You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control PM-8200 in Cell Phone Forensic Tools_ an Overview and Analysis? (Part 32) Control PM-8200: in acquisition and examination. Table 3 highlights the key characteristics of each target device, listed roughly from devices with more capabilities to lesscapable devices, rather than alphabetically. Note that the more capable devices listed have a PDA heritage, insofar as they use Windows Mobile, Palm OS, RIM OS, and Symbian operating systems.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Cell Phone Forensic Tools_ an Overview and Analysis.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Workshop on Security Procedures for the Interchange of Electronic Documents_ Selected Papers and Results say about VI. Conclusion? (Part 1) According to Workshop on Security Procedures for the Interchange of Electronic Documents_ Selected Papers and Results, VI. Conclusion: VI. Conclusion The thesis of this paper is that evidentiary issues and security requirements are two sides of the same coin. And in the realm of security "one size" does not fit all, just as in the law of evidence the foundational showing will vary with the particular circumstances. A simple hypothetical problem should elucidate the point. Party A sends Party B an electronic purchase order in standard EDI format. Parties Y and Z do the same. In both cases disputes arise necessitating the use of the two purchase orders as evidence. Here, however, the similarities end. Parties A and B, it turns out, are established trading partners engaged in a regular course of business involving the routine exchange of electronic purchase orders. The transaction at issue involved a standard commercial product and did not carry an extraordinary dollar value. Parties Y and Z, however, are strangers who - although they possess and utilize EDI capabilities have never done business together before. Furthermore, the transaction was of a high dollar value and was for the purchase of a custom manufactured item. Although the two EDI purchase orders were essentially identical, from an evidentiary standpoint the two transactions were totally different. The burden party A must carry in order to have its purchase order admitted into evidence is relatively light. The use of basic security techniques - password access control, generally reliable audit capability, probably the use of a VAN - should suffice to have the evidence admitted. Party Y, however, must bear a heavy evidentiary burden. The controls used by party A would probably not suffice. Strong originator authentication, message integrity, and non-repudiation - probably encryption techniques - should have been used. Likewise, from the standpoint of the Computer Security Act's risk-based standard, the two transactions bear little resemblance.

Explanation: NIST publication on credential and access management. Topics: access control, authentication. Contains security framework guidance for authentication systems. Source: Workshop on Security Procedures for the Interchange of Electronic Documents_ Selected Papers and Results.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Digital Identity Guidelines_ Federation and Assertions say about 5.5. Discovery and Registration? (Part 2) According to Digital Identity Guidelines_ Federation and Assertions, 5.5. Discovery and Registration: anaging discovery and registration. When an RP joins the ecosystem, it registers itself with the trusted service, downloads the CSP's verification keys, and receives an identifier to use with wallets. When the CSP issues attribute bundles to the subscriber-controlled wallet, the subscriber-controlled wallet is informed where it can find the list of valid RP identifiers within the ecosystem. When the RP connects to the wallet, the wallet can verify the RP's identifier without the RP having to register itself directly with the wallet. Likewise, the RP can trust the wallet's verification keys by verifying the CSP's signature over the wallet's verification keys or identifier. - 5.6. Authentication and Attribute Disclosure The decision of whether a federation transaction proceeds and, therefore, an assertion is issued and attributes are released to the RP SHALL be determined by the subscriber acting in the role of the authorized party. The decision MAY be augmented by the use of allowlists and blocklists to allow the wallet to help the subscriber make a decision based on configured policies and trust agreements. The subscriber-controlled wallet MAY remember the subscriber's decision to allow for future actions at the same RP without separate authorization from the subscriber. The use of a stored authorization decision does not supersede the requirement for wallet activation, as discussed in Sec. 5.4. The subscriber-controlled wallet MAY provide a mechanism to remember a disclosure decision by the authorized party (i.e., the subscriber) to apply to future requests from the same RP. If such a mechanism is provided, the subscriber-controlled wallet SHALL disclose to the authorized party that the storage mechanism is in use and SHALL allow the authorized party to revoke such remembered access at a future time. The subscriber-controlled wallet SHOULD provide a means to selectively disclose a subset of the attributes in the attribute bundle from the CSP.

Explanation: NIST publication on credential and access management. Topics: authentication, authorization. Contains security framework guidance for authentication systems. Source: Digital Identity Guidelines_ Federation and Assertions.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Glossary of Computer Security Terminology say about 2) See BELL-LAPADULA MODEL and SECURITY POLICY MODEL.? (Part 7) According to Glossary of Computer Security Terminology, 2) See BELL-LAPADULA MODEL and SECURITY POLICY MODEL.: s) by trying combinations of commands at random to determine their effect. Common usage today is from the press, which uses the word to describe people who "break into" computers for various purposes. (BBD) | |------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | handled by | The term "handled by" denotes the activities performed on data in an AIS, such as collecting, processing, transferring, storing, retrieving, sorting, transmitting, disseminating and controlling. (DODD 5200.28) | | handshaking | Passing control characters between two devices, to control the flow of information. (APR 205-16) | | handshaking procedures | 1) A dialogue between a user and a computer, a computer and another computer, a program and another program for the purpose of Identifying a user and authenticating identity. A sequence of questions and answers is used based on information either previously stored in the computer or supplied to the computer by the Initiator of the dialogue. (AR 380-380; FIPS PUB 39) | | | 2) Synonymous with PASSWORD DIALOGUE.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Glossary of Computer Security Terminology.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Recommendation for Key Management_ Part 1 – General provide? (Section 289) thority), saving the public-key certificate would be an appropriate form of storing the public key; backup or archive storage may be provided by the infrastructure (e.g., by a certificate repository). The public key may be stored in backup storage until the end of the private key's cryptoperiod and may be stored in archive storage as long as required. The private key is used to establish the identity of an entity who is participating in an authenticated communication session. The private authentication key need not be backed up if a new key pair can be generated and distributed in a timely manner in accordance with Section 8.1.5.1. However, if a new key pair cannot be generated quickly, the private key should be stored in backup storage during the cryptoperiod of the private key. The private key shall not be stored in archive storage. A symmetric data-encryption key is used to protect the confidentiality of stored or transmitted data or both. The same key is used initially to encrypt the plaintext data to be protected and later to decrypt the encrypted data (i.e., the ciphertext), thus obtaining the original plaintext. The key needs to be available for as long as any data that is encrypted using that key may need to be decrypted. Therefore, the key should be backed up or archived during this period. In order to allow key recovery, the symmetric data-encryption key should be stored in backup storage during the cryptoperiod of the key and should be stored in archive storage if required. In many cases, the key is protected and stored with the encrypted data. When archived, the key should be wrapped (i.e., encrypted) by an archive-encryption key or by a symmetric key-wrapping key that is wrapped by a protected archive-encryption key. A symmetric data-encryption key that is used only for transmission is used by an originating entity to encrypt data and by the receiving entity to decrypt the ciphertext data immediately upon receipt.

Explanation: NIST publication on credential and access management. Topics: authentication, key management. Contains security framework guidance for authentication systems. Source: Recommendation for Key Management_ Part 1 – General.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations say about REFERENCES? According to Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations, REFERENCES: Source Controls: AC-11, AC-11(01) Supporting Publications: None

Explanation: NIST publication discussing classified information handling. References: classified, controlled unclassified. Contains guidance on protecting sensitive government information. Source: Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control PD-200901022 in Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171? (Part 70) Control PD-200901022: | x | | | SR-2 | Supply Chain Risk Management Plan | \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ TABLE C-12: SECURITY ASSESSMENT REQUIREMENT MAPPINGS | SECURITY REQUIREMENTS | Defense-in-Depth Protection Strategy | Defense-in-Depth Protection Strategy | Defense-in-Depth Protection Strategy | NIST SP 800-53 Relevant Security Controls | NIST SP 800-53 Relevant Security Controls | |-----------------------------|-------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------|----------------------------------------|---------------------------------------------|-------------------------------------------------------| | | PRA | DLO | CRS | | | | 3.12.1e Conduct penetration | testing x | x | | CA-8 | Penetration Testing | | 3.12.1e Conduct penetration | [ Assignment: organization- defined frequency ], leveraging automated scanning tools and ad hoc tests using subject matter experts.

