You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain (AUP) Audit Support & Protection according to NIST IoT Device Cybersecurity Guidance for the Federal Government_ IoT Device Cybersecurity Requirement Catalog According to IoT Device Cybersecurity Guidance for the Federal Government_ IoT Device Cybersecurity Requirement Catalog, (AUP) Audit Support & Protection: Description: Ability for the device to support and protect audit activities and associated data. Discussion: Organizations will need to use logged information as part of audits to implement security controls and comply with requirements. IoT devices may have to support through features and functions some aspects of that audit process, such as providing access to or transmitting logs when needed by the organization. Related SP 800-53 Rev. 5 Controls: AU-5(5), AU-6, AU-7, AU-9, SI-4 Requirements that may be necessary: 1. Ability to report on its cybersecurity state. 2. Ability to support a self-audit generation process. 3. Ability to run audit scans (automated or otherwise) to provide specific information (e.g., such as that requested for an external process to audit the device). 4. Ability to send requested audit logs to an external audit process or information system (e.g., where its auditing information can be checked to allow for review, analysis, and reporting). 5. Ability to support an alternate auditing process in the event that the primary auditing process fails. 6. Ability to protect the audit information through the use of: - a. Encryption. - b. Digitally signing audit files. - c. Securely sending audit files to another device. - d. Other protections created by the device manufacturer. 7. Ability to prevent any entities from editing audit logs unless the entity is authorized and is responsible for maintaining the audit logs.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: IoT Device Cybersecurity Guidance for the Federal Government_ IoT Device Cybersecurity Requirement Catalog.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Recommendation for Random Bit Generator (RBG) Constructions say about A.1.4. Entropy and Security Strength in This Recommendation? (Part 2) According to Recommendation for Random Bit Generator (RBG) Constructions, A.1.4. Entropy and Security Strength in This Recommendation: case, the security strength of a bitstring produced by the RBG is the minimum of highest\_strength and the length of the bitstring - that is, security\_strength = min ( highest\_strength , length ) . The DRBG within an RBGC construction is instantiated using a bitstring from a randomness source. The randomness source for an RBGC construction will be either the initial randomness source or another RBGC construction. The tree of RBGC constructions will always originate from 40 However, the entropy-source output may be cryptographically processed by an approved conditioning function before being used. an approved initial randomness source that is either a full-entropy source or an RBG2 or RBG3 construction, each of which includes a validated entropy source. In conclusion, entropy sources and properly functioning RBG3 constructions provide output with entropy. RBG1, RBG2, and RBGC constructions provide output with a security strength that depends on the security strength of the RBG instantiation and the length of the output. Likewise, if the entropy source used by an RBG3 construction fails undetectably, the output is then dependent on the DRBG within the construction (i.e., an RBG2(P) construction) to produce output at the highest security strength for the DRBG design. Because of the difference between the use of 'entropy' to describe the output of an entropy source and the use of 'security strength' to describe the output of a DRBG, the term 'randomness' is used as a general term to mean either 'entropy' or 'security strength,' as appropriate. A 'randomness source' is the general term for an entropy source or RBG that provides the randomness used by an RBG.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Recommendation for Random Bit Generator (RBG) Constructions.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Protecting the Integrity of Internet Routing_ Border Gateway Protocol (BGP) Route Origin Validation say about Actual Results? According to Protecting the Integrity of Internet Routing_ Border Gateway Protocol (BGP) Route Origin Validation, Actual Results: Unable to complete certain steps. See comments below.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Protecting the Integrity of Internet Routing_ Border Gateway Protocol (BGP) Route Origin Validation.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Glossary of Computer Security Terminology say about 2) See COMPUTER SECURITY.? (Part 12) According to Glossary of Computer Security Terminology, 2) See COMPUTER SECURITY.: essing systems, other electronic information handling systems, and associated equipment. (NSDD-145; NTISSP 200) - 3) An information system (as defined in Section 6d of the Circular) that is automated. (A-130) automated information systems security automated security monitoring automatic data processing (ADP) system - 1) Measures and controls that protect an AIS against denial ofservice and unauthorized, (accidental or intentional) disclosure, modification or destruction ofAISs and data. AIS security includes consideration of all hardware andlor software functions, characteristics andlor features: operational procedures, accountability procedures, and access controls at the central computer facility, remote computer, and terminal facilities; management constraints; physical structures and devices; and personnel and communications controls needed to provide an acceptable level of risk for the AIS and for the data and information contained in the AIS. It includes the totality ofsecurity safeguards needed to provide an acceptable protection level for an AIS and for data handled by an AIS. (NCSC-TG-004-88) - 2) See COMPUTER SECURITY. - 1) The use of automated procedures to ensure that automation security controls are not circumvented. (AR 380-380) - 2) The use of automated procedures to ensure that the security controls implemented within an ADP system are not circumvented. (FIPS PUB 39) An assembly of computer hardware, firmware, and software, configured for the purpose of calculating, computing, sorting, transmitting, receiving, storing and retrieving data with a minimum of human intervention. (CSC-STD-005-85; DOD 5200.28-STD; DOE 5635.1A) automation security availability - 1) The measures employed to protect automation and the information handled from both hostile and benign threats and to safeguard against unauthorized exploitation through espionage, sabotage, theft, fraud, misappropriation, or misuse.

Explanation: NIST publication on credential and access management. Topics: access control, sso. Contains security framework guidance for authentication systems. Source: Glossary of Computer Security Terminology.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Cybersecurity Framework Manufacturing Profile Low Impact Level Example Implementations Guide_ Volume 3 – Discrete-based Manufacturing System Use Case provide? (Section 122) Parr) | Work | 1-800-555-7643 | | Insurance Provider Account # 8858444 | Agent (R. Parr) | Mobile | 240-555-5698 | | Insurance Provider Account # 8858444 | Agent (R. Parr) | Alternate | 240-555-5433 | | Insurance Provider Account # 8858444 | Agent (R. Parr) | Email | r.parr@insuricare.com | The System Recovery Plan must be reviewed and updated after: - the plan executed in response to a cybersecurity incident, - the plan is executed during an incident response or recovery exercise, - any organizational changes, or - any modifications or maintenance to the manufacturing system or its components that may impact this plan. The supervisor is responsible for updating the document in consultation with other personnel, IT and OT contractors and vendors, as required. The System Recovery Plan will be tested each calendar year. System Recovery team members will perform exercises to: - review documented procedures, - validate the effectiveness of the plan, - identify any gaps or weaknesses in its execution, and - update the plan with any outdated or missing information. The following tables document important information to support the recovery of manufacturing system devices. Each device is listed in its own table with relevant information (e.g., hostname, file systems, physical location, backup strategies). The restoration process for each device below is described in Section 3.6.12. For more detailed system information regarding each host, reference the Hardware Inventory.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: cybersecurity framework, fips, security control. General security reference material without sensitive content. Source: Cybersecurity Framework Manufacturing Profile Low Impact Level Example Implementations Guide_ Volume 3 – Discrete-based Manufacturing System Use Case.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Government Smart Card Interoperability Specification, Version 2.1 say about Command Message? According to Government Smart Card Interoperability Specification, Version 2.1, Command Message: | CLA | 0x00 | |------------|-------------------------------------| | INS | 0xC0 | | P1 | 0x00 | | P2 | 0x00 | | L c | Empty | | Data Field | Empty | | L e | Number of bytes to read in response |

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Government Smart Card Interoperability Specification, Version 2.1.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is Abstract syntax according to A Study of OSI Key Management? Abstract syntax: A description of a data structure that is independent of machine oriented structures and restrictions.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: A Study of OSI Key Management.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain <check-content-ref> according to NIST Specification for the Extensible Configuration Checklist Description Format (XCCDF) According to Specification for the Extensible Configuration Checklist Description Format (XCCDF), <check-content-ref>: This element points to a benchmark compliance check, in the language or system specified by the check element's system attribute. Exactly one of check-content or check-content-ref must appear in each check element. The href attribute identifies the document, and the optional name attribute may be used to refer to a particular part, element, or component of the document. Content: none Cardinality: 0-1 Parent Elements: check Attributes: href, name Child Elements: none

Explanation: NIST cybersecurity documentation and standards guidance. Topics: nist sp, fips, security control. General security reference material without sensitive content. Source: Specification for the Extensible Configuration Checklist Description Format (XCCDF).


