[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Information Integrity?

[Assistant]
According to Control Baselines for Information Systems and Organizations:

| ORGANIZATIONAL RESPONSIBILITIES .........................................................................................
| 2                                                                                |
| 1.4                                                                                | RELATIONSHIPTOOTHERPUBLICATIONS ................................................................................... | 3                                                                                |
| 1.5                                                                                | REVISIONSANDEXTENSIONS .................................................................................................... | 3                                                                                |
| 1.6                                                                                | PUBLICATIONORGANIZATION .................................................................................................. | 3                                                                                |
| CHAPTERTWO THE FUNDAMENTALS............................................................................................ 5                     | CHAPTERTWO THE FUNDAMENTALS............................................................................................ 5                     | CHAPTERTWO THE FUNDAMENTALS............................................................................................

Control Baselines for Information Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What guidance does NIST provide for CMMC Level 1?

[Assistant]
According to IoT Non-Technical Supporting Capability Core Baseline:

ory responsibilities. The information in this publication, including concepts and methodologies, may  be  used  by  federal  agencies  even  before  the  completion  of  such  companion  publications.
Thus,  until  each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning  and  transition  purposes,  federal  agencies  may  wish  to  closely  follow  the  development  of  these  new publications by NIST. Organizations are encouraged to review all draft publications during public comment periods and provide feedback to NIST. Many NIST cybersecurity publications, other than the ones noted above, are available at https://csrc.nist.gov/publications. ## Comments on this publication may be submitted to:

National Institute of Standards and Technology Attn: Applied Cybersecurity Division, Information Technology Laboratory 100 Bureau Drive (Mail Stop 2000) Gaithersburg, MD 20899-2000

Email: iotsecurity@nist.gov

All comments are subject to release under the Freedom of Information Act (FOIA). ## Reports on Computer Systems Technology

The  Information  Technology  Laboratory  (ITL)  at  the  National  Institute  of  Standards  and Technology  (NIST)  promotes  the  U.S. economy  and  public  welfare  by  providing  technical leadership  for  the  Nation's  measurement  and  standards  infrastructure. ITL  develops  tests,  test methods, reference data, proof of concept implementations, and technical analyses to advance the development  and  productive  use  of  information  technology. ITL's  responsibilities  include  the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in federal information systems. ## Abstract

Non-technical supporting capabilities are actions a manufacturer or third-party organization performs in support of the cybersecurity of an IoT device.

IoT Non-Technical Supporting Capability Core Baseline

Audit and Accountability
System and Information Integrity
Security Assessment
Media Protection
Identification and Authentication
Awareness and Training
System and Communications Protection
Access Control
Planning
Incident Response
Risk Assessment
Personnel Security
System and Services Acquisition
Supply Chain Risk Management
Maintenance
Physical Protection
Configuration Management


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Audit and Accountability?

[Assistant]
According to Guide to a Secure Enterprise Network Landscape:

- Packet filters and network address translation: Packet filtering and Network address translation (NAT) are used to monitor and control packets moving across a network interface, apply predetermined security rules, and obscure the internal network from the public internet. - Stateful inspection: Stateful firewalling, also known as dynamic packet filtering, monitors the state of connections and makes determinations as to what types of data packets belong to a known active connection and can be allowed to pass through the firewall. - Deep packet inspection (DPI): This feature, also known as packet sniffing, examines the content of packets (both the header and the payload, unlike the stateful inspection that inspects only the packet header). In addition to the capability provided by stateful inspection, this has capabilities related to finding hidden threats within the data stream, such as attempts at data exfiltration, violations of content policies, malware, and more. - Threat detection and response: Modern firewalls can gather and analyze enough data across multiple packets and sessions to detect threats and security incidents targeted at a particular system or a family of systems. These data from multiple firewalls can also be directed toward security information and event management (SIEM) and correlated with data from other security tools and IT systems to detect enterprise-wide attacks that span multiple systems and network layers. In addition, these data can be used to understand evolving threats and define new access rules, attack patterns, and defensive strategies [6]. - Logging and auditing capabilities: Logging and auditing capabilities result in the construction of network events that can be used to identify patterns of performance and security issues. - Access control functions: Access control functions enforce granular sophisticated access control policies.

Guide to a Secure Enterprise Network Landscape


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Supply Chain Risk Management?

[Assistant]
According to High-Performance Computing Security_ Architecture, Threat Analysis, and Security Posture:

Often, the end users themselves best understand how to tune their software to the bespoke hardware of an HPC system to ensure sufficient performance for their workload. Users regularly modify and recompile their software to enhance performance, fix bugs, and adapt to changes in the underlying dependencies or kernel interfaces over time. The sharing of user-built software between teams may be common. User software that is widely used is often open source and, therefore, subject to open-source software supply chain concerns. - Tussles between performance and security: HPC users may consider security to be valuable only to the extent that it does not significantly slow down the HPC system and impede research. Ensuring the usability of security mechanisms with a tolerable performance penalty is therefore critical to adoption by the scientific HPC community. - Varying security requirements for different HPC applications: Individual platforms, projects, and data may have significantly different security sensitivities and need to follow different security policies. An HPC system may need to enforce multiple security policies simultaneously. - Limited resources for security tools: Most HPC systems are designed to devote their resources to maximizing performance rather than acquiring and operating security tools. - Open-source software and self-developed research software: Open-source software and self-developed research software are widely used in HPC. Open-source software is vulnerable to open-source software supply chain threats, while HPC software input data may be vulnerable to data supply chain threats. Self-developed software is susceptible to low software quality. - Granular access control on databases: Since different research groups may have a need to know for different portions of data, granular access control capabilities are necessary.

High-Performance Computing Security_ Architecture, Threat Analysis, and Security Posture


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Incident Response?

[Assistant]
According to Guide to Auditing for Controls and Security_ A System Development Life Cycle Approach:

| 100 | | 4.4.1 Primary Audit Objective of the Definition Phase | 4.4.1 Primary Audit Objective of the Definition Phase | 4.4.1 Primary Audit Objective of the Definition Phase | 100 | | 4.4.2 Overview of the Definition Phase | 4.4.2 Overview of the Definition Phase | 4.4.2 Overview of the Definition Phase | 100 | | 4.4.2.1 | Participants and Their Tasks | Participants and Their Tasks | 101 | | 4.4.2.2 | System Definition Phase Documents | System Definition Phase Documents | 102 | | 4.4.3 Audit Survey | 4.4.3 Audit Survey | 4.4.3 Audit Survey | 103 | | 4.4.3.1 | Review Initiation Phase Outputs | Review Initiation Phase Outputs | 104 | | 4.4.3.2 | Review Definition Phase Plans | Review Definition Phase Plans | 104 | | 4.4.3.3 | Gather Information on Definition Phase Status | Gather Information on Definition Phase Status | 104 | | 4.4.3.4 | Verify Information on Definition Phase Status | Verify Information on Definition Phase Status | 105 | | 4.4.3.4.1 | 4.4.3.4.1 | Review Documents | 105 | | 4.4.3.4.2 | 4.4.3.4.2 | Interview Key Participants | 106 | | 4.4.4 Customize Audit Objectives | 4.4.4 Customize Audit

Guide to Auditing for Controls and Security_ A System Development Life Cycle Approach


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Physical Protection?

[Assistant]
According to Guidelines for Media Sanitization:

ontaining sensitive data that leave an organization without effective sanitization expose a significant vulnerability to 'dumpster divers' and overcurious employees. - Information storage media (ISM).
ISM commonly 2 takes the form of:
- o Devices that contain bits and bytes, such as hard disk drives (HDDs), solid state drives (SSDs), random access memory (RAM), read-only memory (ROM), optical disks, magnetic tape, flash memory, memory devices, phones, mobile computing devices, networking devices, and office equipment
- o Systems that provide 'virtual' or 'logical' storage that abstracts the underlying electronic media (e.g., cloud storage, object storage)

Some types of ISM can contain more physical storage than the user addressable capacity (e.g., overprovisioning) for endurance and performance purposes. For example, an ISM can have 1024 GB of total physical capacity but only 900 GB of available capacity (i.e., user accessible storage). If the ISM implements data reduction techniques (e.g., data compression) internally, it is also possible for the user-addressable capacity to exceed the total physical capacity. In either case, user data may be stored on the full 1024 GB because of the mechanisms in the ISM, and the entire contents should be sanitized.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for Incident Response?

[Assistant]
According to Protecting Controlled Unclassified Information (CUI)_ NIST Special Publication 800-171, Revision 3. Small Business Primer:

| Access Control                    | Maintenance         | Security Assessment and Monitoring   |
|-----------------------------------|---------------------|--------------------------------------|
| Awareness and Training            | Media Protection    | System and Communications Protection |
| Audit and Accountability          | Personnel Security  | System and Information Integrity     |
| Configuration Management          | Physical Protection | Planning                             |
| Identification and Authentication | Risk Assessment     | System and Services Acquisition      |
| Incident Response                 |                     | Supply Chain Risk Management         |

Below is an example of the Incident Response Testing requirement, which is part of the Incident Response (IR) family. The structure and content of a typical security requirement includes:

## Family: Incident Response

Protecting Controlled Unclassified Information (CUI)_ NIST Special Publication 800-171, Revision 3. Small Business Primer


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Configuration Management?

[Assistant]
According to Cryptographic Module Validation Program (CMVP) Security Policy Requirements_ CMVP Validation Authority Updates to ISO_IEC 24759 and ISO_IEC 19790 Anne:

- Illustrative diagram, schematic, or photograph of the module. A photograph included for hardware modules. If the security policy encompasses multiple versions of the module, each version is represented separately or annotated that the representation is illustrated for all versions. For a software or , firmware, hybrid, or sub-chip cryptographic module, the security policy includes a block diagram that illustrates:
- o The location of the logical object of the software or firmware module with respect to the operating system, other supporting applications, and the cryptographic boundary so that all of the logical and physical layers between the logical object and the cryptographic boundary are clearly defined and
- o The interactions of the logical object of the software or firmware module with the operating system and other supporting applications resident within the cryptographic boundary. - o Tested Operational Environment's Physical Perimeter (TOEPP) - The location of the cryptographic module with respect to the TOEPP that is part of the module's tested configuration but may be outside of the module's cryptographic boundary so that all of the logical and physical layers between the cryptographic module and the TOEPP are clearly defined. This also includes a description and components list of the TOEPP. - Precise definition of the module's physical TOEPP and cryptographic boundariesy

In addition to ISO/IEC 24759 Section 6.14 and ISO/IEC 19790 Annex B, other publications and documents specify the documentation requirements for the security policy. Many of these requirements relate to the specific conditions and configurations of modules and would not be applicable in many cases. These additional requirements are listed for each section of the security policy, grouped by the source publication or document, and reference the specific section from the document where the requirement is stated.

Cryptographic Module Validation Program (CMVP) Security Policy Requirements_ CMVP Validation Authority Updates to ISO_IEC 24759 and ISO_IEC 19790 Anne


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 1 require for System and Communications Protection?

[Assistant]
According to Summary Report for “Workshop on Updating Manufacturer Guidance for Securable Connected Product Development”:

Security is a collective responsibility involving manufacturers, integrators, and asset owners and operators. CISA helps clarify security roles and ensures all parties uphold their responsibilities. The key component of secure by design is seeing where manufacturers can embed cyber security from the start to make it more difficult or impossible for an integrator or asset owner to open a cyber security risk. Current US critical infrastructure contains legacy systems without security functionality that inherently complicate adding security today. Infrastructure improvement options include the present 'Bubble Boy' method, which segments all traffic, ta rgeted improvements, and the 'rip and replace' method. Secure operational technology (OT) devices need to be available to provide that defense in depth, so that any failures in segmentation do not result in total data protection. It emphasizes open standards and autonomy at the asset and operator level. Resilience features should resemble those in the enterprise space, including secure compromise. Secure-by-design for OT considers threat categories like vulnerability handling and communications, resilience, logging, and end-device capabilities. Instead, participants recommended that the government could provide top-level support for broader cybersecurity objectives, integrating planning approaches to navigate the complexities of different sectors. Tools like effective consumer education awareness campaigns may drive better security practices to ensure consumers are well-informed about cybersecurity measures as they evolve. Participants agreed that one key aspect of government involvement is effective communication, which the participants agreed should be action-based messages directed at consumers. For example, simplifying communication and facilitating customer outreach are ways to promote awareness and understanding of cybersecurity practices.

Summary Report for “Workshop on Updating Manufacturer Guidance for Securable Connected Product Development”


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Federal Cybersecurity Awareness Programs_ A Mixed Methods Research Study provide? (Part 6)

[Assistant]
............................................................ 4            | 2.2 SURVEY METHODOLOGY .....................................................................................................
4            |
| 2.2.1                                                                                | Survey Design                                                                                | ............................................................................................................. 4                           |
| 2.2.2                                                                                | Survey Recruitment ..................................................................................................... | 5                                                                                |
| 2.2.3                                                                                | Survey Data Collection............................................................................................... | 6                                                                                |
| 2.2.4                                                                                | Survey Data Analysis ..................................................................................................

Federal Cybersecurity Awareness Programs_ A Mixed Methods Research Study


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Guide to Auditing for Controls and Security_ A System Development Life Cycle Approach provide? (Part 3)

[Assistant]
n activities; provides scientific and technological advisory services and assistance to Federal agencies; and provides the technical foundation for computer-related policies of the Federal Government.
The Institute consists of the following divisions:

## The Institute for Materials Science and Engineering

Conducts research and provides measurements, data, standards, reference materials, quantitative understanding and other technical information fundamental to the processing, structure, properties and performance of materials; addresses the scientific basis for new advanced materials technologies; plans research around cross-cutting scientific themes such as nondestructive evaluation and phase diagram development; oversees Bureau-wide technical programs in nuclear reactor radiation research and nondestructive evaluation; and broadly disseminates generic technical information resulting from its programs. The Institute consists of the following Divisions:

'Headquarters and Laboratories at Gaithersburg, MD, unless otherwise noted; mailing address Gaithersburg, MD 20899. ^Some divisions within the center are located at Boulder, CO 80303. ^Located at Boulder, CO, with some elements at Gaithersburg, MD

- Basic Standards^
- Radiation Research
- Chemical Physics
- Analytical Chemistry
- Applied Mathematics
- Electronics and Electrical Engineering^
- Manufacturing Engineering
- Building Technology
- Fire Research
- Chemical Engineering^
- Information Systems Engineering
- Systems and Software Technology
- Computer Security
- Systems and Network Architecture
- Advanced Computer Systems
- Ceramics
- Fracture and Deformation^
- Polymers
- Metallurgy
- Reactor Radiation

## Computer Science and Technology

NBS Special Publication 500-153

## Guide to Auditing for Controls and Security: A System Development Life Cycle Approach

Editors/Authors:

Zella G. Ruthberg

Bonnie T. Fisher

William E' Perry

John W. Lainhart SV

James G. Cox

'

Mark Gillen

Douglas B.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice CM.L2-3.4.3 (NIST 3.4.3)?

[Assistant]
According to Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171:

3.4.3e Employ automated discovery and management tools to maintain an up-to-date, complete, accurate, and readily available inventory of system components. 3.4.3. 3.4.3e | Employ automated discovery and management tools to maintain an up-to-date, complete, accurate, and readily available inventory of system components.

Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 2 require for Audit and Accountability?

[Assistant]
According to Assessing Security Requirements for Controlled Unclassified Information:

- System development life cycle responsibilities (e.g., program managers, mission/business owners, information owners/stewards, system designers and developers, system/security engineers, systems integrators)
- Acquisition or procurement responsibilities (e.g., contracting officers)
- System, security, or risk management and oversight responsibilities (e.g., authorizing officials, chief information officers, chief information security officers, system owners, information security managers)
- Security assessment and monitoring responsibilities (e.g., auditors, system evaluators, assessors, independent verifiers/validators, analysts)

| Access Control                    | Maintenance         | Security Assessment and Monitoring   |
|-----------------------------------|---------------------|--------------------------------------|
| Awareness and Training            | Media Protection    | System and Communications Protection |
| Audit and Accountability          | Personnel Security  | System and Information Integrity     |
| Configuration Management          | Physical Protection | Planning                             |
| Identification and Authentication | Risk Assessment     | System and Services Acquisition      |
| Incident Response                 |                     | Supply Chain Risk Management         |

[SELECT FROM: access control policy and procedures; procedures for least privilege; list of system-generated privileged accounts; list of system administration personnel; system audit records; system configuration settings; system security plan; list of system-generated security functions or security-relevant information assigned to system accounts or roles; other relevant documents or records]

Assessing Security Requirements for Controlled Unclassified Information


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 1 require for System and Services Acquisition?

[Assistant]
According to IoT Device Cybersecurity Capability Core Baseline:

259 and this publication have manufacturers as the intended audience, the considerations and capabilities discussed across the two publications can be used by manufacturers, integrators, or consumers.
For more information on how these capabilities can be incorporated into a manufacturer's development processes, see NISTIR 8259. Other organizations can use the core baseline in the context that is available and appropriate to them.

IoT Device Cybersecurity Capability Core Baseline


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AT.L2-3.2.2 (NIST 3.2.2)?

[Assistant]
According to Federal Cybersecurity Awareness Programs_ A Mixed Methods Research Study:

3.2.2                                                                                | Organization Size... 3.2.2 Organization Size

Organization size was determined by the number of federal employees.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Security Assessment?

[Assistant]
According to Control Baselines for Information Systems and Organizations:

| CONTROL NUMBER   | CONTROL NAME CONTROL ENHANCEMENT NAME                 | PRIVACY CONTROL BASELINE   | SECURITY CONTROL BASELINES   | SECURITY CONTROL BASELINES   | SECURITY CONTROL BASELINES   |
|------------------|-------------------------------------------------------|----------------------------|------------------------------|------------------------------|------------------------------|
| CONTROL NUMBER   | CONTROL NAME CONTROL ENHANCEMENT NAME                 | PRIVACY CONTROL BASELINE   | LOW                          | MOD                          | HIGH                         |
| CA-1             | Policy and Procedures                                 | x                          | x                            | x                            | x                            |
| CA-2             | Control Assessments                                   | x                          | x                            | x                            | x                            |
| CA-2(1)          | INDEPENDENT ASSESSORS                                 |                            |                              | x                            | x                            |
| CA-2(2)          | SPECIALIZED ASSESSMENTS                               |                            |                              |                              | x                            |
| CA-2(3)          | LEVERAGING RESULTS FROM EXTERNAL ORGANIZATIONS        |                            |                              |                              |                              |
| CA-3             | Information Exchange                                  |                            | x                            | x                            | x                            |
| CA-3(1)          | UNCLASSIFIED NATIONAL SECURITY SYSTEM CONNECTIONS     | W: Moved to SC-7(25). | W: Moved to SC-7(25). | W: Moved to SC-7(25). | W: Moved to SC-7(25).


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Planning?

[Assistant]
According to Recommendation for Pair-Wise Key-Establishment Schemes Using Discrete Logarithm Cryptography:

There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may  be  used  by  federal  agencies  even  before  the  completion  of  such  companion  publications.  Thus,  until  each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning  and  transition  purposes,  federal  agencies  may  wish  to  closely  follow  the  development  of  these  new publications by NIST.

Recommendation for Pair-Wise Key-Establishment Schemes Using Discrete Logarithm Cryptography


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Physical Protection?

[Assistant]
According to Guide to Malware Incident Prevention and Handling for Desktops and Laptops:

hosts. Because of the potential need for extensive eradication efforts, organizations should be prepared to use various combinations of eradication techniques simultaneously for different situations.
Organizations should also consider performing awareness activities that set expectations for eradication and recovery efforts; these activities can be helpful in reducing the stress that major malware incidents can cause. -  Recovery. The two main aspects of recovery from malware incidents are restoring the functionality and data of infected hosts and removing temporary containment measures. Organizations should carefully consider possible worst-case scenarios and determine how recovery should be performed, including rebuilding compromised hosts from scratch or known good backups. Determining when to remove temporary containment measures, such as suspension of services or connectivity, is often a difficult decision during major malware incidents. Incident response teams should strive to keep containment measures in place until the estimated number of infected hosts and hosts vulnerable to infection is sufficiently low that subsequent incidents should be of little consequence. However, even though the incident response team should assess the risks of restoring services or connectivity, management ultimately should be responsible for determining what should be done based on the incident response team's recommendations and management's understanding of the business impact of maintaining the containment measures. -  Post-Incident Activity. Because the handling of malware incidents can be extremely expensive, it is particularly important for organizations to conduct a robust assessment of lessons learned after major malware incidents to prevent similar incidents from occurring.

Guide to Malware Incident Prevention and Handling for Desktops and Laptops


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Incident Response?

