You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Identity and Access Management for Electric Utilities say about Java Application? (Part 3) According to Identity and Access Management for Electric Utilities, Java Application: tions through the database administrator login. The current version of AlertEnterprise products supports Oracle and Microsoft SQL Server databases. The NCCoE build also supports MySQL server database. To configure the database server, follow these steps: NIST SP 1800-2C: Identity and Access Management for Electric Utilities 156 Create a schema / system identifier (SID) per your naming convention in the database server. The steps to create a schema can be different with different database management systems. Refer to the administrators guide for the database management system installed at your landscape. Create a new user with full access to the created schema. Run the included SQL files, AlertReport471.ddl or AlertReport471.sql and AlertQuartz.sql, on the new schema created. This step should be performed while installing the AlertEnterprise application for the first time. 9.2.3.7 Avoiding Case-Sensitivity Issues in Alert DB To avoid case-sensitivity issues while using the search and sort functionalities in the AlertEnterprise applications, enable a “Case Insensitiveness” search in the database. By default, it is set as case- sensitive. Follow these steps to avoid case-sensitivity issues: Create a trigger to support case insensitiveness. /***********/ create or replace trigger set_nls_onlogon AFTER LOGON ON SCHEMA DECLARE BEGIN EXECUTE IMMEDIATE 'ALTER SESSION SET NLS_SORT="BINARY_CI"'; EXECUTE IMMEDIATE 'ALTER SESSION SET NLS_COMP="LINGUISTIC"'; END set_nls_onlogon; /************/ Restart the AlertEnterprise Application server. The effect may not be visible in some client tools, such as SQL Developer. To see the effect in the SQL Developer tool, follow these steps: Open SQL Developer, and click Tools > Preferences. Click Database > NLS, and perform the following actions: T h i s p u b l i c a t i o n i s a v a i l l a b e f r e e o f c h a r g e f r o m : h t t p : / / d o i . o r g / 1 0 . 6 0 2 8 / N I S T . S P 1 8 0 0 - 2 . .

Explanation: NIST cybersecurity documentation and standards guidance. Topics: nist sp, fips, security control. General security reference material without sensitive content. Source: Identity and Access Management for Electric Utilities.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain Technical Solution Overview according to NIST Cybersecurity Framework Manufacturing Profile Low Impact Level Example Implementations Guide_ Volume 2 – Process-based Manufacturing System Use Case According to Cybersecurity Framework Manufacturing Profile Low Impact Level Example Implementations Guide_ Volume 2 – Process-based Manufacturing System Use Case, Technical Solution Overview: DBAN is a free open source data wiping utility allowing the ability to sanitize hard drives to ensure data is not left behind when drives are beginning decommissioned and prepared for removal from on-premise. DBAN and other hard drive sanitization tools only work with spinning hard drives, SSD hard drives and other flash media refer to vendors for specific directions for sanitizing media before removing from company control.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: cybersecurity framework, fips, security control. General security reference material without sensitive content. Source: Cybersecurity Framework Manufacturing Profile Low Impact Level Example Implementations Guide_ Volume 2 – Process-based Manufacturing System Use Case.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does 2016 NIST_ITL Cybersecurity Program Annual Report say about CONTACTS:? According to 2016 NIST_ITL Cybersecurity Program Annual Report, CONTACTS:: Mr. Rodney Petersen (301) 975-8897 nice.nist@nist.gov Ms. Danielle Santos (301) 975-5048 danielle.santos@nist.gov

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: 2016 NIST_ITL Cybersecurity Program Annual Report.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Quick Start Guide for Populating Mobile Test Devices say about Appendix C-Mobile Device Data Example? (Part 2) According to Quick Start Guide for Populating Mobile Test Devices, Appendix C-Mobile Device Data Example: <!-- image --> Table 12: PIM data example | Data Objects | Data Properties | Data Value | |-------------------------------|------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | Contacts/Address Book Entries | Regular length (up to 50 chars) | Eddie Van Halen, 5150515051 | | Contacts/Address Book Entries | Maximum length (over 50 chars) | John Jacob Jingle Heimer Schmidt That's My Name Too Whenever I Go Out The People Always Shout John Jacob Jingle Heimer Schmidt, 8988675309 | | Contacts/Address Book Entries | Special character (!, @, #, $, %, ^, &, *) | *, 8887771212 | | Contacts/Address Book Entries | Blank name | 8785551111 | | Contacts/Address Book Entries | Regular length with multiple metadata objects (e.g., graphic, email, URL, Address, Birthdate) supported by the device.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Quick Start Guide for Populating Mobile Test Devices.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Data Integrity_ Detecting and Responding to Ransomware and Other Destructive Events say about Jennifer Cawthra? According to Data Integrity_ Detecting and Responding to Ransomware and Other Destructive Events, Jennifer Cawthra: National Cybersecurity Center of Excellence NIST Michael Ekstrom Lauren Lusty Julian Sexton John Sweetnam The MITRE Corporation McLean, Virginia

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Data Integrity_ Detecting and Responding to Ransomware and Other Destructive Events.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Attribute-based Access Control for Microservices-based Applications using a Service Mesh say about Appendix A: List of Recommendations for deployment of an ABAC-based authentication and authorization framework for microservicesbased applications using a service mesh? (Part 4) According to Attribute-based Access Control for Microservices-based Applications using a Service Mesh, Appendix A: List of Recommendations for deployment of an ABAC-based authentication and authorization framework for microservicesbased applications using a service mesh: that is provided by the secure discovery service or DNS. This requirement is needed to ensure that the server is the authorized location for the microservices and to protect against network hijacking. | Service-level Authentication | | EAUN-SR-1 | A request authentication policy must, at the minimum, provide the following information and must be enforced by the sidecar proxy ● Instructions for extracting the credential from the request ● Instructions for validating the credential | End-user level Authentication | | SAUZ-SR-1 | A policy object describing service-to-service access should be in place for all services in the mesh. At a minimum, these policies should restrict access to the namespace level (e.g., 'services in namespace A can call services in namespace B').

Explanation: NIST publication on credential and access management. Topics: access control, authentication, authorization. Contains security framework guidance for authentication systems. Source: Attribute-based Access Control for Microservices-based Applications using a Service Mesh.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Assessing Enhanced Security Requirements for Controlled Unclassified Information say about Abstract? According to Assessing Enhanced Security Requirements for Controlled Unclassified Information, Abstract: The protection of Controlled Unclassified Information (CUI) in nonfederal systems and organizations is important to federal agencies and can directly impact the ability of the Federal Government to successfully carry out its assigned missions and business operations. This publication provides federal agencies and nonfederal organizations with assessment procedures that can be used to carry out assessments of the requirements in NIST Special Publication 800172, Enhanced Security Requirements for Protecting Controlled Unclassified Information: A Supplement to NIST Special Publication 800-171 . The assessment procedures are flexible and can be tailored to the needs of organizations and assessors. Assessments can be conducted as 1) self-assessments; 2) independent, third-party assessments; or 3) government-sponsored assessments. The assessments can be conducted with varying degrees of rigor based on customer-defined depth and coverage attributes. The findings and evidence produced during the assessments can be used to facilitate risk-based decisions by organizations related to the CUI enhanced security requirements.

Explanation: NIST publication discussing classified information handling. References: classified, controlled unclassified, cui. Contains guidance on protecting sensitive government information. Source: Assessing Enhanced Security Requirements for Controlled Unclassified Information.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control SR-11(3) in Developing Cyber-Resilient Systems_ A Systems Security Engineering Approach? (Part 8) Control SR-11(3): ________________________________________________________ INTENDED EFFECT IMPACT ON RISK EXPECTED RESULTS The threat event may produce consequences, but those consequences cannot produce an impact. IMPEDE (includes contain, degrade, delay, and exert) Make it more difficult for the threat event to cause adverse impacts or consequences. For adversarial threats, this involves decreasing the adversary’s return on investment (ROI) for the threat event. CONTAIN Restrict the effects of the threat event to a limited set of resources. The consequences of the threat event are less extensive than they might otherwise be. DEGRADE Decrease the expected consequences of the threat event. Because the consequences of the threat event are less severe than they would be without the mitigation, they could fail to produce an impact, or their impact could be lessened. DELAY Increase the amount of time needed for the threat event to result in adverse impacts. Because the consequences of the threat event occur later than they would without the mitigation, they could fail to produce an impact, or their impact could be lessened. EXERT Increase the level of effort or resources needed for an adversary to achieve a given result. Example: Subtle variations in critical software are implemented (synthetic diversity) and prevent the adversary’s malware from compromising the targeted software. Reduce the likelihood of impact and reduce the level of impact. • Adversary activities are restricted in scope, fail to achieve full effect, do not take place in accordance with the adversary timeline, or require greater resources than the adversary had planned. Reduce the level of impact. Reduce the likelihood of impact, and/or reduce the level of impact. Reduce the likelihood of impact, and/or reduce the level of impact. Reduce the likelihood of impact. • The adversary can affect fewer resources than planned.

Explanation: NIST cybersecurity publication covering vulnerability management. Topics: malware, adversary. Contains technical security guidance that could inform defensive posture. Source: Developing Cyber-Resilient Systems_ A Systems Security Engineering Approach.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is Discussion according to NIST_SP_800-53r5_Security_Privacy_Controls? Discussion: In certain situations, such as during events that are defined in contingency plans,

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: NIST_SP_800-53r5_Security_Privacy_Controls.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does 4th Annual PKI R&D Workshop _Multiple Paths to Trust_ Proceedings say about 4th Annual PKI R&D Workshop -- Proceedings? (Part 2) According to 4th Annual PKI R&D Workshop _Multiple Paths to Trust_ Proceedings, 4th Annual PKI R&D Workshop -- Proceedings: e. The paranoid may regard this procedure as opening up a vulnerability itself - from there on, any local scripts (using the 'file:///' scheme) may change Mozilla's preferences for that profile. It could have been worse, though: we considered and rejected the idea of avoiding the creation of a temporary file by sending the Javascript program over HTTP - that would mean the user should allow script execution over the 'http://' scheme, which would open it up to abusive scripts from anywhere on the Internet. A limitation of our current engager implementations is that they cannot handle Proxy AutoConfiguration [11], which is quite popular. Since implementing this support would require a quite capable JavaScript interpreter, we have chosen to deal with it in future versions; we felt that for the purposes of proving the concept, it was not essential. Notice that engagers are just a convenience feature for users. They're obviously not necessary for the rest of the proxy to work, so long as the user changes the browser and Kapanga's proxy settings manually. That way, this whole system works even with browsers our implementation doesn't have specific engagers for. All that is required is that the browser must have proxy support. We've successfully run Kapanga in conjunction with many other browsers such as Konqueror, Opera and even Links (a console-based browser), just for kicks.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: 4th Annual PKI R&D Workshop _Multiple Paths to Trust_ Proceedings.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain Can Great Seneca Accounting stop someone from turning on a camera or microphone? according to NIST Mobile Device Security_ Bring Your Own Device (BYOD) According to Mobile Device Security_ Bring Your Own Device (BYOD), Can Great Seneca Accounting stop someone from turning on a camera or microphone?: Malicious actors with access (authorized or unauthorized) to device sensors (microphone, camera, gyroscope, Global Positioning System receiver, and radios) can use them to conduct surveillance. It may be directed at the user, as when tracking the device location, or it may be applied more generally, as when recording any nearby sounds. Captured sensor data may be immediately useful to a malicious actor, such as a recording of an executive meeting. Alternatively, the attacker may analyze the data in isolation or in combination with other data to yield sensitive information. For example, a malicious actor can use audio recordings of on-device or proximate activity to probabilistically determine user inputs to touchscreens and keyboards, essentially turning the device into a remote keylogger.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Mobile Device Security_ Bring Your Own Device (BYOD).


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does National Online Informative References (OLIR) Program_ Overview, Benefits, and Use provide? (Section 1) <!-- image --> Overview, Benefits, and Use Nicole Keller Stephen Quinn Karen Scarfone Matthew C. Smith Vincent Johnson This publication is available free of charge from: <!-- image --> Overview, Benefits, and Use Nicole Keller Stephen Quinn Computer Security Division Information Technology Laboratory Karen Scarfone Scarfone Cybersecurity Matthew C. Smith Huntington Ingalls Industries Vincent Johnson Electrosoft Services, Inc. This publication is available free of charge from: February 2024 <!-- image --> U.S. Department of Commerce Gina M. Raimondo, Secretary National Institute of Standards and Technology Laurie E. Locascio, NIST Director and Under Secretary of Commerce for Standards and Technology Certain equipment, instruments, software, or materials, commercial or non-commercial, are identified in this paper in order to specify the experimental procedure adequately. Such identification does not imply recommendation or endorsement of any product or service by NIST, nor does it imply that the materials or equipment identified are necessarily the best available for the purpose. There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may be used by federal agencies even before the completion of such companion publications. Thus, until each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning and transition purposes, federal agencies may wish to closely follow the development of these new publications by NIST. Organizations are encouraged to review all draft publications during public comment periods and provide feedback to NIST.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: National Online Informative References (OLIR) Program_ Overview, Benefits, and Use.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Identity and Access Management for Electric Utilities provide? (Section 304) re 9-23 Guardian Job Scheduler Triggers Field Map 9.3.3.10 Job Scheduler > Triggers Setup > Manual Configuration > Job Scheduler > Triggers. Click New, and create the PACSAD Trigger (Table 9-15). Table 9-15 Guardian Job Scheduler Triggers Name Description Type PACSAD Trigger PACSAD Trigger Reconciliation NIST SP 1800-2C: Identity and Access Management for Electric Utilities 190 Name Batch Size Number of Attempts PACSAD Trigger 100 3 Policy Designer for Users/Roles User policy New T h i s p u b l i c a t i o n System: Reconciliation From Reconciliation System Field Mapping Group User Type User Role PACS AD PACS AD PACSAD Field Map True True 9.3.3.11 Job Scheduler > Scheduler Setup > Manual Configuration > Job Scheduler > Scheduler. Click New, and enter the following fields, as shown in Figure 9-24. a. Job Type: Reconciliation Job b. Job Name: <Job Name> c. Select the Global checkbox d. Reconciliation for: Users e. Reconciliation Type: Incremental Reconciliation f. Reconciliation Triggers: PACSAD Trigger g. Select the schedule as Immediate, Once, Periodically, or Advance. For Periodically, specify the Start At, End At, and Rerun every (duration of job frequency, which should be no less than every 2 minutes). i s a v a i l l a b e f r e e o f c h a r g e f r o m : h t t p : / / d o i . o r g / 1 0 . 6 0 2 8 / N I S T . S P 1 8 0 0 - 2 . . NIST SP 1800-2C: Identity and Access Management for Electric Utilities 191 Figure 9-24 Guardian Reconciliation Job T h i s p u b l i c a t i o n i s a v a i l l a b e f r e e o f c h a r g e f r o m : h t t p : / / d o i . o r g / 1 0 . 6 0 2 8 / N I S T . S P 1 8 0 0 - 2 . . Click Save. 9.4 AlertEnterprise Enterprise Guardian Configuration for the CA Build 9.4.1 System Type Import of DB Connector Log into the application. Go to Setup > Manual Configuration > Import/Export. Check System Types, and then click Import.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is Note according to Audit and Evaluation of Computer Security II_ System Vulnerabilities and Controls? Note: No attempt has been made to make this even a representative bibliography. For further material, see Carlstedt [5], almost any of the other references, or any of several more comprehensive, although not necessarily current, bibliographies.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Audit and Evaluation of Computer Security II_ System Vulnerabilities and Controls.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does U.S. Department of Justice Simplified Risk Analysis Guidelines provide? (Section 29) OF DATA 9a. STATE SENSITIVITY LEVEL OF APPLICATION - 9b. STATE CRITICALITY OF APPLICATION <!-- image --> AUTOMATED INFORMATION SYSTEM FACILITY (AIS) PRIORITIZATION OF APPLICATION SYSTEMS - 9A. APPROXIMATE RANKING OF SENSITIVITY OF APPLICATION SYSTEMS PROCESSED ATTHE AIS FACILITY. - 9a RANK CRITICALITY LEVEL OF EACH APPLICATION WITH RESPECT TO THE FUNCTIONS EACH AIS APPLICATION SUPPORTS. WORKFORM 4 PRIORITIZATION OF SENSITIVITY AND CRITICALITY OF APPLICATIONS Component Application Name System Owner Criticality of Application (please check one) Vital The organization could not accomplish its mission without the application. Important The application is necessary for the organization to perform its mission in a cost-effective and timely manner. Useful The application improves productivity or saves costs but is not essential to operations. Estimate of impact on organization if processing of application is interrupted for various periods of time. Application system owners are requested to estimate the loss if the application cannot be processed for the periods of time listed. The loss estimate should consider the impact on mission operations, the cost of using a manual back-up system, any idle manpower or equipment, and losses in the effectiveness and efficiency of the DOJ project. Please estimate the losses for each delay listed (hour to one month) as I, L, M, H, or C considering the following: I - Insignificant (less than $1,000). L - Low ($1,000 to $10,000). M - Moderate ($10,000 to $100,000). H - High ($100,000 to $1,000,000). C - Catastrophic (over $1,000,000). 1 Hour 1 Day 2 Weeks 2 Hours 2 Days 1 Month 4 Hours 1 Week Have plans been developed to process the application system elsewhere if processing is interrupted? Yes No If yes, describe the plans. - 3.1. Microcomputers/Personal Computers (PCs).

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: U.S. Department of Justice Simplified Risk Analysis Guidelines.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control IP-3 in Data Integrity_ Recovering from Ransomware and Other Destructive Events? (Part 125) Control IP-3: ies you wish to exclude. For example, we chose to exclude C:\Users\*\AppData because that provided many false flags of routine application data modification. 17. Check the box next to Stop Recursion . <!-- image --> <!-- image --> 18. Click Finish . 19. The rule created defines a space for the tasks we will create to search through. ## 2.11.2.2 Creating a Baseline Task 1. Click the Tasks link. 2. Click New Task . 3. Select Baseline Rule Task . <!-- image --> <!-- image --> 4. Click OK . 5. Enter a name for the baseline rule task. 6. Select a privileged user in Tripwire Enterprise to run the rule as. 7. Click Next . 8. Select All Baselines . <!-- image --> <!-- image --> 9. Click Next . 10. Expand Root Node Group > Smart Node Groups > System Tag Sets > Operating System . 11. You can select specific types of operating systems to run the task on or specific machines. We selected Operating System to have it run on all applicable Windows machines. 12. Once you have made your selection, click Next . 13. Select Selected nodes with rule or rule group . 14. Click the rule you created earlier. <!-- image --> <!-- image --> 15. Click Next . 16. Decide how often the baseline task should be run. We set it to manually but you can also set a very specific schedule by choosing periodic . 17. Click Finish . 18. This rule will create baselines of the specified objects. Baselines are essentially versions of the file that check rules will compare against. Baselines should be primarily taken when the integrity of files are known to be good. <!-- image --> ## 2.11.2.3 Creating a Syslog Action 1. Click the Actions link. <!-- image --> 2. Click New Action . 3. Select Syslog Action . 4. Click OK . <!-- image --> 5. Enter a name for the Syslog Action. 6. Click Next . 7. Enter the IP address of the Tripwire Log Center server. 8. Enter the port that Tripwire Log Center receives TCP syslog messages on. 9. Enter a log name , a level , and a facility code per your needs.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Data Integrity_ Recovering from Ransomware and Other Destructive Events.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Performance Assurance and Data Integrity Practices say about File Structure? (Part 2) According to Performance Assurance and Data Integrity Practices, File Structure: unt to achieve improved data reliability. 12. Reliability Through File Redundancy: Some file systems carry checksums over into the data base to assure that data quality does not deteriorate over time. The more advanced systems carry separate checksums, one for the control information and the other for the data values. 13. Reliability Through Input Redundancy: Additional redundancy can be built into input messages (at the cost of increasing the input character count) to provide context information for edit programs, to allow meaningful correction (in some instances), and to allow meaningful operator dialogs in an on-line system. This redundant information takes several forms: check words, double entries, check digits, and batch totals. 14. Redundancy for Audit: Within the data base, additional information can be carried in the record header to provide the basic parameters for certain types of integrity audits. Specifically, a record header could contain the identifier associated with the last program to update the record, the date of that last update, the time of that update, and the transaction sequence number causing the update. 15. Data Checks on Sequence: When processing input transactions, the effective date of the transaction can be processed by the computer to alert the control group in the event over-age transactions are being processed and in extreme cases to inhibit processing of ancient transactions. When the effective date of the transaction is compared against the effective date of the last transaction to update a data record, out of time sequence transactions can be recognized and manual intervention requested 16. Self-Defining Files for Integrity: One technique for handling very large files (in excess of a dozen full tape reels at 1600 bpi ) involves a file design with a directory on the front of every individual record. The directory describes the structure of the record and contains pointers to every data element contained in the record.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Performance Assurance and Data Integrity Practices.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control HA-3 in Computer Security Division 2011 Annual Report? (Part 59) Control HA-3: rocessing Standard (FIPS) 180-4, Secure Hash Standard (SHS) FIPS 180-3, Secure Hash Standard (SHS) , specifies secure hash algorithms (SHAs) called SHA-1, SHA-224, SHA-256, SHA-384 and SHA-512. These algorithms produce 160, 224, 256, 384, and 512-bit outputs, respectively, which are called message digests. Draft FIPS 180-4 provides a general procedure for creating an initialization hash value, adds two additional secure hash algorithms, SHA-512/224 and SHA-512/256, to the standard, and removes a restriction that padding must be done before hash computation begins, which was required in FIPS 180-3. SHA-512/224 and SHA512/256 may be more efficient alternatives to SHA-224 and SHA-256 on platforms that are optimized for 64-bit operations. Removing the restriction on padding operation in the secure hash algorithms will potentially allow more flexibility and efficiency in implementing the secure hash algorithms in many computer network applications. On February 11, 2011, NIST published a notice in the Federal Register (76 FR 7817) announcing the availability of draft FIPS 180-4 and soliciting comments on the draft standard. Comments were received and are being addressed. FIPS 180-4 is expected to be approved in the near future. NIST will submit the FIPS to the Secretary of Commerce for approval in the first half of FY2012. ## NIST Draft (revised) SP 800-107, Recommendation for Applications Using Approved Hash Algorithms SP 800-107 provides security guidelines for achieving the desired security strengths for cryptographic applications that employ the approved cryptographic hash functions specified in FIPS 180. The current version of this document was published in February 2009. Draft FIPS 180-4 added two new hash algorithms: SHA512/224 and SHA-512/256. SP 800-107 was revised to address the security properties of these new hash algorithms.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Computer Security Division 2011 Annual Report.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Conformance Test Architecture and Test Suite for ANSI_NIST-ITL 1-2007 say about Record-Level Requirements and Assertions? (Part 147) According to Conformance Test Architecture and Test Suite for ANSI_NIST-ITL 1-2007, Record-Level Requirements and Assertions: | 2 | M | 14.006-JP2-JP2L- HLL | {14.006} EQ { Image Width} | 3 | |------------|---------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-----|-----|--------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-----| | | | | 2 | M | 14.006-PNG-HLL | {14.006} EQ { Image Width} | 3 | | | | | 2 | M | 14.006-WSQ-HLL | {14.006} EQ { Image Width} | 3 | | 14.007-VLL | 19.1.7 | Field 14.007 shall contain the number of horizontal lines contained in the | 2 | M | 14.007-JPEGB- JPEGL-VLL | {14.007} EQ { Image Height } | 3 | | | | transmitted image.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Conformance Test Architecture and Test Suite for ANSI_NIST-ITL 1-2007.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Guide to Information Technology Security Services say about D.4.2.2 Establish a Incident Tracking System? According to Guide to Information Technology Security Services, D.4.2.2 Establish a Incident Tracking System: The team shall develop a system for <organization name> to locate pertinent information about previous incidents, links to documentation for known viruses and other malicious code, known vulnerabilities of systems, and key people to contact. The team shall develop an incident tracking system. The COTR will review the Tracking System.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Guide to Information Technology Security Services.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Establishing Wireless Robust Security Networks_ A Guide to IEEE 802.11i provide? (Section 101) for negotiation flow between STAs and APs during the discovery phase. 51 Beacon frames may be configured to transmit periodically from approximately every millisecond to every 66 seconds. Figure 5-5. Beacons Used During the Discovery Phases in an ESS <!-- image --> During the discovery phase, STAs and APs negotiate the following key security capabilities: - GLYPH<c=31,font=/HACNND+Webdings> Confidentiality and integrity protocols for protecting unicast traffic - GLYPH<c=31,font=/HACNND+Webdings> Authentication method for mutual authentication of the AP and AS - GLYPH<c=31,font=/HACNND+Webdings> Cryptographic key management approach - GLYPH<c=31,font=/HACNND+Webdings> Pre-authentication capabilities (described in more detail in Section 5.4.4). Confidentiality and integrity protocols for protecting multicast/broadcast traffic are dictated by the AP, since all STAs in a multicast group must use the same cipher suite. The specification of the confidentiality and integrity protocol, along with the chosen key length (if variable), is known as the cipher suite . The same cipher suite options are available for protecting unicast traffic and multicast and broadcast traffic. 52 The possible cipher suites allowed by the IEEE 802.11i amendment are as follows: - GLYPH<c=31,font=/HACNND+Webdings> WEP, with either a 40-bit or 104-bit key - GLYPH<c=31,font=/HACNND+Webdings> TKIP - GLYPH<c=31,font=/HACNND+Webdings> CCMP, which is the default choice according to the 802.11i standard. In practice, many existing devices default to TKIP. 52 The WEP cipher suites are only valid as a group cipher suite in a Transition Security Network to allow pre-RSNA devices to join a BSS. They are not valid in an RSN. - GLYPH<c=31,font=/HACNND+Webdings> Vendor-specific methods (to allow for flexibility and expansion).

Explanation: NIST publication on credential and access management. Topics: authentication, key management. Contains security framework guidance for authentication systems. Source: Establishing Wireless Robust Security Networks_ A Guide to IEEE 802.11i.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Computer Security Division 2007 Annual Report provide? (Section 133) roposals on technical information system management audits, low power encryption, and signcryption, threeparty entity authentication, responsible vulnerability disclosure, and secure system design. Through its membership on CS1, where Dan Benigni serves as the nonvoting chair, and Richard Kissel is the NIST Primary with vote, NIST contributes to all CS1 national and international IT security standards efforts. NIST can also initiate IT security-related projects for national or international standardization through its membership on CS1. As an example, CSD staffer David Ferraiolo recently discussed initiating a new project in CS1 concerning an access control mechanism that can be embedded into operating systems. Dan Benigni also serves as CS1 Liaison to a new INCITS Study Group on Security Best Practices, whose charter is to study the security needs and requirements of the financial and insurance services industries, assess what is missing in current standards and practices, and make recommendations on an approach to create deployable best practices and frameworks for security in these industries. CS1 has created a task group called CS1.1 RBAC, with one national standards project called 'Requirements for the Implementation of RoleBased Access Control (RBAC)' INCITS Project 1794. This standard will provide implementation requirements for RBAC systems, which use RBAC components defined in INCITS 359-2004. The implementation requirements in this standard are intended to ensure the interchange of RBAC data (e.g., roles, permissions, users) and promote functional interoperability among RBAC services and applications. Within the next several months, this work will be ready for its first public review.

Explanation: NIST publication on credential and access management. Topics: access control, authentication. Contains security framework guidance for authentication systems. Source: Computer Security Division 2007 Annual Report.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is Discussion according to Security and Privacy Controls for Information Systems and Organizations? Discussion: System media includes both digital and non-digital media. Digital media includes

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Security and Privacy Controls for Information Systems and Organizations.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does NIST_SP_800-37r2_Risk_Management_Framework provide? (Section 38) e official for risk management and risk executive (function); 14 and - Establishes responsibility and accountability for controls implemented within information systems and inherited by those systems. The RMF provides a dynamic and flexible approach to effectively manage security and privacy risks in diverse environments with complex and sophisticated threats, evolving missions and business functions, and changing system and organizational vulnerabilities. The framework is policy and technology neutral, which facilitates ongoing upgrades to IT resources 15 and to IT modernization efforts-to support and help ensure essential missions and services are provided during such transition periods. This publication describes the RMF and provides guidelines for managing security and privacy risks and applying the RMF to information systems and organizations. The guidelines have been developed: - To ensure that managing system-related security and privacy risk is consistent with the mission and business objectives of the organization and risk management strategy established by the senior leadership through the risk executive (function); - To achieve privacy protections for individuals and security protections for information and information systems through the implementation of appropriate risk response strategies; - To support consistent, informed, and ongoing authorization decisions, 16 reciprocity, and the transparency and traceability of security and privacy information; 11 Chapter 3 describes the seven steps and associated tasks in the RMF. 12 Section 2.6 describes the relationship between requirements and controls with respect to RMF execution. 13 [OMB FEA] provides guidance on the Federal Enterprise Architecture. 14 [OMB M-17-25] provides guidance on risk management roles and responsibilities. 15 IT resources refer to the information technology component of information resources defined in [OMB A-130].

Explanation: NIST publication on credential and access management. Topics: authorization, sso. Contains security framework guidance for authentication systems. Source: NIST_SP_800-37r2_Risk_Management_Framework.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Criticality Analysis Process Model_ Prioritizing Systems and Components provide? (Section 60) | | Methods | Document Review; Group Decision Making | | Related processes outside of criticality analysis | [FIPS 199] [NIST SP 800-39] - (3.1) Framing Risk | 6 For further guidance on example security measures and metrics, see Appendix A of NIST SP 800-55 Revision 1, Performance Measurement Guide for Information Security.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: nist sp, fips, security control. General security reference material without sensitive content. Source: Criticality Analysis Process Model_ Prioritizing Systems and Components.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Assessing Security Requirements for Controlled Unclassified Information say about REFERENCES? According to Assessing Security Requirements for Controlled Unclassified Information, REFERENCES: Source Assessment Procedures: SC-08, SC-08(01), SC-28, SC-28(01)

Explanation: NIST publication discussing classified information handling. References: classified, controlled unclassified. Contains guidance on protecting sensitive government information. Source: Assessing Security Requirements for Controlled Unclassified Information.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control WE-125 in Bug Framework (BF)_ Formalizing Cybersecurity Weaknesses and Vulnerabilities? (Part 67) Control WE-125: g., SQL injec/t\_i.ligaon) and Source Code Injec/t\_i.ligaon (e.g., Cross Site Scrip/t\_i.ligang (XSS)). Injec/t\_i.ligaons enable the following security failures: IEX, TPR, ACE, and its sub-case RCE. Avoiding the BF DVR bugs (i.e., missing or erroneous veri/uniFB01ca/t\_i.ligaon or under-restric/t\_i.ligave or over-restric/t\_i.ligave veri/uniFB01ca/t\_i.ligaon) and faults (i.e., invalid data) guarantees safety from errors, such as Wrong Value , Inconsistent Value , and Wrong Type . ## 9.2. Memory Safety Memory safety has both temporal and spa/t\_i.ligaal aspects that depend on pointer safety. Temporal memory safety ensures that an object memory is only accessed or used during its life cycle and only via its proper pointers (owners). Access is via BF MAD Dereference of a pointer to the object; use is via BF MUS Read or Write of object data. The /uniFB01rst opera-/t\_i.ligaon over an allocated object must be BF MUS Ini/t\_i.ligaalize Object , and the last one before it is deallocated must be BF MUS Clear (see Fig. 9). Memory safety ensures the proper access and use of memory in code. That is, pointers to objects are properly ini/t\_i.ligaalized, dereferenced, reposi/t\_i.ligaoned, or reassigned, and objects are properly allocated, ini/t\_i.ligaalized, read, wri/t\_t.ligaen, resized, cleared, or deallocated. It is addressed by the BF Memory Bugs Model (see Fig. 9) opera/t\_i.ligaon /uniFB02ow and the BF MAD, MMN, and MUS classes (see BF MEM at [1]) that de/uniFB01ne why, where, and how memory safety could break. Examples of temporal memory safety are unini/t\_i.ligaalized object, use a/f\_t.ligaer deallocate (i.e., use a/f\_t.ligaer free or use a/f\_t.ligaer return in C), and double deallocate (i.e., double free in C) safety. The /uniFB01rst prevents the use of non-meaningful data values, the second prevents the use of data values via dangling pointers, and the third prevents the dealloca/t\_i.ligaon of deallocated objects via dangling pointers.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Bug Framework (BF)_ Formalizing Cybersecurity Weaknesses and Vulnerabilities.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Summary of NIST SP 800-53, Revision 4_ Security and Privacy Controls for Federal Information Systems and Organizations provide? (Section 2) | 1 | Introduction ............................................................................................................1 | |------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------| | 2 | NIST SP 800-53 Revision 4 and the Risk Management Framework (RMF)........2 | | 3 | Control Baselines and Tailoring ...........................................................................4 | | 4 | Documenting the Control Selection Process ......................................................5 | | 5 | Assurance...............................................................................................................6 | | 6 | Security Controls ...................................................................................................7 | | 7 | International Information Security Standards .....................................................8 | | 8 | Overlays..................................................................................................................9 | | 9 | Privacy ..................................................................................................................10 | | List of Figures | List of Figures | | Figure 1: Risk Management 3-Tiered Approach.........................................................2 | Figure 1: Risk Management 3-Tiered Approach.........................................................2 | | Figure 2: The Risk Management Framework ..............................................................3 | Figure 2: The Risk Management Framework ..............................................................3 | | Figure 3: Security Control Selection Process ............................................................5 | Figure 3: Security Control Selection Process ............................................................5 | In April, 2013, NIST published an update, Revision 4, to NIST Special Publication 800-53, Security and Privacy Controls for Federal Information Systems and Organization .

Explanation: NIST cybersecurity documentation and standards guidance. Topics: nist sp, risk management framework, rmf. General security reference material without sensitive content. Source: Summary of NIST SP 800-53, Revision 4_ Security and Privacy Controls for Federal Information Systems and Organizations.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Recommendation for Key Management_ Part 1 – General say about B.3 Conditions Under Which Keying Material Needs to be Recoverable? According to Recommendation for Key Management_ Part 1 – General, B.3 Conditions Under Which Keying Material Needs to be Recoverable: The decision as to whether to back up or archive keying material for possible key recovery should be made on a case-by-case basis and should be based on the list provided in Section 8.2.2.2. When the key-recovery operation is requested by the key's owner, the following actions shall be taken: 1. If a lost key may have been compromised, then the key shall be replaced as soon as possible after recovery in order to limit the exposure of the recovered key and the data it protects (see Section 8.2.3.1). This could include reapplying the protection on the protected data using the new key. 2. If the key becomes inaccessible or has been modified, but compromise is not suspected, then the key may be recovered and used as discussed in Section 9.4.2. The following subsections provide discussions to assist an organization in determining whether or not key recovery is needed. Although the following discussions address only the recoverability of keys, any of the key information (e.g., the metadata associated with the key) shall also be recoverable.

Explanation: NIST publication on credential and access management. Topics: key management, sso. Contains security framework guidance for authentication systems. Source: Recommendation for Key Management_ Part 1 – General.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is C Compiler according to Validated Products List 1995 no. 4_ Programming Languages, Database Language SQL, Graphics, POSIX, Computer Security, Product Data - IGES, OSI? C Compiler: Sun C Compiler Version: 2.0 Release: 20 May 1992

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Validated Products List 1995 no. 4_ Programming Languages, Database Language SQL, Graphics, POSIX, Computer Security, Product Data - IGES, OSI.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Computer Security Division 2011 Annual Report provide? (Section 60) cifications in the reference. This involves testing the components of the algorithm to assure that they are implemented correctly. The Monte Carlo Test is designed to exercise the entire IUT . This test is designed to detect the presence of implementation flaws that are not detected with the controlled input of the Known Answer Tests. The types of implementation flaws detected by this validation test include pointer problems, insufficient allocation of space, improper error handling, and incorrect behavior of the IUT . The Multi-Block Message Test (MMT) is designed to test the ability of the implementation to process multi-block messages, which require the chaining of information from one block to the next. Automated security testing and test suite development are integral components of the CAVP . The CAVP encompasses validation testing for FIPS-approved and NIST-recommended cryptographic algorithms. Cryptographic algorithm validation is a prerequisite to the CMVP . The testing of cryptographic algorithm implementations is performed by independent third-party laboratories that are accredited as Cryptographic and Security Testing (CST) laboratories by the NIST National Voluntary Laboratory Accreditation Program (NVLAP). The CAVP develops and maintains a Cryptographic Algorithm Validation System (CAVS) tool that automates the cryptographic algorithm validation testing.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Proceedings of the Privilege Management Workshop, September 1-3, 2009 provide? (Section 12) Accountability Act (HIPAA) will be the standard with which everyone must comply. This would take the pressure off the U.S. government and place responsibility onto the owners and stewards of the data. | |---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | 60-80% of the medical practitioners are not from 'technical' backgrounds. Does that shift concerns away from privacy and onto availability of the health data? | Yes. The more medical practitioners rely on online data, the more this reliance will drive the requirements for availability guarantees. |

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Proceedings of the Privilege Management Workshop, September 1-3, 2009.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is https according to Enhancing Resilience of the Internet and Communications Ecosystem_ A NIST Workshop Proceedings? https: //doi.org/10.6028/NIST.IR.8192

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Enhancing Resilience of the Internet and Communications Ecosystem_ A NIST Workshop Proceedings.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control SI-11 in Guidelines for Smart Grid Cybersecurity? (Part 135) Control SI-11: ations for PEV potential privacy issues should be explored as technology solutions are deployed going forward. System and infrastructure architects and engineers should stay aware of potential issues. Section 5.9 Awareness and Training Organizations involved within the smart grid should provide privacy and information security training, supported by ongoing awareness communications, to their workers that have job responsibilities involving customer and energy usage data. Organizations should also consider providing information to their customers and the public to help them to better understand the privacy issues related to the smart grid, along with how the organization is working to mitigate the associated risks, and also steps the public can take to better protect their own privacy. Utilities, State PUCs/PSCs, Third Party providers, and consumer advocacy groups should consider using these as a starting point to help them effectively and efficiently plan for privacy education programs as they may relate to smart grid privacy. Section 5.10 Mitigating Privacy Concerns within the Smart Grid  Perform privacy impact assessments (PIAs). Any organization that collects personal information, or information that can reveal information about personal activities, can identify areas where privacy protections are necessary by performing a PIA. A PIA can be performed internal to the organization, or by an objective outside entity.  Perform Audits. An audit is a structured evaluation of a person, organization, system, process, enterprise, project or product. Audits can be used to determine compliance levels with legal requirements, to identify areas where policies are not being followed, and so on. An audit should ideally be performed by an objective entity that is not a member of the area being audited. 58  Utilize the Privacy Use Cases. Use cases can help smart grid architects and engineers build privacy protections into the smart grid.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control, assessment. General security reference material without sensitive content. Source: Guidelines for Smart Grid Cybersecurity.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Guidelines for Smart Grid Cybersecurity provide? (Section 512) stems - CIS and TCS being the most likely applications. Care must be exercised by field resources who may have printouts, smart device displays, or laptop displays that contain customer personal data. Any reports on these non-operational activities should be assessed from a privacy perspective to ensure that if any personal data is included that appropriate safeguards are taken to limit exposure to authorized utility or Contracted Agent resources. 5.6 Data used to specify location could reveal personal data associated with the location. Determine what data is used in any reports and who has access to these reports in digital or print formats. Location- based information may be considered privacy information itself. 5.7 Access to personal data should be limited to only that necessary to accomplish job responsibilities. 5.8 Different applications keep information for differing periods of time. CIS might keep data about outages that impacted a specific customer in that specific customer's file for a long time. Some historical data can be very helpful to identifying future maintenance needs, assess equipment performance, or determine meter upgrade schedules. This data may be indefinitely held, but should be anonymized, i.e. stripped of personal data, so that it is associated with a meter number but not personal data or energy usage information. 5.9 Assess how long any reports generated on non-operational activities are retained. Create policy safeguards for any reports that must contain personal data. AICPA Principle Applies: X Notes 5.10 Management Principle X 5.11 Notice Principle X Policies and procedures should exist for the data collected, used, shared and stored for non- operational meter reading, configuration, or other activities. A position should exist with assigned accountability for ensuring such policies and procedures exist, are effectively communicated to all personnel, and are followed.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Guidelines for Smart Grid Cybersecurity.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Integrating Cybersecurity and Enterprise Risk Management (ERM) say about 3.4 Prioritize Risks? (Part 1) According to Integrating Cybersecurity and Enterprise Risk Management (ERM), 3.4 Prioritize Risks: 3.4 Prioritize Risks After identifying and analyzing applicable risks and recording them in the cybersecurity risk register, the priorities of those risks should be determined and indicated. This is accomplished by determining the exposure presented by each risk (i.e., based on the likelihood that a threat event will occur and result in an adverse impact). 29 A cybersecurity risk can have adverse effects on achieving organizational objectives. Based on the analysis conducted using the processes described in Section 3.3, such effects could range from negligible to severe, so exposure determination is important. Additionally, since organizations have limited resources, it is helpful to sort the risks within the register in order of importance to prioritize risk response. In the cybersecurity risk register (CSRR) template in Figure 4, this result helps complete the priority column. 30 When completing the Priority column of the CSRR, consider the following: - How to combine the calculations of likelihood and impact to determine exposure 31 - How to determine and measure the potential benefits from pursuing a particular risk response - When to seek additional guidance on how to evaluate risk exposure levels, such as while evaluating exposures germane to risk tolerance statements Practitioners use both qualitative and quantitative models for calculating and communicating about exposure. Figure 5 (derived from Table I-2 of NIST SP 800-30) demonstrates the use of qualitative descriptors for likelihood and impact as well as how these might be used to determine an overall exposure value. Each risk is evaluated in light of the risk's likelihood and impact and determined during risk analysis. The thresholds for ranges of exposure can be established and published as part of the enterprise governance model and used by stakeholders to prioritize each risk in the register. Figure 5: Likelihood and Impact Matrix Derived from NIST SP 800-30 Rev.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: nist sp, fips, security control. General security reference material without sensitive content. Source: Integrating Cybersecurity and Enterprise Risk Management (ERM).


