[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Information Integrity?

[Assistant]
According to Summary of NIST SP 800-53, Revision 4_ Security and Privacy Controls for Federal Information Systems and Organizations:

As the risk to an information system's confidentiality, integrity and/or availability increases, the need for additional controls to protect the system may also increase accordingly.  SP 800-53 Revision 4 provides the security control baselines as the starting point for the security control selection process. The baselines are chosen based on the security category and associated impact level of information systems as described in Federal Information Processing Standard Publication (FIPS) 199, Standards for Security Categorization of Federal Information and Information Systems, and FIPS Publication 200, Minimum Security Requirements for Federal Information and Information Systems .

- Authority and Purpose (AP);
- Accountability, Audit, and Risk Management (AR);
- Data Quality and Integrity (DI);
- Data Minimization and Retention (DM);
- Individual Participation and Redress (IP);
- Security (SE);
- Transparency (TR); and,
- Use Limitation (UL).


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for Personnel Security?

[Assistant]
According to Protecting Controlled Unclassified Information (CUI)_ NIST Special Publication 800-171, Revision 3. Small Business Primer:

| Access Control                    | Maintenance         | Security Assessment and Monitoring   |
|-----------------------------------|---------------------|--------------------------------------|
| Awareness and Training            | Media Protection    | System and Communications Protection |
| Audit and Accountability          | Personnel Security  | System and Information Integrity     |
| Configuration Management          | Physical Protection | Planning                             |
| Identification and Authentication | Risk Assessment     | System and Services Acquisition      |
| Incident Response                 |                     | Supply Chain Risk Management         |

Description: Ensuring personnel are made aware of the security risks associated with their activities and of the applicable laws, directives, policies, standards, regulations, or procedures related to the security of organizational systems; and ensuring that organizational personnel are adequately trained to carry out their assigned information security-related duties and responsibilities.

Regularly provide basic and advanced security literacy training to new and existing staff. Customize the content to make it relevant -based on the systems that personnel have authorized access to, contextualized to the work environments of personnel (e.g., telework, shop floor), and tailored to the specific roles of personnel. The content should include:

Protecting Controlled Unclassified Information (CUI)_ NIST Special Publication 800-171, Revision 3. Small Business Primer


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for Maintenance?

[Assistant]
According to Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171:

............................................ 5                        |
| 2.1 DEVELOPMENTAPPROACH ......................................................................................................
| 5                                                                                |
| 2.2 ORGANIZATIONANDSTRUCTURE                                                                                | ............................................................................................. 7                                                  |
| 2.3 FLEXIBLE APPLICATION                                                                                | ............................................................................................................. 9                                  |
| CHAPTER THREE THE REQUIREMENTS......................................................................................... 11                       | CHAPTER THREE THE REQUIREMENTS......................................................................................... 11                       |
| 3.1 ACCESSCONTROL                                                                                | .................................................................................................................. 12                            |
| 3.2 AWARENESSANDTRAINING                                                                                | ...................................................................................................

Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for Personnel Security?

[Assistant]
According to Protecting Controlled Unclassified Information (CUI)_ NIST Special Publication 800-171, Revision 3. Small Business Primer:

| Access Control                    | Maintenance         | Security Assessment and Monitoring   |
|-----------------------------------|---------------------|--------------------------------------|
| Awareness and Training            | Media Protection    | System and Communications Protection |
| Audit and Accountability          | Personnel Security  | System and Information Integrity     |
| Configuration Management          | Physical Protection | Planning                             |
| Identification and Authentication | Risk Assessment     | System and Services Acquisition      |
| Incident Response                 |                     | Supply Chain Risk Management         |

Description: Ensuring personnel are made aware of the security risks associated with their activities and of the applicable laws, directives, policies, standards, regulations, or procedures related to the security of organizational systems; and ensuring that organizational personnel are adequately trained to carry out their assigned information security-related duties and responsibilities.

Regularly provide basic and advanced security literacy training to new and existing staff. Customize the content to make it relevant -based on the systems that personnel have authorized access to, contextualized to the work environments of personnel (e.g., telework, shop floor), and tailored to the specific roles of personnel. The content should include:


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Risk Assessment?

[Assistant]
According to Assessing Security and Privacy Controls in Information Systems and Organizations:

SP 800-53A provides a process that allows organizations to tailor the assessment procedures
outlined in the guidance. Tailoring involves customizing the assessment procedures to match
the characteristics of the system and its environment of operation more closely. The tailoring
process described in this guidance gives organizations the flexibility needed to avoid assessment
approaches that are unnecessarily complex or costly while simultaneously meeting the
assessment requirements and risk management principles established in the RMF. Tailoring
decisions are left to the discretion of the organization to maximize flexibility in developing
assessment plans – applying the results of risk assessments to determine the extent, rigor, and
level of intensity of the assessments needed to provide sufficient assurance about the security
and privacy posture of the system. CHAPTER ONE INTRODUCTION ............................................................................................................... 1
1.1   PURPOSE AND APPLICABILITY .......................................................................................................... 1
1.2   TARGET AUDIENCE ............................................................................................................................ 4
1.3   RELATED PUBLICATIONS AND ASSESSMENT PROCESSES ............................................................... 4
1.4   ORGANIZATION OF THIS PUBLICATION ........................................................................................... 5
CHAPTER TWO THE FUNDAMENTALS ..................................................................................................... 6
2.1   ASSESSMENTS WITHIN THE SYSTEM DEVELOPMENT LIFE CYCLE .................................................. 6
2.2   CONTROL STRUCTURE AND ORGANIZATION ..................................................................................

Assessing Security and Privacy Controls in Information Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171 provide? (Part 11)

[Assistant]
..................................................... 11                       | CHAPTER THREE THE REQUIREMENTS.........................................................................................
11                       |
| 3.1 ACCESSCONTROL                                                                                | .................................................................................................................. 12                            |
| 3.2 AWARENESSANDTRAINING                                                                                | ................................................................................................... 13                                           |
| 3.3 AUDIT ANDACCOUNTABILITY                                                                                | ................................................................................................. 14                                             |
| 3.4 CONFIGURATIONMANAGEMENT                                                                                | ........................................................................................... 14                                                   |
| 3.5 IDENTIFICATIONANDAUTHENTICATION                                                                                | ................................................................................. 16                                                             |
| 3.6 INCIDENT RESPONSE                                                                                | ..............................................................................................................

