[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for Access Control?

[Assistant]
According to Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171:

- Applying a threat-centric approach to security requirements specification;
- Employing system and security architectures that support logical and physical isolation using system and network segmentation techniques, virtual machines, and containers; 16
- Implementing dual authorization controls for the most critical or sensitive operations;
- Limiting persistent storage to isolated enclaves or domains;
- Implementing a comply-to-connect approach for systems and networks;
- Extending configuration management requirements by establishing authoritative sources for addressing changes to systems and system components;
- Periodically refreshing or upgrading organizational systems and system components to a known state or developing new systems or components;
- Employing a security operations center with advanced analytics to support continuous monitoring and protection of organizational systems; and
- Using deception to confuse and mislead adversaries regarding the information they use for decision-making, the value and authenticity of the information they attempt to exfiltrate, or the environment in which they are operating.

| FAMILY                            | FAMILY                               |
|-----------------------------------|--------------------------------------|
| Access Control                    | Media Protection                     |
| Awareness and Training            | Personnel Security                   |
| Audit and Accountability          | Physical Protection                  |
| Configuration Management          | Risk Assessment                      |
| Identification and Authentication | Security Assessment                  |
| Incident Response                 | System and Communications Protection |
| Maintenance                       | System and Information Integrity     |

## 3.1   ACCESS CONTROL


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for Supply Chain Risk Management?

[Assistant]
According to Protecting Controlled Unclassified Information (CUI)_ NIST Special Publication 800-171, Revision 3. Small Business Primer:

deral agency to ensure that requirements to protect CUI are identified in applicable contracts or agreements, and CUI is marked by the federal agency. |
| How do I get a 'NIST SP 800 -171 Assessment'?
| The term 'NIST Assessment' and 'NIST SP 800 - 171 Assessment' is frequently used to describe the Department of Defense (DOD) proce ss used to complete its NIST SP 800-171 Assessment Module through the Supplier Performance Risk System (SPRS). NIST develops the underlying technical guidelines (SP 800-171, SP 800-171A, SP 800-172, and SP 800- 172A) on which the 'NIST Assessment' is based, but NIST does not have a role in DOD's implementation of its programs . For additional guidance on NIST's methodology to plan, prepare for, and conduct security requirement assessments, refer to SP 800-171A. |
| What products, vendors, or solutions are 'NIST SP 800 -171 compliant' or 'CMMC - certified'? | NIST does not identify or track implementation of or compliance with the security requirements. |
| What is the relationship between NIST and CMMC? | The Cybersecurity Maturity Model Certification (CMMC) is a DOD program that references the security requirements in NIST SP 800-171 and SP 800-172. NIST is not involved in the design, development, or implementation of the CMMCmodel, accreditation body, or certification process. It is important to note that CMMCis currently based on SP 800-171, Revision 2. Contractors should check for specific requirements in their contracts to understand which version they are required to use. |

Protecting Controlled Unclassified Information (CUI)_ NIST Special Publication 800-171, Revision 3. Small Business Primer


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Control Baselines for Information Systems and Organizations provide? (Part 18)

[Assistant]
| MAINTENANCEFAMILY ..........................................................................................................
| 32                                                                                |
| 3.10                                                                                | MEDIAPROTECTIONFAMILY ................................................................................................. | 33                                                                                |
| 3.11                                                                                | PHYSICALANDENVIRONMENTALPROTECTIONFAMILY .......................................................... | 34                                                                                |
| 3.12                                                                                | PLANNINGFAMILY ............................................................................................................... | 36                                                                                |
| 3.13                                                                                | PROGRAMMANAGEMENTFAMILY .......................................................................................

Control Baselines for Information Systems and Organizations

Risk Assessment
Maintenance
Access Control
System and Communications Protection
System and Information Integrity
Incident Response
Physical Protection
Identification and Authentication
Planning
System and Services Acquisition
Media Protection
Awareness and Training
Audit and Accountability
Supply Chain Risk Management
Configuration Management
Personnel Security
Security Assessment


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for Audit and Accountability?

[Assistant]
According to Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171:

| CHAPTERONE INTRODUCTION...................................................................................................... | CHAPTERONE INTRODUCTION...................................................................................................... |
|--------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------|
| 1.1 PURPOSEANDAPPLICABILITY                                                                                | ................................................................................................... 3                                            |
| 1.2 TARGET AUDIENCE                                                                                | .................................................................................................................. 4                             |
| 1.3 ORGANIZATIONOF THIS SPECIAL PUBLICATION                                                                                | .......................................................................... 4                                                                     |
| CHAPTERTWO THE FUNDAMENTALS............................................................................................ 5                        | CHAPTERTWO THE FUNDAMENTALS............................................................................................ 5                        |
| 2.1 DEVELOPMENTAPPROACH ......................................................................................................

Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Risk Assessment?

[Assistant]
According to Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations:

This publication provides guidance to organizations on identifying, assessing, and mitigating cybersecurity risks throughout the supply chain at all levels of their organizations. The publication integrates cybersecurity supply chain risk management (C-SCRM) into risk management activities by applying a multilevel, C-SCRM-specific approach, including guidance on the development of C-SCRM strategy implementation plans, C-SCRM policies, C-SCRM plans, and risk assessments for products and services. acquire; C-SCRM; cybersecurity supply chain; cybersecurity supply chain risk management; information and communication technology; risk management; supplier; supply chain; supply chain risk assessment; supply chain assurance; supply chain risk; supply chain security. | 3.4.3. Enhancing Practices....................................................................................................................49      |                                                                                |
|-------------------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------|
| 3.5.1. Measuring C-SCRM Through Performance Measures................................................................52                                |                                                                                |
| References.........................................................................................................................................57 |                                                                                |
| Appendix A. C-SCRM Security Controls...............................................................................................

Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Security and Privacy Controls for Information Systems and Organizations provide? (Part 8)

[Assistant]
tions in the public and private sectors, both
nationally and internationally, whose insightful and constructive comments improved the
overall quality, thoroughness, and usefulness of this publication.
HISTORICAL CONTRIBUTIONS TO NIST SPECIAL PUBLICATION 800-53

The authors wanted to acknowledge the many individuals who contributed to previous versions
of Special Publication 800-53 since its inception in 2005. They include Marshall Abrams, Dennis
Bailey, Lee Badger, Curt Barker, Matthew Barrett, Nadya Bartol, Frank Belz, Paul Bicknell, Deb
Bodeau, Paul Brusil, Brett Burley, Bill Burr, Dawn Cappelli, Roger Caslow, Corinne Castanza, Mike
Cooper, Matt Coose, Dominic Cussatt, George Dinolt, Randy Easter, Kurt Eleam, Denise Farrar,
Dave Ferraiolo, Cita Furlani, Harriett Goldman, Peter Gouldmann, Tim Grance, Jennifer Guild,
Gary  Guissanie,  Sarbari  Gupta,  Priscilla  Guthrie,  Richard  Hale,  Peggy  Himes,  Bennett  Hodge,
William Hunteman, Cynthia Irvine, Arnold Johnson, Roger Johnson, Donald Jones, Lisa Kaiser,
Stuart  Katzke,  Sharon  Keller,  Tom  Kellermann,  Cass  Kelly,  Eustace  King,  Daniel  Klemm,  Steve
LaFountain, Annabelle Lee, Robert Lentz, Steven Lipner, William MacGregor, Thomas Macklin,
Thomas Madden, Robert Martin, Erika McCallister, Tim McChesney, Michael McEvilley, Rosalie
McQuaid,  Peter  Mell,  John  Mildner,  Pam  Miller,  Sandra  Miravalle,  Joji  Montelibano,  Douglas
Montgomery, George Moore, Rama Moorthy, Mark Morrison, Harvey Newstrom, Sherrill Nicely,
Robert  Niemeyer,  LouAnna  Notargiacomo,  Pat  O’Reilly,  Tim  Polk,  Karen  Quigg,  Steve  Quinn,
Mark Riddle, Ed Roback, Cheryl Roby, George Rogers, Scott Rose, Mike Rubin, Karen Scarfone,
Roger  Schell,  Jackie  Snouffer,  Ray  Snouffer,  Murugiah  Souppaya,  Gary  Stoneburner,  Keith
Stouffer,  Marianne  Swanson,  Pat  Toth,  Glenda  Turner,  Patrick  Viscuso,  Joe  Weiss,  Richard
Wilsher, Mark Wilson, John Woodward, and Carol Woody.

Security and Privacy Controls for Information Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What guidance does Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations provide?

[Assistant]
<!-- image -->

## NIST Special Publication 800 NIST SP 800-171r3

## Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations

Ron Ross Victoria Pillitteri

This publication is available free of charge from:

https://doi.org/10.6028/NIST.SP.800-171r3

<!-- image -->

## NIST Special Publication 800 NIST SP 800-171r3

## Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations

Ron Ross Victoria Pillitteri Computer Security Division

Information Technology Laboratory

This publication is available free of charge from:

https://doi.org/10.6028/NIST.SP.800-171r3

May 2024

<!-- image -->

U.S. Department of Commerce Gina M. Raimondo, Secretary

Certain equipment, instruments, software, or materials, commercial or non-commercial, are identified in this paper in order to specify the experimental procedure adequately. Such identification does not imply recommendation or endorsement of any product or service by NIST, nor does it imply that the materials or equipment identified are necessarily the best available for the purpose. There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may be used by federal agencies even before the completion of such companion publications. Thus, until each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning and transition purposes, federal agencies may wish to closely follow the development of these new publications by NIST. Organizations are encouraged to review all draft publications during public comment periods and provide feedback to NIST. Many NIST cybersecurity publications, other than the ones noted above, are available at https://csrc.nist.gov/publications.

Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Physical Protection?

[Assistant]
According to Assessing Security and Privacy Controls in Information Systems and Organizations:

DEVELOPMENT LIFE CYCLE .................................................. 6
2.2   CONTROL STRUCTURE AND ORGANIZATION ..................................................................................
7
2.3   BUILDING AN EFFECTIVE ASSURANCE CASE .................................................................................... 8
2.4   ASSESSMENT PROCEDURES: ASSESSMENT OBJECTS, METHODS AND OBJECTIVES ................... 11
CHAPTER THREE THE PROCESS ............................................................................................................. 19
3.1   PREPARE FOR SECURITY AND PRIVACY CONTROL ASSESSMENTS ............................................... 19
3.2   DEVELOP SECURITY AND PRIVACY ASSESSMENT PLANS .............................................................. 23
3.3   CONDUCT SECURITY AND PRIVACY CONTROL ASSESSMENTS ..................................................... 30
3.4   ANALYZE ASSESSMENT REPORT RESULTS ..................................................................................... 32
3.5   ASSESS SECURITY AND PRIVACY CAPABILITIES .............................................................................. 34
CHAPTER FOUR SECURITY AND PRIVACY ASSESSMENT PROCEDURES ................................................. 37
4.1   ACCESS CONTROL............................................................................................................................ 40
4.2   AWARENESS AND TRAINING ........................................................................................................ 118
4.3   AUDIT AND ACCOUNTABILITY ...................................................................................................... 128
4.4   ASSESSMENT, AUTHORIZATION, AND MONITORING ................................................................. 160
4.5   CONFIGURATION MANAGEMENT ................................................................................................

Assessing Security and Privacy Controls in Information Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Physical Protection?

[Assistant]
According to Security and Privacy Controls for Information Systems and Organizations:

The National Institute of Standards and Technology (NIST) Information Technology Laboratory
(ITL) promotes the U.S. economy and public welfare by providing technical leadership for the
Nation’s measurement and standards infrastructure. ITL develops tests, test methods, reference
data, proof of concept implementations, and technical analyses to advance the development
and productive use of information technology (IT). ITL’s responsibilities include the development
of management, administrative, technical, and physical standards and guidelines for the cost-
effective security of other than national security-related information in federal information
systems. The Special Publication 800-series reports on ITL’s research, guidelines, and outreach
efforts in information systems security and privacy and its collaborative activities with industry,
government, and academic organizations. As we push computers to “the edge,” building an increasingly complex world of interconnected
systems and devices, security and privacy continue to dominate the national dialogue. There is
an urgent need to further strengthen the underlying systems, products, and services that we
depend on in every sector of the critical infrastructure to ensure that those systems, products,
and  services  are  sufficiently  trustworthy  and  provide  the  necessary  resilience  to  support  the
economic and national security interests of the United States. NIST Special Publication 800-53,
Revision 5, responds to this need by embarking on a proactive and systemic approach to develop
and make available to a broad base of public and private sector organizations a comprehensive
set of security and privacy safeguarding measures for all types of computing platforms, including
general  purpose  computing  systems,  cyber-physical  systems,  cloud  systems,  mobile  systems,
industrial control systems, and Internet of Things (IoT) devices.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What are the CMMC Level 2 requirements?

