You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Mobile Application Single Sign-On_ Improving Authentication for Public Safety First Responders provide? (Section 111) ph Portner* Mark Russell* Sudhi Umarji The MITRE Corporation McLean, Virginia Dakota Consulting Silver Spring, Maryland *Former employee; all work for this publication was done while at employer. August 2021 FINAL The first and second drafts of this publication are available free of charge from <!-- image --> Certain commercial entities, equipment, products, or materials may be identified by name or company logo or other insignia in order to acknowledge their participation in this collaboration or to describe an experimental procedure or concept adequately. Such identification is not intended to imply special status or relationship with NIST or recommendation or endorsement by NIST or NCCoE; neither is it intended to imply that the entities, equipment, products, or materials are necessarily the best available for the purpose. While NIST and the NCCoE address goals of improving management of cybersecurity and privacy risk through outreach and application of standards and best practices, it is the stakeholder's responsibility to fully perform a risk assessment to include the current threat, vulnerabilities, likelihood of a compromise, and the impact should the threat be realized before adopting cybersecurity measures such as this recommendation. National Institute of Standards and Technology Special Publication 1800-13C, Natl. Inst. Stand. Technol. Spec. Publ. 1800-13C, 159 pages (August 2021), CODEN: NSPUE2 As a private-public partnership, we are always seeking feedback on our practice guides. We are particularly interested in seeing how businesses apply NCCoE reference designs in the real world. If you have implemented the reference design, or have questions about applying it in your environment, please email us at psfr-nccoe@nist.gov. All comments are subject to release under the Freedom of Information Act.

Explanation: NIST publication on credential and access management. Topics: authentication, single sign-on. Contains security framework guidance for authentication systems. Source: Mobile Application Single Sign-On_ Improving Authentication for Public Safety First Responders.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain Required Vendor Information according to NIST PIV Card Application and Middleware Interface Test Guidelines (SP 800-73-4 Compliance) According to PIV Card Application and Middleware Interface Test Guidelines (SP 800-73-4 Compliance), Required Vendor Information: VE05.42-R4.01: The vendor shall specify in its documentation that secure messaging is implemented in accordance with AS05.42-R4.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: PIV Card Application and Middleware Interface Test Guidelines (SP 800-73-4 Compliance).


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is Validity according to NIST Test Personal Identity Verification (PIV) Cards Version 2? Validity: Not Before: Aug 5 08:30:00 2019 GMT, Not After: Dec 31 08:30:00 2040 GMT

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: NIST Test Personal Identity Verification (PIV) Cards Version 2.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Computer Security Division 2011 Annual Report provide? (Section 123) & Abstract Data Structures. In the coming year, we anticipate conducting a demonstration of the Cloud PM implementation, and bringing parts of the NGAC proposed standard to ballot by INCITS. We expect that this project will: - Offer users capabilities of a variety of services achieved through configuration of PM data alone, such as file management, email, workflow, and forms and records management, rather than managing overlapping user accounts, and potentially different authentication schemes for each data service, through a single authenticated session; - Deliver to select users, through the policy machine, select capabilities (of different services) under combinations of arbitrary, but mission-tailored forms of discretionary, mandatory, and history-based access controls, rather than deploying and managing different access control schemes for different data services; - Provide an inherent property of the PM, the comprehensive nature in which data services interplay. For instance, a user can attach a record, created under a relational database management service, to an email message and send that record to any chosen individual. This property is not achieved through interoperability features, but rather through the underlying framework of the PM that inherently provides a foundational basis for interoperability; and - Provide another inherent property of the PM, the comprehensive nature in which data is protected across data services. For example, regardless of the recipient of the message, any user who opens the attached record would only be able to read and/or write fields for which the user is authorized. Mr. David Ferraiolo (301) 975-3046 Mr.

Explanation: NIST publication on credential and access management. Topics: access control, authentication. Contains security framework guidance for authentication systems. Source: Computer Security Division 2011 Annual Report.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain Extended Key Usage : according to NIST NIST Test Personal Identity Verification (PIV) Cards Version 2 According to NIST Test Personal Identity Verification (PIV) Cards Version 2, Extended Key Usage :: TLS Web Client Authentication, Microsoft Smartcard Login, PKINIT Client Auth

Explanation: NIST publication on credential and access management. Topics: authentication, pki. Contains security framework guidance for authentication systems. Source: NIST Test Personal Identity Verification (PIV) Cards Version 2.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Guideline for Using Cryptographic Standards in the Federal Government_ Cryptographic Mechanisms say about 2.3.1 American National Standards Institute (ANSI) 20? According to Guideline for Using Cryptographic Standards in the Federal Government_ Cryptographic Mechanisms, 2.3.1 American National Standards Institute (ANSI) 20: The American National Standards Institute (ANSI) is the administrator and coordinator of the United States' private-sector voluntary standardization system. ANSI does not develop American National Standards itself; rather, it facilitates the development of standards by establishing consensus among qualified groups. Several ANSI committees have developed standards that use cryptography, but the primary committee that has developed standards for the cryptographic algorithms themselves is Accredited Standards Committee (ASC) X9, which is a financial-industry committee. 21 Many of the standards developed within ASC X9 have been adopted within NIST standards (e.g., the Elliptic Curve Digital Signature Algorithm specified in American National 20 Further information is available at the ANSI web site: www.ansi.org. 21 Further information is available at the ANSI X9 web site: x9.org. Standard X9.62 22 has been adopted in FIPS 186). Likewise, ASC X9 has approved the use of NIST standards via a registry of approved standards from non-ASC X9 sources (e.g., AES, as specified in FIPS 197). A number of ASC X9 standards have also been incorporated into the standards of other standards bodies, such as the International Organization for Standardization (ISO) (see Section 2.3.4) via a Technical Advisory Group (TAG) called the International Committee on Information Technology Standards (INCITS). INCITS has been responsible for assuring that U.S. standards (e.g., both those developed by NIST and those developed within ASC X9) are incorporated within ISO standards.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Guideline for Using Cryptographic Standards in the Federal Government_ Cryptographic Mechanisms.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does The Common Configuration Scoring System (CCSS)_ Metrics for Software Security Configuration Vulnerabilities provide? (Section 36) ----------------| | High (H) | Remediation measures are available to mitigate the vulnerability in such a way as to collectively decrease the incidence of exploitation by between 76% and 100%. (A decrease of 100% means that the available remediation measures are able to entirely prevent exploitation.) | | Medium (M) | Remediation measures are available to partially mitigate the vulnerability in such a way as to collectively decrease the incidence of exploitation by between 26% and 75%. | | Low (L) | Remediation measures are available to slightly mitigate the vulnerability in such a way as to collectively decrease the incidence of exploitation by between 1% and 25%. | | None (N) | Remediation measures are not available. | | Not Defined (ND) | Assigning this value to the metric will not influence the score. It is a signal to the equation to skip this metric. The default value is None. | Differences between environments can have a large effect on the risk that a vulnerability poses to a particular organization and its stakeholders. The CCSS environmental metrics capture the characteristics of a vulnerability that are associated with a particular IT environment. Each organization computing CCSS metrics can determine an appropriate definition of IT environment, such as the entire enterprise or a logical or physical subset of the enterprise (e.g., a facility, a division, a small group of related systems). Since environmental metrics are optional, each includes a metric value that has no effect on the score. This value is used when the analyst feels the particular metric does not apply and wishes to ignore it. The environmental metrics customize the previously computed base and temporal metrics. The environmental metrics measure three aspects of vulnerability severity: Local Exploit Level, Local Remediation Level, and Local Impact.