Explanation: NIST publication discussing classified information handling. References: classified, controlled unclassified. Contains guidance on protecting sensitive government information. Source: Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does NIST Big Data Interoperability Framework_ Volume 4, Security and Privacy Version 3 say about E.5.1 Cargo Shipping? (Part 5) According to NIST Big Data Interoperability Framework_ Volume 4, Security and Privacy Version 3, E.5.1 Cargo Shipping: | Event detection | Abnormal events such as cargo moving out of the way or being stationary for unwarranted periods can be detected. | | Fabric | Forensics | Analysis of logged data can reveal details of incidents after they occur. | 3088 3089

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: NIST Big Data Interoperability Framework_ Volume 4, Security and Privacy Version 3.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does 4th Annual PKI R&D Workshop _Multiple Paths to Trust_ Proceedings provide? (Section 329) of DSA optimizations. For the presentation of experiment results, we use cDSA to denote S-BGP with caching, pDSA to denote S-BGP using DSA pre-computation, and cpDSA for S-BGP with both optimizations. In our model, these Table 1: Constants and benchmarks used for simulation. RSA, DSA, and SAS algorithms are based on 1024-bit keys. | | SHA-1 hash | Attestation | S-BGP X.509 Certificate | Identifier | |----------------|--------------|---------------|---------------------------|--------------| | Length (bytes) | 20 | 110 | 600 | 4 | | | RSA | DSA | DSA (p-c) | SAS | |--------------------------|-------|-------|-------------|-------| | Verify Time ( ms ) | 2.5 | 31 | 31 | 2.5 | | Sign Time ( ms ) | 50 | 25.5 | 0.015 | 50 | | Signature Length (bytes) | 128 | 40 | 40 | 128 | | | OCSP request | CRL fetching | |----------------------------|----------------|----------------| | Operation Latency (second) | 0.5-1.0 | 0.5-1.0 | Table 2: Performance rankings for the path authentication schemes we examined | | Convergence | Message Size | Memory | |-------|---------------|----------------|----------| | S-BGP | long | moderate | best | | S-A | shortest | worst | worst | | SAS | longest | best | best | caching strategies store both validated signatures and generated signatures; we use 10 GLYPH<22> s (with a uniformly distributed delta of 5 GLYPH<22> s ) to model the lookup time. The S-A scheme will not speed up by caching hash trees with signatures, because the trees, and hence the signatures, are constantly changing even for the same route announcement (since the trees depend on the context of what else is being signed at that time).

Explanation: NIST publication on credential and access management. Topics: authentication, pki. Contains security framework guidance for authentication systems. Source: 4th Annual PKI R&D Workshop _Multiple Paths to Trust_ Proceedings.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does A Study of Federal Agency Needs for Information Technology Security provide? (Section 148) nts were found to be based on a higher set of environmental and policy factors and conditions. Computer security technology is applied uniquely in each situation even though there are common concerns. Because each organization has unique security needs, security products have been applied on a case by case basis to meet individual security threats and concerns. Products should be flexible enough to serve a broad spectrum of security needs at the operating system level, the application level, the organizational level, and the site level. Organizational security requirements also change over time and cannot be totally specified at the time of product acquisition. For organizations that process unclassified sensitive information, the availability of a greater variety of trusted products that go beyond C2 in terms of functionality and flexibility Is needed. There is a demand to address data integrity in a more direct and user friendly manner. Vendors should consider new mechanisms that directly address discretionary and non-dlscretionary controls, such as role-based access controls, separation of duties, separation of transactions, and user-oriented least privilege. Most organizations felt security standards should include a wide range of assurances including a 'generally accepted commercial practice" level. This new level should minimize the cost of developing new systems or retro-fitting new security functionality in existing systems. Nearly all of those Interviewed expressed the desire to have an Independent third party give a "stamp of approval" with regard to the trustworthiness of the systems they were buying. However, the current evaluation and certification process (I.e., with respect to a TCSEC class) was not perceived by users as meeting their needs for a variety of reasons. Those interviewed felt that security standards have failed to emerge allowing comprehensive Implementation to integrate security across a multi-vendor environment.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: A Study of Federal Agency Needs for Information Technology Security.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Specification for the Open Checklist Interactive Language (OCIL) Version 2.0 say about 1.2 Document Structure? According to Specification for the Open Checklist Interactive Language (OCIL) Version 2.0, 1.2 Document Structure: The remainder of this document is organized into the following major sections and appendices: - Section 2 defines terms used within this specification and provides a list of common acronyms and other abbreviations. - Section 3 defines the conformance rules for this specification. - Section 4 provides an overview of related specifications and standards. - Section 5 presents the primary components of the OCIL data model. - Section 6 provides requirements and recommendations for OCIL content syntax, structures, and development. - Section 7 describes OCIL document processing requirements. - Appendix A discusses possible use cases for OCIL. - Appendix B defines requirements for using OCIL as a check system for the eXtensible Configuration Checklist Description Format (XCCDF).

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Specification for the Open Checklist Interactive Language (OCIL) Version 2.0.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain Integrity according to NIST Guide for Mapping Types of Information and Information Systems to Security Categories_ Appendices According to Guide for Mapping Types of Information and Information Systems to Security Categories_ Appendices, Integrity: The integrity impact level is based on the specific mission and the data supporting that mission, not on the time required to detect the modification or destruction of information. The consequences of unauthorized modification or destruction of global trade information depends on whether the information is time-critical. Unauthorized modification or destruction of information affecting export promotion information may adversely affect mission operations and result in potentially serious economic repercussions. Trade agreements that have been implemented are generally matters of public record. Therefore, the specific negotiated terms, etc., must be accurately recorded. The modification of merchandise inspection information may result in significant financial consequences to an importer or exporter whose shipment is in question and may adversely affect mission operations and result in potentially serious economic repercussions. The results of completed inspections are matters of public record and must be accurately recorded. For tariffs/quotas monitoring information, the requirement for adequate means to detect data corruption is high . This information is used in policy and strategic analysis, and the accuracy of this statistical information is critical. Unauthorized modification or destruction of information affecting tariffs/quotas monitoring information may adversely affect mission operations and result in potentially catastrophic economic repercussions. Recommended Integrity Impact Level: The provisional integrity impact level recommended for global trade information is high .

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Guide for Mapping Types of Information and Information Systems to Security Categories_ Appendices.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Incident Response Recommendations and Considerations for Cybersecurity Risk Management_ A CSF 2.0 Community Profile provide? (Section 67) understood | High | R1: Estimate the impact and scope of adverse events through automated (e.g., SIEM, SOAR) and/or manual means, and review and refine the estimates. | | DE.AE-06 | Information on adverse events is provided to authorized staff and tools | High | R1: Generate alerts and provide them to cybersecurity and incident response tools and staff (e.g., the SOC and incident responders). R2: Make log analysis findings accessible to incident responders and other authorized personnel at all times. R3: Consider automatically creating and assigning tickets in the organization's ticketing system when certain types of alerts occur. | | DE.AE-07 | Cyber threat intelligence and other contextual information are integrated into the analysis | High | R1: Integrate up-to-date CTI and other contextual information (e.g., asset inventories) into adverse event analysis to improve detection accuracy and characterize threat actors, their methods, and indicators of compromise. R2: Rapidly acquire and analyze vulnerability disclosures for the organization's technologies from suppliers, vendors, and third-party security advisories. N1: See [SP800-150] for guidelines on consuming, using, and storing CTIs, as well as establishing CTI relationships. | | DE.AE-08 | Incidents are declared when adverse events meet the defined incident criteria | High | R1: Apply incident criteria to known and assumed characteristics of analyzed activity, and consider known false positives to determine whether an incident should be declared. | | RS (Respond) | Actions regarding a detected cybersecurity incident are taken | High | N1: The Respond Function is at the core of incident response activities.

Explanation: NIST cybersecurity publication covering vulnerability management. Topics: vulnerability, threat actor, incident response. Contains technical security guidance that could inform defensive posture. Source: Incident Response Recommendations and Considerations for Cybersecurity Risk Management_ A CSF 2.0 Community Profile.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is References according to Security and Privacy Controls for Information Systems and Organizations? References: [SP 800-12], [SP 800-30], [SP 800-39], [SP 800-100].

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Security and Privacy Controls for Information Systems and Organizations.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Guidelines for Securing Radio Frequency Identification (RFID) Systems provide? (Section 221) | If the risk assessment identifies risks related to human health, fuel, ordnance, or other sensitive materials (e.g., pharmaceuticals) that are not fully mitigated by the RFID usage policy, then the organization should require additional controls to prevent the associated hazard from being realized. A separate policy is needed for each hazard type (HERF/HERO/HERP/other sensitive materials) because each one has distinct issues. Organizations facing these hazards should also consult safety and regulatory experts in this area to ensure their approaches are valid and comply with legally-mandated FCC exposure limits. 79 | RF Subsystem | Recommended | | | 5 | Enhance the organization's information security policy to account for the presence of RFID systems. | The introduction of RFID technology represents a new challenge to the security of the enterprise network that should be mitigated by policy and associated technical, operational, and management controls. Elements of the network security policy that might require revision include (a) perimeter security (i.e., firewalls and extranets), (b) database security, (c) application security, and (d) wireless connections (i.e., between readers and the enterprise network). Typically a firewall separates readers from the enterprise network that hosts RFID database and application servers.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control, assessment. General security reference material without sensitive content. Source: Guidelines for Securing Radio Frequency Identification (RFID) Systems.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Computer Security Division 2012 Annual Report provide? (Section 131) df00)ios, smart carGLYPH(cmap:df00)s, spacebased communications, munitions, security tokens, storage devices, and products supporting Public Key Infrastructure (PKI) and electronic commerce. A module may be a standalone product, such as a virtual private network (VPN), smart carGLYPH(cmap:df00) or toolkit, or one module may be used in several products; as a result, a small number of moGLYPH(cmap:df00)ules may be incorporateGLYPH(cmap:df00) within hunGLYPH(cmap:df00)reGLYPH(cmap:df00)s of proGLYPH(cmap:df00)ucts. Likewise, the CAVP valiGLYPH(cmap:df00)ates cryptographic algorithms that may be integrated in one or more cryptographic modules. The two valiGLYPH(cmap:df00)ation programs (the CAVP anGLYPH(cmap:df00) CMVP) provide documented methodologies for conformance testing through GLYPH(cmap:df00)efineGLYPH(cmap:df00) sets of security requirements. Security requirements for the CAVP are found in the individual validation system documents containing the validation test suites that are required to assure that the algorithm has been implemented correctly. The validation system documents are designed for each FIPS-approved and NIST-recommended cryptographic algorithm. Security requirements for the CMVP are found in FIPS 140-2, Security Requirements for Cryptographic Modules , and the associated test metrics and methods in Derived Test Requirements for FIPS 140-2. Annexes to FIPS 140-2 reference the underlying cryptographic algorithm standards or methods. Federal agencies are required to use modules that were valiGLYPH(cmap:df00)ateGLYPH(cmap:df00) as conforming to the provisions of FIPS 140-2. The CMVP developed Derived Test Requirements associateGLYPH(cmap:df00) with FIPS 140-2 to GLYPH(cmap:df00)efine the security requirements and the test metrics and methods to ensure repeatability of tests and equivalency in results across the testing laboratories.

Explanation: NIST publication on credential and access management. Topics: pki, token, sso. Contains security framework guidance for authentication systems. Source: Computer Security Division 2012 Annual Report.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain Interview according to NIST Assessing Security Requirements for Controlled Unclassified Information According to Assessing Security Requirements for Controlled Unclassified Information, Interview: [SELECT FROM: personnel with responsibilities for cryptographic key establishment or management; personnel with information security responsibilities; system administrators]

Explanation: NIST publication discussing classified information handling. References: classified, controlled unclassified. Contains guidance on protecting sensitive government information. Source: Assessing Security Requirements for Controlled Unclassified Information.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Securing Small-Business and Home Internet of Things (IoT) Devices_ Mitigating Network-Based Attacks Using Manufacturer Usage Description (MUD) provide? (Section 44) le solution. However, a combination of allowing only certain device capabilities and blocking devices or domains that are considered suspicious allowed network administrators to mitigate some threats. With the evolution of internet hosts from multiuser systems to personal devices, this security posture became impractical, and the emergence of IoT has made it unsustainable. In typical networking environments, a malicious actor can detect an IoT device because it exposes its services directly to the internet. The malicious actor can launch an attack on that device from any system on the internet. Once compromised, that device can be used to attack any other system on the internet. Anecdotal evidence indicates that a new device will be detected and will experience its first attack within minutes of deployment. Because the devices being deployed often have known security flaws, the success rate for compromising detected systems is very high. Typically, malware is designed to compromise a list of specific devices, making such attacks very scalable. Once compromised, an IoT device can be used to compromise other internet-connected devices, launch attacks on any victim device on the internet, or launch attacks on devices within the local network hosting the device. 3.4.2 Vulnerabilities The vulnerability of IoT devices in this environment is a consequence of full connectivity, exacerbated by the large number of security vulnerabilities in complex software systems. Modern systems ship with millions of lines of code, creating a target-rich environment for malicious actors. Some vendors provide patches for security vulnerabilities and an efficient means for securely updating their products. However, patches are often unavailable or nearly impossible to install on many other products, including many IoT devices.

Explanation: NIST cybersecurity publication covering vulnerability management. Topics: vulnerability, malware. Contains technical security guidance that could inform defensive posture. Source: Securing Small-Business and Home Internet of Things (IoT) Devices_ Mitigating Network-Based Attacks Using Manufacturer Usage Description (MUD).


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does National Online Informative References (OLIR) Program_ Overview, Benefits, and Use say about Supportive Relationship Mapping OLIR? According to National Online Informative References (OLIR) Program_ Overview, Benefits, and Use, Supportive Relationship Mapping OLIR: An OLIR that indicates how a supporting concept can or does help achieve a supported concept, with one of the concepts being a Focal Document Element and the other a Reference Document Element.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: National Online Informative References (OLIR) Program_ Overview, Benefits, and Use.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Identity and Access Management for Electric Utilities provide? (Section 297) ss, as listed in Figure 9-9. T h i s p u b l i c a t i o n i s a v a i l l a b e f r e e o f c h a r g e f r o m : h t t p : / / d o i . o r g / 1 0 . 6 0 2 8 / N I S T . S P 1 8 0 0 - 2 . . NIST SP 1800-2C: Identity and Access Management for Electric Utilities 177 Figure 9-9 Guardian Recon Authoritative Fields 9.3.3.2 Identity & Access > Request Categories Setup > Manual Configuration > Identity & Access > Request Categories. Select ChangeAccess Category name, and click Modify. a. On the Modify screen, make the following changes: b. In the Provisioning Actions section, un-select the Delimit User and Change Validity Dates checkboxes, if they are selected, and select the Change User option. c. Go to the Add Existing section, and select the system and Remove Role option from the Resources/Roles drop-down field. Click Save to save the configuration. Figure 9-10 Create External Provisioning Attribute Repeat Steps 1 and 2 to configure the fields listed in Figure 9-11. T h i s p u b l i c a t i o n i s a v a i l l a b e f r e e o f c h a r g e f r o m : h t t p : / / d o i . o r g / 1 0 . 6 0 2 8 / N I S T . S P 1 8 0 0 - 2 . . Note: Field names are case-sensitive. NIST SP 1800-2C: Identity and Access Management for Electric Utilities 178 Figure 9-11 Field Names T h i s p u b l i c a t i o n 9.3.3.3 Identity & Access>Provisioning>Provisioning Mapping Setup > Manual Configuration > Identity & Access > Provisioning > Provisioning Mapping. Select ACCESSIT PACS, and click Configure. On the next screen, click the New button, and select UserText1 for the DB Connector Attribute Name (Figure 9-12). i s a v a i l l a b e f r e e o f c h a r g e f r o m : h t t p : / / d o i . o r g / 1 0 . 6 0 2 8 / N I S T . S P 1 8 0 0 - 2 . .