[Assistant]
According to Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations:

<!-- image -->

## NIST Special Publication 800 NIST SP 800-171r3

## Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations

Ron Ross Victoria Pillitteri

This publication is available free of charge from:

https://doi.org/10.6028/NIST.SP.800-171r3

<!-- image -->

## NIST Special Publication 800 NIST SP 800-171r3

## Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations

Ron Ross Victoria Pillitteri Computer Security Division

Information Technology Laboratory

This publication is available free of charge from:

https://doi.org/10.6028/NIST.SP.800-171r3

May 2024

<!-- image -->

U.S. Department of Commerce Gina M. Raimondo, Secretary

Certain equipment, instruments, software, or materials, commercial or non-commercial, are identified in this paper in order to specify the experimental procedure adequately. Such identification does not imply recommendation or endorsement of any product or service by NIST, nor does it imply that the materials or equipment identified are necessarily the best available for the purpose. There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may be used by federal agencies even before the completion of such companion publications. Thus, until each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning and transition purposes, federal agencies may wish to closely follow the development of these new publications by NIST. Organizations are encouraged to review all draft publications during public comment periods and provide feedback to NIST. Many NIST cybersecurity publications, other than the ones noted above, are available at https://csrc.nist.gov/publications.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Awareness and Training?

[Assistant]
According to Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations:

| 1. Introduction.....................................................................................................................................1   |
|---------------------------------------------------------------------------------------------------------------------------------------------------------|
| 1.4.1. Enterprise Risk Management and C-SCRM Owners and Operators.............................................5                                         |
| 1.4.2. Enterprise, Agency, and Mission and Business Process Owners and Operators .........................5                                             |
| 1.4.3. Acquisition and Procurement Owners and Operators.................................................................6                               |
| 1.4.4. Information Security, Privacy, or Cybersecurity Operators .........................................................6                             |
| 1.4.5. System Development, System Engineering, and System Implementation Personnel.................7                                                    |
| 1.5.1. Enterprise's Supply Chain.............................................................................................................9          |
| 1.5.2. Supplier Relationships Within Enterprises .................................................................................10                    |
| 2. Integration of C-SCRM Into Enterprise-Wide Risk Management...................................................... 18                                  |
| 2.3.1. Roles and Responsibilities Across the Three Levels ...................................................................24                         |
| 2.3.2. Level 1 -Enterprise...................................................................................................................27         |
| 2.3.3.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Audit and Accountability?

[Assistant]
According to Zero Trust Architecture:

| 1 INTRODUCCIÓN..................................................................................................................................................10 | 1 INTRODUCCIÓN..................................................................................................................................................10 | 1 INTRODUCCIÓN..................................................................................................................................................10 | |---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------| | 1.1 | HISTORIA DE LOS PROGRAMAS DE CONFIANZA CERO RELACIONADOS CON LAS AGENCIAS FEDERALES .................................11 | | | 1.2 | E STRUCTURA DEL DOCUMENTO .........................................................................................................................12 | | | CONCEPTOS BÁSICOS DE LA CONFIANZA CERO.................................................................................................13 | CONCEPTOS BÁSICOS DE LA CONFIANZA CERO.................................................................................................13 | | | 2.1 | PRINCIPIOS DE LA CONFIANZA CERO ....................................................................................................................15 | | | 2.2 | VISIÓN DE CONFIANZA CERO DE UNA RED .............................................................................................................17 | | | COMPONENTES LÓGICOS DE LA ARQUITECTURA DE CONFIANZA CERO..........................................................19 | COMPONENTES LÓGICOS DE LA ARQUITECTURA DE CONFIANZA CERO..........................................................19 | | | 3.1 VARIACIONES DE LOS ENFOQUES DE LA ARQUITECTURA DE CONFIANZA CERO ...............................................................21 | 3.1 VARIACIONES DE LOS ENFOQUES DE LA ARQUITECTURA DE CONFIANZA CERO ...............................................................21 | | | 3.1.1 | ZTA basada en una gobernanza de la identidad mejorada...................................................................22 | | | 3.1.2 | ZTA y el uso de la microsegmentación..................................................................................................23 | | | 3.1.3 | ZTA y el uso de una infraestructura de red y perímetros definidos a través de software....................23 | | | 3.2 | VARIANTES IMPLEMENTADAS DE LA ARQUITECTURA ABSTRACTA ...............................................................................24 | | | 3.2.1 | Despliegue basado en agentes y puertas de enlace de los dispositivos...............................................24


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for System and Information Integrity?

[Assistant]
According to Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171:

This publication is a supplement to NIST Special Publication 800-171 [SP 800-171]. It contains recommendations  for  enhanced  security  requirements  to  provide  additional  protection  for Controlled Unclassified Information (CUI) in nonfederal systems and organizations when such information is  associated  with critical  programs  or  high  value  assets. The  enhanced  security requirements are designed to respond to the advanced persistent threat (APT) and supplement the basic and derived security requirements in [SP 800-171]. While the security requirements in [SP 800-171] focus primarily on confidentiality protection, the enhanced security requirements in this publication address confidentiality, integrity, and availability protection. The enhanced security requirements are implemented in addition to the basic and derived requirements since those requirements are not designed to address the APT. The enhanced security requirements apply to those components of nonfederal systems that process, store, or transmit CUI or that provide protection for such components. In addition to protecting CUI from unauthorized disclosure, the enhanced security requirements have been designed to protect the integrity and availability of CUI. This is achieved by promoting penetration-resistant architectures, damage-limiting operations, and designs to help achieve cyber resiliency and survivability. | CHAPTERONE INTRODUCTION...................................................................................................... | CHAPTERONE INTRODUCTION......................................................................................................


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Risk Management Framework for Information Systems and Organizations_ A System Life Cycle Approach for Security and Privacy provide? (Part 2)

[Assistant]
y and Privacy

## JOINT TASK FORCE

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-37r2

## December 2018

<!-- image -->

U.S. Department of Commerce Wilbur L.
Ross, Jr., Secretary

National Institute of Standards and Technology Walter Copan, NIST Director and Under Secretary of Commerce for Standards and Technology

\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

## Authority

This publication has been developed by NIST to further its statutory responsibilities under the Federal Information Security Modernization Act (FISMA), 44 U.S.C. § 3551 et seq. , Public Law (P.L.) 113-283. NIST is responsible for developing information security standards and guidelines, including minimum requirements for federal information systems, but such standards and guidelines shall not apply to national security systems without the express approval of the appropriate federal officials exercising policy authority over such systems. This guideline is consistent with requirements of the Office of Management and Budget (OMB) Circular A-130. Nothing in this publication should be taken to contradict the standards and guidelines made mandatory and binding on federal agencies by the Secretary of Commerce under statutory authority. Nor should these guidelines be interpreted as altering or superseding the existing authorities of the Secretary of Commerce, OMB Director, or any other federal official. This publication may be used by nongovernmental organizations on a voluntary basis and is not subject to copyright in the United States. Attribution would, however, be appreciated by NIST. National Institute of Standards and Technology Special Publication 800-37, Revision 2 Natl. Inst. Stand. Technol. Spec. Publ. 800-37, Rev.