Explanation: NIST cybersecurity publication covering vulnerability management. Topics: vulnerability, exploit. Contains technical security guidance that could inform defensive posture. Source: The Common Configuration Scoring System (CCSS)_ Metrics for Software Security Configuration Vulnerabilities.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control HA-1 in Recommendation for Random Number Generation Using Deterministic Random Bit Generators? (Part 23) Control HA-1: tly seedlen bits. 2. seed\_material = df ( seed\_material , seedlen ). 3. ( Key , V ) = CTR\_DRBG\_Update ( seed\_material , Key , V ). 4. reseed\_counter = 1. 5. Return ( V , Key , reseed\_counter ). ## 10.2.1.5 Generating Pseudorandom Bits Using CTR\_DRBG Notes for the generate function specified in Section 9.3: The generation of pseudorandom bits using a CTR\_DRBG instantiation requires a call to the Generate\_function specified in Section 9.3. Process step 8 of that function calls the generate algorithm specified in this section. The values for max\_number\_of\_bits\_per\_request and max\_additional\_input\_length , and blocklen are provided in Table 3 of Section 10.2.1. If the derivation function is not used, then the maximum allowed length of additional\_input = seedlen . For this DRBG mechanism, there are two cases for the processing. For each case, let CTR\_DRBG\_Update be the function specified in Section 10.2.1.2, and let Block\_Encrypt be the function specified in Section 10.3.3. The seed length ( seedlen ) and the value of reseed\_interval are provided in Table 3 of Section 10.2.1. The value of ctr\_len is known by an implementation. ## 10.2.1.5.1 Generating Pseudorandom Bits When a Derivation Function is Not Used This method of generating bits is used when a derivation function is not used by an implementation. The following process or its equivalent shall be used as the generate algorithm for this DRBG mechanism (see step 8 of the generate process in Section 9.3.3): ## CTR\_DRBG\_Generate\_algorithm ( working\_state, requested\_number\_of\_bits, additional\_input ): 1. working\_state : The current values for V , Key , and reseed\_counter (see Section 10.2.1.1). 2. requested\_number\_of\_bits : The number of pseudorandom bits to be returned to the generate function. 3. additional\_input : The additional input string received from the consuming application. Note that the length of the additional\_input string may be zero. ## Output: 1.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Recommendation for Random Number Generation Using Deterministic Random Bit Generators.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control FT-128 in Status Report on the Second Round of the NIST Lightweight Cryptography Standardization Process? (Part 56) Control FT-128: ule that is based on a nonlinear feedback shift register, and the nonlinearity in each round is obtained using a single NAND operation. Variants. The variants of the TinyJAMBU family are listed below. | AEAD variants | Key | Nonce | Tag | State size | |-----------------|-------|---------|-------|--------------| | TinyJAMBU -128 | 128 | 96 | 64 | 128 | | TinyJAMBU -192 | 192 | 96 | 64 | 128 | | TinyJAMBU -256 | 256 | 96 | 64 | 128 | \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ Security Analysis. In [63], the designers provided a security proof for the mode, analysis of the keyed-permutation, and security against forgery and key recovery attacks (including differential, linear, algebraic, and slide attacks). Saha et al. [228-230] showed that the security margin of TinyJAMBU is around 12 % due to the dependencies between the outputs of multiple AND gates. Tweak plan. In order to provide a larger security margin, the designers considered increasing the number of rounds for the permutation that processes the nonce and the AD [26]. ## 3.2.31 WAGE WAGE , designed by Aagaard et al. [64, 231], is a permutation-based AEAD scheme. WAGE is based on the duplex mode of operation [80], where the rate is 64 bits and the capacity is 195 bits. The mode includes additional key additions during the initialization and finalization phases to prevent a key-recovery attack and a forgery attack even after a state is recovered by an attacker during the encryption. The design of the underlying 259-bit permutation of WAGE , called the WAGE permutation, is inspired by the initialization phase of the Welch-Gong (WG) cipher [232, 233]. The WAGE permutation has 111 rounds, where the state is described by 37 7-bit stages.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Status Report on the Second Round of the NIST Lightweight Cryptography Standardization Process.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Guidelines for the Secure Deployment of IPv6 say about 3.4 IPv6 Extension Headers? (Part 4) According to Guidelines for the Secure Deployment of IPv6, 3.4 IPv6 Extension Headers: same functions as AH and also, optionally, confidentiality. IPsec as well as AH and ESP is covered in Section 5.3. -  Destination Options header . NH value of 60 in the immediately preceding header. This header is used to carry optional information that needs to be examined only by a packet's destination node(s). Intermediate nodes (for which the IPv6 base header destination address is not the address of the current node or more Routing Header processing is required) do not examine the Destination Options header. The Destination Options header works similarly to the Hop-by-Hop Option header, as it may carry one or more options, where each option is encoded in type-length-value format. A node receiving a packet that matches the IPv6 destination address examines the NH field, notes the presence of a Destination Options, and processes the Destination Options before forwarding the payload to the upper layer protocol. A Destinations Options header could appear before or after an ESP header; however, it should be placed after an ESP header for increased protection. -  Mobility header . NH value of 135 in the immediately preceding header. This header is used by a mobile node, correspondent node, and home agent to manage mobile IPv6 bindings. Mobile IPv6 (MIPv6) provides enhanced security, streamlined administrative protocols, and greater efficiency compared with Mobile IPv4. MIPv6 is covered in Section 4.4. Extension headers are established at the source before transmission of the packet. Their order and contents are not altered by intermediary nodes. Extension headers provide important services and functions for the IPv6 protocol. They may direct intermediary nodes about how packet payloads are to be handled prior to reaching their ultimate destination. Defined extension headers for the IPv6 protocol should occur in a recommended order.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Guidelines for the Secure Deployment of IPv6.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Foundational PNT Profile_ Applying the Cybersecurity Framework for the Responsible Use of Positioning, Navigation, and Timing (PNT) Services say about risk management? According to Foundational PNT Profile_ Applying the Cybersecurity Framework for the Responsible Use of Positioning, Navigation, and Timing (PNT) Services, risk management: The program and supporting processes to manage information security risk to organizational operations (including mission, functions, image, reputation), organizational assets, individuals, other organizations, and the Nation and includes (i) establishing the context for risk-related activities, (ii) assessing risk, (iii) responding to risk once determined, and (iv) monitoring risk over time. [NIST-SP-800-39]

Explanation: NIST cybersecurity documentation and standards guidance. Topics: cybersecurity framework, fips, security control. General security reference material without sensitive content. Source: Foundational PNT Profile_ Applying the Cybersecurity Framework for the Responsible Use of Positioning, Navigation, and Timing (PNT) Services.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control II-6 in A Study of Federal Agency Needs for Information Technology Security? (Part 136) Control II-6: operated as part of the NIST Computer Security Resource and Response Center. It is intended to encourage sharing of information that will help users and managers better protect their data and systems. The BBS contains the following types of Information: - awareness and reference materials - bibliographies of security-relevant publications - lists of security-related seminars and conferences - recent NIST and other publications that deal with security issues - software reviews - archive of computer security incident alert information Issued by ## Appendix I ## various computer security response centers - information about actual incidents and how to protect against or correct known system vulnerabilities ## The bulletin board system contains three subsystems: - The bulletin subsystem consists of eight topic menus with numerous bulletins listed under each topic. Each bulletin contains a limited amount of information, normally consisting of one to three pages. The bulletins can be viewed on the computer screen or can be downloaded (i.e., transferring the entire file to the user's system) for future reference. - The file subsystem consists of larger amounts of information that can only be viewed by "downloading.* The files are separated into directories that can be viewed prior to selecting files to download. - The message subsystem permits users and the system operator (sysop) to exchange short messages, primarily for administrative or informational purposes. The BBS is available 24 hours a day, seven days a week. Each BBS user has a maximum of 70 minutes a day, 60 minutes on one call. With a modem, dial (301) 948-5717 for 300, 1200 or 2400 baud rate or dial (301) 948-5140 for 9600 baud rate. To access the BBS via the Internet, use the telnet command, for example: Type 'telnet csrc.nist.gov' or 'telnet 129.6.54.11' The BBS is menu driven and offers an on-line help feature.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: A Study of Federal Agency Needs for Information Technology Security.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Security Assurance Requirements for Linux Application Container Deployments say about Table of Contents? (Part 8) According to Security Assurance Requirements for Linux Application Container Deployments, Table of Contents: | 19 | | 6 Assurance Requirements for Image Integrity Solutions | 6 Assurance Requirements for Image Integrity Solutions | ..................................22 | | 7 | Assurance Requirements for Image Registry Protection.................................23 | | |-------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------|--------------------| | 8 | Assurance Requirements for Orchestration Functions....................................24 | | | 9 | Adverse Side Effect of Some Security Solutions..............................................25 | | | 10 | Summary and Conclusions.................................................................................26 | | | List of Appendices | List of Appendices | List of Appendices | | Appendix A-Acronyms..........................................................................................277 | Appendix A-Acronyms..........................................................................................277 | | | Appendix B-References ........................................................................................288 | Appendix B-References ........................................................................................288 | | | List of Figures | List of Figures | List of Figures | | Figure 1 - Container Technology Stack ..........................................................................2 | Figure 1 - Container Technology Stack ..........................................................................2 | | | Figure 2 - vTPM Implemented in a Kernel Module .........................................................8 | Figure 2 - vTPM Implemented in a Kernel Module .........................................................8 | | | Figure 3 - vTPM located in a dedicated Container .........................................................9 | Figure 3 - vTPM located in a dedicated Container .........................................................9 | | | List of Tables | List of Tables | List of Tables | | Table 1- Linux Resource Control using Cgroups..........................................................17 | Table 1- Linux Resource

