You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control CM-7 in Cybersecurity Framework Manufacturing Profile Low Impact Level Example Implementations Guide_ Volume 1 – General Implementation Guidance? (Part 60) Control CM-7: .IP) | PR.IP-5 | Low Define, implement, and enforce policy and regulations regarding emergency and safety systems, fire protection systems, and environment controls for the manufacturing system. Fire suppression mechanisms should take the manufacturing environment into account (e.g., water sprinkler systems could be hazardous in specific environments). | These Subcategory requirements can be met by developing policies and procedures in the Fire and Safety Regulations section of the Cybersecurity Program document. | | PROTECT | Information Protection Processes and Procedures (PR.IP) | PR.IP-6 | Low Ensure that manufacturing system data is destroyed according to policy. | These Subcategory requirements can be met by implementing solutions that provide the Systems Development Lifecycle Management and Media Sanitization technical capabilities Potential solutions for meeting these Subcategory requirements include: Open- AudIT, LANSweeper, Spiceworks, OCSinventory-ng, AlienVault OSSIM, MS Excel (Manual), media sanitization tools. Solutions that were implemented in use cases: Open-AudIT DBAN | | PROTECT | Information Protection Processes and Procedures (PR.IP) | PR.IP-7 | Low Incorporate improvements derived from the monitoring, measurements, assessments, and lessons learned into protection process revisions. Ensure that the security plan for the manufacturing system facilitates the review, testing, and continual improvement of the security protection processes. | These Subcategory requirements can be met by developing policies and procedures in the Periodic Reevaluation of the Program section of the Cybersecurity Program document. | | PROTECT | Information Protection Processes and Procedures (PR.IP) | PR.IP-8 | Low Collaborate and share information about manufacturing system related security incidents and mitigation measures with designated sharing partners. Employ automated mechanisms where feasible to assist in information collaboration.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: cybersecurity framework, fips, security control. General security reference material without sensitive content. Source: Cybersecurity Framework Manufacturing Profile Low Impact Level Example Implementations Guide_ Volume 1 – General Implementation Guidance.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Guideline for Using Cryptographic Standards in the Federal Government_ Cryptographic Mechanisms say about 3.2.1 Block Cipher Algorithms? According to Guideline for Using Cryptographic Standards in the Federal Government_ Cryptographic Mechanisms, 3.2.1 Block Cipher Algorithms: A block cipher algorithm is used with a single key in an approved mode of operation to both apply cryptographic protection (e.g., encrypt) and to subsequently process the protected information (e.g., decrypt). Several block cipher algorithms have been approved by NIST as cryptographic primitives, some of which are no longer approved for applying cryptographic protection. However, they may still be needed for processing information that was previously protected (e.g., they may be needed for decrypting previously encrypted information). The block cipher algorithms are discussed in Sections 3.2.1.1 through 3.2.1.4. A pproved modes of operation are discussed in Section 3.2.1.5.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Guideline for Using Cryptographic Standards in the Federal Government_ Cryptographic Mechanisms.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Recommendation for Random Number Generation Using Deterministic Random Bit Generators say about Information retained within the DRBG mechanism boundary after generation:? According to Recommendation for Random Number Generation Using Deterministic Random Bit Generators, Information retained within the DRBG mechanism boundary after generation:: Replaced internal state values (i.e., the new working\_state ).

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Recommendation for Random Number Generation Using Deterministic Random Bit Generators.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain 2 Authority according to NIST Recommendation for Existing Application-Specific Key Derivation Functions According to Recommendation for Existing Application-Specific Key Derivation Functions, 2 Authority: This publication has been developed by the National Institute of Standards and Technology (NIST) in furtherance of its statutory responsibilities under the Federal Information Security Management Act (FISMA) of 2002, Public Law 107-347. NIST is responsible for developing standards and guidelines, including minimum requirements, for providing adequate information security for all agency operations and assets, but such standards and guidelines shall not apply to national security systems. This Recommendation has been prepared for use by federal agencies. It may be used by non-governmental organizations on a voluntary basis and is not subject to copyright. (Attribution would be appreciated by NIST.) Nothing in this document should be taken to contradict standards and guidelines made mandatory and binding on federal agencies by the Secretary of Commerce under statutory authority. Nor should these guidelines be interpreted as altering or superseding the existing authorities of the Secretary of Commerce, Director of the OMB, or any other federal official. Conformance testing for implementations of this Recommendation will be conducted within the framework of the Cryptographic Module Validation Program (CMVP) and the Cryptographic Algorithm Validation Program (CAVP). The requirements of this Recommendation are indicated by the word ' shall .' Some of these requirements may be out-of-scope for CMVP or CAVP validation testing, and thus are the responsibility of entities using, implementing, installing or configuring applications that incorporate this Recommendation.