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Cybersecurity of Genomic Data provide? (Section 93) Loren Buhle (DNAnexus) Session 3 Cybersecurity Challenges for Genomic Data Storage: Xiaofeng Wang (Indiana University) Moderated Q&A: Jianqing Liu (University of Alabama in Huntsville) Session 4 Privacy Challenges for Genomic Data: Sumitra Muralidhar (Veterans Affairs Million Veterans Program), Natalie Ram (University of Maryland Carey School of Law) Moderated Q&A: Julie Snyder (MITRE) Session 5 Current and Future Genomic Data Use Challenges: Gail Jarvik (American Society of Human Genetics [ASHG]), Ankit Malhotra (Amazon Web Services [AWS]), Heidi Sofia (NIH National Human Genome Research Institute [NHGRI]) Moderated Q&A: Nick Cochran (HudsonAlpha) | | Segment 5: Open Lightning Round | Audience Insights: Li-San Wang (University of Pennsylvania) | | Segment 6: Next Steps | Close Out: Ron Pulivarti (NIST) | Table 3.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Cybersecurity of Genomic Data.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is Acquisition Consistency according to Cell Phone Forensic Tools_ an Overview and Analysis? Acquisition Consistency: Two consecutive acquisition produce different hashes on the following database files: \Categories Database, \ConfigMetabase, SchedSync.dat, DB\_notify\_events, DB\_notify\_queue, pmailFolders, pmailMsgClasses, pmailNamedProps, pmailServices, and Speed.db. (Below)

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Cell Phone Forensic Tools_ an Overview and Analysis.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Guideline for Using Cryptographic Standards in the Federal Government_ Cryptographic Mechanisms provide? (Section 87) e warning and continue operations or to simply discontinue operations. This warning must not be taken lightly. Ignoring the warning means that the user is accepting the risks associated with doing so. For example, if a warning indicates a compromised digital signature certificate, there is a possibility that someone other than the claimed owner of the certificate actually used the private key corresponding to the public key to sign data. Depending on the data, it may not be prudent to ignore the warning. Users should consult with their organizations to determine how to respond to this warning. A PKI consists of at least one CA with its subscribers, as shown in Figure 5. Each of the subscribers (e.g., User 1, User 2, and User 3) obtains a certificate containing their public key and other information, which is signed by their CA. All CA subscribers are provided with the public key of the CA. As a basic example of how this works, suppose that User 3 signs a document and sends the signed document to User 1, who needs to verify the contents and source of the signed document. This is accomplished as follows: 1. User 1 obtains the certificate containing the public key that corresponds to the private key used to sign the document (i.e., User 1 obtains User 3's certificate). Either User 3 supplies that certificate or the certificate is obtained from some other source (e.g., the CA). 2. User 1 verifies User 3's certificate using the CA's public key. 3. User 1 then employs the public key in User 3's certificate to verify the signature on the signed document received from User 3. If the signature is successfully verified, then User 1 knows that User 3 generated the signature, and no unauthorized modifications were made to the document after the signature was generated. <!-- image --> Other more-complicated scenarios exist when users subscribing to different CAs need to interact using CAs that have cross-certified by signing a certificate for each other.

Explanation: NIST publication on credential and access management. Topics: pki, sso. Contains security framework guidance for authentication systems. Source: Guideline for Using Cryptographic Standards in the Federal Government_ Cryptographic Mechanisms.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Guidelines for Smart Grid Cybersecurity provide? (Section 658) lemented security program in terms of conformance to policy, determine whether there is a need to enhance policies and procedures, and evaluate the robustness of the implemented security technologies. 6.2.3.2 Inadequate Security Oversight by Management Description Inadequate oversight and commitment by management can result in a suboptimal security cyberculture throughout the organization. Optimal risk management practices begin from the top 7 tier of the organization. Without senior management oversight and ownership, it is very difficult to maintain and fund a successful cybersecurity security program. Potential Impact Lack of clear senior management ownership of a security program makes it almost impossible to enforce the provisions of the program in the event of a policy being compromised or abused. 6.2.3.3 Inadequate Continuity of Operations or Disaster Recovery Plan Description An inadequate continuity of operations/disaster recovery plan can result in lacking or no procedures in place to ensure the continuation or restoration of operations in the event of a security incident. A continuity of operations/disaster recovery plan should include roles, responsibilities, training, periodic testing and exercises, and continuity of operations/disaster recovery plan updates, as well as identification of alternative storage sites, alternative command and control centers and methods, recovery and reconstitution, as well as fail-safe responses. Potential Impact An inadequate continuity of operations or disaster recovery plan could result in longer than necessary recovery from a possible plant or operational outage. 6.2.3.4 Inadequate Risk Assessment Process Description Lack of a robust risk assessment process can result in an inaccurate risk determination. This risk determination ultimately impacts the organization’s understanding of what risks it faces and the associated policies, processes, and security mitigations that are implemented.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control IP-1 in Data Integrity_ Identifying and Protecting Assets Against Ransomware and Other Destructive Events? (Part 146) Control IP-1: --> 12. Select the Active Directory domain controller. 13. Click OK. 14. Check the box next to the selected domain controller. 15. Click Edit. 16. Enter credentials for an administrator account. 17. Click Save. 18. Click Config WMI. 19. Click OK. <!-- image --> <!-- image --> 20. Click OK when this configuration finishes. 21. Navigate to Administration > System > Settings > Client Provisioning. 22. Set Enable Automatic Download to Enable. 23. Click Save. 24. Navigate to Administration > Identity Management > External Identity Sources > Active Directory. 25. Click the Groups tab. 26. Click Add > Select Groups from Directory. 27. Click Retrieve Groups. (This should populate the window with the groups from Active Directory.) 28. Select them all. <!-- image --> <!-- image --> 29. Click OK. (If you add more groups to Active Directory they can be imported in the same way in the future.) 30. Click the Attributes tab. 31. Click Add > Select Attributes from Directory. 32. Enter a username. 33. Click Retrieve Attributes. (This will populate the window with Active Directory's available attributes, so they can be used for policy in Cisco ISE.) 34. Click OK. 35. Select any desired attributes. <!-- image --> 36. Click OK. 37. Click Save. ## 2.16.6 Policy Enforcement: Developing Policy Conditions 1. Navigate to Policy > Policy Elements > Conditions > Posture. 2. Expand the Posture section. This will reveal a list of categories for conditions. (Note: These conditions allow you to select or define requirements that endpoints should meet. In typical enterprises, these conditions can be used as requirements to gain network access-however, this strongly depends on the capabilities of your network device.) 3. As an example, we will require that Cisco AMP be installed on all Windows devices. If you are using a different anti-malware software, locate that instead. Click Anti-Malware Condition. <!-- image --> 4. Click Add. 5. Enter a name. 6.

