You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control AM-6 in Risk Management Framework for Information Systems and Organizations_ A System Life Cycle Approach for Security and Privacy? (Part 116) Control AM-6: _\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ the organization's privacy program, including any privacy functions performed by independent assessors. The senior agency official for privacy is responsible for providing privacy information to the authorizing official. References: [FIPS 199]; [SP 800-30]; [SP 800-53A]; [SP 800-55]. ## ASSESSMENT PLAN TASK A-2 Develop, review, and approve plans to assess implemented controls. Potential Inputs: Security, privacy, and SCRM plans; program management control information; common control documentation; organizational security and privacy program plans; SCRM strategy; system design documentation; supply chain information; enterprise, security, and privacy architecture information; security, privacy, and SCRM policies and procedures applicable to the system. Expected Outputs: Security and privacy assessment plans approved by the authorizing official. Primary Responsibility: Authorizing Official or Authorizing Official Designated Representative; Control Assessor. Supporting Roles: Senior Agency Information Security Officer; Senior Agency Official for Privacy; System Owner; Common Control Provider; Information Owner or Steward; System Security Officer; System Privacy Officer. System Development Life Cycle Phase: New - Development/Acquisition; Implementation/Assessment. Existing - Operations/Maintenance. Discussion: Security and privacy assessment plans are developed by control assessors based on the implementation information contained in security and privacy plans, program management control documentation, and common control documentation. Organizations may choose to develop a single, integrated security and privacy assessment plan for the system or the organization. An integrated assessment plan delineates roles and responsibilities for control assessment. Assessment plans also provide the objectives for control assessments and specific assessment procedures for each control.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: risk management framework, fips, security control. General security reference material without sensitive content. Source: Risk Management Framework for Information Systems and Organizations_ A System Life Cycle Approach for Security and Privacy.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Biometric Specifications for Personal Identity Verification say about 4.5.2 Minimum interoperability specification? According to Biometric Specifications for Personal Identity Verification, 4.5.2 Minimum interoperability specification: The core cross-vendor interoperability specification is met by establishing requirements on template generators and template matchers as described in the following two sub-sections.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Biometric Specifications for Personal Identity Verification.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Technology Assessment_ Methods for Measuring the Level of Computer Security provide? (Section 72) X | X | X | | X | X | X | X | X | X | | 1801 MVUOOUd | | | | | | X | X | X | X | X | | X | X | X | X | X | X | | ISO! 31U | | X | | X | X X | X | | X | X | X | X | X | X | X | X | X | X | | aiVIUdOHddVNI | | | | | | X | X | X | X | | X | X | | X | X | X | | | 133UU03NI | | | | | | X X | X X | X | X X | X | X X | | | X X X | X | X | | | ai31dN03NI | | | | | | | X | X | X | X | | X X | | X | | X | | | | | | | | | | | | | | | X | | | | | | | aiK}33tl ONOUM | | | | | | X | X | X | X | X | | | X | X | X | X | X | | anid ONOHM ATIVNU31NI 3iVlllNI | X | X | | X X | | X X | | | X | X | X | X | X | X | X | X | X | | NOUVZIUOHinV iSXNVlfl | X | | | | | | | | | | | | | | | | | | 0301100311 U3A3N | X | | | | | | | | | | | | | | | | | | VIVO 0NIS8IN | X | X | X | | | X | | | | | | | | | | | | | oaivondna | X | X | | X | | X | | | | | | | | | | | | | iS01 | X | X | | | | X | | | | | | | | | | | | | | | | X | | | | | | | | | | | | | | | c o ·H (0 W e v a 4J T3 0) c a 0) en o CO 09 O <u J3 O o H CO ON <!-- image --> <!-- image --> | ^ - - o 5 " £ = « O >- ^ I f o i*j £ : E D 2 Z ^ o u r i < ir (J • 3 J - 1 - 1 | - .

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control, assessment. General security reference material without sensitive content. Source: Technology Assessment_ Methods for Measuring the Level of Computer Security.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Guide to IPsec VPNs say about 3.1 Overview of IKE? (Part 3) According to Guide to IPsec VPNs, 3.1 Overview of IKE: four-byte Initiator SPI.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Guide to IPsec VPNs.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Recommendation for Key Management_ Part 2 – Best Practices for Key Management Organizations provide? (Section 132) the guidelines and procedures for key recovery operations. - k. Compromise Recovery: The procedures for recovering from the exposure of sensitive keying material to unauthorized entities. - k. Disciplinary Actions : A specification of the consequences for willful or negligent mishandling of keying material. - l. Change Procedures: A specification of the procedures for effecting changes to key management planning documentation. The following key management-related information for cryptographic product development may be useful to determine and resolve potential impacts to the key management infrastructure or other keying material acquisition processes in a time frame that meets user requirements. Yes/no responses should be provided to the following questions as well as additional information for each 'yes' response. To the extent practical, SP 800-160, 112 should be followed in the development of cryptographic products. 1. Are unique key management products 113 and services 114 required by the cryptographic product for proper operation? 2. Are there any cryptographic capabilities to be supported by a CKMS that are not fully configurable in the cryptographic product? 3. Does the cryptographic module implement a software download capability for importing updated cryptographic functions? 115 4. Does the cryptographic module use any non-keying material CKMS products or services (such as CKL/CRLs, seed key 116 conversion, etc.)? 5. Does the cryptographic module design preclude the use of any approved cryptographic algorithm? 112 SP 800-160 Volume 1, Systems Security Engineering: Considerations for a Multidisciplinary Approach in the Engineering of Trustworthy Secure Systems . 113 Key management products: e.g., keys, certificates, tokens, etc. 114 Key management services: The generation, establishment, distribution, destruction, revocation, and recovery of keys. 115 Cryptographic functions: algorithms and modes of operation.

Explanation: NIST publication on credential and access management. Topics: key management, token. Contains security framework guidance for authentication systems. Source: Recommendation for Key Management_ Part 2 – Best Practices for Key Management Organizations.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is System Supplier according to Validated Products List 1995 no. 4_ Programming Languages, Database Language SQL, Graphics, POSIX, Computer Security, Product Data - IGES, OSI? System Supplier: Data General Corporation

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Validated Products List 1995 no. 4_ Programming Languages, Database Language SQL, Graphics, POSIX, Computer Security, Product Data - IGES, OSI.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Practical Combinatorial Testing provide? (Section 84) as an input validity check that issues an error message if input is not acceptable. The assertion gives conditions that must hold for the function to operate properly, in this case a non-zero divisor. It is the responsibility of the programmer to ensure that a zero divisor is never passed to the function. The distinction between assertions and input validation code is that assertions are intended to catch programming mistakes , while input validation detects errors in user or file/database input. With a sufficient number of assertions derived from a specification, the program can have a self-checking property [27, 60, 47]. The assertions can serve as a sort of embedded proof of important properties, such that if the assertions hold for all executions of the program, then the properties encoded in the assertions are guaranteed to hold. Then, if the assertions form a chain of logic that implies a formal statement of program properties, the program's correctness with respect to these properties can be proven. We can take advantage of this scheme in combinatorial testing by demonstrating that the assertions hold for all t -way With self-checking through assertions, thousands of tests can often be run at very low cost, allowing highstrength interaction coverage. combinations of inputs. While this is not the same as a correctness proof, it is an effective way of integrating formal methods for correctness with program testing, and an extensive body of research has developed this idea for practical use (for a survey, see [4]). Some modern programming languages, such as Eiffel [52], include extensive support for including assertions that encode program properties, and tools such as the Java Modeling Language [42] have been designed to integrate assertions with testing.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Practical Combinatorial Testing.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Cryptographic Key Management Workshop Summary -- June 8-9, 2009 say about 2.1.9 2010 Transitions: Elaine Barker, NIST? According to Cryptographic Key Management Workshop Summary -- June 8-9, 2009, 2.1.9 2010 Transitions: Elaine Barker, NIST: - The talk described NIST recommendations to transition from algorithms and key sizes that are believed to be too weak (i.e., no longer secure) to a stronger set of algorithms and key sizes, including deadlines for transition from the old set to the new set. - A security strength (AKA 'bits of security') is a number associated with the expected amount of work (often measured in binary operations) that is required to obtain any given key used by an application by testing all possible keys. The security strength is specified in bits and is currently a value from the set {80, 112, 128, 192, 256}. 80 bits of security are good through December 31, 2010. Thereafter, NIST recommends 112 bits as the minimum. - Material was provided from NIST SP 800-57, Part 1 (for algorithms, key sizes, security strengths, and recommended transition times), FIPS 186-3 (for digital signatures), and FIPS 180-3 (hash functions). See the presentation slides or referenced documents for details and comparisons among algorithms and parameters.

