You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Conformance Test Architecture and Test Suite for ANSI_NIST-ITL 1-2007 say about Table of Contents? (Part 2) According to Conformance Test Architecture and Test Suite for ANSI_NIST-ITL 1-2007, Table of Contents: | Introduction....................................................................................................................1 | Introduction....................................................................................................................1 | |--------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------| | 1.1 | Background...............................................................................................................1 | | 1.2 | Need for Conformance Testing to Biometric Standards...........................................1 | | 1.3 | Support for the ANSI/NIST- ITL 1-2007 Standard....................................................2 | | 1.4 | Requirements in the Standard and Conformance Test Assertions ..........................2 | | 1.5 | Hierarchy of Conformance Tests..............................................................................3 | | 1.6 | Target Audience .......................................................................................................4 | | 2 CTA/CTS Overview ........................................................................................................5 | 2 CTA/CTS Overview ........................................................................................................5 | | 2.1 | High-Level Architecture ............................................................................................5 | | 2.2 | Software Details........................................................................................................6 | | 3 Quick Start......................................................................................................................7 | 3 Quick Start......................................................................................................................7 | | 3.1 | Installation.................................................................................................................7 | | 3.2 | Loading and Running Implementations ....................................................................8 | | 4 Test Results .................................................................................................................10 | 4 Test Results .................................................................................................................10 | | 4.1 | Overall Results........................................................................................................10 | | 4.2 | Detailed Results......................................................................................................10 | | Annex A - Code Structure..................................................................................................16 | Annex A - Code Structure..................................................................................................16 | | Annex B - References ........................................................................................................19 | Annex B - References ........................................................................................................19 | | Annex C - Standard Requirements and Conformance Test Assertions .......................20 | Annex C - Standard Requirements and Conformance Test Assert

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Conformance Test Architecture and Test Suite for ANSI_NIST-ITL 1-2007.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Secure Data Network Systems (SDNS) Key Management Documents provide? (Section 103) SREKEYcnf MSTR_SRKEY | | | | | SREKEYcnf- MSTR_SRKEY | IDLE | | MSTR_SRKEY | | | SRKRQ (note 1) WF_SRKRS | | CRRQ WF_CRRS | | SRDRQ (note 1) WF_SRDRS | | | IDLE | | WF_NKRS | | EXCcnf + MSTR SRKEY | | | | | | | | IDLE | | DOSSV yisiAi | NKRQ | WF_NKR5 | | | | | | | | IDLE | | IDLE | MSTR_ASSOC | | | | | | | | | IDLE | | | ASSOCJNIT | EXCreq NKRS | SREKEYreq | SRKRS | CRLreq | CRRS | SDLIVRreq | SRDRS | ESTAT | ASSOC_TER | Note 1 -See SDN.

Explanation: NIST publication on credential and access management. Topics: key management, sso. Contains security framework guidance for authentication systems. Source: Secure Data Network Systems (SDNS) Key Management Documents.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control PM-8200 in Cell Phone Forensic Tools_ an Overview and Analysis? (Part 182) Control PM-8200: and LOCIGPRS data was found and reported, but had to be manually decoded for interpretation. (Meet) EMS Data: Active/deleted incoming EMS Messages that exceed 160 characters were found and reported. An EMS message containing an embedded picture was found, but neither the text nor the image were correctly decoded and presented. (Below) Foreign Language Data: SMS messages containing French language characters were found and reported correctly, but French language ADN entries were presented incorrectly in both the user interface and the HTML generated report. SMS messages containing Japanese language characters were found, but reported incorrectly in the user interface and the generated HTML report. The Japanese language ADN entries were presented correctly in the HTML report, but not in the user interface. (Below) ## SIM 8778 The scenarios above were conducted using a Cingular SIM. The attempt to acquire the Cingular SIM 8778 was unsuccessful. The error thrown reported: 'In this SIM card this type of directory not present.' (MISS) ## SIM 1144 The following scenarios were conducted using an AT&T SIM. Service Provider Name (SPN) was not allocated. No FPLMN entries were registered. Basic Data: The following data was found and reported: IMSI, ICCID, Language Preference (LP), Abbreviated Dialing Numbers (ADN), Last Numbers Dialed (LND) and active/deleted SMS messages. However, long ADN text entries were truncated by one character in the Data view, but not the Binary data view. (Meet) Location Data: All LOCI and LOCIGPRS data was found and reported, but had to be manually decoded for interpretation. (Meet) EMS Data: Active/deleted incoming EMS Messages that exceed 160 characters were found and reported. An EMS message containing an embedded picture was found, but neither the text nor the image were correctly decoded and presented.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Cell Phone Forensic Tools_ an Overview and Analysis.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Attribute-based Access Control for Microservices-based Applications using a Service Mesh say about 4 Authentication and Authorization Policy Configuration in Service Mesh? According to Attribute-based Access Control for Microservices-based Applications using a Service Mesh, 4 Authentication and Authorization Policy Configuration in Service Mesh: Fine-grained access control for microservices can be enforced through the configuration of authentication and access control policies. These policies are defined in the control plane of the service mesh, mapped into low-level configurations, and pushed into the sidecar proxies that form the data plane of the service mesh. The configurations enable the proxies to enforce the policies at application runtime (or request time), thus making the proxies act as Policy Enforcement Points (PEPs). As stated in the introduction, the objective of this document is to provide guidance for the deployment of an authentication and authorization framework that is external to the application and agnostic to the platform hosting the application and the service mesh product that implements the application infrastructure. However, Kubernetes is used as the reference application platform and Istio as the service mesh infrastructure platform to provide concrete examples of the concepts and to allow for recommendations with more clarity and specificity.

Explanation: NIST publication on credential and access management. Topics: access control, authentication, authorization. Contains security framework guidance for authentication systems. Source: Attribute-based Access Control for Microservices-based Applications using a Service Mesh.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain Media Protection according to NIST Cybersecurity Framework Manufacturing Profile Low Impact Level Example Implementations Guide_ Volume 1 – General Implementation Guidance According to Cybersecurity Framework Manufacturing Profile Low Impact Level Example Implementations Guide_ Volume 1 – General Implementation Guidance, Media Protection: Media protection solutions enable a manufacturer to restrict the use of portable media within the manufacturing system.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: cybersecurity framework, fips, security control. General security reference material without sensitive content. Source: Cybersecurity Framework Manufacturing Profile Low Impact Level Example Implementations Guide_ Volume 1 – General Implementation Guidance.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Guidelines for Smart Grid Cybersecurity provide? (Section 816) device Uses closed-loop or advisory methods to isolate the faulted segment Once the fault is isolated, it determines how best to restore service to unfaulted segments through feeder reconfiguration. Smart Grid Characteristics  Provides power quality  Optimizes asset utilization  Anticipates and responds to system disturbances Cybersecurity Objectives/Requirements  Integrity of outage information is critical  Availability to detect large-scale outages usually involve multiple sources of information  Confidentiality is not very important Potential Stakeholder Issues  Customer safety  Customer device standards  Demand response acceptance by customers 111 Category: Distribution Automation Overall Use Case #26 Scenario: Load Management Category Description A broad definition of “distribution automation” includes any automation that is used in the planning, engineering, construction, operation, and maintenance of the distribution power system, including interactions with the transmission system, interconnected distributed energy resources, and automated interfaces with end-users. No one approach is optimal for a utility or its customers. Certain distribution automation functions, such as optimal volt/VAR control, can be more beneficial to one utility or even a few feeders in one utility, while other distribution automation functions, such as fault detection, isolation, and service restoration, could be far more beneficial in other utilities. Increasingly, distribution automation will entail closed-loop control, where distribution algorithms, applied to real-time models of the distribution system, will increase reliability and/or efficiency of the distribution system without direct operator involvement.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Guidelines for Smart Grid Cybersecurity.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain https:/ /doi.org/10.1145/2809826.2809834 according to NIST 2016 NIST_ITL Cybersecurity Program Annual Report According to 2016 NIST_ITL Cybersecurity Program Annual Report, https:/ /doi.org/10.1145/2809826.2809834: Cyber attacks inevitably have negative impacts on relevant missions. However, concrete methods to accurately evaluate such impacts are rare. In this paper, we propose a probabilistic approach based on Bayesian networks for quantitative mission impact assessment. A System Object Dependency Graph (SODG) is first built to capture the intrusion propagation process at the low operating system level. On top of the SODG, a mission-task-asset (MTA) map can be established to associate the system objects with corresponding tasks and missions. Based on the MTA map, a Bayesian network can be constructed to leverage the collected intrusion evidence and infer the probabilities of tasks and missions being tainted. This approach is promising for effective quantitative mission impact assessment. <!-- image -->