Explanation: NIST cybersecurity publication covering vulnerability management. Topics: malware, ransomware. Contains technical security guidance that could inform defensive posture. Source: Data Integrity_ Identifying and Protecting Assets Against Ransomware and Other Destructive Events.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Cybersecurity Framework Profile for Electric Vehicle Extreme Fast Charging Infrastructure say about 5.2.3. Data Security Category? (Part 19) According to Cybersecurity Framework Profile for Electric Vehicle Extreme Fast Charging Infrastructure, 5.2.3. Data Security Category: | This may include metering data collected about energy consumed, information used to manage loads and balance power, and local breaker/switchgear control commands. | ISA/IEC 62443-2- 1:D4E1 ORG 2.2, DATA 1.2, USER 1.16 ISA/IEC 62443-3- 3:2013 SR 3.1, SR 3.3, SR 3.4, SR 3.8 | | DS-7: The development and testing environment(s) are separate from the production environment. | Ecosystem: Separating development and testing environments from production environments is considered a best practice. Exceptions, such as early release (e.g., beta versions), can be managed closely while trying to keep as much separation as possible between development and production.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: cybersecurity framework, fips, security control. General security reference material without sensitive content. Source: Cybersecurity Framework Profile for Electric Vehicle Extreme Fast Charging Infrastructure.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Approaches to Privacy and Security in Computer Systems_ Proceedings of a Conference Held at the National Bureau of Standards March 4-5, 1974 say about CURRENT LEGISLATIVE PROPOSALS IN CONGRESS? (Part 3) According to Approaches to Privacy and Security in Computer Systems_ Proceedings of a Conference Held at the National Bureau of Standards March 4-5, 1974, CURRENT LEGISLATIVE PROPOSALS IN CONGRESS: ned that the worst enemy of privacy is not the computer -its worst enemy is apathy and ignorance. I am pleased that the President addressed himself to privacy in his recent State of the Union Address. Just a few days ago, he announced the formation of a commission on the issue of Privacy and Data Banks in our country. Suffice to say, it does us little good to attack the computer -it is only an instrument of man. \^Tiat must be attacked is the computer mentality-the kind of faceless bureaucracy in and out of Governxnent that seeks to make the computer a supreme being. The potential of privacy invasion is always present in a sophisticated computer operation. Remarkably, the misuse of information held about individuals in computer systems has been held to a minimum. But the potential for misuse is still there, and certainly data surveillance has grown to very menacing proportions due to the technological advances which alter such information Given multiple use and consolidation through automated systems. Substantial increases in demand for personal reports by Government Agencies, Private Systems, and Social Science Researchers have intensified the severity of the problem. As you know, it is not enough for us to discuss the technology of the computer and speak of privacy in an abstract fashion. We must resolve, at this Conference, and in every other private and public forum to do what is necessary to protect our constitutional right to privacy. Let us make no mistake about it. the computer already knows more about most of us than we know about ourselves. The amount of data held in computer systems is enormous. Think about it for a moment. The list includes tax returns, census responses, social security data, military records, security files, finger prints, FHA and VA mortgage guarantees, credit records, health data, and social research involving individuals. Such examples are barely the tip of the iceberg.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Approaches to Privacy and Security in Computer Systems_ Proceedings of a Conference Held at the National Bureau of Standards March 4-5, 1974.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations provide? (Section 38) h, compromise, or otherwise adversely impact a system. Social engineering includes phishing, pretexting, impersonation, baiting, quid pro quo, threadjacking, social media exploitation, and tailgating. Social mining is an attempt to gather information about the organization that may be used to support future attacks. Security literacy training includes how to communicate employee and management concerns regarding potential indicators of insider threat and potential and actual instances of social engineering and data mining through appropriate organizational channels in accordance with established policies and procedures. Source Controls: AT-02, AT-02(02), AT-02(03) Supporting Publications: SP 800-50 [32], SP 800-160-2 [10] - a. Provide role-based security training to organizational personnel: 1. Before authorizing access to the system or CUI, before performing assigned duties, and [ Assignment: organization-defined frequency ] thereafter 2. When required by system changes or following [ Assignment: organizationdefined events ]. - b. Update role-based training content [ Assignment: organization-defined frequency ] and following [ Assignment: organization-defined events ]. Organizations determine the content and frequency of security training based on the assigned duties, roles, and responsibilities of individuals and the security requirements of the systems to which personnel have authorized access. In addition, organizations provide system developers, enterprise architects, security architects, software developers, systems integrators, acquisition/procurement officials, system and network administrators, personnel conducting configuration management and auditing activities, personnel performing independent verification and validation, security assessors, and personnel with access to system-level software with securityrelated technical training specifically tailored for their assigned duties.

Explanation: NIST publication discussing classified information handling. References: classified, controlled unclassified, cui. Contains guidance on protecting sensitive government information. Source: Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Requirements for Cryptographic Accordions say about Publication History? According to Requirements for Cryptographic Accordions, Publication History: Approved by the NIST Editorial Review Board on 2025-04-02

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Requirements for Cryptographic Accordions.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Validated Products List 1995 no. 4_ Programming Languages, Database Language SQL, Graphics, POSIX, Computer Security, Product Data - IGES, OSI provide? (Section 133) raft, Inc. VR204801 C Compiler: SCO UNIX* Development System Release 3.2v4.2 APTL: 100342 Mindcraft, Inc. 151-2SEQ001 Issued: 04/12/94 Type: Native Product Supplier: Sequent Computer Systems Inc. Product: DYNIX/ptx Version 4.0.0 PCD: DYNIX/ptx POSIX.1 Conformance Specification Part Number 1003-49622-04 GTI - Supported by Product MFS - Supported by Product MC - Supported by Product AP - Supported by Product Computer Hardware Supplier: Sequent Computer Systems Inc. Computer Hardware Product: Sequent Symmetry Systems SE20 C Compiler: ptx/C (Version 4.0.0) APTL: 100342 Mindcraft, Inc. 151-2SEQ002 Issued: 04/12/94 Type: Native Product Supplier: Sequent Computer Systems Inc. Product: DYNIX/ptx Version 2.1.1 PCD: DYNIX/ptx POSIX.1 Conformance Specification Part Number 1 003-49622-03a GTI - Supported by Product MFS - Supported by Product MC - Supported by Product AP - Supported by Product Computer Hardware Supplier: Sequent Computer Systems Inc. Computer Hardware Product: Sequent Symmetry Systems SE60 C Compiler: ptx/C (Version 2.1.1) APTL: 100342 Mindcraft, Inc. 151-2SGI001 Issued: 03/07/95 Type: Native Product Supplier: Silicon Graphics, Inc. Product: IRIX 5.3 with patches 278, 279, and 280 PCD: IRIX 5.3 POSIX.1 Conformance Document GTI - Supported by Product MFS - Supported by Product MC - Not provided by product AP - Supported by Product Computer Hardware Supplier: Silicon Graphics, Inc. Computer Hardware Product: Indigo 2 C Compiler: IRIX Development Option 5.3 (SC4-IDO-5.3) APTL: 100342 Mindcraft, Inc. 151-2SGI002 Issued: 03/07/95 Type: Native Product Supplier: Silicon Graphics, Inc. Product: IRIX 5.3 with patches 278, 279, and 280 PCD: IRIX 5.3 POSIX.1 Conformance Document GTI - Supported by Product MFS - Supported by Product MC - Not provided by product AP - Supported by Product Computer Hardware Supplier: Silicon Graphics, Inc.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is Contact according to Computer Security Division 2012 Annual Report? Contact: Dr. Lily Chen (301) 975-6974 llchen@nist.gov