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Security Assurance Requirements for Linux Application Container Deployments.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain A.2 Privilege Escalation Attacks according to NIST Guide to Secure Web Services According to Guide to Secure Web Services, A.2 Privilege Escalation Attacks: The objective of privilege escalation attempts is to enable the attacker to change the privilege level of a process, thereby taking control of that now-compromised process to bypass security controls that would otherwise limit the attacker's access to the Web service's functionality, data, resources, and environment. Web services are often configured to run with specific group or user permissions unrelated to those of the end user (human or requester service) responsible for causing the service's execution (e.g., 'anonymous' or 'nobody' permissions). Such Web services, if they also suffer from buffer overflows or race conditions, can be used to increase the permissions grabbed by the attacker, or to escalate the attacker's ability to cause damage to the Web service, its data, resources, or environment. Attackers can perform privilege escalation by taking advantage of defects in the implementation, design, or configuration of Web services. Any standard developed to prevent privilege escalation attempts would remain susceptible to implementation, design, or configuration defects.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Guide to Secure Web Services.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control EP-67 in Interagency Report on the Status of International Cybersecurity Standardization for the Internet of Things (IoT)? (Part 151) Control EP-67: In a 6LoWPAN stack, sensitive information will normally be protected by transport- or application-layer (or even IP-layer) security, which are all above the adaptation layer, leaving no sensitive information to compress at the GHC level. However, a 6LoWPAN deployment that entirely depends on Media Access Control (MAC) layer security may be vulnerable to attacks that exploit redundancy information disclosed by compression to recover information about secret values. This attack is fully mitigated by not exposing secret values to the adaptation layer or by not using GHC in deployments where this is done. Page 10, Section 5 | Proposed Standard | | RFC 7959 August 2016 | IETF | Block-Wise Transfer in Constrained Application Protocol (CoAP) Security Considerations: Where access to a resource is only granted to clients making use of specific security associations, all blocks of that resource must be subject to the same security | Approved Standard | IT System Security Evaluation: Standards that are used to provide: security assessment of operational systems; security requirements for cryptographic modules; security tests for cryptographic modules; automated security checklists; and security metrics.

Explanation: NIST publication on credential and access management. Topics: access control, sso. Contains security framework guidance for authentication systems. Source: Interagency Report on the Status of International Cybersecurity Standardization for the Internet of Things (IoT).


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Digital Identity Guidelines_ Authentication and Authenticator Management provide? (Section 169) gement System of Records Notice (SORN) A notice that federal agencies publish in the Federal Register to describe their system of record. token See authenticator. transaction See digital transaction. Transport Layer Security (TLS) An authentication and security protocol that is widely implemented in browsers and web servers. TLS provides confidentiality, certificate-based authentication of the receiving (server) endpoint, and certificate-based authentication of the originating (client) endpoint. TLS is specified in [RFC8446] and [SP800-52]. usability The extent to which a product can be used by specified users to achieve specified goals with effectiveness, efficiency, and satisfaction in a specified context of use. [ISO/IEC9241-11] validation The process or act of checking and confirming that the evidence and attributes supplied by an applicant are authentic, accurate, and associated with a real-life identity. See attribute validation. verification The process or act of confirming that the applicant undergoing identity proofing holds the claimed real-life identity represented by the validated identity attributes and associated evidence. Synonymous with identity verification. verifier An entity that confirms the claimant’s identity by verifying the claimant’s possession and control of one or more authenticators using an authentication protocol. To do this, the verifier needs to confirm the binding of the authenticators with the subscriber account and check that the subscriber account is active. verifier impersonation See phishing. 116 NIST SP 800-63B-4 July 2025 Digital Identity Guidelines Authentication and Authenticator Management Appendix E. Change Log This appendix is informative. This appendix provides an overview of the changes made to SP 800-63B since its initial release. • Removes Purpose, Definitions, and Abbreviations numbered sections and renumbers sections accordingly. The section numbers referenced below are the new section numbers.

Explanation: NIST publication on credential and access management. Topics: authentication, token, sso. Contains security framework guidance for authentication systems. Source: Digital Identity Guidelines_ Authentication and Authenticator Management.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Measurement Guide for Information Security_ Volume 1 — Identifying and Selecting Measures say about References? (Part 4) According to Measurement Guide for Information Security_ Volume 1 — Identifying and Selecting Measures, References: burg, MD), NIST Special Publication (SP) NIST SP 800-90B. https://doi.org/10.6028/NIST.SP.800-90B - [21] Stolfo S, Bellovin S, Evans D (2011) Measuring Security. IEEE Security & Privacy 9(3):6065. https://doi.org/10.1109/MSP.2011.56 - [22] Ross R, Pillitteri V, Graubart R, Bodeau D, McQuaid R (2021) Developing Cyber-Resilient Systems: A Systems Security Engineering Approach. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) NIST SP 800-160v2r1. https://doi.org/10.6028/NIST.SP.800-160v2r1 - [23] Schroeder K, Trinh H, Pillitteri VY (2024) Measurement Guide for Information Security: Volume 2 - Developing an Information Security Measurement Program. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) NIST SP 800-55v2. https://doi.org/10.6028/NIST.SP.800-55v2

Explanation: NIST cybersecurity documentation and standards guidance. Topics: nist sp, fips, security control. General security reference material without sensitive content. Source: Measurement Guide for Information Security_ Volume 1 — Identifying and Selecting Measures.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Blockchain Networks_ Token Design and Management Overview provide? (Section 114) ate the supply. This section discusses different types of stablecoin designs at a high level. A Classification Framework for Stablecoin Designs [130] provides more in-depth details. Projects have been studied or developed for tokens pegged to fiat currencies and cryptocurrencies as well as tokens that directly represent ownership claims for bank deposits, securities, and central bank reserves. Stablecoins may be composable with other blockchain-based protocols and tools to form more advanced financial instruments and exchange platforms. They can make it possible to borrow and lend tokens issued by distinct protocols, earning yields on deposits. Thus, they may be seen as portable and programmable alternatives to traditional bank accounts, savings accounts, and brokerage accounts, with integrated payment systems. As discussed in Section 4.1.3, blockchain-native tokens (i.e., ownerless or non-sovereign cryptocurrencies) can be represented on a separate blockchain through a bridge that collateralizes them and provides proof of that collateral. They are also referred to as wrapped cryptocurrencies . WBTC [131] is meant to represent bitcoins as tokens that follow the ERC-20 standard on the public Ethereum network through a consortium, the members of which act as notaries. WBTC tokens' minting involves two different roles: 1) merchants, who sign mint requests and provide liquidity for the WBTC/BTC pair, and 2) custodians, who process these requests. The consortium members jointly own the token factory contract via multi-signature. tBTC [132] (associated with the CrossChain Group [133]) allows a similar representation using a relay and incentives coupled with an overcollateralized reserve rather than trusted intermediaries. Each bitcoin deposit is represented as a nonfungible token redeemable for fungible tBTC tokens.

Explanation: NIST publication on credential and access management. Topics: token, sso. Contains security framework guidance for authentication systems. Source: Blockchain Networks_ Token Design and Management Overview.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Recommendation for Pair-Wise Key-Establishment Schemes Using Discrete Logarithm Cryptography provide? (Section 224) entifier. Thus, these schemes, by themselves, offer no assurance to either party of the accuracy of any identifier that may be used to label the entity with whom they have established a shared secret. The use of C(2e, 0s) schemes may be appropriate in applications where any trusted association desired/required between an identifier and an ephemeral public key is enforced by methods external to the scheme (e.g., in the protocol incorporating the key-agreement scheme). This Recommendation does not specify the incorporation of key confirmation in a C(2e, 0s) scheme. These schemes require each participant to own a static key pair that is used in their keyagreement transaction; in addition, the participant acting as party U is required to generate and use an ephemeral key pair. Different assurances are provided to the participants by the utilization of a C(1e, 2s) scheme, depending upon which one acts as party U and which one acts as party V. The use of static key pairs in the key-agreement transaction can provide the participants with some level of assurance that they have correctly identified the party with whom they will be establishing keying material if the transaction is successfully completed. In the case of a transaction based on the One-Pass Unified model or dhHybridOneflow scheme, each participant has assurance that no unintended entity (i.e., no entity other than the owners of the static key pairs involved in the key-establishment transaction) could employ a Diffie-Hellman primitive (see Section 5.7.1) to compute Zs , the static component of the shared secret Z, without knowledge of one of the static private keys employed during the transaction. Absent the compromise of Zs or one of those static private keys, each participant can be confident of correctly identifying the other participant in the keyestablishment transaction.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Recommendation for Pair-Wise Key-Establishment Schemes Using Discrete Logarithm Cryptography.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control HA-2 in Computer Security Division 2005 Annual Report? (Part 20) Control HA-2: identity has been authenticated that person needs to be registered with the PIV system and that person's card needs to be issued. The PIV standard provides specifications for this process. - Access Control (determined by resource owner)-this refers to how users are granted access to Federal resources. The government agencies (resource owner) will determine if the person is granted access based on the security level of the card and the sensitivity level of the resource that is being accessed. - Life Cycle Management-the information associated with a user's identity is subject to change. The user may change employers, gain new security clearances, leave an agency, or any one of a host of possibilities. This framework will recommend guidelines for managing these changes through the life cycle of both the card and the associated cardholder. FIPS 201 was divided into two parts. Part 1 addressed the common identification, security, and privacy requirements for issuing organizations. Part 1 is to have been implemented by all Federal departments and agencies by October 27, 2005. Part 2 provided detailed technical specification of components and processes required for interoperability of PIV cards with the personal authentication, access control, and PIV card management systems across the government. The Office of Management and Budget (OMB) has directed that Part 2 be implemented by all Federal departments and agencies by October 27, 2006. In addition to the FIPS 201 standard, we developed a reference implementation, designated an initial set of conformance test laboratories, and published several implementation guidelines.

Explanation: NIST publication on credential and access management. Topics: access control, authentication, sso. Contains security framework guidance for authentication systems. Source: Computer Security Division 2005 Annual Report.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control PS-10 in IoT Device Cybersecurity Capability Core Baseline? (Part 11) Control PS-10: ederal Information Systems and Organizations. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) 800-53, Rev. 4, Includes updates as of January 22, 2015. https://doi.org/10.6028/NIST.SP.800-53r4 - [2] Fagan M, Megas KN, Scarfone K, Smith M (2020) Foundational Cybersecurity Activities for IoT Device Manufacturers. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Interagency or Internal Report (IR) 8259. https://doi.org/10.6028/NIST.IR.8259 - [3] Joint Task Force Transformation Initiative (2012) Guide for Conducting Risk Assessments. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) 800-30, Rev. 4. - [4] Boeckl K, Fagan M, Fisher W, Lefkovitz N, Megas K, Nadeau E, Piccarreta B, Gabel O'Rourke D, Scarfone K (2019) Considerations for Managing Internet of Things (IoT) Cybersecurity and Privacy Risks. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Interagency or Internal Report (IR) 8228. https://doi.org/10.6028/NIST.IR.8228 - [5] AgeLight Digital Trust Advisory Group (2019) IoT Safety Architecture & Risk Toolkit (IoTSA) v3.1. (AgeLight Advisory & Research Group, Bellevue, WA). - [6] Broadband Internet Technical Advisory Group (BITAG) (2016) Internet of Things (IoT) Security and Privacy Recommendations. (Broadband Internet Technical Advisory Group [BITAG], Denver, CO). )\_Security\_and\_Privacy\_Recommendations.pdf - [7] Cloud Security Alliance (CSA) IoT Working Group (2015) Identity and Access Management for the Internet of Things. (Cloud Security Alliance [CSA]). https://cloudsecurityalliance.org/download/identity-and-access-management-for-the-iot/ - [8] Council to Secure the Digital Economy (CSDE) (2019) The C2 Consensus on IoT Device Security Baseline Capabilities.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: nist sp, fips, security control. General security reference material without sensitive content. Source: IoT Device Cybersecurity Capability Core Baseline.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control GV-2 in Integrating Cybersecurity and Enterprise Risk Management (ERM)? (Part 92) Control GV-2: onsibilities based on its position in the hierarchy and the roles and responsibilities of its officers. | | Enterprise Risk | The effect of uncertainty on enterprise mission and objectives. | | Enterprise Risk Management | 'An effective agency-wide approach to addressing the full spectrum of the organization's significant risks by understanding the combined impact of risks as an interrelated portfolio, rather than addressing risks only within silos.' [1] The 'culture, capabilities, and practices that organizations integrate with strategy-setting and apply when they carry out that strategy, with a purpose | | Enterprise Risk Register | A risk register at the enterprise level that contains normalized and aggregated inputs from subordinate organizations' risk registers and profiles. | | Exposure | The combination of likelihood and impact levels for a risk.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Integrating Cybersecurity and Enterprise Risk Management (ERM).


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is http according to 2016 NIST_ITL Cybersecurity Program Annual Report? http: / /nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST. SP.800-82r2.pdf

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: 2016 NIST_ITL Cybersecurity Program Annual Report.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does A Profile for U.S. Federal Cryptographic Key Management Systems (CKMS) say about 4 Security Policies? According to A Profile for U.S. Federal Cryptographic Key Management Systems (CKMS), 4 Security Policies: An organization often creates and supports layered security policies, with high-level policies addressing the management of its information and lower-level policies specifying the rules for protecting the information. An organization could have different policies covering different applications or categories of information. For example, a Federal organization could have one set of policies covering its financial information and a different set of policies covering its personnel information. This section describes a layered set of policies, including an Information Management Policy, an Information Security Policy, and an FCKMS Security Policy.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: A Profile for U.S. Federal Cryptographic Key Management Systems (CKMS).


