[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Assessing Security and Privacy Controls in Information Systems and Organizations provide? (Part 7)

[Assistant]
dell Piez for their contribution to the development of the SP 800-53A assessment
tables (both electronic sources, and derivative publications) using Open Security Controls
Assessment Language (OSCAL).
The authors also wish to recognize the professional staff from
the NIST Computer Security Division and Applied Cybersecurity Division, and the representatives
from the Federal Chief Information Officer (CIO) Council, Federal Chief Information Security
Officer (CISO) Council, and Federal Privacy Council for their ongoing contributions in helping to
improve the content of the publication. Finally, the authors gratefully acknowledge the
contributions from individuals and organizations in the public and private sectors, both
nationally and internationally, whose insightful and constructive comments improved the
overall quality, thoroughness, and usefulness of this publication. T
h
s

i

p
u
b

l
i

c
a

t
i

o
n

i

s

HISTORICAL CONTRIBUTIONS TO NIST SPECIAL PUBLICATION 800-53A

a
v
a

i
l

l

a
b
e
f
r
e
e
o
f

c
h
a
r
g
e
f
r
o
m

:

h
t
t
p
s
:
/
/
d
o
i
. o
r
g
/
1
0
. 6
0
2
8
/
N
S
T
S
P
. 8
0
0
-
5
3
A
r
5

. I

The authors wanted to acknowledge the many individuals who contributed to previous versions of Special
Publication 800-53A since its inception in 2005.

Assessing Security and Privacy Controls in Information Systems and Organizations

Audit and Accountability
System and Information Integrity
Security Assessment
Media Protection
Identification and Authentication
Awareness and Training
System and Communications Protection
Access Control
Planning
Incident Response
Risk Assessment
Personnel Security
System and Services Acquisition
Supply Chain Risk Management
Maintenance
Physical Protection
Configuration Management


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Information Integrity?

[Assistant]
According to Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations:

Organizations are concerned about the risks associated with products and services that may potentially contain malicious functionality, are counterfeit, or are vulnerable due to poor manufacturing and development practices within the supply chain. These risks are associated with an enterprise's decreased visibility into and understanding of how the technology they acquire is developed, integrated, and deployed or the processes, procedures, standards, and practices used to ensure the security, resilience, reliability, safety, integrity, and quality of the products and services. | 3.4.3. Enhancing Practices....................................................................................................................49      |                                                                                |
|-------------------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------|
| 3.5.1. Measuring C-SCRM Through Performance Measures................................................................52                                |                                                                                |
| References.........................................................................................................................................57 |                                                                                |
| Appendix A. C-SCRM Security Controls............................................................................................... | 63                                                                                |
| A.1.1.

Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Services Acquisition?

[Assistant]
According to Recommendations for Federal Vulnerability Disclosure Guidelines:

There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may be used by federal agencies even before the completion of such companion publications. Thus, until each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning and transition purposes, federal agencies may wish to closely follow the development of these new publications by NIST. The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the Nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology. ITL's responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in federal information systems. The Special Publication 800-series reports on ITL's research, guidelines, and outreach efforts in information system security, and its collaborative activities with industry, government, and academic organizations. | Executive Summary................................................................................................................. | Executive Summary................................................................................................................. | Executive Summary.................................................................................................................

Recommendations for Federal Vulnerability Disclosure Guidelines


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AT.L2-3.2.5 (NIST 3.2.5)?

[Assistant]
According to Assessing Security and Privacy Controls in Information Systems and Organizations:

3.2.5   OPTIMIZE SELECTED ASSESSMENT PROCEDURES TO ENSURE MAXIMUM EFFICIENCY

Assessors have flexibility in organizing assessment plans that meet the needs of the organization
and that provide the best opportunity for obtaining the necessary evidence to determine
security or privacy control effectiveness while reducing overall assessment costs. 3.2.5.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Federal Cybersecurity Role-Based Training Approaches, Successes, and Challenges provide? (Part 2)

[Assistant]
Such identification is not intended to imply recommendation or endorsement by the National Institute of Standards and Technology, nor is it intended to imply that the entities, materials, or equipment are necessarily the best available for the purpose. ## NISTGLYPH<c=2,font=/BAAAAA+HKGrotesk-SemiBold> TechnicalGLYPH<c=2,font=/BAAAAA+HKGrotesk-SemiBold> SeriesGLYPH<c=2,font=/BAAAAA+HKGrotesk-SemiBold> PoliciesGLYPH<c=2,font=/BAAAAA+HKGrotesk-SemiBold>

Copyright, Fair Use, and Licensing Statements Technical Series Publication Identiifier Syntax

## PublicationGLYPH<c=2,font=/BAAAAA+HKGrotesk-SemiBold> HistoryGLYPH<c=2,font=/BAAAAA+HKGrotesk-SemiBold>

Approved by the NIST Editorial Review Board on: 2023-01-03

## How to cite this NIST Technical Series PublicationGLYPH<c=2,font=/BAAAAA+HKGrotesk-SemiBold>

Haney, JM, Jacobs, JL, Furman, SM (2023) Federal Cybersecurity Role-Based Training Approaches, Successes, and Challenges (National Institute of Standards and Technology Gaithers b urg, MD) NIST Special Publication (SP) 1288. https://doi.org/10.6028/NIST.SP.1288

## NISTGLYPH<c=2,font=/BAAAAA+HKGrotesk-SemiBold> AuthorGLYPH<c=2,font=/BAAAAA+HKGrotesk-SemiBold> ORCIDGLYPH<c=2,font=/BAAAAA+HKGrotesk-SemiBold> iDsGLYPH<c=2,font=/BAAAAA+HKGrotesk-SemiBold>

Julie Haney: 0000-0002-6017-9693 Jody Jacobs: 0000-0002-6433-884X Susanne Furman: 0000-0002-7013-6603

## Contact Information

usability@nist.gov

<!-- image -->

## ABSTRACTGLYPH<c=2,font=/EAAAAA+HKGrotesk-Bold>

Most United States federal government organizations are required to conduct cybersecurity role-based training for federal government personnel and supporting contractors who are assigned roles having security and privacy responsibilities.

Federal Cybersecurity Role-Based Training Approaches, Successes, and Challenges


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Security Assessment?

[Assistant]
According to Audit and Evaluation of Computer Security:

UDIT AND EVALUATION
OF COMPUTER SECURITY

Standards Application and Analysis —• Electronic Technology — Center for Consumer Product Technology: Product
Systems Analysis; Product Engineering — Center for Building Technology; Structures, Materials, and Safety; Building
Environment; Technical Evaluation and Application — Center for Fire Research: Fire Science; Fire Safety Engineering.
THE INSTITUTE FOR COMPUTER SCIENCES AND TECHNOLOGY conducts research and provides technical services
designed to aid Government agencies in improving cost effectiveness in the conduct of their programs through the selection,
acquisition, and effective utilization of automatic data processing equipment: and serves as the principal focus wthin the exec-
utive branch for the development of Federal standards for automatic data processing equipment, techniques, and computer
languages. The Institute consist of the following divisions:

Audit and Evaluation
of Computer Security ^

Audit and Evaluation of Computer Security


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for Security Assessment?