Risk Management Framework for Information Systems and Organizations_ A System Life Cycle Approach for Security and Privacy


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice IA.L2-3.5.1 (NIST 3.5.1)?

[Assistant]
According to Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations:

3.5.1. 3.5.1. 3.5.1.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Physical Protection?

[Assistant]
According to Assessing Security and Privacy Controls in Information Systems and Organizations:

The National Institute of Standards and Technology (NIST) Information Technology Laboratory
(ITL) promotes the U.S. economy and public welfare by providing technical leadership for the
Nation’s measurement and standards infrastructure. ITL develops tests, test methods, reference
data, proof of concept implementations, and technical analyses to advance the development
and productive use of information technology (IT). ITL’s responsibilities include the development
of management, administrative, technical, and physical standards and guidelines for the cost-
effective security of other than national security-related information in federal information
systems. The Special Publication 800-series reports on ITL’s research, guidelines, and outreach
efforts in information systems security and privacy and its collaborative activities with industry,
government, and academic organizations. CHAPTER ONE INTRODUCTION ............................................................................................................... 1
1.1   PURPOSE AND APPLICABILITY .......................................................................................................... 1
1.2   TARGET AUDIENCE ............................................................................................................................ 4
1.3   RELATED PUBLICATIONS AND ASSESSMENT PROCESSES ............................................................... 4
1.4   ORGANIZATION OF THIS PUBLICATION ........................................................................................... 5
CHAPTER TWO THE FUNDAMENTALS ..................................................................................................... 6
2.1   ASSESSMENTS WITHIN THE SYSTEM DEVELOPMENT LIFE CYCLE .................................................. 6
2.2   CONTROL STRUCTURE AND ORGANIZATION ..................................................................................


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for Awareness and Training?

[Assistant]
According to Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171:

| CHAPTERONE INTRODUCTION...................................................................................................... | CHAPTERONE INTRODUCTION...................................................................................................... |
|--------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------|
| 1.1 PURPOSEANDAPPLICABILITY                                                                                | ................................................................................................... 3                                            |
| 1.2 TARGET AUDIENCE                                                                                | .................................................................................................................. 4                             |
| 1.3 ORGANIZATIONOF THIS SPECIAL PUBLICATION                                                                                | .......................................................................... 4                                                                     |
| CHAPTERTWO THE FUNDAMENTALS............................................................................................ 5                        | CHAPTERTWO THE FUNDAMENTALS............................................................................................ 5                        |
| 2.1 DEVELOPMENTAPPROACH ......................................................................................................


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 2 require for Physical Protection?

[Assistant]
According to Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations:

...................94          |
| Table 5. Audit and Accountability (AU).......................................................................................................95          |
| Table 6.
Assessment, Authorization, and Monitoring (CA).........................................................................95                       |
| Table 7. Configuration Management (CM).................................................................................................96                |
| Table 8. Contingency Planning (CP) ............................................................................................................96        |
| Table 9. Identification and Authentication (IA) ..........................................................................................97             |
| Table 10. Incident Response (IR).................................................................................................................98      |
| Table 11. Maintenance (MA) ......................................................................................................................98      |
| Table 12. Media Protection (MP)................................................................................................................99        |
| Table 13. Physical and Environmental Protection (PE)...............................................................................99                    |
| Table 14. Planning (PL)..............................................................................................................................100 |
| Table 15. Program Management (PM) .....................................................................................................100               |
| Table 16. Personnel Security (PS) .............................................................................................................101       |
| Table 17.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for System and Services Acquisition?

[Assistant]
According to Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171:

........................................................................ | CHAPTERONE INTRODUCTION......................................................................................................
|
|--------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------|
| 1.1 PURPOSEANDAPPLICABILITY                                                                                | ................................................................................................... 3                                            |
| 1.2 TARGET AUDIENCE                                                                                | .................................................................................................................. 4                             |
| 1.3 ORGANIZATIONOF THIS SPECIAL PUBLICATION                                                                                | .......................................................................... 4                                                                     |
| CHAPTERTWO THE FUNDAMENTALS............................................................................................ 5                        | CHAPTERTWO THE FUNDAMENTALS............................................................................................ 5                        |
| 2.1 DEVELOPMENTAPPROACH ......................................................................................................


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Supply Chain Risk Management?

[Assistant]
According to Control Baselines for Information Systems and Organizations:

| DATE       | TYPE      | REVISION                                                                                |   PAGE |
|------------|-----------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------|
| 12-10-2020 | Editorial | Section 1.4: Change 'NIST SP 800-53 [SP 800-53]' to '[SP 800-53]'                                                                                |      3 |
| 12-10-2020 | Editorial | Section 2.4 (Footnote 26): Change 'See [SP 800-37], Task P-4.' to 'See [SP 800-37], Task P-4, Organizationally-Tailored Control Baselines and Cybersecurity Framework Profiles (Optional), for additional guidance on tailoring control baselines for organization- wide use.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] How does Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171 support CMMC certification?

[Assistant]
According to Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171:

systems, but such standards and guidelines shall not apply to national security systems without the express approval of the appropriate federal officials exercising policy authority over such systems.
This guideline is consistent with requirements of the Office of Management and Budget (OMB) Circular A-130. Nothing in this publication should be taken to contradict the standards and guidelines made mandatory and binding on federal agencies by the Secretary of Commerce under statutory authority. Nor should these guidelines be interpreted as altering or superseding the existing authorities of the Secretary of Commerce, OMB Director, or any other federal official. This publication may be used by nongovernmental organizations on a voluntary basis and is not subject to copyright in the United States. Attribution would, however, be appreciated by NIST. National Institute of Standards and Technology Special Publication 800-172 Natl. Inst. Stand. Technol. Spec. Publ. 800-172, 84 pages (February 2021)

CODEN: NSPUE2

This publication is available free of charge from:

https://doi.org/10.6028/NIST.SP.800-172

Certain  commercial  entities,  equipment,  or  materials  may  be  identified  in  this  document  to describe an experimental procedure or concept adequately. Such identification is not intended to imply recommendation or endorsement by NIST, nor is it intended to imply that the entities, materials, or equipment are necessarily the best available for the purpose. There may be references in this publication to other publications currently under development by  NIST  in  accordance  with  its  assigned  statutory  responsibilities. The  information  in  this publication, including concepts, practices, and methodologies, may be used by federal agencies even  before  the  completion  of  such  companion  publications. Thus,  until  each  publication  is completed,  current  requirements,  guidelines,  and  procedures,  where  they  exist,  remain operative.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does A Zero Trust Architecture Model for Access Control in Cloud-Native Applications in Multi-Cloud Environments provide? (Part 13)

[Assistant] | Advantages of Identity-Tier Policies.........................................................................19 | | | | Summary and Conclusions ............................................................................................20 | | | References ..............................................................................................................................23 | References ..............................................................................................................................23 | | | List of Figures | List of Figures | List of Figures | | Fig.

