You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control RS-0010 in Biometric Specifications for Personal Identity Verification? (Part 29) Control RS-0010: | '97' | | | | | | A1 | Var. | Biometric Header Template (BHT) conforming to ISO/IEC 19785-3:2005 | Biometric Header Template (BHT) conforming to ISO/IEC 19785-3:2005 | Biometric Header Template (BHT) conforming to ISO/IEC 19785-3:2005 | | | | | | | | | Tag | Len.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Biometric Specifications for Personal Identity Verification.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Securing Telehealth Remote Patient Monitoring Ecosystem say about E-1 Device Capabilities Mapping? (Part 45) According to Securing Telehealth Remote Patient Monitoring Ecosystem, E-1 Device Capabilities Mapping: | | PR.DS-3: Assets are formally managed throughout removal, transfers, and disposition. | N/A | N/A | 45 C.F.R. §§ 164.308(a)(1)(ii)(A) 164.310(a)(2)(ii) 164.310(a)(2)(iii) 164.310(a)(2)(iv) 164.310(d)(1) 164.310(d)(2) | | PR.DS-4: Adequate capacity to ensure availability is maintained. |  Ability to enforce configured disk quotas.  Ability to provide sufficient resources to store and run the operating environment (e.g., operating systems, firmware, applications).  Ability to utilize file compression technologies (e.g., to protect against denial of service). | N/A | 45 C.F.R. §§ 164.308(a)(1)(ii)(A) 164.308(a)(1)(ii)(B) 164.308(a)(7) 164.310(a)(2)(i) 164.310(d)(2)(iv) 164.312(a)(2)(ii) | | PR.DS-5: Protections against data leaks are implemented. |  Ability to control device responses to device input.  Ability to control output from the device. | N/A | 45 C.F.R. §§ 164.308(a)(1)(ii)(D) 164.308(a)(3) 164.308(a)(4) 164.310(b) 164.310(c) 164.312(a) | | PR.DS-6: Integrity checking |  Ability to identify software loaded on the IoT device based on IoT device identity. |  Providing documentation and/or other communications describing how to | 45 C.F.R. §§ 164.308(a)(1)(ii)(D) | .

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Securing Telehealth Remote Patient Monitoring Ecosystem.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Guidelines on Securing Public Web Servers say about Miscellaneous Web Security Resources? According to Guidelines on Securing Public Web Servers, Miscellaneous Web Security Resources: | Resource/Title | URL | |---------------------------------------|----------------------------------------------------------------------| | dominosecurity.org | | | Honeynet Project | | | Lotus Domino Security Page | http://www-128.ibm.com/developerworks/lotus/security/ | | Microsoft Internet Explorer Home Page | http://www.microsoft.com/windows/products/winfamily/ie/default .mspx | | Mozilla Security Center | http://www.mozilla.org/security/ | | Netcraft | http://www.netcraft.com/ |

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Guidelines on Securing Public Web Servers.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Securing Web Transactions_ TLS Server Certificate Management provide? (Section 327) ources. Examples include file servers (to store files), print servers (to manage one or more printers), network servers (to manage network traffic), and database servers (to process database queries). (NIST SP 800-47) | | Service Provider | A provider of basic services or value-added services for operation of a network; generally refers to public carriers and other commercial enterprises. (NISTIR 4734) | | Simple Certificate Enrollment Protocol (SCEP) | A protocol defined in an IETF internet draft specification that is used by numerous manufacturers of network equipment and software that are developing simplified means of handling certificates for large-scale implementation to everyday users, as well as referenced in other industry standards. | | Simple Mail Transfer Protocol | The primary protocol used to transfer electronic mail messages on the internet. (NISTIR 7387) | | Special Publication | A type of publication issued by NIST. Specifically, the Special Publica- tion 800 series reports on the Information Technology Laboratory's research, guidelines, and outreach efforts in computer security and its collaborative activities with industry, government, and academic | | | organizations. The 1800 series reports the results of National Cyber- security Center of Excellence demonstration projects.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: nist sp, fips, security control. General security reference material without sensitive content. Source: Securing Web Transactions_ TLS Server Certificate Management.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Computer Security Training & Awareness Course Compendium say about VENDOR:? According to Computer Security Training & Awareness Course Compendium, VENDOR:: Anne Arundel Community College Engineering and Computer Technology Careers 219 101 College Parkway Arnold, MD 21012-1895 Gail Reese: (410) 541-2758 A survey of topics in data retention and control and techniques associated with data, computer systems, network and installation security. The student will obtain skills related to occupations in data libraries and data security at computer installations. NOTE: Three semester hours; prerequisite: CSI 113 or permission of department head. COURSE TITLE: COURSE LENGTH: 2 DAYS TEMPEST Program Management and Systems Engineering

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Computer Security Training & Awareness Course Compendium.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations provide? (Section 408) ended user environment for the product or service, and supplier information. Define risk analysis and the criteria that will be utilized to assess the scoring of the product or service being assessed. Include a rubric with categorical definitions to encourage the transparency of assessment results. The C-SCRA risk exposure reflects a combined judgement based on likelihood and impact analyses. The likelihood analysis is scored via a combination of the aforementioned threat and vulnerability analysis score, as outlined in the figure below. Fig. 11. Example Likelihood Determination | Likelihood Level | Likelihood Level | Likelihood Level | Likelihood Level | Likelihood Level | Likelihood Level | |--------------------|--------------------|--------------------|--------------------|--------------------|--------------------| | Threat | Vulnerability | Vulnerability | Vulnerability | Vulnerability | Vulnerability | | Threat | | Low | Moderate | High | Critical | | Threat | Critical | Moderately Likely | Highly Likely | Very Likely | Very Likely | | Threat | High | Moderately Likely | Highly Likely | Highly Likely | Very Likely | | Threat | Moderate | Unlikely | Moderately Likely | Highly Likely | Highly Likely | | Threat | Low | Unlikely | Unlikely | Moderately Likely | Moderately Likely | The C-SCRA risk exposure is then aggregated based on that likelihood score and the impact score. If multiple vulnerabilities are identified for a given product or service, each vulnerability shall be assigned a risk level based on its likelihood and impact. Fig. 12.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control, assessment. General security reference material without sensitive content. Source: Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Security Guidelines for Storage Infrastructure provide? (Section 61) backup is sensitive to multiple failures. For example, incorrect configuration could involve a live database backup performed without applying techniques to ensure consistency or write-order fidelity. Insufficient currency or retention could mean that at least some portion of the data, old or new, will be unrecoverable. An attacker, therefore, has a high motivation to target not only a 'primary' data asset but also its backup and copies. When existing copies cannot be compromised, another viable attack strategy could be to interfere with the backup process itself, thereby gradually 'poisoning' future copies. When enough time has passed, the attacker can return to the original goal of compromising the primary data assets, knowing that the only available copies for recovery are too old. Another type of 'poisoning' strategy is to specifically infect backup copies of compute or application assets, such as OS images, software packages, firmware, or even source code repositories. This way, when an individual component or even an entire environment is rebuilt in an attempt to battle an infection, at least some portions of the malware will be included in the restored environment, allowing the attacker to quickly regain control, or inflict more damage. The reversable obfuscation and/or encryption of data results in data becoming unavailable to the user or organization unless it is recovered using a key held only by an attacker. This type of risk is commonly used in ransomware attacks - a form of malware that encrypts the victim's data and demands a ransom to restore access to the data. Although it originally targeted data or files on users' computers or enterprise servers, ransomware has evolved to also include other storage components, such as NAS and backup appliances [30]. Data obfuscation and encryption typically originate from an external source but could also potentially be inflicted by an internal one.

