[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Protecting Controlled Unclassified Information (CUI)_ NIST Special Publication 800-171, Revision 3. Small Business Primer provide? (Part 14)

[Assistant]
ed security services provider (MSSP), talk to others in your industry to get their perspective on vendors they have worked with and always thoroughly review any contract or agreement prior to signing.
A helpful resource, assembled by member company participants of the National Defense Information Sharing& Analysis Center (ND-ISAC), is the Defense Industrial Base Managed Service Provider Shopping Guide for Small & Medium-Sized Businesses. You may also explore the CyberAB Marketplace to find a consulting firm to assist in NIST 800-171 implementation.* |
| Review NIST SP 800-171A to help you understandhow the security requirements in SP 800-171 can be self-assessed or are assessed by independent, third-party entities or by the | Review NIST SP 800-171A to help you understandhow the security requirements in SP 800-171 can be self-assessed or are assessed by independent, third-party entities or by the                                                                                |

* We provide links to non-NIST sites throughout this publication because they may have information of interest to readers. NIST does not necessarily endorse the views expressed or the facts presented on those sites.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Assessing Enhanced Security Requirements for Controlled Unclassified Information provide? (Part 12)

[Assistant]
| SYSTEMANDINFORMATIONINTEGRITY.........................................................................................
| 26  |
| REFERENCES .................................................................................................................................. | REFERENCES .................................................................................................................................. | 32  |
| APPENDIXA GLOSSARY................................................................................................................ | APPENDIXA GLOSSARY................................................................................................................ | 36  |
| APPENDIX B ACRONYMS.............................................................................................................. | APPENDIX B ACRONYMS.............................................................................................................. | 44  |
| APPENDIX C ASSESSMENT METHODS.......................................................................................... | APPENDIX C ASSESSMENT METHODS.......................................................................................... | 45  |

\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

## Errata

This table contains changes that have been incorporated into Special Publication 800-172A. Errata updates can include corrections, clarifications, or other minor changes in the publication that are either editorial or substantive in nature. Any potential updates for this document that are not yet published in an errata update or revision-including additional issues and potential corrections-will be posted as they are identified (see SP 800-172A publication details).

Assessing Enhanced Security Requirements for Controlled Unclassified Information

Risk Assessment
Maintenance
Access Control
System and Communications Protection
System and Information Integrity
Incident Response
Physical Protection
Identification and Authentication
Planning
System and Services Acquisition
Media Protection
Awareness and Training
Audit and Accountability
Supply Chain Risk Management
Configuration Management
Personnel Security
Security Assessment


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Information Integrity?

[Assistant]
According to Security and Privacy Controls for Information Systems and Organizations:

Assurance; availability; computer security; confidentiality; control; cybersecurity; FISMA;
information security; information system; integrity; personally identifiable information; Privacy
Act; privacy controls; privacy functions; privacy requirements; Risk Management Framework;
security controls; security functions; security requirements; system; system security. CHAPTER ONE   INTRODUCTION ...................................................................................................... 1
1.1   PURPOSE AND APPLICABILITY ................................................................................................... 2
1.2   TARGET AUDIENCE .................................................................................................................. 3
1.3   ORGANIZATIONAL RESPONSIBILITIES......................................................................................... 3
1.4   RELATIONSHIP TO OTHER PUBLICATIONS ................................................................................... 5
1.5   REVISIONS AND EXTENSIONS .................................................................................................... 5
1.6   PUBLICATION ORGANIZATION .................................................................................................. 5
CHAPTER TWO   THE FUNDAMENTALS ............................................................................................ 7
2.1   REQUIREMENTS AND CONTROLS .............................................................................................. 7
2.2   CONTROL STRUCTURE AND ORGANIZATION .............................................................................. 8
2.3   CONTROL IMPLEMENTATION APPROACHES ............................................................................. 11
2.4   SECURITY AND PRIVACY CONTROLS .........................................................................................

Security and Privacy Controls for Information Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for Media Protection?

[Assistant]
According to Protecting Controlled Unclassified Information (CUI)_ NIST Special Publication 800-171, Revision 3. Small Business Primer:

| Access Control                    | Maintenance         | Security Assessment and Monitoring   |
|-----------------------------------|---------------------|--------------------------------------|
| Awareness and Training            | Media Protection    | System and Communications Protection |
| Audit and Accountability          | Personnel Security  | System and Information Integrity     |
| Configuration Management          | Physical Protection | Planning                             |
| Identification and Authentication | Risk Assessment     | System and Services Acquisition      |
| Incident Response                 |                     | Supply Chain Risk Management         |

## Family: Media Protection

Description: Protect system media, both paper and digital; limiting access to data on system media to authorized users; and sanitizing or destroying system media before disposal or release for reuse.

Protecting Controlled Unclassified Information (CUI)_ NIST Special Publication 800-171, Revision 3. Small Business Primer


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Assessing Security Requirements for Controlled Unclassified Information provide? (Part 14)

[Assistant]
cedures: AC-06(02), AC-06(05)

Determination statements have alphanumeric identifiers. Each determination statement begins with the letter ' A ' to indicate that it is part of an assessment procedure.
The next sequence of numbers or letters (e.g., 03.01.01.e or 03.01.01.f.02) indicates the security requirement identifier from NIST SP 800-171 (and the specific control item if it is a multi-part requirement) that is the target of the assessment. Organization-defined parameters are indicated by the letters ' ODP .' If there are multiple ODPs in the determination statement, the ODP number is indicated in a square bracket (e.g., A.03.01.08.ODP[01]). Square brackets are also used to denote when an assessment procedure further decomposes a requirement into more granular determination statements (e.g., A.03.01.12.a[01], A.03.01.12.a[02], A.03.01.12.a[03]). The application of an assessment procedure to a security requirement produces assessment results or findings . The findings are compiled and used as evidence to determine whether the security requirement has been satisfied or other than satisfied . A finding of satisfied indicates that the assessment objective has been met, producing a fully acceptable result. A finding of other than satisfied indicates that there are potential anomalies that may need to be addressed by the organization. A finding of other than satisfied may also indicate that the assessor was unable to obtain sufficient information to make the determination called for in the determination statement. - 2.2. Assurance Cases

Building an effective assurance case   to determine compliance with security requirements involves compiling evidence from a variety of sources and conducting different types of activities during an assessment. An assurance case is a body of evidence organized into an argument demonstrating that some claim about a system is true.

