[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171 provide? (Part 19)

[Assistant]
traditional Information Technology (IT) systems, Operational Technology (OT) systems, Internet of Things

6  [32 CFR 2002] was issued on September 14, 2016, and went into effect on November 14, 2016.
7 The definition of a critical program may vary from organization to organization. For example, the Department of Defense defines a critical program as a program which significantly increases capabilities and mission effectiveness or extends the expected effective life of an essential system/capability [DOD ACQ]. 8  See [OMB M-19-03] and [OCIO HVA]. CHAPTER ONE                                                                                PAGE   2

\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

(IoT) systems, and Industrial IoT (IIoT) systems. The convergence of these types of systems has brought forth a new class of systems known as cyber-physical systems , many of which are in sectors of U.S. critical infrastructure, including energy, transportation, defense, manufacturing, healthcare, finance, and information and communications. Therefore, CUI that is processed, stored, or transmitted by any of the above systems related to a critical program or high value asset requires additional protection from the APT.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Personnel Security?

[Assistant]
According to Control Baselines for Information Systems and Organizations:

| ORGANIZATIONAL RESPONSIBILITIES .........................................................................................
| 2                                                                                |
| 1.4                                                                                | RELATIONSHIPTOOTHERPUBLICATIONS ................................................................................... | 3                                                                                |
| 1.5                                                                                | REVISIONSANDEXTENSIONS .................................................................................................... | 3                                                                                |
| 1.6                                                                                | PUBLICATIONORGANIZATION .................................................................................................. | 3                                                                                |
| CHAPTERTWO THE FUNDAMENTALS............................................................................................ 5                     | CHAPTERTWO THE FUNDAMENTALS............................................................................................ 5                     | CHAPTERTWO THE FUNDAMENTALS............................................................................................

Control Baselines for Information Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Incident Response?

[Assistant]
According to Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations:

| 3.4.3. Enhancing Practices....................................................................................................................49      |                                                                                |
|-------------------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------|
| 3.5.1. Measuring C-SCRM Through Performance Measures................................................................52                                |                                                                                |
| References.........................................................................................................................................57 |                                                                                |
| Appendix A. C-SCRM Security Controls............................................................................................... | 63                                                                                |
| A.1.1. C-SCRM Controls Summary........................................................................................................63              |                                                                                |
| A.1.1.1. C-SCRM Controls Throughout the Enterprise.......................................................................64                           |                                                                                |
| A.1.2.

Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Risk Assessment?

[Assistant]
According to Summary of NIST SP 800-53, Revision 4_ Security and Privacy Controls for Federal Information Systems and Organizations:

SP 800-53 Revision 4 has been updated to reflect the evolving technology and threat space. Example areas include issues particular to mobile and cloud computing; insider threats; applications security; supply chain risks; advanced persistent threat; and trustworthiness, assurance, and resilience of information systems. The revision also contains a new appendix of privacy controls, and related implementation guidance (Appendix J), based on the Fair Information Practice Principles (FIPPs), a widely accepted framework of defining principles to be used in the evaluation and consideration of systems, processes, or programs that affect individual privacy. The security control baselines address the security needs of a broad and diverse set of constituencies, and are developed based on a number of general assumptions, including common environmental, operational, and functional considerations. The baselines also assume typical threats facing common information systems. Articulating the underlying assumptions is a key element in the initial risk framing step of the risk management process described in NIST SP 800-39. To ensure that an appropriate set of controls is identified to provide security commensurate with risk, organizations tailor the controls to align with specific security needs. Organizations may perform tailoring at the organization level for all information systems, in support of a particular line of business or mission/business process, at the individual information system level, or by using a combination of the above. The tailoring process is comprised of several steps, as described in SP 800-53 Rev. 4 Section 3.2. These actions include:

- Identifying and designating common controls - controls that may be inherited by one or more information systems. If an information system inherits a common control, such as environmental controls within a data center, that system does not need to explicitly implement that control.

Summary of NIST SP 800-53, Revision 4_ Security and Privacy Controls for Federal Information Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for Access Control?

[Assistant]
According to Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171:

- Applying a threat-centric approach to security requirements specification;
- Employing system and security architectures that support logical and physical isolation using system and network segmentation techniques, virtual machines, and containers; 16
- Implementing dual authorization controls for the most critical or sensitive operations;
- Limiting persistent storage to isolated enclaves or domains;
- Implementing a comply-to-connect approach for systems and networks;
- Extending configuration management requirements by establishing authoritative sources for addressing changes to systems and system components;
- Periodically refreshing or upgrading organizational systems and system components to a known state or developing new systems or components;
- Employing a security operations center with advanced analytics to support continuous monitoring and protection of organizational systems; and
- Using deception to confuse and mislead adversaries regarding the information they use for decision-making, the value and authenticity of the information they attempt to exfiltrate, or the environment in which they are operating.

| FAMILY                            | FAMILY                               |
|-----------------------------------|--------------------------------------|
| Access Control                    | Media Protection                     |
| Awareness and Training            | Personnel Security                   |
| Audit and Accountability          | Physical Protection                  |
| Configuration Management          | Risk Assessment                      |
| Identification and Authentication | Security Assessment                  |
| Incident Response                 | System and Communications Protection |
| Maintenance                       | System and Information Integrity     |

## 3.1   ACCESS CONTROL

Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Audit and Accountability?

[Assistant]
According to Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations:

| 1. Introduction.....................................................................................................................................1   |
|---------------------------------------------------------------------------------------------------------------------------------------------------------|
| 1.4.1. Enterprise Risk Management and C-SCRM Owners and Operators.............................................5                                         |
| 1.4.2. Enterprise, Agency, and Mission and Business Process Owners and Operators .........................5                                             |
| 1.4.3. Acquisition and Procurement Owners and Operators.................................................................6                               |
| 1.4.4. Information Security, Privacy, or Cybersecurity Operators .........................................................6                             |
| 1.4.5. System Development, System Engineering, and System Implementation Personnel.................7                                                    |
| 1.5.1. Enterprise's Supply Chain.............................................................................................................9          |
| 1.5.2. Supplier Relationships Within Enterprises .................................................................................10                    |
| 2. Integration of C-SCRM Into Enterprise-Wide Risk Management...................................................... 18                                  |
| 2.3.1. Roles and Responsibilities Across the Three Levels ...................................................................24                         |
| 2.3.2. Level 1 -Enterprise...................................................................................................................27         |
| 2.3.3.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171 provide? (Part 5)

[Assistant]
quirements in NIST Special Publication 800-171 and are intended for use by federal agencies in contractual vehicles or other agreements established between those agencies and nonfederal organizations.
## Keywords

Advanced Persistent Threat; Basic Security Requirement; Contractor Systems; Controlled Unclassified Information; CUI Registry; Derived Security Requirement; Enhanced Security Requirement; Executive Order 13556; FIPS Publication 199; FIPS Publication 200; FISMA; NIST Special Publication 800-53; Nonfederal Organizations; Nonfederal Systems; Security Assessment; Security Control; Security Requirement. \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

## Acknowledgements

The authors also wish to recognize the scientists, engineers, and research staff from the NIST Computer Security and the Applied Cybersecurity Divisions for their exceptional contributions in helping to improve the content of the publication. A special note of thanks to Pat O'Reilly, Jim Foti, Jeff Brewer, Chris Enloe, Ned Goren, and the entire NIST web team for their outstanding administrative support. Finally, the authors also gratefully acknowledge the contributions from individuals and organizations in the public and private sectors, nationally and internationally, whose thoughtful and constructive comments improved the overall quality, thoroughness, and usefulness of this publication. \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

## Patent Disclosure Notice

NOTICE: The Information Technology Laboratory (ITL) has requested that holders of patent claims whose use may be required for compliance with the guidance or requirements of this publication disclose such patent claims to ITL.