A Zero Trust Architecture Model for Access Control in Cloud-Native Applications in Multi-Cloud Environments


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Media Protection?

[Assistant]
According to Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations:

...........................................................64                           |                                                                                |
| A.1.2.
Selecting, Tailoring, and Implementing C-SCRM Security Controls ...........................................67                                  |                                                                                |
| A.2.3. FAMILY: ACCESS CONTROL.........................................................................................................69              |                                                                                |
| A.2.4. FAMILY: AWARENESS AND TRAINING........................................................................................76                       |                                                                                |
| A.2.5. FAMILY: AUDIT AND ACCOUNTABILITY......................................................................................79                       |                                                                                |
| A.2.6. FAMILY: ASSESSMENT, AUTHORIZATION, AND MONITORING..................................................84                                          |                                                                                |
| A.2.7. FAMILY: CONFIGURATION MANAGEMENT................................................................................87                             |                                                                                |
| A.2.8. FAMILY: CONTINGENCY PLANNING ...........................................................................................98                     |                                                                                |
| A.2.9.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for Awareness and Training?

[Assistant]
According to Protecting Controlled Unclassified Information (CUI)_ NIST Special Publication 800-171, Revision 3. Small Business Primer:

| Access Control                    | Maintenance         | Security Assessment and Monitoring   |
|-----------------------------------|---------------------|--------------------------------------|
| Awareness and Training            | Media Protection    | System and Communications Protection |
| Audit and Accountability          | Personnel Security  | System and Information Integrity     |
| Configuration Management          | Physical Protection | Planning                             |
| Identification and Authentication | Risk Assessment     | System and Services Acquisition      |
| Incident Response                 |                     | Supply Chain Risk Management         |

## Getting Started with Awareness and Training

## Family: Awareness and Training


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for Personnel Security?

[Assistant]
According to Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171:

| CHAPTERONE INTRODUCTION...................................................................................................... | CHAPTERONE INTRODUCTION...................................................................................................... |
|--------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------|
| 1.1 PURPOSEANDAPPLICABILITY                                                                                | ................................................................................................... 3                                            |
| 1.2 TARGET AUDIENCE                                                                                | .................................................................................................................. 4                             |
| 1.3 ORGANIZATIONOF THIS SPECIAL PUBLICATION                                                                                | .......................................................................... 4                                                                     |
| CHAPTERTWO THE FUNDAMENTALS............................................................................................ 5                        | CHAPTERTWO THE FUNDAMENTALS............................................................................................ 5                        |
| 2.1 DEVELOPMENTAPPROACH ......................................................................................................


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171 provide? (Part 20)

[Assistant]
and communications. Therefore, CUI that is processed, stored, or transmitted by any of the above systems related to a critical program or high value asset requires additional protection from the APT.
## 1.1   PURPOSE AND APPLICABILITY

The purpose of this publication is to provide federal agencies with a set of enhanced security requirements 9 for protecting the confidentiality , integrity , and availability of CUI: (1) when the CUI is resident in a nonfederal system and organization, (2) when the nonfederal organization is not collecting or maintaining information on behalf of a federal agency or using or operating a system on behalf of an agency, 10 and (3) where there are no specific safeguarding requirements for protecting the CUI prescribed by the authorizing law, regulation, or government-wide policy for the CUI category listed in the CUI Registry. 11 The enhanced security requirements address the protection of CUI by promoting: (1) penetration-resistant architecture, (2) damage-limiting operations, and (3) designs to achieve cyber resiliency and survivability. 12 The enhanced security requirements are intended to supplement the basic and derived security requirements in [SP 800-171] and are for use by federal agencies in contractual vehicles or other agreements established between those agencies and nonfederal organizations. The enhanced security requirements apply to components 13 of nonfederal systems that process, store, or transmit CUI associated with a critical program or a high value asset or that provide security protection for such components. If nonfederal organizations designate specific system components for the processing, storage, or transmission of CUI associated with a critical program or a high value asset, those organizations may limit the scope of the enhanced security requirements by isolating the designated system components in a separate CUI security domain.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for Supply Chain Risk Management?

[Assistant]
According to Assessing Enhanced Security Requirements for Controlled Unclassified Information:

| 3.11.6e   | ENHANCED SECURITY REQUIREMENT Assess, respond to, and monitor supply chain risks associated with organizational systems and system components. | ENHANCED SECURITY REQUIREMENT Assess, respond to, and monitor supply chain risks associated with organizational systems and system components.

Assessing Enhanced Security Requirements for Controlled Unclassified Information


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Personnel Security?

[Assistant]
According to Control Baselines for Information Systems and Organizations:

| CHAPTERONE INTRODUCTION...................................................................................................... 1               | CHAPTERONE INTRODUCTION...................................................................................................... 1               | CHAPTERONE INTRODUCTION...................................................................................................... 1   |
|-----------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------|
| 1.1                                                                                | PURPOSEANDAPPLICABILITY ................................................................................................... | 1                                                                                |
| 1.2                                                                                | TARGET AUDIENCE .................................................................................................................. | 2                                                                                |
| 1.3                                                                                | ORGANIZATIONAL RESPONSIBILITIES .........................................................................................


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AT.L2-3.2.5 (NIST 3.2.5)?

[Assistant]
According to Assessing Security and Privacy Controls in Information Systems and Organizations:

3.2.5   OPTIMIZE SELECTED ASSESSMENT PROCEDURES TO ENSURE MAXIMUM EFFICIENCY

Assessors have flexibility in organizing assessment plans that meet the needs of the organization
and that provide the best opportunity for obtaining the necessary evidence to determine
security or privacy control effectiveness while reducing overall assessment costs. 3.2.5.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Identification and Authentication?

[Assistant]
According to Control Baselines for Information Systems and Organizations:

| CHAPTERONE INTRODUCTION...................................................................................................... 1               | CHAPTERONE INTRODUCTION...................................................................................................... 1               | CHAPTERONE INTRODUCTION...................................................................................................... 1   |
|-----------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------|
| 1.1                                                                                | PURPOSEANDAPPLICABILITY ................................................................................................... | 1                                                                                |
| 1.2                                                                                | TARGET AUDIENCE .................................................................................................................. | 2                                                                                |
| 1.3                                                                                | ORGANIZATIONAL RESPONSIBILITIES .........................................................................................


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Information Integrity?