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Computer Security Division 2012 Annual Report.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Building Secure Microservices-based Applications Using Service-Mesh Architecture provide? (Section 4) e discovery. The availability requirement calls for: (a) resiliency techniques, such as load balancing, circuit breaking, and throttling, and (b) continuous monitoring (for the health of the service). The service mesh is the best-known approach that can facilitate specification of these requirements at a level of abstraction such that it can be uniformly and consistently defined while also being effectively implemented without making changes to individual microservice code. The purpose of this document is to provide deployment guidance for proxy-based Service Mesh components that collectively form a robust security infrastructure for supporting microservices-based applications. API gateway; Application Programming Interface (API); circuit breaker; load balancing; microservices; Service Mesh; service proxy. The authors like to express their sincere thanks to Brandon Lum, Senior Software Engineer at IBM Thomas J. Watson Research Center for his extensive, insightful feedback. They also express thanks to Isabel Van Wyk of G2-Inc and Tia Lo u den of Tetrate Inc. for their detailed editorial review. NOTICE: The Information Technology Laboratory (ITL) has requested that holders of patent claims whose use may be required for compliance with the guidance or requirements of this publication disclose such patent claims to ITL. However, holders of patents are not obligated to respond to ITL calls for patents and ITL has not undertaken a patent search in order to identify which, if any, patents may apply to this publication. As of the date of publication and following call(s) for the identification of patent claims whose use may be required for compliance with the guidance or requirements of this publication, no such patent claims have been identified to ITL. No representation is made or implied by ITL that licenses are not required to avoid patent infringement in the use of this publication.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control, continuous monitoring. General security reference material without sensitive content. Source: Building Secure Microservices-based Applications Using Service-Mesh Architecture.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control AC-3 in Mobile Application Single Sign-On_ Improving Authentication for Public Safety First Responders? (Part 176) Control AC-3: A few lines of Python can get the SAML response into a readable format. In this example, the value above has been saved to a file called samlresp.txt : ``` $ python Python 2.7.10 (default, Feb 7 2017, 00:08:15) [GCC 4.2.1 Compatible Apple LLVM 8.0.0 (clang-800.0.34)] on darwin ``` ``` Type "help", "copyright", "credits" or "license" for more information.

Explanation: NIST publication on credential and access management. Topics: authentication, single sign-on. Contains security framework guidance for authentication systems. Source: Mobile Application Single Sign-On_ Improving Authentication for Public Safety First Responders.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Securing Electronic Health Records on Mobile Devices say about puppet will install here? (Part 95) According to Securing Electronic Health Records on Mobile Devices, puppet will install here: ords on Mobile Devices 13 T h i s p u b l i c a t i o n i s a v a i l l a b e f r e e o f c h a r g e f r o m : h t t p : / / d o i . . o r g / 1 0 6 0 2 8 / N I S T . S P . 1 8 0 0 - 1 . NIST Cybersecurity Framework v1.1 Sector-Specific Standards & Best Practices Security Characteristics Function Category Subcategory PR.DS-3: Assets are formally managed throughout removal, transfers, and disposition PR.DS-6: Integrity checking mechanisms are used to verify software, firmware, and information integrity NIST SP80 0-53 Rev 4 CM-8, MP-6, PE-16 IEC/ISO27002 7.1.1, 7.1.2, 9.1.6, 9.2.6, 9.2.7, 10.7.1, 10.7.2, 10.7.3 20 Critical Security Controls CSC-1, CSC-2 SC-16, SI-7 10.4.1, 12.2.2, 12.2.3 CSC-3 HIPAA Security Rule [2] 45 C.F.R. §§ 164.308(a)(1)(ii)(A), 164.310(a)(2)(ii), 164.310(a)(2)(iii), 164.310(a)(2)(iv), 164.310(d)(1), 164.310(d)(2) 45 C.F.R. §§ 164.308(a)(1)(ii)(D), 164.312(b), 164.312(c)(1), 164.312(c)(2), 164.312(e)(2)(i) NIST SP 1800-1D: Securing Electronic Health Records on Mobile Devices 14 T h i s p u b l i c a t i o n i s a v a i l l a b e f r e e o f c h a r g e f r o m : h t t p : / / d o i . . o r g / 1 0 6 0 2 8 / N I S T . S P . 1 8 0 0 - 1 . NIST Cybersecurity Framework v1.1 Sector-Specific Standards & Best Practices Security Characteristics Function Category Subcategory Information Protection Processes and Procedures (PR.IP) PR.IP-1: A baseline configuration of information technology/ industrial control systems is created and maintained incorporating security principles (e.g. concept of least functionality) 20 Critical Security Controls CSC-2, CSC-3, CSC-4, CSC-7, CSC-13 HIPAA Security Rule [2] 45 C.F.R.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: nist sp, cybersecurity framework, fips. General security reference material without sensitive content. Source: Securing Electronic Health Records on Mobile Devices.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Minimum Security Requirements for Federal Information and Information Systems say about 10. Qualifications.? According to Minimum Security Requirements for Federal Information and Information Systems, 10. Qualifications.: The application of the security controls defined in NIST Special Publication 800-53 required by this standard represents the current state-of-the-practice safeguards and countermeasures for information systems. The security controls will be reviewed by NIST at least annually and, if necessary, revised and extended to reflect: (i) the experience gained from using the controls; (ii) the changing security requirements within federal agencies; and (iii) the new security technologies that may be available. The minimum security controls defined in the low, moderate, and high security control baselines are also expected to change over time as well, as the level of security and due diligence for mitigating risks within federal agencies increases. The proposed additions, deletions, or modifications to the catalog of security controls and the proposed changes to the security control baselines in NIST Special Publication 800-53 will go through a rigorous, public review process to obtain government and private sector feedback and to build consensus for the changes. Federal agencies will have up to one year from the date of final publication to fully comply with the changes but are encouraged to initiate compliance activities immediately.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: nist sp, fips, security control. General security reference material without sensitive content. Source: Minimum Security Requirements for Federal Information and Information Systems.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control PS-15413 in Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations? (Part 92) Control PS-15413: ntal guidance, see control enhancements. Departments and agencies should refer to Appendix F to implement this guidance in accordance with Executive Order 14028, Improving the Nation's Cybersecurity . ## Control Enhancement(s): - (6) LEAST PRIVILEGE | PRIVILEGED ACCESS BY NON-ORGANIZATIONAL USERS Supplemental C-SCRM Guidance: Enterprises should ensure that protections are in place to prevent non-enterprise users from having privileged access to enterprise supply chain and related supply chain information. When enterprise users include independent consultants, suppliers, developers, system integrators, external system service providers, and other ICT/OT-related service providers, relevant access requirements may need to use least privilege mechanisms to precisely define what information and/or components are accessible, for what duration, at what frequency, using what access methods, and by whom. Understanding what components are critical and non-critical can aid in understanding the level of detail that may need to be defined regarding least privilege access for non-enterprise users. - Level(s): 2, 3 ## AC-17 REMOTE ACCESS Supplemental C-SCRM Guidance: Ever more frequently, supply chains are accessed remotely. Whether for the purpose of development, maintenance, or the operation of information systems, enterprises should implement secure remote access mechanisms and allow remote access only to vetted personnel. Remote access to an enterprise's supply chain (including distributed software development environments) should be limited to the enterprise or contractor personnel and only if and as required to perform their tasks. Remote access requirements - such using a secure remote access solution, employing multi-factor authentication, limiting access to specified business hours, limit access to specific assets (not networks) based on role and from specified geographic locations - must be properly defined in agreements.

Explanation: NIST publication on credential and access management. Topics: authentication, multi-factor, privileged access. Contains security framework guidance for authentication systems. Source: Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations.