[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Multi-Factor Authentication for Criminal Justice Information Systems_ Implementation Considerations for Protecting Criminal Justice Information provide? (Part 4)

[Assistant]
nistrative, technical, and physical standards and guidelines for the cost-effective security and privacy of information other than national security-related information in federal information systems.
## Audience

The audience for this document includes state CJIS information security officers (ISOs) and CJIS systems officers (CSOs), law enforcement agency chief information officers (CIOs) and chief information security officers (CISOs), and anyone else responsible for safeguarding CJI. The audience also includes vendors that supply CJI-related technology products and services to agencies that are subject to the CJIS Security Policy. ## Patent Disclosure Notice

NOTICE: ITL has requested that holders of patent claims whose use may be required for compliance with the guidance or requirements of this publication disclose such patent claims to ITL. However, holders of patents are not obligated to respond to ITL calls for patents and ITL has not undertaken a patent search in order to identify which, if any, patents may apply to this publication. As of the date of publication and following call(s) for the identification of patent claims whose use may be required for compliance with the guidance or requirements of this publication, no such patent claims have been identified to ITL. No representation is made or implied by ITL that licenses are not required to avoid patent infringement in the use of this publication. ## Table of Contents

| Executive Summary............................................................................................................................1        |
|-------------------------------------------------------------------------------------------------------------------------------------------------------|
| 1. Introduction...................................................................................................................................3   |
| 2.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 2 require for System and Communications Protection?

[Assistant]
According to Assessing Security Requirements for Controlled Unclassified Information:

| Access Control                    | Maintenance         | Security Assessment and Monitoring   |
|-----------------------------------|---------------------|--------------------------------------|
| Awareness and Training            | Media Protection    | System and Communications Protection |
| Audit and Accountability          | Personnel Security  | System and Information Integrity     |
| Configuration Management          | Physical Protection | Planning                             |
| Identification and Authentication | Risk Assessment     | System and Services Acquisition      |
| Incident Response                 |                     | Supply Chain Risk Management         |

Addressed by 03.13.08.

A.03.01.16.d[02]: wireless access to the system is protected using encryption.

Assessing Security Requirements for Controlled Unclassified Information


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Configuration Management?

[Assistant]
According to Contingency Planning Guide for Federal Information Systems:

| | Introduction ....................................................................................................1 | | |-----------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------| | 1.1 | | Purpose.......................................................................................................................1 | | | 1.2 | | Scope..........................................................................................................................2 | | | 1.3 | | Audience.....................................................................................................................3 | | | 1.4 | Document | Structure....................................................................................................4 | | | Chapter 2.

Contingency Planning Guide for Federal Information Systems


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What guidance does Machine Learning for Access Control Policy Verification provide?

[Assistant]
## NISTIR 8360

## Machine Learning for Access Control Policy Verification

Vincent C. Hu

This publication is available free of charge from: https://doi.org/10.6028/NIST.IR.8360

<!-- image -->

## NISTIR 8360

## Machine Learning for Access Control Policy Verification

Vincent C. Hu

Computer Security Division Information Technology Laboratory

This publication is available free of charge from: https://doi.org/10.6028/NIST.IR.8360

September 2021

<!-- image -->

U.S. Department of Commerce Gina M. Raimondo, Secretary

National Institute of Standards and Technology James K. Olthoff, Performing the Non-Exclusive Functions and Duties of the Under Secretary of Commerce for Standards and Technology & Director, National Institute of Standards and Technology

## National Institute of Standards and Technology Interagency or Internal Report 8360 25 pages (September 2021)

This publication is available free of charge from:

https://doi.org/10.6028/NIST.IR.8360

Certain  commercial  entities,  equipment,  or  materials  may  be  identified  in  this  document  in  order  to  describe  an experimental  procedure  or  concept  adequately. Such  identification  is  not  intended  to  imply  recommendation  or endorsement by NIST, nor is it intended to imply that the entities, materials, or equipment are necessarily the best available for the purpose. There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may  be  used  by  federal  agencies  even  before  the  completion  of  such  companion  publications. Thus,  until  each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning  and  transition  purposes,  federal  agencies  may  wish  to  closely  follow  the  development  of  these  new publications by NIST.

Machine Learning for Access Control Policy Verification

Audit and Accountability
System and Information Integrity
Security Assessment
Media Protection
Identification and Authentication
Awareness and Training
System and Communications Protection
Access Control
Planning
Incident Response
Risk Assessment
Personnel Security
System and Services Acquisition
Supply Chain Risk Management
Maintenance
Physical Protection
Configuration Management


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice IA.L2-3.5.4 (NIST 3.5.4)?

[Assistant]
According to Guide to Malware Incident Prevention and Handling for Desktops and Laptops:

3.5.4                                                                                | Segregation Through Virtualization                                                                                | ... 3.5.4 Segregation Through Virtualization

Browser separation essentially segregates web browsers from each other.

Guide to Malware Incident Prevention and Handling for Desktops and Laptops


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Federal Cybersecurity Awareness Programs_ A Mixed Methods Research Study provide? (Part 9)

[Assistant]
.................................................................................. | 3.3 SECURITY AWARENESS PROGRAMS ...................................................................................
| 12                                                                                |
| 3.3.1                                                                                | Program Size............................................................................................................. | 12                                                                                |
| 3.3.2                                                                                | Team Size .................................................................................................................. | 14                                                                                |
| 4 CONCLUSION................................................................................................................... 17        | 4 CONCLUSION................................................................................................................... 17        | 4 CONCLUSION................................................................................................................... 17        |
| REFERENCES............................................................................................................................ 18 | REFERENCES............................................................................................................................ 18 | REFERENCES............................................................................................................................

Federal Cybersecurity Awareness Programs_ A Mixed Methods Research Study


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Likely Exploited Vulnerabilities_ A Proposed Metric for Vulnerability Exploitation Probability provide? (Part 2)

[Assistant]
ailable at https://csrc.nist.gov/publications/cswp, including related content, potential updates, and document history. All comments are subject to release under the Freedom of Information Act (FOIA).
May 19, 2025

## Abstract

This work presents a proposed security metric to determine the likelihood that a vulnerability has been observed to be exploited. Only a small fraction of the tens of thousands of software and hardware vulnerabilities that are published every year will be exploited. Predicting which ones is important for the efficiency and cost effectiveness of enterprise vulnerability remediation efforts. Currently, such remediation efforts rely on the Exploit Prediction Scoring System (EPSS), which has known inaccurate values, and Known Exploited Vulnerability (KEV) lists, which may not be comprehensive. The proposed likelihood metric may augment EPSS remediation (correcting some inaccuracies) and KEV lists (enabling measurements of comprehensiveness). However, collaboration with industry is necessary to provide necessary performance measurements. ## Keywords

Common Vulnerabilities and Exposures; CVE; Known Exploited Vulnerabilities; KEV; Exploit Prediction Scoring System; EPSS; exploit; Likely Exploited Vulnerabilities; LEV; metrology; prediction; scoring; security; vulnerability. | Table of Contents                                                                                |
|------------------------------------------------------------------------------------------------------------------------------------------------------|
| 1. Introduction...................................................................................................................................1  |
| 2. Background....................................................................................................................................3   |
| 3.