Explanation: NIST publication discussing classified information handling. References: secret, national security. Contains guidance on protecting sensitive government information. Source: Recommendation for Existing Application-Specific Key Derivation Functions.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control HA-1 in 4th Annual PKI R&D Workshop _Multiple Paths to Trust_ Proceedings? (Part 209) Control HA-1: al signatures and encryption, respectively. PKCS 12 permits both software and hardware implementations. Hardware implementations offer physical security in tamper-resistant tokens such as smart cards. [1] ## FEDERAL PKI POLICY AUTHORITY The Federal PKI Policy Authority (FPKI-PA), under the auspices of the Federal Identity and Credentialing Committee (FICC), is responsible for the policies of the various Federal PKI implementations; the Federal PKI Bridge CA (FBCA), the Common Policy Framework CA (CPFCA), the eGovernance CA (eGOVCA) and the Citizen and Commercial Class CA (C4A). This paper will only discuss the relevancy of the FBCA and its concomitant Certificate Policy to the use of PKCS 12. The Federal Government is required to use cryptographic modules that have been accredited as meeting the NIST Federal Information Processing Standard 140 level 2 (FIPS 140-2) accrediting process [3]. Additionally any entities PKI that want to cross-certify with the FBCA must follow US Government PKI Cross-Certification Methodology and Criteria. [4]. Once an entity PKI has completed this process, they are required to sign a Memorandum of Agreement (MOA) with the FPKI-PA, which lays out the rights and responsibilities of both parties. One of the items in every MOA is the requirement that the entity PKI cross-certifying with the FBCA shall maintain compliance with the requirements in the MOA and shall notify the FPKI-PA if any material changes occur. ## ISSUES WITH THE USE OF PKCS-12 The FBCA Certificate Policy [5] is silent on the use of PKCS 12, so that its use does not apparently violate any of the requirements in the MOA. However, as we will discuss later, there are issues associated with private key protection and activation, which are application specific that must be addressed.

Explanation: NIST publication on credential and access management. Topics: pki, token, sso. Contains security framework guidance for authentication systems. Source: 4th Annual PKI R&D Workshop _Multiple Paths to Trust_ Proceedings.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain 4.5.8.1 Introduction of a New DKIM Key according to NIST Trustworthy Email According to Trustworthy Email, 4.5.8.1 Introduction of a New DKIM Key: When initially deploying DKIM for enterprise email, or a new email service to support an organization, an administrator should insure that the corresponding public key is available for validation. �us, the DNS entry with the DKIM public portion should be published in the sender's domain before the sending MTA begins using the private portion to generate signatures. �e order should be: 1. Generate a DKIM key pair and determine the selector that will be used by the MTA(s). 2. Generate and publish the DKIM TXT RR in the sending domain's DNS. 3. Ensure that the DKIM TXT RR is returned in queries. 4. Configur e the sending MTA(s) to use the private portion. 5. Begin using the DKIM key pair with email.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Trustworthy Email.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Assessment of Access Control Systems say about 4.2 Access Rules? (Part 1) According to Assessment of Access Control Systems, 4.2 Access Rules: 4.2 Access Rules As mentioned in Section 3.5, RuBAC can be established by any attributes of a system related to the users such as domain, host, protocol, network, or IP address. For example, a user wants to access an object in another network on the other side of a router. The router employs RuBAC with the rule composed by the network addresses, domain, and protocol to decide whether or not the user can be granted access. So, if an employee changes his or her role within the organization, the existing authentication credentials remain in effect and do not need to be re configured. Using rules in conjunction with roles adds greater flexibility because rules can be applied to people as well as devices. When applying RuBAC in a distributed system for access control, it is important to decide which attributes of the system to use for the rule constraints, so that there will not be conflicts in rule setting that lead to privileges leaking. Therefore, rule-based algorithms need to be devised. For example, suppose that two of the primary types of software users are product engineers and quality engineers. Both groups usually have access to the same data, but they have different roles to perform in relation to the data and the application's function. In addition, individuals within each group have different job responsibilities that may be identified using several types of attributes such as weapon programs and manufacturing areas. To avoid confusion, applicationspecific position codes and access profile rules are maintained for each user. When storing the data object, the data owner identifies attributes that describe the document's content and purpose. At the time of application execution, the user position codes and user's profiles are matched with document attributes to determine the user's access right.

Explanation: NIST publication on credential and access management. Topics: access control, authentication. Contains security framework guidance for authentication systems. Source: Assessment of Access Control Systems.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Policy Machine_ Features, Architecture, and Specification say about 3.5 Obligations? (Part 1) According to Policy Machine_ Features, Architecture, and Specification, 3.5 Obligations: 3.5 Obligations Obligations represent potential changes to the authorization state of the policy. They are used when one or more administrative actions need to be carried out under a specific, known set of circumstances. Events are the means by which obligations are triggered. An event occurs each time a requested access executes successfully. Information related to the event is called the event context and is used by the PM to process obligations. The process identifier, identifier of the associated user, access operation, and sequence of arguments of the triggering event are mandatory and always returned as part of the event context. Other information conveyed via the event context varies based on the type of event that occurred and may include items such as the containing attributes of targeted policy elements (e.g., those pertaining to an object that was deleted), or the types of certain arguments used in an access request (e.g., for a resource access, the type of object (file, message, etc.) accessed. The two main components needed to define an obligation are an event pattern and a response. The pattern and response elements each denote a sentence in a grammar that respectively expresses the triggering conditions of an event pattern and the administrative actions of the response. The event pattern and response each represents sentences that must conform to a formal language over their respective alphabet. That is, the syntax of the sequence of symbols for each item must be well formed according to its respective grammar. The obligation relation, OBLIG, is defined as a ternary relation from U to PATTERN to RESPONSE. For each tuple (u, pattern, response) of the obligation relation, u represents the user that established the pattern and response, and under whose authorization the response is carried out.