[Assistant]
According to Summary of NIST SP 800-53, Revision 4_ Security and Privacy Controls for Federal Information Systems and Organizations:

As the risk to an information system's confidentiality, integrity and/or availability increases, the need for additional controls to protect the system may also increase accordingly.  SP 800-53 Revision 4 provides the security control baselines as the starting point for the security control selection process. The baselines are chosen based on the security category and associated impact level of information systems as described in Federal Information Processing Standard Publication (FIPS) 199, Standards for Security Categorization of Federal Information and Information Systems, and FIPS Publication 200, Minimum Security Requirements for Federal Information and Information Systems .

- Authority and Purpose (AP);
- Accountability, Audit, and Risk Management (AR);
- Data Quality and Integrity (DI);
- Data Minimization and Retention (DM);
- Individual Participation and Redress (IP);
- Security (SE);
- Transparency (TR); and,
- Use Limitation (UL).

Summary of NIST SP 800-53, Revision 4_ Security and Privacy Controls for Federal Information Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Zero Trust Architecture provide? (Part 16)

[Assistant] Una única organización puede gestionar varias redes internas, oficinas remotas con su propia infraestructura local, personas a distancia o móviles y servicios en la nube. Esta complejidad ha superado los métodos tradicionales de seguridad de red perimetral, puesto que no existe un perímetro único y fácilmente identificable para la compañía. También, esta seguridad ha demostrado su insuficiencia, ya que una vez que los atacantes han traspasado la barrera, el movimiento lateral no tiene obstáculos. Esta difícil tarea ha impulsado el desarrollo de un nuevo modelo de ciberseguridad conocido como «confianza cero» (ZT, por su denominación en inglés zero trust ). El enfoque ZT se centra, fundamentalmente, en la protección de los datos y los servicios, pero puede y debe ampliarse para incluir todos los activos de la empresa (dispositivos, aplicaciones, componentes de infraestructura, virtuales y de la nube) y los sujetos (usuarios finales, aplicaciones y otras entidades no humanas que solicitan información de los recursos). A lo largo de este documento, se utilizará la palabra sujeto a menos que la sección se refiera directamente a un usuario final humano, en cuyo caso, se utilizará específicamente usuario en lugar del término más genérico sujeto . Los modelos de seguridad de confianza cero parten de la base de que el atacante está presente en el entorno y que el ambiente de la compañía no es diferente (o no es más confiable) a cualquier otro que no sea de la organización. En este nuevo paradigma, se debe asumir que no hay seguridad implícita. Se deben analizar y evaluar continuamente los riesgos para los activos y actividades corporativas y luego promulgar protecciones para mitigarlos. En la confianza cero, estas protecciones implican, por lo general, restringir el acceso a los recursos (como los datos, los medios informáticos y las aplicaciones o servicios) solo a aquellos sujetos y activos identificados como necesarios para el acceso.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171 provide? (Part 9)

[Assistant]
ework for Improving Critical Infrastructure Cybersecurity [NIST CSF] can find in Appendix C a mapping of the enhanced security requirements in this publication to the security controls in [SP 800-53].
The security control mappings can be useful to organizations that wish to demonstrate compliance to the security requirements in the context of their established information security programs when such programs have been built using the NIST security controls. \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

## Table of Contents

| CHAPTERONE INTRODUCTION...................................................................................................... | CHAPTERONE INTRODUCTION...................................................................................................... |
|--------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------|
| 1.1 PURPOSEANDAPPLICABILITY                                                                                | ................................................................................................... 3                                            |
| 1.2 TARGET AUDIENCE                                                                                | ..................................................................................................................


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for Awareness and Training?

[Assistant]
According to Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171:

| CHAPTERONE INTRODUCTION...................................................................................................... | CHAPTERONE INTRODUCTION...................................................................................................... |
|--------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------|
| 1.1 PURPOSEANDAPPLICABILITY                                                                                | ................................................................................................... 3                                            |
| 1.2 TARGET AUDIENCE                                                                                | .................................................................................................................. 4                             |
| 1.3 ORGANIZATIONOF THIS SPECIAL PUBLICATION                                                                                | .......................................................................... 4                                                                     |
| CHAPTERTWO THE FUNDAMENTALS............................................................................................ 5                        | CHAPTERTWO THE FUNDAMENTALS............................................................................................ 5                        |
| 2.1 DEVELOPMENTAPPROACH ......................................................................................................


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Awareness and Training?

[Assistant]
According to Summary of NIST SP 800-53, Revision 4_ Security and Privacy Controls for Federal Information Systems and Organizations:

The security control baselines address the security needs of a broad and diverse set of constituencies, and are developed based on a number of general assumptions, including common environmental, operational, and functional considerations. The baselines also assume typical threats facing common information systems.  Articulating the underlying assumptions is a key element in the initial risk framing step of the risk management process described in NIST SP 800-39.  To ensure that an appropriate set of controls is identified to provide security commensurate with risk, organizations tailor the controls to align with specific security needs. Organizations may perform tailoring at the organization level for all information systems, in support of a particular line of business or mission/business process, at the individual information system level, or by using a combination of the above. The tailoring process is comprised of several steps, as described in SP 800-53 Rev. 4 Section 3.2.  These actions include:


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Maintenance?

[Assistant]
According to Risk Management Framework for Information Systems and Organizations_ A System Life Cycle Approach for Security and Privacy:

This publication contains comprehensive updates to the Risk Management Framework . The updates include an alignment with the constructs in the NIST Cybersecurity Framework; the integration of privacy risk management processes; an alignment with system life cycle security engineering processes; and the incorporation of supply chain  risk  management  processes. Organizations  can use the frameworks and processes in a complementary manner within the RMF to effectively manage security and  privacy risks to organizational  operations  and assets, individuals, other organizations, and the Nation. Revision 2 includes a set of organization-wide RMF tasks that are designed to prepare information system owners to conduct system-level risk management activities. The intent  is  to  increase  the  effectiveness,  efficiency,  and cost-effectiveness  of  the  RMF  by  establishing  a  closer connection to the organization's missions and business functions  and  improving  the  communications  among senior leaders, managers, and operational personnel. * Note: The publication pertains to information systems, which are discrete sets of information resources organized  for  the  collection,  processing,  maintenance,  use,  sharing,  dissemination,  or  disposition  of information, whether such information is in digital or non-digital form. Information resources include information and related resources, such as personnel, equipment, funds, and information technology. Therefore, information systems may or may not include hardware, firmware, and software. This publication is intended to help organizations manage security and privacy risk, and to satisfy the requirements in the Federal Information Security Modernization Act of 2014 (FISMA), the Privacy Act of 1974, OMB policies, and Federal Information Processing Standards, among other laws,  regulations,  and  policies.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Audit and Accountability?