Likely Exploited Vulnerabilities_ A Proposed Metric for Vulnerability Exploitation Probability


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Communications Protection?

[Assistant]
According to Multi-Factor Authentication for Criminal Justice Information Systems_ Implementation Considerations for Protecting Criminal Justice Information:

| A representative cohort of general users can help test the MFA solution before a general user rollout. | • Take volunteers or a selection of the general cohort to test the MFA solution.
• Test IT support and help desk procedures. • Hold user feedback sessions. • Update communications and/or policy based on feedback. |
|       4 | General user rollout               | Once agencies are satisfied with testing from phases 1-3, it is time to proceed to a general rollout. This may not include some user populations that fall into corner cases. | • Provide multiple waves of communication around the MFA transition. • Allow for questions, answers, and feedback. • Provide a clear deadline for making the transition. • Update communications and/or policy based on feedback. • Monitor and grow adoption over time. |
|       5 | Corner case users                  | Corner case requirements may require alternate MFA solutions. | • Enumerate requirements and potential solutions for corner cases. • Test potential solutions with phases 1-3 before rolling out to corner case users. |

Multi-Factor Authentication for Criminal Justice Information Systems_ Implementation Considerations for Protecting Criminal Justice Information


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Summary of NIST SP 800-53, Revision 4_ Security and Privacy Controls for Federal Information Systems and Organizations provide? (Part 3)

[Assistant] The guide was developed and is maintained by the Joint Task Force Transformation Initiative Interagency Working Group, part of an ongoing information security partnership among the U.S. Department of Defense, the Intelligence Community, the Committee on National Security Systems, the Department of Homeland Security, and U.S. federal civil agencies. SP 800-53 Revision 4 has been updated to reflect the evolving technology and threat space. Example areas include issues particular to mobile and cloud computing; insider threats; applications security; supply chain risks; advanced persistent threat; and trustworthiness, assurance, and resilience of information systems. The revision also contains a new appendix of privacy controls, and related implementation guidance (Appendix J), based on the Fair Information Practice Principles (FIPPs), a widely accepted framework of defining principles to be used in the evaluation and consideration of systems, processes, or programs that affect individual privacy. SP 800-53 Revision 4 is part of the NIST Special Publication 800-series that reports on the NIST Information Technology Laboratory's (ITL) computer security-related research, guidelines, and outreach. The publication provides a comprehensive set of security controls, three security control baselines (low, moderate, and high impact), and guidance for tailoring the appropriate baseline to specific needs according to the organization's missions, environments of operation, and technologies used. As the risk to an information system's confidentiality, integrity and/or availability increases, the need for additional controls to protect the system may also increase accordingly. SP 800-53 Revision 4 provides the security control baselines as the starting point for the security control selection process.

Summary of NIST SP 800-53, Revision 4_ Security and Privacy Controls for Federal Information Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Identification and Authentication?

[Assistant]
According to Guide for Developing Security Plans for Federal Information Systems:

Before the system security plan can be developed, the information system and the information resident within that system must be categorized based on a FIPS 199 impact analysis. Then a determination can be made as to which systems in the inventory can be logically grouped into major applications or general support systems. The FIPS 199 impact levels must be considered when the system boundaries are drawn and when selecting the initial set of security controls (i.e., control baseline). The baseline security controls can then be tailored based on an assessment of risk and local conditions including organization-specific security requirements, specific threat information, costbenefit analyses, the availability of compensating controls, or special circumstances. Common security controls, which is one of the tailoring considerations, must be identified prior to system security plan preparation in order to identity those controls covered at the agency level, which are not system-specific. These common security controls can then be incorporated into the system security plan by reference. - -Security controls associated with public access information systems must be carefully considered and applied with discretion since some of the security controls from the specified security control baselines (e.g., personnel security controls, identification and authentication controls) may not be applicable to users accessing information systems through public interfaces. 12

12 For example, while the baseline security controls require identification and authentication of organizational personnel who maintain and support information systems that provide public access services, the same controls might not be required for users accessing those systems through public interfaces to obtain publicly available information.

Guide for Developing Security Plans for Federal Information Systems


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Summary of NIST SP 800-53, Revision 4_ Security and Privacy Controls for Federal Information Systems and Organizations provide? (Part 2)

[Assistant] ## Table of Contents | 1 | Introduction ............................................................................................................1 | |------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------| | 2 | NIST SP 800-53 Revision 4 and the Risk Management Framework (RMF)........2 | | 3 | Control Baselines and Tailoring ...........................................................................4 | | 4 | Documenting the Control Selection Process ......................................................5 | | 5 | Assurance...............................................................................................................6 | | 6 | Security Controls ...................................................................................................7 | | 7 | International Information Security Standards .....................................................8 | | 8 | Overlays..................................................................................................................9 | | 9 | Privacy ..................................................................................................................10 | | List of Figures | List of Figures | | Figure 1: Risk Management 3-Tiered Approach.........................................................2 | Figure 1: Risk Management 3-Tiered Approach.........................................................2 | | Figure 2: The Risk Management Framework ..............................................................3 | Figure 2: The Risk Management Framework ..............................................................3 | | Figure 3: Security Control Selection Process ............................................................5 | Figure 3: Security Control Selection Process ............................................................5 | ## 1 Introduction In April, 2013, NIST published an update, Revision 4, to NIST Special Publication 800-53, Security and Privacy Controls for Federal Information Systems and Organization .


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Transitioning to the Security Content Automation Protocol (SCAP) Version 2 provide? (Part 5)

[Assistant] 11 | | Appendix B-Acronyms and Abbreviations............................................................14 Appendix C-Glossary | ..............................................................................................15 | | Appendix D-References ..........................................................................................16 | | | List of Figures | List of Figures | | Figure 1: SCAP v2 Architectural Components and Protocols ..................................4 | Figure 1: SCAP v2 Architectural Components and Protocols ..................................4 | | Figure 2: SCAP v2 Architecture: Endpoint Posture Information Collection ............9 | Figure 2: SCAP v2 Architecture: Endpoint Posture Information Collection ............9 | | Figure 3: SCAP v2 Architecture: Vulnerability Information Sharing.......................10 | Figure 3: SCAP v2 Architecture: Vulnerability Information Sharing.......................10 | | Figure 4: SCAP v2 Architecture: Vulnerability Analysis Capabilities.....................11 | Figure 4: SCAP v2 Architecture: Vulnerability Analysis Capabilities.....................11 | | Figure 5: SCAP v2 Architecture: Configuration Setting Checklist Assessment....12 | Figure 5: SCAP v2 Architecture: Configuration Setting Checklist Assessment....12 | ## 1 Introduction This document defines a set of design goals for the next major revision of the Security Content Automation Protocol (SCAP), SCAP v2.

