[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Ordered t-way Combinations for Testing State-based Systems provide? (Part 4)

[Assistant]
coverage measures provide an effective method for quantifying the thoroughness of test input values [26] . A number of measures have been defined for the coverage of (static) input value combinations.
For example, with four binary variables, there are a total of 2 2 * C(4,2) = 24 possible settings of the four variables taken two at a time. If a test  set  includes  tests  that  cover  19  of  the  24,  the simple combinatorial coverage is 19/24 = 0.79. These measures quantify the degree to which input values cover the potential space of parameter value combinations without regard for the order in which these inputs occur in a test set or in  normal operations. However, if a system state is affected or determined  by  the  order  of  inputs,  even  thorough coverage  of  the  input  space  may  not  detect  some failure conditions. Thus, it is desirable to supplement measures of input space coverage with measures of the input value combination ordering. ## 2 Related Work

Combinatorial  aspects  of  input  ordering  have  been studied in the context of event sequences . Sequence covering arrays (SCAs) were introduced in [1]  and [2]  and further  developed in [3] , [4] , [5] , [7] , [8] [9] , [10] , and [11] . Definition. A sequence covering array [2] , SCA( N, S, t ) is an N x S matrix where entries are from a finite set S of s symbols, such that every t -way permutation of symbols from S occurs in at least one row. The t symbols  in  the  permutation  are  not  required  to  be adjacent. For example, Fig. 1 shows an event sequence a *→ b *→ c in test 1 and an event sequence of d * → c * → a in  test  3,  where x *→ y denotes x is  eventually followed by y ,  with possible interleaving. Note that the event sequence array has sequences of events in each row . Event sequences are made up of a value in a column followed by values in columns to the right. Fig. 1.

Ordered t-way Combinations for Testing State-based Systems


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for Personnel Security?

[Assistant]
According to Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171:

| CHAPTERONE INTRODUCTION...................................................................................................... | CHAPTERONE INTRODUCTION...................................................................................................... |
|--------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------|
| 1.1 PURPOSEANDAPPLICABILITY                                                                                | ................................................................................................... 3                                            |
| 1.2 TARGET AUDIENCE                                                                                | .................................................................................................................. 4                             |
| 1.3 ORGANIZATIONOF THIS SPECIAL PUBLICATION                                                                                | .......................................................................... 4                                                                     |
| CHAPTERTWO THE FUNDAMENTALS............................................................................................ 5                        | CHAPTERTWO THE FUNDAMENTALS............................................................................................ 5                        |
| 2.1 DEVELOPMENTAPPROACH ......................................................................................................

Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Services Acquisition?

[Assistant]
According to Guidelines for Media Sanitization:

quirements should include hardware and software specifications as well as interconnections and data flow documents that will assist the system owner in identifying the types of ISM used in the system.
Some ISM support enhanced interface commands for sanitization, which may make sanitization easier, faster, and more effective. The decision may be even more fundamental because effective sanitization procedures may not yet have been determined for emerging ISM types. Without an effective command or interface-based sanitization technique, the ISM may have to be destroyed. In that event, the ISM cannot be reused by other organizations that could have benefited from receiving the repurposed ISM.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Communications Protection?

[Assistant]
According to Report on the Design-A-Thon_ Designing Effective and Accessible Approaches for Digital Product Cybersecurity Education and Awareness:

The NIST Internet of Things (IoT) Cybersecurity Program has defined an IoT cybersecurity baseline for both technical capabilities and non-technical capabilities. Technical capabilities are those provided by digital products using software and hardware, such as Over-The-Air software update mechanisms or data encryption. Non-technical capabilities are those provided by organizations in support of digital product cybersecurity. Cybersecurity education and awareness is an example of a non-technical cybersecurity capability. The term 'education and awareness' is defined as 'The ability for the manufacturer and/or supporting entity to create awareness of and educate customers and others in the IoT device ecosystem about cybersecurity related information, considerations, features, etc. of the IoT device.' [1] There are many ways this capability can be implemented, but some examples include:

This section presents observations and takeaways from the event and teams' designs that were generated after the event and can inform future research and standardization efforts. All three teams identified different approaches in their plans, showing the wide range of tools and concepts that can be used for cybersecurity education and awareness for IoT products. As teams discussed and identified their plans, they found that standardization of available approaches and selection of appropriate approaches could help increase the speed of material development. All teams deeply considered the expected customers of each product to ensure awareness and education approaches were adequately tailored. Teams indicated that any standardization effort should similarly be human-centric and consider the spectrum of potential users of a given application or product. Unlike some areas of cybersecurity (e.g., encryption) which require limited human interaction, particularly with users, education and awareness addresses the human-in-the-loop and so depends, in large part, on human-factors for efficacy.

Report on the Design-A-Thon_ Designing Effective and Accessible Approaches for Digital Product Cybersecurity Education and Awareness


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Configuration Management?

[Assistant]
According to Strategies for the Integration of Software Supply Chain Security in DevSecOps CI_CD Pipelines:

.............................9      |
| 3.1.5. Types of Exploits.........................................................................................................................10   |
| 3.2.1.
Baseline Security ........................................................................................................................11   |
| 3.2.2. Controls for Interacting With SCM Systems...............................................................................12                     |
| 4. CI/CD Pipelines -Background, Security Goals, and Entities to be Trusted .....................................13                                    |
| 5. Integrating SSC Security Into CI/CD Pipelines.................................................................................15                   |
| 5.1.1. Secure Build................................................................................................................................16 |
| 5.1.2. Secure Pull-Push Operations on Repositories............................................................................17                      |
| 5.1.3. Integrity of Evidence Generation During Software Updates......................................................18                               |
| 5.1.4. Secure Code Commits ................................................................................................................19         |

Strategies for the Integration of Software Supply Chain Security in DevSecOps CI_CD Pipelines


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does IoT Device Cybersecurity Capability Core Baseline provide? (Part 6)

[Assistant]
s that protect devices as well as device data, systems, and ecosystems. The concept of a baseline in any context requires careful consideration; security capabilities for IoT devices are no exception.
The core baseline has been derived from researching common cybersecurity risk management approaches and commonly used capabilities for addressing cybersecurity risks to IoT devices, which were refined and validated using a collaborative public-private process to incorporate all viewpoints. Multiple requests for comment were issued, and multiple workshops and roundtables were held. NIST is committed to an open and transparent process that facilitates stakeholder feedback and iterative improvement. These capabilities were developed in the context of NISTIR 8259, Foundational Cybersecurity Activities for IoT Device Manufacturers [2], which discusses considerations for manufacturers to help guide them in choosing and implementing the device cybersecurity capabilities their IoT devices will provide. NISTIR 8259 also defines terminology and concepts that provide critical context for understanding device cybersecurity capabilities as one part of the entire IoT cybersecurity ecosystem. Thus, though both NISTIR 8259 and this publication have manufacturers as the intended audience, the considerations and capabilities discussed across the two publications can be used by manufacturers, integrators, or consumers. For more information on how these capabilities can be incorporated into a manufacturer's development processes, see NISTIR 8259. Other organizations can use the core baseline in the context that is available and appropriate to them. Regardless of an organization's role, this baseline is intended to give all organizations a starting point for IoT device cybersecurity risk management, but the implementation of all capabilities is not considered mandatory.

IoT Device Cybersecurity Capability Core Baseline

Audit and Accountability
System and Information Integrity
Security Assessment
Media Protection
Identification and Authentication
Awareness and Training
System and Communications Protection
Access Control
Planning
Incident Response
Risk Assessment
Personnel Security
System and Services Acquisition
Supply Chain Risk Management
Maintenance
Physical Protection
Configuration Management


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Services Acquisition?

[Assistant]
According to Guide to Auditing for Controls and Security_ A System Development Life Cycle Approach:

Guide to Auditing for Controls and Security: A System Development Life Cycle Approach

m T he National Bureau of Standards' was established by an act of Congress on March 3, 1901. The Bureau's overall goal is to strengthen and advance the nation's science and technology and facilitate their effective application for public benefit. To this end, the Bureau conducts research to assure international competitiveness and leadership of U.S. industry, science arid technology. NBS work involves development and transfer of measurements, standards and related science and technology, in support of continually improving U.S. productivity, product quality and reliability, innovation and underlying science and engineering. The Bureau's technical work is performed by the National Measurement Laboratory, the National Engineering Laboratory, the Institute for Computer Sciences and Technology, and the Institute for Materials Science and Engineering.

Conducts research and provides scientific and technical services to aid Federal agencies in the selection, acquisition, application, and use of computer technology to improve effectiveness and economy in Government operations in accordance with Public Law 89-306 (40 U.S.C. 759), relevant Executive Orders, and other directives; carries out this mission by managing the Federal Information Processing Standards Program, developing Federal ADP standards guidelines, cind managing Federal participation in ADP voluntary standardization activities; provides scientific and technological advisory services and assistance to Federal agencies; and provides the technical foundation for computer-related policies of the Federal Government. The Institute consists of the following divisions:

Guide to Auditing for Controls and Security_ A System Development Life Cycle Approach


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Access Control?

[Assistant]
According to Validating the Integrity of Computing Devices:

| Platform Manifest Correlation System.......................................................................
| 27 |
|                                                                                | 4.3.4                                                                                | Eclypsium Analytic Platform....................................................................................... | 28 |
| 4.4                                                                                | Computing Devices......................................................................................................31 | Computing Devices......................................................................................................31          |    |
|                                                                                | 4.4.1                                                                                | HP Inc.......................................................................................................................... | 31 |
|                                                                                | 4.4.2                                                                                | Dell Technologies........................................................................................................ | 33 |
|                                                                                | 4.4.3                                                                                | Intel.............................................................................................................................

Validating the Integrity of Computing Devices


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Incident Response?

[Assistant]
According to Zero Trust Architecture:

|
| FIPS199   | National Institute of Standards and Technology. (2004). Standards for Security Categorization of Federal Information and Information Systems. (U.
S. Department of Commerce, Washington, DC). Federal Information Processing Standards Publication (FIPS). 199. https://doi.org/10.6028/NIST.FIPS.199                                                           |
| Gilman    | Gilman E., Barth D. (2017). Zero Trust Networks: Building Secure Systems in Untrusted Networks (O'Reilly Media, Inc., Sebastopol, CA). Primera edición. |
| HWAM      | Department of Homeland Security. (2015). Hardware Asset Management (HWAM) Capability Description . Disponible en https://www.uscert.gov/sites/default/files/cdm_files/HWAM_CapabilityDescription.pdf                                                                                |
| IBNVN     | Cohen R., Barabash K., Rochwerger B., Schour L., Crisan D., Birke R., Minkenberg C., Gusat M., Recio R., Jain V. (2013). An Intent-based Approach for Network Virtualization. 2013 IFIP/IEEE International Symposium on Integrated Network Management (IM 2013) . (IEEE, Ghent, Belgium), pp. 42-50. Disponible en https://ieeexplore.ieee.org/document/6572968 |
| JERICHO   | The Jericho Forum. (2007). Jericho Forum Commandments , version 1.2. Disponible en https://collaboration.opengroup.org/jericho/commandments_v1.2.pdf                                                                                |


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Incident Response Recommendations and Considerations for Cybersecurity Risk Management_ A CSF 2.0 Community Profile provide? (Part 2)

[Assistant]
ts, guidelines, and procedures, where they exist, remain operative. For planning and transition purposes, federal agencies may wish to closely follow the development of these new publications by NIST.
Organizations are encouraged to review all draft publications during public comment periods and provide feedback to NIST. Many NIST cybersecurity publications, other than the ones noted above, are available at https://csrc.nist.gov/publications. ## Authority

This publication has been developed by NIST in accordance with its statutory responsibilities under the Federal Information Security Modernization Act (FISMA) of 2014, 44 U.S.C. § 3551 et seq., Public Law (P.L.) 113-283. NIST is responsible for developing information security standards and guidelines, including minimum requirements for federal information systems, but such standards and guidelines shall not apply to national security systems without the express approval of appropriate federal officials exercising policy authority over such systems. This guideline is consistent with the requirements of the Office of Management and Budget (OMB) Circular A-130. Nothing in this publication should be taken to contradict the standards and guidelines made mandatory and binding on federal agencies by the Secretary of Commerce under statutory authority. Nor should these guidelines be interpreted as altering or superseding the existing authorities of the Secretary of Commerce, Director of the OMB, or any other federal official. This publication may be used by nongovernmental organizations on a voluntary basis and is not subject to copyright in the United States. Attribution would, however, be appreciated by NIST.

Incident Response Recommendations and Considerations for Cybersecurity Risk Management_ A CSF 2.0 Community Profile


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Protecting Controlled Unclassified Information (CUI)_ NIST Special Publication 800-171, Revision 3. Small Business Primer provide? (Part 8)

[Assistant]
ederal Agencies

- The National Archives and Records Administration (NARA) , per 32 CFR Part 2002 "Controlled Unclassified Information," determines what CUI is and lists CUI types at archives.gov/cui.
- NIST is responsible for developing and publishing the security requirements for the protection of CUI. How requirements are mandated, and any compliance issues related to nonfederal implementation of SP 800-171, are the responsibility of the federal agency requiring its use , as expressed in a specific contract or agreement. ## Additional NIST Resources

- NIST's Protecting CUI Frequently Asked Questions
- Changes Between SP 800-171 Rev. 2 and Rev. 3 (.xlsx)
- The NIST Cybersecurity and Privacy Reference Tool (CPRT) provides online, interactive versions of the updated security requirements in SP 800-171, Revision 3 and the updated assessment procedures in SP 800-171A, Revision 3
- Event Recording: ' CUI Security Requirements Workshop ,' which provides a general overview of SP 800 -171 and SP 800-171A
- NIST Small Business Cybersecurity Corner

ht ps:/

csrc.nist.gov/projects/protecting-control ed-unclas ified-information

<!-- image -->

## What to Expect

The following pages delve deeper into the SP 800-171 R3 publication to provide more details for those responsible for implementing the requirements 3 . The following pages cover:

<!-- image -->

Page 8: Key differences between SP 800-171 R2 and R3. Pages 9-10: General tips for getting started. Pages 11-28: Tips for getting started, broken out by Control Family. 3 We provide links to non-NIST sites throughout this publication because they may have information of interest to readers. NIST does not necessarily endorse the views expressed or the facts presented on those sites. Further, NIST does not endorse any commercial products that may be advertised or available on these sites.

Protecting Controlled Unclassified Information (CUI)_ NIST Special Publication 800-171, Revision 3. Small Business Primer


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Planning?

[Assistant]
According to Contingency Planning Guide for Federal Information Systems:

## Contingency Planning Guide for Federal Information Systems

## Contingency Planning Guide for Federal Information Systems

There are references in this publication to documents currently under development by NIST in accordance with responsibilities assigned to NIST under the Federal Information Security Management Act of 2002.  The methodologies in this document may be used even before the completion of such companion documents.  Thus, until such time as each document is completed, current requirements, guidelines, and procedures (where they exist) remain operative.  For planning and transition purposes, federal agencies may wish to closely follow the development of these new documents by NIST.  Individuals are also encouraged to review the public draft documents and offer their comments to NIST.

Contingency Planning Guide for Federal Information Systems


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Communications Protection?

[Assistant]
According to Assessing Security and Privacy Controls in Information Systems and Organizations:

NTROL ASSESSMENTS ..................................................... 30
3.4   ANALYZE ASSESSMENT REPORT RESULTS .....................................................................................
32
3.5   ASSESS SECURITY AND PRIVACY CAPABILITIES .............................................................................. 34
CHAPTER FOUR SECURITY AND PRIVACY ASSESSMENT PROCEDURES ................................................. 37
4.1   ACCESS CONTROL............................................................................................................................ 40
4.2   AWARENESS AND TRAINING ........................................................................................................ 118
4.3   AUDIT AND ACCOUNTABILITY ...................................................................................................... 128
4.4   ASSESSMENT, AUTHORIZATION, AND MONITORING ................................................................. 160
4.5   CONFIGURATION MANAGEMENT ................................................................................................ 177
4.6   CONTINGENCY PLANNING ............................................................................................................ 215
4.7   IDENTIFICATION AND AUTHENTICATION .................................................................................... 243
4.8   INCIDENT RESPONSE ............................................................................................................... 275
4.9   MAINTENANCE ........................................................................................................................ 298
4.10   MEDIA PROTECTION .............................................................................................................. 316
4.11   PHYSICAL AND ENVIRONMENTAL PROTECTION .......................................................................

Assessing Security and Privacy Controls in Information Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Information Integrity?

[Assistant]
According to Digital Identity Guidelines_ Authentication and Authenticator Management:

The verifier  SHOULD  determine the performance and integrity of the sensor and its
associated endpoint. This increases the likelihood of detecting injection attacks due to
compromised endpoints, sensor emulators, and similar threats. Acceptable methods for
making this determination include:

• The provenance (e.g., manufacturer or supplier certification), health, and integrity

Malicious code on the endpoint
proxies allows remote access to a
connected authenticator without
the subscriber’s consent.

Digital Identity Guidelines_ Authentication and Authenticator Management


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Awareness and Training?

[Assistant]
According to Assessing Security and Privacy Controls in Information Systems and Organizations:

NTROL ASSESSMENTS ..................................................... 30
3.4   ANALYZE ASSESSMENT REPORT RESULTS .....................................................................................
32
3.5   ASSESS SECURITY AND PRIVACY CAPABILITIES .............................................................................. 34
CHAPTER FOUR SECURITY AND PRIVACY ASSESSMENT PROCEDURES ................................................. 37
4.1   ACCESS CONTROL............................................................................................................................ 40
4.2   AWARENESS AND TRAINING ........................................................................................................ 118
4.3   AUDIT AND ACCOUNTABILITY ...................................................................................................... 128
4.4   ASSESSMENT, AUTHORIZATION, AND MONITORING ................................................................. 160
4.5   CONFIGURATION MANAGEMENT ................................................................................................ 177
4.6   CONTINGENCY PLANNING ............................................................................................................ 215
4.7   IDENTIFICATION AND AUTHENTICATION .................................................................................... 243
4.8   INCIDENT RESPONSE ............................................................................................................... 275
4.9   MAINTENANCE ........................................................................................................................ 298
4.10   MEDIA PROTECTION .............................................................................................................. 316
4.11   PHYSICAL AND ENVIRONMENTAL PROTECTION .......................................................................


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Audit and Accountability?

[Assistant]
According to Validating the Integrity of Computing Devices:

An internal audit finds multiple failures on the part of the purchasing department, the IT department, and the Information Security group to have in place measures to ensure the provenance of the equipment and the secure deployment of devices on the network. | Cybersecurity Framework v1.1   | Cybersecurity Framework v1.1                                   | Cybersecurity Framework v1.1                                                                                | SP 800-   | Security                  |
|--------------------------------|----------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-----------|---------------------------|
| Function                       | Category                                                       | Subcategory                                                                                | 53 R5     | Characteristics Addressed |
| Identify (ID)                  | Supply Chain Risk Management (ID.SC)                           | ID.SC-4: Suppliers and third-party partners are routinely assessed using audits, test results, or other forms of evaluations to confirm they are meeting their contractual obligations. | AU-6      | 5                         |
|                                | Asset Management (ID.AM)                                       | ID.AM-1: Physical devices and systems within the organization are inventoried. | CM-8      | 4                         |
| Protect (PR)                   | Identity Management, Authentication and Access Control (PR.AC) | PR.AC-6: Identities are proofed and bound to credentials and asserted in interactions.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Physical Protection?

[Assistant]
According to Incident Response Recommendations and Considerations for Cybersecurity Risk Management_ A CSF 2.0 Community Profile:

The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the Nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology. ITL's responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in federal information systems. The Special Publication 800-series reports on ITL's research, guidelines, and outreach efforts in information system security, and its collaborative activities with industry, government, and academic organizations. Within this document, an event is any observable occurrence that involves computing assets, including physical and virtual platforms, networks, services, and cloud environments. Examples of events are user login attempts, the installation of software updates, and an application responding to a transaction request. Many events focus on security or have security implications. Adverse events are any events associated with a negative consequence regardless of cause, including natural disasters, power failures, or cybersecurity attacks. This guide addresses only adverse cybersecurity events . Additional analysis is often needed to determine whether adverse cybersecurity events indicate that a cybersecurity incident has occurred.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Awareness and Training?

[Assistant]
According to Organizational Views of NIST Cryptographic Standards and Testing and Validation Programs:

|                                                                                | Introduction ..................................................................................................................... | Introduction ..................................................................................................................... |
|------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
|                                                                                | Background: NIST Cryptographic Standards and Testing/Validation Programs ... 1 Methodology.......................................................................................................... 2 | Background: NIST Cryptographic Standards and Testing/Validation Programs ... 1 Methodology..........................................................................................................

Organizational Views of NIST Cryptographic Standards and Testing and Validation Programs


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Media Protection?

[Assistant]
According to Guide to Auditing for Controls and Security_ A System Development Life Cycle Approach:

| 3.4.5.1.1 Mission Impact/Strategic Value/Organization | 55 | | | (Business) Criticality and Sensitivity Factors 3.4.5.2 Level II: | (Business) Criticality and Sensitivity Factors 3.4.5.2 Level II: | (Business) Criticality and Sensitivity Factors 3.4.5.2 Level II: | | | | | | | 56 | | | 3.4.5.2.1 | 3.4.5.2.1 | System Size/Scale/Complexity | 56 | | | 3.4.5.2.2 | 3.4.5.2.2 | System Environment/Stability | 57 | | | 3.4.5.2.3 | 3.4.5.2.3 | Reliability/Integrity | 58 | | | 3.4.5.2.4 | 3.4.5.2.4 | Technology Integration | 59 | | 3.5 | RISK SCORING -- APPLICATION OF THE WORK PRIORITY SCHEME | RISK SCORING -- APPLICATION OF THE WORK PRIORITY SCHEME | RISK SCORING -- APPLICATION OF THE WORK PRIORITY SCHEME | 59 | | | 3.5.1 Implementation of the Scheme | 3.5.1 Implementation of the Scheme | 3.5.1 Implementation of the Scheme | 59 | | | 3.5.2 | A Simple Scoring Approach | A Simple Scoring Approach | 60 | | | 3.5.3 | A Detailed Scoring Approach | A Detailed Scoring Approach | 60 | | | 3.5.4 | Discretionary Audits | Discretionary Audits | 60 | | 3.6 | USES OF THE WORK PRIORITY SCHEME | USES


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Summary Report for “Workshop on Updating Manufacturer Guidance for Securable Connected Product Development” provide? (Part 7)

[Assistant]
considerations among Information Technology (IT), Internet of Things (IoT), Operational Technology (OT), and Industrial Internet of Things (IIoT)
- Identify insights, considerations, approaches, etc.
for IoT based on the NIST Privacy Framework, NIST Cyber Physical Systems/IoT Framework, NIST Cybersecurity Framework 2.0, and the NIST Secure Software Development Framework. - Incorporate lessons learned and techniques developed in the execution of several IoTrelated National Cybersecurity Center of Excellence (NCCoE) projects. - Address emerging connected product technologies more directly (i.e., Immersive Tech, Artificial Intelligence). - Discuss any relationship that may exist between the repairability of connected products and cybersecurity. - Provide guidelines on balancing cybersecurity with device support considerations, especially when there is a significant mismatch between the expected end of support of the IT components and the end of life of the mechanical components of the connected products. NIST held the publicly available hybrid workshop with virtual morning plenary sessions and afternoon in-person discussion sessions as detailed in the table below.

Summary Report for “Workshop on Updating Manufacturer Guidance for Securable Connected Product Development”

Audit and Accountability
System and Information Integrity
Security Assessment
Media Protection
Identification and Authentication
Awareness and Training
System and Communications Protection
Access Control
Planning
Incident Response
Risk Assessment
Personnel Security
System and Services Acquisition
Maintenance
Physical Protection
Configuration Management


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Configuration Management?

[Assistant]
According to Status Report on the Fourth Round of the NIST Post-Quantum Cryptography Standardization Process:

. . . . . . . . . . . . . . . | 10             |
| 3.2. | BIKE . . . . . . . . . . . . . . . . . . . . . . . . . . . . | 12             |
| 3.3. | Classic McEliece . . . . . . . . . . . . . . . . . .
. . . | 14             |
| 3.4. | SIKE . . . . . . . . . . . . . . . . . . . . . . . . . . . . | 16             |
| 4. Conclusion . . | . . . . . . . . . . . . . . . . . . . . . . . . . . | 18             |
| References . . | . . . . . . . . . . . . . . . . . . . . . . . . . . . | 19             |
| Appendix A. List of Symbols, Abbreviations, and Acronyms                                                                                | . | 26             |
| List of Tables                                                                                | List of Tables                                                                                | List of Tables |
| Table 1. Timeline of the NIST Post-Quantum Cryptography Standardization Process                                                                                | Table 1. Timeline of the NIST Post-Quantum Cryptography Standardization Process                                                                                | 2              |
| Table 2. Fourth-round KEM candidates organized by category, with the candidate se- lected for standardization bolded and in blue . . . . . . . . . . . . . . . . | Table 2. Fourth-round KEM candidates organized by category, with the candidate se- lected for standardization bolded and in blue . . . . . . . . . . . . . . . . | 4              |
| Table 3. Performance of BIKE in thousands of cycles on x86_64 [1] . . . | Table 3. Performance of BIKE in thousands of cycles on x86_64 [1] . . . | 6              |
| Table 4. Performance of HQC in thousands of cycles on x86_64 [1] . . . | Table 4.

Status Report on the Fourth Round of the NIST Post-Quantum Cryptography Standardization Process


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Identification and Authentication?

[Assistant]
According to Secure Software Development Framework (SSDF) Version 1.1_ Recommendations for Mitigating the Risk of Software Vulnerabilities:

| Example 1 : Appoint a single leader or leadership team to be responsible for the entire secure software development process, including being accountable for releasing software to production and delegating responsibilities as appropriate. Example 2 : Increase authorizing officials' awareness of the risks of developing software without integrating security throughout the development life cycle and the risk mitigation provided by secure development practices. Example 3 : Assist upper management in incorporating secure development support into their communications with personnel with development-related roles and responsibilities. Example 4 : Educate all personnel with development-related roles and responsibilities on upper management's commitment to secure development and the importance of secure development to the organization. | BSIMM : SM1.3, SM2.7, CP2.5 EO14028 : 4e(ix) NISTCSF : ID.RM-1, ID.SC-1 OWASPSAMM : SM1.A PCISSLC : 1.1 SP800181 : T0001, T0004                                                                                |
| Implement Supporting Toolchains (PO.3) : Use automation to reduce human effort and improve the accuracy, reproducibility, usability, and comprehensiveness of security practices throughout the SDLC, as well as provide a way to document and demonstrate the use of these practices.

Secure Software Development Framework (SSDF) Version 1.1_ Recommendations for Mitigating the Risk of Software Vulnerabilities


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Awareness and Training?

[Assistant]
According to Contingency Planning Guide for Federal Information Systems:

| Chapter 1.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What guidance does Overview and Considerations of Access Control Based on Attribute Encryption provide?

[Assistant]
<!-- image -->

## NIST Internal Report NIST IR 8450-upd1

## Overview and Considerations of Access Control Based on Attribute Encryption

Vincent C. Hu

This publication is available free of charge from: https://doi.org/10.6028/NIST.IR.8450-upd1

<!-- image -->

## NIST Internal Report NIST IR 8450-upd1

## Overview and Considerations of Access Control Based on Attribute Encryption

Vincent C. Hu Computer Security Division Information Technology Laboratory

This publication is available free of charge from: https://doi.org/10.6028/NIST.IR.8450-upd1

September 2023 INCLUDES UPDATES AS OF 12-20-2023; SEE APPENDIX A

<!-- image -->

U.S. Department of Commerce Gina M. Raimondo, Secretary

National Institute of Standards and Technology

Laurie E. Locascio, NIST Director and Under Secretary of Commerce for Standards and Technology

Certain commercial equipment, instruments, software, or materials, commercial or non-commercial, are identified in this paper in order to specify the experimental procedure adequately. Such identification does not imply recommendation or endorsement of any product or service by NIST, nor does it imply that the materials or equipment identified are necessarily the best available for the purpose. There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may be used by federal agencies even before the completion of such companion publications. Thus, until each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning and transition purposes, federal agencies may wish to closely follow the development of these new publications by NIST. Organizations are encouraged to review all draft publications during public comment periods and provide feedback to NIST.

Overview and Considerations of Access Control Based on Attribute Encryption


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Security Assessment?

[Assistant]
According to Guide to a Secure Enterprise Network Landscape:

r example, the risk profile of the device can be obtained through an out-of-the-box posture check (risk of the device [28]) with or without integrating with an endpoint protection tool for the device.
Other crucial information (provided by telemetry data) needed to assess the security status of the endpoint devices [29] include (a) device support label (the device is managed or corporate-owned) and (b) device posture information (whether it has been compromised). All of these factors go into a policy evaluation for determining the level of trust and must be channeled into authentication and monitoring decisions [30]. 3. Information about real-time contextual data - Date, time, and geolocation at which the access request occurs
4. Information about IT services (e.g., app, data) being accessed
5. Information about the security of the environment hosting the IT services being accessed

Guide to a Secure Enterprise Network Landscape


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Summary Report for “Workshop on Updating Manufacturer Guidance for Securable Connected Product Development” provide? (Part 5)

[Assistant]
ersecurity risk management. |
|    7 | There is an increased awareness for evolving cybersecurity responsibilities across the players of the IoT ecosystem from manufacturers to users of the ecosystem.
|

## About the NIST Cybersecurity for the Internet of Things Program

The mission of the NIST Cybersecurity for the Internet of Things (IoT) program is to cultivate trust in the IoT and foster an environment that enables innovation on a global scale through standards, guidelines, and related tools. The Cybersecurity for IoT program supports the development and application of standards, guidelines, and related tools to improve the cybersecurity of connected devices and the environments in which they are deployed. The program collaborates with stakeholders across government, industry, international bodies, and academia. ## Background

In May 2020, NIST published Foundational Cybersecurity Activities for IoT Device Manufacturers (NIST IR 8259), which describes recommended cybersecurity activities that manufacturers should consider integrating into their product development and support lifecycle. These foundational cybersecurity activities can help manufacturers lessen the cybersecurity-related efforts needed by customers, which in turn can reduce the prevalence and severity of IoT device compromises and the attacks performed using compromised devices. Over time, the NIST volume of work has built upon the concepts introduced in the NIST IR 8259 series to introduce technical, IoT Device Cybersecurity Capability Core Baseline (NIST IR 8259A) and nontechnical, IoT Non-Technical Supporting Capability Core Baseline (NIST IR 8259B) concepts to help manufacturers and customers consider the cybersecurity of IoT devices.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Planning?

[Assistant]
According to Summary of NIST SP 800-53, Revision 4_ Security and Privacy Controls for Federal Information Systems and Organizations:

To aid in review activities, security planning, and risk assessments, organizations document the relevant decisions taken during the security control selection process, providing a sound rationale for those decisions. This documentation is essential when examining the security considerations for organizational information systems with respect to the potential impact on an organization's mission and business.

The resulting tailored baseline set of security controls and the supporting rationale for the selection decisions (including any information system use restrictions required by organizations) are documented in system security plans. Documenting significant risk management decisions in the security control selection process is imperative so that authorizing officials have access to necessary information to make informed authorization decisions for organizational information systems, as demonstrated in Figure 3.

Federal agencies are required to ensure that privacy protections are incorporated into information security planning. To that end, SP 800-53 Rev. 4 features eight new families of privacy controls that are based on the internationally accepted Fair Information Practice Principles (FIPPs). The proliferation of social media, Smart Grid, mobile, and cloud computing, as well as the transition from structured to unstructured data and metadata environments, have added significant complexities and challenges for federal organizations in safeguarding privacy. These challenges extend well beyond the traditional information technology security view of protecting privacy, which focused primarily on ensuring confidentiality.

Summary of NIST SP 800-53, Revision 4_ Security and Privacy Controls for Federal Information Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for System and Services Acquisition?

[Assistant]
According to Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171:

There may be references in this publication to other publications currently under development by  NIST  in  accordance  with  its  assigned  statutory  responsibilities. The  information  in  this publication, including concepts, practices, and methodologies, may be used by federal agencies even  before  the  completion  of  such  companion  publications. Thus,  until  each  publication  is completed,  current  requirements,  guidelines,  and  procedures,  where  they  exist,  remain operative. For planning and transition purposes, federal agencies may wish to closely follow the development of these new publications by NIST. The National Institute of Standards and Technology (NIST) Information Technology Laboratory (ITL) promotes the U.S. economy and public welfare by providing technical leadership for the Nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology (IT). ITL's responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the costeffective security of other than national security-related information in federal information systems. The Special Publication 800-series reports on ITL's research, guidelines, and outreach efforts in information systems security and privacy and its collaborative activities with industry, government, and academic organizations. | CHAPTERONE INTRODUCTION...................................................................................................... | CHAPTERONE INTRODUCTION......................................................................................................

Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Secure Software Development Practices for Generative AI and Dual-Use Foundation Models_ An SSDF Community Profile provide? (Part 4)

[Assistant]
DF) version 1.1 by adding practices, tasks, recommendations, considerations, notes, and informative references that are specific to AI model development throughout the software development life cycle.
These additions are documented in the form of an SSDF Community Profile to support Executive Order (EO) 14110, Safe, Secure, and Trustworthy Development and Use of Artificial Intelligence , which tasked NIST with 'developing a companion resource to the [SSDF] to incorporate secure development practices for generative AI and for dual-use foundation models.' This Community Profile is intended to be useful to the producers of AI models, the producers of AI systems that use those models, and the acquirers of those AI systems. This Profile should be used in conjunction with NIST Special Publication (SP) 800-218, Secure Software Development Framework (SSDF) Version 1.1: Recommendations for Mitigating the Risk of Software Vulnerabilities. ## Keywords

artificial intelligence; artificial intelligence model; cybersecurity risk management; generative artificial intelligence; secure software development; Secure Software Development Framework (SSDF); software acquisition; software development; software security. ## Reports on Computer Systems Technology

The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the Nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology. ITL's responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in federal information systems.

Secure Software Development Practices for Generative AI and Dual-Use Foundation Models_ An SSDF Community Profile


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Ordered t-way Combinations for Testing State-based Systems provide? (Part 2)

[Assistant]
lication of the results to verify and test state-based systems. ## Keywords

combinatorial coverage; combinatorial methods; combinatorial testing; software testing; structural coverage; test coverage.
## Disclaimer

Any mention of commercial products or reference to commercial organizations is for information only; it does not imply recommendation or endorsement by NIST, nor does it imply that the products mentioned are necessarily the best available for the purpose. ## Additional Information

For additional information on NIST's Cybersecurity programs, projects and publications, visit the Computer Security Resource Center. Information on other efforts at NIST and in the Information Technology Laboratory (ITL) is also available. cfdwp@nist.gov

Submit comments on this publication to:

National Institute of Standards and Technology Attn: Computer Security Division, Information Technology Laboratory 100 Bureau Drive (Mail Stop 8930) Gaithersburg, MD 20899-8930

## 1 Introduction

Vulnerability and fault detection often depend on the specific  order  of  inputs  that  establish  states  which eventually lead to a failure. That is, many software processes  are  not  deterministic  functions  where  an input produces the same output whenever the process is invoked irrespective of previous invocations. This is  particularly  true  of  real-time  systems,  which  are designed  to  run  continuously,  maintain  states,  and respond to a changing series of inputs. Such systems are typically driven by a loop function that accepts input values, processes and responds to those inputs, and  updates  its  current  state. Examples  include network protocols and data servers. The system state may change, depending on input, and the system may subsequently respond differently to the same input. That is, the response of the process to a particular set of input values may depend on its current state, such as whether a communication protocol is in a listen or connection-open state.

Ordered t-way Combinations for Testing State-based Systems


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Maintenance?

[Assistant]
According to Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule_ A Cybersecurity Resource Guide:

Additional information about this publication is available at https://csrc.nist.gov/pubs/sp/800/66/r2/final, including related content, potential updates, and document history. NIST Special Publication (SP) 800-66 aims to help educate readers about the security standards included in the HIPAA Security Rule and assist regulated entities in their implementation of the Security Rule. It includes a brief overview of the HIPAA Security Rule, provides guidance for regulated entities in assessing and managing risk to ePHI, identifies typical activities that a additional resources that regulated entities may find useful when implementing the Security regulated entity should consider when implementing an information security program, and lists Rule. This publication is intended to aid understanding of the HIPAA Security Rule and does not supplement, replace, modify, or supersede the Security Rule itself. Anyone seeking clarifications on the HIPAA Security Rule should contact the U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR). For general HIPAA Security Rule information, visit the HHS Security Rule website. 4 The NIST publications available as of the publication date of SP 800-66r2 (Revision 2) were used in preparing this document. NIST frequently publishes new standards and guidelines or updates existing publications that may also serve as useful references. To remain current with the latest

1. Security Standards: General Rules - Includes the general requirements that all regulated entities must meet, establishes flexibility of approach, identifies standards and implementation specifications (both required and addressable), outlines decisions that a regulated entity must make regarding addressable implementation specifications, and requires the maintenance of security measures to continue reasonable and appropriate protection of ePHI
2.

Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule_ A Cybersecurity Resource Guide


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What guidance does Report on the Design-A-Thon_ Designing Effective and Accessible Approaches for Digital Product Cybersecurity Education and Awareness provide?

[Assistant]
<!-- image -->

## NIST Internal Report NIST IR 8558

## Report on the Design-A-Thon: Designing Effective and Accessible Approaches for Digital Product Cybersecurity Education and Awareness

Michael Fagan Julie Haney Daniel Eliot Barbara Cuthill Kristina Rigopoulos

This publication is available free of charge from:

https://doi.org/10.6028/NIST.IR.8558

<!-- image -->

## NIST Internal Report NIST IR 8558

## Report on the Design-A-Thon: Designing Effective and Accessible Approaches for Digital Product Cybersecurity Education and Awareness

Michael Fagan Daniel Eliot Barbara Cuthill Kristina Rigopoulos

Applied Cybersecurity Division Information Technology Laboratory

Julie Haney Information Access Division Information Technology Laboratory

This publication is available free of charge from:

https://doi.org/10.6028/NIST.IR.8558

September 2025

<!-- image -->

U.S. Department of Commerce Howard Lutnick, Secretary

Certain equipment, instruments, software, or materials, commercial or non-commercial, are identified in this paper in order to specify the experimental procedure adequately. Such identification does not imply recommendation or endorsement of any product or service by NIST, nor does it imply that the materials or equipment identified are necessarily the best available for the purpose. There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may be used by federal agencies even before the completion of such companion publications. Thus, until each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning and transition purposes, federal agencies may wish to closely follow the development of these new publications by NIST.

Report on the Design-A-Thon_ Designing Effective and Accessible Approaches for Digital Product Cybersecurity Education and Awareness


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Configuration Management?

[Assistant]
According to Guide for Developing Security Plans for Federal Information Systems:

risk and local conditions including organization-specific security requirements, specific threat information, costbenefit analyses, the availability of compensating controls, or special circumstances.
Common security controls, which is one of the tailoring considerations, must be identified prior to system security plan preparation in order to identity those controls covered at the agency level, which are not system-specific. These common security controls can then be incorporated into the system security plan by reference.

Guide for Developing Security Plans for Federal Information Systems


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Multi-Factor Authentication for Criminal Justice Information Systems_ Implementation Considerations for Protecting Criminal Justice Information provide? (Part 7)

[Assistant]
.........................31   |
| Appendix A. Technology Components Relevant to MFA for CJIS Access .............................................32                                     |

| Appendix B.
Federated Identity Architectures...................................................................................33              |
|------------------------------------------------------------------------------------------------------------------------------------------------|
| B.4.1. Both CAD/RMS Web App& IdP at the State Agency .................................................................37                       |
| B.4.2. CAD Thick Client at the County with the IdP at the State Agency .............................................41                         |
| B.4.3. Both the CAD/RMS Web App and IdP at a County Agency........................................................45                           |
| B.4.4. Integrations with OAuth 2.0 and OIDC.......................................................................................46           |
| B.5.1. VPN Integration with Kerberos but without Federation............................................................50                      |
| B.5.2. VPN Integration with an Identity Provider.................................................................................51            |
| Appendix C. Questions to Ask Your Technology Vendors...................................................................53                      |
| Appendix D. List of Symbols, Abbreviations, and Acronyms...............................................................61                      |
| List of Tables                                                                                |
| Table 1.

Multi-Factor Authentication for Criminal Justice Information Systems_ Implementation Considerations for Protecting Criminal Justice Information


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Risk Assessment?

[Assistant]
According to Validating the Integrity of Computing Devices:

The authoritative source of information regarding the provenance and integrity of the components provides a strong basis for trust in a computing device. Hardware roots of trust are the foundation upon which the computing system's trust model is built, forming the basis in hardware for providing one or more security-specific functions for the system. Incorporating hardware roots of trust into acquisition and lifecycle management processes enables organizations to achieve better visibility into supply chain attacks and to detect advanced persistent threats and other attacks. By leveraging hardware roots of trust capabilities as a computing device traverses the supply chain, we can maintain trust in the computing device throughout its operational lifecycle.

Validating the Integrity of Computing Devices


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What guidance does Protecting Information and System Integrity in Industrial Control System Environments_ Cybersecurity for the Manufacturing Sector provide?