Risk Assessment
Maintenance
Access Control
System and Communications Protection
System and Information Integrity
Incident Response
Physical Protection
Identification and Authentication
Planning
System and Services Acquisition
Media Protection
Awareness and Training
Audit and Accountability
Supply Chain Risk Management
Configuration Management
Personnel Security
Security Assessment


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for Audit and Accountability?

[Assistant]
According to Assessing Enhanced Security Requirements for Controlled Unclassified Information:

| CHAPTERONE INTRODUCTION...................................................................................................... | CHAPTERONE INTRODUCTION...................................................................................................... | 1   |
|-----------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------|-----|
| 1.1                                                                                | PURPOSEANDAPPLICABILITY............................................................................................................. 1        | 2   |
| 1.2                                                                                | TARGET AUDIENCE.............................................................................................................................. |     |
| 1.3                                                                                | ORGANIZATIONOF THIS SPECIAL PUBLICATION................................................................................. | 2   |
| CHAPTERTWO THE FUNDAMENTALS............................................................................................ | CHAPTERTWO THE FUNDAMENTALS............................................................................................ | 3   |
| 2.1                                                                                | ASSESSMENT PROCEDURES................................................................................................................

Assessing Enhanced Security Requirements for Controlled Unclassified Information


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Supply Chain Risk Management?

[Assistant]
According to Incident Response Recommendations and Considerations for Cybersecurity Risk Management_ A CSF 2.0 Community Profile:

public. Sometimes, the media learns of incidents through alternate sources (i.e., not through public affairs personnel). Having a media engagement strategy in place can greatly aid in this situation.
| CSF Element                      | CSF Element Description regarding cybersecurity-                                                                                | Priority   | Recommendations, Considerations, Notes notifications, data breach reporting, and                                                                                |
|----------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| GV.OC-04                         | understood and managed Critical objectives, capabilities, and services that external stakeholders depend on or expect from the organization are understood and communicated       | Medium     | N1: Understanding critical external dependencies on the organization's operations can aid in prioritizing response and recovery efforts. |
| GV.OC-05                         | Outcomes, capabilities, and services that the organization depends on are understood and communicated                                                                             | Medium     | N1: Understanding critical dependencies on external resources (e.g., cloud-based hosting providers and managed service providers) can aid in prioritizing response and recovery efforts.

Incident Response Recommendations and Considerations for Cybersecurity Risk Management_ A CSF 2.0 Community Profile


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171 provide? (Part 10)

[Assistant]
| ..................................................................................................................
4                             |
| 1.3 ORGANIZATIONOF THIS SPECIAL PUBLICATION                                                                                | .......................................................................... 4                                                                     |
| CHAPTERTWO THE FUNDAMENTALS............................................................................................ 5                        | CHAPTERTWO THE FUNDAMENTALS............................................................................................ 5                        |
| 2.1 DEVELOPMENTAPPROACH ...................................................................................................... | 5                                                                                |
| 2.2 ORGANIZATIONANDSTRUCTURE                                                                                | ............................................................................................. 7                                                  |
| 2.3 FLEXIBLE APPLICATION                                                                                | ............................................................................................................. 9                                  |
| CHAPTER THREE THE REQUIREMENTS......................................................................................... 11                       | CHAPTER THREE THE REQUIREMENTS.........................................................................................


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Zero Trust Architecture provide? (Part 13)

[Assistant] | | | ..............................................................................................................................................................54 | | | 7.3.4 | Formulación de políticas para el candidato a la ZTA ............................................................................54 | | | 7.3.5 | Identificación de soluciones candidatas ...............................................................................................55 | | | 7.3.6 | Implementación inicial y control ..........................................................................................................56 | | | 7.3.7 | Ampliación de la ZTA ............................................................................................................................56 | | | REFERENCIAS................................................................................................................................................................58 | REFERENCIAS................................................................................................................................................................58 | | | Lista de apéndices | Lista de apéndices | | | APÉNDICE A | : | SIGLAS.....................................................................................................................................................61 | | B.1 | E STUDIO SOBRE LA TECNOLOGÍA ........................................................................................................................63 | | | B.2 | BRECHAS QUE IMPIDEN EL PASO INMEDIATO A LA ZTA...........................................................................................64 | | | B.2.1 | Falta de términos comunes para el diseño, la planificación y la adquisición de ZTA ...........................64 | | | B.2.2 | Percepción de que la ZTA entra en conflicto con las políticas federales de ciberseguridad existentes ..............................................................................................................................................................64 | ...


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Protecting Controlled Unclassified Information (CUI)_ NIST Special Publication 800-171, Revision 3. Small Business Primer provide? (Part 19)

[Assistant]
tect audit record content. - Ask internal information security staff, or your security vendor, what audit log information, if any, the system currently captures and how it is protected and maintained.
## Questions to Ask:

- Do audit records contain information that establishes type of event, when the event occurred, where the event occurred, the source of the event, outcome, and the identity of the individual associated with the event? - Who within the business should be alerted when there are, for instance, software and hardware errors, failures in audit log capturing mechanisms, or reaching or exceeding audit log storage capacity? - Are we retaining audit records for a period consistent with the business records retention policy? Note that some industries and types of data (e.g., financial, employee, and medical records) have regulatory specifications. - How are audit information and audit logging tools being protected from unauthorized access, modification, and deletion? - Is access to management of audit logging functionality authorized to only a subset of privileged users or roles? - How frequently are these records reviewed? ## Related Resources:

- View all SP 800-171 Audit and Accountability Requirements and Assessment Procedures
- NIST Log Management resources

ht ps:/

csrc.nist.gov/projects/protecting-control ed-unclas ified-information

<!-- image -->

- Logging Made Easy, Cybersecurity and Infrastructure Security Agency (CISA)

## Getting Started with Configuration Management

## Family: Configuration Management

Description: Establishing and maintaining baseline configurations and inventories of organizational systems (including hardware, software, firmware, and documentation); and establishing and enforcing security configuration settings for information technology products employed in organizational systems.