Transitioning to the Security Content Automation Protocol (SCAP) Version 2


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Status Report on the First Round of the Additional Digital Signature Schemes for the NIST Post-Quantum Cryptography Standardization Process provide? (Part 8)

[Assistant]
signature
schemes remained. In July 2022, NIST called for additional digital signature proposals to be considered in the
PQC standardization process to diversify its post-quantum signature portfolio.
Since two
signature schemes based on structured lattices had already been standardized, NIST ex-
pressed particular interest in additional general-purpose signature schemes based on a
security assumption that did not use structured lattices as well as signature schemes with
short signatures and fast verification. NIST published the Call for Proposals for Additional Digital Signatures [2], which specified
the submission requirements and evaluation criteria, and received 50 submission packages
on  June  1,  2023. Of  those,  NIST  accepted  40  First-Round  Candidates  that  consisted  of
signature schemes based on a variety of different security assumptions. The submission
packages of the first-round candidates were posted online at https://csrc.nist.gov/Projec
ts/pqc-dig-sig/round-1-additional-signatures for public review and comment. The Fifth NIST PQC Standardization Conference was held in Rockville, Maryland, on April
10-12, 2024. The submission teams of the accepted first-round candidates were invited to
present posters for their candidate algorithms. Throughout the first round, NIST received
significant  feedback  from  the  cryptographic  community. Based  on  the  public  feedback
and  internal  reviews  of  the  first-round  candidates,  NIST  announced  the  selection  of  14
signature algorithms as Second-Round Candidates in October 2024 to move forward to
the next stage of the standardization process. Table 1 shows a timeline of major events with respect to the Additional Digital Signatures
for the NIST PQC Standardization Process to date. 1

NIST IR 8528
October 2024

Additional Digital Signatures
First Round Status Report

Table 1.

Status Report on the First Round of the Additional Digital Signature Schemes for the NIST Post-Quantum Cryptography Standardization Process


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Personnel Security?

[Assistant]
According to Audit and Evaluation of Computer Security II_ System Vulnerabilities and Controls:

| FOREWORD                                                                        | FOREWORD                                                                                | FOREWORD                                                                              | HI              |
|---------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------|-----------------|
| ABSTRACT                                                                        | ABSTRACT                                                                                | ABSTRACT                                                                              | Iv              |
| ACKNOWLEDGEtENTS                                                                | ACKNOWLEDGEtENTS                                                                                | ACKNOWLEDGEtENTS                                                                      | Iv              |
| EXECUTIVE SUMMARY                                                               | EXECUTIVE SUMMARY                                                                                | EXECUTIVE SUMMARY                                                                     | xlll            |
| PART T: INTRODUCTION                                                            | PART T: INTRODUCTION                                                                             | PART T: INTRODUCTION                                                                  | 1-]             |
| 1. HOST WELCOIING ADDRESS                                                       | 1. HOST WELCOIING ADDRESS                                                                        | 1.

Audit and Evaluation of Computer Security II_ System Vulnerabilities and Controls


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AU.L2-3.3.3 (NIST 3.3.3)?

[Assistant]
According to Recommendation for Pair-Wise Key-Establishment Using Integer Factorization Cryptography:

3.3.3 KAS2-Party_U-confirmation                                                                                | ... 3.3.3); it may also be added to a KAS1 or KTS-OAEP scheme, but only with party V (the party contributing the key pair) acting as the key-confirmation provider, and party U acting as the key-confirmation recipient (see Sections 8. 3.3.3 can be used to provide assurance to a key-pair owner, acting as party V, that both parties are in possession of the  correct  private  key;  i.

Recommendation for Pair-Wise Key-Establishment Using Integer Factorization Cryptography


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Workshop on Enhancing Security of Devices and Components Across the Supply Chain provide? (Part 6)

[Assistant]
|
| Fig. 1. Components for securing microelectronics................................................................................1                      |
| Fig. 2.
Distribution of workshop participants.......................................................................................2                  |

## 1. Introduction

Semiconductor-based hardware is the foundation of modern-day electronics - from smartphones, computers, and telecommunications to transportation and critical infrastructure. The semiconductor hardware supply chain is a complex network of companies that collectively provide intellectual property, designs, and raw materials and manufacture, test, package, and distribute products. Coordination among the components of a supply chain is required at different stages, including inception, deployment to end users, maintenance during use, and disposal or end of life. Securing semiconductor-based hardware and their supply chains help protect sensitive information, maintain the integrity of systems, and ensure overall stability across the infrastructure and connected world. Securing semiconductors involves the security of the component being built as well as the design, development, manufacturing, and distribution environments. Figure 1 illustrates the components of achieving robust semiconductor security. Fig. 1. Elements for securing microelectronics

<!-- image -->

These activities range from physical protection mechanisms (e.g., tamper-resistant packaging) to strong encryption protocols to safeguard data. Secure boot processes ensure that only verified firmware runs, and maintaining supply chain integrity through verification and audits prevents counterfeit components. Life cycle management includes secure provisioning, updates, and end-of-life processes that are complemented by rigorous security testing and compliance with regulatory standards.

Workshop on Enhancing Security of Devices and Components Across the Supply Chain


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Communications Protection?

[Assistant]
According to Audit and Evaluation of Computer Security:

The National Bureau of Standards, with the support of the U.S. Gen-
eral Accounting Office, sponsored an invitational workshop on "Audit and
Evaluation of Computer Security," held in Miami Beach, Florida on March
22-24, 1977.
area and define appropriate subjects for future research.
perts in the audit and computer communities were invited to discuss the
subject in one of ten sessions, each of which considered a different as-
pect.
these reports form the body of these Proceedings.
The ten topics re-
ported on are: Internal Audit Standards, Qualifications and Training,
Security Administration, Audit Considerations in Various System Environ-
ments, Administrative and Physical Controls, Program Integrity, Data In-
tegrity, Communications, Post-Processing Audit Tools and Techniques, and
Interactive Audit Tools and Techniques.

KEYWORDS:
training, communications security, computer controls, computer
security, data integrity, interactive audit, internal audit, post-
processing audit, program integrity.

........
....
Internal Audit Standards
Qualifications and Training ............
.....
Security Administration
Audit Considerations in Various System
.....
Environments
Administrative and Physical Controls .......
.....
Program Integrity
Data Integrity
Communications
Post-Processing Audit Tools and Techniques ....
Interactive Audit Tools and Techniques

Audit and Evaluation of Computer Security


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Awareness and Training?

[Assistant]
According to Assessing Security and Privacy Controls in Information Systems and Organizations:

CHAPTER ONE INTRODUCTION ............................................................................................................... 1
1.1   PURPOSE AND APPLICABILITY .......................................................................................................... 1
1.2   TARGET AUDIENCE ............................................................................................................................ 4
1.3   RELATED PUBLICATIONS AND ASSESSMENT PROCESSES ............................................................... 4
1.4   ORGANIZATION OF THIS PUBLICATION ........................................................................................... 5
CHAPTER TWO THE FUNDAMENTALS ..................................................................................................... 6
2.1   ASSESSMENTS WITHIN THE SYSTEM DEVELOPMENT LIFE CYCLE .................................................. 6
2.2   CONTROL STRUCTURE AND ORGANIZATION .................................................................................. 7
2.3   BUILDING AN EFFECTIVE ASSURANCE CASE .................................................................................... 8
2.4   ASSESSMENT PROCEDURES: ASSESSMENT OBJECTS, METHODS AND OBJECTIVES ................... 11
CHAPTER THREE THE PROCESS ............................................................................................................. 19
3.1   PREPARE FOR SECURITY AND PRIVACY CONTROL ASSESSMENTS ............................................... 19
3.2   DEVELOP SECURITY AND PRIVACY ASSESSMENT PLANS .............................................................. 23
3.3   CONDUCT SECURITY AND PRIVACY CONTROL ASSESSMENTS ..................................................... 30
3.4   ANALYZE ASSESSMENT REPORT RESULTS .....................................................................................

Assessing Security and Privacy Controls in Information Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Supply Chain Risk Management?

[Assistant]
According to Federal Cybersecurity Role-Based Training Approaches, Successes, and Challenges:

NIST Special Publication (SP) 800-53 Rev. 5, Security and Privacy Controls for Information Systems and Organizations , provides guidance for organizations in protecting their operations, assets, and personnel from security threats and risks [SP800-53]. Within the document, Awareness and Training Control (AT-3) 'Role-based Training' addresses training for personnel with 'responsibilities related to operations and supply chain risk management within the context of organizational security and privacy programs.' Furthermore, organizations are instructed to document, monitor, and retain records for their training activities. In addition to federal personnel, RBT applies to contractors providing services to federal organizations.

Federal Cybersecurity Role-Based Training Approaches, Successes, and Challenges


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for Planning?

[Assistant]
According to Protecting Controlled Unclassified Information (CUI)_ NIST Special Publication 800-171, Revision 3. Small Business Primer:

d, communicated, understood, and enforced. Even if cybersecurity activities are outsourced to an external provider, someone within the business should still be designated to manage cybersecurity risk.
|
|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| It's not all technology. | An important point to emphasize is that many requirements in SP 800-171 do not need investments in technology or services to implement. Many requirements can be achieved through the creation of processes and procedures. |
| Implement the requirements and document implementation in a system security plan. | Satisfying the security requirements won't be accomplished overnight. Implement in phases based upon your resources (includin g time, expertise, budget, etc.), starting with understanding what security requirements you may have already satisfied and building from there.

Protecting Controlled Unclassified Information (CUI)_ NIST Special Publication 800-171, Revision 3. Small Business Primer


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Communications Protection?

[Assistant]
According to Digital Identity Guidelines_ Authentication and Authenticator Management:

3.2.6. Verifier-CSP or IdP Communications . . . . . . . . . . . . . . . .

Throughout this document, [FIPS140] requirements are satisfied by security
technologies, products, and services that utilize implementations of cryptography
validated by the Cryptography Module Validation Program [CMVP]. FIPS 140
requirements at a given AAL are often different for authenticators and verifiers, with
more stringent requirements generally applying to verifiers. This is in recognition of the
practical limitations on the certification of authenticators as well as the broader scope
that is often associated with a security breach at a verifier.

2.1.2. Authenticator and Verifier Requirements
Authenticators used at AAL1  SHALL  use approved cryptography. In other words, they
must use approved algorithms, but the implementation need not be validated under
[FIPS140].

Digital Identity Guidelines_ Authentication and Authenticator Management


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Awareness and Training?

[Assistant]
According to Validating the Integrity of Computing Devices:

7                                                                                |
|     |                                                                                | 3.2.2 Scenario 2:                                                                                | Verification of Components During Acceptance Testing........................... 7                                                                                |
|     |                                                                                | 3.2.3                                                                                | Scenario 3: Verification of Components During Use....................................................

Validating the Integrity of Computing Devices


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Guide to Auditing for Controls and Security_ A System Development Life Cycle Approach provide? (Part 9)

[Assistant] - Phase III | 27 | | | 2.3.4 Programming and Training - Phase IV | 2.3.4 Programming and Training - Phase IV | 2.3.4 Programming and Training - Phase IV | 28 | | | 2.3.5 Evaluation and Acceptance - Phase V | 2.3.5 Evaluation and Acceptance - Phase V | 2.3.5 Evaluation and Acceptance - Phase V | 28 | | | 2.3.6 Installation and Operation - Phase VI | 2.3.6 Installation and Operation - Phase VI | 2.3.6 Installation and Operation - Phase VI | 29 | | 2.4 | RESPONSIBLE PARTICIPANTS AND THEIR FUNCTION IN THE | RESPONSIBLE PARTICIPANTS AND THEIR FUNCTION IN THE | RESPONSIBLE PARTICIPANTS AND THEIR FUNCTION IN THE | 29 | | | AIS LIFE CYCLE 2.4.1 Policy/Oversight Participants | AIS LIFE CYCLE 2.4.1 Policy/Oversight Participants | AIS LIFE CYCLE 2.4.1 Policy/Oversight Participants | 29 | | | 2.4.1.1 | 2.4.1.1 | Information Resources Management (IRM) Official | 29 | | | 2.4.1.2 | 2.4.1.2 | System Security Officer (SSO) | 30 | | | 2.4.1.3 | 2.4.1.3 | Internal Control Officer (ICO) | 30 | | | 2.4.2 Functional/Operational Participants | 2.4.2 Functional/Operational Participants | 2.4.2 Functional/Operational Participants | 30 |

Guide to Auditing for Controls and Security_ A System Development Life Cycle Approach


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Access Control?

[Assistant]
According to A Zero Trust Architecture Model for Access Control in Cloud-Native Applications in Multi-Cloud Environments:

## A Zero Trust Architecture Model for Access Control in Cloud-Native Applications in Multi-Location Environments

## A Zero Trust Architecture Model for Access Control in Cloud-Native Applications in Multi-Location Environments

Chandramouli R, Butcher Z (2023) A Zero-Trust Architecture Model for Access Control in Cloud-Native Applications in Multi-Location Environments. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) NIST SP 800-207A. https://doi.org/10.6028/NIST.SP.800-207A

A Zero Trust Architecture Model for Access Control in Cloud-Native Applications in Multi-Cloud Environments


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Status Report on the Fourth Round of the NIST Post-Quantum Cryptography Standardization Process provide? (Part 5)

[Assistant]
Organization of This Document . . . . | 3              |
| 2. Evaluation Criteria and Selection Process . . | . . . . . . . . | 4              |
| 2.1. | Acceptance of the Fourth-Round Candidates . .
. . | 4              |
| 2.2. | Evaluation Criteria . . . . . . . . . . . . . . . . . . . . | 4              |
|                                                                                | 2.2.1. Security . . . . . . . . . . . . . . . . . . . . . . | 4              |
|                                                                                | 2.2.2.Cost and Performance . . . . . . . . . . . . . | 5              |
|                                                                                | 2.2.3.Algorithm and Implementation Characteristics                                                                                | 8              |
| 2.3. | Selection of the Candidates for Standardization . . . | 8              |
| 3. Summary of the Fourth-Round Candidates . | . . . . . . . . | 10             |
| 3.1. | HQC . . . . . . . . . . . . . . . . . . . . . . . . . . . . | 10             |
| 3.2. | BIKE . . . . . . . . . . . . . . . . . . . . . . . . . . . . | 12             |
| 3.3. | Classic McEliece . . . . . . . . . . . . . . . . . . . . . | 14             |
| 3.4. | SIKE . . . . . . . . . . . . . . . . . . . . . . . . . . . . | 16             |
| 4. Conclusion . . | . . . . . . . . . . . . . . . . . . . . . . . . . . | 18             |
| References . . | . . . . . . . . . . . . . . . . . . . . . . . . . . . | 19             |
| Appendix A.

Status Report on the Fourth Round of the NIST Post-Quantum Cryptography Standardization Process


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for Awareness and Training?