[Assistant]
According to Protecting Controlled Unclassified Information (CUI)_ NIST Special Publication 800-171, Revision 3. Small Business Primer:

| Access Control                    | Maintenance         | Security Assessment and Monitoring   |
|-----------------------------------|---------------------|--------------------------------------|
| Awareness and Training            | Media Protection    | System and Communications Protection |
| Audit and Accountability          | Personnel Security  | System and Information Integrity     |
| Configuration Management          | Physical Protection | Planning                             |
| Identification and Authentication | Risk Assessment     | System and Services Acquisition      |
| Incident Response                 |                     | Supply Chain Risk Management         |

Below is an example of the Incident Response Testing requirement, which is part of the Incident Response (IR) family. The structure and content of a typical security requirement includes:

ODPs support consistent security assessments in determining whether security requirements have been satisfied. If a federal agency or a consortium of agencies do not specify a particular value or range of values for an ODP, nonfederal organizations must assign the value or values to complete the security requirement.

Protecting Controlled Unclassified Information (CUI)_ NIST Special Publication 800-171, Revision 3. Small Business Primer


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Security Assessment?

[Assistant]
According to Assessing Security and Privacy Controls in Information Systems and Organizations:

NTROL ASSESSMENTS ..................................................... 30
3.4   ANALYZE ASSESSMENT REPORT RESULTS .....................................................................................
32
3.5   ASSESS SECURITY AND PRIVACY CAPABILITIES .............................................................................. 34
CHAPTER FOUR SECURITY AND PRIVACY ASSESSMENT PROCEDURES ................................................. 37
4.1   ACCESS CONTROL............................................................................................................................ 40
4.2   AWARENESS AND TRAINING ........................................................................................................ 118
4.3   AUDIT AND ACCOUNTABILITY ...................................................................................................... 128
4.4   ASSESSMENT, AUTHORIZATION, AND MONITORING ................................................................. 160
4.5   CONFIGURATION MANAGEMENT ................................................................................................ 177
4.6   CONTINGENCY PLANNING ............................................................................................................ 215
4.7   IDENTIFICATION AND AUTHENTICATION .................................................................................... 243
4.8   INCIDENT RESPONSE ............................................................................................................... 275
4.9   MAINTENANCE ........................................................................................................................ 298
4.10   MEDIA PROTECTION .............................................................................................................. 316
4.11   PHYSICAL AND ENVIRONMENTAL PROTECTION .......................................................................


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Maintenance?

[Assistant]
According to Guide for Developing Security Plans for Federal Information Systems:

.................................................................... 41    | APPENDIX C: REFERENCES.....................................................................................................
41    |

The information system owner 6 is the agency official responsible for the overall procurement, development, integration, modification, or operation and maintenance of the information system. The information system owner has the following responsibilities related to system security plans:

Guide for Developing Security Plans for Federal Information Systems


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Risk Assessment?

[Assistant]
According to Strategies for the Integration of Software Supply Chain Security in DevSecOps CI_CD Pipelines:

.............................9      |
| 3.1.5. Types of Exploits.........................................................................................................................10   |
| 3.2.1.
Baseline Security ........................................................................................................................11   |
| 3.2.2. Controls for Interacting With SCM Systems...............................................................................12                     |
| 4. CI/CD Pipelines -Background, Security Goals, and Entities to be Trusted .....................................13                                    |
| 5. Integrating SSC Security Into CI/CD Pipelines.................................................................................15                   |
| 5.1.1. Secure Build................................................................................................................................16 |
| 5.1.2. Secure Pull-Push Operations on Repositories............................................................................17                      |
| 5.1.3. Integrity of Evidence Generation During Software Updates......................................................18                               |
| 5.1.4. Secure Code Commits ................................................................................................................19         |

Strategies for the Integration of Software Supply Chain Security in DevSecOps CI_CD Pipelines


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 2 require for Incident Response?

[Assistant]
According to Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations:

......................98      |
| Table 11. Maintenance (MA) ......................................................................................................................98      |
| Table 12.
Media Protection (MP)................................................................................................................99        |
| Table 13. Physical and Environmental Protection (PE)...............................................................................99                    |
| Table 14. Planning (PL)..............................................................................................................................100 |
| Table 15. Program Management (PM) .....................................................................................................100               |
| Table 16. Personnel Security (PS) .............................................................................................................101       |
| Table 17. PII Processing and Transparency (PT) .......................................................................................102                |
| Table 18. Risk Assessment (RA) ................................................................................................................102       |
| Table 19. System and Services Acquisition (SA)........................................................................................103                |
| Table 20. System and Communications Protection (SC)...........................................................................103                        |
| Table 21. System and Information Integrity (SI) .......................................................................................104               |
| Table 22. Supply Chain Risk Management (SR).........................................................................................105                  |
| Table 23.

Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Summary of NIST SP 800-53, Revision 4_ Security and Privacy Controls for Federal Information Systems and Organizations provide? (Part 10)

[Assistant]
parameters that organizations define, providing them with the ability to tailor security controls based on specific security requirements, environments of operation, and organizational risk tolerance.
Parameters assigned and/or selected by organizations for a given base control also apply to all control enhancements associated with that control. The first security control in each family (referred to as the dash-1control) addresses policies and procedures needed for effective implementation of all the other controls within each family. Therefore, requirements to develop policies and procedures are not repeated in individual controls. Many security controls and enhancements include supplemental guidance. The supplemental guidance provides additional information about a control or enhancement to help organizations define, develop, and/or implement security controls but does not include any additional requirements. SP 800-53 Rev. 4 includes many changes from SP 800-53 Rev. 3 - 295 controls and control enhancements were added while approximately 100 controls and control enhancements were withdrawn or incorporated into others. Of the eighteen security control families in SP 800-53 Rev. 4, seventeen families are described in the security control catalog in Appendix F, and are closely aligned with the seventeen minimum security requirements for federal information and information systems in FIPS Publication 200, Minimum Security Requirements for Federal Information and Information Systems . One additional family, the Program Management (PM) family, provides controls for information security programs themselves. This family is described in Appendix G of SP 800-53 Rev. 4. While it is not specifically referenced in FIPS 200, the PM section provides security controls at the organization level rather than the information system level. The PM controls are typically implemented at the organization level and not directed at individual organizational information systems.

Summary of NIST SP 800-53, Revision 4_ Security and Privacy Controls for Federal Information Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Supply Chain Risk Management?

[Assistant]
According to Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule_ A Cybersecurity Resource Guide:

Covered entities need to be cognizant of differentiating between best practices versus what the Security Rule requires. Vendor management and supply chain risks are important topics due to the potential they have to introduce new threats and risks to organizations. However, to the extent that such vendors and service providers are business associates, HIPAA treats them the same as covered entities with respect to Security Rule compliance. Covered entities and business associates are required to obtain written satisfactory assurances that PHI will be protected. Covered entities and business associates are permitted to require more of their business associates and even include more stringent cybersecurity requirements in a business associate agreement (BAA). These requirements would need to be agreed upon by both the covered entity and the business associate.