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Guidelines for the Authorization of Personal Identity Verification Card Issuers (PCI) and Derived PIV Credential Issuers (DPCI) say about Task 6: Authorization Decision? According to Guidelines for the Authorization of Personal Identity Verification Card Issuers (PCI) and Derived PIV Credential Issuers (DPCI), Task 6: Authorization Decision: The authorization decision task determines if the assessment phase has been satisfactorily completed so that a recommendation concerning the operation of the issuer can be made with assurance. The DAO, working with the Assessor, reviews the contents of the assessment submission package, the identified and uncorrected or un-correctable deficiencies, the potential impacts on each organization using the issuer's services, and the CAP in determining the final risk to the organization(s) and the acceptability of that risk in light of the organization's mission. Subtask 6.1: Review the authorization decision package to see if it is complete and that all applicable issuer controls have been fully assessed using the designated assessment procedures. Responsibility: DAO Guidance: Coverage for all issuer controls and proper adherence to assessment procedures and appropriate assessment methods helps to create confidence in assessment findings and is the main objective of the assessment review. Part of the assessment review also includes understanding the impact of the identified deficiencies on the organization's operations, assets, and individuals. Subtask 6.2: Determine if the risk to the organization's operations, assets, or potentially affected individuals is acceptable.

Explanation: NIST publication on credential and access management. Topics: authorization, sso. Contains security framework guidance for authentication systems. Source: Guidelines for the Authorization of Personal Identity Verification Card Issuers (PCI) and Derived PIV Credential Issuers (DPCI).


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain 8.1 The difference between CIPSO and RIPSO according to NIST Standard Security Label for GOSIP_ an Invitational Workshop According to Standard Security Label for GOSIP_ an Invitational Workshop, 8.1 The difference between CIPSO and RIPSO: RIPSO, as defined by RFC 1038, consists of two options: the Basic Security Option (BSO) and the Extended Security Option (ESO). The BSO contains the security level and some protection authority flags. The ESO provides a mechanism to include other security related information in the IP packet. Like CIPSO, it provides authorities that interpret the values for each field. Unlike CIPSO, there is no common format for the security label. The format is up to the associated authority. This will require a software change each time a new authority is added. The primary difference between CIPSO and RIPSO is that the 8 possible authority codes in RIPSO are tightly controlled by DCA and the over 4 billion CIPSO authority (DOIs) codes are open to all commercial as well as Federal organizations. Other differences include the fact that RIPSO supports 8 security levels and CIPSO supports 256. In addition, RIPSO requires two options to send a security label and CIPSO requires only 1.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Standard Security Label for GOSIP_ an Invitational Workshop.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Assessing Security Requirements for Controlled Unclassified Information say about Interview? According to Assessing Security Requirements for Controlled Unclassified Information, Interview: [SELECT FROM: personnel with responsibilities for defining terms, conditions, and security requirements for the use of external systems; personnel with information security responsibilities; system administrators]

Explanation: NIST publication discussing classified information handling. References: classified, controlled unclassified. Contains guidance on protecting sensitive government information. Source: Assessing Security Requirements for Controlled Unclassified Information.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Computer Security Division 2010 Annual Report say about NIST Personal Identity Verification Program (NPIVP)? (Part 1) According to Computer Security Division 2010 Annual Report, NIST Personal Identity Verification Program (NPIVP): NIST Personal Identity Verification Program (NPIVP) The objective of the NIST Personal Identity Verification Program (NPIVP) is to validate Personal Identity Verification (PIV) components for conformance to specifications in FIPS 201 and its companion documents. The two PIV components that come under the scope of NPIVP are PIV Smart Card Application and PIV Middleware. All of the tests under NPVIP are handled by third-party laboratories that are accredited as Cryptographic and Security and Testing (CST) Labora tories by the National Voluntary Laboratory Accreditation Program (NVLAP) and are called accredited NPIVP test facilities. As of Septem ber 2010, there are nine such facilities. In prior years, CSD published SP 800-85A, PIV Card Application and Middleware Interface Test Guidelines , to facilitate development of PIV Smart Card Application and PIV Middleware that conform to inter face specifications in SP 800-73, Interfaces for Personal Identity Verification . We also developed an integrated toolkit called 'PIV Interface Test Runner' for conducting tests on both PIV Card Application and PIV Middleware products, and provided the toolkit to accredited NPIVP test facilities. In FY2010, the third edition of SP 800-73 (numbered as SP 800-73-3), was published. After SP 800-73-3 was finalized, we updated SP 800 85A-1, PIV Card Application and Middleware Interface Test Guidelines , to provide test guidelines that align with SP 800-73-3. After a pub lic comment period and resolution of received comments, the final publication of SP 800-85A-2 was released in July 2010. With the release of SP 800-73-3, NPIVP identified the necessary up dates for the PIV Interface Test Runner to align with SP 800-73-3 and the revised PIV card interface test guidelines in SP 800-85A-2.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Computer Security Division 2010 Annual Report.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Annual Report 2018_ NIST_ITL Cybersecurity Program say about Enhancing Risk Management? (Part 6) According to Annual Report 2018_ NIST_ITL Cybersecurity Program, Enhancing Risk Management: security accomplishments in FY18 included an update of NIST's recommendations for protecting the confidentiality of controlled, unclassified information (CUI) in non-federal systems and organizations. Safeguarding that CUI is of paramount importance and can directly affect the ability of federal agencies to successfully conduct their assigned missions and business operations. NIST SP 800-171 Revision 1 10 recommends security requirements to those agencies. The FY18 update included editorial changes to select CUI security requirements, additional references and definitions, and an expanded discussion about each CUI requirement. 10/emspace SP 800-171, Rev. 1, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations, https:/ /csrc.nist.gov/publications/detail/sp/800-171/rev-1/final