[Assistant]
According to Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171:

............................................ 5                        |
| 2.1 DEVELOPMENTAPPROACH ......................................................................................................
| 5                                                                                |
| 2.2 ORGANIZATIONANDSTRUCTURE                                                                                | ............................................................................................. 7                                                  |
| 2.3 FLEXIBLE APPLICATION                                                                                | ............................................................................................................. 9                                  |
| CHAPTER THREE THE REQUIREMENTS......................................................................................... 11                       | CHAPTER THREE THE REQUIREMENTS......................................................................................... 11                       |
| 3.1 ACCESSCONTROL                                                                                | .................................................................................................................. 12                            |
| 3.2 AWARENESSANDTRAINING                                                                                | ...................................................................................................

Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does A Zero Trust Architecture Model for Access Control in Cloud-Native Applications in Multi-Cloud Environments provide? (Part 5)

[Assistant]
blication 800-series reports on ITL's research, guidelines, and outreach efforts in information system security, and its collaborative activities with industry, government, and academic organizations.
## Patent Disclosure Notice

NOTICE: ITL has requested that holders of patent claims whose use may be required for compliance with the guidance or requirements of this publication disclose such patent claims to ITL. However, holders of patents are not obligated to respond to ITL calls for patents and ITL has not undertaken a patent search in order to identify which, if any, patents may apply to this publication. As of the date of publication and following call(s) for the identification of patent claims whose use may be required for compliance with the guidance or requirements of this publication, no such patent claims have been identified to ITL. No representation is made or implied by ITL that licenses are not required to avoid patent infringement in the use of this publication. ## Table of Contents

| Executive Summary................................................................................................................. 1                                                                                | Executive Summary................................................................................................................. 1                                   | Executive Summary.................................................................................................................


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice IA.L2-3.5.1 (NIST 3.5.1)?

[Assistant]
According to Guide to Enterprise Patch Management Planning_ Preventive Maintenance for Technology:

3.5.1 Maintenance Plans for Scenario 1, Routine Patching... 3.5.1 Maintenance Plans for Scenario 1, Routine Patching

Organizations should consider adopting phased deployments for routine patching in which a small subset of the assets to be patched receive the patch first.

Guide to Enterprise Patch Management Planning_ Preventive Maintenance for Technology


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Information Integrity?

[Assistant]
According to Recommendation for Pair-Wise Key-Establishment Schemes Using Discrete Logarithm Cryptography:

automated key-establishment schemes. | Algorithm                           | A clearly specified mathematical process for computation; a set of rules that, if followed, will give a prescribed result.
|
|-------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Approved                            | FIPS- approved or NIST-Recommended. An algorithm or technique that is either 1) specified in a FIPS or NIST Recommendation, or 2) adopted in a FIPS or NIST Recommendation and specified either (a) in an appendix to the FIPS or NIST Recommendation, or (b) in a document referenced by the FIPS or NIST Recommendation. |
| Assumption                          | Used to indicate the conditions that are required to be true when an approved key-establishment scheme is executed in accordance with this Recommendation. |
| Assurance of private-key possession | Confidence that an entity possesses a private key corresponding to a public key. |
| Assurance of validity               | Confidence that either a key or a set of domain parameters is arithmetically correct. |
| Big-endian                          | The property of a byte string having its bytes positioned in order of decreasing significance.

Recommendation for Pair-Wise Key-Establishment Schemes Using Discrete Logarithm Cryptography


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 1 require for System and Communications Protection?

[Assistant]
According to IoT Device Cybersecurity Capability Core Baseline:

- o ENISA : European Union Agency for Network and Information Security (ENISA), 'Baseline Security Recommendations for IoT in the context of Critical Information Infrastructures' [10] - o ETSI : European Telecommunications Standards Institute (ETSI), 'Cyber Security for Consumer Internet of Things' [11] - o GSMA : Groupe Spéciale Mobile Association (GSMA), 'GSMA IoT Security Assessment' [12] - o IEC : International Electrotechnical Commission (IEC), 'IEC 62443-4-2, Edition 1.0, Security for industrial automation and control systems - Part 4-2: Technical security requirements for IACS components' [13] - o IIC : Industrial Internet Consortium (IIC), 'Industrial Internet of Things Volume G4: Security Framework' [14] - o IoTSF : IoT Security Foundation (IoTSF), 'IoT Security Compliance Framework, Release 2' [15] - o ISOC/OTA : Internet Society/Online Trust Alliance (OTA), 'IoT Security & Privacy Trust Framework v2.5' [16] - o NEMA : National Electrical Manufacturers Association (NEMA), 'Cyber Hygiene Best Practices' [17] - o OCF : Open Connectivity Foundation (OCF) 'OCF Security Specification Version 2.1.2' [18] - o PSA : Platform Security Architecture (PSA) Joint Stakeholder Agreement (JSA) Members, 'PSA Certified™ Level I Questionnaire, Version 2.0 Beta' [19] | Device Cybersecurity Capability | Common Elements | Rationale | IoT Reference Examples | |--------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|

IoT Device Cybersecurity Capability Core Baseline


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Status Report on the Fourth Round of the NIST Post-Quantum Cryptography Standardization Process provide? (Part 10)

[Assistant] Timeline of the NIST Post-Quantum Cryptography Standardization Process | Date | Event | |-------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | April 2015 | Workshop on Cybersecurity in a Post-Quantum World, NIST, Gaithersburg,MD | | February 2016 | PQC Standardization: Announcement and outline of NIST's Call for Submissions presentation given at PQCrypto 2016 | | April 2016 | Release of IR 8105, Report on Post-Quantum Cryptography [10] | | December 2016 | Federal Register Notice - Announcing Request for Nominations for Public-Key Post-Quantum Cryptographic Algorithms [11] | | November 30, 2017 | Submission Deadline for NIST PQC Standardization Process | | December 2017 | Announcement of first-round candidates and beginning of first- round public comment period | | April 2018 | First NIST PQC Standardization Conference, Ft.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Control Baselines for Information Systems and Organizations provide? (Part 7)

[Assistant]
_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

In addition to the above acknowledgments, a special note of thanks goes to Jeff Brewer, Jim Foti, and the NIST web team for their outstanding administrative support.
The authors also wish to recognize the professional staff from the NIST Computer Security Division and the Applied Cybersecurity Division and the input from representatives from the OMB Office of Information and Regulatory Affairs (OIRA) Privacy Branch and the Federal CIO Council and Interagency Working Group for their contributions in helping to improve the technical content of the publication. Finally, the authors gratefully acknowledge the significant contributions from individuals and organizations in the public and private sectors, nationally and internationally, whose insightful and constructive comments improved the quality, thoroughness, and usefulness of this publication. ## HISTORICAL CONTRIBUTIONS TO NIST SPECIAL PUBLICATION 800-53

The authors wanted to acknowledge the many individuals who contributed to previous versions of Special Publication 800-53 since its inception in 2005.

Control Baselines for Information Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 1 require for Awareness and Training?