Explanation: NIST cybersecurity documentation and standards guidance. Topics: nist sp, fips, security control. General security reference material without sensitive content. Source: Identity and Access Management for Electric Utilities.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Security Considerations for Remote Electronic UOCAVA Voting say about 4.5 Open Issues? (Part 1) According to Security Considerations for Remote Electronic UOCAVA Voting, 4.5 Open Issues: 4.5 Open Issues Achieving a very strict notion of ballot secrecy remains a challenging issue in remote electronic voting systems. While polling place voting systems do not store, or even learn, the identities of voters, remote electronic voting systems need to authenticate voters before allowing them to cast ballots. Cryptographic protocols exist to protect the secrecy of ballots even from those with unrestricted access to voting system equipment, but these technologies may not be ready for immediate use with remote electronic voting systems. For technical, procedural, and legal reasons, it is likely that any deployed voting system for UOCAVA voters would still have access to, and probably store, sufficient information to violate ballot secrecy. Depending on policy decisions at state and local levels, this issue may not require a technical solution beyond what is already practical. Advanced voting-specific cryptographic protocols have highly desirable properties in idealized models, but in practice, systems based on these protocols are often difficult to use and require that cryptographic keys be distributed to voters before an election. These systems also do not protect against many types of attacks, particularly if the computer used to cast votes and the voting environment are not secured. Current techniques for remote electronic voting do not solve the problems of coercion and vote selling that are inherent to unsupervised voting. Variations on these attacks are possible with mail-in absentee voting, although in that voting method, it is difficult for a single individual to impact many voters. When moving to remote electronic voting, election officials and technologists should consider whether the move makes it easier to scale these attacks. In particular, there appear to be ways that attackers could coerce or buy votes remotely. A simple attack involves selling or transferring the credentials that voters use to log into the remote voting system.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Security Considerations for Remote Electronic UOCAVA Voting.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Multi-Factor Authentication for Criminal Justice Information Systems_ Implementation Considerations for Protecting Criminal Justice Information say about B.5. VPN Integration? (Part 2) According to Multi-Factor Authentication for Criminal Justice Information Systems_ Implementation Considerations for Protecting Criminal Justice Information, B.5. VPN Integration: sends the submitted username and password to the LDAP server to validate the credentials. The LDAP server returns a login success message. 8. The user's session with the CAD/RMS server is established. Although the officer only needs to use one username/password credential and one MFA credential, there is no SSO user experience since the user needs to enter the password twice. If MFA is not required at the CAD/RMS web app, the session is susceptible to phishing, as described in Sec. 2.5. If, on the other hand, the CAD/RMS web app enforced MFA a second time, the user would need to respond to the MFA prompt again. Repeated authentication and MFA prompts pose a burden on the user and can take focus away from the critical work they need to do.

Explanation: NIST publication on credential and access management. Topics: authentication, multi-factor, mfa. Contains security framework guidance for authentication systems. Source: Multi-Factor Authentication for Criminal Justice Information Systems_ Implementation Considerations for Protecting Criminal Justice Information.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Guidelines for Smart Grid Cybersecurity provide? (Section 210) udes scanning for ports, protocols, and services that should not be accessible to users and for improperly configured or incorrectly operating information flow mechanisms. Requirement Enhancements 1. The organization employs vulnerability scanning tools that include the capability to update the list of smart grid information system vulnerabilities scanned; and 2. The organization includes privileged access authorization to organization-defined smart grid information system components for selected vulnerability scanning activities to facilitate more thorough scanning. Additional Considerations A1. A2. A3. The organization employs automated mechanisms on an organization-defined frequency to detect the presence of unauthorized software on organizational smart grid information systems and notifies designated organizational officials; The organization performs security testing to determine the level of difficulty in circumventing the security requirements of the smart grid information system; and The organization employs automated mechanisms to compare the results of vulnerability scans over time to determine trends in smart grid information system vulnerabilities. Impact Level Allocation Low: SG.RA-6 Moderate: SG.RA-6 (1) High: SG.RA-6 (1), (2) 3.23 SMART GRID INFORMATION SYSTEM AND SERVICES ACQUISITION (SG.SA) Smart grid information systems and services acquisition covers the contracting and acquiring of system components, software, firmware, and services from employees, contactors, and third parties. A policy with detailed procedures for reviewing acquisitions should reduce the introduction of additional or unknown vulnerabilities into the smart grid information system. SG.SA-1 Procedures Smart Grid Information System and Services Acquisition Policy and Category: Common Governance, Risk, and Compliance (GRC) Requirements 185 Requirement 1. The organization develops, implements, reviews, and updates on an organization-defined frequency— a.

Explanation: NIST publication on credential and access management. Topics: authorization, privileged access. Contains security framework guidance for authentication systems. Source: Guidelines for Smart Grid Cybersecurity.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is Recommended Confidentiality Impact Level according to Guide for Mapping Types of Information and Information Systems to Security Categories_ Appendices? Recommended Confidentiality Impact Level: The provisional confidentiality impact level recommended for public comment tracking information is low .


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Guidelines for the Secure Deployment of IPv6 say about 3.5.6 Security Ramifications? (Part 4) According to Guidelines for the Secure Deployment of IPv6, 3.5.6 Security Ramifications: ful firewalls can limit even allowed types to those that could legitimately be part of permitted traffic flows. Table 3-7 gives recommended ICMPv6 firewall settings for various possible traffic types. The -Maintenance of Communications‖ and -Error Messages‖ sections of the table assume the more sophisticated connection-association capabilities mentioned above; less-sophisticated firewalls would have to allow these messages whenever a corresponding connection could occur, based on other rules (e.g., allowed source and destination addresses).

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Guidelines for the Secure Deployment of IPv6.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control HA-2 in Computer Security Division 2004 Annual Report? (Part 68) Control HA-2: ter Security Division Information Technology Laboratory National Institute of Standards and Technology U.S. Department of Commerce Carlos M. Gutierrez, Secretary Technology Administration Phillip J. Bond, Under Secretary for Technology National Institute of Standards and Technology Hratch Semerjian, Acting Director NIST IR 7219 April 2005 Disclaimer: Any mention of commercial products is for information only; it does not imply NIST recommendation or endorsement, nor does it imply that the products mentioned are necessarily the best available for the purpose. Michael James, Design/Production The DesignPond

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Computer Security Division 2004 Annual Report.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Report on the Block Cipher Modes of Operation in the NIST SP 800-38 Series say about cookie? According to Report on the Block Cipher Modes of Operation in the NIST SP 800-38 Series, cookie: A piece of state information supplied by a web server to a browser that is temporarily stored and returned to the server on any subsequent visits or requests.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: nist sp, fips, security control. General security reference material without sensitive content. Source: Report on the Block Cipher Modes of Operation in the NIST SP 800-38 Series.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control HA-256 in Derived PIV Application and Data Model Test Guidelines? (Part 141) Control HA-256: '07' as P1 value, the command returns the transported key with status word '90 00'. Compare the test toolkit application's copy of the plaintext key to the one received in the response from the token. For algorithm reference '11' or '14' as P1 value, the command returns the shared secret Z 16 with | 15 Template '85' contains the other party's public key, a point on Curve P-256 or P-384, encoded as '04' || X || Y, without the use of point compression, as described in Section 2.3.3 of [SEC1]. 16 Z is the X coordinate of point P as defined in [SP800-56A], Section 5.7.1.2 | | status word '90 00'. Compare the shared secret computed by the token with the shared secret computed off token (using the key management public key that was returned in Step 6). | |------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | Postcondition(s) | The token has newly generated private key(s). | ## 9. Test Assertions for the Derived PIV Application Data Model This section lists the test assertions used to determine conformity to the derived test requirements (DTR) listed in Section 7. The Implementation Under Test (IUT), the Derived PIV Data Objects loaded on a Derived PIV Application by an issuer, must meet the stated objective(s) of the assertion by way of a test or submission of artifacts in order to be deemed conformant to the associated DTR(s). ## 9.1 BER-TLV Conformance The following assumptions apply to the test assertions within this section. Table 1 - Encoding of Length Field | 1 | When the length of the value field is between 0 and 127 bytes, the length field should consist of a single byte where bit 8 is set to 0 and bits 7 to 1 encode the number of bytes in the value field. When the length of the value field is greater than 127 bytes, the length field consists of two or more bytes.