Explanation: NIST publication discussing classified information handling. References: classified, controlled unclassified, cui. Contains guidance on protecting sensitive government information. Source: Annual Report 2018_ NIST_ITL Cybersecurity Program.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does NIST_SP_800-53r5_Security_Privacy_Controls provide? (Section 248) authorization process for the system that includes multiple authorizing officials with at least one authorizing official from an organization external to the organization conducting the authorization. Discussion: Assigning multiple authorizing officials, at least one of whom comes from an external organization, to serve as co-authorizing officials for the system increases the level of independence in the risk-based decision-making process. It implements the concepts of separation of duties and dual authorization as applied to the system authorization process. Employing authorizing officials from external organizations to supplement the authorizing official from the organization that owns or hosts the system may be necessary when the external organizations have a vested interest or equities in the outcome of the authorization decision. The inter-organization joint authorization process is relevant and appropriate for connected systems, shared systems or services, and systems with multiple information owners. The authorizing officials from the external organizations are key stakeholders of the system undergoing authorization. Related Controls: AC-6. References: [OMB A-130], [SP 800-37], [SP 800-137]. CA-7 CONTINUOUS MONITORING Control: Develop a system-level continuous monitoring strategy and implement continuous monitoring in accordance with the organization-level continuous monitoring strategy that includes: a. Establishing the following system-level metrics to be monitored: [Assignment: organization- defined system-level metrics]; b. Establishing [Assignment: organization-defined frequencies] for monitoring and [Assignment: organization-defined frequencies] for assessment of control effectiveness; c. Ongoing control assessments in accordance with the continuous monitoring strategy; d. Ongoing monitoring of system and organization-defined metrics in accordance with the continuous monitoring strategy; e.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control, assessment. General security reference material without sensitive content. Source: NIST_SP_800-53r5_Security_Privacy_Controls.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Multi-Factor Authentication for Criminal Justice Information Systems_ Implementation Considerations for Protecting Criminal Justice Information say about B.4.2.2. CAD/RMS Thick Client at the County with IdP at the State Agency -WS-Trust? (Part 1) According to Multi-Factor Authentication for Criminal Justice Information Systems_ Implementation Considerations for Protecting Criminal Justice Information, B.4.2.2. CAD/RMS Thick Client at the County with IdP at the State Agency -WS-Trust: B.4.2.2. CAD/RMS Thick Client at the County with IdP at the State Agency -WS-Trust In this scenario, we assume that the CAD/RMS client/server system does not support SAML. We also assume that the user authenticates to the CAD/RMS system through some other means (e.g., Kerberos). To authenticate the user to the message switch, the CAD/RMS thick client redirects the user to a URL at the state IdP that triggers an IdP-initiated SAML authentication flow. The IdP responds with a SAML assertion, which the CAD/RMS thick client sends to the CAD/RMS server, which in turn makes a WS-Trust request to the state IdP to obtain a SAML assertion that it can present to the message switch. The CAD/RMS server is not required to create a SAML authentication request or to parse or validate the SAML responses from the IdP. To the CAD/RMS server, the SAML messages themselves are opaque XML documents, and it simply passes them along. This integration requires configuring the state IdP with parameters for the CAD/RMS system as if it were an RP. Further, we assume that the state IdP supports IdP-initiated SSO and has a URL configured to trigger an IdP-initiated login to the CAD/RMS thick client. Both the IdP and the CAD/RMS system must also support WS-Trust for this integration. This architecture is shown in Fig. 21. Fig. 21. Thick client CAD/RMS at county, state IdP (WS-Trust). <!-- image --> The sequence of interactions is as follows: 1. The officer opens the CAD/RMS thick client application, which connects to the CAD/RMS server. The officer authenticates using a non-SAML method, such as Kerberos. The details of this interaction are proprietary and depend on the CAD/RMS application's design. 2. The officer submits a query that must be submitted to the state message switch. To authenticate the officer, the CAD/RMS thick client opens the IdP-initiated SSO URL of the state IdP in the builtin browser on the officer's MDC. 3.

Explanation: NIST publication on credential and access management. Topics: authentication, multi-factor, sso. Contains security framework guidance for authentication systems. Source: Multi-Factor Authentication for Criminal Justice Information Systems_ Implementation Considerations for Protecting Criminal Justice Information.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Strategies for the Integration of Software Supply Chain Security in DevSecOps CI_CD Pipelines say about 5.1.1. Secure Build? (Part 1) According to Strategies for the Integration of Software Supply Chain Security in DevSecOps CI_CD Pipelines, 5.1.1. Secure Build: 5.1.1. Secure Build The following tasks are required to obtain SSC security assurance in the build process: - Specify policies regarding the build, including (a) the use of a secure isolated platform for performing the build and hardening the build servers, (b) the tools that will be used to perform the build, and (c) the authentication/authorization required for the developers performing the build process. - Enforce those build policies using techniques such as an agent and policy enforcement engine. - Ensure the concurrent generation of evidence for build attestation to demonstrate compliance with secure build processes during the time of software delivery. A common technique for facilitating the second task is to wrap commands from a CI tool with capabilities to gather evidence and ultimately create an evidence trail of the entire SDLC [8]. The first type of evidence is from the build system itself, which should be able to confirm that the tools or processes used are in an isolated environment. This provides internal operational assurance. The second type of evidence that should be gathered consists of the hash of the final build artifact, files, libraries, and other materials used in the artifacts and all events. This is then signed by a trusted component of the build framework that is not under the control of the developers using a digital certificate to create the attestation, which provides verifiable proof of the quality of the software to consumers and enables them to verify the quality of that artifact independently from the producer of the software, thus providing consumer assurance. In this context, the artifact is the build generated by a series of CI process steps. In the context of 'concurrent generation of evidence,' the evidence generated should be enabled by a process with a higher level of trust or isolation than the build itself to protect against tampering. The generation of such evidence requires verification within the build as it occurs.