[Assistant]
According to IoT Device Cybersecurity Capability Core Baseline:

| 1. The ability to report the device's cybersecurity state 2. The ability to differentiate between when a device will likely operate as expected from when it may be in a degraded cybersecurity state 3. The ability to restrict access to the state indicator so only authorized entities can view it 4. The ability to prevent any entities (authorized or unauthorized) from editing the state except for those entities that are responsible for maintaining the device's state information 5. The ability to make the state information available to a service on another device, such as an event/state log server | • This capability supports vulnerability management and incident detection. • Cybersecurity state awareness helps enable investigating compromises, identifying misuse, and troubleshooting certain operational problems. • How the device makes other entities aware of a cybersecurity state will vary based on context- specific needs and goals, but may include capturing and logging information about events in a persistent record that may have to be stored off the device, sending signals to a monitoring system to be handled externally, or alerting via an interface on the IoT device itself. | • CSDE : 5.1.7 • CTIA : 4.7, 4.12, 5.7, 5.16 • ENISA : GP-TM-55, GP-TM- 56 • ETSI : 4.7-2, 4.10-1 • GSMA : CLP13_6.13.1, 7.2.1, 9.1.1.2 • IEC : CR 2.8, CR 3.9, CR 6.1, CR 6.2 • IIC : 7.3, 7.5, 7.7, 8.9, 10.3, 10.4 • IoTSF : 2.4.7.5 • NEMA : Monitoring Devices and Systems • OCF: 5.1, 5.7, 8.6, 12, 13.8, 13.16 • PSA : C1.3, D1.1, D3.2, D3.4, D3.5, D5.1, R4.1, R4.3, R4.4 |


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice CM.L2-3.4.5 (NIST 3.4.5)?

[Assistant]
According to Guide to Auditing for Controls and Security_ A System Development Life Cycle Approach:

3.4.5                                                            | Two Level Work Priority Dimensions/Characteristics               | Two Level Work Priority Dimensions/Characteristics               | 54        |
|           | 3. 3.4.5. 3.4.5.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AT.L2-3.2.1 (NIST 3.2.1)?

[Assistant]
According to Access Control on NoSQL Databases:

3.2.1. 3.2.1.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171 provide? (Part 2)

[Assistant]
systems, but such standards and guidelines shall not apply to national security systems without the express approval of the appropriate federal officials exercising policy authority over such systems.
This guideline is consistent with requirements of the Office of Management and Budget (OMB) Circular A-130. Nothing in this publication should be taken to contradict the standards and guidelines made mandatory and binding on federal agencies by the Secretary of Commerce under statutory authority. Nor should these guidelines be interpreted as altering or superseding the existing authorities of the Secretary of Commerce, OMB Director, or any other federal official. This publication may be used by nongovernmental organizations on a voluntary basis and is not subject to copyright in the United States. Attribution would, however, be appreciated by NIST. National Institute of Standards and Technology Special Publication 800-172 Natl. Inst. Stand. Technol. Spec. Publ. 800-172, 84 pages (February 2021)

CODEN: NSPUE2

This publication is available free of charge from:

https://doi.org/10.6028/NIST.SP.800-172

Certain  commercial  entities,  equipment,  or  materials  may  be  identified  in  this  document  to describe an experimental procedure or concept adequately. Such identification is not intended to imply recommendation or endorsement by NIST, nor is it intended to imply that the entities, materials, or equipment are necessarily the best available for the purpose. There may be references in this publication to other publications currently under development by  NIST  in  accordance  with  its  assigned  statutory  responsibilities. The  information  in  this publication, including concepts, practices, and methodologies, may be used by federal agencies even  before  the  completion  of  such  companion  publications. Thus,  until  each  publication  is completed,  current  requirements,  guidelines,  and  procedures,  where  they  exist,  remain operative.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Awareness and Training?

[Assistant]
According to Status Report on the Fourth Round of the NIST Post-Quantum Cryptography Standardization Process:

| 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . | . . . | 1              |
|------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------|
| 1.1. | Purpose and Organization of This Document . . . . | 3              |
| 2. Evaluation Criteria and Selection Process . . | . . . . . . . . | 4              |
| 2.1. | Acceptance of the Fourth-Round Candidates . . . . | 4              |
| 2.2. | Evaluation Criteria . . . . . . . . . . . . . . . . . . . . | 4              |
|                                                                                | 2.2.1. Security . . . . . . . . . . . . . . . . . . . . . . | 4              |
|                                                                                | 2.2.2.Cost and Performance . . . . . . . . . . . . . | 5              |
|                                                                                | 2.2.3.Algorithm and Implementation Characteristics                                                                                | 8              |
| 2.3. | Selection of the Candidates for Standardization . . . | 8              |
| 3. Summary of the Fourth-Round Candidates . | . . . . . . . . | 10             |
| 3.1. | HQC . . . . . . . . . . . . . . . . . . . . . . . . . . . . | 10             |
| 3.2. | BIKE . . . . . . . . . . . . . . . . . . . . . . . . . . . . | 12             |
| 3.3. | Classic McEliece . . . . . . . . . . . . . . . . . .


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Configuration Management?

[Assistant]
According to Guide for Developing Security Plans for Federal Information Systems:

Title III of the E-Government Act, entitled the Federal Information Security Management Act (FISMA), requires each federal agency to develop, document, and implement an agency-wide information security program to provide information security for the information and information systems that support the operations and assets of the agency, including those provided or managed by another agency, contractor, or other source. System security planning is an important activity that supports the system development life cycle (SDLC) and should be updated as system events trigger the need for revision in order to accurately reflect the most current state of the system. The system security plan provides a summary of the security requirements for the information system and describes the security controls in place or planned for meeting those requirements. The plan also may reference other key security-related documents for the information system such as a risk assessment, plan of action and milestones, accreditation decision letter, privacy impact assessment, contingency plan, configuration management plan, security configuration checklists, and system interconnection agreements as appropriate. Before the system security plan can be developed, the information system and the information resident within that system must be categorized based on a FIPS 199 impact analysis. Then a determination can be made as to which systems in the inventory can be logically grouped into major applications or general support systems. The FIPS 199 impact levels must be considered when the system boundaries are drawn and when selecting the initial set of security controls (i.e., control baseline). The baseline security controls can then be tailored based on an assessment of risk and local conditions including organization-specific security requirements, specific threat information, costbenefit analyses, the availability of compensating controls, or special circumstances.

Guide for Developing Security Plans for Federal Information Systems


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Automated Secure Configuration Guidance from the macOS Security Compliance Project (mSCP) provide? (Part 4)

[Assistant]
y. This publication introduces the mSCP and gives an overview of the resources available from the project's GitHub site, which is continuously curated and updated to support each new release of macOS.
The GitHub site provides practical, actionable recommendations in the form of secure baselines and associated rules. This publication also describes use cases for leveraging the mSCP content. Updates from the previous version of this publication mainly involve the new mSCP capability to create a custom benchmark by tailoring a baseline. ## Keywords

Apple; baseline; configuration management; endpoint device security; macOS; macOS Security Compliance Project (mSCP); operating system security; security compliance. ## Reports on Computer Systems Technology

The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the Nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology. ITL's responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in federal information systems. The Special Publication 800-series reports on ITL's research, guidelines, and outreach efforts in information system security, and its collaborative activities with industry, government, and academic organizations. ## Supplemental Content

The mSCP's GitHub site is at https://github.com/usnistgov/macos\_security#readme, and the project documentation wiki is at https://github.com/usnistgov/macos\_security/wiki. ## Trademark Information

All registered trademarks or trademarks belong to their respective organizations.

Automated Secure Configuration Guidance from the macOS Security Compliance Project (mSCP)


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 2 require for System and Services Acquisition?

[Assistant]
According to Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations:

blication 800-series reports on ITL's research, guidelines, and outreach efforts in information system security, and its collaborative activities with industry, government, and academic organizations.
- Federal agencies responsible for managing and protecting CUI
- Nonfederal organizations responsible for protecting CUI
- Individuals with system development life cycle responsibilities (e.g., program managers, mission/business owners, information owners/stewards, system designers and developers, system/security engineers, systems integrators)
- Individuals with acquisition or procurement responsibilities (e.g., contracting officers)
- Individuals with system, security, or risk management and oversight responsibilities (e.g., authorizing officials, chief information officers, chief information security officers, system owners, information security managers)
- Individuals with security assessment and monitoring responsibilities (e.g., auditors, system evaluators, assessors, analysts, independent verifiers and validators)

Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Protecting Controlled Unclassified Information (CUI)_ NIST Special Publication 800-171, Revision 3. Small Business Primer provide? (Part 4)

[Assistant]
00-171A, Assessing Security Requirements for Controlled Unclassified Information provides assessment procedures and a methodology to conduct assessments of the CUI security requirements in SP 800-171.
NIST SP 800-172, Enhanced Security Requirements for Protecting Controlled Unclassified Information provides enhanced security requirements to help protect CUI associated with critical programs or high value assets in nonfederal systems and organizations from the advanced persistent threat (APT). The SP 800-172 enhanced security requirements are designed to protect confidentiality, integrity and availability of information. <!-- image -->

NIST SP 800-172A, Assessing Enhanced Security Requirements for Controlled Unclassified Information provides assessment procedures and a methodology to conduct assessments of the enhanced security requirements in SP 800-172. ## A is for Assessment

Knowing what requirements to implement is important, but it is also important to understand how to evaluate the organization's implementation. Both publications work handin-hand for full implementation. ht ps:/

csrc.nist.gov/projects/protecting-control ed-unclas

<!-- image -->

ified-information

Protecting information from unauthorized modification

## Key Term: Security Requirement

[SP 800-171] Security Requirement: Security outcomes levied on a nonfederal organization to ensure adequate measures are taken to protect the confidentiality of CUI being processed, stored, or transmitted. <!-- image -->

<!-- image -->

Important Note: The security requirements in NIST SP 800-171 are only applicable to components of nonfederal systems that process, store, or transmit CUI or that provide protection for such components. Protecting information from unauthorized access and disclosure

Preventing disruption in how information is accessed

<!-- image -->

2 SP 800-171 does not explicitly cover integrity and availability so it is not a comprehensive security program.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Access Control?

[Assistant]
According to Recommendations for Federal Vulnerability Disclosure Guidelines:

| Executive Summary................................................................................................................. | Executive Summary................................................................................................................. | Executive Summary................................................................................................................. |
|--------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------|
| U.S. Government Vulnerability Disclosure..................................................................... | 2                                                                                |                                                                                |
| Usage of Document Terminology................................................................................ | 5                                                                                |                                                                                |
| Federal Vulnerability Disclosure Coordination Body ....................................................

Recommendations for Federal Vulnerability Disclosure Guidelines


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Planning for a Zero Trust Architecture_ A Planning Guide for Federal Administrators provide? (Part 7)

[Assistant]
ing to network identity, endpoint health, or data flows. Some discussion of the tenets is included, and some considerations that planners should keep in mind when developing a zero trust architecture.
## 1.1.1 Tenets that Deal with Network Identity Governance

- I. All resource authentication and authorization are dynamic and strictly enforced before access is allowed. A typical enterprise has a wide collection of network identities: end users, accounts used by processes and services, etc. Some end users may have multiple network identities, and some identities may only be used by

1 The unit of 'session' can be nebulous and differ depending on tools, architecture, etc. The basic definition in a zero trust context is a connection to one resource utilizing one network identity and one privilege for that identity (e.g. read, write, delete, etc.) or even a single operation (similar to an API call). This would be the ideal case, but implementations may not allow this fine grain of control and may define sessions as broadly as 'connection to a resource by a network identity with set privileges for a period of time' with reauthentication and reauthorization needed for increased privilege, after a set time period, or an operational change is detected. hardware/software components. The enterprise needs to have a governance policy and structure in place so that only authorized operations are performed, and only when the identity has properly authenticated itself. The enterprise needs to consider if their current identity governance policies are mature enough and where and how are authentication and authorization checks currently performed. Dynamic enforcement means that other factors such as endpoint and environmental factors impact authentication and authorization policies. ## 1.1.2 Tenets that Deal with Endpoints

- I. All data sources and computing services are considered resources.

Planning for a Zero Trust Architecture_ A Planning Guide for Federal Administrators


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Configuration Management?

[Assistant]
According to Incident Response Recommendations and Considerations for Cybersecurity Risk Management_ A CSF 2.0 Community Profile:

A CSF Community Profile is a baseline of CSF outcomes that is created and published to address shared interests and goals for reducing cybersecurity risk among a number of organizations. A Community Profile is typically developed for a particular sector, subsector, technology, threat type, or other use case [CSF2.0].

Incident Response Recommendations and Considerations for Cybersecurity Risk Management_ A CSF 2.0 Community Profile


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Secure Software Development Framework (SSDF) Version 1.1_ Recommendations for Mitigating the Risk of Software Vulnerabilities provide? (Part 4)

[Assistant]
blication 800-series reports on ITL's research, guidelines, and outreach efforts in information system security, and its collaborative activities with industry, government, and academic organizations.
## Abstract

Few software development life cycle (SDLC) models explicitly address software security in detail, so secure software development practices usually need to be added to each SDLC model to ensure that the software being developed is well-secured. This document recommends the Secure Software Development Framework (SSDF) - a core set of high-level secure software development practices that can be integrated into each SDLC implementation. Following such practices should help software producers reduce the number of vulnerabilities in released software, reduce the potential impact of the exploitation of undetected or unaddressed vulnerabilities, and address the root causes of vulnerabilities to prevent future recurrences. Because the framework provides a common vocabulary for secure software development, software acquirers can also use it to foster communications with suppliers in acquisition processes and other management activities. ## Keywords

secure software development; Secure Software Development Framework (SSDF); secure software development practices; software acquisition; software development; software development life cycle (SDLC); software security. ## Trademark Information

All registered trademarks or trademarks belong to their respective organizations. ## Acknowledgments

The authors thank all of the organizations and individuals who provided input for this update to the SSDF. In response to Section 4 of Executive Order (EO) 14028 on 'Improving the Nation's Cybersecurity,' NIST held a June 2021 workshop and received over 150 position papers, many of which suggested secure software development practices, tasks, examples of implementations, and references for consideration for this SSDF update.

Secure Software Development Framework (SSDF) Version 1.1_ Recommendations for Mitigating the Risk of Software Vulnerabilities


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Access Control?

[Assistant]
According to Guide to a Secure Enterprise Network Landscape:

- A portable and interoperable cryptographic identity is required for workloads or services, as well as a standardized way to retrieve, validate, and interact with those identities. An example of such a specification is Secure Production Identity Framework for Everyone (SPIFFE) [47]. - The location of the service may change due to the virtualized nature of the application hosting environment (e.g., migration to different Virtual Machines (VMs), migration to a different pod in containerized applications). Hence, the identity should abstract the environment hosting the service. - The validation of identity (authentication) and authorization need to be done continuously (and not just at the beginning of a service request) as the risk profile associated with the request may change if there are multiple entities involved or if there are changes in behavioral patterns that need to be included as a validation parameter and monitored. - Packet filters and network address translation: Packet filtering and Network address translation (NAT) are used to monitor and control packets moving across a network interface, apply predetermined security rules, and obscure the internal network from the public internet. - Stateful inspection: Stateful firewalling, also known as dynamic packet filtering, monitors the state of connections and makes determinations as to what types of data packets belong to a known active connection and can be allowed to pass through the firewall. - Deep packet inspection (DPI): This feature, also known as packet sniffing, examines the content of packets (both the header and the payload, unlike the stateful inspection that inspects only the packet header). In addition to the capability provided by stateful inspection, this has capabilities related to finding hidden threats within the data stream, such as attempts at data exfiltration, violations of content policies, malware, and more.

Guide to a Secure Enterprise Network Landscape


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Planning?

[Assistant]
According to Approaches and Challenges of Federal Cybersecurity Awareness Programs:

There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may  be  used  by  federal  agencies  even  before  the  completion  of  such  companion  publications. Thus,  until  each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning  and  transition  purposes,  federal  agencies  may  wish  to  closely  follow  the  development  of  these  new publications by NIST. that and now have automated tools…Our onboarding site is a self-registration site so that our new staff can go and self-register, take their training, and then that ties into our primary learning center once they're on board and approved. We reconcile those transcripts. So, we do have now the automated means where we do tie it into our backend account management system so that, truly, people aren't getting access to things before they've taken that training and signed the rules of behavior.

Approaches and Challenges of Federal Cybersecurity Awareness Programs


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Supply Chain Risk Management?

[Assistant]
According to Workshop on Enhancing Security of Devices and Components Across the Supply Chain:

## Workshop on Enhancing Security of Devices and Components Across the Supply Chain

## Workshop on Enhancing Security of Devices and Components Across the Supply Chain

Rekhi S, Kuhn DR, Schaffer K, Souppaya M, Stein AJ, Waller N, Hastings N, Ogata M, Barker WC (2025) Workshop on Enhancing Security of Devices and Components Across the Supply Chain. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Interagency or Internal Report (IR) NIST IR 8532. https://doi.org/10.6028/NIST.IR.8532

Workshop on Enhancing Security of Devices and Components Across the Supply Chain


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 2 require for Awareness and Training?

[Assistant]
According to Assessing Security Requirements for Controlled Unclassified Information:

- Identifying potential problems or shortfalls in security and risk management programs
- Identifying security weaknesses and deficiencies in systems and the environments in which those systems operate
- Prioritizing risk mitigation decisions and activities
- Confirming that identified security weaknesses and deficiencies in the system and environment of operation have been addressed
- Supporting continuous monitoring activities and providing information security situational awareness

| Access Control                    | Maintenance         | Security Assessment and Monitoring   |
|-----------------------------------|---------------------|--------------------------------------|
| Awareness and Training            | Media Protection    | System and Communications Protection |
| Audit and Accountability          | Personnel Security  | System and Information Integrity     |
| Configuration Management          | Physical Protection | Planning                             |
| Identification and Authentication | Risk Assessment     | System and Services Acquisition      |
| Incident Response                 |                     | Supply Chain Risk Management         |

[SELECT FROM: access control policy and procedures; procedures for publicly accessible content; list of users authorized to post publicly accessible content on organizational systems; training materials or records; records of publicly accessible information reviews; records of response to CUI discovered on public websites; system audit logs; security awareness training records; system security plan; other relevant documents or records]

Assessing Security Requirements for Controlled Unclassified Information


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 2 require for System and Information Integrity?

[Assistant]
According to Profile of the IoT Core Baseline for Consumer IoT Products:

Cybersecurity utility: Maintaining confidentiality, integrity, and availability of data is foundational to cybersecurity for IoT products. Customers will expect that data are protected and that protection of data helps to ensure safe and intended functionality of the IoT product. Cybersecurity utility: Enumerating and controlling access to all internal and external interfaces to the IoT product will help preserve the confidentiality, integrity, and availability of the IoT product, its components, and data by helping prevent unauthorized access and modification. | Vulnerability                                                                                | Relevant Consumer Profile Capabilities                                                                                |
|-------------------------------------------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Mirai Malware Variants Attacks - Use of weak authentication to enable the loading of malware onto the device and use that device in DDOS and other attacks. | Mirai Malware Variants Attacks - Use of weak authentication to enable the loading of malware onto the device and use that device in DDOS and other attacks.

Profile of the IoT Core Baseline for Consumer IoT Products


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Protecting Controlled Unclassified Information (CUI)_ NIST Special Publication 800-171, Revision 3. Small Business Primer provide? (Part 9)

[Assistant]
NIST does not necessarily endorse the views expressed or the facts presented on those sites. Further, NIST does not endorse any commercial products that may be advertised or available on these sites.
ht ps:/

csrc.nist.gov/projects/protecting-control ed-unclas ified-information

## Introductory Tips for Implementers

<!-- image -->

## What's New in SP 800 -171, Revision 3? ## SP 800-171, Revision 3 was published in May 2024. Significant changes include:

## Updates to the Security Requirements and Families

- Based on NIST SP 800-53, Revision 5 and the NIST SP 800-53B moderate impact control baseline. - Applies updated tailoring criteria addressing stakeholder feedback (adding new, consolidating, and withdrawing requirements). - Includes increased specificity in security requirements. - Introduces organization-defined parameters (ODP) to increase flexibility to better manage organizationspecific risks. ## Additional Revision 3 Resources

- A CUI overlay (.xlsx) showing the direct link between SP 800-53 and SP 800171, including NIST's tailoring decisions. - Transitioning your organization from implementation of Revision 2 to Revision 3? Review this detailed analysis of the changes between Revision 2 and Revision 3 (.xlsx). - The SP 800-171 security requirements in multiple formats (Excel, JSON, and online) through the NIST Cybersecurity and Privacy Reference Tool. ht ps:/

csrc.nist.gov/projects/protecting-control ed-unclas ified-information

## Key Terms

<!-- image -->

<!-- image -->

Control Baseline: A set of controls you can implement to meet strategic, legal, regulatory, or contractual security and privacy requirements and manage risk. Organization-Defined Parameters (ODPs) are included in certain security requirements. ODPs provide the flexibility and specificity needed by organizations to clearly define their CUI security requirements, given the diverse nature of their missions, business functions, operational environments, and risk tolerance.

Protecting Controlled Unclassified Information (CUI)_ NIST Special Publication 800-171, Revision 3. Small Business Primer


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AT.L2-3.2.12 (NIST 3.2.12)?

[Assistant]
According to Digital Identity Guidelines_ Identity Proofing and Enrollment:

3.2.12 of [SP800-63B]). 3.2.12 of [SP800-63B]).

Digital Identity Guidelines_ Identity Proofing and Enrollment