[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Supply Chain Risk Management?

[Assistant]
According to Summary of NIST SP 800-53, Revision 4_ Security and Privacy Controls for Federal Information Systems and Organizations:

SP 800-53 Revision 4 has been updated to reflect the evolving technology and threat space. Example areas include issues particular to mobile and cloud computing; insider threats; applications security; supply chain risks; advanced persistent threat; and trustworthiness, assurance, and resilience of information systems. The revision also contains a new appendix of privacy controls, and related implementation guidance (Appendix J), based on the Fair Information Practice Principles (FIPPs), a widely accepted framework of defining principles to be used in the evaluation and consideration of systems, processes, or programs that affect individual privacy.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for Maintenance?

[Assistant]
According to Protecting Controlled Unclassified Information (CUI)_ NIST Special Publication 800-171, Revision 3. Small Business Primer:

| Access Control                    | Maintenance         | Security Assessment and Monitoring   |
|-----------------------------------|---------------------|--------------------------------------|
| Awareness and Training            | Media Protection    | System and Communications Protection |
| Audit and Accountability          | Personnel Security  | System and Information Integrity     |
| Configuration Management          | Physical Protection | Planning                             |
| Identification and Authentication | Risk Assessment     | System and Services Acquisition      |
| Incident Response                 |                     | Supply Chain Risk Management         |

## Updates to the Security Requirements and Families

- It is important to identify permitted and prohibited actions regarding software installation when users have the ability to install software on organizational systems. Permitted software installations could include updates and security patches to existing software and downloading new applications from organizationapproved 'app stores.' Companies might prohibit employees from downloading certain programs, services, software versions, etc .

Protecting Controlled Unclassified Information (CUI)_ NIST Special Publication 800-171, Revision 3. Small Business Primer


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Supply Chain Risk Management?

[Assistant]
According to Summary of NIST SP 800-53, Revision 4_ Security and Privacy Controls for Federal Information Systems and Organizations:

SP 800-53 Revision 4 has been updated to reflect the evolving technology and threat space. Example areas include issues particular to mobile and cloud computing; insider threats; applications security; supply chain risks; advanced persistent threat; and trustworthiness, assurance, and resilience of information systems. The revision also contains a new appendix of privacy controls, and related implementation guidance (Appendix J), based on the Fair Information Practice Principles (FIPPs), a widely accepted framework of defining principles to be used in the evaluation and consideration of systems, processes, or programs that affect individual privacy.

Summary of NIST SP 800-53, Revision 4_ Security and Privacy Controls for Federal Information Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for Supply Chain Risk Management?

[Assistant]
According to Protecting Controlled Unclassified Information (CUI)_ NIST Special Publication 800-171, Revision 3. Small Business Primer:

| Access Control                    | Maintenance         | Security Assessment and Monitoring   |
|-----------------------------------|---------------------|--------------------------------------|
| Awareness and Training            | Media Protection    | System and Communications Protection |
| Audit and Accountability          | Personnel Security  | System and Information Integrity     |
| Configuration Management          | Physical Protection | Planning                             |
| Identification and Authentication | Risk Assessment     | System and Services Acquisition      |
| Incident Response                 |                     | Supply Chain Risk Management         |

| How can I 'comply' with SP 800-171? | NIST does not have a role in determining compliance with the security requirements in SP 800-171. If you have questions regarding requirements to protect CUI or other regulatory requirements, please contact your prime contractor and/or federal point of contact for the contract. |
|----------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| How do I know if I have CUI? | It is the responsibility of the federal agency to ensure that requirements to protect CUI are identified in applicable contracts or agreements, and CUI is marked by the federal agency. |
| How do I get a 'NIST SP 800 -171 Assessment'?


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Configuration Management?

[Assistant]
According to Risk Management Framework for Information Systems and Organizations_ A System Life Cycle Approach for Security and Privacy:

curity officer; senior agency official for privacy; supply chain risk management; system development life cycle; system owner; system privacy officer; system security officer; system-specific control.
- To provide closer linkage and communication between the risk management processes and activities at the C-suite or governance level of the organization and the individuals, processes, and activities at the system and operational level of the organization;
- To institutionalize critical risk management preparatory activities at all risk management levels to facilitate a more effective, efficient, and cost-effective execution of the RMF;
- To demonstrate how the NIST Cybersecurity Framework [NIST CSF] can be aligned with the RMF and implemented using established NIST risk management processes;
- To integrate privacy risk management processes into the RMF to better support the privacy protection needs for which privacy programs are responsible;
- To promote the development of trustworthy secure software and systems by aligning life cycle-based systems engineering processes in NIST Special Publication 800-160, Volume 1 [SP 800-160 v1], with the relevant tasks in the RMF;
- To integrate security-related, supply chain risk management (SCRM) concepts into the RMF to address untrustworthy suppliers, insertion of counterfeits, tampering, unauthorized production, theft, insertion of malicious code, and poor manufacturing and development practices throughout the SDLC; and
- To allow for an organization-generated control selection approach to complement the traditional baseline control selection approach and support the use of the consolidated control catalog in NIST Special Publication 800-53, Revision 5.

Risk Management Framework for Information Systems and Organizations_ A System Life Cycle Approach for Security and Privacy


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for Planning?

[Assistant]
According to Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171:

There may be references in this publication to other publications currently under development by  NIST  in  accordance  with  its  assigned  statutory  responsibilities.  The  information  in  this publication, including concepts, practices, and methodologies, may be used by federal agencies even  before  the  completion  of  such  companion  publications.  Thus,  until  each  publication  is completed,  current  requirements,  guidelines,  and  procedures,  where  they  exist,  remain operative. For planning and transition purposes, federal agencies may wish to closely follow the development of these new publications by NIST.

The enhanced security requirements are organized into 14 families consistent with the families for basic and derived requirements. Each family contains the requirements related to the general security topic of the family. The families are closely aligned with the minimum security requirements for federal information and information systems in [FIPS 200]. The security requirements for contingency planning , system and services acquisition , and planning are not included within the scope of this publication due to the tailoring criteria in [SP 800-171]. Table 1 lists the security requirement families addressed in this publication. 17

- 3.11.4e  Document or reference in the system security plan the security solution selected, the rationale for the security solution, and the risk determination.

Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations provide? (Part 20)

[Assistant]
....................................................231 |                                                                                |
| E.2.1.
General Information.................................................................................................................232                                                                                |                                                                                |
| E.2.2. Baseline Risk Factors (Common, Minimal)...............................................................................234                                                                                |                                                                                |
| E.2.3. Risk Severity Schema................................................................................................................242                                                                                |                                                                                |
| E.2.4. Risk Response Guidance...........................................................................................................243                                                                                |                                                                                |
| E.3.1.

Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations

Risk Assessment
Maintenance
Access Control
System and Communications Protection
System and Information Integrity
Incident Response
Physical Protection
Identification and Authentication
Planning
System and Services Acquisition
Media Protection
Awareness and Training
Audit and Accountability
Supply Chain Risk Management
Configuration Management
Personnel Security
Security Assessment


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Access Control?

[Assistant]
According to Summary of NIST SP 800-53, Revision 4_ Security and Privacy Controls for Federal Information Systems and Organizations:

The resulting tailored baseline set of security controls and the supporting rationale for the selection decisions (including any information system use restrictions required by organizations) are documented in system security plans. Documenting significant risk management decisions in the security control selection process is imperative so that authorizing officials have access to necessary information to make informed authorization decisions for organizational information systems, as demonstrated in Figure 3.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What are the CMMC Level 3 requirements?

[Assistant]
According to Protecting Controlled Unclassified Information (CUI)_ NIST Special Publication 800-171, Revision 3. Small Business Primer:

ent, or possibly with other organizations like municipal governments, prime contractors, universities, etc., you will likely be required to demonstrate you are taking adequate measures to protect CUI.
Examples of CUI include:

<!-- image -->

|                      | When provided as part of a government contract, examples include:                                                                                | Marking 1     |
|----------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------|
| Controlled           | e.g., research and engineering data, engineering drawings, specifications, process sheets, manuals, technical reports, technical orders, catalog-item identifications, data sets, studies and analyses and related information, and computer software executable code and source code. | CUI//SP-CTI   |
| General Proprietary  | e.g., financial information, trade secrets, product research and development, existing and future product designs and performance specifications. | CUI//PROPIN   |
| Business Information | you do not handle CUI, implementing the security requirements in SP 800-171 will                                                                                | help you take |

1  For more information on types of CUI and markings, visit the National Archives and Records Administration (NARA) https://www.archives.gov/cui.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Assessing Enhanced Security Requirements for Controlled Unclassified Information provide? (Part 9)

[Assistant]
...................................................................... | 2   |
| CHAPTERTWO THE FUNDAMENTALS............................................................................................
| CHAPTERTWO THE FUNDAMENTALS............................................................................................ | 3   |
| 2.1                                                                                | ASSESSMENT PROCEDURES................................................................................................................ | 3   |
| 2.2                                                                                | ASSURANCE CASES.............................................................................................................................. | 4   |
| CHAPTER THREE THE PROCEDURES............................................................................................... | CHAPTER THREE THE PROCEDURES............................................................................................... | 7   |
| 3.1                                                                                | ACCESSCONTROL ............................................................................................................................... | 8   |
| 3.2                                                                                | AWARENESSANDTRAINING...............................................................................................................

Assessing Enhanced Security Requirements for Controlled Unclassified Information


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for Planning?

[Assistant]
According to Protecting Controlled Unclassified Information (CUI)_ NIST Special Publication 800-171, Revision 3. Small Business Primer:

| Access Control                    | Maintenance         | Security Assessment and Monitoring   |
|-----------------------------------|---------------------|--------------------------------------|
| Awareness and Training            | Media Protection    | System and Communications Protection |
| Audit and Accountability          | Personnel Security  | System and Information Integrity     |
| Configuration Management          | Physical Protection | Planning                             |
| Identification and Authentication | Risk Assessment     | System and Services Acquisition      |
| Incident Response                 |                     | Supply Chain Risk Management         |

| Identify the role(s) responsible for security and provide the necessary resources. | Whether it is just one person or multiple people within the business, ensure roles, responsibilities, and authorities related to cybersecurity risk management are established, communicated, understood, and enforced. Even if cybersecurity activities are outsourced to an external provider, someone within the business should still be designated to manage cybersecurity risk.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171 provide? (Part 6)

[Assistant]
chnology Laboratory (ITL) has requested that holders of patent claims whose use may be required for compliance with the guidance or requirements of this publication disclose such patent claims to ITL.
However, holders of patents are not obligated to respond to ITL calls for patents and ITL has not undertaken a patent search in order to identify which, if any, patents may apply to this publication. As of the date of publication and following call(s) for the identification of patent claims whose use may be required for compliance with the guidance or requirements of this publication, no such patent claims have been identified to ITL. No representation is made or implied by ITL that licenses are not required to avoid patent infringement in the use of this publication. \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

## HOW TO USE THIS PUBLICATION

This publication is a supplement to NIST Special Publication 800-171 [SP 800-171]. It contains recommendations  for  enhanced  security  requirements  to  provide  additional  protection  for Controlled Unclassified Information (CUI) in nonfederal systems and organizations when such information is  associated  with critical  programs  or  high  value  assets. The  enhanced  security requirements are designed to respond to the advanced persistent threat (APT) and supplement the basic and derived security requirements in [SP 800-171]. While the security requirements in [SP 800-171] focus primarily on confidentiality protection, the enhanced security requirements in this publication address confidentiality, integrity, and availability protection. The enhanced security requirements are implemented in addition to the basic and derived requirements since those requirements are not designed to address the APT.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Assessing Security and Privacy Controls in Information Systems and Organizations provide? (Part 9)

[Assistant]
privacy” is universally used since the
guidance is applicable to both security and privacy control assessments. For certain systems,
however, the guidance may only be relevant for security or privacy.
Organizations make their
own determinations on when to manage security and privacy control assessments together or
separately. SP 800-53A provides guidance on assessing controls in information security program plans,
privacy program plans, system security plans, and privacy plans. Where the guidance refers to all
plans listed above, the term “security and privacy plans” is used. If the guidance is specific to a
single type of plan (e.g., system security plan), the specific type of plan is specified. Supplemental Content

The assessment procedures in Chapter 4 are published in multiple data formats, including
comma-separated values (CSV), plain text, and Open Security Controls Assessment (OSCAL). The
available data formats are accessible from the NIST SP 800-53A Revision 5, publication details
page at https://csrc.nist.gov/publications/detail/sp/800-53a/rev-5/final. The OSCAL Content Git
Repository is available at https://github.com/usnistgov/oscal-content. The CSV, plain text, and OSCAL formats represent derivative formats of the (normative)
assessment procedures in this publication. If there are any discrepancies between the content in
derivative formats and this publication, please contact sec-cert@nist.gov. Patent Disclosure Notice

NOTICE: The Information Technology Laboratory (ITL) has requested that holders of patent
claims whose use may be required for compliance with the guidance or requirements of this
publication disclose such patent claims to ITL. However, holders of patents are not obligated to
respond to ITL calls for patents and ITL has not undertaken a patent search in order to identify
which, if any, patents may apply to this publication.