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Contingency Planning Guide for Federal Information Systems provide? (Section 60) along with outage impacts and estimated downtime. The downtime should reflect the maximum time that an organization can tolerate while still maintaining the mission. 2. Identify resource requirements. Realistic recovery efforts require a thorough evaluation of the resources required to resume mission/business processes and related interdependencies as 14 NIST SP 800-37 further describes the RMF and provides guidance on organization-wide risk management including the development of risk management strategies, risk-related governance issues, defining protection requirements and associated risks for organizational mission/business processes, integration of security and privacy requirements into enterprise architectures, and managing risk within the system development life cycle. -  COOP functions are subject to a process-focused BIA; federal information systems are subject to a system-focused BIA. - o Information systems that support COOP functions will be identified in the process-based BIA. - o FCD-2 provides a required template for a process-based BIA; NIST 800-34 provides a recommended template for a system-based BIA. quickly as possible. Examples of resources that should be identified include facilities, personnel, equipment, software, data files, system components, and vital records. 3. Identify recovery priorities for system resources. Based upon the results from the previous activities, system resources can be linked more clearly to critical mission/business processes and functions. Priority levels can be established for sequencing recovery activities and resources. The sample BIA process and data collection activities, outlined in this section and illustrated in Figure 3-2, consisting of a representative information system with multiple components (servers), are designed to help the ISCP Coordinator streamline and focus contingency plan development activities to achieve a more effective plan.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: nist sp, nist 800, rmf. General security reference material without sensitive content. Source: Contingency Planning Guide for Federal Information Systems.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control ES-1 in Guidelines on Active Content and Mobile Code? (Part 45) Control ES-1: its underlying platform (e.g., system registry). The second is to use its authorized access based on the user's identity in an unexpected and disruptive fashion (e.g., invade privacy or deny service). Because browsers can support multiple associations with different Web servers as separate windowed contexts, the mobile code of one context can also target another context. Unauthorized access may occur simply through a lack of adequate access control mechanisms or weak identification and authentication controls, which allow untrusted code to act or masquerade as a trusted component. Attackers may take advantage of browser vulnerabilities in mobile code execution environments. Once access is gained, information residing at the platform can be disclosed or altered. Attackers may install spyware, connect the platform to a botnet, or modify the platform's configuration. Depending on the level of access, complete control of the platform may be taken over by the mobile code. Even without gaining unauthorized access to resources, malicious code can deny platform services to other processes by exhausting computational resources, if resource constraints are not established or not set tightly. ## 3.3.2 Server-Oriented Attacks Attacks can be launched against Web server components and technologies as the first stage of a larger scheme. For example, a browser or other utility can be used to isolate and capture a response from a server, which may be manipulated and fed back to the server in a subsequent request in an attempt to take advantage of a Web application's failure to sanitize user input. The objective is to induce the server to perform unauthorized commands provided by the browser as user input, which in turn gains an attacker access to sensitive information or control of the server.

Explanation: NIST publication on credential and access management. Topics: access control, authentication, sso. Contains security framework guidance for authentication systems. Source: Guidelines on Active Content and Mobile Code.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain Control Item Text according to NIST Automation Support for Security Control Assessments_ Software Asset Management According to Automation Support for Security Control Assessments_ Software Asset Management, Control Item Text: The information system prevents program execution in accordance with [Selection (one or more): [Assignment: organization-defined policies regarding software program usage and restrictions]; rules authorizing the terms and conditions of software program usage].

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control, assessment. General security reference material without sensitive content. Source: Automation Support for Security Control Assessments_ Software Asset Management.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain Task 8 - Evaluate ADP Backup Processing Alternatives according to NIST Sample Statement of Work for Federal Computer Security Services_ For use In-House or Contracting Out According to Sample Statement of Work for Federal Computer Security Services_ For use In-House or Contracting Out, Task 8 - Evaluate ADP Backup Processing Alternatives: The Contractor shall identify and compare ADP processing alternatives against those currently employed. The Contractor shall deliver a ADP Backup Processing Alternatives Report in draft form to the COTR.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Sample Statement of Work for Federal Computer Security Services_ For use In-House or Contracting Out.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Guide to Protecting the Confidentiality of Personally Identifiable Information (PII) say about Appendix F-Acronyms and Abbreviations? (Part 2) According to Guide to Protecting the Confidentiality of Personally Identifiable Information (PII), Appendix F-Acronyms and Abbreviations: Department of Health, Education, and Welfare | | HIPAA | Health Insurance Portability and Accountability Act | | ID | Identification | | IIF | Information in Identifiable Form | | IIHI | Individually Identifiable Health Information | | IP | Internet Protocol | | IPA | Initial Privacy Assessment | | IRS | Internal Revenue Service | | ISA | Interconnection Security Agreement | | IT | Information Technology | | ITL | Information Technology Laboratory | | MAC | Media Access Control | | NARA | National Archives and Records Administration | | NIST | National Institute of Standards and Technology | | NPPI | Non-Public Personal Information | | OECD | Organisation for Economic Co-operation and Development | | OMB | Office of Management and Budget | | OPM | Office of Personnel Management | | PDA | Personal Digital Assistant | | PHI | Protected Health Information | | PIA | Privacy Impact Assessment | | PII | Personally Identifiable Information | PRA Paperwork Reduction Act PTA Privacy Threshold Analysis SDLC System Development Life Cycle SOR System of Records SORN System of Records Notice SP Special Publication SSN Social Security Number URL Uniform Resource Locator USB

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control, assessment. General security reference material without sensitive content. Source: Guide to Protecting the Confidentiality of Personally Identifiable Information (PII).


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain REFERENCES according to NIST Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations According to Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations, REFERENCES: Source Controls: CP-09, CP-09(08) Supporting Publications: SP 800-34 [52], SP 800-130 [53], SP 800-152 [54]

Explanation: NIST publication discussing classified information handling. References: classified, controlled unclassified. Contains guidance on protecting sensitive government information. Source: Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Guidelines for Smart Grid Cybersecurity provide? (Section 302) tf.org/rfc/rfc3748.txt [accessed 8/11/2014]. 20. B. Aboba, D. Simon, and P. Eronen, Extensible Authentication Protocol (EAP) Key Management Framework, IETF Network Working Group RFC 5247, August 2008. http://www.ietf.org/rfc/rfc5247.txt [accessed 8/11/2014]. 21. J. Salowey, L. Dondeti, V. Narayanan, and M. Nakhjiri, Specification for the Derivation of Root Keys from an Extended Master Session Key (EMSK), IETF Network Working Group RFC 5295, August 2008. http://www.ietf.org/rfc/rfc5295.txt [accessed 8/11/2014]. 22. Department of Defense, National Security Agency, Suite B Cryptography [Web page], [accessed 8/11/2014]. 23. D. McGrew, K. Igoe, and M. Salter, “Fundamental Elliptic Curve Cryptography Algorithms,” IETF Network Working Group RFC 6090, February 2011. 24. R. Housley, and T. Polk, Planning for PKI: Best Practices Guide for Deploying Public Key Infrastructure, Wiley, NY, NY, March 2001, 352 pp. 249 APPENDIX A CROSSWALK OF CYBERSECURITY DOCUMENTS This Appendix includes a crosswalk of cybersecurity requirements of NISTIR 7628 with key source documents, NIST SP 800-53 Rev. 4 and the DHS Catalog46, and other standards47 relevant to the smart grid. The crosswalk is not an exhaustive mapping of all cybersecurity requirements and best practices applicable to the smart grid.

Explanation: NIST publication on credential and access management. Topics: authentication, pki, key management. Contains security framework guidance for authentication systems. Source: Guidelines for Smart Grid Cybersecurity.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Secure Data Network Systems (SDNS) Network, Transport, and Message Security Protocols say about 8.2 Security Encapsulation TPDU? According to Secure Data Network Systems (SDNS) Network, Transport, and Message Security Protocols, 8.2 Security Encapsulation TPDU: The structure of the SE TPDU shall be as follows: <!-- image -->

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Secure Data Network Systems (SDNS) Network, Transport, and Message Security Protocols.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Conformance Testing Methodology Framework for ANSI_NIST-ITL 1-2011 Update_ 2013, Data Format for the Interchange of Fingerprint, Facial & Other Biomet say about AN-2013 Annex G: Mapping to the NIEM IEPD? (Part 32) According to Conformance Testing Methodology Framework for ANSI_NIST-ITL 1-2011 Update_ 2013, Data Format for the Interchange of Fingerprint, Facial & Other Biomet, AN-2013 Annex G: Mapping to the NIEM IEPD: action Well- Formed | C.5.2, C.5.3 | All separators are defined by the W3C XMLrecommendations. The characters '<' and '>' are reserved exclusively for enclosing XMLelement names. Every element with a start tag <Name> shall have | 1 | NIEM- Well- Formed XML | Complex ( Test that the XML is well-formed according to W3C XML recommendations. | | M- Transaction | | | | X | | Req. # - ID | Ref.in Base Std. | Requirement Summary | L e v e | Assertion ID | Test Assertion | N o t e | Imp. Required | Imp. Support | Supporte d Range | Test Result | E n c .

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Conformance Testing Methodology Framework for ANSI_NIST-ITL 1-2011 Update_ 2013, Data Format for the Interchange of Fingerprint, Facial & Other Biomet.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain Follow the requirements listed in this document, its annex, and the associated component specifications and set of schemas. according to NIST The Technical Specification for the Security Content Automation Protocol (SCAP)_ SCAP Version 1.3 According to The Technical Specification for the Security Content Automation Protocol (SCAP)_ SCAP Version 1.3, Follow the requirements listed in this document, its annex, and the associated component specifications and set of schemas.: Organizations should ensure that their implementation and use of SCAP 1.3 is compliant with the requirements detailed in each component specification, this document and its annex, and the set of schemas. If requirements are in conflict between component specifications, this document will provide clarification. If a component specification is in conflict with this document, the requirements in this document take precedence. If a component specification or this document is in conflict with the annex, the requirements in the annex take precedence. If a specification and a schema are in conflict, the requirements in the specification take precedence.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: The Technical Specification for the Security Content Automation Protocol (SCAP)_ SCAP Version 1.3.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is Discussion according to NIST_SP_800-53r5_Security_Privacy_Controls? Discussion: Authorized and qualified personnel within the jurisdiction of the organization

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: NIST_SP_800-53r5_Security_Privacy_Controls.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Foundational PNT Profile_ Applying the Cybersecurity Framework for the Responsible Use of Positioning, Navigation, and Timing (PNT) Services provide? (Section 213) ble at Sheet.pdf Federal Aviation Administration, U.S. Department of Transportation (2021) SBAS Worldwide. Available at Federal Trade Commission (2020) Jammer Enforcement. (FCC, Washington, DC). Available at Hopkin P (2018) Fundamentals of risk management: Understanding, evaluating and implementing effective risk management. Kogan Page Publishers. Available at 20Risk%20Management.pdf?sequence=1 International Maritime Organization (2002) IMO Resolution A.915(22) Revised Maritime Policy and Requirements for a Future GNSS. (IMO, London, England). Available at Documents/A.915(22).pdf International Organization for Standardization (2018) ISO 31000:2018 - Risk management Guidelines (ISO, Geneva, Switzerland). Available at https://www.iso.org/standard/65694.html International Organization for Standardization/International Electrotechnical Commission (2018) ISO/IEC 27005:2018 - Information technology - Security techniques - Information security risk management (ISO, Geneva, Switzerland). Available at https://www.iso.org/standard/75281.html Joint Task Force Transformation Initiative (2011) Managing Information Security Risk: Organization, Mission, and Information System View. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) 800-39. https://doi.org/10.6028/NIST.SP.800-39 Haimes, Y. Y., Kaplan, S., & Lambert, J. H. (2002). Risk filtering, ranking, and management framework using hierarchical holographic modeling. Risk Analysis, 22(2), 383-397. Lambert JH, Keisler JM, Wheeler WE, Collier ZA, Linkov I (2013).

Explanation: NIST cybersecurity documentation and standards guidance. Topics: nist sp, cybersecurity framework, fips. General security reference material without sensitive content. Source: Foundational PNT Profile_ Applying the Cybersecurity Framework for the Responsible Use of Positioning, Navigation, and Timing (PNT) Services.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain 4.6 Easy Interface into 2Factor/Biometric and Other Authentication Solutions according to NIST 6th Annual PKI R&D Workshop _Applications-Driven PKI_ Proceedings According to 6th Annual PKI R&D Workshop _Applications-Driven PKI_ Proceedings, 4.6 Easy Interface into 2Factor/Biometric and Other Authentication Solutions: In a typical PKI system, there exists two points of authentication. One is with the CA for issuing an initial certificate which is carried out once in a long time. The other is with the media such as a smartcard that contains the private key. Authentication to the media is usually static PIN-based, as it is the media that enforces the authentication. If the protection of the media requires more complicated or stronger authentication, a lot of more complexity will have to be built into the media, resulting in higher costs. Moreover, not all media can support all forms of strong authentication. In the OTPK system, only one point of authentication (with the CA) is needed. It is carried out when a private key needs to be used. Since the authentication can be centralized to a CA or a collection of CAs, there is economy of scale in implementing a strong authentication (such as 2-factor, biometric etc) to the CA and the cost can be shared across a large pool of entities. There is also no constraint on the media. This makes it easier to integrate a strong authentication mechanism into the OTPK system. However, we do recognize that there are limitations to the implementation of the 2-factor or biometric authentication to the CA. For example, while OTP tokens are suitable for Internet-based transactions, remote authentication over Internet using biometrics is inherently insecure, and subject to replay attacks. On the other hand, using biometrics within a controlled office or a Kiosk environment for paperless eDocument systems is more convenient as compared to the OTP tokens. These considerations will have to be taken into account when designing the OTPK deployment. We envision several scenarios where OTPK can be deployed: - Internet Transactions. A merchant operates an Internet trading portal which requires the user to digitally sign transactions to signify approval. Users will login to the portal using a browser. In such case, the

Explanation: NIST publication on credential and access management. Topics: authentication, pki, token. Contains security framework guidance for authentication systems. Source: 6th Annual PKI R&D Workshop _Applications-Driven PKI_ Proceedings.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Recommendation for Key Management_ Part 2 – Best Practices for Key Management Organizations provide? (Section 91) ied in Key Management Specifications as being required: - Certificate serial number - Authority Key Identifier - Certificate Extensions - Certificate validity period -start and expiration dates 5. In some other applications of public key cryptography (e.g., SSH), the following information shall be specified in Key Management Specifications as being required: - Key subtype -e.g., Host private key, known host key, user private key, authorized key) 82 - Account (to which the key is associated) 79 See Section 5.3.5 of SP 800-57, Part 1. 80 May span the validity periods of successive (i.e., replaced) certificates that include the same public key. 81 If the key type is a private key, the corresponding key is the public key of the key pair; if the key type is a public key, the corresponding key is the private key of the key pair. 82 Certificates and private keys are usually stored together. Because of the explicit trust model of SSH, public keys are stored separately. Consequently, it is important to know which component is where. - Authorized key options (e.g., cert-authority, no-agent-forwarding, no-pty) 83 A Key Management Specification should address any support for the restoration of protected communications in the event of the compromise, corruption, or loss of the keying material used by the cryptographic device or application. The recovery process description should include the methods for replacing keys and/or certificates with new keys. The methods for revocation and compromise notification (e.g., using RKNs) should be provided (e.g., the details for using Certificate Revocation Lists (CRLs) and Compromised Key Lists (CKLs)). When PKI certificates are used, a description of how certificates will be reissued with new public keys and replaced within the cryptographic application should also be included. General compromise-recovery guidance is provided in Section 9.3.4 of Part 1.

Explanation: NIST publication on credential and access management. Topics: pki, key management, sso. Contains security framework guidance for authentication systems. Source: Recommendation for Key Management_ Part 2 – Best Practices for Key Management Organizations.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Security and Privacy Controls for Information Systems and Organizations provide? (Section 995) ERESTS OF CONSUMERS AND PROVIDERS PROCESSING, STORAGE, AND SERVICE LOCATION ORGANIZATION-CONTROLLED CRYPTOGRAPHIC KEYS ORGANIZATION-CONTROLLED INTEGRITY CHECKING PROCESSING AND STORAGE LOCATION — U.S. JURISDICTION Developer Configuration Management SOFTWARE AND FIRMWARE INTEGRITY VERIFICATION ALTERNATIVE CONFIGURATION MANAGEMENT PROCESSES HARDWARE INTEGRITY VERIFICATION TRUSTED GENERATION MAPPING INTEGRITY FOR VERSION CONTROL TRUSTED DISTRIBUTION SECURITY AND PRIVACY REPRESENTATIVES Developer Testing and Evaluation STATIC CODE ANALYSIS THREAT MODELING AND VULNERABILITY ANALYSES INDEPENDENT VERIFICATION OF ASSESSMENT PLANS AND EVIDENCE MANUAL CODE REVIEWS PENETRATION TESTING ATTACK SURFACE REVIEWS O/S O/S O/S O/S O/S O/S O/S O/S O/S O/S O/S O/S O/S O/S O/S O/S O/S O/S O/S O O O O O O O O O O O O O O O O O O O O O O O O √ √ √ √ √ √ √ √ √ √ √ √ √ √ √ √ √ √ √ √ √ √ √ √ √ √ √ √ √ √ √ √ √ √ √ √ √ √ √ √ √ √ √ APPENDIX C PAGE 455 NIST SP 800-53, REV. 5 SECURITY AND PRIVACY CONTROLS FOR INFORMATION SYSTEMS AND ORGANIZATIONS _________________________________________________________________________________________________ T h s i p u b l i c a t i o n i s a v a i l l a b e f r e e o f c h a r g e f r o m : h t t p s : / / d o i . o r g / 1 0 . 6 0 2 8 / N S T S P . 8 0 0 - 5 3 r 5 .

Explanation: NIST cybersecurity publication covering vulnerability management. Topics: vulnerability, penetration test. Contains technical security guidance that could inform defensive posture. Source: Security and Privacy Controls for Information Systems and Organizations.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control RA-3 in NIST_SP_800-53r5_Security_Privacy_Controls? (Part 5) Control RA-3: lytics capabilities to predict and identify risks to [Assignment: organization-defined systems or system components]: [Assignment: organization-defined advanced automation and analytics capabilities]. Discussion: A properly resourced Security Operations Center (SOC) or Computer Incident Response Team (CIRT) may be overwhelmed by the volume of information generated by the proliferation of security tools and appliances unless it employs advanced automation and analytics to analyze the data. Advanced automation and analytics capabilities are typically supported by artificial intelligence concepts, including machine learning. Examples include Automated Threat Discovery and Response (which includes broad-based collection, context- based analysis, and adaptive response capabilities), automated workflow operations, and machine assisted decision tools. Note, however, that sophisticated adversaries may be able CHAPTER THREE PAGE 241 T h s i p u b l i c a t i o n i s a v a i l l a b e f r e e o f c h a r g e f r o m : h t t p s : / / d o i . o r g / 1 0 . 6 0 2 8 / N S T S P . 8 0 0 - 5 3 r 5 . I NIST SP 800-53, REV. 5 SECURITY AND PRIVACY CONTROLS FOR INFORMATION SYSTEMS AND ORGANIZATIONS _________________________________________________________________________________________________ to extract information related to analytic parameters and retrain the machine learning to classify malicious activity as benign. Accordingly, machine learning is augmented by human monitoring to ensure that sophisticated adversaries are not able to conceal their activities. Related Controls: None. References: [OMB A-130], [SP 800-30], [SP 800-39], [SP 800-161], [IR 8023], [IR 8062], [IR 8272].

Explanation: NIST cybersecurity documentation and standards guidance. Topics: nist sp, fips, security control. General security reference material without sensitive content. Source: NIST_SP_800-53r5_Security_Privacy_Controls.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Guide for Security-Focused Configuration Management of Information Systems say about GLOSSARY? (Part 11) According to Guide for Security-Focused Configuration Management of Information Systems, GLOSSARY: cle of the equipment or service), and related resources. Information technology does not include any equipment that is acquired by a contractor incidental to a contract which does not require its use. | |--------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | information technology product | See system component . | | malicious code [SP 800-53] | Software or firmware intended to perform an unauthorized process that will have adverse impact on the confidentiality, integrity, or availability of an information system. A virus, worm, Trojan horse, or other code-based entity that infects a host. Spyware and some forms of adware are also examples of malicious code. | | malware | See Malicious malicious Ccode .

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Guide for Security-Focused Configuration Management of Information Systems.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain Risk Assessment Analysis: according to NIST Mobile Device Security_ Corporate-Owned Personally-Enabled (COPE) According to Mobile Device Security_ Corporate-Owned Personally-Enabled (COPE), Risk Assessment Analysis:: Overall Likelihood: Very High Justification: Often applications include hard-coded credentials for the default password of the administrator account. Default passwords are readily available online. These passwords may not be changed to allow for ease of access and to eliminate the pressure of remembering a password. Level of Impact: High Justification: Successful extraction of the credentials allows an attacker to gain unauthorized access to enterprise data.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control, assessment. General security reference material without sensitive content. Source: Mobile Device Security_ Corporate-Owned Personally-Enabled (COPE).


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Security Guidelines for Storage Infrastructure say about 4.3.3 Account Management Recommendations? (Part 1) According to Security Guidelines for Storage Infrastructure, 4.3.3 Account Management Recommendations: 4.3.3 Account Management Recommendations AC-SS-R14 - Use of accounts not associated with system users: Accounts not associated with any system user (e.g., not in Active Directory, such as 'guest,' 'anonymous,' 'nobody') should be disabled. In situations where they need to be used, they should not be mapped to any system user, and all of their default configurations (e.g., password, privileges) should be changed to conform to organization-wide policies. AC-SS-R15 - Account lockout: Users should be locked out after a certain number of unsuccessful login attempts. Certain implementations of account locking include automatic reset (account unlock) after a certain period of time or a power cycle. Automatic reset should not be allowed on sensitive storage systems. AC-SS-R16 -A local user account for emergency purposes: A single local user account should be maintained for access to storage resources in order to provide emergency-only access if the centralized authentication system is down. This account should conform to all organizational policies (e.g., password length). In addition, its usage should be allowed from a special physically protected location, and following well documented procedures that include appropriate approval of relevant stakeholders, and notification of use. AC-SS-R17 - Eliminate or disable default user accounts: The default user accounts that come with the storage system installations should be eliminated or disabled immediately, if the feature exists. When the feature to disable or eliminate does not exist or there is a justified reason to keep any of those accounts, the privileges assigned to this account should be kept to the minimum necessary. AC-SS-R18 - Limit local and default user accounts: As much as possible, eliminate the use of local and default accounts. In situations where this is not possible: - (a) Limit the use of such accounts and the privileges they have.

Explanation: NIST publication on credential and access management. Topics: authentication, sso. Contains security framework guidance for authentication systems. Source: Security Guidelines for Storage Infrastructure.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain Comments on this publication may be submitted to: according to NIST Codes for Identification of Federal and Federally-Assisted Organizations According to Codes for Identification of Federal and Federally-Assisted Organizations, Comments on this publication may be submitted to:: National Institute of Standards and Technology Attn: Computer Security Division, Information Technology Laboratory 100 Bureau Drive (Mail Stop 8930) Gaithersburg, MD 20899-8930 Email: piv\_comments@nist.gov All comments are subject to release under the Freedom of Information Act (FOIA).

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Codes for Identification of Federal and Federally-Assisted Organizations.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Guide to Enterprise Telework, Remote Access, and Bring Your Own Device (BYOD) Security provide? (Section 44) e sub-network joins the full network; or 2) place it at the perimeter of the full network and use additional mechanisms to restrict the teleworkers to only be able to access the specified sub-network. The value of placing the remote access server at the network perimeter versus the sub-network perimeter differs for the four types of remote access methods: -  Tunneling servers usually give administrators sufficient control over the internal resources to which a teleworker has access, such that there is little advantage to setting up a tunneling server at the edge of a sub-network, as opposed to the network perimeter. -  Portal servers run the application client software on the servers themselves. Placing them at the network perimeter has a similar effect as placing them at the edge of a sub-network because the remote access user is only running applications on the portal server, not on servers inside the network. -  Remote desktop access does not involve remote access servers, so there is no issue with the placement of the remote access server. -  Direct application access servers run the application server software on the servers themselves. Placing them at the network perimeter has a similar effect as placing them at the edge of a subnetwork because the remote access user is only running applications on the direct application access server, not on servers inside the network. Thus, the only types of remote access servers that may be appropriate to place at the sub-network perimeter are portal servers and direct application access servers, but even in those two cases, it is often better to run those on the organization's perimeter so that the organization's firewall can control access to these servers for all workers, not just teleworkers. Further, to simplify management of the network and the network's security policy, running all remote access servers at the network perimeter is also advisable.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Guide to Enterprise Telework, Remote Access, and Bring Your Own Device (BYOD) Security.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Considerations for Managing Internet of Things (IoT) Cybersecurity and Privacy Risks provide? (Section 30) oS) attacks against other organizations, and eavesdropping on network traffic or compromising other devices on the same network segment. This goal applies to all IoT devices. 2. Protect data security. Protect the confidentiality, integrity, and/or availability of data (including PII) collected by, stored on, processed by, or transmitted to or from the IoT device. This goal applies to each IoT device except those without any data that needs protection. 3. Protect individuals' privacy. Protect individuals' privacy impacted by PII processing beyond risks managed through device and data security protection. This goal applies to all IoT devices that process PII or that directly or indirectly impact individuals. Figure 4: Risk Mitigation Goals <!-- image --> Each goal builds on the previous goal and does not replace it or negate the need for it. Meeting each of the risk mitigation goals involves addressing a set of risk mitigation areas , which are defined below. Each risk mitigation area defines an aspect of cybersecurity or privacy risk mitigation thought to be most significantly or unexpectedly affected for IoT by the risk considerations defined in Section 3. Risk mitigation areas for Goal 1, Protect Device Security: - Asset Management: Maintain a current, accurate inventory of all IoT devices and their relevant characteristics throughout the devices' lifecycles in order to use that information for cybersecurity and privacy risk management purposes. - Vulnerability Management: Identify and eliminate known vulnerabilities in IoT device software and firmware in order to reduce the likelihood and ease of exploitation and compromise. - Access Management: Prevent unauthorized and improper physical and logical access to, usage of, and administration of IoT devices by people, processes, and other computing devices. - Device Security Incident Detection: Monitor and analyze IoT device activity for signs of incidents involving device security.

Explanation: NIST cybersecurity publication covering vulnerability management. Topics: vulnerability, exploit. Contains technical security guidance that could inform defensive posture. Source: Considerations for Managing Internet of Things (IoT) Cybersecurity and Privacy Risks.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain 2.3.9 SECURITY IMPACT ANALYSIS according to NIST Guide for Security-Focused Configuration Management of Information Systems According to Guide for Security-Focused Configuration Management of Information Systems, 2.3.9 SECURITY IMPACT ANALYSIS: Security impact analysis is the analysis conducted by qualified staff within an organization to determine the extent to which changes to the system affect the security posture of the system. Because systems are typically in a constant state of change, it is important to understand the impact of changes on the functionality of existing security controls and in the context of organizational risk tolerance. Security impact analysis is incorporated into the documented configuration change control process. The analysis of the security impact of a change occurs when changes are analyzed and evaluated for adverse impact on security, preferably before they are approved and implemented, but also in the case of emergency/unscheduled changes. Once the changes are implemented and tested, a security impact analysis (and/or assessment) is performed to ensure that the changes have been implemented as approved, and to determine if there are any unanticipated effects of the change on existing security controls. Security impact analysis is performed as a part of the Controlling Configuration Changes phase of SecCM and supports the implementation of NIST [SP 800-53] control CM-4 Security Impact Analysis.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control, assessment. General security reference material without sensitive content. Source: Guide for Security-Focused Configuration Management of Information Systems.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control PS-201 in Trustworthy Email? (Part 114) Control PS-201: f authenticated mail. A range of different users require access to these disparate private keys: - �e email server must have use of the private key used for TLS and the private key must be protected. - �e end user (and possibly an enterprise security administrator) must have access to private keys for S/MIME or OpenPGP message signing and key decipherment . Special care is needed to ensure that only the relevant parties have access and control over the respective keys . For federal agencies, this means compliance with all relevant policy and best practice for the protection of key material [SP800 -57pt1] and message contents (e.g., FOIA, eDiscovery, etc.). Security Consideration 7-2: Enterprises should establish a cryptographic key management system (CKMS) for keys associated with protecting email sessions with end users. For federal agencies, this means compliance with all relevant policy and best practice for the protection of key material [SP800 -57pt1]. ## 7.4.2 Confidentiality of Data at Rest �is publication is about securing email and its associated data . �is is one aspect of securing data in transit. To the extent that email comes to rest in persistent storage in mailboxes and file stores, there is some overlap with NIST SP 800-111 [SP800-111]. �ere is an issue in the tradeoff between accessibility and confidentiality when using mailboxes as persistent storage. End users and their organizations are expected to manage their own private keys, and historical versions of these may remain available to enable the decryption of mail encrypted by communicating partners, and to authenticate cc: mail sent to partners, which have been also stored locally. Partners who sign their mail, and decrypt received mail, make their public keys available through certificates, or through DANE records ( i.e., TLSA, OPENPGPKEY, SMIMEA) in the DNS . �ese certificates generally have a l isted expiry date and are rolled over and replaced with new certificates containing new keys .

Explanation: NIST publication on credential and access management. Topics: key management, sso. Contains security framework guidance for authentication systems. Source: Trustworthy Email.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Assessing Security and Privacy Controls in Information Systems and Organizations provide? (Section 152) s for which informaon ﬂow control is enforced by privacy ﬁlters are deﬁned; CHAPTER FOUR PAGE 62 Reference produced from open data hps://github.com/usnistgov/oscal-content NIST SP 800-53A, REV. 5 ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS AC-04(08) INFORMATION FLOW ENFORCEMENT | SECURITY AND PRIVACY POLICY FILTERS AC-04(08)_ODP[05] one or more of the following PARAMETER VALUES is/are selected: {block; strip; modify; quaranne}; AC-04(08)_ODP[06] security policy idenfying acons to be taken aer a ﬁlter processing failure are deﬁned; AC-04(08)_ODP[07] privacy policy idenfying acons to be taken aer a ﬁlter processing failure are deﬁned; AC-04(08)(a)[01] AC-04(08)(a)[02] informaon ﬂow control is enforced using <AC-04(08)_ODP[01] security policy ﬁlter> as a basis for ﬂow control decisions for <AC-04(08)_ODP[03] informaon ﬂows>; informaon ﬂow control is enforced using <AC-04(08)_ODP[02] privacy policy ﬁlter> as a basis for ﬂow control decisions for <AC-04(08)_ODP[04] informaon ﬂows>; AC-04(08)(b) <AC-04(08)_ODP[05] SELECTED PARAMETER VALUE(S)> data aer a ﬁlter processing failure in accordance with <AC-04(08)_ODP[06] security policy>; <AC-04(08)_ODP[05] SELECTED PARAMETER VALUE(S)> data aer a ﬁlter processing failure in accordance with <AC-04(08)_ODP[07] privacy policy>. POTENTIAL ASSESSMENT METHODS AND OBJECTS: AC-04(08)-Examine [SELECT FROM: Access control policy; informaon ﬂow control policies; procedures addressing informaon ﬂow enforcement; system design documentaon; system conﬁguraon sengs and associated documentaon; list of security policy ﬁlters regulang ﬂow control decisions; list of privacy policy ﬁlters regulang ﬂow control decisions; system audit records; system security plan; privacy plan; other relevant documents or records].

Explanation: NIST publication on credential and access management. Topics: access control, sso. Contains security framework guidance for authentication systems. Source: Assessing Security and Privacy Controls in Information Systems and Organizations.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control SI-23 in Developing Cyber-Resilient Systems_ A Systems Security Engineering Approach? Control SI-23: Monitoring and Damage Assessment, Behavior Validation Monitoring and Damage Assessment, Behavior Validation Detect

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control, assessment. General security reference material without sensitive content. Source: Developing Cyber-Resilient Systems_ A Systems Security Engineering Approach.