[Assistant]
According to Assessing Security and Privacy Controls in Information Systems and Organizations:

DEVELOPMENT LIFE CYCLE .................................................. 6
2.2   CONTROL STRUCTURE AND ORGANIZATION ..................................................................................
7
2.3   BUILDING AN EFFECTIVE ASSURANCE CASE .................................................................................... 8
2.4   ASSESSMENT PROCEDURES: ASSESSMENT OBJECTS, METHODS AND OBJECTIVES ................... 11
CHAPTER THREE THE PROCESS ............................................................................................................. 19
3.1   PREPARE FOR SECURITY AND PRIVACY CONTROL ASSESSMENTS ............................................... 19
3.2   DEVELOP SECURITY AND PRIVACY ASSESSMENT PLANS .............................................................. 23
3.3   CONDUCT SECURITY AND PRIVACY CONTROL ASSESSMENTS ..................................................... 30
3.4   ANALYZE ASSESSMENT REPORT RESULTS ..................................................................................... 32
3.5   ASSESS SECURITY AND PRIVACY CAPABILITIES .............................................................................. 34
CHAPTER FOUR SECURITY AND PRIVACY ASSESSMENT PROCEDURES ................................................. 37
4.1   ACCESS CONTROL............................................................................................................................ 40
4.2   AWARENESS AND TRAINING ........................................................................................................ 118
4.3   AUDIT AND ACCOUNTABILITY ...................................................................................................... 128
4.4   ASSESSMENT, AUTHORIZATION, AND MONITORING ................................................................. 160
4.5   CONFIGURATION MANAGEMENT ................................................................................................


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Risk Assessment?

[Assistant]
According to Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations:

|
| Appendix A. C-SCRM Security Controls...............................................................................................
| 63                                                                                |
| A.1.1. C-SCRM Controls Summary........................................................................................................63              |                                                                                |
| A.1.1.1. C-SCRM Controls Throughout the Enterprise.......................................................................64                           |                                                                                |
| A.1.2. Selecting, Tailoring, and Implementing C-SCRM Security Controls ...........................................67                                  |                                                                                |
| A.2.3. FAMILY: ACCESS CONTROL.........................................................................................................69              |                                                                                |
| A.2.4. FAMILY: AWARENESS AND TRAINING........................................................................................76                       |                                                                                |
| A.2.5. FAMILY: AUDIT AND ACCOUNTABILITY......................................................................................79                       |                                                                                |
| A.2.6.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Supply Chain Risk Management?

[Assistant]
According to Summary of NIST SP 800-53, Revision 4_ Security and Privacy Controls for Federal Information Systems and Organizations:

SP 800-53 Revision 4 has been updated to reflect the evolving technology and threat space. Example areas include issues particular to mobile and cloud computing; insider threats; applications security; supply chain risks; advanced persistent threat; and trustworthiness, assurance, and resilience of information systems. The revision also contains a new appendix of privacy controls, and related implementation guidance (Appendix J), based on the Fair Information Practice Principles (FIPPs), a widely accepted framework of defining principles to be used in the evaluation and consideration of systems, processes, or programs that affect individual privacy.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for System and Communications Protection?

[Assistant]
According to Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171:

| CHAPTERONE INTRODUCTION...................................................................................................... | CHAPTERONE INTRODUCTION...................................................................................................... |
|--------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------|
| 1.1 PURPOSEANDAPPLICABILITY                                                                                | ................................................................................................... 3                                            |
| 1.2 TARGET AUDIENCE                                                                                | .................................................................................................................. 4                             |
| 1.3 ORGANIZATIONOF THIS SPECIAL PUBLICATION                                                                                | .......................................................................... 4                                                                     |
| CHAPTERTWO THE FUNDAMENTALS............................................................................................ 5                        | CHAPTERTWO THE FUNDAMENTALS............................................................................................ 5                        |
| 2.1 DEVELOPMENTAPPROACH ......................................................................................................


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for Media Protection?

[Assistant]
According to Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171:

| FAMILY                            | FAMILY                               |
|-----------------------------------|--------------------------------------|
| Access Control                    | Media Protection                     |
| Awareness and Training            | Personnel Security                   |
| Audit and Accountability          | Physical Protection                  |
| Configuration Management          | Risk Assessment                      |
| Identification and Authentication | Security Assessment                  |
| Incident Response                 | System and Communications Protection |
| Maintenance                       | System and Information Integrity     |

17  The Audit and Accountability, Maintenance, Media Protection, and Physical Protection families do not contain enhanced security requirements at this time.

## 3.8   MEDIA PROTECTION


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Supply Chain Risk Management?

[Assistant]
According to Assessing Security and Privacy Controls in Information Systems and Organizations:

CHAPTER ONE INTRODUCTION ............................................................................................................... 1
1.1   PURPOSE AND APPLICABILITY .......................................................................................................... 1
1.2   TARGET AUDIENCE ............................................................................................................................ 4
1.3   RELATED PUBLICATIONS AND ASSESSMENT PROCESSES ............................................................... 4
1.4   ORGANIZATION OF THIS PUBLICATION ........................................................................................... 5
CHAPTER TWO THE FUNDAMENTALS ..................................................................................................... 6
2.1   ASSESSMENTS WITHIN THE SYSTEM DEVELOPMENT LIFE CYCLE .................................................. 6
2.2   CONTROL STRUCTURE AND ORGANIZATION .................................................................................. 7
2.3   BUILDING AN EFFECTIVE ASSURANCE CASE .................................................................................... 8
2.4   ASSESSMENT PROCEDURES: ASSESSMENT OBJECTS, METHODS AND OBJECTIVES ................... 11
CHAPTER THREE THE PROCESS ............................................................................................................. 19
3.1   PREPARE FOR SECURITY AND PRIVACY CONTROL ASSESSMENTS ............................................... 19
3.2   DEVELOP SECURITY AND PRIVACY ASSESSMENT PLANS .............................................................. 23
3.3   CONDUCT SECURITY AND PRIVACY CONTROL ASSESSMENTS ..................................................... 30
3.4   ANALYZE ASSESSMENT REPORT RESULTS .....................................................................................


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for Maintenance?

[Assistant]
According to Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171:

............................................ 5                        |
| 2.1 DEVELOPMENTAPPROACH ......................................................................................................
| 5                                                                                |
| 2.2 ORGANIZATIONANDSTRUCTURE                                                                                | ............................................................................................. 7                                                  |
| 2.3 FLEXIBLE APPLICATION                                                                                | ............................................................................................................. 9                                  |
| CHAPTER THREE THE REQUIREMENTS......................................................................................... 11                       | CHAPTER THREE THE REQUIREMENTS......................................................................................... 11                       |
| 3.1 ACCESSCONTROL                                                                                | .................................................................................................................. 12                            |
| 3.2 AWARENESSANDTRAINING                                                                                | ...................................................................................................


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171 provide? (Part 16)

[Assistant]
nformation, including inconsistent markings, inadequate safeguarding, and needless restrictions, both by standardizing procedures and by providing common definitions through a CUI Registry [NARA CUI].
The CUI Registry is the online repository of information, guidance, policy, and requirements on handling CUI, including issuances by the National Archives and Records Administration (NARA) CUI Executive Agent. The CUI Registry identifies approved CUI categories, provides general

1 An information system is a discrete set of information resources organized expressly for the collection, processing, maintenance, use, sharing, dissemination, or disposition of information. Information systems also include specialized systems, such as industrial and process control systems, cyber-physical systems, IoT systems, embedded systems, and devices. The term system is used throughout this publication to represent all types of computing platforms that can process, store, or transmit CUI. 2 A federal information system is a system that is used or operated by an executive agency, a contractor of an executive agency, or another organization on behalf of an executive agency. A system that does not meet such criteria is a nonfederal system . 3 Controlled Unclassified Information is any information that law, regulation, or government-wide policy requires to have safeguarding or disseminating controls, excluding information that is classified under [EO 13526] or any predecessor or successor order, or [ATOM54], as amended. 4  Established by Executive Order 13556, the CUI Program standardizes the way that the Executive branch handles unclassified information that requires safeguarding or dissemination controls pursuant to and consistent with law, regulations, and government-wide policies. 5  [EO 13556] designated the National Archives and Records Administration (NARA) as the Executive Agent to implement the CUI Program.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What guidance does NIST provide for CMMC Level 3?

[Assistant]
According to Protecting Controlled Unclassified Information (CUI)_ NIST Special Publication 800-171, Revision 3. Small Business Primer:

ent, or possibly with other organizations like municipal governments, prime contractors, universities, etc., you will likely be required to demonstrate you are taking adequate measures to protect CUI.
Examples of CUI include:

<!-- image -->

|                      | When provided as part of a government contract, examples include:                                                                                | Marking 1     |
|----------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------|
| Controlled           | e.g., research and engineering data, engineering drawings, specifications, process sheets, manuals, technical reports, technical orders, catalog-item identifications, data sets, studies and analyses and related information, and computer software executable code and source code. | CUI//SP-CTI   |
| General Proprietary  | e.g., financial information, trade secrets, product research and development, existing and future product designs and performance specifications. | CUI//PROPIN   |
| Business Information | you do not handle CUI, implementing the security requirements in SP 800-171 will                                                                                | help you take |

1  For more information on types of CUI and markings, visit the National Archives and Records Administration (NARA) https://www.archives.gov/cui.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for Supply Chain Risk Management?

[Assistant]
According to Protecting Controlled Unclassified Information (CUI)_ NIST Special Publication 800-171, Revision 3. Small Business Primer:

deral agency to ensure that requirements to protect CUI are identified in applicable contracts or agreements, and CUI is marked by the federal agency. |
| How do I get a 'NIST SP 800 -171 Assessment'?
| The term 'NIST Assessment' and 'NIST SP 800 - 171 Assessment' is frequently used to describe the Department of Defense (DOD) proce ss used to complete its NIST SP 800-171 Assessment Module through the Supplier Performance Risk System (SPRS). NIST develops the underlying technical guidelines (SP 800-171, SP 800-171A, SP 800-172, and SP 800- 172A) on which the 'NIST Assessment' is based, but NIST does not have a role in DOD's implementation of its programs . For additional guidance on NIST's methodology to plan, prepare for, and conduct security requirement assessments, refer to SP 800-171A. |
| What products, vendors, or solutions are 'NIST SP 800 -171 compliant' or 'CMMC - certified'? | NIST does not identify or track implementation of or compliance with the security requirements. |
| What is the relationship between NIST and CMMC? | The Cybersecurity Maturity Model Certification (CMMC) is a DOD program that references the security requirements in NIST SP 800-171 and SP 800-172. NIST is not involved in the design, development, or implementation of the CMMCmodel, accreditation body, or certification process. It is important to note that CMMCis currently based on SP 800-171, Revision 2. Contractors should check for specific requirements in their contracts to understand which version they are required to use. |


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Summary of NIST SP 800-53, Revision 4_ Security and Privacy Controls for Federal Information Systems and Organizations provide? (Part 9)

[Assistant]
tise, and understanding. Appendix E provides three tables that identify specific assurance-related controls that are included in the low-, moderate-, and high-impact baselines described in Appendix D.
The controls described assist organizations in defining the controls needed to satisfy minimum assurance requirements. Where additional assurance is desired to achieve risk management objectives, Table E-4 provides additional security controls and control enhancements to achieve enhanced assurance. Implementers should note that designation of assurance-related controls is not intended to imply a greater level of importance for such controls. Achieving adequate security for organizational information systems requires the correct combination of both functionality- and assurance-related security controls. ## 6 Security Controls

Appendix F, the Security Control Catalog, provides a comprehensive range of countermeasures for organizations and information systems. The security controls are designed to be technologyneutral such that the focus is on the fundamental countermeasures needed to protect organizational information during processing, storage, or transmission. SP 800-53 Rev. 4, therefore, does not provide guidance on the application of security controls to specific technologies, environments of operation, or missions/business functions. These specific areas may be addressed using overlays (see below). Control enhancements are included with many security controls and are selected in order to increase the strength of the base control. Control enhancements are intended to be implemented only in conjunction with implementation of the base control. Some security controls and control enhancements include one or more assignment and selection statements. These are variable parameters that organizations define, providing them with the ability to tailor security controls based on specific security requirements, environments of operation, and organizational risk tolerance.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 2 require for Security Assessment?

[Assistant]
According to Assessing Security Requirements for Controlled Unclassified Information:

assessment; assessment method; assessment object; assessment procedure; assurance; Controlled Unclassified Information; coverage; FISMA; NIST Special Publication 800-171; NIST Special Publication 800-53A; nonfederal organization; nonfederal system; security assessment; security requirement.

- System development life cycle responsibilities (e.g., program managers, mission/business owners, information owners/stewards, system designers and developers, system/security engineers, systems integrators)
- Acquisition or procurement responsibilities (e.g., contracting officers)
- System, security, or risk management and oversight responsibilities (e.g., authorizing officials, chief information officers, chief information security officers, system owners, information security managers)
- Security assessment and monitoring responsibilities (e.g., auditors, system evaluators, assessors, independent verifiers/validators, analysts)

- Federal perspective : The entity establishing and conveying security assessment requirements in contractual vehicles or other types of agreements
- Nonfederal perspective : The entity responding to and complying with the security assessment requirements set forth in contracts or agreements

Assessing Security Requirements for Controlled Unclassified Information