Explanation: NIST publication on credential and access management. Topics: key management, sso. Contains security framework guidance for authentication systems. Source: Cryptographic Key Management Workshop Summary -- June 8-9, 2009.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is Log Entry according to Guide to Computer Security Log Management? Log Entry: An individual record within a log.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Guide to Computer Security Log Management.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does A Threat Analysis on UOCAVA Voting Systems say about 6.1.1 Postal Mail? (Part 2) According to A Threat Analysis on UOCAVA Voting Systems, 6.1.1 Postal Mail: ld be extremely difficult for a small number of malicious individuals to obtain a large amount of information. Most postal employees would only handle a small number of registration/request materials. In some cases it might be difficult to identify these materials from other pieces of mail without opening the Table 2: Threat Matrix for Postal Mail Registration and Ballot Request | Threat | Threat-Sources | Effort | Detection | Impact | Possible Controls | |--------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------|----------|-------------|----------------|------------------------------------------| | Ineligible individual allowed to register to vote. | Hostile Individuals | Low | Mod. | Integrity-Mod. | IA-1, IA-2, IA-4, IA-5 | | Valid voter's ballot request information, such as address, is modified in transit. | Hostile Individuals Postal Workers System Operators Election Officials | Mod. | Low | Integrity-Mod. | MP-5, MP-5(1) | | Registration/Request materials are accidentally lost or destroyed in transit. | Postal Workers | Low | High | Avail.-High | MP-5 | | Registration/Request materials are intentionally delayed or destroyed in transit by a malicious party. | Hostile individuals Hostile Organizations Postal workers | High | High | Avail.-High | MP-5 | | Sensitive personal information is viewed in transit.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: A Threat Analysis on UOCAVA Voting Systems.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain 6.1 Security Risks according to NIST Guidelines for the Secure Deployment of IPv6 According to Guidelines for the Secure Deployment of IPv6, 6.1 Security Risks: This section provides an overview of risks organizations may face when moving from an IPv4 to IPv4/IPv6 and eventually IPv6 environment. The deployment of IPv6 is inevitable. The IPv4 address space is almost exhausted and the only long-term solution is to deploy IPv6. IPv6 is not backwards compatible with IPv4, which means organizations will have to change their network infrastructure and systems to deploy IPv6. Organizations should begin now to understand the risks and the risk mitigation strategies. Planning will enable an organization to make a smooth, secure and successful transition. Some general risks an organization may face include: -  The attacker community's use of IPv6 -  Unauthorized deployment of IPv6 on existing IPv4 production networks -  Vulnerabilities present in IPv6, including -day zero‖ vulnerabilities that are inherent in any new or revised system -  Complexity added by dual IPv4/IPv6 operations -  Immaturity of IPv6 security products and processes -  Possible lack of vendor support.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Guidelines for the Secure Deployment of IPv6.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control PD-12 in Codes for Identification of Federal and Federally-Assisted Organizations? (Part 90) Control PD-12: Memorial Cemetery Commission ## MULTILATERAL DEVELOPMENT BANKS | 11DB | African Development Fund | |--------|--------------------------------------------------------------------| | 11DE | Asian Development Bank | | 11DK | European Bank for Reconstruction and Development | | 11DT | Inter-American Defense Board | | 11DH | Inter-American Development Bank | | 11DR | International Bank for Reconstruction and Development (World Bank) | | 11DA | International Development Association | | 11DF | International Finance Corporation | | 11DG | International Fund for Agricultural Development | | 11DM | International Monetary Fund | | 11DW | Multilateral Investment Guarantee Agency | | 11DN | North American Development Bank | ## REGIONAL ORGANIZATIONS | 19RJ | Asia-Pacific Economic Cooperation | |--------|--------------------------------------------------------------------------------------| | 19RC | Colombo Plan Council for Technical Cooperation | | 19RD | Colombo Plan for Cooperative Economic and Social Development in Asia and the Pacific | | 11RF | Multinational Force and Observers | | 19RA | North Atlantic Assembly | | 19RN | North Atlantic Treaty Organization | | 19RE | Organization for Economic Cooperation and Development | | 19RP | South Pacific Commission | ## TABLE OF ORGANIZATIONS AND CODES OTHER INDEPENDENT FEDERAL AGENCIES, BOARDS, COMMISSIONS, COUNCILS, FOUNDATIONS, OFFICES, QUASI-FEDERAL ORGANIZATIONS AND

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Codes for Identification of Federal and Federally-Assisted Organizations.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Approaches to Privacy and Security in Computer Systems_ Proceedings of a Conference Held at the National Bureau of Standards March 4-5, 1974 say about Data at Rest? According to Approaches to Privacy and Security in Computer Systems_ Proceedings of a Conference Held at the National Bureau of Standards March 4-5, 1974, Data at Rest: As contrasted to data in motion, data at rest is data in a semipermanent file -data on magnetic tape, data on Magnetic Disk, or even data in main storage. The amount of encryption that can be performed depends, of course, on the cost and performance of the encryption devices available. For the moment we will assume the existence of an encryption device having no cost and having no performance limitations. Later, we will consider cost and performance constraints.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Approaches to Privacy and Security in Computer Systems_ Proceedings of a Conference Held at the National Bureau of Standards March 4-5, 1974.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Improving Enterprise Patching for General IT Systems_ Utilizing Existing Tools and Performing Processes in Better Ways provide? (Section 6) HowTo Guides , which provide specific product installation, configuration, and integration instructions for building the example implementation, allowing you to replicate all or parts of this project. You can view or download the guide at Help the NCCoE make this guide better by sharing your thoughts with us as you read the guide. If you adopt this solution for your own organization, please share your experience and advice with us. We recognize that technical solutions alone will not fully enable the benefits of our solution, so we encourage organizations to share lessons learned and best practices for transforming the processes associated with implementing this guide. To provide comments or to learn more by arranging a demonstration of this example implementation, contact the NCCoE at cyberhygiene@nist.gov. Collaborators participating in this project submitted their capabilities in response to an open call in the Federal Register for all sources of relevant security capabilities from academia and industry (vendors and integrators). Those respondents with relevant capabilities or product components signed a Cooperative Research and Development Agreement (CRADA) to collaborate with NIST in a consortium to build this example solution. Certain commercial entities, equipment, products, or materials may be identified by name or company logo or other insignia in order to acknowledge their participation in this collaboration or to describe an experimental procedure or concept adequately. Such identification is not intended to imply special status or relationship with NIST or recommendation or endorsement by NIST or NCCoE; neither is it intended to imply that the entities, equipment, products, or materials are necessarily the best available for the purpose.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Improving Enterprise Patching for General IT Systems_ Utilizing Existing Tools and Performing Processes in Better Ways.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Computer Security Division 2013 Annual Report say about Apple OS X Security Configuration? (Part 1) According to Computer Security Division 2013 Annual Report, Apple OS X Security Configuration: Apple OS X Security Configuration CSD is working with Apple to develop secure system configuration baselines supporting different operational environments for Apple OS X, Version 10.8, Mountain Lion. These configuration guidelines will assist organizations with hardening OS X technologies and provide a basis for unified controls and settings for OS X workstations and for mobile system security configurations for federal agencies. The configurations will be based on a collection of resources, including the existing NIST OS X configuration guidance, the OS X security configuration guide, the Department of Defense (DoD) OS X Recommended Settings, and the Defense Information Systems Agency (DISA) OS X Security Technical Implementation Guide (STIG). Our team is aggregating appropriately 400 initial settings, determining which settings will be included in the configuration baseline, and determining appropriate values for each included setting. As the desired configuration items are established, our team is developing shell scripts that apply the settings to an OS X 10.8 system. The settings are organized into three key baselines, which are appropriate for different environments: -  Enterprise baseline is appropriate for centrally managed, networked systems. -  Small Office Home Office baseline is appropriate for systems that are deployed remotely but need to connect to enterprise networks. -  Special Security Limited Functionality baseline is appropriate for systems where security requirements are more stringent and where the implementation of security safeguards is likely to reduce functionality. SCAP, defined and discussed in other sections of this report, is used to express configuration settings and check system configuration compliance.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Computer Security Division 2013 Annual Report.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain 03.08.03 Media Sanitization according to NIST Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations According to Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations, 03.08.03 Media Sanitization: Sanitize system media that contain CUI prior to disposal, release out of organizational control, or release for reuse.

Explanation: NIST publication discussing classified information handling. References: classified, controlled unclassified, cui. Contains guidance on protecting sensitive government information. Source: Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is Virtualization according to Guide to Security for Full Virtualization Technologies? Virtualization: The simulation of the software and/or hardware upon which other software runs.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Guide to Security for Full Virtualization Technologies.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does NIST Test Personal Identity Verification (PIV) Cards Version 2 say about Security Object:? According to NIST Test Personal Identity Verification (PIV) Cards Version 2, Security Object:: Includes unsigned data objects but not CHUID, Cardholder Fingerprints, or Cardholder Facial Image.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: NIST Test Personal Identity Verification (PIV) Cards Version 2.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain Required Vendor Information according to NIST PIV Card Application and Middleware Interface Test Guidelines (SP 800-73-4 Compliance) According to PIV Card Application and Middleware Interface Test Guidelines (SP 800-73-4 Compliance), Required Vendor Information: VE05.29.01: The vendor shall state in its documentation that the card supports the assertion made in AS05.29.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: PIV Card Application and Middleware Interface Test Guidelines (SP 800-73-4 Compliance).


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control AC-2 in Proceedings of the Workshop of the Federal Criteria for Information Technology Security? (Part 32) Control AC-2: privilege to increase or decrease a process' priority may be allocated to non-TCB subjects). Oth^ noted that the FC should not discuss 'trusted subjects' at all, since it is an implementation detail. In most cases, it should suffice to simply distinguish between TCB and non-TCB (and possibly Reference Monitor and the non-RM TCB). ## Summary and Conclusions The DAWG did not achieve consensus (Hi a lot of the issues discussed. This was due in part to the small amount of time available for discussion. Nonetheless, many excellent points were raised, the most significant of which are hopefully ccHitained in the material presented above. In the mcxlerator's opinion, th^ was general agreement on a number of important issues: - Few were ha{^y with the current contents of Chapter 5. There was not a consensus on what Chapter 5 should l(X)k like, but many opinicHis w^given (as discussed above). - Most participants liked the idea of components in principle. However, nearly everyone had serious concerns about the concept in i^ctice, and in particular, about the FC's components as currently defined. The principle concerns focused on the possibility of reconstructing meaningless (and possibly harmful) assurance requirements from ccHuponents, the lack of control over the quality of individual components, and the loss of meaning by breaking assurance requirements into components and then reconstructing new assurance requirements. This issue consumed most of the DAWG's lime. - Nearly all participants had serious concerns about some of the technical assurance concepts introduced in the FC. Many felt that some of the concepts were not wellaccepted, and that some of the 'new' concepts were not well described Others were concerned that some well-accepted concepts were replaced by less-accepted or poorly described 'new' concepts. The group consensus was that the FC should stick to accepted concerts and ideas (but not close the dcx)r on new ideas being introduced in the future).

Explanation: NIST cybersecurity documentation and standards guidance. Topics: rmf, fips, security control. General security reference material without sensitive content. Source: Proceedings of the Workshop of the Federal Criteria for Information Technology Security.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171 provide? (Section 6) owing call(s) for the identification of patent claims whose use may be required for compliance with the guidance or requirements of this publication, no such patent claims have been identified to ITL. No representation is made or implied by ITL that licenses are not required to avoid patent infringement in the use of this publication. \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ This publication is a supplement to NIST Special Publication 800-171 [SP 800-171]. It contains recommendations for enhanced security requirements to provide additional protection for Controlled Unclassified Information (CUI) in nonfederal systems and organizations when such information is associated with critical programs or high value assets. The enhanced security requirements are designed to respond to the advanced persistent threat (APT) and supplement the basic and derived security requirements in [SP 800-171]. While the security requirements in [SP 800-171] focus primarily on confidentiality protection, the enhanced security requirements in this publication address confidentiality, integrity, and availability protection. The enhanced security requirements are implemented in addition to the basic and derived requirements since those requirements are not designed to address the APT. The enhanced security requirements apply to those components of nonfederal systems that process, store, or transmit CUI or that provide protection for such components. There is no expectation that all of the enhanced security requirements will be selected by federal agencies implementing this guidance. The decision to select a particular set of enhanced security requirements will be based on the mission and business needs of federal agencies and guided and informed by ongoing risk assessments.

Explanation: NIST publication discussing classified information handling. References: classified, controlled unclassified, cui. Contains guidance on protecting sensitive government information. Source: Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is Currently there are nine laboratories accredited to perform Cryptographic Module testing according to Computer Security Division 2004 Annual Report? Currently there are nine laboratories accredited to perform Cryptographic Module testing: five in the United States, two in Canada and two in the United Kingdom. Seven laboratories are to be re-accredited in 2005 and three or more new laboratories should complete accreditation. Currently there are nine Common Criteria testing laboratories.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Computer Security Division 2004 Annual Report.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Mobile Device Security_ Cloud and Hybrid Builds say about 4.3.1 Default Policies? (Part 19) According to Mobile Device Security_ Cloud and Hybrid Builds, 4.3.1 Default Policies: application store.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Mobile Device Security_ Cloud and Hybrid Builds.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is Guidance according to Security Guidance for First Responder Mobile and Wearable Devices? Guidance: Most modern handsets and mobile devices contain the latest features and enhancements regarding data integrity protections. Similarly, devices typically have data integrity mechanisms built-in and enabled by default, requiring little or no user intervention. Older devices may lack features to protect against modern attacks, therefore it is important to keep devices up to date with the latest OS patches and upgrades. Devices that are no longer supported by the hardware vendor or OS manufacturer should be retired out of service.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Security Guidance for First Responder Mobile and Wearable Devices.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does A Zero Trust Architecture Model for Access Control in Cloud-Native Applications in Multi-Cloud Environments provide? (Section 26) via mutual Transport Layer Security (mTLS) when a service makes an initial connection establishment as part of its inter-service call. This authentication is not performed again in subsequent calls. However, the security of this operation is ensured by not allowing the connections to be very long (usually as long as the time to live [TTL] of the service's identity certificate or as short as 15-30 minutes, depending on the configuration). - ID-SEG-REC-3: Service to service authorization - Services should leverage runtime service identity (ID-SEG-REC-2) to enforce granular policies and have the capability to call external authorization services if the mesh-level proxies are insufficient to enforce dynamic authorization policies. - ID-SEG-REC-4: End user authentication - Since all application requests are triggered by user actions, a robust identity management system is required to assign and maintain user identities and enforce robust protocols with phishing-resistant multi-factor authentication (MFA). This system should be used to issue a cryptographically verifiable runtime token that represents the user principal to the rest of the infrastructure (e.g., a JSON Web Token [JWT]), and services should authenticate the credential at each hop. Note on the above recommendation: Authenticating the user in session at every hop is impractical at scale. Therefore, NIST recommends using short-lived end user credentials (e.g., OAuth 2.0 tokens) for external users and exchanging them for a locally authenticatable token, like a JWT, that is authenticated at each hop. - ID-SEG-REC-5: End user to resource authorization - As part of each service access request, the system must ensure that the authenticated end user principal (ID-SEG-REC4) is authorized to act on the resources designated in the request.