Risk Assessment
Maintenance
Access Control
System and Communications Protection
System and Information Integrity
Incident Response
Physical Protection
Identification and Authentication
Planning
System and Services Acquisition
Media Protection
Awareness and Training
Audit and Accountability
Supply Chain Risk Management
Configuration Management
Personnel Security
Security Assessment


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for Identification and Authentication?

[Assistant]
According to Assessing Enhanced Security Requirements for Controlled Unclassified Information:

| CHAPTERONE INTRODUCTION...................................................................................................... | CHAPTERONE INTRODUCTION...................................................................................................... | 1   |
|-----------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------|-----|
| 1.1                                                                                | PURPOSEANDAPPLICABILITY............................................................................................................. 1        | 2   |
| 1.2                                                                                | TARGET AUDIENCE.............................................................................................................................. |     |
| 1.3                                                                                | ORGANIZATIONOF THIS SPECIAL PUBLICATION................................................................................. | 2   |
| CHAPTERTWO THE FUNDAMENTALS............................................................................................ | CHAPTERTWO THE FUNDAMENTALS............................................................................................ | 3   |
| 2.1                                                                                | ASSESSMENT PROCEDURES................................................................................................................

Assessing Enhanced Security Requirements for Controlled Unclassified Information


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Audit and Accountability?

[Assistant]
According to Zero Trust Architecture:

| | | 3.2.2.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Summary of NIST SP 800-53, Revision 4_ Security and Privacy Controls for Federal Information Systems and Organizations provide? (Part 9)

[Assistant]
tise, and understanding. Appendix E provides three tables that identify specific assurance-related controls that are included in the low-, moderate-, and high-impact baselines described in Appendix D.
The controls described assist organizations in defining the controls needed to satisfy minimum assurance requirements. Where additional assurance is desired to achieve risk management objectives, Table E-4 provides additional security controls and control enhancements to achieve enhanced assurance. Implementers should note that designation of assurance-related controls is not intended to imply a greater level of importance for such controls. Achieving adequate security for organizational information systems requires the correct combination of both functionality- and assurance-related security controls. ## 6 Security Controls

Appendix F, the Security Control Catalog, provides a comprehensive range of countermeasures for organizations and information systems. The security controls are designed to be technologyneutral such that the focus is on the fundamental countermeasures needed to protect organizational information during processing, storage, or transmission. SP 800-53 Rev. 4, therefore, does not provide guidance on the application of security controls to specific technologies, environments of operation, or missions/business functions. These specific areas may be addressed using overlays (see below). Control enhancements are included with many security controls and are selected in order to increase the strength of the base control. Control enhancements are intended to be implemented only in conjunction with implementation of the base control. Some security controls and control enhancements include one or more assignment and selection statements. These are variable parameters that organizations define, providing them with the ability to tailor security controls based on specific security requirements, environments of operation, and organizational risk tolerance.

Summary of NIST SP 800-53, Revision 4_ Security and Privacy Controls for Federal Information Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Summary of NIST SP 800-53, Revision 4_ Security and Privacy Controls for Federal Information Systems and Organizations provide? (Part 7)

[Assistant]
ibed in NIST SP 800-39. To ensure that an appropriate set of controls is identified to provide security commensurate with risk, organizations tailor the controls to align with specific security needs.
Organizations may perform tailoring at the organization level for all information systems, in support of a particular line of business or mission/business process, at the individual information system level, or by using a combination of the above. The tailoring process is comprised of several steps, as described in SP 800-53 Rev. 4 Section 3.2. These actions include:

- Identifying and designating common controls - controls that may be inherited by one or more information systems. If an information system inherits a common control, such as environmental controls within a data center, that system does not need to explicitly implement that control. - Applying scoping considerations - these, when applied in conjunction with risk management guidance, can eliminate unnecessary security controls from the initial security control baselines and help ensure that organizations select only those controls needed to provide the appropriate level of protection for information systems. When scoping considerations are applied, compensating controls may need to be selected to provide alternative means to achieve security requirements. - Supplementing baselines - additional security controls and control enhancements are selected if needed to address specific threats and vulnerabilities. ## 4 Documenting the Control Selection Process

To aid in review activities, security planning, and risk assessments, organizations document the relevant decisions taken during the security control selection process, providing a sound rationale for those decisions. This documentation is essential when examining the security considerations for organizational information systems with respect to the potential impact on an organization's mission and business.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Zero Trust Architecture provide? (Part 8)

[Assistant] ## Tabla de contenidos | 1 INTRODUCCIÓN..................................................................................................................................................10 | 1 INTRODUCCIÓN..................................................................................................................................................10 | 1 INTRODUCCIÓN..................................................................................................................................................10 | |---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------| | 1.1 | HISTORIA DE LOS PROGRAMAS DE CONFIANZA CERO RELACIONADOS CON LAS AGENCIAS FEDERALES .................................11 | | | 1.2 | E STRUCTURA DEL DOCUMENTO .........................................................................................................................12 | | | CONCEPTOS BÁSICOS DE LA CONFIANZA CERO.................................................................................................13 | CONCEPTOS BÁSICOS DE LA CONFIANZA CERO.................................................................................................13 | | | 2.1 | PRINCIPIOS DE LA CONFIANZA CERO ....................................................................................................................15 | | | 2.2 | VISIÓN DE CONFIANZA CERO DE UNA RED .............................................................................................................17 | | | COMPONENTES LÓGICOS DE LA ARQUITECTURA DE CONFIANZA CERO..........................................................19 | COMPONENTES LÓGICOS DE LA ARQUITECTURA DE CONFIANZA CERO..........................................................19 | | | 3.1 VARIACIONES DE LOS ENFOQUES DE LA ARQUITECTURA DE CONFIANZA CERO ...............................................................21 | 3.1 VARIACIONES DE LOS ENFOQUES DE LA ARQUITECTURA DE CONFIANZA CERO ...............................................................21 | | | 3.1.1 | ZTA basada en una gobernanza de la identidad mejorada...................................................................22 | | | 3.1.2 | ZTA y el uso de la microsegmentación..................................................................................................23 | | | 3.1.3 | ZTA y el uso de una infraestructura de red y perímetros definidos a través de software....................23 | | | 3.2 | VARIANTES IMPLEMENTADAS DE LA ARQUITECTURA ABSTRACTA ...............................................................................24 | | | 3.2.1 | Despliegue basado en agentes y puertas de


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] How does Protecting Controlled Unclassified Information (CUI)_ NIST Special Publication 800-171, Revision 3. Small Business Primer support CMMC certification?