Assessing Security and Privacy Controls in Information Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Protecting Controlled Unclassified Information (CUI)_ NIST Special Publication 800-171, Revision 3. Small Business Primer provide? (Part 14)

[Assistant]
ed security services provider (MSSP), talk to others in your industry to get their perspective on vendors they have worked with and always thoroughly review any contract or agreement prior to signing.
A helpful resource, assembled by member company participants of the National Defense Information Sharing& Analysis Center (ND-ISAC), is the Defense Industrial Base Managed Service Provider Shopping Guide for Small & Medium-Sized Businesses. You may also explore the CyberAB Marketplace to find a consulting firm to assist in NIST 800-171 implementation.* |
| Review NIST SP 800-171A to help you understandhow the security requirements in SP 800-171 can be self-assessed or are assessed by independent, third-party entities or by the | Review NIST SP 800-171A to help you understandhow the security requirements in SP 800-171 can be self-assessed or are assessed by independent, third-party entities or by the                                                                                |

* We provide links to non-NIST sites throughout this publication because they may have information of interest to readers. NIST does not necessarily endorse the views expressed or the facts presented on those sites.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Information Integrity?

[Assistant]
According to Incident Response Recommendations and Considerations for Cybersecurity Risk Management_ A CSF 2.0 Community Profile:

[FISMA2014] | CSF Element | CSF Element Description | Priority | Recommendations, Considerations, Notes | |---------------|-----------------------------------------------------------------------------------|------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | ID.RA-01 | Vulnerabilities in assets are identified, validated, and recorded | Medium | on cybersecurity risk assessment.

Incident Response Recommendations and Considerations for Cybersecurity Risk Management_ A CSF 2.0 Community Profile


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for Security Assessment?

[Assistant]
According to Assessing Enhanced Security Requirements for Controlled Unclassified Information:

assessment; assessment method; assessment object; assessment procedure; assurance; enhanced security requirement; enhanced security requirement assessment; Controlled Unclassified Information; coverage; CUI Registry; depth; Executive Order 13556; FISMA; NIST Special Publication 800-53; NIST Special Publication 800-53A; NIST Special Publication 800-171; NIST Special Publication 800-172; NIST Special Publication 800-172A; nonfederal organization; nonfederal system; security assessment; security control. | CHAPTERONE INTRODUCTION...................................................................................................... | CHAPTERONE INTRODUCTION...................................................................................................... | 1   |
|-----------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------|-----|
| 1.1                                                                                | PURPOSEANDAPPLICABILITY............................................................................................................. 1        | 2   |
| 1.2                                                                                | TARGET AUDIENCE.............................................................................................................................. |     |
| 1.3                                                                                | ORGANIZATIONOF THIS SPECIAL PUBLICATION.................................................................................


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] How does Protecting Controlled Unclassified Information (CUI)_ NIST Special Publication 800-171, Revision 3. Small Business Primer support CMMC certification?

[Assistant]
According to Protecting Controlled Unclassified Information (CUI)_ NIST Special Publication 800-171, Revision 3. Small Business Primer:

ent, or possibly with other organizations like municipal governments, prime contractors, universities, etc., you will likely be required to demonstrate you are taking adequate measures to protect CUI.
Examples of CUI include:

<!-- image -->

|                      | When provided as part of a government contract, examples include:                                                                                | Marking 1     |
|----------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------|
| Controlled           | e.g., research and engineering data, engineering drawings, specifications, process sheets, manuals, technical reports, technical orders, catalog-item identifications, data sets, studies and analyses and related information, and computer software executable code and source code. | CUI//SP-CTI   |
| General Proprietary  | e.g., financial information, trade secrets, product research and development, existing and future product designs and performance specifications. | CUI//PROPIN   |
| Business Information | you do not handle CUI, implementing the security requirements in SP 800-171 will                                                                                | help you take |

1  For more information on types of CUI and markings, visit the National Archives and Records Administration (NARA) https://www.archives.gov/cui.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for System and Services Acquisition?

[Assistant]
According to Protecting Controlled Unclassified Information (CUI)_ NIST Special Publication 800-171, Revision 3. Small Business Primer:

|                      | When provided as part of a government contract, examples include:                                                                                | Marking 1     |
|----------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------|
| Controlled           | e.g., research and engineering data, engineering drawings, specifications, process sheets, manuals, technical reports, technical orders, catalog-item identifications, data sets, studies and analyses and related information, and computer software executable code and source code. | CUI//SP-CTI   |
| General Proprietary  | e.g., financial information, trade secrets, product research and development, existing and future product designs and performance specifications.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 2 require for Identification and Authentication?

[Assistant]
According to Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations:

| Table 1. Security Requirement Families .......................................................................................................4          |
|----------------------------------------------------------------------------------------------------------------------------------------------------------|
| Table 2. Security Control Tailoring Criteria.................................................................................................93          |
| Table 3. Access Control (AC) .......................................................................................................................93   |
| Table 4. Awareness and Training (AT).........................................................................................................94          |
| Table 5. Audit and Accountability (AU).......................................................................................................95          |
| Table 6. Assessment, Authorization, and Monitoring (CA).........................................................................95                       |
| Table 7. Configuration Management (CM).................................................................................................96                |
| Table 8. Contingency Planning (CP) ............................................................................................................96        |
| Table 9. Identification and Authentication (IA) ..........................................................................................97             |
| Table 10. Incident Response (IR).................................................................................................................98      |
| Table 11. Maintenance (MA) ......................................................................................................................98      |
| Table 12.

Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for Risk Assessment?

[Assistant]
According to Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171:

Advanced Persistent Threat; Basic Security Requirement; Contractor Systems; Controlled Unclassified Information; CUI Registry; Derived Security Requirement; Enhanced Security Requirement; Executive Order 13556; FIPS Publication 199; FIPS Publication 200; FISMA; NIST Special Publication 800-53; Nonfederal Organizations; Nonfederal Systems; Security Assessment; Security Control; Security Requirement. This publication is a supplement to NIST Special Publication 800-171 [SP 800-171]. It contains recommendations  for  enhanced  security  requirements  to  provide  additional  protection  for Controlled Unclassified Information (CUI) in nonfederal systems and organizations when such information is  associated  with critical  programs  or  high  value  assets. The  enhanced  security requirements are designed to respond to the advanced persistent threat (APT) and supplement the basic and derived security requirements in [SP 800-171]. While the security requirements in [SP 800-171] focus primarily on confidentiality protection, the enhanced security requirements in this publication address confidentiality, integrity, and availability protection. The enhanced security requirements are implemented in addition to the basic and derived requirements since those requirements are not designed to address the APT. The enhanced security requirements apply to those components of nonfederal systems that process, store, or transmit CUI or that provide protection for such components. There is no expectation that all of the enhanced security requirements will be selected by federal agencies implementing this guidance. The decision to select a particular set of enhanced security requirements will be based on the mission and business needs of federal agencies and guided and informed by ongoing risk assessments.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for System and Services Acquisition?

[Assistant]
According to Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171:

........................................................................ | CHAPTERONE INTRODUCTION......................................................................................................
|
|--------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------|
| 1.1 PURPOSEANDAPPLICABILITY                                                                                | ................................................................................................... 3                                            |
| 1.2 TARGET AUDIENCE                                                                                | .................................................................................................................. 4                             |
| 1.3 ORGANIZATIONOF THIS SPECIAL PUBLICATION                                                                                | .......................................................................... 4                                                                     |
| CHAPTERTWO THE FUNDAMENTALS............................................................................................ 5                        | CHAPTERTWO THE FUNDAMENTALS............................................................................................ 5                        |
| 2.1 DEVELOPMENTAPPROACH ......................................................................................................


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for Physical Protection?

[Assistant]
According to Assessing Enhanced Security Requirements for Controlled Unclassified Information:

The NIST Information Technology Laboratory (ITL) promotes the U.S. economy and public welfare by providing technical leadership for the Nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, implementations, proofs of concept, and technical analyses to advance the development and productive use of information technology (IT). ITL's responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security of other than national security-related information in federal information systems. The Special Publication 800-series reports on ITL's research, guidelines, and outreach efforts in information systems security and privacy and its collaborative activities with industry, government, and academic organizations. Unless specified by legislation, regulation, or government-wide policy, the term system is used in this publication instead of information system . This change reflects a broad-based and holistic definition of systems that includes general-purpose systems, industrial control systems, cyberphysical systems, and individual devices that are part of the Internet of Things. As computing systems and information technologies are deployed ubiquitously worldwide and systems and components are increasingly connected through wired and wireless networks, the susceptibility of Controlled Unclassified Information to loss or compromise grows - as does the potential for adverse consequences resulting from such occurrences. | CHAPTERONE INTRODUCTION...................................................................................................... | CHAPTERONE INTRODUCTION......................................................................................................


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What guidance does NIST provide for CMMC Level 3?

[Assistant]
According to Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171:

systems, but such standards and guidelines shall not apply to national security systems without the express approval of the appropriate federal officials exercising policy authority over such systems.
This guideline is consistent with requirements of the Office of Management and Budget (OMB) Circular A-130. Nothing in this publication should be taken to contradict the standards and guidelines made mandatory and binding on federal agencies by the Secretary of Commerce under statutory authority. Nor should these guidelines be interpreted as altering or superseding the existing authorities of the Secretary of Commerce, OMB Director, or any other federal official. This publication may be used by nongovernmental organizations on a voluntary basis and is not subject to copyright in the United States. Attribution would, however, be appreciated by NIST. National Institute of Standards and Technology Special Publication 800-172 Natl. Inst. Stand. Technol. Spec. Publ. 800-172, 84 pages (February 2021)

CODEN: NSPUE2

This publication is available free of charge from:

https://doi.org/10.6028/NIST.SP.800-172

Certain  commercial  entities,  equipment,  or  materials  may  be  identified  in  this  document  to describe an experimental procedure or concept adequately. Such identification is not intended to imply recommendation or endorsement by NIST, nor is it intended to imply that the entities, materials, or equipment are necessarily the best available for the purpose. There may be references in this publication to other publications currently under development by  NIST  in  accordance  with  its  assigned  statutory  responsibilities. The  information  in  this publication, including concepts, practices, and methodologies, may be used by federal agencies even  before  the  completion  of  such  companion  publications. Thus,  until  each  publication  is completed,  current  requirements,  guidelines,  and  procedures,  where  they  exist,  remain operative.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for Configuration Management?

[Assistant]
According to Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171:

| CHAPTERONE INTRODUCTION...................................................................................................... | CHAPTERONE INTRODUCTION...................................................................................................... |
|--------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------|
| 1.1 PURPOSEANDAPPLICABILITY                                                                                | ................................................................................................... 3                                            |
| 1.2 TARGET AUDIENCE                                                                                | .................................................................................................................. 4                             |
| 1.3 ORGANIZATIONOF THIS SPECIAL PUBLICATION                                                                                | .......................................................................... 4                                                                     |
| CHAPTERTWO THE FUNDAMENTALS............................................................................................ 5                        | CHAPTERTWO THE FUNDAMENTALS............................................................................................ 5                        |
| 2.1 DEVELOPMENTAPPROACH ......................................................................................................


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for System and Information Integrity?

[Assistant]
According to Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171:

This publication is a supplement to NIST Special Publication 800-171 [SP 800-171]. It contains recommendations  for  enhanced  security  requirements  to  provide  additional  protection  for Controlled Unclassified Information (CUI) in nonfederal systems and organizations when such information is  associated  with critical  programs  or  high  value  assets. The  enhanced  security requirements are designed to respond to the advanced persistent threat (APT) and supplement the basic and derived security requirements in [SP 800-171]. While the security requirements in [SP 800-171] focus primarily on confidentiality protection, the enhanced security requirements in this publication address confidentiality, integrity, and availability protection. The enhanced security requirements are implemented in addition to the basic and derived requirements since those requirements are not designed to address the APT. The enhanced security requirements apply to those components of nonfederal systems that process, store, or transmit CUI or that provide protection for such components. In addition to protecting CUI from unauthorized disclosure, the enhanced security requirements have been designed to protect the integrity and availability of CUI. This is achieved by promoting penetration-resistant architectures, damage-limiting operations, and designs to help achieve cyber resiliency and survivability. | CHAPTERONE INTRODUCTION...................................................................................................... | CHAPTERONE INTRODUCTION......................................................................................................


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Personnel Security?

[Assistant]
According to Risk Management Framework for Information Systems and Organizations_ A System Life Cycle Approach for Security and Privacy:

the Federal Information Security Modernization Act of 2014 (FISMA), the Privacy Act of 1974, OMB policies, and Federal Information Processing Standards, among other laws,  regulations,  and  policies.
The  scope  of  this  publication  pertains  to  federal  information systems,  which  are  discrete  sets  of  information  resources  organized  for  the  collection, processing, maintenance, use, sharing, dissemination, or disposition of information, whether such information is in digital or non-digital form. Information resources include information and related resources, such as personnel, equipment, funds, and information technology.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for Identification and Authentication?

[Assistant]
According to Assessing Enhanced Security Requirements for Controlled Unclassified Information:

| ASSESSMENT PROCEDURES................................................................................................................
| 3   |
| 2.2                                                                                | ASSURANCE CASES.............................................................................................................................. | 4   |
| CHAPTER THREE THE PROCEDURES............................................................................................... | CHAPTER THREE THE PROCEDURES............................................................................................... | 7   |
| 3.1                                                                                | ACCESSCONTROL ............................................................................................................................... | 8   |
| 3.2                                                                                | AWARENESSANDTRAINING............................................................................................................... | 9   |
| 3.3                                                                                | AUDIT ANDACCOUNTABILITY........................................................................................................... | 10  |
| 3.4                                                                                | CONFIGURATION MANAGEMENT.....................................................................................................


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171 provide? (Part 7)

[Assistant]
tegrity, and availability protection. The enhanced security requirements are implemented in addition to the basic and derived requirements since those requirements are not designed to address the APT.
The enhanced security requirements apply to those components of nonfederal systems that process, store, or transmit CUI or that provide protection for such components. There is no expectation that all of the enhanced security requirements will be selected by federal agencies implementing this guidance. The decision to select a particular set of enhanced security requirements will be based on the mission and business needs of federal agencies and guided and informed by ongoing risk assessments. The enhanced security requirements for nonfederal systems processing, storing, or transmitting CUI associated with critical programs or high value assets will be conveyed to nonfederal organizations by federal agencies in a contract, grant, or other agreement. The application of the enhanced security requirements to subcontractors will also be addressed by federal agencies in consultation with nonfederal organizations. \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

## THE APPLICABILITY OF ENHANCED SECURITY REQUIREMENTS

The enhanced security requirements are only applicable to a nonfederal system or nonfederal organization as mandated by a federal agency in a contract, grant, or other agreement. The requirements apply to the components of nonfederal systems that process, store, or transmit CUI associated with a critical program or a high value asset or that provide protection for such components. The requirements also apply to services, including externally provided services, that process, store, or transmit CUI, or that provide security protections, for the system requiring enhanced protection.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 2 require for Personnel Security?

[Assistant]
According to Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations:

| Table 1. Security Requirement Families .......................................................................................................4          |
|----------------------------------------------------------------------------------------------------------------------------------------------------------|
| Table 2. Security Control Tailoring Criteria.................................................................................................93          |
| Table 3. Access Control (AC) .......................................................................................................................93   |
| Table 4. Awareness and Training (AT).........................................................................................................94          |
| Table 5. Audit and Accountability (AU).......................................................................................................95          |
| Table 6. Assessment, Authorization, and Monitoring (CA).........................................................................95                       |
| Table 7. Configuration Management (CM).................................................................................................96                |
| Table 8. Contingency Planning (CP) ............................................................................................................96        |
| Table 9. Identification and Authentication (IA) ..........................................................................................97             |
| Table 10. Incident Response (IR).................................................................................................................98      |
| Table 11. Maintenance (MA) ......................................................................................................................98      |
| Table 12.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for Incident Response?

[Assistant]
According to Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171:

............................................ 5                        |
| 2.1 DEVELOPMENTAPPROACH ......................................................................................................
| 5                                                                                |
| 2.2 ORGANIZATIONANDSTRUCTURE                                                                                | ............................................................................................. 7                                                  |
| 2.3 FLEXIBLE APPLICATION                                                                                | ............................................................................................................. 9                                  |
| CHAPTER THREE THE REQUIREMENTS......................................................................................... 11                       | CHAPTER THREE THE REQUIREMENTS......................................................................................... 11                       |
| 3.1 ACCESSCONTROL                                                                                | .................................................................................................................. 12                            |
| 3.2 AWARENESSANDTRAINING                                                                                | ...................................................................................................


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for Maintenance?

[Assistant]
According to Assessing Enhanced Security Requirements for Controlled Unclassified Information:

| ASSESSMENT PROCEDURES................................................................................................................
| 3   |
| 2.2                                                                                | ASSURANCE CASES.............................................................................................................................. | 4   |
| CHAPTER THREE THE PROCEDURES............................................................................................... | CHAPTER THREE THE PROCEDURES............................................................................................... | 7   |
| 3.1                                                                                | ACCESSCONTROL ............................................................................................................................... | 8   |
| 3.2                                                                                | AWARENESSANDTRAINING............................................................................................................... | 9   |
| 3.3                                                                                | AUDIT ANDACCOUNTABILITY........................................................................................................... | 10  |
| 3.4                                                                                | CONFIGURATION MANAGEMENT.....................................................................................................


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Assessing Enhanced Security Requirements for Controlled Unclassified Information provide? (Part 19)

[Assistant]
_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

designs) associated with a system. Mechanisms are the specific hardware, software, or firmware safeguards employed within a system.
Activities are the protection-related actions supporting a system that involve people (e.g., conducting system backup operations, exercising a contingency plan, and monitoring network traffic). Individuals are people who apply the specifications, mechanisms, or activities described above. Assessment methods define the nature and extent of the assessor's actions. The methods include examine , interview , and test . The examine method is the process of reviewing, inspecting, observing, studying, or analyzing assessment objects (i.e., mechanisms, activities, specifications). The interview method is the process of holding discussions with individuals or groups of individuals to facilitate understanding, achieve clarification, or obtain evidence. The test method is the process of exercising assessment objects (i.e., activities, mechanisms) under specified conditions to compare actual with expected behavior. The purpose of the assessment methods is to facilitate understanding, achieve clarification, and obtain evidence. The results obtained from applying the methods are used for making the specific determinations called for in the determination statements and thereby achieving the objectives for the assessment procedure. The assessment methods described above have associated attributes of depth and coverage , which affect the level of effort for the assessment. These attributes provide a means to define the rigor and scope of the assessment to obtain the assurance needed for enhanced security requirements. A description of assessment methods and objects is provided in Appendix C. Figure 1 illustrates an example of an assessment procedure for the CUI enhanced security requirement 3.1.3e from [SP 800-172].


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for Physical Protection?

[Assistant]
According to Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171:

| ...................................................................................................
3                                            |
| 1.2 TARGET AUDIENCE                                                                                | .................................................................................................................. 4                             |
| 1.3 ORGANIZATIONOF THIS SPECIAL PUBLICATION                                                                                | .......................................................................... 4                                                                     |
| CHAPTERTWO THE FUNDAMENTALS............................................................................................ 5                        | CHAPTERTWO THE FUNDAMENTALS............................................................................................ 5                        |
| 2.1 DEVELOPMENTAPPROACH ...................................................................................................... | 5                                                                                |
| 2.2 ORGANIZATIONANDSTRUCTURE                                                                                | ............................................................................................. 7                                                  |
| 2.3 FLEXIBLE APPLICATION                                                                                | .............................................................................................................


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for System and Services Acquisition?

[Assistant]
According to Protecting Controlled Unclassified Information (CUI)_ NIST Special Publication 800-171, Revision 3. Small Business Primer:

ource code. | CUI//SP-CTI   |
| General Proprietary  | e.g., financial information, trade secrets, product research and development, existing and future product designs and performance specifications.
| CUI//PROPIN   |
| Business Information | you do not handle CUI, implementing the security requirements in SP 800-171 will                                                                                | help you take |

| Access Control                    | Maintenance         | Security Assessment and Monitoring   |
|-----------------------------------|---------------------|--------------------------------------|
| Awareness and Training            | Media Protection    | System and Communications Protection |
| Audit and Accountability          | Personnel Security  | System and Information Integrity     |
| Configuration Management          | Physical Protection | Planning                             |
| Identification and Authentication | Risk Assessment     | System and Services Acquisition      |
| Incident Response                 |                     | Supply Chain Risk Management         |


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for Incident Response?

[Assistant]
According to Protecting Controlled Unclassified Information (CUI)_ NIST Special Publication 800-171, Revision 3. Small Business Primer:

| Access Control                    | Maintenance         | Security Assessment and Monitoring   |
|-----------------------------------|---------------------|--------------------------------------|
| Awareness and Training            | Media Protection    | System and Communications Protection |
| Audit and Accountability          | Personnel Security  | System and Information Integrity     |
| Configuration Management          | Physical Protection | Planning                             |
| Identification and Authentication | Risk Assessment     | System and Services Acquisition      |
| Incident Response                 |                     | Supply Chain Risk Management         |

Below is an example of the Incident Response Testing requirement, which is part of the Incident Response (IR) family. The structure and content of a typical security requirement includes:

## Family: Incident Response


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Protecting Controlled Unclassified Information (CUI)_ NIST Special Publication 800-171, Revision 3. Small Business Primer provide? (Part 11)

[Assistant]
f those systems or components, helps practitioners understand the scope of applicability of SP 800-171 security requirements to business systems. <!-- image -->

Scope and Applicability of SP 800-171.
The security requirements in NIST SP 800-171 are only applicable to components of nonfederal systems that process, store, or transmit CUI or that provide protection for such components. Appropriately scoping requirements is an important factor in determining protection-related investment decisions and managing security risks for your business. You may limit the scope of the security requirements by isolating the system components in a separate security domain. Isolation can be achieved by implementing subnetworks with firewalls or other boundary protection devices. Security domains may employ physical separation, logical separation, or a combination of both. This approach can provide adequate security for CUI and avoid increasing the organization's security posture beyond what it requires for protecting its missions, operations, and assets. ht ps:/

csrc.nist.gov/projects/protecting-control ed-unclas ified-information

Below is a sample CUI data flow diagram for a fictional company. Create your own diagram to understand how CUI flows into, within, and out of the business. <!-- image -->

## General Tips for Getting Started with NIST SP 800-171

<!-- image -->

| Identify the role(s) responsible for security and provide the necessary resources. | Whether it is just one person or multiple people within the business, ensure roles, responsibilities, and authorities related to cybersecurity risk management are established, communicated, understood, and enforced. Even if cybersecurity activities are outsourced to an external provider, someone within the business should still be designated to manage cybersecurity risk.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Summary of NIST SP 800-53, Revision 4_ Security and Privacy Controls for Federal Information Systems and Organizations provide? (Part 6)

[Assistant]
following components: (i) a control section; (ii) a supplemental guidance section; (iii) a control enhancements section; (iv) a references section; and (v) a priority and baseline allocation section.
Figure 2: The Risk Management Framework

<!-- image -->

## 3 Control Baselines and Tailoring

To assist organizations in making the appropriate selection of security controls for information systems, the concept of security control baselines is introduced. Security control baselines are the starting point for the security control selection process and are chosen based on the security category and associated impact level of information systems determined in accordance with FIPS Publication 199 and FIPS Publication 200, respectively (Step One of the RMF). SP 800-53 Rev. 4 states that 'the security controls and control enhancements listed in the initial baselines are not a minimum- but rather a proposed starting point from which controls and controls enhancements may be removed or added.' Appendix D provides a listing of baseline security controls corresponding to the low-impact, moderate-impact, and high-impact information systems, using the high water mark defined in FIPS Publication 200. The security control baselines address the security needs of a broad and diverse set of constituencies, and are developed based on a number of general assumptions, including common environmental, operational, and functional considerations. The baselines also assume typical threats facing common information systems. Articulating the underlying assumptions is a key element in the initial risk framing step of the risk management process described in NIST SP 800-39. To ensure that an appropriate set of controls is identified to provide security commensurate with risk, organizations tailor the controls to align with specific security needs.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Control Baselines for Information Systems and Organizations provide? (Part 17)

[Assistant]
| CONFIGURATIONMANAGEMENTFAMILY ................................................................................
| 24                                                                                |
| 3.6                                                                                | CONTINGENCYPLANNINGFAMILY .......................................................................................... | 26                                                                                |
| 3.7                                                                                | IDENTIFICATIONANDAUTHENTICATIONFAMILY ...................................................................... | 28                                                                                |
| 3.8                                                                                | INCIDENT RESPONSE FAMILY .................................................................................................. | 30                                                                                |
| 3.9                                                                                | MAINTENANCEFAMILY ..........................................................................................................

Control Baselines for Information Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Assessing Security Requirements for Controlled Unclassified Information provide? (Part 3)

[Assistant]
10.6028/NIST.SP.800-171A

## How to Cite this NIST Technical Series Publication:

Ross R, Pillitteri V (2024) Assessing Security Requirements for Controlled Unclassified Information and Organizations.
(National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) NIST SP 800-171Ar3. https://doi.org/10.6028/NIST.SP.800-171Ar3

## Author ORCID iDs

Ron Ross: 0000-0002-1099-9757 Victoria Pillitteri: 0000-0002-7446-7506

## Submit Comments

## 800-171comments@list.nist.gov

National Institute of Standards and Technology Attn: Computer Security Division, Information Technology Laboratory 100 Bureau Drive (Mail Stop 8930) Gaithersburg, MD 20899-8930

## Additional Information

Additional information about this publication is available at https://csrc.nist.gov/pubs/sp/800/171/a/r3/final, including related content, potential updates, and document history. All comments are subject to release under the Freedom of Information Act (FOIA). ## Abstract

The protection of Controlled Unclassified Information (CUI) is of paramount importance to federal agencies and can directly impact the ability of the Federal Government to successfully conduct its essential missions and functions. This publication provides organizations with assessment procedures and a methodology that can be used to conduct assessments of the security requirements in NIST Special Publication 800-171, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations . The assessment procedures are flexible and can be customized to the needs of organizations and assessors. Assessments can be conducted as independent, third-party assessments or as government-sponsored assessments. The assessments can be applied with various degrees of rigor based on customer-defined depth and coverage attributes.

Assessing Security Requirements for Controlled Unclassified Information


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Identification and Authentication?

[Assistant]
According to Assessing Security and Privacy Controls in Information Systems and Organizations:

NTROL ASSESSMENTS ..................................................... 30
3.4   ANALYZE ASSESSMENT REPORT RESULTS .....................................................................................
32
3.5   ASSESS SECURITY AND PRIVACY CAPABILITIES .............................................................................. 34
CHAPTER FOUR SECURITY AND PRIVACY ASSESSMENT PROCEDURES ................................................. 37
4.1   ACCESS CONTROL............................................................................................................................ 40
4.2   AWARENESS AND TRAINING ........................................................................................................ 118
4.3   AUDIT AND ACCOUNTABILITY ...................................................................................................... 128
4.4   ASSESSMENT, AUTHORIZATION, AND MONITORING ................................................................. 160
4.5   CONFIGURATION MANAGEMENT ................................................................................................ 177
4.6   CONTINGENCY PLANNING ............................................................................................................ 215
4.7   IDENTIFICATION AND AUTHENTICATION .................................................................................... 243
4.8   INCIDENT RESPONSE ............................................................................................................... 275
4.9   MAINTENANCE ........................................................................................................................ 298
4.10   MEDIA PROTECTION .............................................................................................................. 316
4.11   PHYSICAL AND ENVIRONMENTAL PROTECTION .......................................................................


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Assessing Security and Privacy Controls in Information Systems and Organizations provide? (Part 4)

[Assistant]
0-series reports on ITL’s research, guidelines, and outreach
efforts in information systems security and privacy and its collaborative activities with industry,
government, and academic organizations.
Abstract

This publication provides a methodology and set of procedures for conducting assessments of
security and privacy controls employed within systems and organizations within an effective risk
management framework. The assessment procedures, executed at various phases of the system
development life cycle, are consistent with the security and privacy controls in NIST Special
Publication 800-53, Revision 5. The procedures are customizable and can be easily tailored to
provide organizations with the needed flexibility to conduct security and privacy control
assessments that support organizational risk management processes and are aligned with the
stated risk tolerance of the organization. Information on building effective security and privacy
assessment plans is also provided with guidance on analyzing assessment results. Keywords

Assessment; assessment plan; assurance; control assessment; FISMA; Privacy Act; privacy
controls; Open Security Controls Assessment Language; OSCAL; privacy requirements; Risk
Management Framework; security controls; security requirements. ii

T
h
s

i

p
u
b

l
i

c
a

t
i

o
n

i

s

a
v
a

i
l

l

a
b
e
f
r
e
e
o
f

c
h
a
r
g
e
f
r
o
m

:

h
t
t
p
s
:
/
/
d
o
i
. o
r
g
/
1
0
. 6
0
2
8
/
N
S
T
S
P
. 8
0
0
-
5
3
A
r
5

I

. NIST SP 800-53A REV. 5
ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS
_________________________________________________________________________________________________

Acknowledgments

This publication was developed by the Joint Task Force Interagency Working Group. The group
includes representatives from the civil, defense, and intelligence communities.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for Risk Assessment?

[Assistant]
According to Protecting Controlled Unclassified Information (CUI)_ NIST Special Publication 800-171, Revision 3. Small Business Primer:

NIST SP 800-172, Enhanced Security Requirements for Protecting Controlled Unclassified Information provides enhanced security requirements to help protect CUI associated with critical programs or high value assets in nonfederal systems and organizations from the advanced persistent threat (APT). The SP 800-172 enhanced security requirements are designed to protect confidentiality, integrity and availability of information.

| Access Control                    | Maintenance         | Security Assessment and Monitoring   |
|-----------------------------------|---------------------|--------------------------------------|
| Awareness and Training            | Media Protection    | System and Communications Protection |
| Audit and Accountability          | Personnel Security  | System and Information Integrity     |
| Configuration Management          | Physical Protection | Planning                             |
| Identification and Authentication | Risk Assessment     | System and Services Acquisition      |
| Incident Response                 |                     | Supply Chain Risk Management         |

- An understanding of the need for security (why is cybersecurity important to our business mission?).
- Specific actions required of users to maintain security (required use of multi-factor authentication, not sharing passwords, etc.).
- How to respond to confirmed or suspected incidents.
- How to securely handle CUI (training should be provided to staff before authorizing access to the system or CUI).
- How to recognize and report insider threats, social engineering, and social mining.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Protecting Controlled Unclassified Information (CUI)_ NIST Special Publication 800-171, Revision 3. Small Business Primer provide? (Part 6)

[Assistant]
ents in SP 800-171. If you have questions regarding requirements to protect CUI or other regulatory requirements, please contact your prime contractor and/or federal point of contact for the contract.
|
|----------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| How do I know if I have CUI? | It is the responsibility of the federal agency to ensure that requirements to protect CUI are identified in applicable contracts or agreements, and CUI is marked by the federal agency. |
| How do I get a 'NIST SP 800 -171 Assessment'? | The term 'NIST Assessment' and 'NIST SP 800 - 171 Assessment' is frequently used to describe the Department of Defense (DOD) proce ss used to complete its NIST SP 800-171 Assessment Module through the Supplier Performance Risk System (SPRS). NIST develops the underlying technical guidelines (SP 800-171, SP 800-171A, SP 800-172, and SP 800- 172A) on which the 'NIST Assessment' is based, but NIST does not have a role in DOD's implementation of its programs . For additional guidance on NIST's methodology to plan, prepare for, and conduct security requirement assessments, refer to SP 800-171A. |
| What products, vendors, or solutions are 'NIST SP 800 -171 compliant' or 'CMMC - certified'? | NIST does not identify or track implementation of or compliance with the security requirements.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AU.L2-3.3.1 (NIST 3.3.1)?

[Assistant]
According to Zero Trust Architecture:

3.3.1                                                                                | Variaciones del algoritmo de confianza... 3.3.1). 3.3.1).


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AC.L2-3.1.15 (NIST 3.1.15)?

[Assistant]
According to Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations:

3.1.15. 3.1.15.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for Awareness and Training?

[Assistant]
According to Protecting Controlled Unclassified Information (CUI)_ NIST Special Publication 800-171, Revision 3. Small Business Primer:

| Access Control                    | Maintenance         | Security Assessment and Monitoring   |
|-----------------------------------|---------------------|--------------------------------------|
| Awareness and Training            | Media Protection    | System and Communications Protection |
| Audit and Accountability          | Personnel Security  | System and Information Integrity     |
| Configuration Management          | Physical Protection | Planning                             |
| Identification and Authentication | Risk Assessment     | System and Services Acquisition      |
| Incident Response                 |                     | Supply Chain Risk Management         |

## Getting Started with Awareness and Training

## Family: Awareness and Training


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for Personnel Security?

[Assistant]
According to Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171:

............................................ 5                        |
| 2.1 DEVELOPMENTAPPROACH ......................................................................................................
| 5                                                                                |
| 2.2 ORGANIZATIONANDSTRUCTURE                                                                                | ............................................................................................. 7                                                  |
| 2.3 FLEXIBLE APPLICATION                                                                                | ............................................................................................................. 9                                  |
| CHAPTER THREE THE REQUIREMENTS......................................................................................... 11                       | CHAPTER THREE THE REQUIREMENTS......................................................................................... 11                       |
| 3.1 ACCESSCONTROL                                                                                | .................................................................................................................. 12                            |
| 3.2 AWARENESSANDTRAINING                                                                                | ...................................................................................................


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for Audit and Accountability?

[Assistant]
According to Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171:

............................................ 5                        |
| 2.1 DEVELOPMENTAPPROACH ......................................................................................................
| 5                                                                                |
| 2.2 ORGANIZATIONANDSTRUCTURE                                                                                | ............................................................................................. 7                                                  |
| 2.3 FLEXIBLE APPLICATION                                                                                | ............................................................................................................. 9                                  |
| CHAPTER THREE THE REQUIREMENTS......................................................................................... 11                       | CHAPTER THREE THE REQUIREMENTS......................................................................................... 11                       |
| 3.1 ACCESSCONTROL                                                                                | .................................................................................................................. 12                            |
| 3.2 AWARENESSANDTRAINING                                                                                | ...................................................................................................


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for Awareness and Training?

[Assistant]
According to Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171:

............................................ 5                        |
| 2.1 DEVELOPMENTAPPROACH ......................................................................................................
| 5                                                                                |
| 2.2 ORGANIZATIONANDSTRUCTURE                                                                                | ............................................................................................. 7                                                  |
| 2.3 FLEXIBLE APPLICATION                                                                                | ............................................................................................................. 9                                  |
| CHAPTER THREE THE REQUIREMENTS......................................................................................... 11                       | CHAPTER THREE THE REQUIREMENTS......................................................................................... 11                       |
| 3.1 ACCESSCONTROL                                                                                | .................................................................................................................. 12                            |
| 3.2 AWARENESSANDTRAINING                                                                                | ...................................................................................................


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Protecting Controlled Unclassified Information (CUI)_ NIST Special Publication 800-171, Revision 3. Small Business Primer provide? (Part 15)

[Assistant]
nks to non-NIST sites throughout this publication because they may have information of interest to readers. NIST does not necessarily endorse the views expressed or the facts presented on those sites.
Further, NIST does not endorse any commercial products that may be advertised or available on these sites. ht ps:/

csrc.nist.gov/projects/protecting-control ed-unclas ified-information

## Family: Access Control

Description: Limiting information system access to authorized users, processes acting on behalf of authorized users, or devices (including other information systems) and to the types of transactions and functions that authorized users are permitted to exercise.*

## Getting Started with Access Control

<!-- image -->

Implement policies and procedures that limit access to CUI on systems and devices to only those individuals that require such access to do their jobs . Complete a review of publicly available information , such as information on the company website. - Review the content for CUI and remove such information if discovered. CUI should not be available to the public. ## Protect CUI with device locks and session termination . - Train staff on these behaviors and establish policies that prevent unauthorized individuals from seeing CUI or other sensitive information on a device while the device is unattended by an individual. When the individual returns to their device, they will have to re-establish access by using a password or biometric authenticator

Foundational Concept -Least Privilege: This involves limiting access rights to only those users who need it to accomplish assigned tasks. - Identify who has access to CUI and the system. Only those who require access to CUI should have it. For example, if a network or system administrator does not need access to CUI, their access should be restricted. - Reassign or remove privileges as necessary, such as when an individual no longer requires access to CUI and the system.