Explanation: NIST publication on credential and access management. Topics: authentication, authorization. Contains security framework guidance for authentication systems. Source: Strategies for the Integration of Software Supply Chain Security in DevSecOps CI_CD Pipelines.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Notional Supply Chain Risk Management Practices for Federal Information Systems provide? (Section 57) subject to access by a variety of actors. It is critical to limit such access to only as much as necessary for those actors to perform their role(s) and to monitor that access for supply chain impact. Access control techniques exist that may be useful in providing needed granularity to ensure that only appropriate actors can monitor or change supply chain elements, element processes, organizations, organizational processes, information, communications, and systems covering the comprehensive supply chain. - a) Establish an internal policy for the broad responsibilities of assigning access control to information, systems, supply chain elements, element processes, as well as key personnel and organizational activities as deemed necessary to protect the confidentiality, integrity, and availability of supply chain elements and processes throughout the system/element life cycle. - b) Instantiate general criteria by which access controls are to be applied, the objects of such controls, the initiating and terminating events or conditions under which such controls are applied, and specific access control mechanisms (e.g., automated, manual, or hybrid). - c) Identify the individuals (roles) and organizations with responsibility for the design, development, and implementation of access controls, to include use of information security, operations security, physical security, industrial security, and IA tactics, techniques, procedures, and tools. - d) Define requirements to include access control (both physical and logical) requirements in all written agreements with integrators including: - Responsibilities for assigning access control among all parties; - Mandatory, recommended, and prohibited access control methods; and - Audit plans for access control review. - e) Define, design, specify, and require assigned roles throughout the supply chain and system or element life cycle so that no single role can, intentionally or unintentionally, create adverse consequences.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Notional Supply Chain Risk Management Practices for Federal Information Systems.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Criticality Analysis Process Model_ Prioritizing Systems and Components provide? (Section 142) cially in the ERP system. Their review questions may include: - Where do inputs to a critical process come from? - Where do the outputs of a critical process go? - What information/data is processed? Is that information/data sensitive or categorized? Are there special handling requirements associated with the information/data? - What is required for providing the output in a timely, accurate, and complete manner? - Which subsystem processes must be completed before the next process takes over? - What subsystems/functions/processes are used to ensure that the subsystems perform their roles as required? - What subsystems/functions/processes interact with or connect to a critical subsystem? Using this information, they identify those subsystems and functions which directly perform or support a highly critical process, those which indirectly support a highly critical process, and those which are immaterial to the critical process. The Lead Systems Architect uses this information to modify the draft system diagram developed in C.2 slightly and to highlight key areas of importance. C.4 The Lead Systems Architect works with her team of engineers to document generally the characteristics of each subsystem and how the subsystems should function when operating normally. They then analyze how each subsystem will behave under the following conditions: - A subsystem is given an incomplete input; - A subsystem is given an incorrect input; - A subsystem is given an input at the wrong time or slowly; - An IT/OT subsystem is not given enough power or too much power; - An IT/OT subsystem is given a software/firmware update. They validate their analysis by brainstorming certain scenarios and how the system will be impacted.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Criticality Analysis Process Model_ Prioritizing Systems and Components.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is Related Controls according to Security and Privacy Controls for Information Systems and Organizations? Related Controls: AT-2, AT-3, IR-4, IR-6, IR-8, PM-22, PM-26, SA-9, SI-18.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Security and Privacy Controls for Information Systems and Organizations.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control SA-1 in NIST_SP_800-53r5_Security_Privacy_Controls? (Part 1) Control SA-1: POLICY AND PROCEDURES Control: a. Develop, document, and disseminate to [Assignment: organization-defined personnel or roles]: 1. [Selection (one or more): Organization-level; Mission/business process-level; System- level] system and services acquisition policy that: (a) Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and (b) Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and 2. Procedures to facilitate the implementation of the system and services acquisition policy and the associated system and services acquisition controls; b. Designate an [Assignment: organization-defined official] to manage the development, documentation, and dissemination of the system and services acquisition policy and procedures; and c. Review and update the current system and services acquisition: 1. Policy [Assignment: organization-defined frequency] and following [Assignment: organization-defined events]; and 2. Procedures [Assignment: organization-defined frequency] and following [Assignment: organization-defined events]. Discussion: System and services acquisition policy and procedures address the controls in the SA family that are implemented within systems and organizations. The risk management strategy is an important factor in establishing such policies and procedures. Policies and procedures contribute to security and privacy assurance. Therefore, it is important that security and privacy programs collaborate on the development of system and services acquisition policy and procedures. Security and privacy program policies and procedures at the organization level are preferable, in general, and may obviate the need for mission- or system-specific policies and procedures.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: NIST_SP_800-53r5_Security_Privacy_Controls.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control EP-67 in Interagency Report on the Status of International Cybersecurity Standardization for the Internet of Things (IoT)? (Part 180) Control EP-67: ocol for use with constrained nodes and constrained networks in the Internet of Things. The protocol is designed for machine-to-machine (M2M) applications such as smart energy and building automation. Parsing the Protocol and Processing URIs: CoAP attempts to narrow the opportunities for introducing network-facing application vulnerabilities by: reducing parser complexity, giving the entire range of encodable values a meaning where possible, and by aggressively reducing | Approved Standard Guidance Available Commercial Availability | | Network Security: Standards that provide security requirements and guidelines on processes and methods for the secure management, operation and use of information, information networks, and their inter-connections. | Network Security: Standards that provide security requirements and guidelines on processes and methods for the secure management, operation and use of information, information networks, and their inter-connections. | Network Security: Standards that provide security requirements and guidelines on processes and methods for the secure management, operation and use of information, information networks, and their inter-connections. | Network Security: Standards that provide security requirements and guidelines on processes and methods for the secure management, operation and use of information, information networks, and their inter-connections.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Interagency Report on the Status of International Cybersecurity Standardization for the Internet of Things (IoT).


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations say about 1.4.3. Acquisition and Procurement Owners and Operators? According to Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations, 1.4.3. Acquisition and Procurement Owners and Operators: These readers are those with C-SCRM responsibilities as part of their role in the procurement or acquisition function of an enterprise. Acquisition personnel may execute C-SCRM activities as a part of their general responsibilities in the acquisition and procurement life cycle. These personnel will collaborate closely with the enterprise's C-SCRM personnel to execute C-SCRM activities with acquisition and procurement. Recommended reading includes: - Section 1: Introduction - Section 2.1: The Business Case for C-SCRM - Section 2.2: Cybersecurity Risks Throughout the Supply Chain - Section 3.1: C-SCRM in Acquisition - Section 3.3: C-SCRM Awareness and Training - Appendix A: C-SCRM Security Controls - o These readers should pay special attention to requisite controls for supplier contracts and include them in agreements with both primary and sub-tier contractor parties. - Appendix F: Software Supply Chain Security Guidelines

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does NIST_SP_800-53r5_Security_Privacy_Controls provide? (Section 892) e set of points on the boundary of a system, a system component, or an environment where an attacker can try to enter, cause an effect on, or extract data from, that system, component, or environment. Independent review and examination of records and activities to assess the adequacy of system controls, to ensure compliance with established policies and operational procedures. A chronological record of system activities, including records of system accesses and operations performed in a given period. An individual entry in an audit log related to an audited event. A process that manipulates collected audit information and organizes it into a summary format that is more meaningful to analysts. A chronological record that reconstructs and examines the sequence of activities surrounding or leading to a specific operation, procedure, or event in a security-relevant transaction from inception to result. authentication [FIPS 200] Verifying the identity of a user, process, or device, often as a prerequisite to allowing access to resources in a system. APPENDIX A PAGE 395 NIST SP 800-53, REV. 5 SECURITY AND PRIVACY CONTROLS FOR INFORMATION SYSTEMS AND ORGANIZATIONS _________________________________________________________________________________________________ authenticator authenticity Something that the claimant possesses and controls (typically a cryptographic module or password) that is used to authenticate the claimant’s identity. This was previously referred to as a token. The property of being genuine and being able to be verified and trusted; confidence in the validity of a transmission, message, or message originator. See authentication. authorization [CNSSI 4009] Access privileges granted to a user, program, or process or the act of granting those privileges.

Explanation: NIST publication on credential and access management. Topics: authentication, authorization, token. Contains security framework guidance for authentication systems. Source: NIST_SP_800-53r5_Security_Privacy_Controls.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Recommendation for Cryptographic Key Generation say about Recommendation for Cryptographic Key Generation? According to Recommendation for Cryptographic Key Generation, Recommendation for Cryptographic Key Generation: Elaine Barker Allen Roginsky Computer Security Division Information Technology Laboratory Richard Davis National Security Agency This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-133r2 June 2020 <!-- image --> U.S. Department of Commerce Wilbur L. Ross, Jr., Secretary National Institute of Standards and Technology Walter Copan, NIST Director and Under Secretary of Commerce for Standards and Technology

Explanation: NIST publication discussing classified information handling. References: secret, national security. Contains guidance on protecting sensitive government information. Source: Recommendation for Cryptographic Key Generation.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is FR according to A Framework for Designing Cryptographic Key Management Systems? FR: 8.2 The CKMS design shall specify the physical security controls for protecting each device containing CKMS components.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: A Framework for Designing Cryptographic Key Management Systems.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Specification for the Extensible Configuration Checklist Description Format (XCCDF) Version 1.2 provide? (Section 40) escribed in [DCXML]. It MAY also have an @href attribute that gives a URL for the referenced resource. References SHOULD be given as Dublin Core descriptions; a bare string MAY be used for simplicity. If a bare string appears, then it is taken to be the string content for a <dc:title> element. For more information, consult [DCES]. Multiple <xccdf:reference> elements MAY appear; a benchmark consumer product MAY concatenate them or put them into a reference list, and MAY choose to number them. XCCDF supports a digital signature mechanism whereby XCCDF document users can validate the integrity, origin, and authenticity of documents. XCCDF provides a means to hold such signatures and a uniform method for applying and validating them [XMLDSIG]. The <xccdf:signature> element MAY hold an enveloped digital signature asserting authorship and allowing verification of the integrity of associated data (e.g., its parent element, other documents, portions of other documents). The signature SHALL apply only after inclusion (i.e., XInclude) processing. The <xccdf:signature> element is OPTIONAL, and it MAY appear as a child of the <xccdf:Benchmark> , <xccdf:Rule> , <xccdf:Group> , <xccdf:Value> , <xccdf:Profile> , <xccdf:TestResult> , or <xccdf:Tailoring> elements. Any digital signature format employed for XCCDF MUST be capable of identifying the signer, storing all information needed to verify the signature (usually a certificate or certificate chain), and detecting any change to the signed content. XCCDF products that support signatures MUST support the W3C XMLSignature standard enveloped signatures, as defined in [XMLDSIG]. If multiple signatures are needed in an XCCDF document, at most one of them MAY be enveloped; all others MUST be detached [XMLDSIG Section 2].