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control, assessment. General security reference material without sensitive content. Source: 2016 NIST_ITL Cybersecurity Program Annual Report.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control AM-1 in Improving Enterprise Patching for General IT Systems_ Utilizing Existing Tools and Performing Processes in Better Ways? (Part 48) Control AM-1: 2 | Does the platform monitor the security and vulnerabilities associated with all software and dependencies used? | There is an audit trail of users who have logged in and the actions they performed. Updates are also sent out to help remediate software running on the platform. | | | SM 4.3 | Is anti-malware or antivirus able to be installed on the system running your platform? | Eclypsium scanners and the Eclypsium backend are compatible with running other endpoint security software on the same device. | | | SM 4.4 | Does the platform allow for logging connection events to the tool? | In cloud deployments, Eclypsium manages network security protections. In an on- premises deployment, this would be inherited from the environment into which Eclypsium is deployed. | | | SM 4.5 | Are there training courses or procedures in the event of an incident involving the tool or platform? | Eclypsium security operations personnel receive security and incident response training. Customer training is available from Eclypsium to cover firmware security and incident response scenarios. | | | SM 5.1 | Are there training courses in how to use the products? Are there different courses for different roles? | Eclypsium has the latest training catalog. | | | SM 5.2 | Are there training courses for teaching administrators how to utilize the platform? | Eclypsium has the latest training catalog. | | | SM 5.3 | Are trainings updated and metrics collected to improve trainings? | Eclypsium has the latest training catalog. | | ## A.2.4 Forescout Platform Support of Security Measures | SM # | Question | Technical Mechanism or Configuration | Refs.

Explanation: NIST cybersecurity publication covering vulnerability management. Topics: malware, incident response. Contains technical security guidance that could inform defensive posture. Source: Improving Enterprise Patching for General IT Systems_ Utilizing Existing Tools and Performing Processes in Better Ways.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is Issuer according to NIST Test Personal Identity Verification (PIV) Cards Version 2? Issuer: CN=Test ECC P-256 CA for Test PIV Cards v2, ou=Test CA, o=Test Certificates 2020, c=US

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: NIST Test Personal Identity Verification (PIV) Cards Version 2.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Information Security Handbook_ A Guide for Managers provide? (Section 128) gure 5-6 plots system category along the vertical axis and corrective action impact along the horizontal axis. The notional agency systems are denoted as the small letters at the top of each quadrant. In this example, systems 'N' and 'F' were found to have category rankings of 'high' and corrective action impacts of 'great.' 41 Figures 4-6 and 4-8 on pages 31 and 34 (respectively) in NIST SP 800-65 provide examples of how spreadsheets can be used to facilitate the prioritization process. Figure 5-6. Joint Prioritization with Costs <!-- image --> Drawn from the perspective of the enterprise, Figure 5-6 plots agencydetermined security controls importance along the vertical axis and corrective action impact along the horizontal axis. The numbers (1-17) represent the seventeen NIST SP 800-53 security control areas used for this example. Security control area 12 ranked 'high' in importance but had a 'basic' corrective action impact. The dollar figures in Figure 5-6 represent the total cost to implement all corrective actions within that cell. For example, looking at cell HG, it would cost the agency $85,961 to implement corrective actions for systems 'N' and 'F' and topic area '4.' After plotting all of its systems, the agency should perform executive validation of the placement of the various systems to ensure that stakeholders' priorities are met. Agency information security stakeholders should review the prioritization results to ensure that the prioritization is appropriate and given the opportunity to reprioritize their inputs if the results of the process are found to be unsatisfactory. Assuming the agency stakeholders agree that all prioritized corrective actions are appropriate, as displayed in Figure 5-6, the analysis can proceed accordingly.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: nist sp, fips, security control. General security reference material without sensitive content. Source: Information Security Handbook_ A Guide for Managers.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Guidelines for the Use of PIV Credentials in Facility Access say about 2.4 Infrastructure Requirements? According to Guidelines for the Use of PIV Credentials in Facility Access, 2.4 Infrastructure Requirements: The qualities and benefits of the complete PIV System can only be achieved if its implementation is supported by bi-directional communications infrastructure used in modern PACS. The following areas have significant influence on the rate at which the complete PIV System integration can be achieved by PACS, and should therefore be supported by PACS upgrades and new PACS procurements: 1. Fast network or two-way serial communication among PACS readers and controllers, panels and head-end components. 2. Fast network communication for PIV status and validation services. Point (1) allows the PACS to quickly issue commands to cards and receive responses while Point (2) allows direct access to PIV status and validation services, if needed.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Guidelines for the Use of PIV Credentials in Facility Access.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain Appendix B - NVD Scoring Methodology according to NIST CVSS Implementation Guidance According to CVSS Implementation Guidance, Appendix B - NVD Scoring Methodology: This appendix describes the process NVD uses to collect, analyze, and score vulnerabilities in accordance with the CVSS. An overview of the CVSS is provided within section 2. Version 2.0 of the CVSS was first established as the vulnerability scoring system used by SCAP in specification version 1.0 [2] and has been used as primary guidance by the NVD since September 2007. Vulnerabilities scored prior to September 2007 used version 1.0 of the CVSS and were approximated to version 2.0's metrics without human analysis and are noted as 'incomplete approximation' in the description.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: CVSS Implementation Guidance.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Recommendation for Pair-Wise Key-Establishment Using Integer Factorization Cryptography say about 6.4.1.5 Owner Assurance of Private-Key Possession? (Part 2) According to Recommendation for Pair-Wise Key-Establishment Using Integer Factorization Cryptography, 6.4.1.5 Owner Assurance of Private-Key Possession: te key corresponding to PubKeyU , where PubKeyV and PubKeyU are the public keys associated with parties V and U, respectively, that were used during that KAS2-Party\_V-confirmation transaction. 4. -The KAS2-Party\_U-confirmation scheme in Section 8.3.3.3 can be used to provide assurance to a key-pair owner, acting as party V, that both parties are in possession of the correct private key; i.e., when the key confirmation is successful, party V has obtained assurance that party U possesses the private key corresponding to PubKeyU and that party V possesses the private key corresponding to PubKeyV , where PubKeyU and PubKeyV are the public keys associated with parties U and V, respectively, that were used during that KAS2-Party\_U-confirmation transaction. 5. -The KAS2-bilateral-confirmation scheme in Section 8.3.3.4 can be used to provide assurance to a key-pair owner acting as either party U or party V that both parties are in possession of the correct private key; i.e., when the bilateral key-confirmation is successful, each party has obtained assurance that party U possesses the private key corresponding to PubKeyU , and that party V possesses the private key corresponding to PubKeyV , where PubKeyU and PubKeyV are the public keys associated with parties U and V, respectively, that were used during that KAS2-bilateral-confirmation transaction.' 3. The owner receives assurance via an encrypted certificate - The key-pair owner uses the private key while engaging in a key-establishment transaction with a Certificate Authority (trusted by the owner) using a scheme in this Recommendation after providing the CA with the corresponding public key. As part of this transaction, the CA generates a (new) certificate containing the owner's public key and encrypts that certificate using (some portion of) the symmetric keying material that has been established. Only the encrypted form of the certificate is provided to the owner.

Explanation: NIST publication on credential and access management. Topics: certificate authority, sso. Contains security framework guidance for authentication systems. Source: Recommendation for Pair-Wise Key-Establishment Using Integer Factorization Cryptography.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Guidelines for the Authorization of Personal Identity Verification Card Issuers (PCI) and Derived PIV Credential Issuers (DPCI) say about 2.5 Authorization Boundary of the Issuer? (Part 1) According to Guidelines for the Authorization of Personal Identity Verification Card Issuers (PCI) and Derived PIV Credential Issuers (DPCI), 2.5 Authorization Boundary of the Issuer: 2.5 Authorization Boundary of the Issuer The first step in authorizing an issuer is to identify the appropriate authorization boundary. The authorization boundary defines the specific operations that are to be the target of the assessment and authorization. A PCI comprises the complete set of functions required for the issuance and maintenance of PIV Cards while a DPCI comprises of the complete set of functions required for the issuance and maintenance of Derived PIV Credentials. In determining the authorization boundary, the organization must consider if the functions are being performed identically in all issuing facilities, are using identical information technology components, and are under the same direct management control. For instance, an organization may have two sub-organizations, each of which has distinct processes and management structures. The organization may decide to establish two separate issuers, each with its own authorization boundary. In this example, two separate assessments would be undertaken. Each assessment would result in an independent authorization decision. In drawing an authorization boundary, an organization may want to include only a subset of its issuing facilities. For example, if a PCI has several facilities, some of which are ready for operation and some that are still in the development stage, the organization may choose to define the authorization boundary to include the PCI and only those facilities that are ready to be assessed. If the authorization is successful, the PCI and a subset of its issuing facilities will be authorized to operate and begin issuing PIV Cards. The remaining issuing facilities can continue with implementation and be included in the authorization boundary at a later date.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control, assessment. General security reference material without sensitive content. Source: Guidelines for the Authorization of Personal Identity Verification Card Issuers (PCI) and Derived PIV Credential Issuers (DPCI).


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Mobile Device Security_ Corporate-Owned Personally-Enabled (COPE) say about Time Frame Supported:? According to Mobile Device Security_ Corporate-Owned Personally-Enabled (COPE), Time Frame Supported:: Because this was the first risk assessment performed by Orvilia, the process was more time-intensive than it will be in future risk management cycles. Orvilia completed the initial risk assessment within six months.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control, assessment. General security reference material without sensitive content. Source: Mobile Device Security_ Corporate-Owned Personally-Enabled (COPE).


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain D.5 Address Holder Environments according to NIST Protecting the Integrity of Internet Routing_ Border Gateway Protocol (BGP) Route Origin Validation According to Protecting the Integrity of Internet Routing_ Border Gateway Protocol (BGP) Route Origin Validation, D.5 Address Holder Environments: It is assumed that address holders understand the usage of RPKI resources and have agreements in place with a Regional Internet Registry (RIR) or other authority that enables route origin authorizations (ROAs) for addresses that they hold to be created and signed. The address holder has two options for creating the ROAs: the hosted or delegated model.

Explanation: NIST publication on credential and access management. Topics: authorization, pki. Contains security framework guidance for authentication systems. Source: Protecting the Integrity of Internet Routing_ Border Gateway Protocol (BGP) Route Origin Validation.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is Misnamed Files according to Cell Phone Forensic Tools_ an Overview and Analysis? Misnamed Files: Misnamed files (e.g., . txt file renamed with a . dll extension) were found and reported in the Files folder and could be viewed with the proper application after saved to the forensic workstation. (Meet)


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain Contact: according to NIST Computer Security Division 2013 Annual Report According to Computer Security Division 2013 Annual Report, Contact:: Mr. David Waltermire (301) 975-3390 david.waltermire@nist.gov

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Computer Security Division 2013 Annual Report.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control AC-06(05) in Assessing Security Requirements for Controlled Unclassified Information? (Part 104) Control AC-06(05): Strategies, Tools, and Methods ## ASSESSMENT OBJECTIVE ## Determine if: A.03.17.02[01]: acquisition strategies, contract tools, and procurement methods are developed to identify supply chain risks. A.03.17.02[02]: acquisition strategies, contract tools, and procurement methods are developed to protect against supply chain risks. A.03.17.02[03]: acquisition strategies, contract tools, and procurement methods are developed to mitigate supply chain risks. A.03.17.02[04]: acquisition strategies, contract tools, and procurement methods are implemented to identify supply chain risks. A.03.17.02[05]: acquisition strategies, contract tools, and procurement methods are implemented to protect against supply chain risks. A.03.17.02[06]: acquisition strategies, contract tools, and procurement methods are implemented to mitigate supply chain risks.

Explanation: NIST publication discussing classified information handling. References: classified, controlled unclassified. Contains guidance on protecting sensitive government information. Source: Assessing Security Requirements for Controlled Unclassified Information.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain Rodney Petersen | 2016 Government Leadership of the Year according to NIST 2017 NIST_ITL Cybersecurity Program Annual Report According to 2017 NIST_ITL Cybersecurity Program Annual Report, Rodney Petersen | 2016 Government Leadership of the Year: Awarding Organization: The Colloquium for Information Systems Security Education (CISSE) <!-- image --> Rodney Petersen is the director of the National Initiative for Cybersecurity Education (NICE) at the National Institute of Standards and Technology (NIST). He previously served as the Managing Director of the EDUCAUSE Washington Office and a Senior Government Relations Officer. He founded and directed the EDUCAUSE Cybersecurity Initiative and was the lead staff liaison for the Higher Education Information Security Council. Prior to joining EDUCAUSE, he worked at two different times for the University of Maryland - first as Campus Compliance Officer in the Office of the President and later as the Director of IT Policy and Planning in the Office of the Vice President and Chief Information Officer. He also completed one year of federal service as an Instructor in the Academy for Community Service for AmeriCorps' National Civilian Community Corps. He is the co-editor of a book entitled 'Computer and Network Security in Higher Education.' He received his law degree from Wake Forest University and bachelors degrees in political science and business administration from Alma College. He was awarded a certificate as an Advanced Graduate Specialist in Education Policy, Planning, and Administration from the University of Maryland. Source: https:/ /cisse.info/about/award-recipients/634-2016-government-leadership-of-the-year-rodney-petersen