Explanation: NIST publication on credential and access management. Topics: key management, token, sso. Contains security framework guidance for authentication systems. Source: Derived PIV Application and Data Model Test Guidelines.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations provide? (Section 125) Enumeration (CWE), which is a dictionary of weaknesses that can lead to exploitable vulnerabilities (i.e., CVEs) and the Common Weakness Scoring System (CWSS) for assigning risk scores to weaknesses. SwAAP also uses the Common Attack Pattern Enumeration & Classification (CAPEC), which is a publicly available catalog of attack patterns with a comprehensive schema and classification taxonomy, to provide descriptions of common methods for exploiting software and the Malware Attribute Enumeration & Characterization (MAEC), which provides a standardized language for encoding and communicating information about malware based upon attributes such as behaviors, artifacts, and attack patterns. There are a number of software assurance tools and technologies that are now incorporating many of these automation specifications to provide software security throughout the software development life cycle. The implementation and effective use of software assurance technologies can assist organizations in automating the implementation, assessment, and continuous monitoring of several NIST SP 800-53 security controls including CA-7, Continuous Monitoring; SA-4, Acquisitions; SA-8, Security Engineering Principles; SA-11, Developer Security Testing; SA-12, Supply Chain Protection; SA-13, Trustworthiness; SA-14, Critical Information System Components; and SI-13, Predictable Failure Prevention. Aggregation and analysis technologies are those that have the capability to collect raw data from one or more security controls or other direct data gathering technologies and correlate, analyze, and represent the raw data in a way that provides a more meaningful perspective on the effectiveness of security control implementation across part or all of an organization than would data from any single technology. This section discusses common types of aggregation and analysis technologies and their role in supporting an ISCM capability. They include SIEM and management dashboards.

Explanation: NIST cybersecurity publication covering vulnerability management. Topics: exploit, malware. Contains technical security guidance that could inform defensive posture. Source: Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control TE-1 in Mobile Device Security_ Bring Your Own Device (BYOD)? (Part 27) Control TE-1: ites - phishing protection risky URLs - application forensics - application binaries (Android only) - application inventory (Android only) zIPS also collects some information that cannot be disabled. These items include: - device root/jailbreak status - USB debug mode status (Android only) - developer mode status (Android only) - 3 rd party app store presence (Android only) - mobile OS-specific vulnerability status (e.g., Stagefright) - device encryption status (Android only) - device protection status - screen lock status zIPS must collect certain data items to properly communicate with the zConsole. These items include: - user credentials (email address, Zimperium-specific password) - mobile network operator - mobile network country code - device operating system - device push token - hash of local z9 database - time and name of threat detection when a threat occurs ## 4.7.3 Application Vetting: Kryptowire Kryptowire collects certain pieces of device information through the MaaS360 REST API for analytics and application association purposes. The data collected includes: - MDM device ID - MDM device name - MDM username - last MDM sync date - MDM enrollment data - enterprise and non-app store installed applications ## 4.7.4 VPN: Palo Alto Networks The Palo Alto Networks VPN uses information about the device as it establishes VPN connections.

Explanation: NIST publication on credential and access management. Topics: token, sso. Contains security framework guidance for authentication systems. Source: Mobile Device Security_ Bring Your Own Device (BYOD).


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Privacy Protection in the United States_ A 1991 Survey of Laws and Regulations Affecting Privacy in the Public and Private Sector Including a List of say about B . Government: Obligations of Processors of Personal Data? (Part 3) According to Privacy Protection in the United States_ A 1991 Survey of Laws and Regulations Affecting Privacy in the Public and Private Sector Including a List of , B . Government: Obligations of Processors of Personal Data: tion for and purposes of collection, the extra-agency disclosures ("routine uses") that may be made of the data collected, and the consequences to the individual of failing to provide the information. Personal data must be collected as much as possible directly from the record subject, and information may not ordinarily be collected about an individual's exercise of First Amendment rights ( e . q , freedom of expression, assembly, and religion). 5 U.S.C. § 552a. The Privacy Act also generally prohibits Federal agencies from disclosing personal data except for publicly announced purposes, and requires agencies (1) to keep an accounting of extra-agency disclosures, (2) to instruct record management personnel in the requirements of the Act and the rules for its implementation, and (3) to "establish appropriate administrative, technical, and physical safeguards to insure the security and confidentiality of records." 5 U.S.C. 552a. § 9. Many State fair information practice statutes limit the type of information that the State government can collect and maintain about individuals. See , e . q . Ark. Stat. § 16-804; Conn. Gen. Stat. § 4-190; 111. Stat. ch. 116, § 43.5; Mass. Gen. L. ch. 119, § 51E; Mass. Gen. L. ch. 66, § 17A; Ohio Rev. Code 1347.01; Va . Code 2.1-377;. 2. § § 10. Furthermore, statutes in nearly every State limit the ability of government to disclose personal data to third parties. See Ala. Code § 41-8-10; Alaska Stat. § 09.25.140; Ark. Stat. § 16-804; Cal. Civil Code § 1798; Colo. Rev. Stat. § 24-72 . 204 (3) (a) ; Conn. Gen. Stat. § 4-190; D.C. Code § 37-106.2; Fla. Stat. § 257.261; 111. Stat. ch . 116, § 43.5; 111. Stat. ch. 81, § 1202; Ind. Code § 4-1-6; Iowa Code § 68A.7(13); Ky. Rev. Stat. § 61.870; La. Rev. Stat. § 44:13; Me. Rev. Stat. tit. 27, § 121; Me. Rev. Stat. tit. 5, § 1851; Mich. Comp. Laws § 397.603; Minn. Stat. § 13.01; Miss. Code §25-53-53; Mo. Stat. § 182.817; Mont. Rev. Code § 22-1-1103; Neb. Rev. Stat. § 84-712.05; Nev. Rev. Stat.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Privacy Protection in the United States_ A 1991 Survey of Laws and Regulations Affecting Privacy in the Public and Private Sector Including a List of .


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Security Considerations for Remote Electronic UOCAVA Voting say about Property: Proper software engineering practices? According to Security Considerations for Remote Electronic UOCAVA Voting, Property: Proper software engineering practices: The voting system software is designed, implemented, tested and deployed with accepted software engineering best practices.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain Extension: according to NIST COTS Security Protection Profile - Operating Systems (CSPP-OS) (Worked Example Applying Guidance of NISTIR-6462, CSPP) Version 1.0 According to COTS Security Protection Profile - Operating Systems (CSPP-OS) (Worked Example Applying Guidance of NISTIR-6462, CSPP) Version 1.0, Extension:: Not hierarchical to any other component. Dependencies: None FPT\_SYN-CSPP.1.1 The TSF shall support the system capability to provide the capability to synchronize distributed TSF elements and to associate audit event records produced by multiple TSF entities. Refinement (to CSPP component): See FPT\_SYN-CSPP.1.1 in [CSPP]. Application note: This component is similar to FPT\_STM 'Time stamps', but calls out the synchronization requirement instead of a specifying a mechanism (i.e., reliable time stamps') that could be used for that purpose.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: COTS Security Protection Profile - Operating Systems (CSPP-OS) (Worked Example Applying Guidance of NISTIR-6462, CSPP) Version 1.0.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Secure Data Network Systems (SDNS) Access Control Documents say about 4.2.3 COMPARE EV AND PDU LABEL? According to Secure Data Network Systems (SDNS) Access Control Documents, 4.2.3 COMPARE EV AND PDU LABEL: Inputs: Enforcement Vector PDU Attributes Local Configuration Information Outputs: PAE Result = Pass/Fail

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Secure Data Network Systems (SDNS) Access Control Documents.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Securing Web Transactions_ TLS Server Certificate Management say about Download a Certificate from the CertCentral Account? According to Securing Web Transactions_ TLS Server Certificate Management, Download a Certificate from the CertCentral Account: After DigiCert issues the certificate, access it from inside the CertCentral account. 1. In the CertCentral account, go to the Orders page. In the sidebar menu, click Certificates > Orders. 2. On the Orders page, use the filters and advanced search features to locate the certificate to be downloaded. 3. In the Order # column of the certificate to be downloaded, click the Quick View link. 4. In the Order # details pane (on the right), using the Download Certificate As drop-down, select the certificate format to be used. - a. .crt (best for Apache/Linux) Download the certificate in a .crt format, best for Apache/Linux platforms. - b. .pb7 (best for Microsoft and Java) Download the certificate in a .pb7 format, best for Microsoft and Java platforms. 5. (OPTIONAL) In the Download Certificate As drop-down, click More Options to see more Server Platform options and File Type options or to download only the Certificate, the Intermediate Certificate, or the Root Certificate. 6. Download a Combined Certificate File In the Download Certificate window, under Combined Certificate Files, use any of these options to download the combined SSL certificate file. - a. Platform specific In the Server Platform drop-down, select the server where the SSL/TLS certificate will be installed, and then click Download.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Securing Web Transactions_ TLS Server Certificate Management.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Methodology for Characterizing Network Behavior of Internet of Things Devices say about Abstract? According to Methodology for Characterizing Network Behavior of Internet of Things Devices, Abstract: This report describes an approach to capturing and documenting the network communication behavior of Internet of Things (IoT) devices. From this information, manufacturers, network administrators, and others can create and use files based on the Manufacturer Usage Description (MUD) specification to manage access to and from those IoT devices. The report also describes the current state of implementation of the approach and proposals for future development.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Methodology for Characterizing Network Behavior of Internet of Things Devices.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control SI-4(2) in Developing Cyber-Resilient Systems_ A Systems Security Engineering Approach? Control SI-4(2): Wireless Sniffing (T0887) Encrypt Network Traffic (M0808) Minimize Wireless Signal Propagation (M0806) Damage Assessment, Behavior Validation Obfuscation Obfuscation Negate, Degrade, Exert Negate, Degrade, Exert

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control, assessment. General security reference material without sensitive content. Source: Developing Cyber-Resilient Systems_ A Systems Security Engineering Approach.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Risk Management Framework for Information Systems and Organizations_ A System Life Cycle Approach for Security and Privacy provide? (Section 333) | • Authorizing Official or Authorizing Official Designated Representative | • System Owner or Common Control Provider • Information Owner or Steward • System Security Officer • System Privacy Officer • Senior Agency Information Security Officer • Senior Agency Official for Privacy | \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ TABLE E-7: MONITORING TASKS, RESPONSIBILITIES, AND SUPPORTING ROLES | RMF TASKS | PRIMARY RESPONSIBILITY | SUPPORTING ROLES | |----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | TASK M-1 System and Environment Changes Monitor the information system and its environment of operation for changes that impact the security and privacy posture of the system.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: risk management framework, rmf, fips. General security reference material without sensitive content. Source: Risk Management Framework for Information Systems and Organizations_ A System Life Cycle Approach for Security and Privacy.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Recommendation for Key Management_ Part 1 – General provide? (Section 91) vice to be provided. Asymmetric algorithms are used, for example, to: 1. Provide source, identity, and integrity authentication services in the form of digital signatures, 31 and 2. Establish cryptographic keying material using key-agreement and key-transport algorithms. 32 SP 800-175B provides discussions on the use of asymmetric-key algorithms to generate digital signatures and establish keying material. Random bit generators (RBGs) (also called random number generators (RNGs)) are required for the generation of keying material (e.g., keys and IVs). RBGs generate sequences of random bits (e.g., 010011); technically, RNGs translate those bits into numbers (e.g., 010011 is translated into the number 19). However, the term 'random number generator' (RNG) is commonly used to refer to both concepts. The use of RBGs is discussed in SP 800-175B; approved RBGs are specified in the SP 800-90 series of documents. 29 For example, see FIPS 197 and SP 800-38F. 30 Sometimes, a key pair is generated by a party that is trusted by the key owner rather than by the key owner and then provided to the key owner. 31 See FIPS 186. 32 See SP 800-56A and SP 800-56B. This section classifies the different types of keys and other cryptographic information according to their uses; discusses cryptoperiods and suggests appropriate cryptoperiods for each key type; provides recommendations and requirements for other keying material; introduces assurance of domain-parameter validity, public-key validity, and private-key possession; discusses the implications of the compromise of keying material; and provides guidance on the selection, implementation, and replacement of cryptographic algorithms and key sizes according to their security strengths. There are several different types of cryptographic keys, each used for a different purpose.

Explanation: NIST publication on credential and access management. Topics: authentication, key management. Contains security framework guidance for authentication systems. Source: Recommendation for Key Management_ Part 1 – General.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain EVALUATION OF HARDWARE/SOFTWARE PRODUCT THAT PERFORMS A DIRECT COMPUTER SECURITY FUNCTION according to NIST Sample Statement of Work for Federal Computer Security Services_ For use In-House or Contracting Out According to Sample Statement of Work for Federal Computer Security Services_ For use In-House or Contracting Out, EVALUATION OF HARDWARE/SOFTWARE PRODUCT THAT PERFORMS A DIRECT COMPUTER SECURITY FUNCTION: - o OMB Circular A-130, Appendix III, Security of Federal Automated Information Systems - o OMB Bulletin 90-08, Guidance for Preparation of Security Plans for Federal Computer Systems that Contain Sensitive Information - o Model Framework for Management Control Over Automated Information Systems, January 1988, PCMI

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Sample Statement of Work for Federal Computer Security Services_ For use In-House or Contracting Out.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control PD-12 in Guidelines for the Authorization of Personal Identity Verification Card Issuers (PCI) and Derived PIV Credential Issuers (DPCI)? (Part 63) Control PD-12: ort contains- (i) the results of the assessment; (ii) recommendations for correcting deficiencies; and (iii) the residual risk to the organization if those deficiencies are not corrected or mitigated. The assessment report is the Assessor's statement of the results of analyzing and evaluating the issuer's implementation of controls. The sample assessment report template in Appendix E should be used as a format for documenting the results after assessing the issuer controls. ## Task 5: Assessment Documentation This task consists of the Assessor submitting the assessment report to the OIMO and the latter adding the issuer's operations plan (revised if necessary) and the corrective actions plan (CAP) to generate an authorization submission package for the DAO. In situations where the assessment report contains deficiencies, the OIMO may choose to address some deficiencies based on the recommendations by the Assessor and revise the operations plan (if needed), even before submitting the package for authorization. Subtask 5.1: Provide the OIMO with the assessment report. Responsibility: Assessor Guidance: The OIMO relies on the expertise, experience, and judgment of the Assessor to: (i) provide recommendations on how to correct deficiencies in the planned or performed operations; and (ii) to understand the potential impacts of those deficiencies. The OIMO may choose to act on selected recommendations of the Assessor before the authorization package is finalized. To optimize the utilization of resources organization-wide, any actions taken by the OIMO prior to the final authorization decision must be coordinated with the DAO. The Assessor reviews any changes made in response to the corrective actions and revises the assessment report, as appropriate. Subtask 5.2: Revise the operations plan (if necessary) and implement its new provisions.

Explanation: NIST publication on credential and access management. Topics: authorization, sso. Contains security framework guidance for authentication systems. Source: Guidelines for the Authorization of Personal Identity Verification Card Issuers (PCI) and Derived PIV Credential Issuers (DPCI).


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control AC-3 in Mobile Application Single Sign-On_ Improving Authentication for Public Safety First Responders? (Part 124) Control AC-3: cument. In the lab, local\_policy.jar was extracted to the default location, <javahome>/lib/security.Network Configuration . - Check if the firewall is running or not by using the command below. If it is up, it will return a status that shows it is running: - If it is not running, activate the firewall by using the following command: - Check if the required ports, 9031 and 9999, are open by using the following command: - This command will return the following values: ``` firewall-cmd --state ``` ``` sudo systemctl start firewalld.service ``` ``` firewall-cmd --list-ports ``` 6031/tcp 9999/udp 9031/tcp 6031/udp 9998/udp 9031/udp 9999/tcp 9998/tcp 8080/tcp From the returned ports, we can determine which ports and protocols are open. - In case the required ports are not open, issue the command below. It should return success . - Reload the firewall by using the following command to make the rule change take effect: - Now, when the open ports are listed, the required ports should show up: ``` firewall-cmd --zone=public --permanent --add-port=9031/tcp success ``` ``` firewall-cmd --reload Success ``` firewall-cmd --zone=public --list-ports 6031/tcp 9999/udp 9031/tcp 6031/udp 9998/udp 9031/udp 9999/tcp 9998/tcp 8080/tcp 5000/tcp ## 3.2.3 PingFederate Installation Ping installation documentation is available at gettingStartedGuide/pf\_t\_installPingFederateRedHatEnterpriseLinux.html. . ## Some important points are listed below: -  Obtain a Ping Identity license. It can be acquired from https://www.pingidentity.com/en/account/sign-on.html. -  For this experiment, installation was done using the zip file. Installation was done at /usr/share . -  The license was updated. -  The PingFederate service can be configured as a service that automatically starts at system boot. PingFederate provides instructions for doing this on different OSs.

Explanation: NIST publication on credential and access management. Topics: authentication, single sign-on. Contains security framework guidance for authentication systems. Source: Mobile Application Single Sign-On_ Improving Authentication for Public Safety First Responders.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Small Business Information Security_ The Fundamentals provide? (Section 47) able to meet their contractual agreement. Regularly assess your processes, procedures, and technology solutions according to your risks (see Section 2). Make corrections and improvements as necessary. You may want to consider conducting training or table-top exercises which simulate or run-through a major event scenario in order to identify potential weaknesses in your processes, procedures, technology, or personnel readiness. Make corrections as needed. Many incidents can be prevented by practicing safe and secure business habits. Unlike the previous section, which looked at programmatic steps you can take within your business, this section focuses on every-day activities you and your employees can do to help keep your business safe and secure. While criminals are becoming more sophisticated, most criminals still use well-known and easily avoidable methods. This section provides a list of recommended practices to help protect your business. Each employee should be trained to follow these basic practices. Get to know them and maintain contact with your employees, including any contractors your business or building may employ (e.g. for cleaning, security, or maintenance). 16 Watch for unusual activity or warning signs such as the employee mentions financial problems, begins working strange hours, asks for a lot of overtime, or becomes unusually secretive. In most cases, this activity is benign, but occasionally it can be an indicator that the employee is or may begin stealing information or money from the business, or otherwise damaging the company. Watch for unusual activity near your place of business or in your industry. Similarly, know if other businesses in your area perform any activities which may pose an environmental or safety risk. An event that affects your neighbors may affect your business as well, or indicate new risks in your area, so it is important to remain aware.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Small Business Information Security_ The Fundamentals.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Derived Personal Identity Verification (PIV) Credentials say about identity management system identity proofing? (Part 1) According to Derived Personal Identity Verification (PIV) Credentials, identity management system identity proofing: identity management system identity proofing Perimeter network segment that is logically between internal and external networks. Its purpose is to enforce the internal network's information assurance policy for external information exchange and to provide external, untrusted sources with restricted access to releasable information while shielding the internal networks from outside attacks. A standardized application residing on a removable hardware cryptographic token that hosts a Derived PIV Credential and associated mandatory and optional elements An X.509 Derived PIV Authentication certificate with associated public and private key that is issued in accordance with the requirements specified in this document where the PIV Authentication certificate on the applicant's PIV Card serves as the original credential. The Derived PIV Credential (DPC) is an additional common identity credential under Homeland Security Presidential Directive-12 and Federal Information Processing Standards (FIPS) 201 that is issued by a federal department or agency and is used with mobile devices. A measure of trust or confidence in an authentication mechanism defined in publications Office of Management and Budget (OMB)-04-04 and NIST SP 800-63 in terms of four levels: -  Level 1: LITTLE OR NO confidence -  Level 2: SOME confidence -  Level 3: HIGH confidence -  Level 4: VERY HIGH confidence A standard for adoption and use by federal departments and agencies that has been developed within the Information Technology Laboratory and published by NIST. A standard in FIPS covers a specific topic in information technology to achieve a common level of quality or some level of interoperability.

Explanation: NIST publication on credential and access management. Topics: authentication, identity management, token. Contains security framework guidance for authentication systems. Source: Derived Personal Identity Verification (PIV) Credentials.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control SI-11 in Guidelines for Smart Grid Cybersecurity? (Part 57) Control SI-11: mation voluntarily turned over to Third Parties is "ill-suited for the digital age we live in today.” Although it ruled against Golden Valley, the 9th Circuit indicated a possible new legal approach. Specifically, the court said that in some circumstances "a company's guarantee to its customers that it will safeguard the privacy of their records might suffice to justify resisting an administrative subpoena."41 The Court did note that the outcome might have been different if Golden Valley had entered into a contract with its customers specifically agreeing to keep such business records confidential.42 In 2012, the first court case discussing privacy in the context of the smart grid was tried in the Maine Supreme Court. In Friedman, the Maine Supreme Court partially invalidated the Maine Public Utilities Commission’s (“Maine PUC”) dismissal of plaintiff Friedman's objections to a Smart Meter opt-out penalty. First, the court rejected the Maine PUC’s arguments that Friedman’s health and safety concerns had been “resolved” by its opt-out investigations in another proceeding, because the Commission had explicitly declined in those proceedings to make any determination on health and safety -- instead deferring to the jurisdiction of the Federal Communications Commission (FCC). The court held the Maine PUC could not explicitly decline to make determinations on health and safety in the opt-out investigations proceedings, and then attempt to treat the issues as “resolved” in this proceeding. Having never determined whether the smart-meter technology is safe, it could not conclude whether the opt-out fee was “unreasonable or unjustly discriminatory.” Second, the Maine Supreme Court concluded that the Maine PUC had resolved the privacy, trespass, and Fourth Amendment claims against the utility, but did not state exactly how the Maine PUC concluded that was the case.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Guidelines for Smart Grid Cybersecurity.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations provide? (Section 72) tials for facility access. - c. Review the facility access list [ Assignment: organization-defined frequency ]. - d. Remove individuals from the facility access list when access is no longer required. A facility can include one or more physical locations containing systems or system components that process, store, or transmit CUI. Physical access authorizations apply to employees and visitors. Individuals with permanent physical access authorization credentials are not considered visitors. Authorization credentials include identification badges, identification cards, and smart cards. Organizations determine the strength of the authorization credentials consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines. Physical access authorizations may not be necessary to access certain areas within facilities that are designated as publicly accessible. Source Control: PE-02 Supporting Publications: None - a. Monitor physical access to the facility where the system resides to detect and respond to physical security incidents. - b. Review physical access logs [ Assignment: organization-defined frequency ] and upon occurrence of [ Assignment: organization-defined events or potential indications of events ]. NIST SP 800-171r3 May 2024 A facility can include one or more physical locations containing systems or system components that process, store, or transmit CUI. Physical access monitoring includes publicly accessible areas within organizational facilities. Examples of physical access monitoring include guards, video surveillance equipment (i.e., cameras), and sensor devices. Reviewing physical access logs can help to identify suspicious activities, anomalous events, or potential threats. The reviews can be supported by audit logging controls if the access logs are part of an automated system. Incident response capabilities include investigations of physical security incidents and responses to those incidents.

Explanation: NIST publication discussing classified information handling. References: classified, controlled unclassified, cui. Contains guidance on protecting sensitive government information. Source: Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Protecting Information and System Integrity in Industrial Control System Environments_ Cybersecurity for the Manufacturing Sector say about ACKNOWLEDGEMENTS? (Part 1) According to Protecting Information and System Integrity in Industrial Control System Environments_ Cybersecurity for the Manufacturing Sector, ACKNOWLEDGEMENTS: ACKNOWLEDGEMENTS We are grateful to the following individuals for their generous contributions of expertise and time. | Name | Organization | |--------------------|-----------------------------| | Dan Frechette | Microsoft | | Ian Schmertzler | Dispel | | Ben Burke | Dispel | | Chris Jensen | Tenable | | Bethany Brower | VMWare | | Dennis Hui | OSIsoft (now part of AVEVA) | | John Matranga | OSIsoft (now part of AVEVA) | | Michael A. Piccalo | Forescout | | Tim Jones | Forescout | | Yejin Jang | Forescout | | Samantha Pelletier | TDI Technologies | | Rusty Hale | TDI Technologies | | Steve Petruzzo | GreenTec-USA | | Josh Carlson | Dragos | | Alex Baretta | Dragos | The Technology Partners/Collaborators who participated in this build submitted their capabilities in response to a notice in the Federal Register. Respondents with relevant capabilities or product components were invited to sign a Cooperative Research and Development Agreement (CRADA) with NIST, allowing them to participate in a consortium to build this example solution.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Protecting Information and System Integrity in Industrial Control System Environments_ Cybersecurity for the Manufacturing Sector.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control PE-22 in Security and Privacy Controls for Information Systems and Organizations? Control PE-22: COMPONENT MARKING Control: Mark [Assignment: organization-defined system hardware components] indicating the impact level or classification level of the information permitted to be processed, stored, or transmitted by the hardware component. CHAPTER THREE PAGE 192 T h s i p u b l i c a t i o n i s a v a i l l a b e f r e e o f c h a r g e f r o m : h t t p s : / / d o i . o r g / 1 0 . 6 0 2 8 / N S T S P . 8 0 0 - 5 3 r 5 . I NIST SP 800-53, REV. 5 SECURITY AND PRIVACY CONTROLS FOR INFORMATION SYSTEMS AND ORGANIZATIONS _________________________________________________________________________________________________ Discussion: Hardware components that may require marking include input and output devices. Input devices include desktop and notebook computers, keyboards, tablets, and smart phones. Output devices include printers, monitors/video displays, facsimile machines, scanners, copiers, and audio devices. Permissions controlling output to the output devices are addressed in AC-3 or

Explanation: NIST cybersecurity documentation and standards guidance. Topics: nist sp, fips, security control. General security reference material without sensitive content. Source: Security and Privacy Controls for Information Systems and Organizations.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control PA-220 in Mobile Device Security_ Corporate-Owned Personally-Enabled (COPE)? (Part 246) Control PA-220: . 1. In the MobileIron Admin Portal, navigate to Policies & Configs > Compliance Actions. 2. Select Add; the Add Compliance Action dialogue opens. 3. In the Add Compliance Action dialogue: - a. In the Name field, add a description of the compliance action; we recommend indicating the kind of action taken. This example illustrates creating a compliance action that will be associated with the MTP - High Risk label. - b. Select the Enforce Compliance Actions Locally on Devices check box. - c. Select the Send a compliance notification or alert to the user check box. - d. Select the Block email access and AppConnect apps check box. - e. Select the Quarantine the device check box. - f. Deselect the Remove All Configurations check box. - g. Click Save. Figure 2-124 MTP High Risk Compliance Action <!-- image --> ## 2.7.7.3 Create MobileIron Security Policy for Lookout MES In addition to potentially defining other controls, such as password requirements, a Security Policy can map a Compliance Action to an App Control rule, enabling MobileIron to execute the configured actions whenever a device that applies the policy violates the App Control rule. The following steps will create a new Security Policy for Lookout MES High Risk devices using an existing policy as a baseline from which to apply more stringent controls. 1. In the MobileIron Admin Portal , navigate to Policies & Configs > Policies. 2. On the Policies page: - a. Select the security policy to use as a baseline. - b. Select More Actions > Save As ; this opens the New Security Policy dialogue. - c. In the New Security Policy dialogue: - i. In the Name field, rename the policy to MTP - High Risk. - ii. In the Priority drop-down menu, select a current policy. The new policy will be prioritized based on the selection. In this example, the new policy is higher than the MTP Medium Risk policy.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Mobile Device Security_ Corporate-Owned Personally-Enabled (COPE).


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain CSD's Part in National and I nternational ISO Security Standards Processes according to NIST Computer Security Division 2015 Annual Report According to Computer Security Division 2015 Annual Report, CSD's Part in National and I nternational ISO Security Standards Processes: Figure 1 shows many of the national and international standards developing organizations (SDOs) involved in cybersecurity standardization. CSD participates in many cybersecurity standards' activities in many of these organizations, either in leadership positions or as editors and contributors, including the Biometric Application Programming Interface (BioAPI) Consortium; the Bluetooth Special Interest Group (SIG): Bluetooth Security Expert Group (BT-SEG); the International Telecommunications Union - Telecommunication Standardization Sector (ITU-T); various groups within the Institute of Electrical and Electronics Engineers (IEEE) and the Internet Engineering Task Force (IETF); the North American Security Products Organization (NASPO); the Trusted Computing Group (TCG); and Accredited Standards Committee X9, Inc. (ASC X9, Inc.) (e.g., X9F - Data & Information Security Subcommittee). Many of CSD's publications have been the basis for both national and international standards projects. The following paragraphs discuss, in particular, CSD staff activities in conjunction with the InterNational Committee for Information Technology Standards (INCITS) Technical Committee Cyber Security (CS1), where CSD's Sal Francomacaro served as the CS1 Vice Chair.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Computer Security Division 2015 Annual Report.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain Audience according to NIST Assessing Security Requirements for Controlled Unclassified Information According to Assessing Security Requirements for Controlled Unclassified Information, Audience: This publication serves a diverse group of individuals and organizations in the public and private sectors, including individuals with: - System development life cycle responsibilities (e.g., program managers, mission/business owners, information owners/stewards, system designers and developers, system/security engineers, systems integrators) - Acquisition or procurement responsibilities (e.g., contracting officers) - System, security, or risk management and oversight responsibilities (e.g., authorizing officials, chief information officers, chief information security officers, system owners, information security managers) - Security assessment and monitoring responsibilities (e.g., auditors, system evaluators, assessors, independent verifiers/validators, analysts) The above roles and responsibilities can be viewed from two perspectives: - Federal perspective : The entity establishing and conveying security assessment requirements in contractual vehicles or other types of agreements - Nonfederal perspective : The entity responding to and complying with the security assessment requirements set forth in contracts or agreements

Explanation: NIST publication discussing classified information handling. References: classified, controlled unclassified. Contains guidance on protecting sensitive government information. Source: Assessing Security Requirements for Controlled Unclassified Information.