Explanation: NIST publication on credential and access management. Topics: authorization, sso. Contains security framework guidance for authentication systems. Source: Policy Machine_ Features, Architecture, and Specification.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control PD-12 in Guidelines for the Authorization of Personal Identity Verification Card Issuers (PCI) and Derived PIV Credential Issuers (DPCI)? (Part 9) Control PD-12: sks and sub-tasks. ## 2. PREPARATION FOR ASSESSMENT AND AUTHORIZATION This chapter presents the fundamentals of an authorization of a PIV Card Issuer (PCI) and a Derived PIV Credential Issuer (DPCI). It includes: (i) definitions of an issuer and issuing facility; (ii) outsourcing issuer services or functions; (iii) the differences between an assessment and authorization; (iv) authorization boundaries of an issuer; (v) roles and responsibilities; (vi) the relationship between authorization under [SP 800-37-1] and SP 800-79-2; (vii) preparing for the assessment; (viii) types of authorization decisions; (xi) use of risk in the authorization decision; and (x) the contents of the authorization package. ## 2.1 Issuer At the highest level, an issuer provides a full set of functions required to produce, issue, and maintain PIV Cards or Derived PIV Credentials for an organization. A PCI or DPCI is considered operational if all relevant roles and responsibilities have been defined and appointed; suitable policies and compliant procedures have been implemented for all relevant PIV processes, 5 including sponsorship, identity proofing/registration, adjudication, card/token production, activation/issuance, and maintenance; and information system components that are utilized for performing the above-mentioned functions (processes) have been assessed and shown to meet all technical and operational requirements prescribed in FIPS 201-2 and related documents. In order to comply with Homeland Security Presidential Directive 12 ([HSPD-12]), an organization must first establish an issuer, to issue PIV Cards or Derived PIV Credentials, which conforms to and satisfies the requirements of FIPS 201-2 and related documents. The issuer must then be authorized (i.e., using the guidelines specified in this document). An organization has certain flexibility in implementing its issuance functions.

Explanation: NIST publication on credential and access management. Topics: authorization, token. Contains security framework guidance for authentication systems. Source: Guidelines for the Authorization of Personal Identity Verification Card Issuers (PCI) and Derived PIV Credential Issuers (DPCI).


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control UI-64 in Guidelines for the Secure Deployment of IPv6? (Part 267) Control UI-64: orts used by other customers. This may be more difficult to 59 See the current version of the IETF Internet Draft, Dual-Stack Lite Broadband Deployments Following IPv4 Exhaustion , Work in Progress . detect and to mitigate without a complete system for authentication by port number, which would represent a huge security requirement. For a description of an analogous attack, see the Java-based attack described by Martin et al. 60 Some attack mitigation strategies block an IPv4 address (temporarily or permanently) after detecting an improper use. Thus, the carrier-grade NAT needs to protect other customers using the same address by making sure that a single user of a shared address cannot trigger such a response. Finally, a carrier-grade NAT needs to enforce ingress filtering of IPv6 traffic to prevent IPv6 spoofing. ## 6.6 Translation Translation consists of transforming IPv4 or IPv6 packets into the other protocol so they can be routed or transmitted across a network. Network Address Translation-Protocol Translation (NAT-PT) allows IPv6 and IPv4 devices to communicate via an intermediate translation device. Transport Relay Translator (TRT) is another mechanism to allow IPv6 hosts to communicate with IPv4 hosts through an intermediary. Translation mechanisms (IPv4 to IPv6 and IPv6 to IPv4) introduce new methods to construct networks and systems and thus enlarge the set of possible attacks against those networks and systems. Protocol translation is not recommended as a strategic approach to transitioning from IPv4 to IPv6 for a variety of reasons. Translating IPv6 into IPv4 effectively negates most of the compelling reasons for transitioning to IPv6 in the first place. Hierarchical routing, expanded address space, streamlined packet headers, and IPv6 mobility are all lost when translating IPv6 into IPv4. Translation does not solve the IPv4 address space exhaustion problem.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Guidelines for the Secure Deployment of IPv6.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does 4th Annual PKI R&D Workshop _Multiple Paths to Trust_ Proceedings say about 4th Annual PKI R&D Workshop -- Proceedings? According to 4th Annual PKI R&D Workshop _Multiple Paths to Trust_ Proceedings, 4th Annual PKI R&D Workshop -- Proceedings: Secure Electronic Signature Regulations, draft, Canada Gazette Part I, 2004. Available at I/2004/20040508/html/regle6e.html account a business may have. 2 The Australian Business Number (ABN) is a unique 11 digit identifier issued by the Australian Tax Office (ATO) to all entities registered in the Australian Business Register. It is used when dealing with the ATO, other government agencies, and when supplying goods and services to other businesses. usertype=BC 3 Here we distinguish between registration - the process of obtaining an epass from epass Canada - and enrolment - the action of signing up or applying for a Government of Canada service.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: 4th Annual PKI R&D Workshop _Multiple Paths to Trust_ Proceedings.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Identity and Access Management for Electric Utilities provide? (Section 211) b l l i i c c a a t t i i o o n n i i s s a a v v a a i i l l l l a a b b e e f f r r e e e e o o f f c c h h a a r r g g e e f f r r o o m m : : h h t t t t p p : : / / / / d d o o i i . . . . o o r r g g / / 1 1 0 0 6 6 0 0 2 2 8 8 / / N N I I S S T T . . S S P P 1 1 8 8 0 0 0 0 - - 2 2 . . . . ip dhcp snooping dot1x system-auth-control ! diagnostic bootup level minimal spanning-tree mode pvst spanning-tree extend system-id ! redundancy mode sso ! ! ip ssh version 2 ! class-map match-any non-client-nrt-class match non-client-nrt ! policy-map port_child_policy class non-client-nrt-class bandwidth remaining ratio 10 snmp trap mac-notification change added spanning-tree portfast ! ip access-list extended ACL-DEFAULT remark Allow DHCP permit udp any eq bootpc any eq bootps remark Allow DNS permit udp any any eq domain permit icmp any any permit tcp any host 172.16.4.77 eq 8443 permit tcp any host 172.16.4.77 eq 443 permit tcp any host 172.16.4.77 eq www permit tcp any host 172.16.4.77 eq 8905 permit tcp any host 172.16.4.77 eq 8909 permit udp any host 172.16.4.77 eq 8905 permit udp any host 172.16.4.77 eq 8909 deny ip any any ip access-list extended ACL-WEBAUTH-REDIRECT permit tcp any any eq www permit tcp any any eq 443 deny ip any any ! NIST SP 1800-2C: Identity and Access Management for Electric Utilities 43 T T h h i i s s p p u u b b l l i i c c a a t t i i o o n n i i s s a a v v a a i i l l l l a a b b e e f f r r e e e e o o f f c c h h a a r r g g e e f f r r o o m m : : h h t t t t p p : : / / / / d d o o i i . . . . o o r r g g / / 1 1 0 0 6 6 0 0 2 2 8 8 / / N N I I S S T T . . S S P P 1 1 8 8 0 0 0 0 - - 2 2 . . . . logging origin-id ip logging source-interface GigabitEthernet1/0/48 !