Explanation: NIST cybersecurity publication covering vulnerability management. Topics: malware, ransomware. Contains technical security guidance that could inform defensive posture. Source: Security Guidelines for Storage Infrastructure.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Computer Security Division 2013 Annual Report say about Contact:? According to Computer Security Division 2013 Annual Report, Contact:: Dr. René Peralta (301) 975-8702 rene.peralta@nist.gov

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Computer Security Division 2013 Annual Report.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Status Report on the Final Round of the NIST Lightweight Cryptography Standardization Process say about 4. Benchmarking Results? According to Status Report on the Final Round of the NIST Lightweight Cryptography Standardization Process, 4. Benchmarking Results: This section summarizes the main software and hardware performance benchmarking initiatives that were considered during evaluation of the finalists. While these efforts provided crucial information on the performance of the finalists, it is important to note their limitations. Results may not present a complete picture of a finalist's potential for optimization in any particular metric. Further, not all implementations are designed with the same assumptions or goals, and there are more diverse implementations for some finalists than others. More efficient implementations are likely possible for all finalists. As such, the results of these efforts were considered as a general guide and not a strict ranking.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Status Report on the Final Round of the NIST Lightweight Cryptography Standardization Process.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Recommended Criteria for Cybersecurity Labeling of Consumer Software say about 2.1.2 Terminology Conventions? According to Recommended Criteria for Cybersecurity Labeling of Consumer Software, 2.1.2 Terminology Conventions: The Descriptive Claims group defines two terms, Claimant and Label Scope: A Claimant is defined in broad terms to encompass organizations of varying sizes and functions. This allows for individual developers, developer organizations, publishers, and others to act as the entity making the claims represented in a label and allows for flexibility on the part of the scheme owner. The Label Scope refers to what a label is describing. This allows a claimant to distinguish among software that is either included or excluded from the claims backed by the label (e.g., a mobile app versus a back-end server). This is especially important to the consumer, as it is often difficult to determine where these systems begin and end - their boundaries. For brevity, the criteria in this document frequently use the term 'software' and should be understood as referring to 'software within the label scope.'

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Recommended Criteria for Cybersecurity Labeling of Consumer Software.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control SI-11 in Guidelines for Smart Grid Cybersecurity? (Part 366) Control SI-11: nticating communication between smart meters and an AMI head end can help ensure that an adversary cannot falsely claim to be the AMI head end and issue control commands to the meter, update firmware. Authenticating the meter to the AMI head end can help ensure that usage information is retrieved from the correct meter. 35 As utilities merge and service territories change, a utility will eventually end up with a collection of smart meters from different vendors. Meter to/from AMI head end authentication should be interoperable to ensure that authentication and authorization information need not be updated separately on different vendor’s AMI systems. Demand response (DR) HAN devices should be securely authenticated to the HAN gateway and vice versa. It is important for a HAN device to authenticate any demand-response commands from the DR head end in order to prevent coordinated falsification of control commands across many HAN devices and/or at rapid rates could lead to grid stability problems. It is important that the DR head end authenticate the HAN device to ensure that commands are delivered to the correct device and that responses from that device are not forged. Interoperability of authentication is essential in order to ensure competition that will lead to low- cost consumer devices. This authentication process should be simple and user-friendly, since it will be utilized and installed by consumers who buy/rent HAN devices. HAN devices obtained by the consumer from the utility may be preprovisioned with authentication information, but HAN devices obtained from retail stores may require provisioning through an Internet connection or may receive their provisioning through the HAN gateway. Authentication and access control is important to meters and AMI access networks (e.g., neighborhood area networks (NANs) and HANs).

Explanation: NIST publication on credential and access management. Topics: access control, authentication, authorization. Contains security framework guidance for authentication systems. Source: Guidelines for Smart Grid Cybersecurity.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Blockchain and Related Technologies to Support Manufacturing Supply Chain Traceability_ Needs and Industry Perspectives say about Non-Technological? According to Blockchain and Related Technologies to Support Manufacturing Supply Chain Traceability_ Needs and Industry Perspectives, Non-Technological: Team spirit with a member in charge of governance. The right environment for co-innovation was set up. SITA volunteered to project manage the initiatives, induced a consortium spirit, and organized workshops where participants from all companies could brainstorm and work together face-to-face.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Blockchain and Related Technologies to Support Manufacturing Supply Chain Traceability_ Needs and Industry Perspectives.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control CM-8 in Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations? (Part 65) Control CM-8: | An organizational official responsible for the development, implementation, assessment, and monitoring of common controls (i.e., security controls inherited by information systems). | | Compensating Security Controls [NISTIR 7298] | The management, operational, and technical controls (i.e., safeguards or countermeasures) employed by an organizationin lieu of the recommended controls in the low, moderate, or high baselines described in NIST Special Publication 800-53, that provide equivalent or comparable protection for an information system. | | Comprehensive Testing [NISTIR 7298] | A test methodology that assumes explicit and substantial knowledge of the internal structure and implementation detail of the assessment object. Also known as white box testing. | | Computer Incident Response Team (CIRT) [CNSSI 4009] | Group of individuals usually consisting of Security Analysts organized to develop, recommend, and coordinate immediate mitigation actions for containment, eradication, and recovery resulting from computer security incidents. Also called a Computer Security Incident Response Team (CSIRT) or a CIRC (Computer Incident Response Center, Computer Incident Response Capability, or Cyber Incident Response Team). | | Confidentiality [44 U.S.C., Sec. 3542] | Preserving authorized restrictions on information access and disclosure, including means for protecting personal privacy and proprietary information. | | Configuration Control (or Configuration Management) [CNSSI 4009] | Process for controlling modifications to hardware, firmware, software, and documentation to protect the information system against improper modifications before, during, and after system implementation. | | Continuous Monitoring | Maintaining ongoing awareness to support organizational risk decisions.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: nist sp, fips, security control. General security reference material without sensitive content. Source: Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain 5.2.4 Management Interfaces according to NIST Securing Web Transactions_ TLS Server Certificate Management According to Securing Web Transactions_ TLS Server Certificate Management, 5.2.4 Management Interfaces: Certificate owners and the Certificate Services team should provide user interfaces to view and manage certificates. The interfaces should be simple enough to support certificate owners who have small numbers of certificates and perform management operations infrequently. The interfaces should also offer more-sophisticated functionality to support the needs of certificate owners with large numbers of certificates and the needs of the Certificate Services team. The interfaces should provide the following characteristics and functions: -  Inventory view : Certificate owners should be able to view their certificates (to which they have been granted access). The Certificate Services team should be able to view the entire inventory. -  Searching and filtering : Certificate owners with large numbers of certificates, and the Certificate Services team, should be able to search and filter operations so they can quickly find specific certificates. -  Enrollment and renewal : The portal should provide a simple method to request new certificates and to renew existing certificates. Having a single interface for enrollment and renewal across all CAs reduces the retraining needed when moving CAs, resulting in better crypto-agility. -  Approvals : If an external system is not used for reviewing certificate requests, then the portal should provide a method for an approver to perform RA functions to review the relevant details of certificate requests and to approve/reject the requests with comments.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Securing Web Transactions_ TLS Server Certificate Management.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control HA-256 in Derived PIV Application and Data Model Test Guidelines? (Part 183) Control HA-256: --------------------------------------------------------------| | Purpose | Verifies that the public key algorithm used for generating the keys is as specified in Table 3-4 of [SP800-78]. | | DTR(s) | • DTR-07.03.01.03 • DTR-07.03.01.04 | | Issuer Documentation | None. | | Precondition(s) | • A token with the Derived PIV Application is inserted into an appropriate token reader. • Suitable drivers have been loaded between the test system and an instance of the reader. • A Derived PIV Authentication certificate is present within the Derived PIV Application. | | Test Scenario | 1. Send the SELECT command with • AID == 'A0 00 00 03 08 00 00 20 00 01 00' 2. Send the GET DATA command with • Data field of the command containing the tag ('5FC105') of the X.509 Certificate for Derived PIV Authentication data object 3. Extract subjectPublicKeyInfo->algorithm->algorithm field value 4. Match the algorithm value to the Table 3-4 of [SP800-78]. 5. If the algorithm is elliptic curve, ensure that the OID for Curve P-256 from Table 3-5 of [SP800-78] is populated in the subjectPublicKeyInfo->algorithm- >parameters->namedCurve field. Note: If the RSA algorithm is used, the subjectPublicKeyInfo->algorithm->parameters field will be NULL. | | Expected Result(s) | 1.