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Specification for the Extensible Configuration Checklist Description Format (XCCDF) Version 1.2.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Computer Security Division 2011 Annual Report say about Cryptography for Emerging Technologies and Applications (CETA) Workshop? (Part 1) According to Computer Security Division 2011 Annual Report, Cryptography for Emerging Technologies and Applications (CETA) Workshop: Cryptography for Emerging Technologies and Applications (CETA) Workshop The CETA Workshop will provide an opportunity for industry, research and academia communities, and government sectors to identify cryptographic challenges encountered in their development of emerging technologies and applications, and to learn about NIST's current cryptographic research, activities, programs, and standards development. Technology areas to be addressed include sensor and building networks, mobile devices, smart objects/Internet of things, and cyber physical systems. NIST considered the following trends when organizing the CETA Workshop: the increasing demand for small footprint cryptography for power-constrained devices; the emerging desire, from both providers and consumers, for trustworthy processes supporting secure communications and transactions that maximize integrity and nonrepudiation properties on single end-user devices that access many kinds of services and applications, and the need for individual users that access the same services and applications from multiple platforms; the need for much more agile key management on cyberspace; and the need for usable and reliable public, enterprise-specific, pseudonymous, and anonymous modes of operation from the same end-user device. In preparation for the workshop, NIST called for the submission of abstracts. The abstracts must highlight cryptographic challenges identified during the research and development of emerging technologies and applications. Examples of emerging or evolving technology areas include: - Sensor and building networks; - Mobile devices; - Smart Objects/Internet of Things; and - Cyber physical systems. Examples of cryptographic requirements for emerging sectors might include: performance or resource issues; cryptographic services (such as anonymous or group signatures); or key management challenges.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Computer Security Division 2011 Annual Report.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Derived Personal Identity Verification (PIV) Credentials provide? (Section 66) explanation of the NIST Cybersecurity Framework Subcategory codes. Note: Some of our components are marked in the version column as not applicable. This is due to the use of SaaS [24] cloud services. Table 3-6 Products and Technologies | Component | Product | Version | Function | Cybersecurity Framework Subcategories | |---------------------------|--------------------------------|------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------| | PKI Certificate Authority | Entrust Data- card Managed PKI | Not appli- cable | Entity that issues an authentica- tion certificate, which is an X.509 public key certificate that has been issued in accordance with the re- quirements of NIST SP 800-157 and the X.509 Certificate Policy for the U.S.

Explanation: NIST publication on credential and access management. Topics: pki, certificate authority. Contains security framework guidance for authentication systems. Source: Derived Personal Identity Verification (PIV) Credentials.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control AC-06(05) in Assessing Security Requirements for Controlled Unclassified Information? (Part 76) Control AC-06(05): ents for A.03.12.01: the security requirements for the system and its environment of operation are assessed <A.03.12.01.ODP[01]: frequency> to determine if the requirements have been satisfied. ## ASSESSMENT METHODS AND OBJECTS ## Examine [SELECT FROM: security assessment and monitoring policy and procedures; procedures for security assessment planning; security assessment plan; security assessment report; system security plan; other relevant documents or records] ## Interview [SELECT FROM: personnel with security assessment responsibilities; personnel with information security responsibilities] ## Test [SELECT FROM: mechanisms for supporting security assessments, processes for security assessment plan development, or security assessment reporting] ## REFERENCES Source Assessment Procedure: CA-02 ## 03.12.02 Plan of Action and Milestones ## ASSESSMENT OBJECTIVE ## Determine if: A.03.12.02.a.01: a plan of action and milestones for the system is developed to document the planned remediation actions for correcting weaknesses or deficiencies noted during security assessments. A.03.12.02.a.02: a plan of action and milestones for the system is developed to reduce or eliminate known system vulnerabilities. A.03.12.02.b.01: the existing plan of action and milestones is updated based on the findings from security assessments. A.03.12.02.b.02: the existing plan of action and milestones is updated based on the findings from audits or reviews. A.03.12.02.b.03: the existing plan of action and milestones is updated based on the findings from continuous monitoring activities.

Explanation: NIST publication discussing classified information handling. References: classified, controlled unclassified. Contains guidance on protecting sensitive government information. Source: Assessing Security Requirements for Controlled Unclassified Information.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control HA-1 in Recommendations for Discrete Logarithm-based Cryptography_ Elliptic Curve Domain Parameters? (Part 22) Control HA-1: lliptic curve K-283 is a Weierstrass curve Ba , b defined over the binary field GF(2 m ) with m = 283 and parameters a = 0 and b = 1. This curve has order h ⋅ n , where h = 4, and n is a prime number. This curve has domain parameters D = ( m , f ( z ), T , h , n , Type , a , b , G , { Seed , c }), where the Type is 'Koblitz curve,' and the other parameters are defined as follows: ``` T: 6 f ( z ): z 283 + z 12 + z 7 + z 5 + 1 h : 4 n : 388533778445145814183892381364703781328481\ 1733793061324295874997529815829704422603873 ``` ``` (= 0x1ffffff ffffffff ffffffff ffffffff ffffe9ae 2ed07577 265dff7f 94451e06 1e163c61 ) tr : 7777244870872830999287791970962823977569917 (=(2 m + 1) h ⋅ n = 0x5947 44be2a23 66880201 aeeb87e7 87a70e7d ) a : 0 (= 0x0000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 ) b : 1 (= 0x0000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000001 ) ``` ## Polynomial basis: ``` Gx : 0x503213f 78ca4488 3f1a3b81 62f188e5 53cd265f 23c1567a 16876913 b0c2ac24 58492836 Gy : 0x1ccda38 0f1c9e31 8d90f95d 07e5426f e87e45c0 e8184698 e4596236 4e341161 77dd2259 ``` ## Normal basis: ``` Gx : 0x3ab9593 f8db09fc 188f1d7c 4ac9fcc3 e57fcd3b db15024b 212c7022 9de5fcd9 2eb0ea60 Gy : 0x2118c47 55e7345c d8f603ef 93b98b10 6fe8854f feb9a3b3 04634cc8 3a0e759f 0c2686b1 ``` Seed : n/a (binary Koblitz curve) ## 3.3.1.4. Curve K-409 The elliptic curve K-409 is a Weierstrass curve Ba , b defined over the binary field GF(2 m ) with m = 409 and parameters a = 0 and b = 1. This curve has order h ⋅ n , where h = 4, and n is a prime number.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Recommendations for Discrete Logarithm-based Cryptography_ Elliptic Curve Domain Parameters.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control AM-1 in Cybersecurity Framework Version 1.1 Manufacturing Profile? (Part 50) Control AM-1: nd Access Control (PR.AC) | PR.AC-3 | Low Impact Establish usage restrictions, connection requirements, implementation guidance, and authorizations for remote access to the manufacturing system. Provide an explicit indication of active remote access connections to users physically present at the devices. Remote access methods include, for example, wireless, dial-up, broadband, Virtual Private Network (VPN) connections, mobile device connections, and communications through external networks. | Reference ISA/IEC 62443-2- 1:2009 4.3.3.6.6 ISA/IEC 62443-3- 3:2013 SR 1.13,2.6 AC-17, AC-19, AC-20 SC-15 AC-17(1)(2)(3)(4) AC-20(1)(2) | | PROTECT | Identity Management, Authentication and Access Control (PR.AC) | PR.AC-3 | Moderate and High Impact remote access only through approved and managed access points. remote access to the manufacturing system and implement cryptographic mechanisms | Reference ISA/IEC 62443-2- 1:2009 4.3.3.6.6 ISA/IEC 62443-3- 3:2013 SR 1.13,2.6 AC-17, AC-19, AC-20 SC-15 AC-17(1)(2)(3)(4) AC-20(1)(2) | | PROTECT | Identity Management, Authentication and Access Control (PR.AC) | PR.AC-3 | Allow Monitor where determined necessary. Allow only authorized use of privileged functions from remote access. Establish agreements and verify security for connections with external systems.