Explanation: NIST cybersecurity documentation and standards guidance. Topics: nist sp, fips, security control. General security reference material without sensitive content. Source: Identity and Access Management for Electric Utilities.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Guidelines for the Authorization of Personal Identity Verification Card Issuers (PCI) and Derived PIV Credential Issuers (DPCI) say about APPENDIX C: ISSUER READINESS REVIEW CHECKLIST? (Part 3) According to Guidelines for the Authorization of Personal Identity Verification Card Issuers (PCI) and Derived PIV Credential Issuers (DPCI), APPENDIX C: ISSUER READINESS REVIEW CHECKLIST: orization to operate in accordance with [SP 800-37-1]. | Make sure that the information systems utilized by the issuer have been assessed and authorization to operate in accordance with [SP 800-37-1]. | | | | Ensure that the following documentation has been developed and can be made available to the assessment team: | Ensure that the following documentation has been developed and can be made available to the assessment team: | | | | (i) | Operations plan | | | | (iii) | authorization decisions for the issuer Letters of appointment (if any) | | | | (iv) | Service Level Agreements (SLA) and Memorandums of Understanding (MOU) between the organization and the service provider(s).

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control, assessment. General security reference material without sensitive content. Source: Guidelines for the Authorization of Personal Identity Verification Card Issuers (PCI) and Derived PIV Credential Issuers (DPCI).


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does A Profile for U.S. Federal Cryptographic Key Management Systems (CKMS) provide? (Section 101) ted process. - u) Trusted association protections: The following may need to be provided for each trusted association protection: - i. The mechanism used for integrity protection, and - ii. The mechanism used for source authentication. - v) Date-Times: - i. The generation date, - ii. The association date, - iii. The activation date, - iv. The future activation date, - v. The renewal date, - vi. The future renewal data, - vii. The date of the last rekey, - viii. The future rekey date, - ix. The date of the last usage of the key, - x. The deactivation date, - xi. The future deactivation date, - xii. The expiration date, - xiii. The revocation date, - xiv. The compromise date, - xv. The destruction date, and - xvi. The future destruction date. - w) Revocation Reason. These metadata elements specify a key's important characteristics, its acceptable uses, and other information that is related to the key. This information is used by an FCKMS when managing and protecting the key. Metadata elements relevant to the management and use of a key should be correctly associated with a key and used whenever a key is stored, retrieved, loaded into a cryptographic module, used to protect data (e.g., other keys), exchanged with peer entities authorized to use the key, and when assuring that a key is correctly protected. FR:6.2 For each key type used in the system, the CKMS design shall specify all metadata elements selected for a trusted association, the circumstances under which the metadata elements are created and associated with the key, and the method of association (i.e., cryptographic mechanism or trusted process). FR:6.3 For each cryptographic mechanism used in the Key Protections metadata element (item s above), the CKMS design shall specify the following: - i. The cryptographic algorithm: See item g) above. - ii. The parameters for the key: See item i) above. - iii. The key identifier: See item b) above. - iv.

Explanation: NIST publication on credential and access management. Topics: authentication, key management, sso. Contains security framework guidance for authentication systems. Source: A Profile for U.S. Federal Cryptographic Key Management Systems (CKMS).


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Foundational PNT Profile_ Applying the Cybersecurity Framework for the Responsible Use of Positioning, Navigation, and Timing (PNT) Services say about 4.3.2. Security Continuous Monitoring Category? (Part 5) According to Foundational PNT Profile_ Applying the Cybersecurity Framework for the Responsible Use of Positioning, Navigation, and Timing (PNT) Services, 4.3.2. Security Continuous Monitoring Category: | and minimum detectable limits. Analysis of the correlation engines may be able to determine if some faults can remain undetected. These findings can be used in the risk management procedures. Consider providing a loopback reference timing signal to continuously monitor for changes in the total network and signal propagation delay. Within a specified time, alert dependent users and applications when monitoring is unavailable or when PNT data or service is unavailable. Software and hardware can be integrated into the PNT system and critical infrastructure components to detect and mitigate GNSS jamming and spoofing events and preserve PNT data availability, continuity, and integrity. Physical access to PNT devices and components is actively monitored to detect potential breaches in security. Actively monitor | DHS GPS CI ICAO 9849 5.3.7 Kaplan 10 | | CM-3: Personnel activity is monitored | the physical environment to include the RF environment. PNT devices and equipment may be in remote locations. Positively identify people who access areas that contain PNT devices. Where feasible, implement the use of access controls that are specific to personnel, such as swipe cards and personal identification numbers (PINs). Monitor personnel actions for unauthorized activity on or using PNT systems or data. The scope of the monitoring can include elements such as login attributes (e.g., time, physical location, | NIST SP 800-53 Rev. 5 CA-7, PE-6, PE-20 NIST SP 800-53 Rev.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: nist sp, cybersecurity framework, fips. General security reference material without sensitive content. Source: Foundational PNT Profile_ Applying the Cybersecurity Framework for the Responsible Use of Positioning, Navigation, and Timing (PNT) Services.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Federal Cybersecurity Role-Based Training Approaches, Successes, and Challenges provide? (Section 45) ing for your organization and contractors (nonfederal individuals) supporting your organization unless explicitly categorized as one or the other (i.e., 'federal employees' or 'contractor employees'). The term security will be used as a shorthand for 'cybersecurity' or 'information security.' Reference to physical security or personnel security is different and will be labeled as such. Role-based training activities provide security and privacy information to organizational employees who have significant security responsibilities. This type of training is not to be confused with security or privacy awareness activities that involve security/privacy information targeted at the general workforce within the organization. - Training on specific tools required for employees to perform security-related job duties - Training for employees who have privileged access to applications or systems - Training for oversight roles such as information systems security officer (ISSO), information systems security manager (ISSM), or auditors - Training for employees who manage access and authorizations to applications and systems - Training on organizational policies and procedures related to security and privacy configurations, settings, controls, etc. - Cybersecurity for employees in leadership positions, such as 'Cybersecurity for Executives,' Cybersecurity for System Owners,' or 'Becoming A Chief Information System Officer' - General-user annual security or privacy awareness training - Leadership or management training not related to security - Coding/software development classes - Organizational orientation and onboarding briefings - Training on tools not having a security purpose As a reminder, in order to maintain anonymity, when responding to open-ended questions, please do not include any information that might identify you or your organization. However, should you accidentally include such information, the researchers will redact it from the research record. 3.

Explanation: NIST publication on credential and access management. Topics: authorization, sso, privileged access. Contains security framework guidance for authentication systems. Source: Federal Cybersecurity Role-Based Training Approaches, Successes, and Challenges.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Computer Security Division 2007 Annual Report provide? (Section 58) SC X 'key wrapping' standard that includes versions of the AESKW algorithm for use with AES and Triple DES. | Contacts: Ms. Shu-jen Chang (Hash functions) (301) 975-2940 shu-jen.chang@nist.gov | Dr. Morris Dworkin (301) 975-2354 morris.dworkin@nist.gov | |--------------------------------------------------------------------------------------|-------------------------------------------------------------| The requirements for key management continue to expand as new types of devices and connectivity mechanisms become available (e.g., laptops, broadband access, Blackberries). We continue to address the needs of the federal government by defining the basic principles required for key management, including key establishment, wireless applications, and the Public Key Infrastructure (PKI). Modifications were made to SP 800-57, Recommendation for Key Management-Part 1: General , which included an indication of the appropriate hash functions to be used for additional applications, depending on the security strength. Parts 1 and 2 provide general guidance and best practices for the management of cryptographic keying material. Part 3 of SP 800-57 on application-specific guidance is under development and is expected to be available for initial public comment in 2008. Part 3 is intended to address the key management issues associated with currently available cryptographic mechanisms. Key management efforts have included the completion of SP 800-56A, Recommendation for Pair-Wise Key Establishment Schemes Using Discrete Logarithm Cryptography , and the commencement of a related document, SP 800-56B, Recommendation for Pair-Wise Key Establishment Schemes Using Integer Factorization Cryptography (e.g., RSA). As they become a more convenient way to access the Internet, wireless technologies are being more widely adopted by government agencies.