Assessing Security Requirements for Controlled Unclassified Information


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations provide? (Part 9)

[Assistant]
..........................93   |
| Table 4. Awareness and Training (AT).........................................................................................................94          |
| Table 5.
Audit and Accountability (AU).......................................................................................................95          |
| Table 6. Assessment, Authorization, and Monitoring (CA).........................................................................95                       |
| Table 7. Configuration Management (CM).................................................................................................96                |
| Table 8. Contingency Planning (CP) ............................................................................................................96        |
| Table 9. Identification and Authentication (IA) ..........................................................................................97             |
| Table 10. Incident Response (IR).................................................................................................................98      |
| Table 11. Maintenance (MA) ......................................................................................................................98      |
| Table 12. Media Protection (MP)................................................................................................................99        |
| Table 13. Physical and Environmental Protection (PE)...............................................................................99                    |
| Table 14. Planning (PL)..............................................................................................................................100 |
| Table 15. Program Management (PM) .....................................................................................................100               |
| Table 16.

Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What guidance does Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171 provide?

[Assistant]
## NIST Special Publication 800-172

## Enhanced Security Requirements for Protecting Controlled Unclassified Information

A Supplement to NIST Special Publication 800-171

RON ROSS VICTORIA PILLITTERI GARY GUISSANIE RYAN WAGNER RICHARD GRAUBART

DEB BODEAU

This publication is available free of charge from:

https://doi.org/10.6028/NIST.SP.800-172

<!-- image -->

## NIST Special Publication 800-172

## Enhanced Security Requirements for Protecting Controlled Unclassified Information

A Supplement to NIST Special Publication 800-171

## RON ROSS VICTORIA PILLITTERI

Computer Security Division

National Institute of Standards and Technology

## GARY GUISSANIE RYAN WAGNER

Institute for Defense Analyses

RICHARD GRAUBART DEB BODEAU

The MITRE Corporation

This publication is available free of charge from:

https://doi.org/10.6028/NIST.SP.800-172

## February 2021

<!-- image -->

U.S. Department of Commerce Wynn Coggins, Acting Secretary

National Institute of Standards and Technology James K. Olthoff, Performing the Non-Exclusive Functions and Duties of the Under Secretary of Commerce for Standards and Technology & Director, National Institute of Standards and Technology

\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

## Authority

This publication has been developed by NIST to further its statutory responsibilities under the Federal Information Security Modernization Act (FISMA), 44 U.S.C. § 3551 et seq. , Public Law (P.L.) 113-283. NIST is responsible for developing information security standards and guidelines, including minimum requirements for federal information systems, but such standards and guidelines shall not apply to national security systems without the express approval of the appropriate federal officials exercising policy authority over such systems.

Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Physical Protection?

[Assistant]
According to Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations:

................................................................................57 |                                                                                |
| Appendix A.
C-SCRM Security Controls............................................................................................... | 63                                                                                |
| A.1.1. C-SCRM Controls Summary........................................................................................................63              |                                                                                |
| A.1.1.1. C-SCRM Controls Throughout the Enterprise.......................................................................64                           |                                                                                |
| A.1.2. Selecting, Tailoring, and Implementing C-SCRM Security Controls ...........................................67                                  |                                                                                |
| A.2.3. FAMILY: ACCESS CONTROL.........................................................................................................69              |                                                                                |
| A.2.4. FAMILY: AWARENESS AND TRAINING........................................................................................76                       |                                                                                |
| A.2.5. FAMILY: AUDIT AND ACCOUNTABILITY......................................................................................79                       |                                                                                |
| A.2.6.

Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Summary of NIST SP 800-53, Revision 4_ Security and Privacy Controls for Federal Information Systems and Organizations provide? (Part 5)

[Assistant]
e of continuous improvement in the organization's risk-related activities, with effective communication among tiers and stakeholders. Figure 1 illustrates the three-tiered approach to risk management.
Figure 1: Risk Management 3-Tiered Approach

<!-- image -->

The NIST Risk Management Framework (RMF), described in NIST Special Publication 800-37 Revision 1, Guide for Applying the Risk Management Framework to Federal Information Systems: a Security Life Cycle Approach, is a methodology for implementing risk management at the information systems tier. The RMF (depicted in Figure 2) identifies six distinct steps that provide a disciplined and structured process to integrate information security risk management activities into the system development life cycle. The RMF addresses security concerns of organizations related to the design, development, implementation, operation, and disposal of information systems and the environments in which those systems operate. The security controls in SP 800-53 Rev. 4 support Step Two of the RMF, and a detailed catalog of these controls is provided in Appendix F. For ease of use in the security control selection and specification process, controls are organized into eighteen families, each containing security controls related to the general security topic of the family. Security controls involve aspects of policy, oversight, supervision, manual processes, individual actions, or automated mechanisms implemented by information systems/devices. The security control structure consists of the

following components: (i) a control section; (ii) a supplemental guidance section; (iii) a control enhancements section; (iv) a references section; and (v) a priority and baseline allocation section.

Summary of NIST SP 800-53, Revision 4_ Security and Privacy Controls for Federal Information Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171 provide? (Part 8)

[Assistant]
e requirements also apply to services, including externally provided services, that process, store, or transmit CUI, or that provide security protections, for the system requiring enhanced protection.
The protection of a specific service to include CUI that is processed, stored or transmitted during the provision of that service, is achieved by implementing the enhanced security  requirements  for  the  service,  or  the  system  or  system  components  responsible  for providing that service. In addition to protecting CUI from unauthorized disclosure, the enhanced security requirements have been designed to protect the integrity and availability of CUI. This is achieved by promoting penetration-resistant architectures, damage-limiting operations, and designs to help achieve cyber resiliency and survivability. The term organizational system is used in many of the enhanced security requirements. It has a specific meaning regarding the applicability of the enhanced requirements as described above. Appropriate scoping considerations for the requirements are important factors in determining protection-related investment decisions and managing security risk for nonfederal organizations that have the responsibility of protecting CUI associated with critical programs and high value assets. \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

## FRAMEWORK FOR IMPROVING CRITICAL INFRASTRUCTURE CYBERSECURITY

Organizations that have implemented or plan to implement the NIST Framework for Improving Critical Infrastructure Cybersecurity [NIST CSF] can find in Appendix C a mapping of the enhanced security requirements in this publication to the security controls in [SP 800-53].


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 2 require for Access Control?

[Assistant]
According to Assessing Security Requirements for Controlled Unclassified Information:

| Access Control                    | Maintenance         | Security Assessment and Monitoring   |
|-----------------------------------|---------------------|--------------------------------------|
| Awareness and Training            | Media Protection    | System and Communications Protection |
| Audit and Accountability          | Personnel Security  | System and Information Integrity     |
| Configuration Management          | Physical Protection | Planning                             |
| Identification and Authentication | Risk Assessment     | System and Services Acquisition      |
| Incident Response                 |                     | Supply Chain Risk Management         |

## 03.01.06      Least Privilege - Privileged Accounts

[SELECT FROM: access control policy and procedures; procedures for least privilege; list of system-generated privileged accounts; list of system administration personnel; system audit records; system configuration settings; system security plan; list of system-generated security functions or security-relevant information assigned to system accounts or roles; other relevant documents or records]


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Access Control?

[Assistant]
According to A Zero Trust Architecture Model for Access Control in Cloud-Native Applications in Multi-Cloud Environments:

## A Zero Trust Architecture Model for Access Control in Cloud-Native Applications in Multi-Location Environments

## A Zero Trust Architecture Model for Access Control in Cloud-Native Applications in Multi-Location Environments

Chandramouli R, Butcher Z (2023) A Zero-Trust Architecture Model for Access Control in Cloud-Native Applications in Multi-Location Environments. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) NIST SP 800-207A. https://doi.org/10.6028/NIST.SP.800-207A

A Zero Trust Architecture Model for Access Control in Cloud-Native Applications in Multi-Cloud Environments


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171 provide? (Part 14)

[Assistant]
..................................................... 50                 | APPENDIX C MAPPINGTABLES ....................................................................................................
50                 |
| APPENDIXD ADVERSARY EFFECTS............................................................................................... 68                    | APPENDIXD ADVERSARY EFFECTS............................................................................................... 68                    |

\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

## Errata

This table contains changes that have been incorporated into Special Publication 800-172. Errata updates can include corrections, clarifications, or other minor changes in the publication that are either editorial or substantive in nature. Any potential updates for this document that are not yet published in an errata update or revision-including additional issues and potential corrections-will be posted as they are identified; see the SP 800-172 publication details. | DATE   | TYPE   | CHANGE   | PAGE   |
|--------|--------|----------|--------|

\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

## CHAPTER ONE

## INTRODUCTION

THE NEED TO PROTECT CONTROLLED UNCLASSIFIED INFORMATION

oday, more than at any time in history, the Federal Government relies on external service providers to help carry out a wide range of federal missions and business functions using information systems.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171 provide? (Part 9)

[Assistant]
ework for Improving Critical Infrastructure Cybersecurity [NIST CSF] can find in Appendix C a mapping of the enhanced security requirements in this publication to the security controls in [SP 800-53].
The security control mappings can be useful to organizations that wish to demonstrate compliance to the security requirements in the context of their established information security programs when such programs have been built using the NIST security controls. \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

## Table of Contents

| CHAPTERONE INTRODUCTION...................................................................................................... | CHAPTERONE INTRODUCTION...................................................................................................... |
|--------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------|
| 1.1 PURPOSEANDAPPLICABILITY                                                                                | ................................................................................................... 3                                            |
| 1.2 TARGET AUDIENCE                                                                                | ..................................................................................................................


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Access Control?

[Assistant]
According to Incident Response Recommendations and Considerations for Cybersecurity Risk Management_ A CSF 2.0 Community Profile:

are are authenticated                                                                                | Medium     | N1: See the notes for PR.
|
| PR.AA-04                                                        | Identity assertions are protected, conveyed, and verified                                                                                | Medium     | N1: See the notes for PR. |
| PR.AA-05                                                        | Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties | Medium     | N1: See the notes for PR. |
| PR.AA-06                                                        | Physical access to assets is managed, monitored, and enforced commensurate with risk                                                                                | Medium     | N1: See the notes for PR. |
| PR.AT (Awareness and Training)                                  | The organization's personnel are provided with cybersecurity awareness and training so that they can perform their cybersecurity-related tasks                                            | Medium     | N1: See the notes for PR. |
| PR.AT-01                                                        | Personnel are provided with awareness and training so that they possess the knowledge and skills to perform general tasks with cybersecurity risks in mind                                | Medium     | N1: See the notes for PR.

Incident Response Recommendations and Considerations for Cybersecurity Risk Management_ A CSF 2.0 Community Profile


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Summary of NIST SP 800-53, Revision 4_ Security and Privacy Controls for Federal Information Systems and Organizations provide? (Part 2)

[Assistant] ## Table of Contents | 1 | Introduction ............................................................................................................1 | |------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------| | 2 | NIST SP 800-53 Revision 4 and the Risk Management Framework (RMF)........2 | | 3 | Control Baselines and Tailoring ...........................................................................4 | | 4 | Documenting the Control Selection Process ......................................................5 | | 5 | Assurance...............................................................................................................6 | | 6 | Security Controls ...................................................................................................7 | | 7 | International Information Security Standards .....................................................8 | | 8 | Overlays..................................................................................................................9 | | 9 | Privacy ..................................................................................................................10 | | List of Figures | List of Figures | | Figure 1: Risk Management 3-Tiered Approach.........................................................2 | Figure 1: Risk Management 3-Tiered Approach.........................................................2 | | Figure 2: The Risk Management Framework ..............................................................3 | Figure 2: The Risk Management Framework ..............................................................3 | | Figure 3: Security Control Selection Process ............................................................5 | Figure 3: Security Control Selection Process ............................................................5 | ## 1 Introduction In April, 2013, NIST published an update, Revision 4, to NIST Special Publication 800-53, Security and Privacy Controls for Federal Information Systems and Organization .


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171 provide? (Part 16)

[Assistant]
nformation, including inconsistent markings, inadequate safeguarding, and needless restrictions, both by standardizing procedures and by providing common definitions through a CUI Registry [NARA CUI].
The CUI Registry is the online repository of information, guidance, policy, and requirements on handling CUI, including issuances by the National Archives and Records Administration (NARA) CUI Executive Agent. The CUI Registry identifies approved CUI categories, provides general

1 An information system is a discrete set of information resources organized expressly for the collection, processing, maintenance, use, sharing, dissemination, or disposition of information. Information systems also include specialized systems, such as industrial and process control systems, cyber-physical systems, IoT systems, embedded systems, and devices. The term system is used throughout this publication to represent all types of computing platforms that can process, store, or transmit CUI. 2 A federal information system is a system that is used or operated by an executive agency, a contractor of an executive agency, or another organization on behalf of an executive agency. A system that does not meet such criteria is a nonfederal system . 3 Controlled Unclassified Information is any information that law, regulation, or government-wide policy requires to have safeguarding or disseminating controls, excluding information that is classified under [EO 13526] or any predecessor or successor order, or [ATOM54], as amended. 4  Established by Executive Order 13556, the CUI Program standardizes the way that the Executive branch handles unclassified information that requires safeguarding or dissemination controls pursuant to and consistent with law, regulations, and government-wide policies. 5  [EO 13556] designated the National Archives and Records Administration (NARA) as the Executive Agent to implement the CUI Program.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Protecting Controlled Unclassified Information (CUI)_ NIST Special Publication 800-171, Revision 3. Small Business Primer provide? (Part 20)

[Assistant]
tems (including hardware, software, firmware, and documentation); and establishing and enforcing security configuration settings for information technology products employed in organizational systems.
## Getting Started with Configuration Management

<!-- image -->

Changes to a system can have potentially significant effects on the security of the system. Configuration management helps establish processes for initializing, changing and monitoring configurations to the hardware, software, or firmware components of the system or the operational procedures related to the system storing CUI. ## Limit who can make changes to the system containing CUI. - Permit only qualified and authorized individuals to access the system for the purpose of initiating changes. Access restrictions include physical and logical access controls, software libraries, workflow automation, media libraries, abstract layers (i.e., changes implemented into external interfaces rather than directly into the system), and change windows (i.e., changes occur only during specified times). ## Authorized software -allow by exception. - It is important to identify permitted and prohibited actions regarding software installation when users have the ability to install software on organizational systems. Permitted software installations could include updates and security patches to existing software and downloading new applications from organizationapproved 'app stores.' Companies might prohibit employees from downloading certain programs, services, software versions, etc . ## Locate CUI. - Identify the location of CUI and the system components on which the information is processed and stored. Identify who within the business has access to CUI. Again, remember to restrict this access to only those who need it. Foundational Concept -Least Functionality: Systems (databases, email systems, network drives, etc.) provide a variety of functions and services.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for System and Communications Protection?