Explanation: NIST publication on credential and access management. Topics: access control, authentication, authorization. Contains security framework guidance for authentication systems. Source: Cybersecurity Framework Version 1.1 Manufacturing Profile.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Specification for the Extensible Configuration Checklist Description Format (XCCDF) say about XCCDF Schema 1.0? (Part 8) According to Specification for the Extensible Configuration Checklist Description Format (XCCDF), XCCDF Schema 1.0: n xml:lang="en"> Metadata for the Benchmark, should be Dublin Core or some other well-specified and accepted metadata format. If Dublin Core, then it will be a sequence of simple Dublin Core elements. </xsd:documentation> </xsd:annotation> <xsd:sequence> <xsd:choice minOccurs="1" maxOccurs="1"> <xsd:any namespace="http://purl.org/dc/elements/1.1/" minOccurs="1" maxOccurs="unbounded"/> <!-- the namespace URI below is from a draft version of the schema designed to support the checklist metadata requirements from NIST special pub 800-70. --> <xsd:any namespace="" processContents="skip" minOccurs="1" maxOccurs="unbounded"/> </xsd:choice> ``` ``` </xsd:sequence> </xsd:complexType> <!-- ************************************************************** --> <!-- ****************** global elements ************************* --> <!-- ************************************************************** --> <xsd:element name="status"> <xsd:annotation> <xsd:documentation xml:lang="en"> The acceptance status of an Item with an optional date attribute that signifies the date of the status change. </xsd:documentation> </xsd:annotation> <xsd:complexType> <xsd:simpleContent> <xsd:extension base="cdf:statusType"> <xsd:attribute name="date" type="xsd:date" use="optional"/> </xsd:extension> </xsd:simpleContent> </xsd:complexType> </xsd:element> <xsd:simpleType name="statusType"> <xsd:annotation> <xsd:documentation xml:lang="en"> The possible status codes for an Benchmark or Item to be inherited from the parent element if it is not defined.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: nist sp, fips, security control. General security reference material without sensitive content. Source: Specification for the Extensible Configuration Checklist Description Format (XCCDF).


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control HA-256 in Derived PIV Application and Data Model Test Guidelines? (Part 156) Control HA-256: mandatory tags for the Key History Object are present in the order indicated in Table 19 of [SP800-73], Part 1. 4. From Step 4, the command returns status word '90 00' along with the Security Object. | |--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| ## 9.1.6 Retired X.509 Certificates for Key Management ## 9.1.6.1 BER-TLV of Retired X.509 Certificates for Key Management | Test Assertion | TA-09.01.06.01 | |----------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | Purpose | Verifies that the Retired X.509 Certificates for Key Management (if present) conform to the Derived PIV data model requirements.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Derived PIV Application and Data Model Test Guidelines.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Establishing Wireless Robust Security Networks_ A Guide to IEEE 802.11i say about 10.3 Wi-Fi Alliance Product Certification Programs? According to Establishing Wireless Robust Security Networks_ A Guide to IEEE 802.11i, 10.3 Wi-Fi Alliance Product Certification Programs: The Wi-Fi Alliance has established several certification programs to give consumers of WLAN products assurance that their systems comply with IEEE 802.11 specifications and can interoperate with similar equipment from other vendors. The following certifications are available that indicate product compliance with IEEE 802.11i: - GLYPH<c=31,font=/HACNND+Webdings> Wi-Fi Protected Access (WPA), which includes a subset of the IEEE 802.11i specification that addresses the weaknesses of WEP - GLYPH<c=31,font=/HACNND+Webdings> WPA2, which extends WPA to include the full set of IEEE 802.11i requirements. Federal agencies should procure WPA2 products that have been FIPS-validated; WPA products cannot be FIPS-validated because they do not support FIPS-approved encryption algorithms. WPA and WPA2 have both Personal and Enterprise modes of operation. Organizations that plan to deploy authentication servers as part of an IEEE 802.1X and EAP implementation should procure products with the Enterprise level certification.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Establishing Wireless Robust Security Networks_ A Guide to IEEE 802.11i.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain 2.1.1 Network Boot Services according to NIST Validating the Integrity of Computing Devices According to Validating the Integrity of Computing Devices, 2.1.1 Network Boot Services: The following procedures will create an environment that will enable the acceptance testing of computing devices into an enterprise. First, we create CentOS 7, CentOS 8, and WinPE images that will be booted on computing devices via a Preboot Execution Environment (PXE). We then configure the PXE environment to boot the images.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Validating the Integrity of Computing Devices.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Guidelines for the Secure Deployment of IPv6 provide? (Section 47) Summary..............................................................................................................6-47 | 6-46 | | List of Appendices | List of Appendices | List of Appendices | List of Appendices | | Appendix A- Acronyms and Abbreviations ......................................................................A-1 | Appendix A- Acronyms and Abbreviations ......................................................................A-1 | Appendix A- Acronyms and Abbreviations ......................................................................A-1 | | | Appendix B-References and Other IPv6 Resources .......................................................B-1 | Appendix B-References and Other IPv6 Resources .......................................................B-1 | Appendix B-References and Other IPv6 Resources .......................................................B-1 | | | List of Figures | List of Figures | List of Figures | List of Figures | | Figure 2-1.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Guidelines for the Secure Deployment of IPv6.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Computer Security Division 2014 Annual Report provide? (Section 217) her with associated virtual network and hardware/software for data storage An IaaS's consumer's total set of interactions with these resources constitute the set of use cases for IaaS cloud service. These use cases have associated security requirements and these requirements are met by protection options enabled by available security solutions/technologies. The purpose of this paper is to analyze these protection options from the viewpoint of: (a) Security functionality they can provide and (b) the architecture that governs their deployment, so that IaaS consumers can decide on the most appropriate security configuration for their VM instances depending upon the profile of the applications running in them. I. Dominguez, D.R. Kuhn, R.N. Kacker, and Y. Lei, 'CCM: A Tool for Measuring Combinatorial Coverage of System State Space' [poster], 2013 ACM / IEEE International Symposium on Empirical Software Engineering and Measurement (ESEM 2013), Baltimore, Maryland, October 10-11, 2013, p. 291. doi: 10.1109/ESEM.2013.44. This poster presents some measures of combinatorial coverage that can be helpful in estimating residual risk related to insufficient testing of rare interactions, and a tool for computing these measures. D. Ferraiolo, S. Gavrila and W. Jansen, 'On the Unification of Access Control and Data Services,' 15th IEEE Conference on Information Reuse and Integration (IRI 2014), San Francisco, California, August 13-15, 2014, pp. 450-457. doi: 10.1109/ IRI.2014.7051924. A primary objective of enterprise computing (via a data center, cloud, etc.) is the controlled delivery of data services (DS). Typical DSs include applications such as email, workflow, and records management, as well as system level features, such as file and access control management.