[Assistant]
According to Protecting Controlled Unclassified Information (CUI)_ NIST Special Publication 800-171, Revision 3. Small Business Primer:

<!-- image -->

<!-- image -->

Howard Lutnick, Secretary of Commerce

<!-- image -->

Protecting Controlled Unclassified Information (CUI): NIST Special Publication 800-171, Revision 3 Small Business Primer

## Purpose of this Primer

This guide provides small businesses with an overview of NIST Special Publication (SP) 800-171 Revision 3, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations . The following pages contain:

- An overview of foundational components of SP 800-171
- A list of frequently asked questions and their answers
- Tips for getting started
- Related resources

## What is Controlled Unclassified Information (CUI)?*

CUI is information the government creates or possesses, or that an entity creates or possesses on behalf of the government, that law, regulation, or governmentwide policy requires you to take technical and operational steps to protect. Systems that process, store, and transmit CUI often support government programs involving sensitive critical assets. As part of a contractual agreement with the federal government, or possibly with other organizations like municipal governments, prime contractors, universities, etc., you will likely be required to demonstrate you are taking adequate measures to protect CUI.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for Security Assessment?

[Assistant]
According to Protecting Controlled Unclassified Information (CUI)_ NIST Special Publication 800-171, Revision 3. Small Business Primer:

| Access Control                    | Maintenance         | Security Assessment and Monitoring   |
|-----------------------------------|---------------------|--------------------------------------|
| Awareness and Training            | Media Protection    | System and Communications Protection |
| Audit and Accountability          | Personnel Security  | System and Information Integrity     |
| Configuration Management          | Physical Protection | Planning                             |
| Identification and Authentication | Risk Assessment     | System and Services Acquisition      |
| Incident Response                 |                     | Supply Chain Risk Management         |

Below is an example of the Incident Response Testing requirement, which is part of the Incident Response (IR) family. The structure and content of a typical security requirement includes:

ODPs support consistent security assessments in determining whether security requirements have been satisfied. If a federal agency or a consortium of agencies do not specify a particular value or range of values for an ODP, nonfederal organizations must assign the value or values to complete the security requirement.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for Personnel Security?

[Assistant]
According to Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171:

| CHAPTERONE INTRODUCTION...................................................................................................... | CHAPTERONE INTRODUCTION...................................................................................................... |
|--------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------|
| 1.1 PURPOSEANDAPPLICABILITY                                                                                | ................................................................................................... 3                                            |
| 1.2 TARGET AUDIENCE                                                                                | .................................................................................................................. 4                             |
| 1.3 ORGANIZATIONOF THIS SPECIAL PUBLICATION                                                                                | .......................................................................... 4                                                                     |
| CHAPTERTWO THE FUNDAMENTALS............................................................................................ 5                        | CHAPTERTWO THE FUNDAMENTALS............................................................................................ 5                        |
| 2.1 DEVELOPMENTAPPROACH ......................................................................................................


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for Audit and Accountability?

[Assistant]
According to Protecting Controlled Unclassified Information (CUI)_ NIST Special Publication 800-171, Revision 3. Small Business Primer:

| Access Control                    | Maintenance         | Security Assessment and Monitoring   |
|-----------------------------------|---------------------|--------------------------------------|
| Awareness and Training            | Media Protection    | System and Communications Protection |
| Audit and Accountability          | Personnel Security  | System and Information Integrity     |
| Configuration Management          | Physical Protection | Planning                             |
| Identification and Authentication | Risk Assessment     | System and Services Acquisition      |
| Incident Response                 |                     | Supply Chain Risk Management         |

| Identify the role(s) responsible for security and provide the necessary resources. | Whether it is just one person or multiple people within the business, ensure roles, responsibilities, and authorities related to cybersecurity risk management are established, communicated, understood, and enforced. Even if cybersecurity activities are outsourced to an external provider, someone within the business should still be designated to manage cybersecurity risk.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for Identification and Authentication?

[Assistant]
According to Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171:

............................................ 5                        |
| 2.1 DEVELOPMENTAPPROACH ......................................................................................................
| 5                                                                                |
| 2.2 ORGANIZATIONANDSTRUCTURE                                                                                | ............................................................................................. 7                                                  |
| 2.3 FLEXIBLE APPLICATION                                                                                | ............................................................................................................. 9                                  |
| CHAPTER THREE THE REQUIREMENTS......................................................................................... 11                       | CHAPTER THREE THE REQUIREMENTS......................................................................................... 11                       |
| 3.1 ACCESSCONTROL                                                                                | .................................................................................................................. 12                            |
| 3.2 AWARENESSANDTRAINING                                                                                | ...................................................................................................


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Summary of NIST SP 800-53, Revision 4_ Security and Privacy Controls for Federal Information Systems and Organizations provide? (Part 7)

[Assistant]
ibed in NIST SP 800-39. To ensure that an appropriate set of controls is identified to provide security commensurate with risk, organizations tailor the controls to align with specific security needs.
Organizations may perform tailoring at the organization level for all information systems, in support of a particular line of business or mission/business process, at the individual information system level, or by using a combination of the above. The tailoring process is comprised of several steps, as described in SP 800-53 Rev. 4 Section 3.2. These actions include:

- Identifying and designating common controls - controls that may be inherited by one or more information systems. If an information system inherits a common control, such as environmental controls within a data center, that system does not need to explicitly implement that control. - Applying scoping considerations - these, when applied in conjunction with risk management guidance, can eliminate unnecessary security controls from the initial security control baselines and help ensure that organizations select only those controls needed to provide the appropriate level of protection for information systems. When scoping considerations are applied, compensating controls may need to be selected to provide alternative means to achieve security requirements. - Supplementing baselines - additional security controls and control enhancements are selected if needed to address specific threats and vulnerabilities. ## 4 Documenting the Control Selection Process

To aid in review activities, security planning, and risk assessments, organizations document the relevant decisions taken during the security control selection process, providing a sound rationale for those decisions. This documentation is essential when examining the security considerations for organizational information systems with respect to the potential impact on an organization's mission and business.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for Risk Assessment?

[Assistant]
According to Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171:

Advanced Persistent Threat; Basic Security Requirement; Contractor Systems; Controlled Unclassified Information; CUI Registry; Derived Security Requirement; Enhanced Security Requirement; Executive Order 13556; FIPS Publication 199; FIPS Publication 200; FISMA; NIST Special Publication 800-53; Nonfederal Organizations; Nonfederal Systems; Security Assessment; Security Control; Security Requirement. This publication is a supplement to NIST Special Publication 800-171 [SP 800-171]. It contains recommendations  for  enhanced  security  requirements  to  provide  additional  protection  for Controlled Unclassified Information (CUI) in nonfederal systems and organizations when such information is  associated  with critical  programs  or  high  value  assets. The  enhanced  security requirements are designed to respond to the advanced persistent threat (APT) and supplement the basic and derived security requirements in [SP 800-171]. While the security requirements in [SP 800-171] focus primarily on confidentiality protection, the enhanced security requirements in this publication address confidentiality, integrity, and availability protection. The enhanced security requirements are implemented in addition to the basic and derived requirements since those requirements are not designed to address the APT. The enhanced security requirements apply to those components of nonfederal systems that process, store, or transmit CUI or that provide protection for such components. There is no expectation that all of the enhanced security requirements will be selected by federal agencies implementing this guidance. The decision to select a particular set of enhanced security requirements will be based on the mission and business needs of federal agencies and guided and informed by ongoing risk assessments.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Incident Response?

[Assistant]
According to Risk Management Framework for Information Systems and Organizations_ A System Life Cycle Approach for Security and Privacy:

Risk assessments are also conducted to determine the potential that the use of an external provider for the development, implementation, maintenance, management, operation, or disposition of a system, system element, or service could create a loss, and the potential impact of that loss. The impact may be immediate (e.g., physical theft) or on-going (e.g., the ability of adversaries to replicate critical equipment because of theft). The impact may be endemic (e.g., limited to a single system) or systemic (e.g., including any system that uses a specific type of system component). Supply chain risk assessments consider vulnerabilities which may arise related to the disposition of a system or system element and from the use of external providers. Vulnerabilities in the supply chain may include a lack of traceability or accountability leading to the potential use of counterfeits, insertion of malware, or poor-quality systems. The use of external providers may result in a loss of visibility and control over how systems, system elements, and services are developed, deployed, and maintained. A clear understanding of the threats, vulnerabilities, and potential impacts of an adverse supply chain event can help organizations appropriately balance supply chain risk with risk tolerance. Supply chain risk assessments can include information from supplier audits, reviews, and supply chain intelligence. Organizations develop a strategy for collecting information, including a strategy for collaborating with providers on supply chain risk assessments. Such collaboration helps organizations leverage information from providers, reduce redundancy, identify potential courses of action for risk responses, and reduce the burden on providers.

Risk Management Framework for Information Systems and Organizations_ A System Life Cycle Approach for Security and Privacy


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Audit and Accountability?

[Assistant]
According to Summary of NIST SP 800-53, Revision 4_ Security and Privacy Controls for Federal Information Systems and Organizations:

- Authority and Purpose (AP);
- Accountability, Audit, and Risk Management (AR);
- Data Quality and Integrity (DI);
- Data Minimization and Retention (DM);
- Individual Participation and Redress (IP);
- Security (SE);
- Transparency (TR); and,
- Use Limitation (UL).


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice CM.L2-3.4.2 (NIST 3.4.2)?

[Assistant]
According to Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations:

3.4.2.

Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for System and Information Integrity?

[Assistant]
According to Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171:

This publication is a supplement to NIST Special Publication 800-171 [SP 800-171]. It contains recommendations  for  enhanced  security  requirements  to  provide  additional  protection  for Controlled Unclassified Information (CUI) in nonfederal systems and organizations when such information is  associated  with critical  programs  or  high  value  assets. The  enhanced  security requirements are designed to respond to the advanced persistent threat (APT) and supplement the basic and derived security requirements in [SP 800-171]. While the security requirements in [SP 800-171] focus primarily on confidentiality protection, the enhanced security requirements in this publication address confidentiality, integrity, and availability protection. The enhanced security requirements are implemented in addition to the basic and derived requirements since those requirements are not designed to address the APT. The enhanced security requirements apply to those components of nonfederal systems that process, store, or transmit CUI or that provide protection for such components. In addition to protecting CUI from unauthorized disclosure, the enhanced security requirements have been designed to protect the integrity and availability of CUI. This is achieved by promoting penetration-resistant architectures, damage-limiting operations, and designs to help achieve cyber resiliency and survivability. | CHAPTERONE INTRODUCTION...................................................................................................... | CHAPTERONE INTRODUCTION......................................................................................................


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Assessing Enhanced Security Requirements for Controlled Unclassified Information provide? (Part 3)

[Assistant]
may wish to closely follow the development of these new publications by NIST. Organizations are encouraged to review draft publications during the public comment periods and provide feedback to NIST.
Many NIST publications, other than the ones noted above, are available at https://csrc.nist.gov/publications. Submit comments on this publication to: sec-cert@nist.gov

National Institute of Standards and Technology Attn: Computer Security Division, Information Technology Laboratory 100 Bureau Drive (Mail Stop 8930) Gaithersburg, MD 20899-8930

All comments are subject to release under the Freedom of Information Act (FOIA) [FOIA96]. \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

## Reports on Computer Systems Technology

The NIST Information Technology Laboratory (ITL) promotes the U.S. economy and public welfare by providing technical leadership for the Nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, implementations, proofs of concept, and technical analyses to advance the development and productive use of information technology (IT). ITL's responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security of other than national security-related information in federal information systems. The Special Publication 800-series reports on ITL's research, guidelines, and outreach efforts in information systems security and privacy and its collaborative activities with industry, government, and academic organizations. ## Abstract

The protection of Controlled Unclassified Information (CUI) in nonfederal systems and organizations is important to federal agencies and can directly impact the ability of the Federal Government to successfully carry out its assigned missions and business operations.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171 provide? (Part 14)

[Assistant]
..................................................... 50                 | APPENDIX C MAPPINGTABLES ....................................................................................................
50                 |
| APPENDIXD ADVERSARY EFFECTS............................................................................................... 68                    | APPENDIXD ADVERSARY EFFECTS............................................................................................... 68                    |

\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

## Errata

This table contains changes that have been incorporated into Special Publication 800-172. Errata updates can include corrections, clarifications, or other minor changes in the publication that are either editorial or substantive in nature. Any potential updates for this document that are not yet published in an errata update or revision-including additional issues and potential corrections-will be posted as they are identified; see the SP 800-172 publication details. | DATE   | TYPE   | CHANGE   | PAGE   |
|--------|--------|----------|--------|

\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

## CHAPTER ONE

## INTRODUCTION

THE NEED TO PROTECT CONTROLLED UNCLASSIFIED INFORMATION

oday, more than at any time in history, the Federal Government relies on external service providers to help carry out a wide range of federal missions and business functions using information systems.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Risk Management Framework for Information Systems and Organizations_ A System Life Cycle Approach for Security and Privacy provide? (Part 3)

[Assistant]
d States. Attribution would, however, be appreciated by NIST. National Institute of Standards and Technology Special Publication 800-37, Revision 2 Natl. Inst. Stand. Technol. Spec. Publ. 800-37, Rev.
2, 183 pages (December 2018)

CODEN: NSPUE2

This publication is available free of charge from:

https://doi.org/10.6028/NIST.SP.800-37r2

Certain commercial entities, equipment, or materials may be identified in this document to describe an  experimental  procedure  or  concept  adequately. Such  identification  is  not  intended  to  imply recommendation or endorsement by NIST, nor is it intended to imply that the entities, materials, or equipment are necessarily the best available for the purpose. There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts, practices, and methodologies, may be used by federal agencies even before the completion  of  such  companion  publications. Thus,  until  each  publication  is  completed,  current requirements, guidelines, and procedures, where they exist, remain operative. For planning and transition purposes, federal agencies may wish to closely follow the development of these new publications by NIST. Organizations are encouraged to review draft publications during the designated public comment periods and provide feedback to NIST. Many NIST publications, other than the ones noted above, are available at https://csrc.nist.gov/publications. ## Comments on this publication may be submitted to:

National Institute of Standards and Technology Attn: Computer Security Division, Information Technology Laboratory 100 Bureau Drive (Mail Stop 8930) Gaithersburg, MD 20899-8930

Email: sec-cert@nist.gov

All comments are subject to release under the Freedom of Information Act (FOIA) [FOIA96].


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 2 require for Incident Response?

[Assistant]
According to Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations:

| Table 1. Security Requirement Families .......................................................................................................4          |
|----------------------------------------------------------------------------------------------------------------------------------------------------------|
| Table 2. Security Control Tailoring Criteria.................................................................................................93          |
| Table 3. Access Control (AC) .......................................................................................................................93   |
| Table 4. Awareness and Training (AT).........................................................................................................94          |
| Table 5. Audit and Accountability (AU).......................................................................................................95          |
| Table 6. Assessment, Authorization, and Monitoring (CA).........................................................................95                       |
| Table 7. Configuration Management (CM).................................................................................................96                |
| Table 8. Contingency Planning (CP) ............................................................................................................96        |
| Table 9. Identification and Authentication (IA) ..........................................................................................97             |
| Table 10. Incident Response (IR).................................................................................................................98      |
| Table 11. Maintenance (MA) ......................................................................................................................98      |
| Table 12.

Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Summary of NIST SP 800-53, Revision 4_ Security and Privacy Controls for Federal Information Systems and Organizations provide? (Part 13)

[Assistant]
n the risk tolerance of the organizations or communities of interest developing the overlays. General guidance on overlays is provided in section 3.3 and an overlay template is provided in Appendix I.
The template is included as an example only-organizations may choose to use other formats or modify the format in this appendix based on organizational needs and the type of overlay being developed. The level of detail included in the overlay is at the discretion of the organization initiating the overlay but should be of sufficient breadth and depth to provide an appropriate rationale and justification for the resulting tailored baseline developed, including any risk-based decisions made during the overlay development process. The sample overlay template consists of eight sections:

- Identification;
- Overlay Characteristics;
- Applicability;
- Overlay Summary;
- Detailed Overlay Control Specifications;
- Tailoring Considerations;
- Definitions; and
- Additional Information or Instructions. ## 9 Privacy

Federal agencies are required to ensure that privacy protections are incorporated into information security planning. To that end, SP 800-53 Rev. 4 features eight new families of privacy controls that are based on the internationally accepted Fair Information Practice Principles (FIPPs). The proliferation of social media, Smart Grid, mobile, and cloud computing, as well as the transition from structured to unstructured data and metadata environments, have added significant complexities and challenges for federal organizations in safeguarding privacy. These challenges extend well beyond the traditional information technology security view of protecting privacy, which focused primarily on ensuring confidentiality. The families of controls are described in a similar manner to those of Appendix F (Security Controls) and Appendix G (Information Security Programs Organization-Wide Information Security Program Management Controls). SP 800-53 Rev.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations provide? (Part 8)

[Assistant]
..........85                       |                                                                                |
| Appendix C.
| Tailoring Criteria ......................................................................................................93                         |                                                                                |
| Appendix D. | Organization-Defined Parameters ..........................................................................106                                       |                                                                                |
| Appendix E. | Change Log ............................................................................................................109                          |                                                                                |

## List of Tables

| Table 1. Security Requirement Families .......................................................................................................4          |
|----------------------------------------------------------------------------------------------------------------------------------------------------------|
| Table 2. Security Control Tailoring Criteria.................................................................................................93          |
| Table 3. Access Control (AC) .......................................................................................................................93   |
| Table 4. Awareness and Training (AT).........................................................................................................94          |
| Table 5.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Assessing Security and Privacy Controls in Information Systems and Organizations provide? (Part 5)

[Assistant]
__________

Acknowledgments

This publication was developed by the Joint Task Force Interagency Working Group. The group
includes representatives from the civil, defense, and intelligence communities.
The National
Institute of Standards and Technology wishes to acknowledge and thank the senior leaders from
the Department of Commerce, Department of Defense, the Office of the Director of National
Intelligence, the Committee on National Security Systems, and the members of the interagency
working group whose dedicated efforts contributed significantly to this publication. Department of Defense

HON. John Sherman
Chief Information Officer

Dr. Kelly Fletcher
Principal Deputy Chief Information Officer

David McKeown
Deputy CIO for Cybersecurity and DoD CISO

Mark Hakun
Principal Deputy CIO for Cybersecurity

Kevin Dulany
Director, Cybersecurity Policy and Partnerships

Office of the Director of National
Intelligence

Michael E. Waschull
Acting Chief Information Officer

Michael E. Waschull
Deputy Chief Information Officer

C. Matthew Conner
Cybersecurity Group and IC CISO

Cheri Benedict
Director, Security Coordination Center

National Institute of Standards and
Technology

Committee on National Security
Systems

James St. Pierre
Acting Director, Information Technology Laboratory (ITL)

Mark G. Hakun
Chair

Kevin Stine
Cybersecurity Advisor, ITL

Matthew Scholl
Chief, Computer Security Division

Kevin Stine
Chief, Applied Cybersecurity Division

Dominic A.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations provide? (Part 6)

[Assistant]
However, holders of patents are not obligated to respond to ITL calls for patents and ITL has not undertaken a patent search in order to identify which, if any, patents may apply to this publication.
As of the date of publication and following call(s) for the identification of patent claims whose use may be required for compliance with the guidance or requirements of this publication, no such patent claims have been identified to ITL. No representation is made or implied by ITL that licenses are not required to avoid patent infringement in the use of this publication. ## Table of Contents

| 1. Introduction..............................................................................................................................1      | 1. Introduction..............................................................................................................................1      | 1. Introduction..............................................................................................................................1      |
|-----------------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------|
| 2. The Fundamentals.....................................................................................................................3           | 2. The Fundamentals.....................................................................................................................3           | 2. The Fundamentals.....................................................................................................................3           |
| 3.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Incident Response?

[Assistant]
According to Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations:

...........................................................64                           |                                                                                |
| A.1.2.
Selecting, Tailoring, and Implementing C-SCRM Security Controls ...........................................67                                  |                                                                                |
| A.2.3. FAMILY: ACCESS CONTROL.........................................................................................................69              |                                                                                |
| A.2.4. FAMILY: AWARENESS AND TRAINING........................................................................................76                       |                                                                                |
| A.2.5. FAMILY: AUDIT AND ACCOUNTABILITY......................................................................................79                       |                                                                                |
| A.2.6. FAMILY: ASSESSMENT, AUTHORIZATION, AND MONITORING..................................................84                                          |                                                                                |
| A.2.7. FAMILY: CONFIGURATION MANAGEMENT................................................................................87                             |                                                                                |
| A.2.8. FAMILY: CONTINGENCY PLANNING ...........................................................................................98                     |                                                                                |
| A.2.9.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Configuration Management?

[Assistant]
According to Summary of NIST SP 800-53, Revision 4_ Security and Privacy Controls for Federal Information Systems and Organizations:

| 1 | Introduction ............................................................................................................1 | |------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------| | 2 | NIST SP 800-53 Revision 4 and the Risk Management Framework (RMF)........2 | | 3 | Control Baselines and Tailoring ...........................................................................4 | | 4 | Documenting the Control Selection Process ......................................................5 | | 5 | Assurance...............................................................................................................6 | | 6 | Security Controls ...................................................................................................7 | | 7 | International Information Security Standards .....................................................8 | | 8 | Overlays..................................................................................................................9 | | 9 | Privacy ..................................................................................................................10 | | List of Figures | List of Figures | | Figure 1: Risk Management 3-Tiered Approach.........................................................2 | Figure 1: Risk Management 3-Tiered Approach.........................................................2 | | Figure 2: The Risk Management Framework ..............................................................3 | Figure 2: The Risk Management Framework ..............................................................3 | | Figure 3: Security Control Selection Process ............................................................5 | Figure 3: Security Control Selection Process ............................................................5 |


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations provide? (Part 10)

[Assistant]
..................................................................115                  |                                                                                |
| A.2.13.
FAMILY: PHYSICAL AND ENVIRONMENTAL PROTECTION......................................................116                                        |                                                                                |
| A.2.14. FAMILY: PLANNING ................................................................................................................120          |                                                                                |
| A.2.15. FAMILY: PROGRAM MANAGEMENT ......................................................................................123                          |                                                                                |
| A.2.16. FAMILY: PERSONNEL SECURITY..............................................................................................129                   |                                                                                |
| A.2.17. FAMILY: PERSONALLY IDENTIFIABLE INFORMATION PROCESSING AND TRANSPARENCY                                                                       | ....132                                                                                |
| A.2.18. FAMILY: RISK ASSESSMENT....................................................................................................132                |                                                                                |
| A.2.19. FAMILY: SYSTEM AND SERVICES ACQUISITION......................................................................136                              |                                                                                |
| A.2.20.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Communications Protection?

[Assistant]
According to Incident Response Recommendations and Considerations for Cybersecurity Risk Management_ A CSF 2.0 Community Profile:

ent some incidents, prepare to handle incidents that do occur, reduce the impact of those incidents, and improve incident response and cybersecurity risk management practices based on lessons learned.
Detect, Respond, and Recover help organizations discover, manage, prioritize, contain, eradicate, and recover from cybersecurity incidents, as well as perform incident reporting, notification, and other incident-related communications.

Incident Response Recommendations and Considerations for Cybersecurity Risk Management_ A CSF 2.0 Community Profile


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Planning?

[Assistant]
According to Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations:

....................................................................................... | 63                                                                                |
| A.1.1.
C-SCRM Controls Summary........................................................................................................63              |                                                                                |
| A.1.1.1. C-SCRM Controls Throughout the Enterprise.......................................................................64                           |                                                                                |
| A.1.2. Selecting, Tailoring, and Implementing C-SCRM Security Controls ...........................................67                                  |                                                                                |
| A.2.3. FAMILY: ACCESS CONTROL.........................................................................................................69              |                                                                                |
| A.2.4. FAMILY: AWARENESS AND TRAINING........................................................................................76                       |                                                                                |
| A.2.5. FAMILY: AUDIT AND ACCOUNTABILITY......................................................................................79                       |                                                                                |
| A.2.6. FAMILY: ASSESSMENT, AUTHORIZATION, AND MONITORING..................................................84                                          |                                                                                |
| A.2.7.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Protecting Controlled Unclassified Information (CUI)_ NIST Special Publication 800-171, Revision 3. Small Business Primer provide? (Part 3)

[Assistant]
| help you take |

1  For more information on types of CUI and markings, visit the National Archives and Records Administration (NARA) https://www.archives.gov/cui.
ht ps:/

csrc.nist.gov/projects/protecting-control ed-unclas ified-information

## Overview

## Audience

<!-- image -->

<!-- image -->

Pages 2-6 provide a general overview of SP 800-171, R3 -helpful to business leaders or those new to SP 800-171. Pages 7-27 are for those who are tasked with managing the implementation SP 800-171. It is not all-encompassing, but it does provide tips and resources to help with getting started. This section serves as a bridge to the larger SP 800-171 publication. ## Key Term: Confidentiality

<!-- image -->

Confidentiality refers to the protection of information from unauthorized access and disclosure . *Definitions in this document are intended as plain language. View the official definition within 32 CFR Part 2002 "Controlled Unclassified Information."

## A Suite of Guidance

NIST's suite of CUI guidance (shown in the table below) focuses on protecting the confidentiality 2 of CUI in nonfederal systems and organizations and recommends specific security requirements to achieve that objective. This guide will focus on SP 800-171, Revision 3 . <!-- image -->

<!-- image -->

<!-- image -->

NIST SP 800-171, Protecting Controlled Unclassified Information in Nonfederal Systems is a set of recommended security requirements for protecting the confidentiality of CUI. NIST SP 800-171A, Assessing Security Requirements for Controlled Unclassified Information provides assessment procedures and a methodology to conduct assessments of the CUI security requirements in SP 800-171.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for Maintenance?

[Assistant]
According to Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171:

| CHAPTERONE INTRODUCTION...................................................................................................... | CHAPTERONE INTRODUCTION...................................................................................................... |
|--------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------|
| 1.1 PURPOSEANDAPPLICABILITY                                                                                | ................................................................................................... 3                                            |
| 1.2 TARGET AUDIENCE                                                                                | .................................................................................................................. 4                             |
| 1.3 ORGANIZATIONOF THIS SPECIAL PUBLICATION                                                                                | .......................................................................... 4                                                                     |
| CHAPTERTWO THE FUNDAMENTALS............................................................................................ 5                        | CHAPTERTWO THE FUNDAMENTALS............................................................................................ 5                        |
| 2.1 DEVELOPMENTAPPROACH ......................................................................................................


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations provide? (Part 14)

[Assistant]
istry [4]. The requirements do not apply to nonfederal organizations that are collecting or maintaining information on behalf of a federal agency or using or operating a system on behalf of an agency.
8

The security requirements in this publication are only applicable to components of nonfederal systems that process, store, or transmit CUI or that provide protection for such components. 9 The requirements are intended for use by federal agencies in contractual vehicles or other agreements that are established between those agencies and nonfederal organizations. Appropriately scoping requirements is an important factor in determining protection-related investment decisions and managing security risks for nonfederal organizations. If nonfederal organizations designate system components for the processing, storage, or transmission of CUI, those organizations may limit the scope of the security requirements by isolating the system components in a separate security domain. Isolation can be achieved by applying architectural and design concepts (e.g., implementing subnetworks with firewalls or other boundary protection devices and using information flow control mechanisms). Security domains may employ physical separation, logical separation, or a combination of both. This approach can provide adequate security for CUI and avoid increasing the organization's security posture beyond what it requires for protecting its missions, operations, and assets. ## 1.2. Organization of This Publication

The remainder of this special publication is organized as follows:

- Section 2 describes the assumptions and methodology used to develop the security requirements for protecting the confidentiality of CUI, the format of the requirements, and the tailoring criteria applied to the NIST guidelines to obtain the requirements. - Section 3 lists the security requirements for protecting the confidentiality of CUI in nonfederal systems and organizations.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171 provide? (Part 11)

[Assistant]
..................................................... 11                       | CHAPTER THREE THE REQUIREMENTS.........................................................................................
11                       |
| 3.1 ACCESSCONTROL                                                                                | .................................................................................................................. 12                            |
| 3.2 AWARENESSANDTRAINING                                                                                | ................................................................................................... 13                                           |
| 3.3 AUDIT ANDACCOUNTABILITY                                                                                | ................................................................................................. 14                                             |
| 3.4 CONFIGURATIONMANAGEMENT                                                                                | ........................................................................................... 14                                                   |
| 3.5 IDENTIFICATIONANDAUTHENTICATION                                                                                | ................................................................................. 16                                                             |
| 3.6 INCIDENT RESPONSE                                                                                | ..............................................................................................................


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for Identification and Authentication?

[Assistant]
According to Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171:

| CHAPTERONE INTRODUCTION...................................................................................................... | CHAPTERONE INTRODUCTION...................................................................................................... |
|--------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------|
| 1.1 PURPOSEANDAPPLICABILITY                                                                                | ................................................................................................... 3                                            |
| 1.2 TARGET AUDIENCE                                                                                | .................................................................................................................. 4                             |
| 1.3 ORGANIZATIONOF THIS SPECIAL PUBLICATION                                                                                | .......................................................................... 4                                                                     |
| CHAPTERTWO THE FUNDAMENTALS............................................................................................ 5                        | CHAPTERTWO THE FUNDAMENTALS............................................................................................ 5                        |
| 2.1 DEVELOPMENTAPPROACH ......................................................................................................


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Services Acquisition?

[Assistant]
According to Summary of NIST SP 800-53, Revision 4_ Security and Privacy Controls for Federal Information Systems and Organizations:

Information technologySecurity techniques-Information security management systems-Requirements and ISO/IEC 15408, Information technology -- Security techniques -- Evaluation criteria for IT security .
ISO/IEC 27001 applies to all types of organizations and specifies requirements for establishing, implementing, operating, monitoring, reviewing, maintaining, and improving a documented information security management system (ISMS) within the context of business risks. ISO/IEC 15408 (also known as the Common Criteria) provides functionality and assurance requirements for developers of information systems and information system components (i.e., information technology products). Since many of the technical security controls defined in Appendix F are implemented in hardware, software, and firmware components of information systems, organizations can obtain significant benefit from the acquisition and employment of information technology products evaluated against the requirements of ISO/IEC 15408. The use of such products can provide evidence that certain security controls are implemented correctly, operating as intended, and producing the desired effect in satisfying stated security requirements.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What guidance does Protecting Controlled Unclassified Information (CUI)_ NIST Special Publication 800-171, Revision 3. Small Business Primer provide?

[Assistant]
<!-- image -->

<!-- image -->

Howard Lutnick, Secretary of Commerce

<!-- image -->

Protecting Controlled Unclassified Information (CUI): NIST Special Publication 800-171, Revision 3 Small Business Primer

## Purpose of this Primer

This guide provides small businesses with an overview of NIST Special Publication (SP) 800-171 Revision 3, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations . The following pages contain:

- An overview of foundational components of SP 800-171
- A list of frequently asked questions and their answers
- Tips for getting started
- Related resources

## What is Controlled Unclassified Information (CUI)?*

CUI is information the government creates or possesses, or that an entity creates or possesses on behalf of the government, that law, regulation, or governmentwide policy requires you to take technical and operational steps to protect. Systems that process, store, and transmit CUI often support government programs involving sensitive critical assets. As part of a contractual agreement with the federal government, or possibly with other organizations like municipal governments, prime contractors, universities, etc., you will likely be required to demonstrate you are taking adequate measures to protect CUI.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Incident Response?

[Assistant]
According to Assessing Security and Privacy Controls in Information Systems and Organizations:

CHAPTER ONE INTRODUCTION ............................................................................................................... 1
1.1   PURPOSE AND APPLICABILITY .......................................................................................................... 1
1.2   TARGET AUDIENCE ............................................................................................................................ 4
1.3   RELATED PUBLICATIONS AND ASSESSMENT PROCESSES ............................................................... 4
1.4   ORGANIZATION OF THIS PUBLICATION ........................................................................................... 5
CHAPTER TWO THE FUNDAMENTALS ..................................................................................................... 6
2.1   ASSESSMENTS WITHIN THE SYSTEM DEVELOPMENT LIFE CYCLE .................................................. 6
2.2   CONTROL STRUCTURE AND ORGANIZATION .................................................................................. 7
2.3   BUILDING AN EFFECTIVE ASSURANCE CASE .................................................................................... 8
2.4   ASSESSMENT PROCEDURES: ASSESSMENT OBJECTS, METHODS AND OBJECTIVES ................... 11
CHAPTER THREE THE PROCESS ............................................................................................................. 19
3.1   PREPARE FOR SECURITY AND PRIVACY CONTROL ASSESSMENTS ............................................... 19
3.2   DEVELOP SECURITY AND PRIVACY ASSESSMENT PLANS .............................................................. 23
3.3   CONDUCT SECURITY AND PRIVACY CONTROL ASSESSMENTS ..................................................... 30
3.4   ANALYZE ASSESSMENT REPORT RESULTS .....................................................................................


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations provide? (Part 15)

[Assistant]
|     |
| D.3.1.10. Related Laws, Regulations, and Policies...........................................................................215                       |     |

| D.3.1.11.
Revision and Maintenance...............................................................................................215                                                                                |                                                                                |
|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------|
| D.3.1.12. C-SCRM Plan Approval......................................................................................................216                                                                                |                                                                                |
| D.3.1.13. Acronym List.....................................................................................................................216                                                                                |                                                                                |
| D.3.1.14.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does A Zero Trust Architecture Model for Access Control in Cloud-Native Applications in Multi-Cloud Environments provide? (Part 20)

[Assistant]
vices-Based Applications Using a Service Mesh [3], provides deployment guidance for building an authentication and authorization framework within the service mesh that meets the security requirements.
This may include establishing (1) zero trust by enabling mutual authentication in communication between any pair of services and (2) a robust access control mechanism based on an access control model (e.g., the attribute-based access control [ABAC] model) that can be used to express a wide set of policies and is scalable in terms of user base, objects (resources), and deployment environment. ## Scope

The scope of this document includes:

- Identifying the requirements for realizing a ZTA for granular access control in microservices-based application platforms that include a service mesh infrastructure. - Identifying the infrastructural elements that should be part of the platform in order to configure and implement ZT principles. - Guidance for deploying a ZTA in the above platform and outlining the security assurances that the deployment can provide. - Recommend multi-tier policies that combine network-level (both coarse-grained and fine-grained) and identity-tier policies for enforcing ZT principles. The reference application platform consists of microservices-based applications using a service mesh with sidecar proxies as the application services infrastructure. The service mesh technology variation that uses a sidecar-less approach is not considered as the deployment of this technology is still in early stages. ## Target Audience

This guidance is intended for security architects and infrastructure designers in organizations with a hybrid IT environment (consisting of both on-premises and multiple cloud-based applications) with a combination of legacy and microservices-based (i.e., cloud-native) applications and a built-in application services infrastructure, such as a service mesh.

A Zero Trust Architecture Model for Access Control in Cloud-Native Applications in Multi-Cloud Environments


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for Awareness and Training?

[Assistant]
According to Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171:

| CHAPTERONE INTRODUCTION...................................................................................................... | CHAPTERONE INTRODUCTION...................................................................................................... |
|--------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------|
| 1.1 PURPOSEANDAPPLICABILITY                                                                                | ................................................................................................... 3                                            |
| 1.2 TARGET AUDIENCE                                                                                | .................................................................................................................. 4                             |
| 1.3 ORGANIZATIONOF THIS SPECIAL PUBLICATION                                                                                | .......................................................................... 4                                                                     |
| CHAPTERTWO THE FUNDAMENTALS............................................................................................ 5                        | CHAPTERTWO THE FUNDAMENTALS............................................................................................ 5                        |
| 2.1 DEVELOPMENTAPPROACH ......................................................................................................


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Summary of NIST SP 800-53, Revision 4_ Security and Privacy Controls for Federal Information Systems and Organizations provide? (Part 6)

[Assistant]
following components: (i) a control section; (ii) a supplemental guidance section; (iii) a control enhancements section; (iv) a references section; and (v) a priority and baseline allocation section.
Figure 2: The Risk Management Framework

<!-- image -->

## 3 Control Baselines and Tailoring

To assist organizations in making the appropriate selection of security controls for information systems, the concept of security control baselines is introduced. Security control baselines are the starting point for the security control selection process and are chosen based on the security category and associated impact level of information systems determined in accordance with FIPS Publication 199 and FIPS Publication 200, respectively (Step One of the RMF). SP 800-53 Rev. 4 states that 'the security controls and control enhancements listed in the initial baselines are not a minimum- but rather a proposed starting point from which controls and controls enhancements may be removed or added.' Appendix D provides a listing of baseline security controls corresponding to the low-impact, moderate-impact, and high-impact information systems, using the high water mark defined in FIPS Publication 200. The security control baselines address the security needs of a broad and diverse set of constituencies, and are developed based on a number of general assumptions, including common environmental, operational, and functional considerations. The baselines also assume typical threats facing common information systems. Articulating the underlying assumptions is a key element in the initial risk framing step of the risk management process described in NIST SP 800-39. To ensure that an appropriate set of controls is identified to provide security commensurate with risk, organizations tailor the controls to align with specific security needs.