[Assistant]
## NIST SPECIAL PUBLICATION 1800-10

## Protecting Information and System Integrity in Industrial Control System Environments: Cybersecurity for the Manufacturing Sector

Includes Executive Summary (A); Approach, Architecture, and Security Characteristics (B); and How-To Guides (C)

Michael Powell Joseph Brule Michael Pease Keith Stouffer CheeYee Tang Timothy Zimmerman Chelsea Deane John Hoyt Mary Raguso Aslam Sherule Kangmin Zheng Matthew Zopf

FINAL

March 2022

This publication is available free of charge from https://doi.org/10.6028/NIST.SP.1800-10

The first draft of this publication is available free of charge from https://www.nccoe.nist.gov/publications/practice-guide/protecting-information-and-systemintegrity-industrial-control-system-draft

<!-- image -->

## NIST SPECIAL PUBLICATION 1800-10

## Protecting Information and System Integrity in Industrial Control System Environments: Cybersecurity for the Manufacturing Sector

Includes Executive Summary (A); Approach, Architecture, and Security Characteristics (B); and How-To Guides (C)

Michael Powell National Cybersecurity Center of Excellence National Institute of Standards and Technology

Michael Pease Keith Stouffer CheeYee Tang Timothy Zimmerman Engineering Laboratory National Institute of Standards and Technology

Joe Brule Chelsea Deane John Hoyt Mary Raguso Aslam Sherule Kangmin Zheng The MITRE Corporation McLean, Virginia

Matthew Zopf Strativia Largo, Maryland

FINAL

March 2022

<!-- image -->

U.S. Department of Commerce Gina M. Raimondo, Secretary

National Institute of Standards and Technology

James K.

Protecting Information and System Integrity in Industrial Control System Environments_ Cybersecurity for the Manufacturing Sector


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Communications Protection?

[Assistant]
According to Guide to Auditing for Controls and Security_ A System Development Life Cycle Approach:

4. Ineffective Security Practices for the AppHcation - Inadequate manual checks and controls to ensure correct processing by the ADP system, or negligence by those responsible for carrying out these checks, result in many vulnerabilities. 5. Procedural Errors Within the ADP Facility - Both errors and intentional acts committed by the ADP operations staff may result in improper operational procedures, lapsed controls, and losses in storage media and output. 6. Program Errors - Applications programs should be developed in an environment that requires and supports complete, correct, and consistent program design, good programming practices, adequate testing, review, and documentation, and proper maintenance procedures. Although programs developed in such an environment may still contain undetected errors, programs not developed in this manner will probably be rife with errors. Additionally, programmers can deliberately modify programs to produce undesirable side effects or they can misuse the programs they are in charge of. 7. Operating System Flaws - Design and implementation errors, system generation and maintenance problems, and deliberate penetrations resulting in modifications to the operating system can produce undesirable effects in the application system. Flaws in the operating system are often difficult to prevent and detect. 8. Communications System Failure - Information being routed from one location to another over communication lines is vulnerable to accidental failures and to intentional interception and modification by unauthorized parties. 8 Development Phase-The Institute for Computer Sciences and Technology at the National Bureau of Standards (ICST/NBS), in structuring a framework within which the development of software could be discussed, identified a Development Phase including four stages -definition, design, programming, and testing. These are represented by Phases II-V described above.

Guide to Auditing for Controls and Security_ A System Development Life Cycle Approach


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Multi-Factor Authentication for Criminal Justice Information Systems_ Implementation Considerations for Protecting Criminal Justice Information provide? (Part 9)

[Assistant]
....................20                   |
| Fig. 11. Common architecture for implementing MFA directly with state portal.................................22                                |
| Fig. 12.
Common architecture for implementing MFA at state agency identity service. ......................23                                   |

| Fig. 13. State application dashboard. ................................................................................................24     |
|----------------------------------------------------------------------------------------------------------------------------------------------|
| Fig. 14. VPN with MFA is not integrated with the CJIS application......................................................25                    |
| Fig. 15. Integrating MFA for a VPN with Kerberos..............................................................................26             |
| Fig. 16. Integrating MFA for a VPN with federation. ..........................................................................28             |
| Fig. 17. Federation in a message switch use case...............................................................................34            |
| Fig. 18. Web app and IdP at state (SAML proxy). ...............................................................................38            |
| Fig. 19. Web app and IdP at state (WS-Trust). ...................................................................................40          |
| Fig. 20. Thick client CAD/RMS and Proxy IdP at county, state IdP.......................................................42                    |
| Fig. 21. Thick client CAD/RMS at county, state IdP (WS-Trust). ..........................................................44                  |
| Fig. 22. CAD/RMS web app and IdP at county (SAML proxy). .............................................................45                     |
| Fig. 23. CAD/RMS web app and IdP at state - OIDC and OAuth 2.0.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Risk Assessment?

[Assistant]
According to Protecting Information and System Integrity in Industrial Control System Environments_ Cybersecurity for the Manufacturing Sector:

Although the integration of IT and OT networks is helping manufacturers boost productivity and gain efficiencies, it has also provided malicious actors, including nation states, common criminals, and insider threats a fertile landscape where they can exploit cybersecurity vulnerabilities to compromise the integrity of ICS and ICS data to reach their end goal. The motivations behind these attacks can range from degrading manufacturing capabilities to financial gain, and causing reputational harm.

Once malicious actors gain access, they can harm an organization by compromising data or system integrity, hold ICS and/or OT systems ransom, damage ICS machinery, or cause physical injury to workers. The statistics bear this out. The X-Force Threat Intelligence Index 2021 (ibm.com) stated that manufacturing was the second-most-attacked industry in 2020, up from eighth place in 2019.

The NCCoE, in conjunction with the NIST EL, collaborated with cybersecurity technology providers to develop and implement example solutions that demonstrate how manufacturing organizations can protect the integrity of their data from destructive malware, insider threats, and unauthorized software within manufacturing environments that rely on ICS.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule_ A Cybersecurity Resource Guide provide? (Part 9)

[Assistant]
.............................................................79                                                                                |
| 5.5.1.
Policies and Procedures (§ 164.316(a))......................................................................................81                                                                                |
| 5.5.2. Documentation (§ 164.316(b))...................................................................................................83                                                                                |
| References.......................................................................................................................................85                                                                                |
| Appendix A. List of Symbols, Abbreviations, and Acronyms...............................................................87                                                                                |
| Appendix B. Glossary .......................................................................................................................91                                                                                |
| Appendix C. Risk Assessment Tables.................................................................................................96                                                                                |
| Appendix D. Security Rule Standards and Implementation Specifications Crosswalk........................105                                                                                |
| Appendix E.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Risk Assessment?

[Assistant]
According to Federal Cybersecurity Role-Based Training Approaches, Successes, and Challenges:

- RBT assignment: There is no standard way that organizations determine which employees should be assigned RBT. Some use the National Initiative for Cybersecurity Education (NICE) Workforce Framework for Cybersecurity (NICE Framework) as a guide, but others leave decisions up to the office of the Chief Information Officer (CIO) or even individual supervisors. - RBT content: About two-thirds of surveyed participants said that their organizations create at least some RBT content on their own, which could be resource-intensive. Those who purchase training may find the cost to obtain content for many cybersecurity roles to be prohibitive. Indeed, over 40% of survey participants rated finding RBT materials and updating RBT as moderately or very challenging. On the upside, the majority (about 60%) said that their RBT content is tailored to their organizational mission and current security threats. - RBT approaches: Almost all survey participants (95%) said their organizations offered at least some online training, while over half also allow live training options. Almost half utilize industry-recognized certifications to fulfill RBT requirements. NIST Special Publication (SP) 800-53 Rev. 5, Security and Privacy Controls for Information Systems and Organizations , provides guidance for organizations in protecting their operations, assets, and personnel from security threats and risks [SP800-53]. Within the document, Awareness and Training Control (AT-3) 'Role-based Training' addresses training for personnel with 'responsibilities related to operations and supply chain risk management within the context of organizational security and privacy programs.' Furthermore, organizations are instructed to document, monitor, and retain records for their training activities. In addition to federal personnel, RBT applies to contractors providing services to federal organizations. 'Training for a 'new in role' and 'refresher training' needs are quite different.