Protecting Controlled Unclassified Information (CUI)_ NIST Special Publication 800-171, Revision 3. Small Business Primer


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for Risk Assessment?

[Assistant]
According to Protecting Controlled Unclassified Information (CUI)_ NIST Special Publication 800-171, Revision 3. Small Business Primer:

NIST SP 800-172, Enhanced Security Requirements for Protecting Controlled Unclassified Information provides enhanced security requirements to help protect CUI associated with critical programs or high value assets in nonfederal systems and organizations from the advanced persistent threat (APT). The SP 800-172 enhanced security requirements are designed to protect confidentiality, integrity and availability of information.

| Access Control                    | Maintenance         | Security Assessment and Monitoring   |
|-----------------------------------|---------------------|--------------------------------------|
| Awareness and Training            | Media Protection    | System and Communications Protection |
| Audit and Accountability          | Personnel Security  | System and Information Integrity     |
| Configuration Management          | Physical Protection | Planning                             |
| Identification and Authentication | Risk Assessment     | System and Services Acquisition      |
| Incident Response                 |                     | Supply Chain Risk Management         |

- An understanding of the need for security (why is cybersecurity important to our business mission?).
- Specific actions required of users to maintain security (required use of multi-factor authentication, not sharing passwords, etc.).
- How to respond to confirmed or suspected incidents.
- How to securely handle CUI (training should be provided to staff before authorizing access to the system or CUI).
- How to recognize and report insider threats, social engineering, and social mining.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Summary of NIST SP 800-53, Revision 4_ Security and Privacy Controls for Federal Information Systems and Organizations provide? (Part 12)

[Assistant]
8 (also known as the Common Criteria) provides functionality and assurance requirements for developers of information systems and information system components (i.e., information technology products).
Since many of the technical security controls defined in Appendix F are implemented in hardware, software, and firmware components of information systems, organizations can obtain significant benefit from the acquisition and employment of information technology products evaluated against the requirements of ISO/IEC 15408. The use of such products can provide evidence that certain security controls are implemented correctly, operating as intended, and producing the desired effect in satisfying stated security requirements. ## 8 Overlays

To help ensure that selected and implemented controls are sufficient to adequately mitigate risks to organizational operations and assets, SP 800-53 Rev. 4 introduces the concept of overlays. An overlay provides a set of security controls, control enhancements, and supplemental guidance for community-wide use or to address specialized requirements, technologies, or unique missions and environments of operation. For example, the federal government may decide to establish a government-wide set of security controls and implementation guidance for public key infrastructure (PKI) systems that could be uniformly applied to information systems. Multiple overlays can be applied to a single security control baseline. The tailored baselines that result from the overlay development process may be more or less stringent than the original security control baselines. Risk assessments provide information necessary to determine if the risk from implementing the tailored baselines falls within the risk tolerance of the organizations or communities of interest developing the overlays. General guidance on overlays is provided in section 3.3 and an overlay template is provided in Appendix I.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Protecting Controlled Unclassified Information (CUI)_ NIST Special Publication 800-171, Revision 3. Small Business Primer provide? (Part 8)

[Assistant]
ederal Agencies

- The National Archives and Records Administration (NARA) , per 32 CFR Part 2002 "Controlled Unclassified Information," determines what CUI is and lists CUI types at archives.gov/cui.
- NIST is responsible for developing and publishing the security requirements for the protection of CUI. How requirements are mandated, and any compliance issues related to nonfederal implementation of SP 800-171, are the responsibility of the federal agency requiring its use , as expressed in a specific contract or agreement. ## Additional NIST Resources

- NIST's Protecting CUI Frequently Asked Questions
- Changes Between SP 800-171 Rev. 2 and Rev. 3 (.xlsx)
- The NIST Cybersecurity and Privacy Reference Tool (CPRT) provides online, interactive versions of the updated security requirements in SP 800-171, Revision 3 and the updated assessment procedures in SP 800-171A, Revision 3
- Event Recording: ' CUI Security Requirements Workshop ,' which provides a general overview of SP 800 -171 and SP 800-171A
- NIST Small Business Cybersecurity Corner

ht ps:/

csrc.nist.gov/projects/protecting-control ed-unclas ified-information

<!-- image -->

## What to Expect

The following pages delve deeper into the SP 800-171 R3 publication to provide more details for those responsible for implementing the requirements 3 . The following pages cover:

<!-- image -->

Page 8: Key differences between SP 800-171 R2 and R3. Pages 9-10: General tips for getting started. Pages 11-28: Tips for getting started, broken out by Control Family. 3 We provide links to non-NIST sites throughout this publication because they may have information of interest to readers. NIST does not necessarily endorse the views expressed or the facts presented on those sites. Further, NIST does not endorse any commercial products that may be advertised or available on these sites.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171 provide? (Part 12)

[Assistant]
| ..............................................................................................................
17                                |
| 3.7 MAINTENANCE                                                                                | ...................................................................................................................... 18                        |
| 3.8 MEDIAPROTECTION                                                                                | .............................................................................................................. 18                                |
| 3.9 PERSONNEL SECURITY                                                                                | ............................................................................................................ 18                                  |
| 3.10 PHYSICAL PROTECTION ........................................................................................................ | 19                                                                                |
| 3.11 RISKASSESSMENT                                                                                | ................................................................................................................ 19                              |
| 3.12 SECURITY ASSESSMENT                                                                                | ........................................................................................................


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 2 require for Audit and Accountability?

[Assistant]
According to Assessing Security Requirements for Controlled Unclassified Information:

- System development life cycle responsibilities (e.g., program managers, mission/business owners, information owners/stewards, system designers and developers, system/security engineers, systems integrators)
- Acquisition or procurement responsibilities (e.g., contracting officers)
- System, security, or risk management and oversight responsibilities (e.g., authorizing officials, chief information officers, chief information security officers, system owners, information security managers)
- Security assessment and monitoring responsibilities (e.g., auditors, system evaluators, assessors, independent verifiers/validators, analysts)

| Access Control                    | Maintenance         | Security Assessment and Monitoring   |
|-----------------------------------|---------------------|--------------------------------------|
| Awareness and Training            | Media Protection    | System and Communications Protection |
| Audit and Accountability          | Personnel Security  | System and Information Integrity     |
| Configuration Management          | Physical Protection | Planning                             |
| Identification and Authentication | Risk Assessment     | System and Services Acquisition      |
| Incident Response                 |                     | Supply Chain Risk Management         |

[SELECT FROM: access control policy and procedures; procedures for least privilege; list of system-generated privileged accounts; list of system administration personnel; system audit records; system configuration settings; system security plan; list of system-generated security functions or security-relevant information assigned to system accounts or roles; other relevant documents or records]

Assessing Security Requirements for Controlled Unclassified Information


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Assessing Security Requirements for Controlled Unclassified Information provide? (Part 12)