Explanation: NIST publication on credential and access management. Topics: access control, authentication, authorization. Contains security framework guidance for authentication systems. Source: A Zero Trust Architecture Model for Access Control in Cloud-Native Applications in Multi-Cloud Environments.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does De-Identifying Government Datasets_ Techniques and Governance say about 3.6. Disclosure Review Boards? (Part 5) According to De-Identifying Government Datasets_ Techniques and Governance, 3.6. Disclosure Review Boards: f evaluating data releases, the DRB should require that written applications be submitted to the DRB that specify the nature of the dataset, the deidentification methodology, and the result. An application may require that the proposer present the re-identification risk, the risk to individuals if the dataset is re-identified, and a proposed plan for detecting and mitigating successful re-identification. In addition, the DRB should require that when individuals are informed that their information will be deidentified, they also be informed that privacy risks may remain despite de-identification. The DRB should keep accurate records of its request memos, their associated documentation, the DRB decision, and the actual files released. These records should be appropri- 24 For example, in 2022, the Census Bureau's DRB had 12 voting members: two technical co-chairs, a representative from the Policy Coordination Office, a representative from the Associate Director for Communications, two representatives from the Center for Enterprise Dissemination-Disclosure Avoidance (CED-DA), two representatives from the Economic Programs Directorate, two representatives from the Demographic Programs Directorate, and two representatives from the Decennial Programs Directorate [29]. ately archived and curated so that they can be recovered. In the case of large data releases, the definitive version of the released data should be curated using an externally validated procedure, such as a recorded cryptographic hash value or signature, and a digital object identifier (DOI) [83]. DRBs may wish to institute a two-step process in which the applicant first proposes and receives approval for a specific de-identification process that will be applied to a specific dataset and then submits and receives approval for the release of the dataset that has been de-identified according to the proposal.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: De-Identifying Government Datasets_ Techniques and Governance.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Automation Support for Security Control Assessments_ Software Asset Management say about Roles and Assessment Methods? According to Automation Support for Security Control Assessments_ Software Asset Management, Roles and Assessment Methods: | Determination Statement ID | Implemented By | Assessment Boundary | Assessment Responsibility | Assessment Methods | Selected | Rationale for Risk Acceptance | Frequency of Assessment | Impact of Not Implementing | |------------------------------|------------------|-----------------------|-----------------------------|----------------------|------------|---------------------------------|---------------------------|------------------------------| | SI-3(c){2} | ISCM-Ops | ISCM-TN | ISCM-Sys | Test | | | | |

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control, assessment. General security reference material without sensitive content. Source: Automation Support for Security Control Assessments_ Software Asset Management.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Guide to Enterprise Telework, Remote Access, and Bring Your Own Device (BYOD) Security provide? (Section 18) ), and remote access communications. The document emphasizes the importance of securing sensitive information stored on telework devices and transmitted through remote access across external networks. This document provides recommendations for creating telework-related policies and for selecting, implementing, and maintaining the necessary security controls for remote access servers and clients. This document is primarily intended for security, system, and network engineers and administrators, as well as computer security program managers, who are responsible for the technical aspects of preparing, operating, and securing remote access solutions and client devices. Portions of the document are also intended for higher-level management, such as the individuals responsible for creating telework policies. The material in this document is technically oriented, and it is assumed that readers have at least a basic understanding of remote access, networking, network security, and system security. The remainder of this document is organized into the following sections: -  Section 2 provides an overview of enterprise telework and remote access security. It discusses general vulnerabilities and threats against telework and remote access solutions. It also describes the highlevel architectures of common remote access methods and the security characteristics of each architecture. Finally, it discusses concerns particular to BYOD use of organization networks. -  Section 3 presents recommendations for securing remote access solutions, including server security, server placement, and client software security. It also covers authentication, authorization, and access control for remote access solutions. -  Section 4 offers recommendations for securing telework client devices and protecting data on them. -  Section 5 discusses security throughout the telework and remote access life cycle.

Explanation: NIST publication on credential and access management. Topics: access control, authentication, authorization. Contains security framework guidance for authentication systems. Source: Guide to Enterprise Telework, Remote Access, and Bring Your Own Device (BYOD) Security.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Summary Report for “Workshop on Updating Manufacturer Guidance for Securable Connected Product Development” say about Contact Information? According to Summary Report for “Workshop on Updating Manufacturer Guidance for Securable Connected Product Development”, Contact Information: iotsecurity@nist.gov National Institute of Standards and Technology Attn: Applied Cybersecurity Division, Information Technology Laboratory 100 Bureau Drive (Mail Stop 2000) Gaithersburg, MD 20899-2000

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Summary Report for “Workshop on Updating Manufacturer Guidance for Securable Connected Product Development”.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Cybersecurity Framework Profile for Electric Vehicle Extreme Fast Charging Infrastructure provide? (Section 236) . | ISA/IEC 62443-2- 1:D4E1 EVENT 1.2 ISA/IEC 62443-3- 3:2013 SR 6.1 | | DP-4 | Cloud/Third-Party | Applicable, but no additional Cloud/Third-Party-specific considerations. | [NIST-SP800-53r5] AU-6, CA-2, CA-7 | | DP-4 | Utility/Building Management System | Applicable, but no additional Utility/Building Management System specific considerations. | ISA/IEC 62443-2- 1:D4E1 EVENT 1.2 ISA/IEC 62443-3- 3:2013 SR 6.1 | | DP-5: Detection processes are continuously improved. | Ecosystem: These improvements may take the form of additional or increased tool use, activities, or Cyber Threat Intelligence use. | [NIST-SP800-53r5] CA-2, CA-7, PL-2, PM-14, RA-5, SI-4 | | DP-5 | EV | Applicable, but no additional EV-specific considerations. | [NIST-SP800-53r5] CA-2, CA-7, PL-2, PM-14, RA-5 | | DP-5 | XFC/EVSE | Applicable, but no additional EVSE-specific considerations. | ISA/IEC 62443-2- 1:D4E1 ORG 1.1 | | DP-5 | Cloud/Third-Party | Applicable, but no additional Cloud/Third-Party-specific considerations. | [NIST-SP800-53r5] CA-2, CA-7, PL-2, PM-14, RA-5 | | DP-5 | Utility/Building Management System | Applicable, but no additional Utility/Building Management System-specific considerations. | ISA/IEC 62443-2- 1:D4E1 ORG 1.1 | The activities in the Respond function support the ability to contain the impact of an incident by developing and implementing the appropriate responses to a detected cybersecurity attack or anomalous incident. The Respond function actions are triggered by the outputs generated by the Detect function and the Protect function provides the ability to execute the proper response to an incident according to a pre-defined plan.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: cybersecurity framework, fips, security control. General security reference material without sensitive content. Source: Cybersecurity Framework Profile for Electric Vehicle Extreme Fast Charging Infrastructure.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Identifying and Estimating Cybersecurity Risk for Enterprise Risk Management say about 2.1.2 Enterprise Strategy for Cybersecurity Risk Coordination? (Part 5) According to Identifying and Estimating Cybersecurity Risk for Enterprise Risk Management, 2.1.2 Enterprise Strategy for Cybersecurity Risk Coordination: | | 4. Assessing CSRM and reporting system level risk response through CSRRs | Security plans; risk response; system authorization (or denial of authorization with referral back for plan revision) | Risk assessment results; CSRRs describing residual risk and response actions taken; risk categorization and metrics that support ongoing assessment, authorization, and continuous monitoring | | 5.Aggregating organization level CSRRs | CSRRs showing system level risk decisions and metrics; internal reports from compliance/auditing processes to confirm alignment with enterprise risk strategy; observations regarding CSRM achievement in light of risk strategy | CSRRs aggregated and normalized based on enterprise-defined risk categories and measurement criteria; refinement of risk tolerance statements, if needed, to ensure balance among value, resources, and risk | | 6.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control, assessment. General security reference material without sensitive content. Source: Identifying and Estimating Cybersecurity Risk for Enterprise Risk Management.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171 say about COMMON ABBREVIATIONS? (Part 4) According to Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171, COMMON ABBREVIATIONS: | Tactics, Techniques, and Procedures | | USC | United States Code | | US-CERT | United States Computer Emergency Response Team | | VLAN | Virtual Local Area Network | \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

Explanation: NIST publication discussing classified information handling. References: classified, controlled unclassified. Contains guidance on protecting sensitive government information. Source: Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control HA-3 in Computer Security Division 2014 Annual Report? (Part 151) Control HA-3: emented in hardware or protected firmware so that malware cannot tamper with the functions they provide. Roots of trust provide a firm foundation from which to build security and trust. NIST CSD's work aims to encourage the use of roots of trust in computers to provide stronger security assurances. A focus area for this work has been securing mobile devices, using roots of trust to provide device integrity, data and application isolation, and protected storage. As part of this work, CSD is revising SP 800-164, Guidelines on HardwareRooted Security in Mobile Devices, based on the public comments that were received on the draft. A revised draft will be released in FY 2015. Meanwhile, the draft guideline is being used as the basis for an effort with the National Cybersecurity Center of Excellence (NCCoE) to encourage the adoption of stronger security technologies in mobile devices. Using draft SP 800-164 as a foundational document, the NCCoE and CSD developed the Mobile Device Security for Enterprises building block, which will demonstrate commercially available technologies that provide protection to both organization-issued and personally owned mobile platforms. The NCCoE will invite mobile device, operating system, and management software vendors, as well as application developers, to participate in this building block activity and demonstrate how their technologies could be used together to meet existing security requirements. The CSD also continued its work to protect platform firmware in FY 2014. Boot firmware, commonly known as the Basic Input/Output System (BIOS), is a critical firmware component, due to its unique and privileged position within modern computing architectures. CSD has been working with key members of the computer industry on the use of roots of trust to improve the security of BIOS.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Computer Security Division 2014 Annual Report.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is Note according to Engineering Trustworthy Secure Systems? Note: This includes the criteria defined by regulatory, certification, evaluation, and other approval authorities.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Engineering Trustworthy Secure Systems.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control CP-09 in Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations? (Part 130) Control CP-09: Maintenance (MA) | NIST SP 800-53 CONTROLS MODERATE BASELINE | NIST SP 800-53 CONTROLS MODERATE BASELINE | TAILORING CRITERIA | SECURITY REQUIREMENT | |---------------------------------------------|---------------------------------------------|----------------------|------------------------| | MA-01 | System Maintenance Policy and Procedures | CUI | 03.15.01 | | MA-02 | Controlled Maintenance | NCO | - | | NIST SP 800-53 CONTROLS MODERATE BASELINE | NIST SP 800-53 CONTROLS MODERATE BASELINE | TAILORING CRITERIA | SECURITY REQUIREMENT | |---------------------------------------------|--------------------------------------------------|----------------------|------------------------| | MA-03 | Maintenance Tools | CUI | 03.07.04 | | MA-03(01) | Maintenance Tools | Inspect Tools | CUI | 03.07.04 | | MA-03(02) | Maintenance Tools | Inspect Media | CUI | 03.07.04 | | MA-03(03) | Maintenance Tools | Prevent Unauthorized Removal | CUI | 03.07.04 | | MA-04 | Nonlocal Maintenance | CUI | 03.07.05 | | MA-05 | Maintenance Personnel | CUI | 03.07.06 | | MA-06 | Timely Maintenance | NCO | - | Table 12.

Explanation: NIST publication discussing classified information handling. References: classified, controlled unclassified, cui. Contains guidance on protecting sensitive government information. Source: Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control HA-2 in Guidelines for the Selection, Configuration, and Use of Transport Layer Security (TLS) Implementations? (Part 91) Control HA-2: n: the CCM Mode for Authentication and Confidentiality. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) 800-38C, Includes updates as of July 20, 2007. https://doi.org/10.6028/NIST.SP.800-38C - [29] Eastlake D, III, (2011) Transport Layer Security (TLS) Extensions: Extension Definitions. (Internet Engineering Task Force (IETF)), IETF Request for Comments (RFC) 6066. https://doi.org/10.17487/RFC6066 - [30] Eronen P, Tschofenig H (2005) Pre-Shared Key Ciphersuites for Transport Layer Security (TLS). (Internet Engineering Task Force (IETF), Network Working Group), IETF Request for Comments (RFC) 4279. https://doi.org/10.17487/RFC4279 - [31] Federal Public Key Infrastructure Policy Authority (2019) X.509 Certificate Policy For The U.S. Federal PKI Common Policy Framework. - [32] Freier A, Karlton P, Kocher P (2011) The Secure Sockets Layer (SSL) Protocol Version 3.0. (Internet Engineering Task Force (IETF)), IETF Request for Comments (RFC) 6101. https://doi.org/10.17487/RFC6101 - [33] Gutmann P (2014) Encrypt-then-MAC for Transport Layer Security (TLS) and Datagram Transport Layer Security (DTLS). (Internet Engineering Task Force (IETF)), IETF Request for Comments (RFC) 7366. https://doi.org/10.17487/RFC7366 - [34] Hoffman P, Schlyter J (2012) The DNS-Based Authentication of Named Entities (DANE) Transport Layer Security (TLS) Protocol: TLSA. (Internet Engineering Task - Force (IETF)), IETF Request for Comments (RFC) 6698. https://doi.org/10.17487/RFC6698 - [35] Huitema C, Rescorla E (2018) Issues and Requirements for SNI Encryption in TLS. (Internet Engineering Task Force (IETF) Transport Layer Security Working Group), Internet-Draft draft-ietf-tls-sni-encryption-04.

Explanation: NIST publication on credential and access management. Topics: authentication, pki. Contains security framework guidance for authentication systems. Source: Guidelines for the Selection, Configuration, and Use of Transport Layer Security (TLS) Implementations.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Card Technology Developments and Gap Analysis Interagency Report say about Workshop topics:? (Part 3) According to Card Technology Developments and Gap Analysis Interagency Report, Workshop topics:: PM | LUNCH | | | 2:05 PM- 3:35 PM | PANEL DISCUSSION: INTEROPERABILITY REQUIREMENTS/ISSUES | | | 3:35 PM- 3:55 PM | QUESTIONS AND COMMENTARY | | | 3:55 PM- 4:10 PM | BREAK | | | 4:15 PM- 4:45 PM | PANEL DISCUSSION: TECHNOLOGYROAD MAP & GAP ANALYSIS | | | 4:45 PM- 5:00PM | QUESTIONS AND COMMENTARY | | | 5:00 PM- 5:15PM | WORKSHOPWRAP-UP | |

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Card Technology Developments and Gap Analysis Interagency Report.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is This report is intended for two main audiences according to Common Platform Enumeration_ Name Matching Specification Version 2.3? This report is intended for two main audiences: IT management tool developers and the authors and editors of CPE content. Readers of this report should already be familiar with CPE naming concepts and conventions as defined in [CPE23-N].

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Common Platform Enumeration_ Name Matching Specification Version 2.3.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Status Report on the Second Round of the NIST Lightweight Cryptography Standardization Process provide? (Section 96) thenticated Encryption and Hash Family, Submission to the NIST Lightweight Cryptography Standardization Process. https://csrc.nist.gov/ Projects/lightweight-cryptography/round-2-candidates. - [52] Goudarzi D, Jean J, K¨ olbl S, Peyrin T, Rivain M, Sasaki Y, Sim SM (2019) Pyjamask \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ - v1.0, Submission to the NIST Lightweight Cryptography Standardization Process. lightweight-cryptography/round-2-candidates. - [53] Iwata T, Khairallah M, Minematsu K, Peyrin T (2019) Romulus v1.2, Submission to the NIST Lightweight Cryptography Standardization Process. https://csrc.nist.gov/ Projects/lightweight-cryptography/round-2-candidates. - [54] Naito Y, Matsui M, Sakai Y, Suzuki D, Sakiyama K, Sugawara T (2019) SAEAES, Submission to the NIST Lightweight Cryptography Standardization Process. https: //csrc.nist.gov/Projects/lightweight-cryptography/round-2-candidates. - [55] Canteaut A, Duval S, Leurent G, Naya-Plasencia M, Perrin L, Pornin T, Schrottenloher A (2019) Saturnin: A Suite of Lightweight Symmetric Algorithms for Post-Quantum Security, Submission to the NIST Lightweight Cryptography Standardization Process. lightweight-cryptography/ round-2-candidates. - [56] Beierle C, Jean J, K¨ olbl S, Leander G, Moradi A, Peyrin T, Sasaki Y, Sasdrich P, Sim S (2019) SKINNY-AEAD and SKINNY-Hash v1.1, Submission to the NIST Lightweight Cryptography Standardization Process. lightweight-cryptography/round-2-candidates.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Status Report on the Second Round of the NIST Lightweight Cryptography Standardization Process.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does A Statistical Test Suite for Random and Pseudorandom Number Generators for Cryptographic Applications provide? (Section 75) uences occurring in the tested sequence is too large or too small relative to the expected behavior of that cumulative sum for random sequences. This cumulative sum may be considered as a random walk. For a random sequence, the excursions of the random walk should be near zero. For certain types of non-random sequences, the excursions of this random walk from zero will be large. CumulativeSums( mode,n ), where: - n The length of the bit string. Additional input for the function, but supplied by the testing code: - ε The sequence of bits as generated by the RNG or PRNG being tested; this exists as a global structure at the time of the function call; ε = ε 1 , ε 2 , … , ε n . mode A switch for applying the test either forward through the input sequence ( mode = 0 ) or backward through the sequence ( mode = 1 ). - z: The largest excursion from the origin of the cumulative sums in the corresponding (-1, +1) sequence. The reference distribution for the test statistic is the normal distribution. - (1) Form a normalized sequence: The zeros and ones of the input sequence ( ε ) are converted to values Xi of -1 and +1 using Xi = 2 ε i - 1. For example, if ε = 1011010111 , then X = 1, (-1), 1, 1, (-1), 1, (-1), 1, 1, 1 . - (2) Compute partial sums Si of successively larger subsequences, each starting with X1 (if mode = 0 ) or Xn (if mode = 1 ). | Mode = 0 (forward) | Mode = 1 (backward) | |--------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------| | S 1 = X 1 S 2 = X 1 + X 2 S 3 = X 1 + X 2 + X 3 . . S k = X 1 + X 2 + X 3 +…+X k . .

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: A Statistical Test Suite for Random and Pseudorandom Number Generators for Cryptographic Applications.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Computer Security Training & Awareness Course Compendium say about TANDEM? According to Computer Security Training & Awareness Course Compendium, TANDEM: COURSE TITLE: Audit and Security of Tandem Systems COURSE LENGTH: 2 DAYS

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Computer Security Training & Awareness Course Compendium.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Securing Telehealth Remote Patient Monitoring Ecosystem say about C-2 Information and Information System Categorization? (Part 2) According to Securing Telehealth Remote Patient Monitoring Ecosystem, C-2 Information and Information System Categorization: Table C-1, Information Types and Categorizations, and provisional impact levels were captured, with the category levels corresponding to the recommended value found in NIST SP 800-60 Volume II [31]. . Table C-1 Information Types and Categorizations | Information Type | NIST SP 800-60 Volume II Reference (e.g., C.2.8.9) | Confidentiality | Integrity | Availability | Justification (to change an impact level) | |--------------------------------------|------------------------------------------------------|-------------------|-------------|----------------|---------------------------------------------| | personal identity and authentication | C.2.8.9 | moderate | moderate | moderate | N/A | | access to care | D.14.1 | low | moderate | low | N/A | | Overall Rating | Overall Rating | moderate | moderate | moderate | N/A | After identifying the information categories, one may determine the security objectives. Security objectives use a scale of low, medium, and high. FIPS 199 provides guidance in applying security categorization (SC). This practice guide identifies two information types: personal identity and authentication, as well as access to care. RPM ʼ s SC may be expressed as {( confidentiality, MODERATE), ( integrity, MODERATE), ( availability, MODERATE)} [29]. The SC provides a base guide for security controls selection.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: nist sp, fips, security control. General security reference material without sensitive content. Source: Securing Telehealth Remote Patient Monitoring Ecosystem.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control AT-1 in Building a Cybersecurity and Privacy Learning Program? (Part 56) Control AT-1: ith privileged access; reviewing these issues with the offices of the CIO, CISO, and/or CPO; and aligning learning goals for these risks to the available budget for impacted personnel and departments. Evaluating organizational policies, program reviews, internal audits, self-assessments, and spot-checks can also help CPLP managers identify additional topics to address. ## 4.1.4. Developing New Materials for Those With Significant Cybersecurity and/or Privacy Responsibilities The customized and individualized nature of ongoing skills development and training for personnel with significant cybersecurity and/or privacy responsibilities requires a more detailed and nuanced learning program approach. For example, multiple requirements documents may be needed to develop new learning program elements and identify training that will satisfy learning objectives. The CPLP manager should partner and coordinate these efforts with the organization's human capital office, CLO, training and curriculum developers, and the individual managers and supervisors for the personnel in this learning program audience segment. CPLP managers should ensure that the complexity of the training is commensurate with the role and needs of the people who will undergo the learning effort. Cybersecurity and privacy role-based training materials can be developed at a beginning level for a person who is just learning a discipline. Materials can be developed at an intermediate level for someone who has more experience and, therefore, more responsibility in their workplace. Advanced materials can be developed for agency SMEs whose jobs incorporate the highest level of trust and an accompanying high level of cybersecurity or privacy responsibilities. ## 4.1.5. Acquiring Learning Materials From External Sources CPLP managers should evaluate available materials from a variety of external sources, including federal programs and repositories, industry vendors, and academic institutions.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control, assessment. General security reference material without sensitive content. Source: Building a Cybersecurity and Privacy Learning Program.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171 provide? (Section 48) - 3.9.1e Conduct [ Assignment: organization-defined enhanced personnel screening ] for individuals and reassess individual positions and access to CUI [ Assignment: organization-defined frequency ]. Personnel security is the discipline that provides a trusted workforce based on an evaluation or assessment of conduct, integrity, judgment, loyalty, reliability, and stability. The extent of the vetting is commensurate with the level of risk that individuals could bring about by their position and access to CUI. For individuals accessing Federal Government facilities and systems, the Federal Government employs resources, information, and technology in its vetting processes to ensure a trusted workforce. These screening processes may be extended all or in part to persons accessing federal information, including CUI that is resident in nonfederal systems and organizations through \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ contractual vehicles or other agreements established between federal agencies and nonfederal organizations. Examples of enhanced personnel screening for security purposes include additional background checks. Personnel reassessment activities reflect applicable laws, executive orders, directives, policies, regulations, and specific criteria established for the level of access required for assigned positions. Damage-Limiting Operations. See [SP 800-160-2]: [ Preclude (Expunge); Impede (Exert)]. If adverse information develops or is obtained about an individual with access to CUI which calls into question whether the individual should have continued access to systems containing CUI, actions are taken (e.g., preclude or limit further access by the individual, audit actions taken by the individual) to protect the CUI while the adverse information is resolved. Damage-Limiting Operations.

Explanation: NIST publication discussing classified information handling. References: classified, controlled unclassified, cui. Contains guidance on protecting sensitive government information. Source: Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain 5.2.7 PR.AC-7: Users, devices, and other assets are authenticated (e.g., singlefactor, multifactor) commensurate with the risk of the transaction (e.g., individuals' security and privacy risks and other organizational risks) according to NIST Securing Property Management Systems According to Securing Property Management Systems, 5.2.7 PR.AC-7: Users, devices, and other assets are authenticated (e.g., singlefactor, multifactor) commensurate with the risk of the transaction (e.g., individuals' security and privacy risks and other organizational risks): Authentication that is commensurate with the risk of the transaction is an intrinsic part of the example implementation. Transactions/users/systems/applications are authenticated based upon the level of risk. Based upon configured policies, the access control platform, TDi ConsoleWorks 5.2-0u1, determines what level of authentication is required for a particular request as determined by the risk level associated.

Explanation: NIST publication on credential and access management. Topics: access control, authentication, sso. Contains security framework guidance for authentication systems. Source: Securing Property Management Systems.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is Discussion according to IoT Device Cybersecurity Guidance for the Federal Government_ IoT Device Cybersecurity Requirement Catalog? Discussion: Data backups must be made to support IoT device customers' organizational requirements and as required by each organization's applicable laws, executive orders, directives, regulations, or other legal requirements regarding specific categories of information (e.g., personal health information). Manufacturers can provide education explaining and/or demonstrating how to back-up the data collected, derived from, stored, transmitted and/or processed by the IoT device, in addition to the IoT device system-level information including, if applicable, system state information, operating system software, middleware, application software, and licenses.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: IoT Device Cybersecurity Guidance for the Federal Government_ IoT Device Cybersecurity Requirement Catalog.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Automation Support for Security Control Assessments_ Software Asset Management say about Determination Statement 1? According to Automation Support for Security Control Assessments_ Software Asset Management, Determination Statement 1: | Determination Statement ID | Determination Statement Text | |------------------------------|----------------------------------------------------------------------------------------------------------------------------| | CM-11(b){1} | Determine if the organization: enforces software installation policies through [Assignment: organization-defined methods]. |

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control, assessment. General security reference material without sensitive content. Source: Automation Support for Security Control Assessments_ Software Asset Management.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control AU-09(07) in Assessing Security and Privacy Controls in Information Systems and Organizations? Control AU-09(07): PROTECTION OF AUDIT INFORMATION | STORE ON COMPONENT WITH DIFFERENT OPERATING SYSTEM ASSESSMENT OBJECTIVE: Determine if:

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control, assessment. General security reference material without sensitive content. Source: Assessing Security and Privacy Controls in Information Systems and Organizations.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Interagency Report on the Status of International Cybersecurity Standardization for the Internet of Things (IoT) provide? (Section 366) Food and Drug Administration | | FDIS | Final Draft International Standard | | FIDO | Fast Identity Online | | FIPS | Federal Information Processing Standard | | GCMP | Galois/Counter Mode Protocol | | GSMA | Groupe Speciale Mobile Association | | GW | Gateway | | EHR | Electronic Health Records | | HIPAA | Health Insurance Portability and Accountability Act of 1996 | | HIT | Health Information Technology | | HITRUST | Health Information Trust Alliance | | HL7 | Health Level 7 | | HTTP | Hypertext Transfer Protocol | | HVAC | Heating, Ventilation, and Air Conditioning | | IACS | Industrial Automation and Control Systems | | ICS | Industrial Control Systems | ICT Information and Communications Technology IDMEF Intrusion Detection Message Exchange Format IEC International Electrotechnical Commission IEEE Institute of Electrical and Electronics Engineers IETF Internet Engineering Task Force IICSWG Interagency International Cybersecurity Standardization Working Group IIC Industrial Internet Consortium IODEF Incident Object Description Exchange Format IoT Internet of Things IPv6 Internet Protocol version 6 ISA International Society of Automation ISMS Information Security Management Systems ISO International Organization for Standardization IT Information Technology ITS JPO Intelligent Transportation System Joint Program Office

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Interagency Report on the Status of International Cybersecurity Standardization for the Internet of Things (IoT).


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is Description according to IoT Device Cybersecurity Guidance for the Federal Government_ IoT Device Cybersecurity Requirement Catalog? Description: Ability to establish controls for the connections made to the IoT device.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is https according to Recommendations for Key-Encapsulation Mechanisms? https: //doi.org/10.6028/NIST.SP.800-108r1-upd1

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Recommendations for Key-Encapsulation Mechanisms.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Recommendation for Stateful Hash-Based Signature Schemes say about 9.3 Revocation? (Part 3) According to Recommendation for Stateful Hash-Based Signature Schemes, 9.3 Revocation: | | [8] | McGrew D, Kampanakis P, Fluhrer S, Gazdag S, Butin D, Buchmann J (2016) State Management for Hash-Based Signatures. Cryptology ePrint Archive , Report 2016/357. https://eprint.iacr.org/2016/357.pdf | |-------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | [9] | Genêt A, Kannwischer MJ, Pelletier H, McLauchlan A (2018) Practical Fault Injection Attacks on SPHINCS. Cryptology ePrint Archive , Report 2018/674. https://eprint.iacr.org/2018/674 | | [10] | Castelnovi L, Martinelli A, Prest T (2018) Grafting trees: A fault attack against the SPHINCS framework. Post-Quantum Cryptography - 9th International Conference (PQCrypto 2018) , Lecture Notes in Computer Science 10786, pp 165-184. https://doi.org/10.1007/978-3-319-79063-3_8 | | [11] | Fluhrer S (2017) Further Analysis of a Proposed Hash-Based Signature Standard . Cryptology ePrint Archive , Report 2017/553. https://eprint.iacr.org/2017/553.pdf | | [12] | Buchmann J, Dahmen E, Hulsing A (2011) XMSS - A Practical Forward Secure Signature Scheme based on Minimal Security Assumptions . Cryptology ePrint Archive , Report 2011/484. https://eprint.iacr.org/2011/484.pdf | | [13] | Bruinderink LG, Hülsing A (2016) 'Oops, I did it again' - Security of One- Time Signatures under Two-Message Attacks. Cryptology ePrint Archive , Report 2016/1042.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Recommendation for Stateful Hash-Based Signature Schemes.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does 2016 NIST_ITL Cybersecurity Program Annual Report say about NISTIR 8074 (2 volumes)? According to 2016 NIST_ITL Cybersecurity Program Annual Report, NISTIR 8074 (2 volumes): Volume 1: Report on Strategic U.S. Government Engagement in International Standardization to Achieve U.S. Objectives for Cybersecurity

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: 2016 NIST_ITL Cybersecurity Program Annual Report.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control CM-7 in Trusted Cloud_ Security Practice Guide for VMware Hybrid Cloud Infrastructure as a Service (IaaS) Environments? (Part 150) Control CM-7: nected to the ESXi host run the following command: Get-VMHost | Get-AdvancedSetting -Name Syslog.global.logHost If Syslog.global.logHost is not set to a site-specific syslog server, this is a finding. | udp://sfo01vrli01.s fo01.rainpole.lo- cal:514 | | CCE- 8447 0-4 | NIST800 53-VI- ESXi- CFG- 00165 | Built-in | ESXi | From a PowerCLI command prompt, while connected to the ESXi host run the following command: Get-VMHost | Get-AdvancedSetting -Name Security.AccountUnlockTime If Security.AccountUnlockTime is not set to 900, this is a finding. | 900 | | CCE- 8447 1-2 | NIST800 53-VI- ESXi- CFG- 00166 | Built-in | ESXi | From a PowerCLI command prompt, while connected to the ESXi host run the following command: Get-VMHost | Get-AdvancedSetting -Name Config.HostAgent.plugins.solo.enableMob If Config.HostAgent.plugins.solo.enableMob is not set to false, this is a finding. | FALSE | | CCE- 8447 2-0 | NIST800 53-VI- ESXi- CFG- 00167 | Built-in | ESXi | From a PowerCLI command prompt, while connected to the ESXi host run the following command: Get-VMHost | Get-AdvancedSetting -Name Config.HostAgent.plugins.hostsvc.esxAdminsGroup For systems that do not use Active Directory and have no local user accounts, other than root, dcui, and/or vpxuser, this is not applicable.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Trusted Cloud_ Security Practice Guide for VMware Hybrid Cloud Infrastructure as a Service (IaaS) Environments.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Stateless Hash-Based Digital Signature Standard say about 3.1 Additional Requirements? (Part 1) According to Stateless Hash-Based Digital Signature Standard, 3.1 Additional Requirements: 3.1 Additional Requirements This section specifies requirements for cryptographic modules that implement SLH-DSA. Section 3.2 discusses issues that implementers of cryptographic modules should take into consideration but that are not requirements. SP 800-89, Recommendation for Obtaining Assurances for Digital Signature Applications [3], specifies requirements that apply to the use of digital signature schemes. Randomness generation. SLH-DSA key generation (Algorithm 21) requires the generation of three random 𝑛 -byte values: PK .seed, SK .seed, and SK .prf, where 𝑛 is 16, 24, or 32, depending on the parameter set. For each invocation of key generation, each of these values shall be a fresh (i.e., not previously used) random value generated using an approved random bit generator (RBG), as prescribed in SP 800-90A, SP 800-90B, and SP 800-90C [14, 15, 16]. Moreover, the RBG used shall have a security strength of at least 8𝑛 bits. See Table 2 for the value of 𝑛 for each parameter set. Destruction of sensitive data. Data used internally by key generation and signing algorithms in intermediate computation steps could be used by an adversary to gain information about the private key and thereby compromise security. The data used internally by verification algorithms is similarly sensitive for some applications, including the verification of signatures that are used as bearer tokens (i.e., authentication secrets) or signatures on plaintext messages that are intended to be confidential. Intermediate values of the verification algorithm may reveal information about its inputs (i.e., the message, signature, and public key), and in some applications, security or privacy requires one or more of these inputs to be confidential. Therefore, implementations of SLH-DSA shall ensure that any local copies of the inputs and any potentially sensitive intermediate data are destroyed as soon as they are no longer needed. Key checks.

Explanation: NIST publication on credential and access management. Topics: authentication, token. Contains security framework guidance for authentication systems. Source: Stateless Hash-Based Digital Signature Standard.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain 3.2.5.3 ArcSight Content according to NIST Situational Awareness for Electric Utilities According to Situational Awareness for Electric Utilities, 3.2.5.3 ArcSight Content: - Filter for any of the following: - ArcSight Category events: - /Modify/Configuration - /Found/Misconfigured - tftp protocol - tftp port - Filter for following ArcSight Category Device Groups: - /Firewall - /Network Equipment - /VPN - /IDS - or Category Object: - /Network - Data Monitor and Dashboard to display results of the above

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Situational Awareness for Electric Utilities.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain that are addressed are: according to NIST Technology Assessment_ Methods for Measuring the Level of Computer Security According to Technology Assessment_ Methods for Measuring the Level of Computer Security, that are addressed are:: internal audit administrative security physical security standards processing security operating system security software security data base security communications security applications security Each of these ten areas has then been broken out into a comprehensive set of four to seven subtopics. The questionnaires (checklists) developed in DPSE address numerous relevant questions in each of the subtopic areas.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control, assessment. General security reference material without sensitive content. Source: Technology Assessment_ Methods for Measuring the Level of Computer Security.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Guide for Mapping Types of Information and Information Systems to Security Categories_ Appendices say about Availability? According to Guide for Mapping Types of Information and Information Systems to Security Categories_ Appendices, Availability: The availability impact level is based on the specific mission and the data supporting that mission, not on the time required to re-establish access to subsidies information. Subsidies processes are generally tolerant of delay. In most cases, disruption of access to subsidies information can be expected to have only a limited adverse effect on agency operations, agency assets, or individuals. Recommended Availability Impact Level: The provisional availability impact level recommended for subsidies information is low .

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Guide for Mapping Types of Information and Information Systems to Security Categories_ Appendices.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control HA-3 in Computer Security Division 2012 Annual Report? (Part 237) Control HA-3: Exchange Formats Framework (CBEFF) specifieGLYPH(cmap:df00) in national anGLYPH(cmap:df00) international stanGLYPH(cmap:df00)arGLYPH(cmap:df00)s is also proviGLYPH(cmap:df00)eGLYPH(cmap:df00). BioCTS 2012 for ANSI/NIST-ITL 1-2011 is currently designed to support testing of implementations that include any of the RecorGLYPH(cmap:df00) T ypes GLYPH(cmap:df00)efineGLYPH(cmap:df00) in AN-2011, but conformance testing is only performed for the selected Record Types (1, 4, 10, 13, 14, 15, anGLYPH(cmap:df00) 17). Plans exist to extend the test tool to support additional Record Types. Information regarGLYPH(cmap:df00)ing BioCTS 2012 testing architectures, coGLYPH(cmap:df00)e structure, anGLYPH(cmap:df00) other software design details is provided. ## Contacts: Mr. Fernando Podio fernanGLYPH(cmap:df00)o.poGLYPH(cmap:df00)io@nist.gov Mr. Dylan Yaga GLYPH(cmap:df00)ylan.yaga@nist.gov ## NISTIR 7874 , Guidelines for Access Control System Evaluation Metrics Nearly all applications include some form of access control (AC). AC is concerneGLYPH(cmap:df00) with GLYPH(cmap:df00)etermining the alloweGLYPH(cmap:df00) activities of legitimate users, meGLYPH(cmap:df00)iating every attempt by a user to access a resource in the system. AC systems come with a wiGLYPH(cmap:df00)e variety of features anGLYPH(cmap:df00) administrative capabilities, and their operational impact can be significant. In particular , this impact can pertain to administrative and user productivity, as well as to the organization's ability to perform its mission. Therefore, it is reasonable to use quality metrics to verify the mechanical properties of AC systems. This document discusses the administration, enforcement, performance, and support properties of AC mechanisms that are embedded in each AC system.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Computer Security Division 2012 Annual Report.