Federal Cybersecurity Role-Based Training Approaches, Successes, and Challenges


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Identification and Authentication?

[Assistant]
According to Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule_ A Cybersecurity Resource Guide:

| 5.2.4. Device and Media Controls (§ 164.310(d)).................................................................................63                                                                                |
|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| 5.3.1. Access Control (§ 164.312(a)).....................................................................................................65                                                                                |
| 5.3.2. Audit Controls (§ 164.312(b)).....................................................................................................69                                                                                |
| 5.3.3. Integrity (§ 164.312(c))...............................................................................................................71                                                                                |
| 5.3.4. Person or Entity Authentication (§ 164.312(d)).........................................................................73                                                                                |
| 5.3.5. Transmission Security (§ 164.312(e)(1)).....................................................................................75                                                                                |
| 5.4.1.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AT.L2-3.2.4 (NIST 3.2.4)?

[Assistant]
According to Zero Trust Architecture:

3.2.4                                                                                | Entorno de pruebas (sandbox) para aplicaciones en dispositivos... 3.2.4 Entorno de pruebas ( sandbox ) para aplicaciones en dispositivos

Otra variación del modelo de despliegue de agente y puerta de enlace es hacer que las aplicaciones o procesos examinados se ejecuten en compartimentos independientes dentro de los activos.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Risk Assessment?

[Assistant]
According to High-Performance Computing Security_ Architecture, Threat Analysis, and Security Posture:

Architecture, Threat Analysis, and Security Posture

Architecture, Threat Analysis, and Security Posture

Guo Y, Chandramouli R, Wofford L, Gregg R, Key G, Clark A, Hinton C, Prout A, Reuther A, Adamson R, Warren A, Bangalore P, Deumens E, Farkas C (2024) High-Performance Computing Security: Architecture, Threat Analysis, and Security Posture. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) NIST SP 800-223. https://doi.org/10.6028/NIST.SP.800-223

High-Performance Computing Security_ Architecture, Threat Analysis, and Security Posture


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Physical Protection?

[Assistant]
According to Contingency Planning Guide for Federal Information Systems:

The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analysis to advance the development and productive use of information technology. ITL's responsibilities include the development of technical, physical, administrative, and management standards and guidelines for the cost-effective security and privacy of sensitive unclassified information in federal computer systems. This Special Publication 800-series reports on ITL's research, guidance, and outreach efforts in computer security and its collaborative activities with industry, government, and academic organizations. -  Restoring information systems using alternate equipment;
-  Performing some or all of the affected business processes using alternate processing (manual) means (typically acceptable for only short-term disruptions);
-  Recovering information systems operations at an alternate location (typically acceptable for only long-term disruptions or those physically impacting the facility); and
-  Implementing of appropriate contingency planning controls based on the information system's security impact level. This document does not address facility-level information system planning (commonly referred to as a disaster recovery plan) or organizational mission continuity (commonly referred to as a continuity of operations [COOP] plan) except where it is required to restore information systems and their processing capabilities. Nor does this document address continuity of mission/business processes. Although information systems typically support mission/business processes, the processes also depend on a variety of other resources and capabilities not associated with information systems.

Contingency Planning Guide for Federal Information Systems


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Configuration Management?

[Assistant]
According to Guide to Malware Incident Prevention and Handling for Desktops and Laptops:

| 1 | | 1.1 | | Purpose and Scope...................................................................................................1 | | | | 1.2 | Audience ...................................................................................................................1 | | | | 1.3 | Document Structure | ..................................................................................................1 | | 2.

Guide to Malware Incident Prevention and Handling for Desktops and Laptops


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Guide for Developing Security Plans for Federal Information Systems provide? (Part 6)

[Assistant]
.................. 9                                           |
| 2.1 SYSTEM BOUNDARIES................................................................................................................
| 9                                                                                |
| 2.2 MAJOR APPLICATIONS ............................................................................................................. | 11                                                                                |
| 2.3 GENERAL SUPPORT SYSTEMS .................................................................................................. | 12                                                                                |
| 2.4 MINOR APPLICATIONS ............................................................................................................. | 12                                                                                |
| 2.5 SECURITY CONTROLS .............................................................................................................. | 13                                                                                |
| 2.5.1 Scoping Guidance ........................................................................................................... | 13                                                                                |
| 2.5.2 Compensating Controls ..................................................................................................


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Access Control?

[Assistant]
According to Workshop on Enhancing Security of Devices and Components Across the Supply Chain:

...............................11  |
| 2.5.1. Speaker Viewpoints....................................................................................................................11        |
| 2.5.2.
Key Highlights .............................................................................................................................13  |
| 3. Summary and Road Ahead ...........................................................................................................15                |
| Appendix A. Workshop Agenda........................................................................................................16                  |
| List of Figures                                                                                |
| Fig. 1. Components for securing microelectronics................................................................................1                      |
| Fig. 2. Distribution of workshop participants.......................................................................................2                  |

Workshop on Enhancing Security of Devices and Components Across the Supply Chain


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Information Integrity?

[Assistant]
According to Security and Privacy Controls for Information Systems and Organizations:

....................................................................... 11
2.4   SECURITY AND PRIVACY CONTROLS .........................................................................................
13
2.5   TRUSTWORTHINESS AND ASSURANCE ..................................................................................... 14
CHAPTER THREE   THE CONTROLS ................................................................................................. 16
3.1   ACCESS CONTROL .................................................................................................................. 18
3.2   AWARENESS AND TRAINING ................................................................................................... 59
3.3   AUDIT AND ACCOUNTABILITY ................................................................................................. 65
3.4   ASSESSMENT, AUTHORIZATION, AND MONITORING ................................................................. 83
3.5   CONFIGURATION MANAGEMENT ........................................................................................... 96
3.6   CONTINGENCY PLANNING .................................................................................................... 115
3.7   IDENTIFICATION AND AUTHENTICATION ............................................................................... 131
3.8   INCIDENT RESPONSE ............................................................................................................ 149
3.9   MAINTENANCE .................................................................................................................... 162
3.10   MEDIA PROTECTION .......................................................................................................... 171
3.11   PHYSICAL AND ENVIRONMENTAL PROTECTION ....................................................................

Security and Privacy Controls for Information Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for Physical Protection?

[Assistant]
According to Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171:

The National Institute of Standards and Technology (NIST) Information Technology Laboratory (ITL) promotes the U.S. economy and public welfare by providing technical leadership for the Nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology (IT). ITL's responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the costeffective security of other than national security-related information in federal information systems. The Special Publication 800-series reports on ITL's research, guidelines, and outreach efforts in information systems security and privacy and its collaborative activities with industry, government, and academic organizations. | CHAPTERONE INTRODUCTION...................................................................................................... | CHAPTERONE INTRODUCTION...................................................................................................... |
|--------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------|
| 1.1 PURPOSEANDAPPLICABILITY                                                                                | ...................................................................................................