Explanation: NIST publication on credential and access management. Topics: pki, key management, sso. Contains security framework guidance for authentication systems. Source: Computer Security Division 2007 Annual Report.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control ES-1 in Establishing Wireless Robust Security Networks_ A Guide to IEEE 802.11i? (Part 157) Control ES-1: et-drafts/draft-zorn-radiuskeywrap-xx.txt). AES Key Wrap is specified in RFC 3394, Advanced Encryption Standard (AES) Key Wrap Algorithm , available at Figure 6-4. Standard IEEE 802.11 RSN Authentication Infrastructure <!-- image --> ## 6.3.3 Attacks on the Authentication Server Operating system security was not a major concern for pre-RSN WLANs because of the limited functionality of most APs. In an RSN, the core STA authentication function is performed on a separate authentication server, which typically runs on a sophisticated operating system such as UNIX, Linux, or Windows. A breach of the operating system or an application or service with operating system privileges could lead to a complete compromise of RSN security. Accordingly, WLAN security should include hardening of the servers that support the authentication process. 90 ## 6.4 EAP Multiplexing Model and Related Support Requirements This section provides additional information on the conceptual architecture of EAP for readers seeking a better understanding of how EAP works and how it interacts with other protocols. Readers who do not need this information should skip this section and proceed to Section 6.5. RFC 3748 provides a framework for EAP using a four-layer conceptual model described in Table 6-5. It is called the EAP multiplexing model because it describes how EAP can handle multiple EAP methods in the same EAP implementation. Table 6-5.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Establishing Wireless Robust Security Networks_ A Guide to IEEE 802.11i.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Conformance Test Architecture and Test Suite for ANSI_NIST-ITL 1-2007 provide? (Section 62) m Field size per occurrence and Minimum Occur count values for each record type. The length of the data shall be greater than or equal to the field's min size per occurrence times the min Occur count. | 1 | M | LengthMin::13.024 | Length(13.024) GTE MinSize(13.024) * MinOccurrences(13.024) | | | | | | Length_Minimum_ Tagged_Field | 9.1 (Table 8), 15.1 (Table 17), 18.1 (Table 31), 19.1 (Table 33), 22.1 (Table 37) | This requirement is inferred from the Tables describing the Minimum Field size per occurrence and Minimum Occur count values for each record type. The length of the data shall be greater than or equal to the field's min size per occurrence times the min Occur count. | 1 | M | LengthMin::13.999 | Length(13.999) GTE MinSize(13.999) * MinOccurrences(13.9999) | | | | | | Length_Minimum_ Tagged_Field | 9.1 (Table 8), 15.1 (Table 17), 18.1 (Table 31), 19.1 (Table 33), 22.1 (Table 37) | This requirement is inferred from the Tables describing the Minimum Field size per occurrence and Minimum Occur count values for each record type. The length of the data shall be greater than or equal to the field's min size per occurrence times the min Occur count.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Conformance Test Architecture and Test Suite for ANSI_NIST-ITL 1-2007.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Guidelines for Securing Radio Frequency Identification (RFID) Systems provide? (Section 24) antial productivity gains and efficiencies. These organizations and individuals include hospitals and patients, retailers and customers, and manufacturers and distributors throughout the supply chain. This document provides an overview of RFID technology, the associated security and privacy risks, and recommended practices that will enable organizations to realize productivity improvements while safeguarding sensitive information and protecting the privacy of individuals. While RFID security is a rapidly evolving field with a number of promising innovations expected in the coming years, these guidelines focus on controls that are commercially available today. RFID is a form of automatic identification and data capture (AIDC) technology that uses electric or magnetic fields at radio frequencies to transmit information. An RFID system can be used to identify many types of objects, such as manufactured goods, animals, and people. Each object that needs to be identified has a small object known as an RFID tag affixed to it or embedded within it. The tag has a unique identifier and may optionally hold additional information about the object. Devices known as RFID readers wirelessly communicate with the tags to identify the item connected to each tag and possibly read or update additional information stored on the tag. This communication can occur without optical line of sight and over greater distances than other AIDC technologies. RFID technologies support a wide range of applications-everything from asset management and tracking to access control and automated payment. Every RFID system includes a radio frequency (RF) subsystem, which is composed of tags and readers. In many RFID systems, the RF subsystem is supported by an enterprise subsystem that is composed of middleware, analytic systems, and networking services. RFID systems that share information across organizational boundaries, such as supply chain applications, also have an inter-enterprise subsystem.

Explanation: NIST publication on credential and access management. Topics: access control, sso. Contains security framework guidance for authentication systems. Source: Guidelines for Securing Radio Frequency Identification (RFID) Systems.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control PD-12 in Guidelines for the Authorization of Personal Identity Verification Card Issuers (PCI) and Derived PIV Credential Issuers (DPCI)? (Part 17) Control PD-12: as been established and the processes are in compliance with FIPS 201-2. This document identifies roles and responsibilities of key personnel involved in the assessment and authorization of an issuer. 10 Recognizing that organizations have widely varying missions and structures, there may be some differences in naming conventions for authorization-related roles and in how the associated responsibilities are allocated among personnel (e.g. one individual may perform multiple roles in certain circumstances). ## 2.6.1 Senior Authorizing Official (SAO) The Senior Authorizing Official (see Figure 2) of an organization is responsible for all operations. The SAO has budgetary control, provides oversight, develops policy, and has authority over all functions and services provided by the issuer. ## 2.6.2 Designated Authorizing Official (DAO) The Designated Authorizing Official has the authority within an organization to review all assessments of an issuer and its facilities, and to provide an authorization decision as required by [HSPD-12]. Through authorization, the DAO accepts responsibility for the operation of the issuer at an acceptable level of risk to the organization. The SAO may also fulfill the role of the DAO. The DAO shall not assume the role of the OIMO. ## 2.6.3 Organization Identity Management Official (OIMO) The Organization Identity Management Official is responsible for implementing policies of the organization, assuring that all PIV processes of the issuer are being performed reliably, and providing guidance and assistance to the issuing facilities. The OIMO implements and manages the operations plan; ensures that all roles are filled with capable, trustworthy, knowledgeable, and trained staff; makes certain that all services, equipment, and processes meet FIPS 201-2 requirements; monitors and coordinates activities with Issuing Facility Manager(s); and supports the authorization process.

Explanation: NIST publication on credential and access management. Topics: authorization, identity management, sso. Contains security framework guidance for authentication systems. Source: Guidelines for the Authorization of Personal Identity Verification Card Issuers (PCI) and Derived PIV Credential Issuers (DPCI).


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does PIV Card Application and Middleware Interface Test Guidelines (SP 800-73-4 Compliance) provide? (Section 192) Reset the security status of the '96' key reference by sending the VERIFY command with - P2, key reference value is set to '96' - P1 parameter is 'FF' and both Lc and the data field are absent 4. Send VERIFY card command with - P2, key reference value is set to '97' - Data field of the command will contain a value that matches the Secondary Finger OCC value 5. Send GET DATA command with - Data field of the command containing the tag of the Printed Information data object 6. Reset the security status of the '97' key reference by sending the VERIFY command with - P2, key reference value is set to '97' - P1 parameter is 'FF' and both Lc and the data field are absent 7. Send GET DATA command with - Data field of the command containing the tag of the Printed Information data object 8. Send VERIFY card command with - P2, key reference value is set to '96' - Data field of the command will contain a random fingerprint value. The fingerprint is truncated so that the total length is less than 3 bytes times the minimum number of minutia specified in the BIT Group Template for key reference '96' 9. Send VERIFY card command with - P2, key reference value is set to '96' - Data field of the command will contain a random fingerprint value. The fingerprint is padded so that the total length is more than 3 bytes times the maximum number of minutia specified in the BIT Group Template for key reference '96' 10. Send VERIFY card command repeatedly until after the issuer specified maximum number of OCC tries is exceeded with - P2, key reference value is set to '96' - Data field of the command will contain an arbitrary, but correctly formatted, value that does not match the Primary Finger OCC value obtained from the vendor 11. Repeat steps 8-10 with key reference '97'. 1. The command returns the application property template with the status word '90 00' at the end. 2.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: PIV Card Application and Middleware Interface Test Guidelines (SP 800-73-4 Compliance).


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Security in ISDN say about 7.2 Standard Security Mechanisms Required for ISDN? According to Security in ISDN, 7.2 Standard Security Mechanisms Required for ISDN: A number of security mechanisms standards are needed for ISDN but need not be specific to ISDN. The OSI standards developed to provide the security mechanisms defined in IS 7498/2 should be utilized to the maximum extent possible. Specific security mechanisms are the subject of standards development efforts of the new JTC1/SC27. The following sections provide a brief overview of these security mechanisms.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Security in ISDN.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain 4. Conformance according to NIST Common Platform Enumeration_ Applicability Language Specification Version 2.3 According to Common Platform Enumeration_ Applicability Language Specification Version 2.3, 4. Conformance: Products and organizations may want to claim conformance with this specification for a variety of reasons. For example, vulnerability researchers may want to assert that they provide vulnerability applicability statements in the form of CPE Applicability Language statements. In relation to this, implementers may want to assert that their products have the ability to process applicability statements written using the CPE Applicability Language. This section provides the high-level requirements that a product or organization must meet if they are seeking conformance with this specification. The majority of the requirements listed in this section reference other sections in this document that fully define the high-level requirement.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Common Platform Enumeration_ Applicability Language Specification Version 2.3.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain User-Controlled Identity Wallet : according to NIST A Taxonomic Approach to Understanding Emerging Blockchain Identity Management Systems According to A Taxonomic Approach to Understanding Emerging Blockchain Identity Management Systems, User-Controlled Identity Wallet :: A user-controlled identity wallet is an application that primarily allows a user to hold identifiers and credentials by storing the corresponding private keys. It also serves as an interface for entities to interact with one another. For example, the subjects can receive and approve credentials from the issuers and disclose presentations to relying parties. Actions can be initiated automatically through application programming interfaces (APIs) that may be triggered by a user through scanning QR codes. In certain systems, a user can fully originate identifiers offline, on their own, and directly in their identity wallet (see Section 4.4.1 on Identifier Architectures ). Identity wallets may take various forms, such as dedicated hardware wallets, mobile applications, or even paper wallets (private keys are simply printed out and kept in a safe location). They may also come natively in a browser, an operating system, or as extensions. Wallets that are proposed 'as a service' by a third-party holder that controls a user's private keys are called custodial wallets . In addition, identity wallets can act as control centers since entities can receive and decide whether to approve requests for verifiable information, thereby giving their consent to perform some action. They may also serve as gateways for accessing and using applications and services. See Section 6.4 on Ecosystem Convergence for more insight about interoperability and cryptographic schemes used to secure custodial wallets.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: A Taxonomic Approach to Understanding Emerging Blockchain Identity Management Systems.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Annual Report 2018_ NIST_ITL Cybersecurity Program provide? (Section 2) o copyright in the United States. Attribution would, however, be appreciated by NIST. National Institute of Standards and Technology Special Publication 800-206 Natl. Inst. Stand. Technol. Spec. Publ. 800-206, 31 pages (January 2020) CODEN: NSPUE2 This publication is available free of charge from: https:/ /doi.org/10.6028/NIST.SP.800-206 The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the Nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology. ITL's responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in federal information systems. The Special Publication 800-series reports on ITL's research, guidelines, and outreach efforts in information system security, and its collaborative activities with industry, government, and academic organizations. Any mention of commercial products or organizations is for informational purposes only; it is not intended to imply recommendation or endorsement by the National Institute of Standards and Technology, nor is it intended to imply that the products identified are necessarily the best available for the purpose. All names are trademarks or registered trademarks of their respective owners.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Annual Report 2018_ NIST_ITL Cybersecurity Program.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain 2.3.1 CONFIGURATION MANAGEMENT POLICY AND PROCEDURES according to NIST Guide for Security-Focused Configuration Management of Information Systems According to Guide for Security-Focused Configuration Management of Information Systems, 2.3.1 CONFIGURATION MANAGEMENT POLICY AND PROCEDURES: The development of documented SecCM policy communicates senior management's expectations for SecCM to members of the organization through specific, measurable, and confirmable objectives. It is a top-down approach which defines what is required and what is not permitted with respect to using SecCM to manage and control information resources. While policy defines the objectives for what must be done, procedures describe how the policy objectives are met through specific actions and results. SecCM procedures are developed to describe the methodology and tasks for each activity that supports implementation of the SecCM policy. Documenting configuration management policy and procedures is performed during the Planning phase and supports the implementation of NIST [SP 800-53] control CM-1 Configuration Management Policy and Procedures .