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: 2017 NIST_ITL Cybersecurity Program Annual Report.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Cryptographic Key Management Workshop Summary -- June 8-9, 2009 say about 3.4 Usability? (Part 2) According to Cryptographic Key Management Workshop Summary -- June 8-9, 2009, 3.4 Usability: s to know the prospective user and to understand that security is not the primary task of the user. A system must be efficient, effective and understandable; there is no complex system that is secure. - Conventional wisdom is that 'computer security systems can't be effective unless they are complex and difficult to use.' - PKI enrollment is often the most difficult computer task to perform. Usability is more than just the user interface. CKM designers have to adopt the mantra of making it easy for users to do the right thing. Designers have to align the design to the user's conceptual model of a security system. The interface has to use terminology that is intuitively obvious to the general computer user. The complexity of the CKM system has to be minimized for the user if it is to be used effectively. - Certificate pop-ups have to be minimized, because users have become accustomed to ignoring pop-ups. Factors that inhibit the adoption of new technologies have to be eliminated, and those that promote the adoption of effective security technologies have to be encouraged. - Applicable Models: Cryptographic key life cycle (key birth to death management); security analysis; model all system actors and their actions; information management models must be the foundation of key management. - Users of a CKM System are humans, devices, applications, programmers, and administrators. - Design Considerations must include a mix of long-term symmetric and asymmetric keys for some applications, algorithm agility, security parameters, and a desire to keep it simple and keep it cheap. - When the CKM policies, components, and recommended security practices are properly selected from the CKM System Design Framework and combined properly in a CKM system design, we have a well-defined CKM solution. - We would like to see a leap in ease of implementation, management, and use; we have already made significant progress in this area.

Explanation: NIST publication on credential and access management. Topics: pki, key management. Contains security framework guidance for authentication systems. Source: Cryptographic Key Management Workshop Summary -- June 8-9, 2009.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control HA-256 in PIV Data Model Test Guidelines? (Part 65) Control HA-256: Extract Finger View Header fie on ld . a. b. Extract contents of Finger Position c. Extract contents of View Number. . d. Extract contents of Impression Type e. Extract contents of Finger Quality. f. Extract contents of Number of Minutiae. 5.Repeat steps 4a through 4f for the second view header. | |--------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | Expected Result(s) | The expected values for each of the fields parsed in Step 4 above are given below: a. Finger View Header shall have the value 'A' b. Finger Position value shall be between 0 and 14. c. View Number shall be 0 if there is only one minutiae record for a finger. d. Impression Type is 0 or 2. 100. e. Finger Quality value shall be between 60 and een 0 and 128. The expected values for each of the fields parsed in Step 5 is the same as above. f. Number of Minutiae value shall be betw | ## 9.3.3 Fingerprint Minutiae Data | Purpose | Verify that each instance of Fingerprint Minutiae data conforms to specifications in Table 3 of SP80076.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: PIV Data Model Test Guidelines.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain CONTACT: according to NIST 2016 NIST_ITL Cybersecurity Program Annual Report According to 2016 NIST_ITL Cybersecurity Program Annual Report, CONTACT:: Dr. Michaela Iorga (301) 975-8431 michaela.iorga@nist.gov

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: 2016 NIST_ITL Cybersecurity Program Annual Report.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Specification for the Extensible Configuration Checklist Description Format (XCCDF) Version 1.1.4 provide? (Section 163) ement> <xsd:complexType name="valueType"> <xsd:annotation> <xsd:documentation xml:lang="en"> Data type for the Value element, which represents a tailorable string, boolean, or number in the Benchmark. </xsd:documentation> </xsd:annotation> <xsd:complexContent> <xsd:extension base="cdf:itemType"> <xsd:sequence> <xsd:element name="value" type="cdf:selStringType" minOccurs="1" maxOccurs="unbounded"/> <xsd:element name="default" type="cdf:selStringType" minOccurs="0" maxOccurs="unbounded"/> <xsd:element name="match" type="cdf:selStringType" minOccurs="0" maxOccurs="unbounded"/> <xsd:element name="lower-bound" type="cdf:selNumType" minOccurs="0" maxOccurs="unbounded"/> <xsd:element name="upper-bound" type="cdf:selNumType" minOccurs="0" maxOccurs="unbounded"/> <xsd:element name="choices" type="cdf:selChoicesType" minOccurs="0" maxOccurs="unbounded"/> <xsd:element name="source" type="cdf:uriRefType" minOccurs="0" maxOccurs="unbounded"/> <xsd:element name="signature" type="cdf:signatureType" minOccurs="0" maxOccurs="1"/> </xsd:sequence> <xsd:attribute name="type" type="cdf:valueTypeType" default="string" use="optional"/> <xsd:attribute name="operator" type="cdf:valueOperatorType" default="equals" use="optional"/> <xsd:attribute name="interactive" type="xsd:boolean" default="0" use="optional"/> <xsd:attribute name="interfaceHint" use="optional" type="cdf:interfaceHintType"/> </xsd:extension> </xsd:complexContent> </xsd:complexType> <!-- ************************************************************** --> <!-- *************** Value-related Types ************************ --> <!-- ************************************************************** --> <xsd:complexType name="selChoicesType"> <xsd:annotation> <xsd:documentation xml:lang="en"> The choice element specifies a list of legal or suggested choices for a Value object. It holds one or more choice elements, a mustMatch attribute, and a selector attribute.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Specification for the Extensible Configuration Checklist Description Format (XCCDF) Version 1.1.4.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Securing Distributed Energy Resources_ An Example of Industrial Internet of Things Cybersecurity say about 1.2 Solution? According to Securing Distributed Energy Resources_ An Example of Industrial Internet of Things Cybersecurity, 1.2 Solution: The NCCoE collaborated with stakeholders in the electricity sector, UMD, and cybersecurity technology providers to build an environment that represents a distribution utility interconnected with a campus DER microgrid. Within this ecosystem, we explore how information exchanges among DERs and electric distribution grid operations can be protected from certain cybersecurity compromises. The example solution demonstrates the following capabilities: -  communications and data integrity to ensure that information is not modified in transit -  authentication and access control to ensure that only known, authorized systems can exchange information -  command register that maintains an independent, immutable record of information exchanges between distribution grid and DER operators -  malware detection to monitor information exchanges and processing to identify potential malware infections -  behavioral monitoring to detect deviations from operational norms -  analysis and visualization processes to monitor data, identify anomalies, and alert operators The example solution documented in the practice guide uses technologies and security capabilities from our project collaborators. The solution aligns with the security standards and guidelines of the NIST Cybersecurity Framework; NIST Interagency or Internal Report 7628 Revision 1: Guidelines for Smart Grid Cybersecurity [1]; and NIST Special Publication (SP) 1108r4, Framework and Roadmap for Smart Grid Interoperability Standards, Release 4.0 [2].

Explanation: NIST publication on credential and access management. Topics: access control, authentication. Contains security framework guidance for authentication systems. Source: Securing Distributed Energy Resources_ An Example of Industrial Internet of Things Cybersecurity.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Federal Cybersecurity Awareness Programs_ A Mixed Methods Research Study say about 1 Introduction? (Part 2) According to Federal Cybersecurity Awareness Programs_ A Mixed Methods Research Study, 1 Introduction: challenges and recommendations abound, it is currently unknown whether these apply to programs within the U.S. government (federal) sector and if government organizations experience additional issues. To address this gap, NIST completed research to better understand the needs, challenges, practices, and necessary competencies of federal security awareness teams and programs. The research consisted of two phases: eight focus groups of federal security awareness professionals which informed the development of a follow-on, online survey completed by 96 federal employees involved in their security awareness programs. Research results are directly informing government efforts to produce guidance and resources to aid federal security awareness programs. This report provides an overview of the research, including a description of the research methodologies and the participants, organizations, and security awareness programs represented in the study. Two companion documents report on the results of the study. Each document addresses an overarching theme focused on a subset of research questions: NIST 8420A 'Approaches and Challenges of Federal Cybersecurity Awareness Programs' - What approaches and techniques do federal agencies employ in their security awareness programs? - What's working well with respect to security awareness programs in federal agencies? - What's not working well? What are the challenges and concerns of federal security awareness programs? - How do organizations determine the effectiveness of the security awareness program? - What resources and guidance are used to inform the security awareness programs? \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ - What do programs feel like they need to be more successful? What kinds of resources would be most beneficial?

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Federal Cybersecurity Awareness Programs_ A Mixed Methods Research Study.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Computer Security Division 2009 Annual Report provide? (Section 32) d new ones were added. We also invite public and private organizations to submit their information security practices to be considered for inclusion on the list of practices maintained on the website. Policies and procedures may be submitted to us in any area of information security, includ- ing accreditation, audit trails, authorization of processing, budget planning and justification, certification, contingency planning, data integrity, disaster planning, documentation, hardware and system maintenance, identification and authentication, incident handling and response, life cycle, network security, personnel security, physical and environmental protection, production input/ output controls, security policy, program management, review of security controls, risk management, security awareness training and education (including specific training course and awareness materials), and security planning. In FY2010, we will continue the momentum to expand the number of sample practices and policies made available to federal agencies and the public. We are currently identifying robust sources for more samples to add to this growing repository. We plan to take advantage of the advances in communication technology and combine this outreach with other outreach areas for information security in order to reach many in the federal agencies and the public. Contacts: Ms. Pauline Bowen (301) 975-2938 pauline.bowen@nist.gov Mr. Mark Wilson (301) 975-3870 mark.wilson@nist.gov What do a business's invoices have in common with e-mail? If both are done on the same computer, the business owner may want to think more about computer security. Information - payroll records, proprietary information, client or employee data - is essential to a business's success. A computer failure or other system breach could cost a business anything from its reputation to damages and recovery costs.

Explanation: NIST publication on credential and access management. Topics: authentication, authorization. Contains security framework guidance for authentication systems. Source: Computer Security Division 2009 Annual Report.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Implementing a Zero Trust Architecture_ High-Level Document provide? (Section 61) s to Resource Data Based on Requesting Endpoint - the subject will be granted full or limited access to different levels of data based on whether the requesting endpoint is enterprise-managed or BYOD. -  Scenario H-3: Internet Access restricted when Accessing High Level Data - while a subject has an active access session to a resource storing data with high classification, the enterprise will restrict that subject from accessing public internet resources. -  Scenario H-4: Accessing High Level Data Triggers MFA Challenge - if a subject already as an active access session with a resource and is accessing low-classification data, a request to access high-classification data at that resource will trigger a multi-factor authentication challenge. -  Scenario H-5: Just-in-Time Access to High-Level Data - the enterprise can grant a subject temporary access privileges to high-level data when needed. -  Scenario H-6: Operations Denied When Accessing High Level Data - a subject that is authorized to fully access (e.g., read and write) high classification data when using an enterprise-managed endpoint and located on premises or at a branch office can have their access privileges limited to read-only when using a BYOD or when located remote from enterprise infrastructure. -  Scenario H-7: High Classified Data Has Extra Protection When Stored on Endpoints - when a subject downloads or copies high classification data onto the subject's endpoint, the data is encrypted or has some further protection that requires the subject to pass a challenge before accessing or performing actions on the local copy of the data. The summary and detailed functional demonstration results are shown in the sections below.

Explanation: NIST publication on credential and access management. Topics: authentication, multi-factor, mfa. Contains security framework guidance for authentication systems. Source: Implementing a Zero Trust Architecture_ High-Level Document.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Recommendation for Block Cipher Modes of Operation_ the CCM Mode for Authentication and Confidentiality say about 4.1 Definitions and Abbreviations? (Part 1) According to Recommendation for Block Cipher Modes of Operation_ the CCM Mode for Authentication and Confidentiality, 4.1 Definitions and Abbreviations: 4.1 Definitions and Abbreviations | Approved | FIPS approved or NIST recommended: an algorithm or technique that is either 1) specified in a FIPS or NIST Recommendation, or 2) adopted in a FIPS or NIST Recommendation. | |-----------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | Associated Data | Input data to the CCM generation-encryption process that is authenticated but not encrypted. | | Authenticity | The property that data originated from its purported source. | |-------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | Bit | A binary digit: 0 or 1. | | Bit Length | The number of bits in a bit string. | | Bit String | An ordered sequence of bits. | | Block | A bit string whose length is the block size of the block cipher algorithm. | | Block Cipher Algorithm | A family of functions and their inverses that is parameterized by cryptographic keys; the functions map bit strings of a fixed length to bit strings of the same length. | | Block Size | The bit length of an input (or output) block of the block cipher. | | CBC-MAC | Cipher Block Chaining-Message Authentication Code | | CCM | Counter with Cipher Block Chaining-Message Authentication Code. | | Ciphertext | The output of the CCM encryption-generation process. | | Cryptographic Key | A parameter used in the block cipher algorithm that determines the forward cipher function. | | CTR | Counter.

Explanation: NIST publication on credential and access management. Topics: authentication, sso. Contains security framework guidance for authentication systems. Source: Recommendation for Block Cipher Modes of Operation_ the CCM Mode for Authentication and Confidentiality.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control PE-3 in Guide to Operational Technology (OT) Security? Control PE-3: Physical Access Control

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Guide to Operational Technology (OT) Security.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain Conclusion according to NIST Report of the Invitational Workshop on Integrity Policy in Computer Information Systems (WIPCIS) According to Report of the Invitational Workshop on Integrity Policy in Computer Information Systems (WIPCIS), Conclusion: The whole Group unanimously felt that the opportunity to participate in the Workshop was an extremely valuable experience, and one that none of us would have liked to miss. We feel that some extremely useful progress has been made, and, at an absolute minimum, we are beginning to develop a useful vocabulary which can be used to discuss the problem. We would like to sincerely thank the organizers for the opportunity and would like to express an eagerness to continue our participation in the future. On a personal note, as the Group Leader, I would like to sincerely thank the members of the Group, and Stuart Katzke who joined us for some of our discussions, for providing a very exciting forum and what I consider to be some very valuable ideas

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Report of the Invitational Workshop on Integrity Policy in Computer Information Systems (WIPCIS).


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Computer Security_ Selected Articles say about The Cuckoo's Egg , by Clifford Stoll. Doubleday 1989. 326 pages.? (Part 2) According to Computer Security_ Selected Articles, The Cuckoo's Egg , by Clifford Stoll. Doubleday 1989. 326 pages.: vice is provided on the requirements for security detection controls to produce information acceptable as criminal evidence. Analyses of federal and several state computer crime statutes are included. Organizing for Computer Crime Investigation and Prosecution, by Catherine H. Conlv. NCJ 118216. National Institute of Justice. 1989. 124 pages. Dedicated Computer Crime Units, by J. Thomas McEwen. NCJ 118215. National Institute of Justice. 1989. 129 pages. Information Technology Installation Security, Federal Systems Integration and Management Center, Office of Technical Assistance, 5203 Leesburg Pike, Suite 400, Falls Church, VA 22051. December 1988. 98 pages. This publication addresses all government managers having responsibility for information technology. The publication is intended to assist them in developing, implemendng, and maintaining security policies, procedures and techniques. Computer Viruses: Dealing with Electronic Vandalism and Programmed Threats, by Eugene Spafford, Kathleen Heaphy and David Ferbrache. ADAPSO, 1300 North Seventeenth Street, Suite 300, Arlington, VA 22209. 1989. 109 pages. This book presents a high-level discussion of computer viruses, explaining how they work, who writes them, and what they do. It is not a technical reference on viruses. The book dispels common myths about viruses and provides simple, effective suggestions on how to protect computer systems against threats. Managing Information Resources: New Directions In State Government, Dr. Sharon L. Caudel, Dr. Donald A. Marchand with Dr. Stuart L Bretschneider, Ms. Particia T. Fletcher, and Mr. Kurt M. Thurmaier. School of Information Studies, Syracuse University, 4-206 Center for Science and Technology, Syracuse, NY 13244-4100. August, 1989. 307 pages. This report is a joint effort between the National Association for State Information Systems, Inc., information processing industry companies, and Syracuse University's School of Information Studies which directed the research.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Computer Security_ Selected Articles.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Secure Biometric Match-on-Card Feasibility Report provide? (Section 15) . The size of the generated certificates was kept consistent by changing only the public key modulus and exponent associated with each certificate to match the public/private key pair stored on a DUT. For tests using Rivest Shamir Adleman (RSA) 1024, the size of the certificate used was 1,345 bytes and for RSA 2048, the certificate size was 1,477 bytes. Testing consisted of sending matching and non-matching sample fingerprint templates to a DUT for verification in alternating sequence. First, sample fingerprint templates containing a minutia count of 41 were sent to the DUT for verification and time values were recorded. The process was repeated for sample fingerprint templates containing a minutia count of 34 and 27. Live fingerprint scans were not used in the tests since it was desirable to maintain a controlled test environment where the minutia count of the sample fingerprint templates could be regulated. Instead, the sample fingerprint templates were read from files generated from fingerprint scans beforehand. For each test case, 200 trials were run so that 100 time values could be collected each for matching and non-matching templates. The DUT was powered continuously during the automated sequence of 200 trials. As a consequence, transaction delays that could result from operations at DUT power-up, for example FIPS 140-2 power-up diagnostic tests, are not visible in the measurements. Table 3 provides a summary of the DUTs used in the feasibility study. Multiple DUTs may correspond to the same physical card but have been given unique names to differentiate the test configurations. Note that the DUTs submitted are prototypes constructed to meet the requirements stated in Appendix D. In conformance with the 'no endorsement' policy of NIST, the participants' DUT names have been omitted. Table 3.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Secure Biometric Match-on-Card Feasibility Report.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Securing Web Transactions_ TLS Server Certificate Management say about 2.3.1.2.5 Security Assertion Markup Language (SAML) Single Sign-On Prerequisites? According to Securing Web Transactions_ TLS Server Certificate Management, 2.3.1.2.5 Security Assertion Markup Language (SAML) Single Sign-On Prerequisites: SAML is a highly recommended DigiCert feature for secure user authentication. However, it is not required to duplicate the TLS lab setup. For more information on SAML, please refer to guidance at: -  https://pages.nist.gov/800-63-3/sp800-63-3.html Before beginning, make sure the following prerequisites are met: -  Have a CertCentral account. -  Have SAML enabled on the CertCentral account. (To get the SAML features turned on for the CertCentral account, contact the DigiCert account representative or the DigiCert support team. Once activated, in the sidebar menu, under Settings, see the Single Sign-On and SAML Certificate Request menu options.) -  Have an identity provider (IdP). -  Have the IdP metadata (dynamic or static). -  Have admin privileges on the CertCentral account (or have manager privileges on the CertCentral account with the Allow access to SAML settings permission).

Explanation: NIST publication on credential and access management. Topics: authentication, single sign-on. Contains security framework guidance for authentication systems. Source: Securing Web Transactions_ TLS Server Certificate Management.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Conformance Testing Methodology Framework for ANSI_NIST-ITL 1-2011 Update_ 2013, Data Format for the Interchange of Fingerprint, Facial & Other Biomet say about AN-2013 Annex G: Mapping to the NIEM IEPD? (Part 71) According to Conformance Testing Methodology Framework for ANSI_NIST-ITL 1-2011 Update_ 2013, Data Format for the Interchange of Fingerprint, Facial & Other Biomet, AN-2013 Annex G: Mapping to the NIEM IEPD: | | X | | Req. # - ID | Ref. in Base Std. | Requirement Summary | L e v e l | Assertion ID | Test Assertion | N o t e s | Imp. Required | Imp. Support | Supporte d Range | Test Result | E n c .

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Conformance Testing Methodology Framework for ANSI_NIST-ITL 1-2011 Update_ 2013, Data Format for the Interchange of Fingerprint, Facial & Other Biomet.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain SHARE YOUR FEEDBACK according to NIST Securing Distributed Energy Resources_ An Example of Industrial Internet of Things Cybersecurity According to Securing Distributed Energy Resources_ An Example of Industrial Internet of Things Cybersecurity, SHARE YOUR FEEDBACK: You can view or download the guide at Help the NCCoE make this guide better by sharing your thoughts with us as you read it. If you adopt this solution for your own organization, please share your experience and advice with us. We recognize that technical solutions alone will not fully enable the benefits of our solution, so we encourage organizations to share lessons learned and best practices for transforming the processes associated with implementing this guide. To provide comments or to learn more by arranging a demonstration of this example implementation, contact the NCCoE at energy\_nccoe@nist.gov.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Securing Distributed Energy Resources_ An Example of Industrial Internet of Things Cybersecurity.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Understanding Stablecoin Technology and Related Security Considerations provide? (Section 41) (Coin Minting and Burning): Stablecoins have different policies for minting (coin creation) and burning (coin deletion). Most stablecoin architectures create coins only upon the receipt of collateral. For redemption, they return the provided collateral funds in exchange for receipt of the minted coins (burning them to remove them from circulation). Other stablecoins allow for arbitrary printing of coins without the need to receive collateral. A few even allow for arbitrary burning (and minting) of coins while coins are in the users' possession (apart from any actions by the users) in order to stabilize the coin value. Stablecoins are often collateralized with fiat currency, really 'cash-equivalent reserves (deposits, T-bills, commercial paper)' [1]. Cryptocurrencies (both stable and volatile) may also be used for collateral. Some have reserves held in physical commodities, such as gold or diamonds, where a large degree of value can be stored in a small form factor. Others have reserve funds that represent asset values but are invested in mutual funds or exchange traded funds (ETFs). Others may hold their reserve in an investment account that trades in futures and options to keep a reserve pool that tracks a particular asset value. Some stablecoins have no reserve pool and, thus, no collateral type. Such stablecoins rely on the ability to arbitrarily print volatile companion coins to generate reserve funds on demand. Cryptocurrency-backed stablecoins are often 'over-collateralized', having more cryptocurrency value in reserve than the total value of all issued stablecoin tokens. They do this when the value of their reserves may have high volatility. Fiat currency and non-currency asset collateralized stablecoins are often 'fully collateralized', having a reserve pool of equal value to all issued stablecoin tokens. However, some are only 'partially collateralized', keeping in reserve only a fraction of the value of the issued tokens.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Understanding Stablecoin Technology and Related Security Considerations.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Security Considerations for Remote Electronic UOCAVA Voting say about 2.2.4 Auditors / observers? According to Security Considerations for Remote Electronic UOCAVA Voting, 2.2.4 Auditors / observers: Auditors and observers will need access to information generated or observed during an election in order to perform their functions. In general, auditors and observers will have limited information collected through observation due to the distributed nature of remote electronic voting systems. Most of the information auditors and observers will have access to will be electronically generated by the remote electronic voting system with a possible exception when paper ballots are used or a voter verified paper audit trial is produced. The integrity and accuracy of the information used by the auditors and observers will greatly impact the effectiveness of their functions.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Security Considerations for Remote Electronic UOCAVA Voting.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Data Integrity_ Detecting and Responding to Ransomware and Other Destructive Events say about D.2 Data Integrity Use Case Requirements? (Part 7) According to Data Integrity_ Detecting and Responding to Ransomware and Other Destructive Events, D.2 Data Integrity Use Case Requirements: | The downloads are identified as mali- cious, using a denyl- ist. | Data Integrity DR-4 | | CR 4.i | | The downloads are identified as mali- cious through analy- sis, and the denylist is updated. | Data Integrity DR-4 | | CR 4.j | | The malicious exe- cutable is halted or deleted. | Data Integrity DR-4 | | CR 4.k | | Suspicious network traffic is detected, and denylist is up- dated. | Data Integrity DR-4 | | CR 5 | The DI example imple- mentation shall detect and respond to changes to the database made through a web server vulnerability in custom code. | | Data Integrity DR-5 | | CR 5.a | | Database integrity changes are col- lected and logged. | Data Integrity DR-5 | | CR 5.b | | Information about the client interact- ing with the web service is collected and logged.

Explanation: NIST cybersecurity publication covering vulnerability management. Topics: vulnerability, ransomware. Contains technical security guidance that could inform defensive posture. Source: Data Integrity_ Detecting and Responding to Ransomware and Other Destructive Events.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control CM-4 in Security and Privacy Controls for Information Systems and Organizations? (Part 2) Control CM-4: nesses, incompatibility, or intentional malice. Discussion: A separate test environment requires an environment that is physically or logically separate and distinct from the operational environment. The separation is sufficient to ensure that activities in the test environment do not impact activities in the operational environment and that information in the operational environment is not inadvertently transmitted to the test environment. Separate environments can be achieved by physical or logical means. If physically separate test environments are not implemented, organizations determine the strength of mechanism required when implementing logical separation. Related Controls: SA-11, SC-7. (2) IMPACT ANALYSES | VERIFICATION OF CONTROLS CHAPTER THREE PAGE 101 T h s i p u b l i c a t i o n i s a v a i l l a b e f r e e o f c h a r g e f r o m : h t t p s : / / d o i . o r g / 1 0 . 6 0 2 8 / N S T S P . 8 0 0 - 5 3 r 5 . I NIST SP 800-53, REV. 5 SECURITY AND PRIVACY CONTROLS FOR INFORMATION SYSTEMS AND ORGANIZATIONS _________________________________________________________________________________________________ After system changes, verify that the impacted controls are implemented correctly, operating as intended, and producing the desired outcome with regard to meeting the security and privacy requirements for the system. Discussion: Implementation in this context refers to installing changed code in the operational system that may have an impact on security or privacy controls. Related Controls: SA-11, SC-3, SI-6. References: [SP 800-128].

Explanation: NIST cybersecurity documentation and standards guidance. Topics: nist sp, fips, security control. General security reference material without sensitive content. Source: Security and Privacy Controls for Information Systems and Organizations.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Guide to Integrating Forensic Techniques into Incident Response provide? (Section 17) | Application Layer........................................................................................ | 6-2 | | | 6.1.2 | Transport Layer.......................................................................................... | 6-2 | | | 6.1.3 | IP Layer ..................................................................................................... | 6-3 | | | 6.1.4 | Hardware Layer..........................................................................................

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Guide to Integrating Forensic Techniques into Incident Response.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain 6.1 Generation-Encryption Process according to NIST Recommendation for Block Cipher Modes of Operation_ the CCM Mode for Authentication and Confidentiality According to Recommendation for Block Cipher Modes of Operation_ the CCM Mode for Authentication and Confidentiality, 6.1 Generation-Encryption Process: The following is a specification of the generation-encryption process of CCM: Prerequisites: block cipher algorithm; key K ; counter generation function; formatting function; MAC length Tlen . Input : valid nonce N ; valid payload P of length Plen bits; valid associated data A ; Output : ciphertext C.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Security Best Practices for the Electronic Transmission of Election Materials for UOCAVA Voters provide? (Section 10) | 33 | | 4.1 | Overview................................................................................33 | Overview................................................................................33 | | | 4.2 General Issues ........................................................................33 | 4.2 General Issues ........................................................................33 | 4.2 General Issues ........................................................................33 | | |-------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------|----| | 4.2.1 | 4.2.1 | Voter Identification and Authentication..................................33 | | | 4.2.2 | 4.2.2 | Ballot Accounting ...............................................................34 | | | 4.2.3 | 4.2.3 | Return Identification...........................................................35 | | | 4.2.4 | 4.2.4 | Ballot Tracking...................................................................35 | | | 4.2.5 | 4.2.5 | Ballot Preparation...............................................................36 | | | 4.3 | Fax Transmission.....................................................................37 | Fax Transmission.....................................................................37 | | | 4.4 | Electronic Mail.........................................................................38 | Electronic Mail.........................................................................38 | | | 4.5 | Web-Based File Repositories......................................................39 | Web-Based File Repositories......................................................39 | | | 4.6 | Online Ballot Markers ...............................................................39 | Online Ballot Markers ...............................................................39 | | | 5 OTHER RESOURCES....................................................................

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Security Best Practices for the Electronic Transmission of Election Materials for UOCAVA Voters.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control HA-1 in Guide to Integrating Forensic Techniques into Incident Response? (Part 9) Control HA-1: yption often presents challenges for analysts. Users might encrypt individual files, folders, volumes, or partitions so that others cannot access their contents without a decryption key or passphrase. 51 The encryption might be performed by the OS or a third-party program. Although it is relatively easy to identify an encrypted file, it is usually not so easy to decrypt it. The analyst might be able to identify the encryption method by examining the file header, identifying encryption programs installed on the system, or finding encryption keys (which are often stored on other media). Once the encryption method is known, the analyst can better determine the feasibility of decrypting the file. In many cases, it is not possible to decrypt files because the encryption method is strong and the authentication (e.g., passphrase) used to perform decryption is unavailable. Although an analyst can detect the presence of encrypted data rather easily, the use of steganography is more difficult to detect. Steganography , also known as steg , is the embedding of data within other data. Digital watermarks and the hiding of words and information within images are examples of steganography. Some techniques an analyst can use to locate stegged data include looking for multiple versions of the same image, identifying the presence of grayscale images, searching metadata and registries, using histograms, and using hash sets to search for known steganography software. Once certain that stegged data exists, analysts might be able to extract the embedded data by determining what software created the data and then finding the stego key, or by using brute force and cryptographic attacks to determine a password. 52 However, such efforts are often unsuccessful and can be extremely timeconsuming, particularly if the analyst does not find the presence of known steganography software on the media being reviewed.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain Appendix H according to NIST A Study of Federal Agency Needs for Information Technology Security According to A Study of Federal Agency Needs for Information Technology Security, Appendix H: federal managers to share information, build upon the experience of other agencies, and avoid duplication of effort. The forum promotes broad dissemination of useful computer security materials within the federal government in a timely manner.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: A Study of Federal Agency Needs for Information Technology Security.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Multi-Factor Authentication for Criminal Justice Information Systems_ Implementation Considerations for Protecting Criminal Justice Information say about 2.5. The Importance of Phishing Resistance? (Part 1) According to Multi-Factor Authentication for Criminal Justice Information Systems_ Implementation Considerations for Protecting Criminal Justice Information, 2.5. The Importance of Phishing Resistance: 2.5. The Importance of Phishing Resistance All MFA has security benefits compared to using a single factor, but not all forms of MFA are created equal, even if they are at the same AAL. One important differentiator among various types of MFA is the ability for the authenticator to resist phishing attacks. Phishing attacks attempt to lure a user (usually through an email) into interacting with a counterfeit webpage or application and trick the user into revealing information (typically passwords or one-time codes) that can be used to masquerade as that user to the real web page or application. See Fig. 4 for an example of how a phishing attack occurs. <!-- image --> Fig. 4. An example of a phishing attack. <!-- image --> Tip: Not all authenticators are phishing resistant, but phishing-resistant MFA solutions are now commonly supported by identity platforms. Commercially, Fast Identity Online (FIDO) authenticators paired with the World Wide Web Consortium's ( W3C) Web Authentication API are the most widely available phishing-resistant authenticators. Agencies should ask vendors what phishing-resistant authentication options they support, to include support for phishingresistant, syncable authenticators as described in NIST 800-63B-4 [4]. Phishing attacks are a significant cybersecurity challenge, as they are often conducted remotely and at scale, meaning that an attacker may send a phishing email to thousands of employees, needing only to trick a single employee into providing their login information to gain unauthorized access to data and/or applications. Phishing-resistant authentication systems do not require the user to recognize an attack and make the right decision, but rather have phishing resistance built into the authentication protocol itself. NIST published a blog post on phishing-resistant authenticators and how they mitigate common attacks [5].

Explanation: NIST publication on credential and access management. Topics: authentication, multi-factor, mfa. Contains security framework guidance for authentication systems. Source: Multi-Factor Authentication for Criminal Justice Information Systems_ Implementation Considerations for Protecting Criminal Justice Information.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Interagency Report on the Status of International Cybersecurity Standardization for the Internet of Things (IoT) say about 8.8 Physical Security? According to Interagency Report on the Status of International Cybersecurity Standardization for the Internet of Things (IoT), 8.8 Physical Security: IoT components may be in remote and unattended locations where physical access is almost unrestricted. Due to their cost model, very low cost IoT components cannot be protected by physically hardening the component or by adding anti-tampering features. Where physical access can be controlled, there are sector specific and generic standards available, such as the six-part ISO/IEC TS 22237 for data center facilities and infrastructures and Security Industry Association (SIA) Open Supervised Device Protocol (OSDP) v2.1.7 for interoperability among access control and security products.

Explanation: NIST publication on credential and access management. Topics: access control, sso. Contains security framework guidance for authentication systems. Source: Interagency Report on the Status of International Cybersecurity Standardization for the Internet of Things (IoT).


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does NIST_SP_800-53r5_Security_Privacy_Controls provide? (Section 317) al mission and business functions despite disruption, compromise, or failure in organizational systems. Related Controls: CP-2, CP-6, CP-8, CP-9, CP-10, MA-6, PE-3, PE-11, PE-12, PE-17, SC-36, SI-13. Control Enhancements: (1) ALTERNATE PROCESSING SITE | SEPARATION FROM PRIMARY SITE Identify an alternate processing site that is sufficiently separated from the primary processing site to reduce susceptibility to the same threats. Discussion: Threats that affect alternate processing sites are defined in organizational assessments of risk and include natural disasters, structural failures, hostile attacks, and errors of omission or commission. Organizations determine what is considered a sufficient degree of separation between primary and alternate processing sites based on the types of threats that are of concern. For threats such as hostile attacks, the degree of separation between sites is less relevant. Related Controls: RA-3. (2) ALTERNATE PROCESSING SITE | ACCESSIBILITY Identify potential accessibility problems to alternate processing sites in the event of an area-wide disruption or disaster and outlines explicit mitigation actions. Discussion: Area-wide disruptions refer to those types of disruptions that are broad in geographic scope with such determinations made by organizations based on organizational assessments of risk. Related Controls: RA-3. (3) ALTERNATE PROCESSING SITE | PRIORITY OF SERVICE Develop alternate processing site agreements that contain priority-of-service provisions in accordance with availability requirements (including recovery time objectives). Discussion: Priority of service agreements refer to negotiated agreements with service providers that ensure that organizations receive priority treatment consistent with their availability requirements and the availability of information resources for logical alternate processing and/or at the physical alternate processing site.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control, assessment. General security reference material without sensitive content. Source: NIST_SP_800-53r5_Security_Privacy_Controls.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does NIST_SP_800-37r2_Risk_Management_Framework say about Acknowledgements? According to NIST_SP_800-37r2_Risk_Management_Framework, Acknowledgements: This publication was developed by the Joint Task Force Interagency Working Group. The group includes representatives from the Civil, Defense, and Intelligence Communities. The National Institute of Standards and Technology wishes to acknowledge and thank the senior leaders from the Departments of Commerce and Defense, the Office of the Director of National Intelligence, the Committee on National Security Systems, and the members of the interagency working group whose dedicated efforts contributed significantly to the publication.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: NIST_SP_800-37r2_Risk_Management_Framework.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control DS-3 in Data Confidentiality_ Identifying and Protecting Assets Against Data Breaches? (Part 28) Control DS-3: . In this build, Duo offers a variety of authentication options, such as a hardware-based authenticator. Organizations should audit tools to deter- mine what information they are using and collecting. Disassociability: Organizations should ex- plore capabilities and configurations that allow for the de-identification of phone numbers and other personal information, such as the capability to replace a phone- number with placeholder text or privacy- enhancing cryptographic techniques to limit the tracking of users. | ## 5.3.2 Authentication to Virtual Desktop Interface Solution The reference architecture in this document demonstrates a Virtual Desktop Interface (VDI) solution to facilitate secure access to organizational resources and data. Organizations may allow users' personal devices to access corporate resources using the VDI solution. Organizations should consider the privacy risk of installing VDI software on personally owned devices, information revealed by the VDI protocol, and monitoring of user activity while in the virtual environment. Figure 5-2 Virtual Desktop Interface Data Flow Diagram <!-- image --> Table 5-10 Virtual Desktop Interface Data Actions | Data Type | Data Action | Privacy Impact | |----------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------| | Username | The username is stored by the user workstation and active directory. It is transferred as part of the authentication pro- cess.

Explanation: NIST publication on credential and access management. Topics: authentication, sso. Contains security framework guidance for authentication systems. Source: Data Confidentiality_ Identifying and Protecting Assets Against Data Breaches.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Guidelines for Smart Grid Cybersecurity provide? (Section 293) .  Local autonomy: All authentication processes between devices, or between users and devices will be able to operate even if a centralized service over a network is not available at any given time. For example, this is to ensure that if a network connection in a substation becomes unavailable, but a critical operation needs to be accomplished by local personnel, they would not in any way be inhibited from doing so.  Revocation management: The ability to revoke credentials in a system in an ordered manner that ensures that all affected devices and users are notified and can take appropriate actions and adjustments to their configurations. Examples can include handling revoked PKI certificates and ensuring that entities with revoked certificates cannot be authenticated to protected services and functions.  Key material provisioning: The processes and methods used to securely enter key material initially into components and devices of a system, as well as changing key materials during their operation.  Key material destruction: The secure disposal of all key material after its intended use and lifetime, for example, the zeriozation/erasure of CSPs. Making key material unavailable is an acceptable alternative for systems where destruction is not possible.  Credential span of control: The number of organizations, domains, systems or entities controlled or controllable through the use of the key material associated with the credential. This does not explicitly address keys used for purposes other than control nor 241 include asymmetric keys that are indirectly used for control, such as those associated with root or intermediate certification authorities.

Explanation: NIST publication on credential and access management. Topics: authentication, pki, sso. Contains security framework guidance for authentication systems. Source: Guidelines for Smart Grid Cybersecurity.