Explanation: NIST publication on credential and access management. Topics: access control, sso. Contains security framework guidance for authentication systems. Source: Computer Security Division 2014 Annual Report.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain 2.2.3.5 GUI Gateway Installation according to NIST Securing Property Management Systems According to Securing Property Management Systems, 2.2.3.5 GUI Gateway Installation: 1. Ensure that the following packages are installed via $yum install [pkg\_name], where [pkg\_name] is: 2. -freerdp-libs 3. -uuid 4. -cairo 5. -libvncserver 6. -libpng12 7. -freerdp-plugins 8. -net-tools 9. -openssh-clients 10. -open-vm-tools <!-- image -->

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Securing Property Management Systems.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does General Access Control Guidance for Cloud Systems provide? (Section 11) y and the privacy of services it provides. This document focuses on providing guidance for access control systems that are applicable to an organization's cloud implementation and security management. It does not prescribe the internal cloud access control standards that an organization may need in their enterprise systems or within a community other than the organization itself. The intended audience for this document is an organizational entity that implements access control solutions for sharing information in cloud systems. This document assumes that readers are familiar with the cloud and access (authorization) control systems and have basic knowledge of operating systems, databases, networking, and security. Given the constantly changing nature of the information technology (IT) industry, readers are strongly encouraged to take advantage of other documents-including those listed in this document-for more current and detailed information. The sections and appendix presented in this document are as follows: - Section 1 states the purpose and scope of access control and cloud systems. - Section 2 provides an overview of cloud access control characteristics. - Section 3 discusses guidance for access control systems for IaaS (Infrastructure as a Service). - Section 4 discusses guidance for access control systems for PaaS (Platform as a Service). - Section 5 discusses guidance for access control systems for SaaS (Software as a Service). - Section 6 discusses guidance for access control systems for inter- and intra-cloud operations. - Section 7 concludes the document with future directions. With the support of different service models, cloud systems can provide a wide range of services to its end-users, developers, and system administrators. Cloud systems have been developed over time and conceptualized through a combination of software, hardware components, and virtualization technologies.

Explanation: NIST publication on credential and access management. Topics: access control, authorization. Contains security framework guidance for authentication systems. Source: General Access Control Guidance for Cloud Systems.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Guidelines for Smart Grid Cybersecurity provide? (Section 264) ds development process of FIPS and recommendation practices of NIST. At a minimum, a technique outside of this family of 39 See Volume 3, Chapter 8 R&D for a discussion of some of the considerations. 226 techniques should (1) be defined in a publicly available forum, (2) be provided to a community of cryptographers for review and comment for a reasonable duration, (3) be in, or under development in, a standard by a recognized standards-developing organization (SDO). In addition, a case should be made for its use along the lines of resource constraints, unique nature of an application, or new security capabilities not afforded by the FIPS-approved and NIST- recommended techniques. 4.2.1.2 Entropy As discussed earlier in the section there are considerations when dealing with entropy on many constrained devices and systems that can be found throughout the smart grid. There are some possible approaches that can address restricted sources of entropy on individual point devices, they include:  Seeding a Deterministic Random Bit Generator (DRBG) on a device before distribution; any additional entropy produced within the device should be used to reseed it.  Alternatively, a Key Derivation Function (KDF) could derive new keys from a long-term key that the device has been pre-provisioned with. 4.2.1.3 Cryptographic Module Upgradeability Cryptographic algorithms are implemented within cryptographic modules that need to be designed to protect the cryptographic algorithm and keys used in the system. The following needs to be considered when planning the upgradeability of these modules:  Smart grid equipment is often required to have an average life of 20 years, which is much longer than for typical information technology (IT) and communications systems.  Due to reliability requirements for the electrical grid, testing cycles are often longer and more rigorous.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Guidelines for Smart Grid Cybersecurity.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is Contact according to Computer Security Division 2012 Annual Report? Contact: Mr. Quynh Dang quynh.GLYPH(cmap:df00)ang@nist.gov

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Computer Security Division 2012 Annual Report.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Control Baselines for Information Systems and Organizations say about 2.4 TAILORING CONTROL BASELINES? (Part 1) According to Control Baselines for Information Systems and Organizations, 2.4 TAILORING CONTROL BASELINES: 2.4 TAILORING CONTROL BASELINES After selecting an appropriate control baseline, organizations initiate a tailoring process to align the controls more closely with the specific security and privacy requirements identified by the organization. The tailoring process is part of an organization-wide risk management process that includes framing, assessing, responding to, and monitoring information security and privacy risks. Tailoring decisions are dependent on organizational or system-specific factors. While tailoring decisions are focused on security and privacy considerations, the decisions are typically aligned with other risk-related issues that organizations must routinely address. Risk-related issues such as cost, schedule, and performance are considered in the determination of which controls to employ and how to implement controls in organizational systems and environments of operation. 24 The tailoring process can include but is not limited to the following activities: 25 - Identifying and designating common controls - Applying scoping considerations - Selecting compensating controls - Assigning values to organization-defined control parameters via explicit assignment and selection operations - Supplementing baselines with additional controls and control enhancements - Providing specification information for control implementation Organizations use risk management guidance to facilitate risk-based decision making regarding the applicability of the controls in the baselines. Ultimately, organizations employ the tailoring process to achieve cost-effective solutions that support organizational mission and business needs and provide security and privacy protections commensurate with risk. Organizations have the flexibility to tailor at the organization level for systems in support of a line of business or a mission or business process, at the individual system level, or by using a combination of the two.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Control Baselines for Information Systems and Organizations.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171 say about CUI ENHANCED SECURITY REQUIREMENTS? (Part 1) According to Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171, CUI ENHANCED SECURITY REQUIREMENTS: CUI ENHANCED SECURITY REQUIREMENTS Controlled Unclassified Information has the same value , whether such information is resident in a federal system that belongs to a federal agency or a nonfederal system that belongs to a nonfederal organization. Accordingly, the enhanced security requirements in this publication are consistent with and complementary to the guidelines used by federal agencies to protect CUI. The requirements are only applicable to a nonfederal system or nonfederal organization as mandated by a federal agency in a contract, grant, or other agreement. The APT is extremely dangerous to the national and economic security interests of the United States since organizations are very dependent on systems of all types, including traditional Information Technology (IT) systems, Operational Technology (OT) systems, Internet of Things 6 [32 CFR 2002] was issued on September 14, 2016, and went into effect on November 14, 2016. 7 The definition of a critical program may vary from organization to organization. For example, the Department of Defense defines a critical program as a program which significantly increases capabilities and mission effectiveness or extends the expected effective life of an essential system/capability [DOD ACQ]. 8 See [OMB M-19-03] and [OCIO HVA]. CHAPTER ONE PAGE 2 \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ (IoT) systems, and Industrial IoT (IIoT) systems. The convergence of these types of systems has brought forth a new class of systems known as cyber-physical systems , many of which are in sectors of U.S.

Explanation: NIST publication discussing classified information handling. References: classified, controlled unclassified, cui. Contains guidance on protecting sensitive government information. Source: Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Guide to Intrusion Detection and Prevention Systems (IDPS) provide? (Section 93) rk traffic and analyzes its wireless networking protocols to identify suspicious activity involving the protocols themselves. This section provides a detailed discussion of wireless IDPS technologies. First, it contains a brief overview of wireless networking, which is background material for understanding the rest of the section. Next, it covers the major components of wireless IDPSs and explains the architectures typically used for deploying the components. It also examines the security capabilities of the technologies in depth, including the methodologies they use to identify and stop suspicious activity. The rest of the section discusses the management capabilities of the technologies, including recommendations for implementation and operation. Wireless networking enables devices with wireless capabilities to use computing resources without being physically connected to a network. The devices simply need to be within a certain distance (known as the range ) of the wireless network infrastructure. A wireless local area network (WLAN) is a group of wireless networking nodes within a limited geographic area that is capable of exchanging data through radio communications. WLANs are typically used by devices within a fairly limited range, such as an office building or corporate campus, and are implemented as extensions to existing wired local area networks (LAN) to provide enhanced user mobility. This section provides a brief introduction to wireless networking. Section 5.1.1 provides an overview of the most commonly used WLAN standards. Section 5.1.2 discusses the fundamental components of WLANs. Finally, Section 5.1.3 briefly examines the major threats against WLANs. This material is intended only to provide a high-level overview of wireless networking as background information for the wireless IDPS material in the rest of the section. 25 Most WLANs use the Institute of Electrical and Electronics Engineers (IEEE) 802.11 family of WLAN standards.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Guide to Intrusion Detection and Prevention Systems (IDPS).


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Securing Telehealth Remote Patient Monitoring Ecosystem provide? (Section 346) en authorized and unauthorized remote users. o Ability for the IoT device to differentiate between authorized and unauthorized physical device users.  Ability to verify the identity of an IoT device.  Ability to add a unique physical identifier at an external or internal location on the device authorized entities can access. |  Providing details for how to establish unique identification for each IoT device associated with the system and critical system components within which it is used.  Providing communications and documentation detailing how to perform account management activities, using the technical IoT device capabilities, or through supporting systems and/or tools.  Providing the details necessary to establish and implement unique identification for each IoT device associated with the system and critical system components within which it is used.  Providing the details necessary to require unique identifiers for each IoT device | .

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Securing Telehealth Remote Patient Monitoring Ecosystem.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Audit and Evaluation of Computer Security II_ System Vulnerabilities and Controls say about 4.2 Control Measures? (Part 3) According to Audit and Evaluation of Computer Security II_ System Vulnerabilities and Controls, 4.2 Control Measures: or components from the terminal. Where large quantities of media are used with the terminal, provisions should be made for its safe keeping. Most often these provisions will involve lockable cabinets. In general, the control of access to data in the host system will be provided by application and/or system controls. The discussion of such controls is treated in a different report. However, the auditor is cautioned that the selection and adequacy of local controls may be balanced against and must be appropriate to the application and system controls - 4.2.4 Audit Trail : Records must be kept such that the auditor can establish that controls are in place and that they are uniformly and consistently applied. More specifically, records must be kept such that: - o The assignment of responsibility and establishment of access rules consistent with Control Principles can be demonstrated. Normally, it will be possible to make this demonstration from documents kept for other purposes. These documents may include policy statements, standards and guidelines, procedures, program specifications, job descriptions and performance plans. - o Consistent enforcement of access rules can be demonstrated. This may involve the keeping of records specifically for this purpose. Such records might include a log of all attempted accesses distinguishing between those allowed and those disallowed. - o Accountability for service consumption and resource (data, media, terminal, etc.) use can be established. Normally this portion of the audit trail would be composed of system accounting records. - o The presence, or authorized absence or use of media can be demonstrated. This portion of the audit trail will usually be composed of media inventory control records such as the library management system. - o That required approvals and authorizations were given.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Audit and Evaluation of Computer Security II_ System Vulnerabilities and Controls.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Risk Management Framework for Information Systems and Organizations_ A System Life Cycle Approach for Security and Privacy say about SYSTEM DESCRIPTION? (Part 4) According to Risk Management Framework for Information Systems and Organizations_ A System Life Cycle Approach for Security and Privacy, SYSTEM DESCRIPTION: contractor-operated; nonfederal [state and local governments, grantees]); incident response points of contact; authorization date and authorization termination date; and ongoing authorization status. System registration information is updated with the system characterization information (see Task P-18). References: [SP 800-18]; [NIST CSF] (Core [Identify Function]).

Explanation: NIST cybersecurity documentation and standards guidance. Topics: csf, risk management framework, fips. General security reference material without sensitive content. Source: Risk Management Framework for Information Systems and Organizations_ A System Life Cycle Approach for Security and Privacy.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is GLUCK according to Report of the Workshop on Cryptography in Support of Computer Security? GLUCK: People must always realize that you must have a secure key in order to distribute other keys.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Report of the Workshop on Cryptography in Support of Computer Security.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control SI-4009 in Computer Security Division 2008 Annual Report? (Part 23) Control SI-4009: communications used in electronic commerce, critical infrastructure, and other application areas. At the core of all products offering cryptographic services is the cryptographic module. Cryptographic modules, which contain cryptographic algorithms, are used in products and systems to provide security services such as confidentiality, integrity, and authentication. Although cryptography is used to provide security, weaknesses such as poor design or weak algorithms can render a product insecure and place highly sensitive information at risk. When protecting their sensitive data, federal government agencies require a minimum level of assurance that cryptographic products meet their security requirements. Also, federal agencies are required to use only tested and validated cryptographic modules. Adequate testing and validation of the cryptographic module and its underlying cryptographic algorithms against established standards is essential to provide security assurance. Our testing-focused activities include validating cryptographic modules and cryptographic algorithm implementations, developing test suites, providing technical support to industry forums, and conducting education, training, and outreach programs. Activities in this area involve collaboration and the facilitation of relationships with other entities. Federal agencies that have collaborated recently with these activities are the Department of State, the Department of Commerce, the Department of Defense, the General Services Administration, the National Aeronautics and Space Administration, the National Security Agency, the Department of Energy, the United States Office of Management and Budget, the Social Security Administration, the United States Postal Service, the Department of Veterans Affairs, the Federal Aviation Administration, and NIST's National Voluntary Laboratory Accreditation Program.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Computer Security Division 2008 Annual Report.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Mobile Application Single Sign-On_ Improving Authentication for Public Safety First Responders say about 2.2.2.3 Authenticating with the Token? According to Mobile Application Single Sign-On_ Improving Authentication for Public Safety First Responders, 2.2.2.3 Authenticating with the Token: Now, because the system has a U2F token on file for the user, the user has the option to authenticate. - Click Authenticate (Figure 2-16), and the Google Authenticator application will be activated once more. - Hold the U2F token to your device, and then the authentication will be successful and the SSO flow will continue. Figure 2-16 FIDO U2F Authentication <!-- image -->

Explanation: NIST publication on credential and access management. Topics: authentication, token, single sign-on. Contains security framework guidance for authentication systems. Source: Mobile Application Single Sign-On_ Improving Authentication for Public Safety First Responders.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is https according to Securing Small-Business and Home Internet of Things (IoT) Devices_ Mitigating Network-Based Attacks Using Manufacturer Usage Description (MUD)? https: //docs.forescout.com/bundle/connect-module-1-7-rn/page/connect-module-1-7-rn.About-

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Securing Small-Business and Home Internet of Things (IoT) Devices_ Mitigating Network-Based Attacks Using Manufacturer Usage Description (MUD).


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain DISCUSSION according to NIST Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations According to Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations, DISCUSSION: Audit records can be generated at various levels of abstraction, including at the packet level as information traverses the network. Selecting the appropriate level of abstraction is a critical aspect of an audit logging capability and can facilitate the identification of root causes to problems. The ability to add information generated in audit records is dependent on system functionality to configure the audit record content. Organizations may consider additional information in audit records, including the access control or flow control rules invoked and the individual identities of group account users. Organizations may also consider limiting additional audit record information to only information that is explicitly needed for audit requirements.

Explanation: NIST publication discussing classified information handling. References: classified, controlled unclassified. Contains guidance on protecting sensitive government information. Source: Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations.