                                                                | Table 1. Timeline of the NIST Post-Quantum Cryptography Standardization Process                                                                                | 2              |
| Table 2. Fourth-round KEM candidates organized by category, with the candidate se- lected for standardization bolded and in blue . . . . . . . . . . . . . . . . | Table 2. Fourth-round KEM candidates organized by category, with the candidate se- lected for standardization bolded and in blue . . . . . . . . . . . . . . . . | 4              |
| Table 3. Performance of BIKE in thousands of cycles on x86_64 [1] . . . | Table 3. Performance of BIKE in thousands of cycles on x86_64 [1] . . . | 6              |
| Table 4. Performance of HQC in thousands of cycles on x86_64 [1] . . . | Table 4. Performance of HQC in thousands of cycles on x86_64 [1] . . . | 6              |
| Table 5. Performance of Classic McEliece in thousands of cycles on x86_64                                                                                | Table 5.

Status Report on the Fourth Round of the NIST Post-Quantum Cryptography Standardization Process


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] How does Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171 support CMMC certification?

[Assistant]
According to Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171:

systems, but such standards and guidelines shall not apply to national security systems without the express approval of the appropriate federal officials exercising policy authority over such systems.
This guideline is consistent with requirements of the Office of Management and Budget (OMB) Circular A-130. Nothing in this publication should be taken to contradict the standards and guidelines made mandatory and binding on federal agencies by the Secretary of Commerce under statutory authority. Nor should these guidelines be interpreted as altering or superseding the existing authorities of the Secretary of Commerce, OMB Director, or any other federal official. This publication may be used by nongovernmental organizations on a voluntary basis and is not subject to copyright in the United States. Attribution would, however, be appreciated by NIST. National Institute of Standards and Technology Special Publication 800-172 Natl. Inst. Stand. Technol. Spec. Publ. 800-172, 84 pages (February 2021)

CODEN: NSPUE2

This publication is available free of charge from:

https://doi.org/10.6028/NIST.SP.800-172

Certain  commercial  entities,  equipment,  or  materials  may  be  identified  in  this  document  to describe an experimental procedure or concept adequately. Such identification is not intended to imply recommendation or endorsement by NIST, nor is it intended to imply that the entities, materials, or equipment are necessarily the best available for the purpose. There may be references in this publication to other publications currently under development by  NIST  in  accordance  with  its  assigned  statutory  responsibilities. The  information  in  this publication, including concepts, practices, and methodologies, may be used by federal agencies even  before  the  completion  of  such  companion  publications. Thus,  until  each  publication  is completed,  current  requirements,  guidelines,  and  procedures,  where  they  exist,  remain operative.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Assessing Enhanced Security Requirements for Controlled Unclassified Information provide? (Part 7)

[Assistant]
nts, third-party assessments, or assessments conducted by sponsoring organizations (e.g., government agencies). Such approaches may be specified in contracts or in agreements by participating parties.
\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

## DEFINITION AND USAGE OF THE TERM INFORMATION SYSTEM

Unless specified by legislation, regulation, or government-wide policy, the term system is used in this publication instead of information system . This change reflects a broad-based and holistic definition of systems that includes general-purpose systems, industrial control systems, cyberphysical systems, and individual devices that are part of the Internet of Things. As computing systems and information technologies are deployed ubiquitously worldwide and systems and components are increasingly connected through wired and wireless networks, the susceptibility of Controlled Unclassified Information to loss or compromise grows - as does the potential for adverse consequences resulting from such occurrences. \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

## ORGANIZATIONAL SYSTEMS

The term organizational system is used in many of the CUI enhanced security requirements in [SP 800-172] and the associated assessment procedures in this publication. In that context, an organizational system is a nonfederal system that processes, stores, or transmits CUI associated with a critical program or high value asset. Specifically, enhanced security requirements apply to  the  system components or services that  process,  store,  or  transmit  CUI  or  that  provide security protections for those components or services as mandated by a federal agency in a contract, grant, or other agreement.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 1 require for Risk Assessment?

[Assistant]
According to Summary Report for “Workshop on Updating Manufacturer Guidance for Securable Connected Product Development”:

re IoT products (and connected products) to better reflect the wide variety of applications and use cases that exist. - Develop the relationship between risk assessment and threat modeling activities.
- Address the different cybersecurity considerations among Information Technology (IT), Internet of Things (IoT), Operational Technology (OT), and Industrial Internet of Things (IIoT)
- Identify insights, considerations, approaches, etc. for IoT based on the NIST Privacy Framework, NIST Cyber Physical Systems/IoT Framework, NIST Cybersecurity Framework 2.0, and the NIST Secure Software Development Framework.

Summary Report for “Workshop on Updating Manufacturer Guidance for Securable Connected Product Development”


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Media Protection?

[Assistant]
According to High-Performance Computing Security_ Architecture, Threat Analysis, and Security Posture:

## 4.2. Compute Node Sanitization

Examples of compute node sanitization include:

Compute node sanitization is highly recommended as the compute nodes are equipped with sophisticated hardware accelerators. Nevertheless, the process of sanitization must be carefully balanced with the goal of maximizing the utilization of HPC systems.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Physical Protection?

[Assistant]
According to Recommendation for Pair-Wise Key-Establishment Using Integer Factorization Cryptography:

------------------------------------------------------------------|
| Symmetric-key algorithm    | A cryptographic algorithm that uses secret keying material that is shared between authorized parties.
|
| Targeted security strength | The security strength that is intended to be supported by one or more implementation-related choices (such as algorithms, primitives, auxiliary functions, parameter sizes and/or actual parameters) for the purpose of instantiating a cryptographic mechanism. In this Recommendation, it is assumed that the targeted security strength of any instantiation of an approved key-establishment scheme has a value greater than or equal to 112 bits and less than or equal to 256 bits. |
| Trusted association        | Assurance of the integrity of an asserted relationship between items of information that may be provided by cryptographic or non- cryptographic (e.g., physical) means. Also see Binding. |
| Trusted party              | A party that is trusted by an entity to faithfully perform certain services for that entity. An entity may choose to act as a trusted party for itself. |
| Trusted third party        | A third party, such as a CA, that is trusted by its clients to perform certain services. (By contrast, the two participants in a key- establishment transaction are considered to be the first and second parties.)                                                                                |

Recommendation for Pair-Wise Key-Establishment Using Integer Factorization Cryptography


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Incident Response?

[Assistant]
According to Digital Identity Guidelines_ Identity Proofing and Enrollment:

3.6.

4.3.6. Verification Requirements . . . . . . . . . . . . . . . . . . . . .

3.6. Redress Requirements


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Personnel Security?

[Assistant]
According to Secure Software Development Practices for Generative AI and Dual-Use Foundation Models_ An SSDF Community Profile:

| Practice | Task | Priority | Recommendations [R], Considerations [C], and Notes [N] Specific to AI Model Development | Informative References | |--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------| | Implement Roles and Responsibilities (PO.2): Ensure that everyone inside and outside of the organization involved in the SDLC is prepared to perform their SDLC-related roles and responsibilities throughout the SDLC.

Secure Software Development Practices for Generative AI and Dual-Use Foundation Models_ An SSDF Community Profile


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Overview and Considerations of Access Control Based on Attribute Encryption provide? (Part 9)

[Assistant]
| List of Figures                                                                                |
| Fig. 1.
P + (- P ) = P - P = 0 in an elliptic curve ............................................................................ | Fig. 1. P + (- P ) = P - P = 0 in an elliptic curve ............................................................................ | 4                                                                                |
| Fig. 2. P + Q in an elliptic curve ................................................................................................. | Fig. 2. P + Q in an elliptic curve ................................................................................................. | 5                                                                                |
| Fig. 3 . Basic process steps of the CP-ABE scheme..................................................................14                       | Fig. 3 . Basic process steps of the CP-ABE scheme..................................................................14                       |                                                                                |
| Fig. 4. Tree structure of an example access control policy........................................................15                        | Fig. 4. Tree structure of an example access control policy........................................................15                        |                                                                                |
| Fig. 5. Basic process steps of KP-ABE scheme........................................................................19                      | Fig. 5.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Information Integrity?

[Assistant]
According to NIST Cybersecurity Framework 2.0_ Quick-Start Guide for Cybersecurity Supply Chain Risk Management (C-SCRM):

Configure platforms to allow the installation of organization-approved software only. 2. Verify the source of new software and the software's integrity before installing it. 3. Configure platforms to use only approved DNS services that block access to known malicious domains. 4. ... | • NIST SP 800-161r1, control SI-3 • ISO 27002:2022, control 8.7 • … |
| …                                                                                |                   |                                                                                |                                                                     |

NIST Cybersecurity Framework 2.0_ Quick-Start Guide for Cybersecurity Supply Chain Risk Management (C-SCRM)


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Planning?

[Assistant]
According to Guide for Developing Security Plans for Federal Information Systems:

## Guide for Developing Security Plans for Federal Information Systems

The National Institute of Standards and Technology would like to acknowledge the authors of the original NIST Special Publication 800-18, Guide for Developing Security Plans for Information Technology System. The original document was used as the foundation for this revision. Additionally, thank you to all the NIST staff that reviewed and commented on the document. | EXECUTIVE SUMMARY.......................................................................................................... | VII                                                                                |
|--------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------|
| 1. INTRODUCTION ........................................................................................................................ | 1                                                                                |
| 1.1 BACKGROUND............................................................................................................................ | 1                                                                                |
| 1.2 TARGET AUDIENCE.................................................................................................................... | 1                                                                                |
| 1.3 ORGANIZATION OF DOCUMENT..................................................................................................


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Analyzing Collusion Threats in the Semiconductor Supply Chain provide? (Part 6)

[Assistant]
tage is the birthplace of an Integrated Circuit (IC). At this stage, the goals and purpose of an integrated circuit (IC) are formulated, and the scope and target of a hardware component are discussed.
Customers, the design, planning, finance teams, and other key stakeholders are involved at this stage. 2. Design: Design stage gives a form to the ideas generated in the concept stage. This is the stage where prototypes of the concept are created with the help of different Computer Aided Design (CAD) tools and analysis of whether the goals identified during the concept stage are met. This stage also includes the use of third-party software and hardware prototyping. 3. Integration: Integration is the stage where different design components from designers and third parties are integrated together. This phase is crucial since many design elements already have tested solutions, so not everything needs to be created from the ground up. It is more feasible to purchase these solutions from third parties and integrate them into the design. 4. Manufacturing: After the IC's design is finished, the manufacturing phase begins. This stage includes several processes, including fabrication and packaging. Due to the high cost of building and maintaining manufacturing facilities, many design houses are fabless and outsource their designs to manufacturers located elsewhere. 5. Testing: Testing is the stage at which manufactured Integrated Circuits (ICs) are tested to ensure that they perform properly. Following the completion of fabrication, each IC undergoes testing. An IC's functionalities are tested here to make sure they adhere to design specifications. 6. Provisioning: Provisioning is the stage where standard and sensitive data are loaded into the manufactured IC. Standard data are generic and mostly available open source, but the sensitive data are anything whose disclosure would compromise IP or security.

Analyzing Collusion Threats in the Semiconductor Supply Chain


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice MA.L2-3.7.1 (NIST 3.7.1)?

[Assistant]
According to Protecting Information and System Integrity in Industrial Control System Environments_ Cybersecurity for the Manufacturing Sector:

3.7.1.

Protecting Information and System Integrity in Industrial Control System Environments_ Cybersecurity for the Manufacturing Sector


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AT.L2-3.2.1 (NIST 3.2.1)?

[Assistant]
According to Recommendation for Pair-Wise Key-Establishment Using Integer Factorization Cryptography:

3.2.1 rsakpg2-basic ... 3.2.1 rsakpg2-basic

rsakpg2-basic is the generator in the RSAKPG2 family such that the private key is in the basic format ( n , d ). 3.2.1) except that the private key is in the prime-factor format: ( p , q , d ).


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 2 require for Incident Response?

[Assistant]
According to Profile of the IoT Core Baseline for Consumer IoT Products:

Cybersecurity utility: The ability to identify IoT products and their components is necessary to support such activities as asset management for updates, data protection, and digital forensics capabilities for incident response. Cybersecurity utility: Protection of data and ensuring proper functionality can be supported by the ability to alert the customer when the device starts operating in unexpected ways, which could mean that unauthorized access is being attempted, malware has been loaded, botnets have been created, device software errors have happened, or other types of actions have occurred that was not initiated by the IoT product user or intended by the developer. 1. The IoT product developer creates awareness and provides education targeted at customers about information relevant to cybersecurity of the IoT product and its product components, including :
- a. The presence and use of IoT product cybersecurity capabilities, including at a minimum :
- i. How to change configuration settings and the cybersecurity implications of changing settings, if any. - ii. How to configure and use access control functionality (e.g., set and change passwords). - iii. How software updates are applied and any instructions necessary for the customer on how to use software update functionality. - iv. How to manage device data including creation, update, and deletion of data on the IoT product. - b. How to maintain the IoT product and its product components during its lifetime, including after the period of security support (e.g., delivery of software updates and patches) from the IoT product developer. - c. How an IoT product and its product components can be securely reprovisioned or disposed of. - d. Vulnerability management options (e.g., configuration and patch management and anti-malware) available for the IoT product or its product components that could be used by customers. - e.

Profile of the IoT Core Baseline for Consumer IoT Products


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does A Zero Trust Architecture Model for Access Control in Cloud-Native Applications in Multi-Cloud Environments provide? (Part 7)

[Assistant]
| Background - Zero Trust Principles and Zero Trust Architecture................................
| 2                                                                                |
|                                                                                | Relationship to Other NIST Guidance Documents...................................................... | 3                                                                                |
|                                                                                | Scope......................................................................................................................... | 3                                                                                |
|                                                                                | Target Audience                                                                                | .........................................................................................................