Explanation: NIST publication on credential and access management. Topics: authentication, token. Contains security framework guidance for authentication systems. Source: Derived PIV Application and Data Model Test Guidelines.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control CS-3 in U.S. Department of Energy Risk Assessment Methodology? (Part 121) Control CS-3: ware & | Communications: | Sabotage Unauthorized access Accidents | | M M M H | 3 2 1 1 | | (Hard- Software): | Lighting All | environmental threats | | M | 1 | | f) Procedures, Administration, and Management: | Storm* All environmental | threats | | M M | 1 1 | | g) Environmental Security and Safety: | Storms Fire | | | M L | 1 2 | t 4 ' ii <!-- image --> | DEPARTMENT OF ENERGY ADP SYSTEM RISK ASSESSMENT | DEPARTMENT OF ENERGY ADP SYSTEM RISK ASSESSMENT | DEPARTMENT OF ENERGY ADP SYSTEM RISK ASSESSMENT | EXECUTIVE SUMMARY | EXECUTIVE SUMMARY | PAGE 5 | PAGE 5 | |----------------------------------------------------------------|----------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------|----------------------------------------------------------------|----------------------------------------------------------------| | 5 , COUfiTBRMEASUfiES tDENTmCAJIONS AND WSK PROFILE ACCEPTANCE | 5 , COUfiTBRMEASUfiES tDENTmCAJIONS AND WSK PROFILE ACCEPTANCE | 5 , COUfiTBRMEASUfiES tDENTmCAJIONS AND WSK PROFILE ACCEPTANCE | 5 , COUfiTBRMEASUfiES tDENTmCAJIONS AND WSK PROFILE ACCEPTANCE | 5 , COUfiTBRMEASUfiES tDENTmCAJIONS AND WSK PROFILE ACCEPTANCE | 5 , COUfiTBRMEASUfiES tDENTmCAJIONS AND WSK PROFILE ACCEPTANCE | 5 , COUfiTBRMEASUfiES tDENTmCAJIONS AND WSK PROFILE ACCEPTANCE | | (1) SECURITY DISCIPLINE AREA | (a ) accept CURRENT RISK PROFILE (YES OR NO) | (b)

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control, assessment. General security reference material without sensitive content. Source: U.S. Department of Energy Risk Assessment Methodology.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does A Comparison of Attribute Based Access Control (ABAC) Standards for Data Service Applications_ Extensible Access Control Markup Language (XACML) and N provide? (Section 45) licy is to allow access under these critical situations, a policy combining algorithm of 'permit-overrides' is used, while still denying access if only the conditions stated in Rule 1 or Rule 2 apply. ``` // Doctor Access to Medical Records // <Target> /* :Attribute-Category :Attribute ID :Attribute Value */ :access-subject :Role :doctor :access-subject :Role :intern :resource :Resource-id :medical-records :action :Action-id :read :action :Action-id :write </Target> <Rule RuleId = 'Rule 1' Effect='Deny'> <Condition> ``` ``` Function: string-not-equal ``` ``` /* :Attribute-Category :Attribute ID */ :access-subject :WardAssignment :resource :WardLocation </Condition> </Rule> <Rule RuleId = 'Rule 2' Effect='Deny'> <Condition> Function: and Function: string-equal /* :Attribute-Category :Attribute ID :Attribute Value */ :access-subject :Role :intern Function: string-equal /* :Attribute-Category : Attribute ID :Attribute Value */ :action :Action-id :write </Condition> </Rule> <Rule RuleId = 'Rule 3' Effect='Permit'> <Condition> Function: and Function: string-equal /* :Attribute-Category :Attribute ID :Attribute Value */ :access-subject :Role :doctor Function: string-equal /* :Attribute-Category :Attribute ID :Attribute Value */ :resource :PatientStatus :critical </Condition> </Rule> </Policy> ``` Together policies (PolicySets and Policies) and attribute assignments define the authorization state. Table 1 defines the authorization state for Policy 1 by specifying attribute names and values.

Explanation: NIST publication on credential and access management. Topics: access control, authorization. Contains security framework guidance for authentication systems. Source: A Comparison of Attribute Based Access Control (ABAC) Standards for Data Service Applications_ Extensible Access Control Markup Language (XACML) and N.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does 2016 NIST_ITL Cybersecurity Program Annual Report say about CONTACTS:? According to 2016 NIST_ITL Cybersecurity Program Annual Report, CONTACTS:: Ms. Elaine Barker (301) 975-2911 elaine.barker@nist.gov Mr. John Kelsey (301) 975-5101 john.kelsey@nist.gov Dr. Meltem Sönmez Turan (301) 975-4391 Dr. Kerry McKay (301) 975-4969 meltem.turan@nist.gov kerry.mckay@nist.gov

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: 2016 NIST_ITL Cybersecurity Program Annual Report.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Audit and Evaluation of Computer Security II_ System Vulnerabilities and Controls say about 3..8 Session 8. Data Bases and Data Base Management Systems? According to Audit and Evaluation of Computer Security II_ System Vulnerabilities and Controls, 3..8 Session 8. Data Bases and Data Base Management Systems: This, the last session of the workshop, sounds like a very well-defined area with clear limits or boundaries. In a sense it is, but this does not mean it is simple. The state of the art in Data Base Management Systems finds us coming to grips with a variety of structures. There are network, hierarchical, and relational structures with proliferations of access methods, linkages, relationships, and file inversions. There is no universal form for these, and theory and standards are sparse. The challenge to this session has two major aspects. We must deal with the problem of variety, as in most of the other sessions. The other aspect has to do with auditor independence. When an auditor uses a query language to draw information from a data base, he is dependent on the system structure. Should the auditor have an independent access path to data? I phrased this as a question rather than a position; but let me leave no doubt that auditability is, in itself, a control and we have to provide for auditability in all our workshop sessions.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Audit and Evaluation of Computer Security II_ System Vulnerabilities and Controls.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Security Considerations for Voice Over IP Systems say about 4.2.1.3 H.235v2 Annex D - Voice Encryption Option? (Part 3) According to Security Considerations for Voice Over IP Systems, 4.2.1.3 H.235v2 Annex D - Voice Encryption Option: cate requests | | The voice encryption option describes the master key exchange during H.225.0 call signaling and the generation and distribution of media stream keys during H.245 call control. The encryption algorithms are to be used in CBC mode. New is the support of the AES. AES and TDEA may also be used in EOFB mode. The following security mechanisms are described within the voice encryption security profile: - Encryption of RTP packets with an assortment of algorithms and modes to be taken; - Key management with key and security capability exchange; - Key update mechanism and synchronization. The following issues are not covered by this profile: - Encryption and key management for RTCP; - Authentication and integrity for RTP and RTCP (a lightweight authentication and integrity could be provided by media anti-spamming). To counter denial of service and flooding attacks on discovered RTP/UDP ports, the H.235 standard defines the media anti-spamming procedure, which provides lightweight RTP packet authentication and integrity on selected fields through a computed message authentication code (MAC). The algorithms used are tripleDES-MAC or the cryptographic one-way function SHA1. Media anti-spamming uses the padding mechanism of RTP. For this feature, no special security profile was specified in H.235 like the voice encryption security profile for the RTP encryption, but media anti-spamming may be used in combination with media encryption.

Explanation: NIST publication on credential and access management. Topics: authentication, key management, sso. Contains security framework guidance for authentication systems. Source: Security Considerations for Voice Over IP Systems.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain 6.1 Purpose according to NIST Report of the NIST Workshop on Digital Signature Certificate Management, December 10-11, 1992 According to Report of the NIST Workshop on Digital Signature Certificate Management, December 10-11, 1992, 6.1 Purpose: A RevocationList is created by an authority (A) to enumerate all 'active' revoked certificates issued by a set of authorities, which may or may not include A. A revoked certificate is active if it has been issued and the expiry date of the certificate it revokes has not been reached. A Revocation List provides assurance that there are no other active Revoked Certificates issued by the named authorities.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Report of the NIST Workshop on Digital Signature Certificate Management, December 10-11, 1992.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Technology Assessment_ Methods for Measuring the Level of Computer Security say about LIST OF TABLES? (Part 1) According to Technology Assessment_ Methods for Measuring the Level of Computer Security, LIST OF TABLES: LIST OF TABLES | Table | | Page | |---------|-------------------------------------------------------------------------------------------------|--------| | 2-1 2-2 | Environmental Parameter Categories , Dedicated Data Base Management System | 2-2 | | | (e.g.. Airline Reservations) | 2-4 | | 2- 3 | Environmental Influences | 2-6 | | 3- 1 | Applications Systems Controls from the Systems Auditability and Control Study | 3-3 | | 3-2 | Computer Service Center Control Structure | 3-5 | | 3-3 | Application System Development Control Structure | 3-6 | | 3-4 | AFIPS Guideline Evaluation Categories | 3-8 | | 3-5 | Control Evaluation Guide of the Canadian Institute of Chartered Accountants | 3-11 | | 3-6 | Illustrative General Control Structure | 3-21 | | 3-7 | Mutually Exclusive Exposures | 3-23 | | 3-8 | Overlapping Exposures | 3-24 | | 4- 1 | Touche Ross Application Activities Subject to Control ,.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control, assessment. General security reference material without sensitive content. Source: Technology Assessment_ Methods for Measuring the Level of Computer Security.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control PD-12 in Codes for Identification of Federal and Federally-Assisted Organizations? (Part 65) Control PD-12: | | | Federally Aided Organization: | | 6991 | National Railroad Passenger Corporation (AMTRAK) | ## TABLE OF ORGANIZATIONS AND CODES EXECUTIVE DEPARTMENTS ## (and their associated organizations) ## Code Organization | 2000 | TREASURY , Department of the | |--------|--------------------------------------------------------| | 2001 | Departmental Offices | | 2004 | Inspector General | | 2014 | Office of the Inspector General for Tax Administration | | 2046 | Office of the Comptroller of the Currency | | 2041 | Bureau of Engraving and Printing | | 2042 | Bureau of the Fiscal Service | | 2044 | United States Mint | | 2022 | Alcohol and Tobacco Tax and Trade Bureau | | 2026 | Financial Crimes Enforcement Network | | 2050 | Internal Revenue Service | | | Associated Federal Organizations: | | 2061 | Federal Financing Bank | | 2066 | Community Development Financial Institutions | | | Federally Aided Organizations: | | 2093 | District of Columbia | | 2094 | District of Columbia Public School | ## TABLE OF ORGANIZATIONS AND CODES EXECUTIVE DEPARTMENTS ## (and their associated organizations) ## Code Organization | 3600 | VETERANS AFFAIRS , Department of | |--------|-----------------------------------------------------------------------------------| | 3601 |

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Codes for Identification of Federal and Federally-Assisted Organizations.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Recommendations for Federal Vulnerability Disclosure Guidelines say about 2.1.3. Develop Technical Analysis Capability? According to Recommendations for Federal Vulnerability Disclosure Guidelines, 2.1.3. Develop Technical Analysis Capability: The FCB may develop technical vulnerability analysis and remediation capabilities to triage the importance of incoming source vulnerability reports, verify the existence of reported vulnerabilities, and assist the VDPO closest to an affected system with analysis and remediation efforts. They could be used, for example, to address severe vulnerabilities applicable to multiple VDPOs and to assist smaller VDPOs that may not have sufficient resources to assess and remediate vulnerabilities.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Recommendations for Federal Vulnerability Disclosure Guidelines.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations say about Sample Text? (Part 4) According to Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations, Sample Text: | Establish processes to respond to identified risks and to monitor for impacts to the enterprise's supply chain | Cancelled | … | … | … | Table 16. Objective 3 - Implementation milestones to position the enterprise as an industry leader in C-SCRM | Implementation Plan Milestone | Status | Owner | Priority | Target Date | |---------------------------------------------------------------------------------------------------------------------------------------------|-----------|---------|------------|---------------| | Coordinate and engage with national security and law enforcement to ensure rapid access to mission-critical supply chain threats | Planned | J. Doe | Do Now | XX/XX/XX | | Evaluate C-SCRM improvement opportunities, and strengthen requirements and oversight for industry-wide common solutions and shared services | Complete | … | Do Next | … | | Advocate for C-SCRM awareness and competency through training and workforce development, to include secure coding training for developers | Delayed | … | Do Later | … | | Release white papers and public guidance related to C-SCRM | Cancelled | … | … | … |

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain CONTACTS: according to NIST Computer Security Division 2014 Annual Report According to Computer Security Division 2014 Annual Report, CONTACTS:: Mr. Rick Kuhn (301) 975-3337 kuhn@nist.gov Dr. Raghu Kacker (301) 975-2109 raghu.kacker@nist.gov

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Computer Security Division 2014 Annual Report.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is Note according to Security Guidance for First Responder Mobile and Wearable Devices? Note: 802.1X is still used in WPA, WPA2, and WPA3 personal protocols, however, it generally takes place within the authenticator since an authenticator server is not used in WPA personal networks.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Security Guidance for First Responder Mobile and Wearable Devices.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does A Profile for U.S. Federal Cryptographic Key Management Systems (CKMS) say about 4.11.7 Changing FCKMS Security Policies? (Part 2) According to A Profile for U.S. Federal Cryptographic Key Management Systems (CKMS), 4.11.7 Changing FCKMS Security Policies: peration of the changed security-domain protection mechanisms; and f) Coordinate with the domain authorities of other domains with which an equivalence or compatibility has previously been determined. | |-----------|---------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | PF:4.9 | | A Federal CKMS could support the manual configuration and/or automated negotiation of modified FCKMS Security Policies for interaction with entities in different domains that are approved by all affected Security Domain authorities. |

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: A Profile for U.S. Federal Cryptographic Key Management Systems (CKMS).


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Security Assurance Requirements for Linux Application Container Deployments provide? (Section 51) use of enterprise-grade authentication services using strong credentials and directories, and isolating containers to separate hosts based on the sensitivity level of the applications running in them. In addition to these countermeasures, the orchestration artifacts should satisfy the following security assurance requirements: - (a) Clusters should have capabilities for logging and monitoring the resource consumption patterns of individual containers to avoid unanticipated spikes in resource usage leading to non-availability of critical resources. - (b) The Orchestration platform must be usable on containerized infrastructures with more than one host OS. In other words, the orchestration tools used must be container-host OS-neutral. Using different tools for different container host OS platforms increases the probability of denial-of-service attacks in those environments since the enterprise is not able to obtain a global picture of resource usage for all running containers in the entire containerized infrastructure of the enterprise. While discussing a security solution (e.g., using mount namespace) in the context of a security objective (i.e., filesystem isolation), certain augmenting solutions are recommended since the solution under discussion cannot meet the objective by itself. However, there are some security solutions that, irrespective of any augmenting controls, impose certain limitations on the functionality and performance of certain container functions. Despite their direct impact affecting only functional and performance aspects, they may have an indirect impact on certain security parameters. For example, while setting up system call filters (with whitelist and blacklist) using Seccomp as a security solution (since system calls are not namespace-aware and thus ruling out the use of the namespaces feature), the presence of malicious processes can introduce accidental leakage between containers.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Security Assurance Requirements for Linux Application Container Deployments.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Non-Fungible Token Security provide? (Section 11) an asset. It is a token - a record maintained by a smart contract on a blockchain. The record may point to an asset or represent some intangible asset. The person buying an NFT is then buying a token. The token may or may not convey to the purchaser any legal rights over the asset. NFTs are often represented by standard ERC-721 in smart contracts on Ethereum or a similar standard on another blockchain (see Section 5 on token standards for more details). These standards provide minimum functionality to be implemented by NFT implementations. Additional functionality is possible, even expected. For example, NFT smart contracts may have an owner role that can perform management functions (e.g., [28]). Such functionality can include upgrading to a new smart contract (e.g., [29]). Such upgrades can provide the owner arbitrary functionality, including the expiring or delisting of purchased NFTs (e.g., [29]). The following non-exhaustive set of NFT properties can be derived from this definition. Most correctly functioning and secured NFT implementations will contain these properties (see Section 3.3 for caveats to this). 1. Owned: NFTs designate ownership by recording a blockchain address. 2. Transferable: Owners and designated approved entities can transfer the ownership of NFTs to other addresses. 3. Indivisible: NFTs cannot be subdivided (although the ownership may be fractionalized). 4. Linked: NFTs have references to the asset that they represent. 5. Recorded: NFTs are smart contract data records stored on a blockchain. 6. Provenance: NFTs have their chain of ownership recorded. 7. Permanence: NFTs are normally indestructible (although some are designed to be burned). 8. Immutable: The asset that an NFT represents cannot be modified. 9. Unique: Each NFT represents a unique asset. 10. Authentic: Each NFT asset is what the NFT claims it to be (e.g., artwork from a particular artist). 11. Authorized: Each NFT asset has been authorized by an owner to be sold as an NFT.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Non-Fungible Token Security.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does NIST_SP_800-207_Zero_Trust_Architecture say about Acknowledgments? According to NIST_SP_800-207_Zero_Trust_Architecture, Acknowledgments: This document is the product of a collaboration between multiple federal agencies and is overseen by the Federal CIO Council. The architecture subgroup is responsible for development of this document, but there are specific individuals who deserve recognition. These include Greg Holden, project manager of the Federal CIO Council ZTA project; Alper Kerman, project manager for the NIST/National Cybersecurity Center of Excellence ZTA effort; and Douglas Montgomery.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: NIST_SP_800-207_Zero_Trust_Architecture.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain 2.16.7 Policy Enforcement: Developing Policy Results according to NIST Data Integrity_ Identifying and Protecting Assets Against Ransomware and Other Destructive Events According to Data Integrity_ Identifying and Protecting Assets Against Ransomware and Other Destructive Events, 2.16.7 Policy Enforcement: Developing Policy Results: 1. Navigate to Policy > Policy Elements > Results > Posture > Requirements. 2. Click one of the black arrows next to the Edit link, and select Insert New Requirement. 3. Enter a name. 4. Select Windows All for Operating Systems. 5. Select 4.x or later for Compliance Module. 6. Select Temporal Agent for Posture. 7. Select User Defined Conditions > Anti-Malware Condition > Cisco AMP (substitute Cisco AMP with the name of the condition you just created). 8. Select Message Text Only for the Remediation Action. (Other remediation actions can be defined by going to Policy > Policy Elements > Results > Posture > Remediation Actions, but there is not an option for Cisco AMP to be installed, so we leave the default for now.) 9. Enter a Message to inform the user that they must install Cisco AMP. <!-- image --> 10. Click Save.

Explanation: NIST cybersecurity publication covering vulnerability management. Topics: malware, ransomware. Contains technical security guidance that could inform defensive posture. Source: Data Integrity_ Identifying and Protecting Assets Against Ransomware and Other Destructive Events.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control EC-1 in A Zero Trust Architecture Model for Access Control in Cloud-Native Applications in Multi-Cloud Environments? (Part 2) Control EC-1: riggered by user actions, a robust identity management system is required to assign and maintain user identities and enforce robust protocols with phishing-resistant multi-factor authentication (MFA). This system should be used to issue a cryptographically verifiable runtime token that represents the user principal to the rest of the infrastructure (e.g., a JSON Web Token [JWT]), and services should authenticate the credential at each hop. Note on the above recommendation: Authenticating the user in session at every hop is impractical at scale. Therefore, NIST recommends using short-lived end user credentials (e.g., OAuth 2.0 tokens) for external users and exchanging them for a locally authenticatable token, like a JWT, that is authenticated at each hop. - ID-SEG-REC-5: End user to resource authorization - As part of each service access request, the system must ensure that the authenticated end user principal (ID-SEG-REC4) is authorized to act on the resources designated in the request. This authorization may be performed by the application itself or checked locally (e.g., by checking against a set of claims in a JWT) or externally against an authorization system's policy decision point. The JWT libraries that process the token must be enabled to both decode (base64url encoding) and verify the signature. Enforcing end user authorization via the service mesh's sidecar PEP is particularly effective [3]. Context for the application of these policy recommendations and the improved security assurance that emanates from their deployment and enforcement are explained in [2] and [3]. ## Limitations of Identity-Based Segmentation Policies for Enterprise ZTA While identity-based segmentation is powerful, purely identity-based policies cannot currently be adopted due to the following scenarios: - Identity-based segmentation policies can include access scenarios that cover all origins (e.g., users, services) and all target resources that consist of services and data.

Explanation: NIST publication on credential and access management. Topics: access control, authentication, authorization. Contains security framework guidance for authentication systems. Source: A Zero Trust Architecture Model for Access Control in Cloud-Native Applications in Multi-Cloud Environments.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control AC-3 in Mobile Application Single Sign-On_ Improving Authentication for Public Safety First Responders? (Part 31) Control AC-3: what mitigates the potential for misuse of compromised access tokens. -  PKCE, as explained previously, prevents interception of the authorization code by malicious applications on the mobile device. ## 5.3 Scenarios and Findings The overall test scenario on Android devices involved launching the Motorola Solutions PSX Cockpit mobile application, authenticating, and then subsequently launching additional PSX applications and validating that the applications could access the back-end APIs and reflected the identity of the authenticated user. To enable testing of the two authentication scenarios, two separate 'user organization' infrastructures were created in the NCCoE lab, and both were registered as IdPs to the test PingFederate instance acting as the PSX AS. A 'domain selector' was created in PingFederate to perform IdP discovery based on the domain of the user's email address, enabling the user to trigger authentication at one of the IdPs. . On iOS devices, two demonstration applications-a chat application and a mapping application, with corresponding back-end APIs-were developed to demonstrate SSO. The iOS demo used the same authentication infrastructure in the NCCoE lab as the Android demo. The demo consisted of launching either application and authenticating to the IdP that supported OpenID Connect and FIDO UAF, then launching the additional demo application to demonstrate SSO and access to the back-end APIs with the identity of the authenticated user. Prior to testing the authentication infrastructure, users had to register U2F and UAF authenticators at the respective IdPs. FIDO authenticator registration requires a process that provides high assurance that the authenticator is in possession of the claimed account holder. In practice, this typically requires a strongly authenticated session or an in-person registration process overseen by an administrator.

Explanation: NIST publication on credential and access management. Topics: authentication, authorization, token. Contains security framework guidance for authentication systems. Source: Mobile Application Single Sign-On_ Improving Authentication for Public Safety First Responders.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control HA-3 in Computer Security Division 2015 Annual Report? (Part 60) Control HA-3: ute of Technology; - Christopher Boyer, Assistant Vice President, Public Policy, AT&T; - John R. Centafont, NSA Information Assurance and Cyber Defense; - David Cullinane, CEO, TruStar, LLC; - Dr. Kevin Fu, Associate Professor, The University of Michigan; - Gregory Garcia, Executive Vice President, McBee Strategic; - Jeffrey Greene, Esq., Director, Government Affairs, North America & Senior Policy Counsel, Senior Policy Counsel, Cybersecurity and Identity, Symantec Corporation; - Toby Levin, Retired (formerly Senior Advisor and Director of Privacy Policy, U.S. DHS); - Edward Roback, Associate Chief Information Officer for Cyber Security, U.S. Department of Treasury; and - Gale Stone, Deputy Assistant Inspector General for Audit, Social Security Administration (SSA). During FY 2014-2015, ISPAB held three meetings, all in Washington D.C: - October 22-24, 2014; - February 11-13, 2015; and - June 10-12, 2015. In keeping with previous practices at the first meeting of each fiscal year, the Board established a work plan for FY 2015 at the meeting in October 2014. The resulting plan included the following areas of focus: - Cryptography, and specifically NIST R&D; - Federally funded Research and Development Centers (FFRDCs) - internally, externally and control balance; - Metrics - success measure for security and privacy; - Trust in NIST (accountability and success); - Quantum mechanics; - Identity management (Biometrics); - Privacy technology - implementation methodology; - Medical devices - security, privacy and safety, Healthcare IT Security; 3 4 - FISMA - Continuous Diagnostics and Mitigation (CDM) and Federal Risk and Authorization Management Program (FedRAMP); - CDM - Communications Security, Reliability and Interoperability Council (CSRIC), Trusted Internet Connection (TIC); - Key ESCROW - history and lessons learned - Cybersecurity; and - Updates of other critical NIST publications.

Explanation: NIST publication on credential and access management. Topics: authorization, identity management, sso. Contains security framework guidance for authentication systems. Source: Computer Security Division 2015 Annual Report.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does PIV Card Application and Middleware Interface Test Guidelines (SP 800-73-4 Compliance) provide? (Section 164) PIV_INVALID_CARD_HANDLE . | | Postcondition(s) | 1. The PIV Middleware remains in the state it had prior to the pivEstablishSecureMessaging function call. 2. The precondition states are unaffected. | | Purpose | Ensure the PIV Middleware correctly handles a secure messaging failure. | |-----------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | Target | pivEstablishSecureMessaging | | Reference(s) | 1. SP 800-73-4 Part 3, Section 3.2.2 2. AS04.07A-R4 | | Precondition(s) | 1. Avalid PIV Card is placed within the reading range of the contactless reader. 2. There exists a valid connection between the test system and an instance of the contactless reader. 3. The client application owns a shared connection to the PIV Card Application ( sharedConnection := true ). | <!-- image --> | | 4. No other contactless card is within the proximity of the reader. 5.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: PIV Card Application and Middleware Interface Test Guidelines (SP 800-73-4 Compliance).


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Guide for Conducting Risk Assessments provide? (Section 207) - Guidance on organization-wide levels of impact needing no further consideration. - Identification of critical missions/business functions. - Exemplary set of impacts, annotated by the organization, if necessary. ( Table H-2 ) - Assessment scale for assessing the impact of threat events, annotated by the organization, if necessary. ( Table H-3 ) | No | Yes | Yes If not provided by Tier 2 | | From Tier 2: (Mission/business process level) - Impact information and guidance specific to Tier 2 (e.g., impact information related to mission/business processes, EA segments, common infrastructure, support services, common controls, and external dependencies). - Identification of high-value assets. | Yes Via RAR | Yes Via Peer Sharing | Yes | | From Tier 3: (Information system level) - Impact information and guidance specific to Tier 3 (e.g., likelihood information affecting information systems, information technologies, information system components, applications, networks, environments of operation). - Historical data on successful and unsuccessful cyber attacks; attack detection rates. - Security assessment reports (i.e., deficiencies in assessed controls identified as vulnerabilities). - Results of continuous monitoring activities (e.g., automated and nonautomated data feeds). - Vulnerability assessments, Red Team reports, or other reports from analyses of information systems, subsystems, information technology products, devices, networks, or applications. - Contingency Plans, Disaster Recovery Plans, Incident Reports.

Explanation: NIST cybersecurity publication covering vulnerability management. Topics: vulnerability, red team. Contains technical security guidance that could inform defensive posture. Source: Guide for Conducting Risk Assessments.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control AN-2011 in Conformance Test Architecture and Test Suite for ANSI_NIST-ITL 1-2011 NIEM XML Encoded Transactions? (Part 46) Control AN-2011: the AN-2011 standard) -  Modified : The Element FingerprintImageStitchedIndicator to only accept the character 'Y'. Reason : The Element was defined in the schema as a Boolean type ( true or false ). This prevented the base requirement of only allowing a single alphabetic character of 'Y' (Field 14.027 in Table 71 of the AN-2011 standard).

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Conformance Test Architecture and Test Suite for ANSI_NIST-ITL 1-2011 NIEM XML Encoded Transactions.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does The NIST Cybersecurity Framework (CSF) 2.0 provide? (Section 17) they represent a baseline of required actions to address cybersecurity risks. Quick-Start Guides (QSGs) are brief documents on specific CSF-related topics and are often tailored to specific audiences. QSGs can help an organization implement the CSF because they distill specific portions of the CSF into actionable 'first steps' that an organization can consider on the path to improving their cybersecurity posture and management of associated risks. The guides are revised in their own time frames, and new guides are added as needed. Suggestions for new Informative References for CSF 2.0 can always be shared with NIST at olir@nist.gov. Suggestions for other resources to reference on the NIST CSF website, including additional QSG topics, should be directed to cyberframework@nist.gov. The CSF's use will vary based on an organization's unique mission and risks. With an understanding of stakeholder expectations and risk appetite and tolerance (as outlined in GOVERN), an organization can prioritize cybersecurity activities to make informed decisions about cybersecurity expenditures and actions. An organization may choose to handle risk in one or more ways - including mitigating, transferring, avoiding, or accepting negative risks and realizing, sharing, enhancing, or accepting positive risks - depending on the potential impacts and likelihoods. Importantly, an organization can use the CSF both internally to manage its cybersecurity capabilities and externally to oversee or communicate with third parties. Regardless of the CSF's utilization, an organization may benefit from using the CSF as guidance to help it understand, assess, prioritize, and communicate cybersecurity risks and the actions that will manage those risks. The selected outcomes can be used to focus on and implement strategic decisions to improve cybersecurity postures and maintain continuity of missionessential functions while taking priorities and available resources into account.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: cybersecurity framework, csf, fips. General security reference material without sensitive content. Source: The NIST Cybersecurity Framework (CSF) 2.0.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control AM-1 in Cybersecurity Framework Profile for Hybrid Satellite Networks (HSN)? (Part 3) Control AM-1: ms risk assessment to include data and services provided externally. The HSN's prioritization effort often considers third-party relationships, agreements, and understandings between the participants. | NIST SP 800-53r5 SA-9, CP-2, AC-20, RA-2, RA-9, SA-20, SC-6 | | ID.AM-6: Cybersecurity roles and responsibilities for the entire workforce and third-party stakeholders (e.g., suppliers, customers, partners) are established. | Consider assigning cybersecurity roles and responsibilities to all participating organizations for the software, data, or components they manage. The roles and responsibilities of the external organization to the HSN are typically agreed upon in advance. Identify and resolve any inconsistencies or gaps in advance. | NIST SP 800-53r5 SA-9, CP-2, PM-2, PM-29, PS-7 ETSI TR 101 984 5.2 | ## 4.1.2. Identify: Business Environment Category The organization's mission, objectives, stakeholders, and activities are understood and prioritized; this information is used to inform cybersecurity roles, responsibilities, and risk management decisions. In the context of HSNs, identify the dependencies, obligations, and relationships between different organizations and their stakeholders to remove ambiguities and resolve any differences. The Business Environment category has five subcategories that apply to HSNs. Table 2. Business Environment Category for the Identify Function.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: nist sp, cybersecurity framework, fips. General security reference material without sensitive content. Source: Cybersecurity Framework Profile for Hybrid Satellite Networks (HSN).


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Automation Support for Security Control Assessments_ Volume 1_ Overview say about 2.2.1 Terms for Referring to Assessment Objects? According to Automation Support for Security Control Assessments_ Volume 1_ Overview, 2.2.1 Terms for Referring to Assessment Objects: This document generally uses the term assessment object . The meaning of assessment object as used herein is equivalent to the glossary definition but is focused on what could potentially have a security defect. Thus, as used in this NISTIR, the term assessment object more specifically refers to the following: Anything that can have a security defect (i.e., failed or absent control). Examples include devices, software, people, credentials, accounts, privileges, and things to which privileges are granted (including data and physical facilities). Assessment object is a general concept and used where generality is implied. However, in the context of a specific capability (or group of capabilities), it may be clearer to use a more specific term. Many capabilities focus on assessment objects with defects. Hardware Asset Management (HWAM) and Software Asset Management (SWAM) are examples of capabilities with such a focus. In referring to such assessment objects, the term asset may be used (e.g., assets with defects). Most specific capabilities focus on specific assessment object types. HWAM focuses exclusively on defects in and around devices, for example. Because this volume often uses examples from the HWAM capability volume, it often uses the term devices when referring to defects in that context. For the purposes of this NISTIR, all hardware assets (assessment objects) are devices, but not all devices are assessment objects. For example, a chip on a circuit board is a device and an asset, but in the HWAM context, it is not at an abstraction level of focus. Likewise, automated security control assessment does not focus on a device's keyboard, mouse, and monitor, per se, as such mechanisms are just part of the larger device (or assessment object) being assessed. However, property systems might count them as separate assets.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control, assessment. General security reference material without sensitive content. Source: Automation Support for Security Control Assessments_ Volume 1_ Overview.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171 say about 2.1 DEVELOPMENT APPROACH? (Part 4) According to Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171, 2.1 DEVELOPMENT APPROACH: _\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ organizations while under attack. The enhanced security requirements focus on the following key elements, which are essential to addressing the APT: - Applying a threat-centric approach to security requirements specification; - Employing system and security architectures that support logical and physical isolation using system and network segmentation techniques, virtual machines, and containers; 16 - Implementing dual authorization controls for the most critical or sensitive operations; - Limiting persistent storage to isolated enclaves or domains; - Implementing a comply-to-connect approach for systems and networks; - Extending configuration management requirements by establishing authoritative sources for addressing changes to systems and system components; - Periodically refreshing or upgrading organizational systems and system components to a known state or developing new systems or components; - Employing a security operations center with advanced analytics to support continuous monitoring and protection of organizational systems; and - Using deception to confuse and mislead adversaries regarding the information they use for decision-making, the value and authenticity of the information they attempt to exfiltrate, or the environment in which they are operating.

Explanation: NIST publication discussing classified information handling. References: classified, controlled unclassified. Contains guidance on protecting sensitive government information. Source: Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain 3 Motivating Use Cases according to NIST 4th Annual PKI R&D Workshop _Multiple Paths to Trust_ Proceedings According to 4th Annual PKI R&D Workshop _Multiple Paths to Trust_ Proceedings, 3 Motivating Use Cases: In this section, we describe the use cases we wish to support with our work.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: 4th Annual PKI R&D Workshop _Multiple Paths to Trust_ Proceedings.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Domain Name System-Based Electronic Mail Security provide? (Section 99) nded for general use as this will result in the majority of email being deferred. It should only be used in scenarios where senders and receivers are coordinated and maintain a stable DANE deployment. Both public sector and private sector enterprises are heavily dependent on web-based technology other than email for e-commerce and other public-facing applications. Fraudulent web sites pose at least as great a security and privacy problem as fraudulent email. Further, as email becomes a more difficult medium for malicious entities to use as a penetration vector, other web-based media will be more intensively exploited. Already, emerging communications trends appear to be replacing email exchanges among individuals with other social media (e.g., Baidu, Facebook, Facebook Messenger, Google+, Instagram, LinkedIn, Pinterest, Snapchat, Tieba, Tumblr, Twitter, Viber, WhatsApp, and YouTube). Therefore, an extension of the current project that focuses on use of improved DNSSEC applications such as DANE for web applications other than mail may be justified. Additionally, the test scenarios did not include the Exchange for Office 365 MTA to demonstrate Scenario 1. Future builds might be considered to demonstrate this capability. Finally, utilities are currently under development that would provide improved support for SMIMEA and improved system notification of failed DNSSEC signature validation events. Future builds might be considered to demonstrate these capabilities as well.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Domain Name System-Based Electronic Mail Security.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Establishing Wireless Robust Security Networks_ A Guide to IEEE 802.11i provide? (Section 289) O'Reilly Media, 2005. He, Changhua, and Mitchell, John, 'Analysis of the 802.11i 4-Way Handshake', Proceedings of the 2004 ACM Workshop on Wireless Security , 2004. IEEE Standard 802.11, 1999 Edition. Also available at http://standards.ieee.org/getieee802/download/802.11-1999.pdf. IEEE Standard 802.11i, 2004 Edition. Also available at http://standards.ieee.org/getieee802/download/802.11i-2004.pdf. IEEE Standard 802.1X, 2004 Edition. Also available at http://standards.ieee.org/getieee802/download/802.1X-2004.pdf. Matsunaga, Yasuhiko et al, 'Secure Authentication System for Public WLAN Roaming', Proceedings of the First ACM International Workshop on Wireless Mobile Applications and Services on WLAN Hotspots , 2003. Mitsuyama, Yukio et al, 'Embedded Architecture of IEEE 802.11i Cipher Algorithms', Proceedings of the IEEE International Symposium on Consumer Electronics , 2004. O'Hara, Bob and Petrick, Al, IEEE 802.11 Handbook: A Designer's Companion , IEEE Press, 2001. Schmoyer, Tim, Lim, Yu-Xi, and Owen, Henry, 'Wireless Intrusion Detection and Response: A Case Study Using the Classic Man-in-the-middle Attack', Proceedings of IEEE Wireless Communication and Networking Conference 2004, 2004. Smyth, Neil, McLoone, Máire, and McCanny, John, 'Reconfigurable Hardware Acceleration of WLAN Security', IEEE Workshop on Signal Processing Systems (SiPS) Design & Implementation , 2004. Šorman, Matija, Kova č , Tomislav, and Maurovi ć , Damir, 'Implementing Improved WLAN Security', 46 th International Symposium Electronics in Marine , 2004. Wool, Avishai, 'A Note on the Fragility of the 'Michael' Message Integrity Code', IEEE Transactions on Wireless Communications , Vol. 3 No. 5, September 2004. You, Liyu and Jamshaid, Kamran, 'Novel Applications for 802.11x Enabled Wireless Networked Home', 2004 IEEE Consumer Communications and Networking Conference , 2004.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Establishing Wireless Robust Security Networks_ A Guide to IEEE 802.11i.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Threshold Schemes for Cryptographic Primitives_ Challenges and Opportunities in Standardization and Validation of Threshold Cryptography provide? (Section 31) eously. The secrecy of keys can be compromised by the leakage of key-dependent information during computations. This is possible even without direct physical contact with components within the device. For example, the time taken, the power consumed, and the electromagnetic radiation emanated by a device can be measured without penetrating the device enclosure. We will assume that, regardless of whether the computation is in hardware or software, the device that performs the computation consists of some circuit with wires connecting to logical gates and memory cells. Then, the attacker's view of the circuit elements may be noisy (the noisy leakage model [CJRR99]), or the attacker may be limited by the number of wires of the circuit that it can observe within a certain period of time (the probing model [ISW03]). The noisy leakage model and probing model have been unified [DDF14]. In both models, under some reasonable assumptions on the statistical distributions of sidechannel information, the complexity of a side-channel attack of a suitable implementation with an n -out-ofn secret-sharing increases exponentially with the number of shares. As such, side channel attacks on secret-shared implementations become infeasible if the number of shares is sufficiently high, and is further thwarted when the shares are refreshed before the attacker can collect enough side-channel information. Further refinements of the model take transient behavior ('glitches') of the transistors into account, which can be handled by Threshold Implementations (TI) [NRR06] or by 'lazy engineering' to just increase the number of shares [BGG + 14]. Besides the aforementioned side-channel attacks, an attacker may also obtain keydependent information by injecting a fault into the computation, and then observing the outputs [BDL97]. To inject the fault, the attacker may, for example, apply a strong external electromagnetic field.

Explanation: NIST publication discussing classified information handling. References: secret, cui. Contains guidance on protecting sensitive government information. Source: Threshold Schemes for Cryptographic Primitives_ Challenges and Opportunities in Standardization and Validation of Threshold Cryptography.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain 2.3 Skill Statements according to NIST Workforce Framework for Cybersecurity (NICE Framework) According to Workforce Framework for Cybersecurity (NICE Framework), 2.3 Skill Statements: Skill statements relate to Task statements in that a learner is demonstrating skills in performing tasks. A learner who is not able to demonstrate the described skill would not be able to complete the Task that relies on that skill. A Skill is defined as the capacity to perform an observable action. Skill statements may describe straightforward or complex skills. Multiple Skill statements may be needed to complete a given Task. Likewise, exercising a Skill may be used to complete more than one Task. Skill statements can be simple. Example: Skill in recognizing the alerts of an Intrusion Detection System Skill statements can be complex. Example: Skill in generating a hypothesis as to how a threat actor circumvented the Intrusion Detection System. As depicted in Figure 1, Skill statements describe what the learner can do, and Task statements describe the work to be done. Therefore, it is important to separate the language used between Skill statements and Task statements and to use terms that facilitate observability and assessment of the learner.

Explanation: NIST cybersecurity publication covering vulnerability management. Topics: threat actor, intrusion detection. Contains technical security guidance that could inform defensive posture. Source: Workforce Framework for Cybersecurity (NICE Framework).


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does NIST_SP_800-53r5_Security_Privacy_Controls provide? (Section 870) s i p u b l i c a t i o n i s a v a i l l a b e f r e e o f c h a r g e f r o m : h t t p s : / / d o i . o r g / 1 0 . 6 0 2 8 / N S T S P . 8 0 0 - 5 3 r 5 . I NIST SP 800-53, REV. 5 SECURITY AND PRIVACY CONTROLS FOR INFORMATION SYSTEMS AND ORGANIZATIONS _________________________________________________________________________________________________ [SP 800-60-2] [SP 800-61] [SP 800-63-3] [SP 800-63A] [SP 800-63B] [SP 800-70] [SP 800-73-4] [SP 800-76-2] [SP 800-77] Stine KM, Kissel RL, Barker WC, Lee A, Fahlsing J (2008) Guide for Mapping Types of Information and Information Systems to Security Categories: Appendices. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) 800-60, Vol. 2, Rev. 1. Cichonski PR, Millar T, Grance T, Scarfone KA (2012) Computer Security Incident Handling Guide. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) 800-61, Rev. 2. https://doi.org/10.6028/NIST.SP.800-61r2 Grassi PA, Garcia ME, Fenton JL (2017) Digital Identity Guidelines. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) 800-63-3, Includes updates as of March 2, 2020. Grassi PA, Fenton JL, Lefkovitz NB, Danker JM, Choong Y-Y, Greene KK, Theofanos MF (2017) Digital Identity Guidelines: Enrollment and Identity Proofing. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) 800-63A, Includes updates as of March 2, 2020. Grassi PA, Fenton JL, Newton EM, Perlner RA, Regenscheid AR, Burr WE, Richer, JP, Lefkovitz NB, Danker JM, Choong Y-Y, Greene KK, Theofanos MF (2017) Digital Identity Guidelines: Authentication and Lifecycle Management.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: nist sp, fips, security control. General security reference material without sensitive content. Source: NIST_SP_800-53r5_Security_Privacy_Controls.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Computer Security Division 2009 Annual Report say about Key Management? (Part 2) According to Computer Security Division 2009 Annual Report, Key Management: xpected to be available for comment during Q2 FY2010. Further information about this project is available on the CSRC website. Contacts: Mr. Quynh Dang Ms. Elaine Barker (301) 975-3610 (301) 975-2911 qdang@nist.gov ebarker@nist.gov

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Computer Security Division 2009 Annual Report.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Foundational PNT Profile_ Applying the Cybersecurity Framework for the Responsible Use of Positioning, Navigation, and Timing (PNT) Services provide? (Section 97) ategy to protect the confidentiality, integrity, and availability of PNT services. In this PNT Profile, the availability and integrity of PNT services are of primary concern throughout the enterprise. PNT data that is bound or associated with personally identifiable information (PII) or other sensitive data increases confidentiality concerns. There are seven Subcategories within Data Security that apply to the PNT Profile, as summarized in the table below. Table 11. Data Security Subcategories Applicable to PNT | Protect Data Security Subcategory | Applicability to PNT | References (PNT-Specific) | |-------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------| | DS-1: Data at rest is protected.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: cybersecurity framework, fips, security control. General security reference material without sensitive content. Source: Foundational PNT Profile_ Applying the Cybersecurity Framework for the Responsible Use of Positioning, Navigation, and Timing (PNT) Services.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Cybersecurity Framework Profile for Electric Vehicle Extreme Fast Charging Infrastructure say about 5.2.4. Information Protection and Processes Category? (Part 25) According to Cybersecurity Framework Profile for Electric Vehicle Extreme Fast Charging Infrastructure, 5.2.4. Information Protection and Processes Category: 8-07, RQ-08-08 ISO 24089:2023 4.3.3.1, 7.3.1.3 | | IP-12 | XFC/EVSE | This may include development systems, operational systems, and IT/ICS systems. | ISA/IEC 62443-2- 1:D4E1 EVENT 1.9 | | IP-12 | Cloud/Third-Party | This may include development systems, operational systems, and IT/ICS systems. | [NIST-SP800-53r5] RA-1, RA-3, RA-5 | | IP-12 | Utility/Building Management System | This may include development systems, operational systems, and IT/ICS systems. | ISA/IEC 62443-2- 1:D4E1 EVENT 1.9 |

Explanation: NIST cybersecurity documentation and standards guidance. Topics: cybersecurity framework, fips, security control. General security reference material without sensitive content. Source: Cybersecurity Framework Profile for Electric Vehicle Extreme Fast Charging Infrastructure.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Security of SQL-Based Implementations of Product Data Exchange Using STEP say about 2.4 Security Responsibilities: Non-SQL Components? According to Security of SQL-Based Implementations of Product Data Exchange Using STEP, 2.4 Security Responsibilities: Non-SQL Components: Many aspects of security in a STEP environment will take place outside the SQL processor. This section outlines these responsibilities in the following areas: application interface, SQL interface to the physical database, SQL interface to non-SQL DBMS's, and interface to remote databases.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Security of SQL-Based Implementations of Product Data Exchange Using STEP.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Cybersecurity Framework Manufacturing Profile say about 3.1 Framework Core? (Part 2) According to Cybersecurity Framework Manufacturing Profile, 3.1 Framework Core: Table 1 Cybersecurity Framework Functions and Categories | Function Unique Identifier | Function | Category Unique Identifier | Category | |------------------------------|------------|------------------------------|-------------------------------------------------| | ID | Identify | ID.AM | Asset Management | | ID | Identify | ID.BE | Business Environment | | ID | Identify | ID.GV | Governance | | ID | Identify | ID.RA | Risk Assessment | | ID | Identify | ID.RM | Risk Management Strategy | | PR | Protect | PR.AC | Access Control | | PR | Protect | PR.AT | Awareness and Training | | PR | Protect | PR.DS | Data Security | | PR | Protect | PR.IP | Information Protection Processes and Procedures | | PR | Protect | PR.MA | Maintenance | | PR | Protect | PR.PT | Protective Technology | | DE | Detect | DE.AE | Anomalies and Events | | DE | Detect | DE.CM | Security Continuous Monitoring | | DE | Detect | DE.DP | Detection Processes | | RS | Respond | RS.RP | Response Planning | | RS | Respond | RS.CO | Communications | | RS | Respond | RS.AN | Analysis | | RS | Respond | RS.MI

Explanation: NIST cybersecurity documentation and standards guidance. Topics: cybersecurity framework, fips, security control. General security reference material without sensitive content. Source: Cybersecurity Framework Manufacturing Profile.