[Assistant]
According to Protecting Controlled Unclassified Information (CUI)_ NIST Special Publication 800-171, Revision 3. Small Business Primer:

| Access Control                    | Maintenance         | Security Assessment and Monitoring   |
|-----------------------------------|---------------------|--------------------------------------|
| Awareness and Training            | Media Protection    | System and Communications Protection |
| Audit and Accountability          | Personnel Security  | System and Information Integrity     |
| Configuration Management          | Physical Protection | Planning                             |
| Identification and Authentication | Risk Assessment     | System and Services Acquisition      |
| Incident Response                 |                     | Supply Chain Risk Management         |

- A business champion: Someone who is responsible for developing and maintaining the incident response plan.
- Who to call: List all the individuals who may be part of the incident response efforts. Include their contact information, roles, and responsibilities.
- What/when/how to report: List the business' communications/reporting responsibilities as required by laws, regulations, contracts, agreements, or policies.
- Also, most federal contracts will include specific reporting and notification requirements that should be included in the Incident Response Plan

Description: Monitor, control, and protect organizational communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of the systems; and employ architectural designs, software development techniques, and systems engineering principles that promote effective information security within organizational systems.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for System and Services Acquisition?

[Assistant]
According to Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171:

There may be references in this publication to other publications currently under development by  NIST  in  accordance  with  its  assigned  statutory  responsibilities. The  information  in  this publication, including concepts, practices, and methodologies, may be used by federal agencies even  before  the  completion  of  such  companion  publications. Thus,  until  each  publication  is completed,  current  requirements,  guidelines,  and  procedures,  where  they  exist,  remain operative. For planning and transition purposes, federal agencies may wish to closely follow the development of these new publications by NIST. The National Institute of Standards and Technology (NIST) Information Technology Laboratory (ITL) promotes the U.S. economy and public welfare by providing technical leadership for the Nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology (IT). ITL's responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the costeffective security of other than national security-related information in federal information systems. The Special Publication 800-series reports on ITL's research, guidelines, and outreach efforts in information systems security and privacy and its collaborative activities with industry, government, and academic organizations. | CHAPTERONE INTRODUCTION...................................................................................................... | CHAPTERONE INTRODUCTION......................................................................................................


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171 provide? (Part 13)

[Assistant]
| ........................................................................................................
22                                      |
| 3.13 SYSTEMANDCOMMUNICATIONSPROTECTION ..................................................................... | 23                                                                                |
| 3.14 SYSTEMANDINFORMATIONINTEGRITY ................................................................................ | 27                                                                                |
| REFERENCES .................................................................................................................................. 32 | REFERENCES .................................................................................................................................. 32 |
| APPENDIXA GLOSSARY................................................................................................................ 38            | APPENDIXA GLOSSARY................................................................................................................ 38            |
| APPENDIX B ACRONYMS.............................................................................................................. 48             | APPENDIX B ACRONYMS.............................................................................................................. 48             |
| APPENDIX C MAPPINGTABLES .................................................................................................... 50                 | APPENDIX C MAPPINGTABLES ....................................................................................................


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 2 require for Planning?

[Assistant]
According to Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations:

......95                       |
| Table 7. Configuration Management (CM).................................................................................................96                |
| Table 8.
Contingency Planning (CP) ............................................................................................................96        |
| Table 9. Identification and Authentication (IA) ..........................................................................................97             |
| Table 10. Incident Response (IR).................................................................................................................98      |
| Table 11. Maintenance (MA) ......................................................................................................................98      |
| Table 12. Media Protection (MP)................................................................................................................99        |
| Table 13. Physical and Environmental Protection (PE)...............................................................................99                    |
| Table 14. Planning (PL)..............................................................................................................................100 |
| Table 15. Program Management (PM) .....................................................................................................100               |
| Table 16. Personnel Security (PS) .............................................................................................................101       |
| Table 17. PII Processing and Transparency (PT) .......................................................................................102                |
| Table 18. Risk Assessment (RA) ................................................................................................................102       |
| Table 19.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does A Zero Trust Architecture Model for Access Control in Cloud-Native Applications in Multi-Cloud Environments provide? (Part 7)

[Assistant]
| Background - Zero Trust Principles and Zero Trust Architecture................................
| 2                                                                                |
|                                                                                | Relationship to Other NIST Guidance Documents...................................................... | 3                                                                                |
|                                                                                | Scope......................................................................................................................... | 3                                                                                |
|                                                                                | Target Audience                                                                                | .........................................................................................................


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Communications Protection?

[Assistant]
According to Incident Response Recommendations and Considerations for Cybersecurity Risk Management_ A CSF 2.0 Community Profile:

- Govern, Identify, and Protect help organizations prevent some incidents, prepare to handle incidents that do occur, reduce the impact of those incidents, and improve incident response and cybersecurity risk management practices based on lessons learned from those incidents. - Detect, Respond, and Recover help organizations discover, manage, prioritize, contain, eradicate, and recover from cybersecurity incidents, as well as perform incident reporting, notification, and other incident-related communications. - Employing a botnet to send high volumes of connection requests to an internet-facing service, making it unavailable to legitimate service users
- Obtaining administrative credentials at a software-as-a-service provider, which puts sensitive tenant data entrusted to that provider at risk
- Intruding upon an organization's business network to steal credentials and use them to instruct industrial control systems to shut down or destroy critical physical components, causing a major service disruption
- Deploying ransomware to prevent the use of computer systems and cause multiple data breaches by copying files from those systems
- Using phishing emails to compromise user accounts and using those accounts to commit financial fraud
- Identifying a new vulnerability in network management appliances and exploiting the vulnerability to gain unauthorized access to network communications
- Compromising a vendor's software, which is subsequently distributed to customers in its compromised state

All six Functions have vital roles in incident response. Govern, Identify, and Protect help organizations prevent some incidents, prepare to handle incidents that do occur, reduce the impact of those incidents, and improve incident response and cybersecurity risk management practices based on lessons learned.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Services Acquisition?

[Assistant]
According to Summary of NIST SP 800-53, Revision 4_ Security and Privacy Controls for Federal Information Systems and Organizations:

The NIST Risk Management Framework (RMF), described in NIST Special Publication 800-37 Revision 1, Guide for Applying the Risk Management Framework to Federal Information Systems: a Security Life Cycle Approach, is a methodology for implementing risk management at the information systems tier. The RMF (depicted in Figure 2) identifies six distinct steps that provide a disciplined and structured process to integrate information security risk management activities into the system development life cycle. The RMF addresses security concerns of organizations related to the design, development, implementation, operation, and disposal of information systems and the environments in which those systems operate. The criteria for whether a security control is assurance- or functionality-related is based on the overall characteristics of the control. In general, assurance-related controls are controls that: (i) define processes, procedures, techniques, or methodologies for designing and developing information systems and system components; (ii) provide supporting operational processes including improving the quality of systems, components, or processes; (iii) produce security evidence from developmental or operational activities; (iv) determine security control effectiveness or risk; or (v) improve personnel skills, expertise, and understanding. Many organizations use well-known international information security standards as the basis or as a supplemental source of security controls for risk management. To aid in selection and comparison, SP 800-53 Rev. 4 provides mapping tables to provide organizations with a general indication of security control coverage with respect to ISO/IEC 27001, Information technologySecurity techniques-Information security management systems-Requirements and ISO/IEC 15408, Information technology -- Security techniques -- Evaluation criteria for IT security .


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 2 require for Media Protection?

[Assistant]
According to Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations:

......................98      |
| Table 11. Maintenance (MA) ......................................................................................................................98      |
| Table 12.
Media Protection (MP)................................................................................................................99        |
| Table 13. Physical and Environmental Protection (PE)...............................................................................99                    |
| Table 14. Planning (PL)..............................................................................................................................100 |
| Table 15. Program Management (PM) .....................................................................................................100               |
| Table 16. Personnel Security (PS) .............................................................................................................101       |
| Table 17. PII Processing and Transparency (PT) .......................................................................................102                |
| Table 18. Risk Assessment (RA) ................................................................................................................102       |
| Table 19. System and Services Acquisition (SA)........................................................................................103                |
| Table 20. System and Communications Protection (SC)...........................................................................103                        |
| Table 21. System and Information Integrity (SI) .......................................................................................104               |
| Table 22. Supply Chain Risk Management (SR).........................................................................................105                  |
| Table 23.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for Risk Assessment?

[Assistant]
According to Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171:

ance. The decision to select a particular set of enhanced security requirements will be based on the mission and business needs of federal agencies and guided and informed by ongoing risk assessments.
The enhanced security requirements for nonfederal systems processing, storing, or transmitting CUI associated with critical programs or high value assets will be conveyed to nonfederal organizations by federal agencies in a contract, grant, or other agreement. The application of the enhanced security requirements to subcontractors will also be addressed by federal agencies in consultation with nonfederal organizations.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Physical Protection?

[Assistant]
According to Risk Management Framework for Information Systems and Organizations_ A System Life Cycle Approach for Security and Privacy:

The National Institute of Standards and Technology (NIST) Information Technology Laboratory (ITL) promotes the U.S. economy and public welfare by providing technical leadership for the Nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology (IT). ITL's responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the costeffective security of other than national security-related information in federal information systems. The Special Publication 800-series reports on ITL's research, guidelines, and outreach efforts in information systems security and privacy and its collaborative activities with industry, government, and academic organizations. All  information  systems  process,  store,  or  transmit  some  type  of  information. For  example, information about the temperature in a remote facility collected and transmitted by a sensor to a monitoring station, location coordinates transmitted by radio to a controller on a weapons system, photographic images transmitted by a remote camera (land/satellite-based) to a server, or health IT devices transmitting patient information via a hospital network, require protection. This information can be protected by: categorizing the information to determine the impact of loss; assessing whether the processing of the information could impact individuals' privacy; and selecting and implementing controls that are applicable to the IT resources in use. Therefore, cloud-based  systems,  industrial/process  control  systems,  weapons  systems,  cyber-physical systems, applications, IoT devices, or mobile devices/systems, do not require a separate risk management process but rather a tailored set of controls and specific implementation details determined by applying the existing RMF process.

Risk Management Framework for Information Systems and Organizations_ A System Life Cycle Approach for Security and Privacy


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 2 require for System and Communications Protection?

[Assistant]
According to Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations:

......................98      |
| Table 11. Maintenance (MA) ......................................................................................................................98      |
| Table 12.
Media Protection (MP)................................................................................................................99        |
| Table 13. Physical and Environmental Protection (PE)...............................................................................99                    |
| Table 14. Planning (PL)..............................................................................................................................100 |
| Table 15. Program Management (PM) .....................................................................................................100               |
| Table 16. Personnel Security (PS) .............................................................................................................101       |
| Table 17. PII Processing and Transparency (PT) .......................................................................................102                |
| Table 18. Risk Assessment (RA) ................................................................................................................102       |
| Table 19. System and Services Acquisition (SA)........................................................................................103                |
| Table 20. System and Communications Protection (SC)...........................................................................103                        |
| Table 21. System and Information Integrity (SI) .......................................................................................104               |
| Table 22. Supply Chain Risk Management (SR).........................................................................................105                  |
| Table 23.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Summary of NIST SP 800-53, Revision 4_ Security and Privacy Controls for Federal Information Systems and Organizations provide? (Part 10)

[Assistant]
parameters that organizations define, providing them with the ability to tailor security controls based on specific security requirements, environments of operation, and organizational risk tolerance.
Parameters assigned and/or selected by organizations for a given base control also apply to all control enhancements associated with that control. The first security control in each family (referred to as the dash-1control) addresses policies and procedures needed for effective implementation of all the other controls within each family. Therefore, requirements to develop policies and procedures are not repeated in individual controls. Many security controls and enhancements include supplemental guidance. The supplemental guidance provides additional information about a control or enhancement to help organizations define, develop, and/or implement security controls but does not include any additional requirements. SP 800-53 Rev. 4 includes many changes from SP 800-53 Rev. 3 - 295 controls and control enhancements were added while approximately 100 controls and control enhancements were withdrawn or incorporated into others. Of the eighteen security control families in SP 800-53 Rev. 4, seventeen families are described in the security control catalog in Appendix F, and are closely aligned with the seventeen minimum security requirements for federal information and information systems in FIPS Publication 200, Minimum Security Requirements for Federal Information and Information Systems . One additional family, the Program Management (PM) family, provides controls for information security programs themselves. This family is described in Appendix G of SP 800-53 Rev. 4. While it is not specifically referenced in FIPS 200, the PM section provides security controls at the organization level rather than the information system level. The PM controls are typically implemented at the organization level and not directed at individual organizational information systems.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 2 require for Planning?

[Assistant]
According to Assessing Security Requirements for Controlled Unclassified Information:

stomize assessments based on organizational policies and requirements, known threat and vulnerability information, system and platform dependencies, operational considerations, and tolerance for risk.
1

| Access Control                    | Maintenance         | Security Assessment and Monitoring   |
|-----------------------------------|---------------------|--------------------------------------|
| Awareness and Training            | Media Protection    | System and Communications Protection |
| Audit and Accountability          | Personnel Security  | System and Information Integrity     |
| Configuration Management          | Physical Protection | Planning                             |
| Identification and Authentication | Risk Assessment     | System and Services Acquisition      |
| Incident Response                 |                     | Supply Chain Risk Management         |


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does A Zero Trust Architecture Model for Access Control in Cloud-Native Applications in Multi-Cloud Environments provide? (Part 10)

[Assistant]
| Shortcomings of Identity-Based Segmentation Policies for Enterprise ZTA ................
| 9                                                                                |
|                                                                                | Multi-Tier Policies for Enterprise ZTA .........................................................................


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Services Acquisition?

[Assistant]
According to Summary of NIST SP 800-53, Revision 4_ Security and Privacy Controls for Federal Information Systems and Organizations:

The NIST Risk Management Framework (RMF), described in NIST Special Publication 800-37 Revision 1, Guide for Applying the Risk Management Framework to Federal Information Systems: a Security Life Cycle Approach, is a methodology for implementing risk management at the information systems tier. The RMF (depicted in Figure 2) identifies six distinct steps that provide a disciplined and structured process to integrate information security risk management activities into the system development life cycle. The RMF addresses security concerns of organizations related to the design, development, implementation, operation, and disposal of information systems and the environments in which those systems operate. The criteria for whether a security control is assurance- or functionality-related is based on the overall characteristics of the control. In general, assurance-related controls are controls that: (i) define processes, procedures, techniques, or methodologies for designing and developing information systems and system components; (ii) provide supporting operational processes including improving the quality of systems, components, or processes; (iii) produce security evidence from developmental or operational activities; (iv) determine security control effectiveness or risk; or (v) improve personnel skills, expertise, and understanding. Many organizations use well-known international information security standards as the basis or as a supplemental source of security controls for risk management. To aid in selection and comparison, SP 800-53 Rev. 4 provides mapping tables to provide organizations with a general indication of security control coverage with respect to ISO/IEC 27001, Information technologySecurity techniques-Information security management systems-Requirements and ISO/IEC 15408, Information technology -- Security techniques -- Evaluation criteria for IT security .


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Security and Privacy Controls for Information Systems and Organizations provide? (Part 15)

[Assistant]
_________

USE OF EXAMPLES IN THIS PUBLICATION

Throughout this publication, examples are used to illustrate, clarify, or explain certain items in
chapter sections, controls, and control enhancements.
These examples are illustrative in nature
and are not intended to limit or constrain the application of controls or control enhancements
by organizations. T
h
s

i

p
u
b

l
i

c
a

t
i

o
n

i

s

a
v
a

i
l

l

a
b
e
f
r
e
e
o
f

c
h
a
r
g
e
f
r
o
m

:

h
t
t
p
s
:
/
/
d
o
i
. o
r
g
/
1
0
. 6
0
2
8
/
N
S
T
S
P
. 8
0
0
-
5
3
r
5

I

. xi

NIST SP 800-53, REV. 5                                                                                SECURITY AND PRIVACY CONTROLS FOR INFORMATION SYSTEMS AND ORGANIZATIONS
_________________________________________________________________________________________________

FEDERAL RECORDS MANAGEMENT COLLABORATION

Federal  records  management  processes  have  a  nexus  with  certain  information  security  and
privacy  requirements  and  controls. For  example,  records  officers  may  be  managing  records
retention,  including  when  records  will  be  deleted. Collaborating  with  records  officers  on  the
selection and implementation of security and privacy controls related to records management
can support consistency and efficiency and ultimately strengthen the organization’s security and
privacy posture. T
h
s

i

p
u
b

l
i

c
a

t
i

o
n

i

s

a
v
a

i
l

l

a
b
e
f
r
e
e
o
f

c
h
a
r
g
e
f
r
o
m

:

h
t
t
p
s
:
/
/
d
o
i
. o
r
g
/
1
0
. 6
0
2
8
/
N
S
T
S
P
. 8
0
0
-
5
3
r
5

. I

xii

T
h
s

i

p
u
b

l
i

c
a

t
i

o
n

i

s

a
v
a

i
l

l

a
b
e
f
r
e
e
o
f

c
h
a
r
g
e
f
r
o
m

:

h
t
t
p
s
:
/
/
d
o
i
. o
r
g
/
1
0
. 6
0
2
8
/
N
S
T
S
P
. 8
0
0
-
5
3
r
5

. I

NIST SP 800-53, REV.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Summary of NIST SP 800-53, Revision 4_ Security and Privacy Controls for Federal Information Systems and Organizations provide? (Part 8)

[Assistant]
sions. This documentation is essential when examining the security considerations for organizational information systems with respect to the potential impact on an organization's mission and business.
The resulting tailored baseline set of security controls and the supporting rationale for the selection decisions (including any information system use restrictions required by organizations) are documented in system security plans. Documenting significant risk management decisions in the security control selection process is imperative so that authorizing officials have access to necessary information to make informed authorization decisions for organizational information systems, as demonstrated in Figure 3. Figure 3: Security Control Selection Process

<!-- image -->

## 5 Assurance

Appendix E in SP 800-53 Revision 4 provides an update to guidance regarding security assurance. This section outlines methods for agencies to establish measures of confidence that the implemented security controls provide the security capability required to protect critical missions and business operations. The criteria for whether a security control is assurance- or functionality-related is based on the overall characteristics of the control. In general, assurance-related controls are controls that: (i) define processes, procedures, techniques, or methodologies for designing and developing information systems and system components; (ii) provide supporting operational processes including improving the quality of systems, components, or processes; (iii) produce security evidence from developmental or operational activities; (iv) determine security control effectiveness or risk; or (v) improve personnel skills, expertise, and understanding. Appendix E provides three tables that identify specific assurance-related controls that are included in the low-, moderate-, and high-impact baselines described in Appendix D.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Assessing Security and Privacy Controls in Information Systems and Organizations provide? (Part 19)

[Assistant]
..................................................................................... 718
APPENDIX F ONGOING ASSESSMENT AND AUTOMATION .................................................................
721

ix

T
h
s

i

p
u
b

l
i

c
a

t
i

o
n

i

s

a
v
a

i
l

l

a
b
e
f
r
e
e
o
f

c
h
a
r
g
e
f
r
o
m

:

h
t
t
p
s
:
/
/
d
o
i
. o
r
g
/
1
0
. 6
0
2
8
/
N
S
T
S
P
. 8
0
0
-
5
3
A
r
5

. I

NIST SP 800-53A REV. 5
ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS
_________________________________________________________________________________________________

CHAPTER ONE

INTRODUCTION
THE NEED TO ASSESS SECURITY AND PRIVACY CONTROL EFFECTIVENESS

Today’s systems2 are complex assemblages of technology (i.e., hardware, software, and
firmware), processes, and people working together to provide organizations with the
capabilities to process, store, and transmit information in a timely manner in support of various
mission and business functions. The degree to which organizations have come to depend upon
systems to conduct routine, important, and critical mission and business functions means that
the protection of the underlying systems and environments of operation is paramount to the
success of the organization. The selection of appropriate security and privacy controls for a
system is an important task that can have significant implications on the operations and assets
of an organization as well as the welfare of individuals. Security controls are the safeguards or
countermeasures prescribed for a system or an organization to protect the confidentiality,
integrity, and availability of its system and information and to manage information security risk.

Assessing Security and Privacy Controls in Information Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Control Baselines for Information Systems and Organizations provide? (Part 2)

[Assistant]
rce under statutory authority. Nor should these guidelines be interpreted as altering or superseding the existing authorities of the Secretary of Commerce, OMB Director, or any other federal official.
This publication may be used by nongovernmental organizations on a voluntary basis, and is not subject to copyright in the United States. Attribution would, however, be appreciated by NIST. National Institute of Standards and Technology Special Publication 800-53B Natl. Inst. Stand. Technol. Spec. Publ. 800-53B, 85 pages (October 2020)

CODEN: NSPUE2

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-53B

Certain commercial entities, equipment, or materials may be identified in this document to describe an  experimental  procedure  or  concept  adequately. Such  identification  is  not  intended  to  imply recommendation or endorsement by NIST, nor is it intended to imply that the entities, materials, or equipment are necessarily the best available for the purpose. There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts, practices, and methodologies may be used by federal agencies even before the completion  of  such  companion  publications. Thus,  until  each  publication  is  completed,  current requirements, guidelines, and procedures, where they exist, remain operative. For planning and transition purposes, federal agencies may wish to closely follow the development of these new publications by NIST. Organizations are encouraged to review draft publications during the designated public comment periods and provide feedback to NIST. Many NIST publications, other than the ones noted above, are available at https://csrc.nist.gov/publications.

Control Baselines for Information Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Physical Protection?

[Assistant]
According to A Zero Trust Architecture Model for Access Control in Cloud-Native Applications in Multi-Cloud Environments:

et of cybersecurity paradigms that move defenses from static, network-based perimeters to focus on users and resources. It is a set of security primitives rather than a particular set of technologies.
Zero trust assumes that there is no implicit trust granted to user accounts based solely on their physical or network location (i.e., local area networks versus the internet) or to endpoints (devices) based on their ownership (e.g., enterprise or personally owned). Zero trust focuses on protecting resources (e.g., devices, services, workflows, network accounts) rather than network segments, as the network location is no longer seen as the prime component to the security posture of the resource. - A zero trust architecture uses zero trust principles to plan industrial and enterprise infrastructures and workflows.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations provide? (Part 9)

[Assistant]
...............................................................79                       |                                                                                |
| A.2.6.
FAMILY: ASSESSMENT, AUTHORIZATION, AND MONITORING..................................................84                                          |                                                                                |
| A.2.7. FAMILY: CONFIGURATION MANAGEMENT................................................................................87                             |                                                                                |
| A.2.8. FAMILY: CONTINGENCY PLANNING ...........................................................................................98                     |                                                                                |
| A.2.9. FAMILY: IDENTIFICATION AND AUTHENTICATION...................................................................102                                |                                                                                |
| A.2.10. FAMILY: INCIDENT RESPONSE................................................................................................105                  |                                                                                |
| A.2.11. FAMILY: MAINTENANCE.........................................................................................................110               |                                                                                |
| A.2.12. FAMILY: MEDIA PROTECTION ................................................................................................115                  |                                                                                |
| A.2.13.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for Planning?

[Assistant]
According to Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171:

There may be references in this publication to other publications currently under development by  NIST  in  accordance  with  its  assigned  statutory  responsibilities.  The  information  in  this publication, including concepts, practices, and methodologies, may be used by federal agencies even  before  the  completion  of  such  companion  publications.  Thus,  until  each  publication  is completed,  current  requirements,  guidelines,  and  procedures,  where  they  exist,  remain operative. For planning and transition purposes, federal agencies may wish to closely follow the development of these new publications by NIST.

The enhanced security requirements are organized into 14 families consistent with the families for basic and derived requirements. Each family contains the requirements related to the general security topic of the family. The families are closely aligned with the minimum security requirements for federal information and information systems in [FIPS 200]. The security requirements for contingency planning , system and services acquisition , and planning are not included within the scope of this publication due to the tailoring criteria in [SP 800-171]. Table 1 lists the security requirement families addressed in this publication. 17

- 3.11.4e  Document or reference in the system security plan the security solution selected, the rationale for the security solution, and the risk determination.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Protecting Controlled Unclassified Information (CUI)_ NIST Special Publication 800-171, Revision 3. Small Business Primer provide? (Part 14)

[Assistant]
ed security services provider (MSSP), talk to others in your industry to get their perspective on vendors they have worked with and always thoroughly review any contract or agreement prior to signing.
A helpful resource, assembled by member company participants of the National Defense Information Sharing& Analysis Center (ND-ISAC), is the Defense Industrial Base Managed Service Provider Shopping Guide for Small & Medium-Sized Businesses. You may also explore the CyberAB Marketplace to find a consulting firm to assist in NIST 800-171 implementation.* |
| Review NIST SP 800-171A to help you understandhow the security requirements in SP 800-171 can be self-assessed or are assessed by independent, third-party entities or by the | Review NIST SP 800-171A to help you understandhow the security requirements in SP 800-171 can be self-assessed or are assessed by independent, third-party entities or by the                                                                                |

* We provide links to non-NIST sites throughout this publication because they may have information of interest to readers. NIST does not necessarily endorse the views expressed or the facts presented on those sites.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Protecting Controlled Unclassified Information (CUI)_ NIST Special Publication 800-171, Revision 3. Small Business Primer provide? (Part 19)

[Assistant]
tect audit record content. - Ask internal information security staff, or your security vendor, what audit log information, if any, the system currently captures and how it is protected and maintained.
## Questions to Ask:

- Do audit records contain information that establishes type of event, when the event occurred, where the event occurred, the source of the event, outcome, and the identity of the individual associated with the event? - Who within the business should be alerted when there are, for instance, software and hardware errors, failures in audit log capturing mechanisms, or reaching or exceeding audit log storage capacity? - Are we retaining audit records for a period consistent with the business records retention policy? Note that some industries and types of data (e.g., financial, employee, and medical records) have regulatory specifications. - How are audit information and audit logging tools being protected from unauthorized access, modification, and deletion? - Is access to management of audit logging functionality authorized to only a subset of privileged users or roles? - How frequently are these records reviewed? ## Related Resources:

- View all SP 800-171 Audit and Accountability Requirements and Assessment Procedures
- NIST Log Management resources

ht ps:/

csrc.nist.gov/projects/protecting-control ed-unclas ified-information

<!-- image -->

- Logging Made Easy, Cybersecurity and Infrastructure Security Agency (CISA)

## Getting Started with Configuration Management

## Family: Configuration Management

Description: Establishing and maintaining baseline configurations and inventories of organizational systems (including hardware, software, firmware, and documentation); and establishing and enforcing security configuration settings for information technology products employed in organizational systems.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Protecting Controlled Unclassified Information (CUI)_ NIST Special Publication 800-171, Revision 3. Small Business Primer provide? (Part 16)

[Assistant]
administrator does not need access to CUI, their access should be restricted. - Reassign or remove privileges as necessary, such as when an individual no longer requires access to CUI and the system.
- Identify who within the business has administrative (i.e., system administrator or domain administrator) privileges on systems and devices. Limit administrative privileges to only those who need them to perform specified tasks. Implement policies that restrict use of these accounts for routine, day-to-day tasks that do not require administrative privileges. ## Related Resources:

- View all SP 800-171 Access Control Requirements and Assessment Procedures
- NIST Identity and Access Management Resources

*Family definitions, except for 'Supply Chain Risk Management,' are adapted from FIPS 200 , Minimum Security Requirements for Federal Information and Information Systems. ht ps:/

csrc.nist.gov/projects/protecting-control ed-unclas ified-information

## Getting Started with Access Control

<!-- image -->

## Getting Started with Awareness and Training

## Family: Awareness and Training

Description: Ensuring personnel are made aware of the security risks associated with their activities and of the applicable laws, directives, policies, standards, regulations, or procedures related to the security of organizational systems; and ensuring that organizational personnel are adequately trained to carry out their assigned information security-related duties and responsibilities. ## Getting Started with Awareness and Training

<!-- image -->

Regularly provide basic and advanced security literacy training to new and existing staff. Customize the content to make it relevant -based on the systems that personnel have authorized access to, contextualized to the work environments of personnel (e.g., telework, shop floor), and tailored to the specific roles of personnel.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Media Protection?

[Assistant]
According to Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations:

| 3.4.3. Enhancing Practices....................................................................................................................49      |                                                                                |
|-------------------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------|
| 3.5.1. Measuring C-SCRM Through Performance Measures................................................................52                                |                                                                                |
| References.........................................................................................................................................57 |                                                                                |
| Appendix A. C-SCRM Security Controls............................................................................................... | 63                                                                                |
| A.1.1. C-SCRM Controls Summary........................................................................................................63              |                                                                                |
| A.1.1.1. C-SCRM Controls Throughout the Enterprise.......................................................................64                           |                                                                                |
| A.1.2.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Access Control?

[Assistant]
According to Zero Trust Architecture:

| 1 INTRODUCCIÓN..................................................................................................................................................10 | 1 INTRODUCCIÓN..................................................................................................................................................10 | 1 INTRODUCCIÓN..................................................................................................................................................10 | |---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------| | 1.1 | HISTORIA DE LOS PROGRAMAS DE CONFIANZA CERO RELACIONADOS CON LAS AGENCIAS FEDERALES .................................11 | | | 1.2 | E STRUCTURA DEL DOCUMENTO .........................................................................................................................12 | | | CONCEPTOS BÁSICOS DE LA CONFIANZA CERO.................................................................................................13 | CONCEPTOS BÁSICOS DE LA CONFIANZA CERO.................................................................................................13 | | | 2.1 | PRINCIPIOS DE LA CONFIANZA CERO ....................................................................................................................15 | | | 2.2 | VISIÓN DE CONFIANZA CERO DE UNA RED .............................................................................................................17 | | | COMPONENTES LÓGICOS DE LA ARQUITECTURA DE CONFIANZA CERO..........................................................19 | COMPONENTES LÓGICOS DE LA ARQUITECTURA DE CONFIANZA CERO..........................................................19 | | | 3.1 VARIACIONES DE LOS ENFOQUES DE LA ARQUITECTURA DE CONFIANZA CERO ...............................................................21 | 3.1 VARIACIONES DE LOS ENFOQUES DE LA ARQUITECTURA DE CONFIANZA CERO ...............................................................21 | | | 3.1.1 | ZTA basada en una gobernanza de la identidad mejorada...................................................................22 | | | 3.1.2 | ZTA y el uso de la microsegmentación..................................................................................................23 | | | 3.1.3 | ZTA y el uso de una infraestructura de red y perímetros definidos a través de software....................23 | | | 3.2 | VARIANTES IMPLEMENTADAS DE LA ARQUITECTURA ABSTRACTA ...............................................................................24 | | | 3.2.1 | Despliegue basado en agentes y puertas de enlace de los dispositivos...............................................24


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Protecting Controlled Unclassified Information (CUI)_ NIST Special Publication 800-171, Revision 3. Small Business Primer provide? (Part 18)

[Assistant]
rses, and awareness posters. The resources will likely need to be customized to meet your own unique business needs, but they offer a starting point. Resources can be found in the resources box below.
## Related Resources:

- View all SP 800-171 Awareness and Training Requirements and Assessment Procedures
- NIST Free and Low-Cost Online Cybersecurity Learning Content

ht ps:/

csrc.nist.gov/projects/protecting-control ed-unclas ified-information

- NARA CUI training
- Center for Development of Security Excellence Security Awareness Hub

81&/$66,),('GLYPH<c=3,font=/BCDOEE+Wingdings-Regular>,1)250$7,21GLYPH<c=3,font=/BCDOEE+Wingdings-Regular>,1

<!-- image -->

## Getting Started with Audit and Accountability

## Family: Audit and Accountability

Description: Creating, protecting, and retaining system audit records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful, unauthorized, or inappropriate system activity; and ensure that the actions of individual system users can be uniquely traced to those users so they can be held accountable for their actions. ## Getting Started with Audit and Accountability

<!-- image -->

Understand and track who is performing actions within business system(s), what those actions are, and when those actions are taken. Having the ability to review system activity and analyze records, generate reports, resolve audit log process failures, and protect audit data gives the business insight into potential unauthorized activity and improves the ability to respond quickly and appropriately. Consider automated tools for conducting audit and logging activities. Products range from free, open-source tools to commercially available ones. ## Define, maintain, and protect audit record content. - Ask internal information security staff, or your security vendor, what audit log information, if any, the system currently captures and how it is protected and maintained.