[Assistant]
functional and assurance specifications, design documentation, and architectures) associated with a system. Mechanisms are the hardware, software, and firmware safeguards implemented within a system.
Activities are the protectionrelated actions supporting a system that involve people (e.g., conducting system backup

2  SP 800-53A [5] provides additional information on the assessment process and the individuals steps listed above. 3  Artifacts may be in formats other than documents (e.g., databases, Governance, Risk, and Compliance [GRC] tools, or Open Security Controls Assessment Language [OSCAL]). operations, exercising an incident response plan, and monitoring network traffic). Individuals are the people applying the specifications, mechanisms, or activities described above. Assessment methods define the nature and extent of the assessor's actions and are used to facilitate understanding, achieve clarification, or obtain evidence. The assessment methods include examine , interview , and test . The examine method is the process of reviewing, studying, inspecting, or analyzing assessment objects. The interview method is the process of holding discussions with individuals or groups about assessment objects. The test method is the process of exercising assessment objects (i.e., activities, mechanisms) under specified conditions to compare actual with expected behavior. Assessment methods include attributes of depth and coverage , which define the rigor, scope, and level of effort for the assessment as well as the degree of assurance that the security requirements have been satisfied. See SP 800-53A, Appendix C, Assessment Method Descriptions [5].


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Security Assessment?

[Assistant]
According to A Zero Trust Architecture Model for Access Control in Cloud-Native Applications in Multi-Cloud Environments:

- The global control plane can be leveraged to perform the functions of individual control planes at the enterprise level rather than at the cluster level (e.g., issuing identities to all services in the enterprise by leveraging the enterprise Public Key Infrastructure (PKI) system).
- The global control plane can also be used to shut down a specific control plane if all cluster nodes under the jurisdiction of that control plane have been compromised.
- The management plane provides the human-computer interfaces (e.g., user interfaces, such as command line interfaces and APIs) that enable enterprise-level systems to work by encoding organizational processes related to the usage of various tools (e.g., policy definition and evaluation tools, telemetry tools) at the lower layer.

- Identity-tier policies enable the automated testing of policies. Policies that are independent of infrastructure can be tested by merely exercising the application and observing the outcomes (e.g., trace the sequence of service calls and requests or responses instead of configuring the infrastructure correctly for test runs).
- Identity-tier policies enable 'policy as code' (PaC). With the availability of tools for the declarative specification of policies through PaC, identity-tier policies can be defined and implemented by incorporating the code into automated workflows, such as continuous integration/continuous delivery (CI/CD) pipelines.
- Identity-tier policies enable fine-grained access control by providing visibility into application call sequences/interdependencies and data flows through request-level tracking, which enables the enforcement of security policies for application traffic that is both north-south and east-west, irrespective of the environment (e.g., corporate data center or cloud infrastructure).

A Zero Trust Architecture Model for Access Control in Cloud-Native Applications in Multi-Cloud Environments


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Security Assessment?

[Assistant]
According to Assessing Security and Privacy Controls in Information Systems and Organizations:

CHAPTER ONE INTRODUCTION ............................................................................................................... 1
1.1   PURPOSE AND APPLICABILITY .......................................................................................................... 1
1.2   TARGET AUDIENCE ............................................................................................................................ 4
1.3   RELATED PUBLICATIONS AND ASSESSMENT PROCESSES ............................................................... 4
1.4   ORGANIZATION OF THIS PUBLICATION ........................................................................................... 5
CHAPTER TWO THE FUNDAMENTALS ..................................................................................................... 6
2.1   ASSESSMENTS WITHIN THE SYSTEM DEVELOPMENT LIFE CYCLE .................................................. 6
2.2   CONTROL STRUCTURE AND ORGANIZATION .................................................................................. 7
2.3   BUILDING AN EFFECTIVE ASSURANCE CASE .................................................................................... 8
2.4   ASSESSMENT PROCEDURES: ASSESSMENT OBJECTS, METHODS AND OBJECTIVES ................... 11
CHAPTER THREE THE PROCESS ............................................................................................................. 19
3.1   PREPARE FOR SECURITY AND PRIVACY CONTROL ASSESSMENTS ............................................... 19
3.2   DEVELOP SECURITY AND PRIVACY ASSESSMENT PLANS .............................................................. 23
3.3   CONDUCT SECURITY AND PRIVACY CONTROL ASSESSMENTS ..................................................... 30
3.4   ANALYZE ASSESSMENT REPORT RESULTS .....................................................................................

Assessing Security and Privacy Controls in Information Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Protecting Controlled Unclassified Information (CUI)_ NIST Special Publication 800-171, Revision 3. Small Business Primer provide? (Part 16)

[Assistant]
administrator does not need access to CUI, their access should be restricted. - Reassign or remove privileges as necessary, such as when an individual no longer requires access to CUI and the system.
- Identify who within the business has administrative (i.e., system administrator or domain administrator) privileges on systems and devices. Limit administrative privileges to only those who need them to perform specified tasks. Implement policies that restrict use of these accounts for routine, day-to-day tasks that do not require administrative privileges. ## Related Resources:

- View all SP 800-171 Access Control Requirements and Assessment Procedures
- NIST Identity and Access Management Resources

*Family definitions, except for 'Supply Chain Risk Management,' are adapted from FIPS 200 , Minimum Security Requirements for Federal Information and Information Systems. ht ps:/

csrc.nist.gov/projects/protecting-control ed-unclas ified-information

## Getting Started with Access Control

<!-- image -->

## Getting Started with Awareness and Training

## Family: Awareness and Training

Description: Ensuring personnel are made aware of the security risks associated with their activities and of the applicable laws, directives, policies, standards, regulations, or procedures related to the security of organizational systems; and ensuring that organizational personnel are adequately trained to carry out their assigned information security-related duties and responsibilities. ## Getting Started with Awareness and Training

<!-- image -->

Regularly provide basic and advanced security literacy training to new and existing staff. Customize the content to make it relevant -based on the systems that personnel have authorized access to, contextualized to the work environments of personnel (e.g., telework, shop floor), and tailored to the specific roles of personnel.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations provide? (Part 11)

[Assistant]
gnificant contributions from individuals and organizations in the public and private sectors whose constructive comments improved the overall quality, thoroughness, and usefulness of this publication.
The authors also wish to thank the NIST technical editing and production staff - Jim Foti, Jeff Brewer, Eduardo Takamura, Isabel Van Wyk, Cristina Ritfeld, Derek Sappington, and Carolyn Schmidt - for their outstanding support in preparing this document for publication. Finally, a special note of thanks goes out to Kelley Dempsey for the initial research and development of the content used in the prototype CUI overlay. ## Historical Contributions

The authors also wish to acknowledge the following organizations and individuals for their historic contributions to this publication:

- Organizations: National Archives and Records Administration, Department of Defense
- Individuals: Carol Bales, Matthew Barrett, Jon Boyens, Devin Casey, Christian Enloe, Gary Guissanie, Peggy Himes, Robert Glenn, Elizabeth Lennon, Vicki Michetti, Dorian Pappas, Karen Quigg, Mark Riddle, Matthew Scholl, Mary Thomas, Murugiah Souppaya, Patricia Toth, and Patrick Viscuso

## 1. Introduction

Executive Order (EO) 13556 [1] established a government-wide program to standardize the way the executive branch handles Controlled Unclassified Information (CUI). 1 EO 13556 required that the CUI program emphasize openness, transparency, and uniformity of government-wide practices and that the program implementation take place in a manner consistent with Office of Management and Budget (OMB) policies and National Institute of Standards and Technology (NIST) standards and guidelines. As the CUI program Executive Agent, the National Archives and Records Administration (NARA) provides information, guidance, policy, and requirements on handling CUI [4]. This includes approved CUI categories and descriptions, the basis for safeguarding and dissemination controls, and procedures for the use of CUI.

Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Audit and Accountability?

[Assistant]
According to Control Baselines for Information Systems and Organizations:

| ORGANIZATIONAL RESPONSIBILITIES .........................................................................................
| 2                                                                                |
| 1.4                                                                                | RELATIONSHIPTOOTHERPUBLICATIONS ................................................................................... | 3                                                                                |
| 1.5                                                                                | REVISIONSANDEXTENSIONS .................................................................................................... | 3                                                                                |
| 1.6                                                                                | PUBLICATIONORGANIZATION .................................................................................................. | 3                                                                                |
| CHAPTERTWO THE FUNDAMENTALS............................................................................................ 5                     | CHAPTERTWO THE FUNDAMENTALS............................................................................................ 5                     | CHAPTERTWO THE FUNDAMENTALS............................................................................................


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for Supply Chain Risk Management?

[Assistant]
According to Protecting Controlled Unclassified Information (CUI)_ NIST Special Publication 800-171, Revision 3. Small Business Primer:

| Access Control                    | Maintenance         | Security Assessment and Monitoring   |
|-----------------------------------|---------------------|--------------------------------------|
| Awareness and Training            | Media Protection    | System and Communications Protection |
| Audit and Accountability          | Personnel Security  | System and Information Integrity     |
| Configuration Management          | Physical Protection | Planning                             |
| Identification and Authentication | Risk Assessment     | System and Services Acquisition      |
| Incident Response                 |                     | Supply Chain Risk Management         |

| How can I 'comply' with SP 800-171? | NIST does not have a role in determining compliance with the security requirements in SP 800-171. If you have questions regarding requirements to protect CUI or other regulatory requirements, please contact your prime contractor and/or federal point of contact for the contract. |
|----------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| How do I know if I have CUI? | It is the responsibility of the federal agency to ensure that requirements to protect CUI are identified in applicable contracts or agreements, and CUI is marked by the federal agency. |
| How do I get a 'NIST SP 800 -171 Assessment'?


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171 provide? (Part 10)

[Assistant]
| ..................................................................................................................
4                             |
| 1.3 ORGANIZATIONOF THIS SPECIAL PUBLICATION                                                                                | .......................................................................... 4                                                                     |
| CHAPTERTWO THE FUNDAMENTALS............................................................................................ 5                        | CHAPTERTWO THE FUNDAMENTALS............................................................................................ 5                        |
| 2.1 DEVELOPMENTAPPROACH ...................................................................................................... | 5                                                                                |
| 2.2 ORGANIZATIONANDSTRUCTURE                                                                                | ............................................................................................. 7                                                  |
| 2.3 FLEXIBLE APPLICATION                                                                                | ............................................................................................................. 9                                  |
| CHAPTER THREE THE REQUIREMENTS......................................................................................... 11                       | CHAPTER THREE THE REQUIREMENTS.........................................................................................


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Media Protection?

[Assistant]
According to Summary of NIST SP 800-53, Revision 4_ Security and Privacy Controls for Federal Information Systems and Organizations:

The NIST Risk Management Framework (RMF), described in NIST Special Publication 800-37 Revision 1, Guide for Applying the Risk Management Framework to Federal Information Systems: a Security Life Cycle Approach, is a methodology for implementing risk management at the information systems tier. The RMF (depicted in Figure 2) identifies six distinct steps that provide a disciplined and structured process to integrate information security risk management activities into the system development life cycle. The RMF addresses security concerns of organizations related to the design, development, implementation, operation, and disposal of information systems and the environments in which those systems operate.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Awareness and Training?

[Assistant]
According to Incident Response Recommendations and Considerations for Cybersecurity Risk Management_ A CSF 2.0 Community Profile:

Many organizations may use more than one of these approaches, such as internally performing basic incident response and engaging third-party resources for assistance with certain incidents. Larger organizations may have multiple incident response teams, with each team responsible for a particular logical or physical segment of the organization. When this model is employed, the teams should be part of a single coordinated entity (e.g., a federation) to ensure that incident response processes, procedures, and training are consistent across the organization and that information is shared among teams. The Community Profile is intended for use by most organizations, regardless of sector, size, or other factors. Additional versions of this Community Profile could be developed for narrower audiences, such as federal agencies, small businesses, or educational institutions. For more information on CSF 2.0 Community Profiles, see the Framework Resource Center.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for Physical Protection?

[Assistant]
According to Protecting Controlled Unclassified Information (CUI)_ NIST Special Publication 800-171, Revision 3. Small Business Primer:

| Access Control                    | Maintenance         | Security Assessment and Monitoring   |
|-----------------------------------|---------------------|--------------------------------------|
| Awareness and Training            | Media Protection    | System and Communications Protection |
| Audit and Accountability          | Personnel Security  | System and Information Integrity     |
| Configuration Management          | Physical Protection | Planning                             |
| Identification and Authentication | Risk Assessment     | System and Services Acquisition      |
| Incident Response                 |                     | Supply Chain Risk Management         |

Scope and Applicability of SP 800-171. The security requirements in NIST SP 800-171 are only applicable to components of nonfederal systems that process, store, or transmit CUI or that provide protection for such components. Appropriately scoping requirements is an important factor in determining protection-related investment decisions and managing security risks for your business. You may limit the scope of the security requirements by isolating the system components in a separate security domain. Isolation can be achieved by implementing subnetworks with firewalls or other boundary protection devices. Security domains may employ physical separation, logical separation, or a combination of both. This approach can provide adequate security for CUI and avoid increasing the organization's security posture beyond what it requires for protecting its missions, operations, and assets.

- Permit only qualified and authorized individuals to access the system for the purpose of initiating changes. Access restrictions include physical and logical access controls, software libraries, workflow automation, media libraries, abstract layers (i.e., changes implemented into external interfaces rather than directly into the system), and change windows (i.e., changes occur only during specified times).


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Security and Privacy Controls for Information Systems and Organizations provide? (Part 13)

[Assistant]
SR-9, and SR-11. T
h
s

i

p
u
b

l
i

c
a

t
i

o
n

i

s

a
v
a

i
l

l

a
b
e
f
r
e
e
o
f

c
h
a
r
g
e
f
r
o
m

:

h
t
t
p
s
:
/
/
d
o
i
. o
r
g
/
1
0
. 6
0
2
8
/
N
S
T
S
P
. 8
0
0
-
5
3
r
5

I

.
viii

T
h
s

i

p
u
b

l
i

c
a

t
i

o
n

i

s

a
v
a

i
l

l

a
b
e
f
r
e
e
o
f

c
h
a
r
g
e
f
r
o
m

:

h
t
t
p
s
:
/
/
d
o
i
. o
r
g
/
1
0
. 6
0
2
8
/
N
S
T
S
P
. 8
0
0
-
5
3
r
5

I

. NIST SP 800-53, REV. 5                                                                                SECURITY AND PRIVACY CONTROLS FOR INFORMATION SYSTEMS AND ORGANIZATIONS
_________________________________________________________________________________________________

INFORMATION SYSTEMS — A BROAD-BASED PERSPECTIVE

As we push computers to “the edge,” building an increasingly complex world of interconnected
systems and devices, security and privacy continue to dominate the national dialogue. There is
an urgent need to further strengthen the underlying systems, products, and services that we
depend on in every sector of the critical infrastructure to ensure that those systems, products,
and  services  are  sufficiently  trustworthy  and  provide  the  necessary  resilience  to  support  the
economic and national security interests of the United States. NIST Special Publication 800-53,
Revision 5, responds to this need by embarking on a proactive and systemic approach to develop
and make available to a broad base of public and private sector organizations a comprehensive
set of security and privacy safeguarding measures for all types of computing platforms, including
general  purpose  computing  systems,  cyber-physical  systems,  cloud  systems,  mobile  systems,
industrial control systems, and Internet of Things (IoT) devices. Safeguarding measures include
both security and privacy controls to protect the critical and essential operations and assets of
organizations and the privacy of individuals.

Security and Privacy Controls for Information Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Protecting Controlled Unclassified Information (CUI)_ NIST Special Publication 800-171, Revision 3. Small Business Primer provide? (Part 11)

[Assistant]
f those systems or components, helps practitioners understand the scope of applicability of SP 800-171 security requirements to business systems. <!-- image -->

Scope and Applicability of SP 800-171.
The security requirements in NIST SP 800-171 are only applicable to components of nonfederal systems that process, store, or transmit CUI or that provide protection for such components. Appropriately scoping requirements is an important factor in determining protection-related investment decisions and managing security risks for your business. You may limit the scope of the security requirements by isolating the system components in a separate security domain. Isolation can be achieved by implementing subnetworks with firewalls or other boundary protection devices. Security domains may employ physical separation, logical separation, or a combination of both. This approach can provide adequate security for CUI and avoid increasing the organization's security posture beyond what it requires for protecting its missions, operations, and assets. ht ps:/

csrc.nist.gov/projects/protecting-control ed-unclas ified-information

Below is a sample CUI data flow diagram for a fictional company. Create your own diagram to understand how CUI flows into, within, and out of the business. <!-- image -->

## General Tips for Getting Started with NIST SP 800-171

<!-- image -->

| Identify the role(s) responsible for security and provide the necessary resources. | Whether it is just one person or multiple people within the business, ensure roles, responsibilities, and authorities related to cybersecurity risk management are established, communicated, understood, and enforced. Even if cybersecurity activities are outsourced to an external provider, someone within the business should still be designated to manage cybersecurity risk.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for Planning?

[Assistant]
According to Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171:

There may be references in this publication to other publications currently under development by  NIST  in  accordance  with  its  assigned  statutory  responsibilities.  The  information  in  this publication, including concepts, practices, and methodologies, may be used by federal agencies even  before  the  completion  of  such  companion  publications.  Thus,  until  each  publication  is completed,  current  requirements,  guidelines,  and  procedures,  where  they  exist,  remain operative. For planning and transition purposes, federal agencies may wish to closely follow the development of these new publications by NIST.

The enhanced security requirements are organized into 14 families consistent with the families for basic and derived requirements. Each family contains the requirements related to the general security topic of the family. The families are closely aligned with the minimum security requirements for federal information and information systems in [FIPS 200]. The security requirements for contingency planning , system and services acquisition , and planning are not included within the scope of this publication due to the tailoring criteria in [SP 800-171]. Table 1 lists the security requirement families addressed in this publication. 17

- 3.11.4e  Document or reference in the system security plan the security solution selected, the rationale for the security solution, and the risk determination.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Incident Response Recommendations and Considerations for Cybersecurity Risk Management_ A CSF 2.0 Community Profile provide? (Part 5)

[Assistant]
, and academic organizations. ## Supplemental Content

NIST has established an Incident Response project page that hosts links to resources with additional information on incident response activities.
By moving links from this document to a website, NIST can update and expand them as needed without having to release a new version of this publication. For more information on CSF 2.0 Community Profiles, see the Framework Resource Center. ## Audience

The target audience for this publication includes cybersecurity program leadership, cybersecurity personnel, and others who are responsible for preparing for, detecting, responding to, or recovering from cybersecurity incidents. This publication is intended for use by most organizations, regardless of sector, size, or other factors. ## Trademark Information

All registered trademarks belong to their respective organizations. ## Patent Disclosure Notice

NOTICE: ITL has requested that holders of patent claims whose use may be required for compliance with the guidance or requirements of this publication disclose such patent claims to ITL. However, holders of patents are not obligated to respond to ITL calls for patents and ITL has not undertaken a patent search in order to identify which, if any, patents may apply to this publication. As of the date of publication and following call(s) for the identification of patent claims whose use may be required for compliance with the guidance or requirements of this publication, no such patent claims have been identified to ITL. No representation is made or implied by ITL that licenses are not required to avoid patent infringement in the use of this publication.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Awareness and Training?

[Assistant]
According to Summary of NIST SP 800-53, Revision 4_ Security and Privacy Controls for Federal Information Systems and Organizations:

The security control baselines address the security needs of a broad and diverse set of constituencies, and are developed based on a number of general assumptions, including common environmental, operational, and functional considerations. The baselines also assume typical threats facing common information systems.  Articulating the underlying assumptions is a key element in the initial risk framing step of the risk management process described in NIST SP 800-39.  To ensure that an appropriate set of controls is identified to provide security commensurate with risk, organizations tailor the controls to align with specific security needs. Organizations may perform tailoring at the organization level for all information systems, in support of a particular line of business or mission/business process, at the individual information system level, or by using a combination of the above. The tailoring process is comprised of several steps, as described in SP 800-53 Rev. 4 Section 3.2.  These actions include:


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations provide? (Part 17)

[Assistant]
|                                                                                |
| D.4.1.2.
Description .........................................................................................................................218                                                                                |                                                                                |
| D.4.1.3. Information Gathering and Scoping Analysis .....................................................................219                                                                                |                                                                                |
| D.4.1.4. Threat Analysis ...................................................................................................................225                                                                                |                                                                                |
| D.4.1.5. Vulnerability Analysis .........................................................................................................225                                                                                |                                                                                |
| D.4.1.6.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 2 require for Maintenance?

[Assistant]
According to Assessing Security Requirements for Controlled Unclassified Information:

Additional information about this publication is available at https://csrc.nist.gov/pubs/sp/800/171/a/r3/final, including related content, potential updates, and document history.

| Access Control                    | Maintenance         | Security Assessment and Monitoring   |
|-----------------------------------|---------------------|--------------------------------------|
| Awareness and Training            | Media Protection    | System and Communications Protection |
| Audit and Accountability          | Personnel Security  | System and Information Integrity     |
| Configuration Management          | Physical Protection | Planning                             |
| Identification and Authentication | Risk Assessment     | System and Services Acquisition      |
| Incident Response                 |                     | Supply Chain Risk Management         |

A.03.02.01.ODP[01]: the frequency at which to provide security literacy training to system users after initial training is defined . A.03.02.01.ODP[02]: events that require security literacy training for system users are defined. A.03.02.01.ODP[03]: the frequency at which to update security literacy training content is defined. A.03.02.01.ODP[04]: events that require security literacy training content updates are defined. A.03.02.01.a.01[01]: security literacy training is provided to system users as part of initial training for new users. security literacy training is provided to system users


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Information Integrity?

[Assistant]
According to Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations:

Organizations are concerned about the risks associated with products and services that may potentially contain malicious functionality, are counterfeit, or are vulnerable due to poor manufacturing and development practices within the supply chain. These risks are associated with an enterprise's decreased visibility into and understanding of how the technology they acquire is developed, integrated, and deployed or the processes, procedures, standards, and practices used to ensure the security, resilience, reliability, safety, integrity, and quality of the products and services. | 3.4.3. Enhancing Practices....................................................................................................................49      |                                                                                |
|-------------------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------|
| 3.5.1. Measuring C-SCRM Through Performance Measures................................................................52                                |                                                                                |
| References.........................................................................................................................................57 |                                                                                |
| Appendix A. C-SCRM Security Controls............................................................................................... | 63                                                                                |
| A.1.1.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What are the CMMC Level 3 requirements?

[Assistant]
According to Protecting Controlled Unclassified Information (CUI)_ NIST Special Publication 800-171, Revision 3. Small Business Primer:

ent, or possibly with other organizations like municipal governments, prime contractors, universities, etc., you will likely be required to demonstrate you are taking adequate measures to protect CUI.
Examples of CUI include:

<!-- image -->

|                      | When provided as part of a government contract, examples include:                                                                                | Marking 1     |
|----------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------|
| Controlled           | e.g., research and engineering data, engineering drawings, specifications, process sheets, manuals, technical reports, technical orders, catalog-item identifications, data sets, studies and analyses and related information, and computer software executable code and source code. | CUI//SP-CTI   |
| General Proprietary  | e.g., financial information, trade secrets, product research and development, existing and future product designs and performance specifications. | CUI//PROPIN   |
| Business Information | you do not handle CUI, implementing the security requirements in SP 800-171 will                                                                                | help you take |

1  For more information on types of CUI and markings, visit the National Archives and Records Administration (NARA) https://www.archives.gov/cui.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What guidance does NIST provide for CMMC Level 2?

[Assistant]
According to Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations:

aft publications during public comment periods and provide feedback to NIST. Many NIST cybersecurity publications, other than the ones noted above, are available at https://csrc.nist.gov/publications.
## Authority

This publication has been developed by NIST in accordance with its statutory responsibilities under the Federal Information Security Modernization Act (FISMA) of 2014, 44 U.S.C. § 3551 et seq., Public Law (P.L.) 113-283. NIST is responsible for developing information security standards and guidelines, including minimum requirements for federal information systems, but such standards and guidelines shall not apply to national security systems without the express approval of appropriate federal officials exercising policy authority over such systems. This guideline is consistent with the requirements of the Office of Management and Budget (OMB) Circular A-130. Nothing in this publication should be taken to contradict the standards and guidelines made mandatory and binding on federal agencies by the Secretary of Commerce under statutory authority. Nor should these guidelines be interpreted as altering or superseding the existing authorities of the Secretary of Commerce, Director of the OMB, or any other federal official. This publication may be used by nongovernmental organizations on a voluntary basis and is not subject to copyright in the United States. Attribution would, however, be appreciated by NIST. ## NIST Technical Series Policies

Copyright, Use, and Licensing Statements NIST Technical Series Publication Identifier Syntax

## Publication History

Approved by the NIST Editorial Review Board on 2024-04-23 Supersedes NIST Special Publication 800-171r2 (February 2020; Includes updates as of 01-28-2021) https://doi.org/10.6028/NIST.SP.800-171r2

## How to Cite this NIST Technical Series Publication:

Ross R, Pillitteri V (2024) Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for Incident Response?

[Assistant]
According to Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171:

| CHAPTERONE INTRODUCTION...................................................................................................... | CHAPTERONE INTRODUCTION...................................................................................................... |
|--------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------|
| 1.1 PURPOSEANDAPPLICABILITY                                                                                | ................................................................................................... 3                                            |
| 1.2 TARGET AUDIENCE                                                                                | .................................................................................................................. 4                             |
| 1.3 ORGANIZATIONOF THIS SPECIAL PUBLICATION                                                                                | .......................................................................... 4                                                                     |
| CHAPTERTWO THE FUNDAMENTALS............................................................................................ 5                        | CHAPTERTWO THE FUNDAMENTALS............................................................................................ 5                        |
| 2.1 DEVELOPMENTAPPROACH ......................................................................................................


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for System and Communications Protection?

[Assistant]
According to Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171:

| CHAPTERONE INTRODUCTION...................................................................................................... | CHAPTERONE INTRODUCTION...................................................................................................... |
|--------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------|
| 1.1 PURPOSEANDAPPLICABILITY                                                                                | ................................................................................................... 3                                            |
| 1.2 TARGET AUDIENCE                                                                                | .................................................................................................................. 4                             |
| 1.3 ORGANIZATIONOF THIS SPECIAL PUBLICATION                                                                                | .......................................................................... 4                                                                     |
| CHAPTERTWO THE FUNDAMENTALS............................................................................................ 5                        | CHAPTERTWO THE FUNDAMENTALS............................................................................................ 5                        |
| 2.1 DEVELOPMENTAPPROACH ......................................................................................................


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What guidance does NIST provide for CMMC Level 3?

[Assistant]
According to Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171:

systems, but such standards and guidelines shall not apply to national security systems without the express approval of the appropriate federal officials exercising policy authority over such systems.
This guideline is consistent with requirements of the Office of Management and Budget (OMB) Circular A-130. Nothing in this publication should be taken to contradict the standards and guidelines made mandatory and binding on federal agencies by the Secretary of Commerce under statutory authority. Nor should these guidelines be interpreted as altering or superseding the existing authorities of the Secretary of Commerce, OMB Director, or any other federal official. This publication may be used by nongovernmental organizations on a voluntary basis and is not subject to copyright in the United States. Attribution would, however, be appreciated by NIST. National Institute of Standards and Technology Special Publication 800-172 Natl. Inst. Stand. Technol. Spec. Publ. 800-172, 84 pages (February 2021)

CODEN: NSPUE2

This publication is available free of charge from:

https://doi.org/10.6028/NIST.SP.800-172

Certain  commercial  entities,  equipment,  or  materials  may  be  identified  in  this  document  to describe an experimental procedure or concept adequately. Such identification is not intended to imply recommendation or endorsement by NIST, nor is it intended to imply that the entities, materials, or equipment are necessarily the best available for the purpose. There may be references in this publication to other publications currently under development by  NIST  in  accordance  with  its  assigned  statutory  responsibilities. The  information  in  this publication, including concepts, practices, and methodologies, may be used by federal agencies even  before  the  completion  of  such  companion  publications. Thus,  until  each  publication  is completed,  current  requirements,  guidelines,  and  procedures,  where  they  exist,  remain operative.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Security Assessment?

[Assistant]
According to Summary of NIST SP 800-53, Revision 4_ Security and Privacy Controls for Federal Information Systems and Organizations:

8 (also known as the Common Criteria) provides functionality and assurance requirements for developers of information systems and information system components (i.e., information technology products).
Since many of the technical security controls defined in Appendix F are implemented in hardware, software, and firmware components of information systems, organizations can obtain significant benefit from the acquisition and employment of information technology products evaluated against the requirements of ISO/IEC 15408. The use of such products can provide evidence that certain security controls are implemented correctly, operating as intended, and producing the desired effect in satisfying stated security requirements.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Protecting Controlled Unclassified Information (CUI)_ NIST Special Publication 800-171, Revision 3. Small Business Primer provide? (Part 20)

[Assistant]
tems (including hardware, software, firmware, and documentation); and establishing and enforcing security configuration settings for information technology products employed in organizational systems.
## Getting Started with Configuration Management

<!-- image -->

Changes to a system can have potentially significant effects on the security of the system. Configuration management helps establish processes for initializing, changing and monitoring configurations to the hardware, software, or firmware components of the system or the operational procedures related to the system storing CUI. ## Limit who can make changes to the system containing CUI. - Permit only qualified and authorized individuals to access the system for the purpose of initiating changes. Access restrictions include physical and logical access controls, software libraries, workflow automation, media libraries, abstract layers (i.e., changes implemented into external interfaces rather than directly into the system), and change windows (i.e., changes occur only during specified times). ## Authorized software -allow by exception. - It is important to identify permitted and prohibited actions regarding software installation when users have the ability to install software on organizational systems. Permitted software installations could include updates and security patches to existing software and downloading new applications from organizationapproved 'app stores.' Companies might prohibit employees from downloading certain programs, services, software versions, etc . ## Locate CUI. - Identify the location of CUI and the system components on which the information is processed and stored. Identify who within the business has access to CUI. Again, remember to restrict this access to only those who need it. Foundational Concept -Least Functionality: Systems (databases, email systems, network drives, etc.) provide a variety of functions and services.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What are the CMMC Level 3 requirements?

[Assistant]
According to Protecting Controlled Unclassified Information (CUI)_ NIST Special Publication 800-171, Revision 3. Small Business Primer:

ent, or possibly with other organizations like municipal governments, prime contractors, universities, etc., you will likely be required to demonstrate you are taking adequate measures to protect CUI.
Examples of CUI include:

<!-- image -->

|                      | When provided as part of a government contract, examples include:                                                                                | Marking 1     |
|----------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------|
| Controlled           | e.g., research and engineering data, engineering drawings, specifications, process sheets, manuals, technical reports, technical orders, catalog-item identifications, data sets, studies and analyses and related information, and computer software executable code and source code. | CUI//SP-CTI   |
| General Proprietary  | e.g., financial information, trade secrets, product research and development, existing and future product designs and performance specifications. | CUI//PROPIN   |
| Business Information | you do not handle CUI, implementing the security requirements in SP 800-171 will                                                                                | help you take |

1  For more information on types of CUI and markings, visit the National Archives and Records Administration (NARA) https://www.archives.gov/cui.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for System and Information Integrity?

[Assistant]
According to Protecting Controlled Unclassified Information (CUI)_ NIST Special Publication 800-171, Revision 3. Small Business Primer:

NIST SP 800-172, Enhanced Security Requirements for Protecting Controlled Unclassified Information provides enhanced security requirements to help protect CUI associated with critical programs or high value assets in nonfederal systems and organizations from the advanced persistent threat (APT). The SP 800-172 enhanced security requirements are designed to protect confidentiality, integrity and availability of information.

2 SP 800-171 does not explicitly cover integrity and availability so it is not a comprehensive security program.

| Access Control                    | Maintenance         | Security Assessment and Monitoring   |
|-----------------------------------|---------------------|--------------------------------------|
| Awareness and Training            | Media Protection    | System and Communications Protection |
| Audit and Accountability          | Personnel Security  | System and Information Integrity     |
| Configuration Management          | Physical Protection | Planning                             |
| Identification and Authentication | Risk Assessment     | System and Services Acquisition      |
| Incident Response                 |                     | Supply Chain Risk Management         |


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Identification and Authentication?

[Assistant]
According to Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations:

| 1. Introduction.....................................................................................................................................1   |
|---------------------------------------------------------------------------------------------------------------------------------------------------------|
| 1.4.1. Enterprise Risk Management and C-SCRM Owners and Operators.............................................5                                         |
| 1.4.2. Enterprise, Agency, and Mission and Business Process Owners and Operators .........................5                                             |
| 1.4.3. Acquisition and Procurement Owners and Operators.................................................................6                               |
| 1.4.4. Information Security, Privacy, or Cybersecurity Operators .........................................................6                             |
| 1.4.5. System Development, System Engineering, and System Implementation Personnel.................7                                                    |
| 1.5.1. Enterprise's Supply Chain.............................................................................................................9          |
| 1.5.2. Supplier Relationships Within Enterprises .................................................................................10                    |
| 2. Integration of C-SCRM Into Enterprise-Wide Risk Management...................................................... 18                                  |
| 2.3.1. Roles and Responsibilities Across the Three Levels ...................................................................24                         |
| 2.3.2. Level 1 -Enterprise...................................................................................................................27         |
| 2.3.3.