Covered entities need to be cognizant of differentiating between best practices versus what the Security Rule requires. Vendor management and supply chain risks are important topics due to the potential they have to introduce new threats and risks to organizations. To the extent that such vendors and service providers are business associates, HIPAA treats them the same as covered entities with respect to Security Rule compliance. Covered entities and business associates are required to obtain written satisfactory assurances from business associates that PHI will be protected. Covered entities and business associates are permitted to require more of their business associates and even include more stringent cybersecurity requirements in a BAA. These requirements would need to be agreed upon by both the covered entity and the business associate.

Health Industry Cybersecurity Supply Chain Risk Management

Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule_ A Cybersecurity Resource Guide


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 2 require for Audit and Accountability?

[Assistant]
According to Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations:

...................95          |
| Table 6. Assessment, Authorization, and Monitoring (CA).........................................................................95                       |
| Table 7.
Configuration Management (CM).................................................................................................96                |
| Table 8. Contingency Planning (CP) ............................................................................................................96        |
| Table 9. Identification and Authentication (IA) ..........................................................................................97             |
| Table 10. Incident Response (IR).................................................................................................................98      |
| Table 11. Maintenance (MA) ......................................................................................................................98      |
| Table 12. Media Protection (MP)................................................................................................................99        |
| Table 13. Physical and Environmental Protection (PE)...............................................................................99                    |
| Table 14. Planning (PL)..............................................................................................................................100 |
| Table 15. Program Management (PM) .....................................................................................................100               |
| Table 16. Personnel Security (PS) .............................................................................................................101       |
| Table 17. PII Processing and Transparency (PT) .......................................................................................102                |
| Table 18.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Physical Protection?

[Assistant]
According to High-Performance Computing Security_ Architecture, Threat Analysis, and Security Posture:

Antwan Clark Laboratory for Physical Sciences

The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the Nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology. ITL's responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in federal information systems. The Special Publication 800-series reports on ITL's research, guidelines, and outreach efforts in information system security, and its collaborative activities with industry, government, and academic organizations. In addition to the management software that installs, boots, configures, and manages HPCrelated systems, HPC application codes rely on several layers of scientific and performanceenhancing libraries. The layers of software that are available to users are referred to as the software stack. The lower layers of this stack are typically focused on performance and include compilers, communication libraries, and user-space interfaces to HPC hardware components. The middle layer includes performance tools, math libraries, and data or computation abstraction layers. The top of the stack consists of end-user science or production applications. Each software product within this stack may require certain versions or variants of other products and have many dependencies. For example, Hierarchical Data Format Version 5 (HDF5) [20] is a scientific data formatting library with only seven dependencies, while Data Mining Classification and Regression Methods (rminer) [21] - an R-based data mining application - has 150 software dependencies.

High-Performance Computing Security_ Architecture, Threat Analysis, and Security Posture


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What guidance does Assessing Security Requirements for Controlled Unclassified Information provide?

[Assistant]
<!-- image -->

## NIST Special Publication 800 NIST SP 800-171Ar3

## Assessing Security Requirements for Controlled Unclassified Information

Ron Ross Victoria Pillitteri

This publication is available free of charge from:

https://doi.org/10.6028/NIST.SP.800-171Ar3

<!-- image -->

## NIST Special Publication

## NIST SP 800-171Ar3

## Assessing Security Requirements for Controlled Unclassified Information

Ron Ross Victoria Pillitteri Computer Security Division

Information Technology Laboratory

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-171Ar3

May 2024

<!-- image -->

U.S. Department of Commerce Gina M. Raimondo, Secretary

National Institute of Standards and Technology

Certain equipment, instruments, software, or materials, commercial or non-commercial, are identified in this paper in order to specify the experimental procedure adequately. Such identification does not imply recommendation or endorsement of any product or service by NIST, nor does it imply that the materials or equipment identified are necessarily the best available for the purpose. There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may be used by federal agencies even before the completion of such companion publications. Thus, until each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning and transition purposes, federal agencies may wish to closely follow the development of these new publications by NIST. to NIST. Many NIST cybersecurity publications, other than the ones noted above, are available at

Organizations are encouraged to review all draft publications during public comment periods and provide feedback https://csrc.nist.gov/publications.

Assessing Security Requirements for Controlled Unclassified Information


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for Planning?

[Assistant]
According to Protecting Controlled Unclassified Information (CUI)_ NIST Special Publication 800-171, Revision 3. Small Business Primer:

| Access Control                    | Maintenance         | Security Assessment and Monitoring   |
|-----------------------------------|---------------------|--------------------------------------|
| Awareness and Training            | Media Protection    | System and Communications Protection |
| Audit and Accountability          | Personnel Security  | System and Information Integrity     |
| Configuration Management          | Physical Protection | Planning                             |
| Identification and Authentication | Risk Assessment     | System and Services Acquisition      |
| Incident Response                 |                     | Supply Chain Risk Management         |

| Identify the role(s) responsible for security and provide the necessary resources. | Whether it is just one person or multiple people within the business, ensure roles, responsibilities, and authorities related to cybersecurity risk management are established, communicated, understood, and enforced. Even if cybersecurity activities are outsourced to an external provider, someone within the business should still be designated to manage cybersecurity risk.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Recommendations for Federal Vulnerability Disclosure Guidelines provide? (Part 4)

[Assistant]
) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the Nation's measurement and standards infrastructure.
ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology. ITL's responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in federal information systems. The Special Publication 800-series reports on ITL's research, guidelines, and outreach efforts in information system security, and its collaborative activities with industry, government, and academic organizations. ## Patent Disclosure Notice

NOTICE: ITL has requested that holders of patent claims whose use may be required for compliance with the guidance or requirements of this publication disclose such patent claims to ITL. However, holders of patents are not obligated to respond to ITL calls for patents and ITL has not undertaken a patent search in order to identify which, if any, patents may apply to this publication. As of the date of publication and following call(s) for the identification of patent claims whose use may be required for compliance with the guidance or requirements of this publication, no such patent claims have been identified to ITL. No representation is made or implied by ITL that licenses are not required to avoid patent infringement in the use of this publication. ## Table of Contents

| Executive Summary................................................................................................................. | Executive Summary.................................................................................................................


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for Identification and Authentication?

[Assistant]
According to Assessing Enhanced Security Requirements for Controlled Unclassified Information:

| ASSESSMENT PROCEDURES................................................................................................................
| 3   |
| 2.2                                                                                | ASSURANCE CASES.............................................................................................................................. | 4   |
| CHAPTER THREE THE PROCEDURES............................................................................................... | CHAPTER THREE THE PROCEDURES............................................................................................... | 7   |
| 3.1                                                                                | ACCESSCONTROL ............................................................................................................................... | 8   |
| 3.2                                                                                | AWARENESSANDTRAINING............................................................................................................... | 9   |
| 3.3                                                                                | AUDIT ANDACCOUNTABILITY........................................................................................................... | 10  |
| 3.4                                                                                | CONFIGURATION MANAGEMENT.....................................................................................................

Assessing Enhanced Security Requirements for Controlled Unclassified Information


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 2 require for Identification and Authentication?

[Assistant]
According to Profile of the IoT Core Baseline for Consumer IoT Products:

issions or access to other product components. - c. Maintain appropriate access control during initial connection (i.e., onboarding) and when reestablishing connectivity after disconnection or outage.
| Vulnerability                                                                                | Relevant Consumer Profile Capabilities                                                                                |
|-------------------------------------------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Mirai Malware Variants Attacks - Use of weak authentication to enable the loading of malware onto the device and use that device in DDOS and other attacks. | Mirai Malware Variants Attacks - Use of weak authentication to enable the loading of malware onto the device and use that device in DDOS and other attacks. |
| Unauthorized access to the IoT device                                                                                | Asset Identification Interface Access Control Information Dissemination Education and Awareness                                                             |
| Malicious code can be loaded on the IoT device                                                                                | Software Update Cybersecurity State Awareness Education and Awareness                                                                                |

Profile of the IoT Core Baseline for Consumer IoT Products


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Risk Assessment?

[Assistant]
According to Summary of NIST SP 800-53, Revision 4_ Security and Privacy Controls for Federal Information Systems and Organizations:

SP 800-53 Revision 4 has been updated to reflect the evolving technology and threat space. Example areas include issues particular to mobile and cloud computing; insider threats; applications security; supply chain risks; advanced persistent threat; and trustworthiness, assurance, and resilience of information systems. The revision also contains a new appendix of privacy controls, and related implementation guidance (Appendix J), based on the Fair Information Practice Principles (FIPPs), a widely accepted framework of defining principles to be used in the evaluation and consideration of systems, processes, or programs that affect individual privacy. The security control baselines address the security needs of a broad and diverse set of constituencies, and are developed based on a number of general assumptions, including common environmental, operational, and functional considerations. The baselines also assume typical threats facing common information systems. Articulating the underlying assumptions is a key element in the initial risk framing step of the risk management process described in NIST SP 800-39. To ensure that an appropriate set of controls is identified to provide security commensurate with risk, organizations tailor the controls to align with specific security needs. Organizations may perform tailoring at the organization level for all information systems, in support of a particular line of business or mission/business process, at the individual information system level, or by using a combination of the above. The tailoring process is comprised of several steps, as described in SP 800-53 Rev. 4 Section 3.2. These actions include:

- Identifying and designating common controls - controls that may be inherited by one or more information systems. If an information system inherits a common control, such as environmental controls within a data center, that system does not need to explicitly implement that control.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Maintenance?

[Assistant]
According to Audit and Evaluation of Computer Security II_ System Vulnerabilities and Controls:

| 3-8       |
| Fig. | 1              | Responsibilities and Duties to Provide Security for Data Processing System ..
| 3-5       |
| PART |                | SESSION 2 ~ MANAGERIAL AND ORGANIZATIONAL VULNERABILITIES AND CONTROLS ~ LINE LEVEL - DATA PROCESSING |           |
|      | IV:            |                                                                                | 4-1       |
|      |                |                                                                                | 4-2       |
| 1. | EDITOR'S       | NOTE INTRODUCTION 4-3                                                                                | 4-3 4-3   |
|      | 1.1 1.2 1.3    | The Charge Intent of Paper                                                                            | 4-3 4-3   |
| 2. | 1.4            | Elements of Discussion Comments                                                                       | 4-4       |
|      | DATA           | PROCESSING ".

Audit and Evaluation of Computer Security II_ System Vulnerabilities and Controls


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Audit and Accountability?

[Assistant]
According to Overview and Considerations of Access Control Based on Attribute Encryption:

tributes for permissions. This means that there is no choice but to trust the key issuer. Such accountability for user secret keys provides fine-grained access without flexibility or scalability [BS].
This makes it unsuitable for certain applications unless it is supported by re-encryption techniques [GOLIC] or integrated with legacy systems such that the key generation system does not manage permission by itself instead of receiving the entitlement data from other system components (e.g., a user permission database so data owners are able to verify such data).

Overview and Considerations of Access Control Based on Attribute Encryption


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Automated Secure Configuration Guidance from the macOS Security Compliance Project (mSCP) provide? (Part 6)

[Assistant]
.................................................................. | Introduction ......................................................................................................................
|
|---------------------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------|
|                                                                                | Purpose and Scope.................................................................................................... | 1                                                                                |
|                                                                                | Audience .................................................................................................................... | 1                                                                                |
|                                                                                | Relevance to NIST SP 800-70 and the National Checklist Program ...........................

Automated Secure Configuration Guidance from the macOS Security Compliance Project (mSCP)


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Guide for Developing Security Plans for Federal Information Systems provide? (Part 4)

[Assistant]
|
| 1.4 SYSTEMS INVENTORY AND FEDERAL INFORMATION PROCESSING STANDARDS (FIPS 199)                                                              | ......
2                                                                                |
| 1.5 MAJOR APPLICATIONS, GENERAL SUPPORT SYSTEMS, AND MINOR APPLICATIONS                                                                    | .................. 2                                                                                |
| 1.6 OTHER RELATED NIST PUBLICATIONS ..................................................................................... | 3                                                                                |
| 1.7 SYSTEM SECURITY PLAN RESPONSIBILITIES .............................................................................. | 3                                                                                |
| 1.7.1 Chief Information Officer ................................................................................................ | 4                                                                                |
| 1.7.2 Information System Owner                                                                                | ............................................................................................... 5                                 |
| 1.7.3 Information Owner                                                                                | ...........................................................................................................


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 2 require for Access Control?

[Assistant]
According to Profile of the IoT Core Baseline for Consumer IoT Products:

minimum, the IoT product component shall:
- a. Use and have access only to interfaces necessary for the IoT product's operation. All other channels and access to channels are removed or secured. - b.
For all interfaces necessary for the IoT product's use, access control measures are in place (e.g., unique password-based multifactor authentication, physical interface ports inaccessible from the outside of a component). - c. For all interfaces, access and modification privileges are limited. 2. Some, but not necessarily all, IoT product components have the means to protect and maintain interface access control. At a minimum, the IoT product shall:
- a. Validate that data shared among IoT product components match specified definitions of format and content. - b. Prevent unauthorized transmissions or access to other product components. - c. Maintain appropriate access control during initial connection (i.e., onboarding) and when reestablishing connectivity after disconnection or outage.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Planning?

[Assistant]
According to Summary of NIST SP 800-53, Revision 4_ Security and Privacy Controls for Federal Information Systems and Organizations:

To aid in review activities, security planning, and risk assessments, organizations document the relevant decisions taken during the security control selection process, providing a sound rationale for those decisions. This documentation is essential when examining the security considerations for organizational information systems with respect to the potential impact on an organization's mission and business.

The resulting tailored baseline set of security controls and the supporting rationale for the selection decisions (including any information system use restrictions required by organizations) are documented in system security plans. Documenting significant risk management decisions in the security control selection process is imperative so that authorizing officials have access to necessary information to make informed authorization decisions for organizational information systems, as demonstrated in Figure 3.

Federal agencies are required to ensure that privacy protections are incorporated into information security planning. To that end, SP 800-53 Rev. 4 features eight new families of privacy controls that are based on the internationally accepted Fair Information Practice Principles (FIPPs). The proliferation of social media, Smart Grid, mobile, and cloud computing, as well as the transition from structured to unstructured data and metadata environments, have added significant complexities and challenges for federal organizations in safeguarding privacy. These challenges extend well beyond the traditional information technology security view of protecting privacy, which focused primarily on ensuring confidentiality.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Protecting Controlled Unclassified Information (CUI)_ NIST Special Publication 800-171, Revision 3. Small Business Primer provide? (Part 6)

[Assistant]
ents in SP 800-171. If you have questions regarding requirements to protect CUI or other regulatory requirements, please contact your prime contractor and/or federal point of contact for the contract.
|
|----------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| How do I know if I have CUI? | It is the responsibility of the federal agency to ensure that requirements to protect CUI are identified in applicable contracts or agreements, and CUI is marked by the federal agency. |
| How do I get a 'NIST SP 800 -171 Assessment'? | The term 'NIST Assessment' and 'NIST SP 800 - 171 Assessment' is frequently used to describe the Department of Defense (DOD) proce ss used to complete its NIST SP 800-171 Assessment Module through the Supplier Performance Risk System (SPRS). NIST develops the underlying technical guidelines (SP 800-171, SP 800-171A, SP 800-172, and SP 800- 172A) on which the 'NIST Assessment' is based, but NIST does not have a role in DOD's implementation of its programs . For additional guidance on NIST's methodology to plan, prepare for, and conduct security requirement assessments, refer to SP 800-171A. |
| What products, vendors, or solutions are 'NIST SP 800 -171 compliant' or 'CMMC - certified'? | NIST does not identify or track implementation of or compliance with the security requirements.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Communications Protection?

[Assistant]
According to Protecting Information and System Integrity in Industrial Control System Environments_ Cybersecurity for the Manufacturing Sector:

.................. | 50     |
| 5.3.3   | PR.AC-4: Access Permissions and Authorizations are Managed, Incorporating the Principles of Least Privilege and Separation of Duties .........................
50                                                          |        |
| 5.3.4   | PR.AC-7: Users, Devices, and Other Assets are Authenticated (e.g., single-factor, multi-factor) Commensurate with the Risk of the Transaction (e.g., Individual Security and Privacy Risks and Other Organizational Risks) | 50     |
| 5.3.5   | PR.DS-1: Data-at-Rest is Protected......................................................................... | 51     |
| 5.3.6   | PR.DS-6: Integrity Checking Mechanisms are Used to Verify Software, Firmware, and Information Integrity ..................................................................... | 51     |
| 5.3.7   | PR.IP-4: Backups of Information are Conducted, Maintained, and Tested............ | 51     |
| 5.3.8   | PR.MA-1: Maintenance and Repair of Organizational Assets are Performed and Logged, with Approved and Controlled Tools ...................................... | 51     |
| 5.3.9   | PR.MA-2: Remote Maintenance of Organizational Assets is Approved, Logged, and Performed in a Manner that Prevents Unauthorized Access............... | 51     |
| 5.3.10  | DE.AE-1: A Baseline of Network Operations and Expected Data Flows for Users Systems is Established and Managed................................................... | and 52 |
| 5.3.11  | DE.AE-2: Detected Events are Analyzed to Understand Attack Targets And Methods                                                                                |        |

Protecting Information and System Integrity in Industrial Control System Environments_ Cybersecurity for the Manufacturing Sector


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 1 require for System and Communications Protection?

[Assistant]
According to Summary Report for “Workshop on Updating Manufacturer Guidance for Securable Connected Product Development”:

ld be action-based messages directed at consumers. For example, simplifying communication and facilitating customer outreach are ways to promote awareness and understanding of cybersecurity practices.
Government-led programs for consumer education were seen as vital by the audience in driving consumer engagement and encouraging consumers to value secure products. It was noted that 'one size fits all communications' does not address the varying levels of knowledge in the general public.

Summary Report for “Workshop on Updating Manufacturer Guidance for Securable Connected Product Development”


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 2 require for System and Services Acquisition?

[Assistant]
According to Assessing Security Requirements for Controlled Unclassified Information:

Certain equipment, instruments, software, or materials, commercial or non-commercial, are identified in this paper in order to specify the experimental procedure adequately. Such identification does not imply recommendation or endorsement of any product or service by NIST, nor does it imply that the materials or equipment identified are necessarily the best available for the purpose. There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may be used by federal agencies even before the completion of such companion publications. Thus, until each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning and transition purposes, federal agencies may wish to closely follow the development of these new publications by NIST. to NIST. Many NIST cybersecurity publications, other than the ones noted above, are available at

The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the Nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology. ITL's responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in federal information systems. The Special Publication 800-series reports on ITL's research, guidelines, and outreach efforts in information system security, and its collaborative activities with industry, government, and academic organizations.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Services Acquisition?

[Assistant]
According to Ordered t-way Combinations for Testing State-based Systems:

- [20] James  M. Higdon,  Gerald  Oveson,  Efficient  Test  of Configurations  and  Orders  of  Complex  Operating  Procedures Tech. Rpt.,  COLSA North Florida Ops, 96th Cyberspace Test Group, AFMC, Eglin AFB, FL, 4 Apr 2018. - [21] Duan F, Lei Y, Kacker RN, Kuhn DR. An Approach to T-Way Test Sequence Generation With Constraints. 2019 IEEE Intl Conference on Software Testing, Verification and Validation Workshops (ICSTW) 2019 Apr 22 (pp. 241-250). IEEE. - [22] Garn B, Simos DE, Duan F, Lei Y, Bozic J, Wotawa F. Weighted Combinatorial Sequence Testing for the TLS Protocol. In2019  IEEE  International  Conference  on  Software  Testing, Verification and Validation Workshops (ICSTW) 2019 Apr 22 (pp. 46-51). IEEE. - [23] Oetsch  J,  Nieves  JC. Stable-Ordered  Models  for Propositional Theories with Order Operators. InEuropean Conference on Logics in Artificial Intelligence 2019 May 7 (pp. 794-802). Springer, Cham. - [24] Yuster R. Perfect sequence covering arrays. Designs, Codes and Cryptography. 2020 Mar;88(3):585-93. - [25] Younis MI. MVSCA: Multi-Valued Sequence Covering Array. Journal of Engineering. 2019 Oct 29;25(11):8291. - [26] D.R. Kuhn,  I. Dominguez,  R.N. Kacker  and  Y. Lei. "Combinatorial Coverage Measurement Concepts and Applications", 2nd  Intl  Workshop  on  Combinatorial  Testing , Luxembourg, IWCT2013, IEEE, Mar. 2013. - [27] Zamli KZ, Othman RR, Zabil MH. On sequence based interaction  testing. In2011  IEEE  Symposium  on  Computers  & Informatics 2011 Mar 20 (pp. 662-667). IEEE. - [28] Kuhn DR, Higdon JM, Lawrence JF, Kacker RN, Lei Y. Efficient  methods  for  interoperability  testing  using  event sequences. FLIGHT TEST SQUADRON (46TH) EGLIN AFB FL; 2012 Aug 1. - [29] Yilmaz C, Fouche S, Cohen MB, Porter A, Demiroz G, Koc U. Moving forward with combinatorial interaction testing. Computer. 2013 Dec 11;47(2):37-45. - [30] Garn  B,  Simos  DE,  Zauner  S,  Kuhn  R,  Kacker  R. Browser fingerprinting using combinatorial sequence testing.

Ordered t-way Combinations for Testing State-based Systems


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Guidelines for the Use of PIV Credentials in Facility Access provide? (Part 4)

[Assistant]
s recommendation provides a technical guideline to use Personal Identity Verification (PIV) Cards in facility access; enabling federal agencies to operate as government-wide interoperable enterprises.
These guidelines cover the risk-based strategy to select appropriate PIV authentication mechanisms as expressed within Federal Information Processing Standard (FIPS) 201. ## Keywords

credential; e-authentication; identity credential; issuance; personal identity verification (PIV); physical access control system (PACS); PIV authentication mechanisms; PIV cards; public key infrastructure (PKI); validation

## Acknowledgements

The authors of SP 800-116 Revision 1 (Hildegard Ferraiolo of NIST; Nabil Ghadiali of the National Gallery of Art; and Jason Mohler, Vincent Johnson, and Steven Brady of Electrosoft Services, Inc.) wish to thank William MacGregor, Ketan Mehta, and Karen Scarfone for their substantial contribution towards the original version of this publication, and David Cooper for his substantial contribution towards both the original version of this publication and the draft version of this revision. The authors also gratefully acknowledge and appreciate the support and contributions by many others in the public and private sectors whose helpful and beneficial comments greatly enhance the utility of this publication. Special thanks to the Interagency Security Committee (ISC), the General Services Administration, the Department of Homeland Security, the Department of Defense, and the Office of Management and Budget for their review and contributions to this document. ## Audience

This document is intended for government officials responsible for implementing Homeland Security Presidential Directive-12 (HSPD-12) compliant physical access control systems (PACS). Information in this document is also useful to government contractors and physical security vendors that provide HSPD-12 systems, products, and integration services.

Guidelines for the Use of PIV Credentials in Facility Access


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Incident Response?

[Assistant]
According to Addressing Visibility Challenges with TLS 1.3 within the Enterprise_ High-Level Document:

|                                                                                | 5.4 Specific Details ........................................................................................................... | 5.4 Specific Details ........................................................................................................... | 5.4 Specific Details ...........................................................................................................

Addressing Visibility Challenges with TLS 1.3 within the Enterprise_ High-Level Document


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Communications Protection?

[Assistant]
According to Guide for Developing Security Plans for Federal Information Systems:

2 OMB Circular A-130, Appendix III, defines general support system as an interconnected set of information resources under the same direct management control that shares common functionality. It normally includes hardware, software, information, data, applications, communications, and people. system to the high watermark or highest impact level must be applied when grouping minor applications/subsystems with varying FIPS 199 impact levels into a single general support system or major application unless there is adequate boundary protection, e.g., firewalls and encryption, around those subsystems or applications with the highest impact level. Additionally, there must be assurance that the shared resources, i.e., networks, communications, and physical access within the whole general support system or major application, are protected adequately for the highest impact level. Having the ability to isolate the high impact systems will not only result in more secure systems, but will also reduce the amount of resources required to secure many applications/systems that do not require that level of security. NIST SP 800-53 provides three security control baselines, i.e., low, moderate, and high, that are associated with the three FIPS 199 impact levels; as the impact level increases, so do the minimum assurance requirements. For reporting purposes, i.e., FISMA annual report, when an information system has varying FIPS 199 impact levels, that system is categorized at the highest impact level on that information system. Major applications are systems that perform clearly defined functions for which there are readily identifiable security considerations and needs (e.g., an electronic funds transfer system). A major application might comprise many individual programs and hardware, software, and telecommunications components. These components can be a single software application or a combination of hardware/software focused on supporting a specific, mission-related function.

Guide for Developing Security Plans for Federal Information Systems


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What guidance does Incident Response Recommendations and Considerations for Cybersecurity Risk Management_ A CSF 2.0 Community Profile provide?

[Assistant]
<!-- image -->

## NIST Special Publication 800 NIST SP 800-61r3

## Incident Response Recommendations and Considerations for Cybersecurity Risk Management

A CSF 2.0 Community Profile

Alex Nelson Sanjay Rekhi Murugiah Souppaya Karen Scarfone

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-61r3

<!-- image -->

## NIST Special Publication 800 NIST SP 800-61r3

## Incident Response Recommendations and Considerations for Cybersecurity Risk Management

A CSF 2.0 Community Profile

Alex Nelson Sanjay Rekhi Murugiah Souppaya*

Computer Security Division Information Technology Laboratory

Karen Scarfone Scarfone Cybersecurity

*Former NIST employee; all work for this publication was done while at NIST. This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-61r3

April 2025

<!-- image -->

U.S. Department of Commerce

Howard Lutnick, Secretary of Commerce

National Institute of Standards and Technology

Certain equipment, instruments, software, or materials, commercial or non-commercial, are identified in this paper in order to specify the experimental procedure adequately. Such identification does not imply recommendation or endorsement of any product or service by NIST, nor does it imply that the materials or equipment identified are necessarily the best available for the purpose. There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may be used by federal agencies even before the completion of such companion publications. Thus, until each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning and transition purposes, federal agencies may wish to closely follow the development of these new publications by NIST.

Incident Response Recommendations and Considerations for Cybersecurity Risk Management_ A CSF 2.0 Community Profile


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Audit and Accountability?

[Assistant]
According to Digital Identity Guidelines:

1.3.3. Customer Experience . . . . . . . . . . . . . . . . . . . . . . .

3.3.

3.3.1. Assurance Levels . . . . . . . . . . . . . . . . . . . . . . . . . .


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Secure Software Development Practices for Generative AI and Dual-Use Foundation Models_ An SSDF Community Profile provide? (Part 10)

[Assistant]
s in this Profile do not distinguish between human-written and AI-generated source code, because it is assumed that all source code should be evaluated for vulnerabilities and other issues before use.
## Sources of Expertise

This document leverages and integrates numerous sources of expertise, including:

- NIST research and publications on trustworthy and responsible AI, including the Artificial Intelligence Risk Management Framework (AI RMF 1.0) [2], Adversarial Machine Learning: A Taxonomy and Terminology of Attacks and Mitigations [3], Towards a Standard for Identifying and Managing Bias in Artificial Intelligence [4], and the Dioptra experimentation testbed for security evaluations of machine learning algorithms [5]. - NIST's Secure Software Development Framework (SSDF) Version 1.1 [6], which is a set of fundamental, sound, and secure software development practices. It provides a common language to help facilitate communications among stakeholders, including software producers and software acquirers. The SSDF has also been used in support of EO 14028, Improving the Nation's Cybersecurity [7], to enhance software supply chain security. - NIST general cybersecurity resources, including The NIST Cybersecurity Framework (CSF) 2.0 [8], Security and Privacy Controls for Information Systems and Organizations [9], and Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations [10]. - AI model developers, AI researchers, AI system developers, and secure software practitioners from industry and government with expertise in the unique security challenges of AI models and the practices for addressing those challenges. This expertise was primarily captured through NIST's January 2024 workshop, where speakers and attendees shared suggestions for adapting secure software development practices and tasks to accommodate the unique aspects of AI model development and the software leveraging them.

Secure Software Development Practices for Generative AI and Dual-Use Foundation Models_ An SSDF Community Profile


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Risk Assessment?

[Assistant]
According to Organizational Views of NIST Cryptographic Standards and Testing and Validation Programs:

In addition, seven out of 21 organizations commented that maintaining FIPS certification may, in some cases, weaken security and erode confidence by discouraging updates throughout the lifecycle of the product. Once a product undergoes a significant update (for example, a planned product revision or a bug or security vulnerability fix), it may lose its certification. Organizations are then put in a difficult position or may experience resource burdens to remedy the situation. 'The vulnerability is inside of-- let's say it's inside the FIPS module. This is the case where FIPS 140 is horrible because literally the way the rules are written now, fixing that vulnerability takes the FIPS 140 validation away. And theoretically, you should not be able to sell to a company now. So instead of fixing it, we put it in a queue. And then there's six months to a year to a year and a half to two years before it comes out. So the right thing to do is you fix it. So literally, the right thing to do is they fix it. They don't have FIPS 140 anymore, so why do they worry about FIPS 140 at all? They just lost it. The right thing to do from a security standpoint. So this ability to address vulnerabilities and to patch validated code is a real problem. It sends the wrong message if you do what you should do, which is patch it and live without it. Just live without the compliance until you're able to go through the FIPS process. In fact, the FIPS process takes so long, at some point they go, 'Why?' … I was at the CMVP conference three or four weeks ago, and…three or four people that program OpenSSL said their code was more secure without FIPS than with FIPS. The FIPS made it less secure. And I think one of the main reasons is this inability to quickly and agilely address vulnerabilities. So that needs to be fixed. They need to find some process.' (C19)

'Now, certification is a problem there.

Organizational Views of NIST Cryptographic Standards and Testing and Validation Programs


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Audit and Accountability?

[Assistant]
According to The Federal Cybersecurity Awareness Workforce_ Professional Backgrounds, Knowledge, Skills, and Development Activities:

| EXECUTIVE SUMMARY........................................................................................................III                                                                                | EXECUTIVE SUMMARY........................................................................................................III                                                                                | EXECUTIVE SUMMARY........................................................................................................III                                                                                |
|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| 1 INTRODUCTION................................................................................................................. 1                                                                                | 1 INTRODUCTION.................................................................................................................

The Federal Cybersecurity Awareness Workforce_ Professional Backgrounds, Knowledge, Skills, and Development Activities


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations provide? (Part 8)

[Assistant]
..........85                       |                                                                                |
| Appendix C.
| Tailoring Criteria ......................................................................................................93                         |                                                                                |
| Appendix D. | Organization-Defined Parameters ..........................................................................106                                       |                                                                                |
| Appendix E. | Change Log ............................................................................................................109                          |                                                                                |

## List of Tables

| Table 1. Security Requirement Families .......................................................................................................4          |
|----------------------------------------------------------------------------------------------------------------------------------------------------------|
| Table 2. Security Control Tailoring Criteria.................................................................................................93          |
| Table 3. Access Control (AC) .......................................................................................................................93   |
| Table 4. Awareness and Training (AT).........................................................................................................94          |
| Table 5.

Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AC.L2-3.1.10 (NIST 3.1.10)?

[Assistant]
According to Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations:

3.1.10. 3.1.10.

Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AU.L2-3.3.2 (NIST 3.3.2)?

[Assistant]
According to Recommendation for Pair-Wise Key-Establishment Using Integer Factorization Cryptography:

3.3.2 KAS2-Party_V-confirmation                                                                                | ... 3.3.2 and 8. 3.3.2 can be used to provide assurance to a key-pair owner, acting as party U, that both parties are in possession of the correct private key; i.

Recommendation for Pair-Wise Key-Establishment Using Integer Factorization Cryptography


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does A Data Structure for Integrity Protection with Erasure Capability provide? (Part 5)

[Assistant]
j and B = 1 ,  so  the  invariant  holds,  and for each iteration of the loop, the invariant is maintained. ̸

Theorem 4 (Block  dispersal) . No  consecutive  blocks appear in the same row or column.
That is, for any two blocks numbered a, b , where b = a +1 , in rows i a and i b , and columns j a and j b respectively, i a = i b and j a = j b . ̸

Proof. This can be shown by considering cases below. ̸

1. If i < j , then block a will be written to cell ( i a , j a ) and then i and j swapped, so that in the next iteration, i > j ,  and block b written to cell ( i b , j b ) . Since i b = j a and j b = i a ,  and i = j , i a = i b and j a = j b . ̸

̸

2. If i > j , then block a will be written to cell ( i a , j a ) , j incremented,  and  then i and j swapped. Then  either the relationship is unchanged, with i > j ,  or i = j . ̸

2(a). If i = j ,  then  no  data  block  will  be  written  in the  next  iteration,  but i will  be  set  to  0  and j will  be incremented  such  that i < j ,  and  the  next  data  block written with i b = 0 and j b = j a +1 , ensuring that i a = i b and j a = j b . ̸

̸

2(b). if i > j ,  then  on  the  next  iteration,  block b will be written with i b = j a and j b = i a ,  and i = j ,  so  that i a = i b and j a = j b . ̸

̸

## IV. BLOCK LOCATION

With  the  relations  above,  one  can  derive  expressions to locate a given block within the matrix. The following relations  are  clear  (see  Fig. 2  for  example)  where N = number of columns = number of rows; row and column indexes range from 0 to N -1 . - The  total  number  of  data  blocks  in  the  matrix  is N 2 -N since  the  diagonal  is  null. Thus,  the  last
- numbered  block  in  a  filled  matrix  of  N  rows  and columns is number N 2 -N .

A Data Structure for Integrity Protection with Erasure Capability

Audit and Accountability
System and Information Integrity
Media Protection
Identification and Authentication
Awareness and Training
System and Communications Protection
Access Control
Planning
Incident Response
Risk Assessment
Personnel Security
System and Services Acquisition
Supply Chain Risk Management
Maintenance
Physical Protection
Security Assessment


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for Security Assessment?

[Assistant]
According to Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171:

...... 4                                                                     |
| CHAPTERTWO THE FUNDAMENTALS............................................................................................
5                        | CHAPTERTWO THE FUNDAMENTALS............................................................................................ 5                        |
| 2.1 DEVELOPMENTAPPROACH ...................................................................................................... | 5                                                                                |
| 2.2 ORGANIZATIONANDSTRUCTURE                                                                                | ............................................................................................. 7                                                  |
| 2.3 FLEXIBLE APPLICATION                                                                                | ............................................................................................................. 9                                  |
| CHAPTER THREE THE REQUIREMENTS......................................................................................... 11                       | CHAPTER THREE THE REQUIREMENTS......................................................................................... 11                       |
| 3.1 ACCESSCONTROL                                                                                | ..................................................................................................................

Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Awareness and Training?

[Assistant]
According to Guide to Auditing for Controls and Security_ A System Development Life Cycle Approach:

| | 2.2.4 AIS Life Cycle Matrix | 2.2.4 AIS Life Cycle Matrix | 2.2.4 AIS Life Cycle Matrix | 24 | | 2.3 | LIFE CYCLE PHASES | LIFE CYCLE PHASES | LIFE CYCLE PHASES | 26 | | | 2.3.1 Initiation - Phase I | 2.3.1 Initiation - Phase I | 2.3.1 Initiation - Phase I | 27 | | | 2.3.2 Definition - Phase II | 2.3.2 Definition - Phase II | 2.3.2 Definition - Phase II | 27 | | | 2.3.3 System Design - Phase III | 2.3.3 System Design - Phase III | 2.3.3 System Design - Phase III | 27 | | | 2.3.4 Programming and Training - Phase IV | 2.3.4 Programming and Training - Phase IV | 2.3.4 Programming and Training - Phase IV | 28 | | | 2.3.5 Evaluation and Acceptance - Phase V | 2.3.5 Evaluation and Acceptance - Phase V | 2.3.5 Evaluation and Acceptance - Phase V | 28 | | | 2.3.6 Installation and Operation - Phase VI | 2.3.6 Installation and Operation - Phase VI | 2.3.6 Installation and Operation - Phase VI | 29 | | 2.4 | RESPONSIBLE PARTICIPANTS AND THEIR FUNCTION

Guide to Auditing for Controls and Security_ A System Development Life Cycle Approach


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Planning?

[Assistant]
According to Addressing Visibility Challenges with TLS 1.3 within the Enterprise_ High-Level Document:

..................................................................... | 5.4 Specific Details ...........................................................................................................
| 29                                                                          |
|------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------|
| 6                                                                                | Functional Demonstrations...............................................................30                                         | Functional Demonstrations...............................................................30                                         | Functional Demonstrations...............................................................30                                         |                                                                             |
|                                                                                | 6.1                                                                                | Usage Scenarios Supported ....................................................................................... | Usage Scenarios Supported .......................................................................................


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Audit and Accountability?

[Assistant]
According to Guide to a Secure Enterprise Network Landscape:

of network events that can be used to identify patterns of performance and security issues. - Access control functions: Access control functions enforce granular sophisticated access control policies.
- Multiple locations and functions: Firewalls reside at different locations to perform different functions. Firewalls at the network edge perform the network perimeter protection function by filtering disallowed sources and destinations and blocking the packets of potential threats. Firewalls inside a data center can segment the internal network to prevent the lateral movement of traffic and isolate sensitive resources (e.g., services and data stores). Device-based firewalls prevent malicious traffic in and out of endpoints. - Open Application Programming Interfaces (APIs): These enable integration with many networking products that provide additional security capabilities. - Policy Composition Capabilities: Some firewalls can have the capabilities to merge policies at enforcement time so as to ensure that consistent policies are applied to different classes of users (e.g., those on-premises and on private and public clouds). - Web application firewalls (WAF): This class of firewalls has been used ever since web applications accessed through web protocols, such as Hypertext Transfer Protocol

Guide to a Secure Enterprise Network Landscape


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What guidance does Risk Management Framework for Information Systems and Organizations_ A System Life Cycle Approach for Security and Privacy provide?

[Assistant]
## Risk Management Framework for Information Systems and Organizations

A System Life Cycle Approach for Security and Privacy

This publication contains comprehensive updates to the Risk Management Framework . The updates include an alignment with the constructs in the NIST Cybersecurity Framework; the integration of privacy risk management processes; an alignment with system life cycle security engineering processes; and the incorporation of supply chain  risk  management  processes. Organizations  can use the frameworks and processes in a complementary manner within the RMF to effectively manage security and  privacy risks to organizational  operations  and assets, individuals, other organizations, and the Nation. Revision 2 includes a set of organization-wide RMF tasks that are designed to prepare information system owners to conduct system-level risk management activities. The intent  is  to  increase  the  effectiveness,  efficiency,  and cost-effectiveness  of  the  RMF  by  establishing  a  closer connection to the organization's missions and business functions  and  improving  the  communications  among senior leaders, managers, and operational personnel. ## JOINT TASK FORCE

This publication is available free of charge from:

https://doi.org/10.6028/NIST.SP.800-37r2

<!-- image -->

## NIST Special Publication 800-37

Revision 2

## Risk Management Framework for Information Systems and Organizations

## A System Life Cycle Approach for Security and Privacy

## JOINT TASK FORCE

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-37r2

## December 2018

<!-- image -->

U.S. Department of Commerce Wilbur L.

Risk Management Framework for Information Systems and Organizations_ A System Life Cycle Approach for Security and Privacy


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Configuration Management?

[Assistant]
According to Secure Software Development Framework (SSDF) Version 1.1_ Recommendations for Mitigating the Risk of Software Vulnerabilities:

A software development life cycle (SDLC) 1 is a formal or informal methodology for designing, creating, and maintaining software (including code built into hardware). There are many models for SDLCs, including waterfall, spiral, agile, and - in particular - agile combined with software development and IT operations (DevOps) practices. Few SDLC models explicitly address software security in detail, so secure software development practices usually need to be added to and integrated into each SDLC model. Regardless of which SDLC model is used, secure software development practices should be integrated throughout it for three reasons: to reduce the number of vulnerabilities in released software, to reduce the potential impact of the exploitation of undetected or unaddressed vulnerabilities, and to address the root causes of vulnerabilities to prevent recurrences. Vulnerabilities include not just bugs caused by coding flaws, but also weaknesses caused by security configuration settings, incorrect trust assumptions, and outdated risk analysis.

Secure Software Development Framework (SSDF) Version 1.1_ Recommendations for Mitigating the Risk of Software Vulnerabilities