[Assistant]
According to Proceedings of the Cybersecurity in Cyber-Physical Systems Workshop, April 23-24, 2012:

An attacker may develop Stuxnet-like malware [2], featuring  zero-day  exploits,  rootkits,  anti-virus  evasion  techniques, and  process  injection  and  hooking  code,  to  target  a  specific process step within the entire chip manufacturing process. Industrial control systems (ICS) are rapidly becoming a new major target of cyber-criminals. This was pointed out in multiple  occasions by security experts [1],  [2]  and  was  confirmed by a recent survey carried out by Symantec [3]. In this survey, 53%  of  the  1580  critical  infrastructure  companies  that  were interviewed admitted to having been targeted by cyber attacks. On average, the surveyed companies admitted to having been attacked 10 times in the last 5 years, with each of these attacks having an average cost of 850k USD. The survey provides a basis for a quantitative estimate of the extent of the problem and implies  that  the  incidents  reported  by  the  press  over  the last  several  years  are  nothing  but  the  tip  of  a  considerably larger problem: the vast majority of incidents have never been disclosed. Still, the details of the publicly disclosed incidents give  us  a  better  understanding  of  the  underlying  issues  we face. For  instance,  a  recently  discovered  malware  variant called Stuxnet which has been analyzed at length by Symantec [4]  was  shown  to  be  part  of  a  highly  sophisticated  targeted attack aiming at tampering with devices involved in the control  of  high  speed  engines,  and  compromise  the  associated industrial process [5]. The infection was only uncovered accidentally  when  an  operational  anomaly  was  discovered  Stuxnet has probably been operating undetected since June of 2009 [6]. Stuxnet, and other related threats discovered recently [7], show that industrial control systems are evolving, bringing powerful  capabilities  into  the  critical  infrastructure  environment along with new and yet undiscovered threats.

Proceedings of the Cybersecurity in Cyber-Physical Systems Workshop, April 23-24, 2012


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Summary Report for “Workshop on Updating Manufacturer Guidance for Securable Connected Product Development” provide? (Part 8)

[Assistant] Table 2 - Agenda for the Workshop | Time | Title | Speaker(s)/Facilitators | |-------------------|--------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------| | 9:00AM - 9:15AM | Welcome, Agenda, Goals for the day | Michael Fagan, NIST | | 9:15AM - 9:55AM | Building More Secure Devices Using Threat Modeling with MITRE EMB3D | David Keppler, Senior Principal Cybersecurity Engineer, MITRE Jack Cyprus, Cybersecurity Engineer, MITRE | | 9:55AM - 10:35AM | Secure by Design considerations for OT | Matthew Rogers, Industrial Control System (ICS) Expert, CISA | | 10:35AM - 11:15AM | Life in Maintenance Mode: What it means to keep connected devices secure | Stacey Higginbotham, Policy Fellow at Consumer Reports | | 11:15AM - 11:55AM | Getting Smart: An Overview of IoT Privacy | Dylan Gilbert, Privacy Policy Advisor, NIST | | 11:55AM - 12:00PM | Closing of the Morning Hybrid Session | Michael Fagan, NIST | | 12:00PM - 1:00PM | Break | Break | | 1:00PM - 2:00PM | Discussion Session 1 - NIST IR 8259 Post-Market Activities update | Greg Witte, Palydin, Facilitator | | 2:00PM - 2:15PM | Break | Break | | 2:15PM - 3:15PM | Discussion Session 2 - NIST IR 8259 Pre-Market Activities | Christine Abruzzi, Cacapon

Audit and Accountability
System and Information Integrity
Security Assessment
Media Protection
Identification and Authentication
Awareness and Training
System and Communications Protection
Access Control
Planning
Incident Response
Risk Assessment
Personnel Security
System and Services Acquisition
Maintenance
Physical Protection
Configuration Management


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Planning?

[Assistant]
According to Guide for Developing Security Plans for Federal Information Systems:

|
| 1.3 ORGANIZATION OF DOCUMENT..................................................................................................
| 1                                                                                |
| 1.4 SYSTEMS INVENTORY AND FEDERAL INFORMATION PROCESSING STANDARDS (FIPS 199)                                                              | ...... 2                                                                                |
| 1.5 MAJOR APPLICATIONS, GENERAL SUPPORT SYSTEMS, AND MINOR APPLICATIONS                                                                    | .................. 2                                                                                |
| 1.6 OTHER RELATED NIST PUBLICATIONS ..................................................................................... | 3                                                                                |
| 1.7 SYSTEM SECURITY PLAN RESPONSIBILITIES .............................................................................. | 3                                                                                |
| 1.7.1 Chief Information Officer ................................................................................................ | 4                                                                                |
| 1.7.2 Information System Owner                                                                                | ...............................................................................................

Guide for Developing Security Plans for Federal Information Systems


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AT.L2-3.2.4 (NIST 3.2.4)?

[Assistant]
According to Assessing Security and Privacy Controls in Information Systems and Organizations:

3.2.4   DEVELOP ASSESSMENT PROCEDURES FOR ORGANIZATION-SPECIFIC CONTROLS

Based on organizational policies, mission or business function requirements, and an assessment
of risk, organizations may choose to develop and implement additional (organization-specific)
controls or control enhancements for their systems that are beyond the scope of [SP 800-53].

Assessing Security and Privacy Controls in Information Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Communications Protection?

[Assistant]
According to Guide to Auditing for Controls and Security_ A System Development Life Cycle Approach:

he development of software could be discussed, identified a Development Phase including four stages -definition, design, programming, and testing. These are represented by Phases II-V described above.
During the Development Phase the requirements for software are determined and the software is then defined, specified, programmed, and tested. Documentation is prepared within this phase to provide an adequate record of the technical information developed. The PCIE Work Group's phases are intended to cover not only softwcu-e but also hardware, telecommunications, etc., i.e., all the components of an automated information system


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What guidance does Cryptographic Module Validation Program (CMVP)-Approved Sensitive Security Parameter Generation and Establishment Methods_ CMVP Validation Authority U provide?

[Assistant]
<!-- image -->

## NIST Special Publication NIST SP 800-140Dr2

## Cryptographic Module Validation Program (CMVP)-Approved Sensitive Security Parameter Generation and Establishment Methods:

CMVP Validation Authority Updates to ISO/IEC 24759

Alexander Calis

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-140Dr2

<!-- image -->

## NIST Special Publication NIST SP 800-140Dr2

## Cryptographic Module Validation Program (CMVP)-Approved Sensitive Security Parameter Generation and Establishment Methods:

CMVP Validation Authority Updates to ISO/IEC 24759

Alexander Calis

Computer Security Division Information Technology Laboratory

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-140Dr2

July 2023

<!-- image -->

U.S. Department of Commerce Gina M. Raimondo, Secretary

National Institute of Standards and Technology

Certain commercial equipment, instruments, software, or materials, commercial or non-commercial, are identified in this paper in order to specify the experimental procedure adequately. Such identification does not imply recommendation or endorsement of any product or service by NIST, nor does it imply that the materials or equipment identified are necessarily the best available for the purpose. There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may be used by federal agencies even before the completion of such companion publications. Thus, until each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning and transition purposes, federal agencies may wish to closely follow the development of these new publications by NIST.

Cryptographic Module Validation Program (CMVP)-Approved Sensitive Security Parameter Generation and Establishment Methods_ CMVP Validation Authority U


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Maintenance?

[Assistant]
According to Recommendation for Pair-Wise Key-Establishment Using Integer Factorization Cryptography:

yland), NIST Special Publication (SP) 800-56C, Rev. 1, April 2018. https://doi.org/10.6028/NIST.SP.800-56Cr1
- [SP 800-57] Barker  EB  (2016) Recommendation  for  Key  Management,  Part  1:  General .
(National Institute of Standards and Technology, Gaithersburg, Maryland), NIST Special Publication (SP) 800-57 Part 1, Rev. 4, January 2016. https://doi.org/10.6028/NIST.SP.800-57pt1r4
- [SP 800-89] Barker EB (2006) Recommendation for Obtaining Assurances for Digital Signature Applications . (National  Institute  of  Standards  and  Technology,  Gaithersburg, Maryland), NIST Special Publication (SP) 800-89, November 2006. https://doi.org/10.6028/NIST.SP.800-89

Recommendation for Pair-Wise Key-Establishment Using Integer Factorization Cryptography