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Guide for Security-Focused Configuration Management of Information Systems.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does 6th Annual PKI R&D Workshop _Applications-Driven PKI_ Proceedings say about Access Manager? According to 6th Annual PKI R&D Workshop _Applications-Driven PKI_ Proceedings, Access Manager: The Access Manager is the central authentication and authorization mechanism used by other web services and resources. All requests for authentication, authoriz ation, and session state flow through this service. As shown in Figure 6, the Access Manager is the key component - bringing together disparate web services and resources.

Explanation: NIST publication on credential and access management. Topics: authentication, authorization, pki. Contains security framework guidance for authentication systems. Source: 6th Annual PKI R&D Workshop _Applications-Driven PKI_ Proceedings.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Recommendation for Random Bit Generator (RBG) Constructions say about 2.1. RBG Security? (Part 1) According to Recommendation for Random Bit Generator (RBG) Constructions, 2.1. RBG Security: 2.1. RBG Security Ideal randomness sources generate identically distributed and independent uniform random bits that provide full-entropy outputs (i.e., one bit of entropy per output bit). Real-world RBGs are designed with a security goal of indistinguishability from the output of an ideal randomness source. That is, given some limits on an adversary's data and computing power, it is expected that no adversary can reliably distinguish between RBG outputs and outputs from an ideal randomness source. Consider an adversary that can perform 2 w computations (typically, these are guesses of the RBG's internal state) and is given an output sequence from either an RBG with a security strength of s bits (where s ≥ w ) or an ideal randomness source. It is expected that an adversary has no better probability of determining which source was used for its random bits than <!-- formula-not-decoded --> where ε is negligible. In this recommendation, the size of the RBG output is limited to 2 64 output bits and ε ≤ 2 -32 . NIST Internal Report (IR) 8427 [NISTIR\_8427] provides a justification for the selection of ε . An RBG that has been designed to support a security strength of s bits is suitable for any application with a targeted security strength that does not exceed s . An RBG that is compliant with this recommendation can support requests for output with a security strength of 128, 192, or 256 bits, except for an RBG3 construction (as described in Sec. 6), which can provide fullentropy output. 2 A bitstring with full entropy has an amount of entropy equal to its length. Full entropy bitstrings are important for cryptographic applications, as these bitstrings have ideal randomness properties and may be used for any cryptographic purpose. They may be truncated to any length such that the amount of entropy in the truncated bitstring is equal to its length.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Recommendation for Random Bit Generator (RBG) Constructions.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control HA-3 in Recommendation for Pair-Wise Key-Establishment Schemes Using Discrete Logarithm Cryptography? (Part 142) Control HA-3: tifier employed for that purpose. In particular, when an identifier is used to label party V during the key-agreement process, that identifier has a trusted association to party V's static public key. (In other words, whenever both the identifier and static public key of one participant are employed in the keyagreement process, they are associated in a manner that is trusted by the other participant.) When an identifier is used to label party U during the key-agreement process, it has been selected/assigned in accordance with the requirements of the protocol relying upon the use of the key-agreement scheme. The following is an assumption for using the derived keying material for purposes beyond the C(1e,1s) scheme itself. Party U has obtained assurance that party V is (or was) in possession of the appropriate static private key, as specified in Section 5.6.2.2.3. ## 6.2.2.1 dhOneFlow, C(1e, 1s, FFC DH) Scheme This section describes the dhOneFlow scheme. Assurance of secure key establishment using this scheme can only be obtained when the assumptions in Section 6.2.2 are true. In particular, it is assumed that party U has obtained the static public key yV of party V. In this scheme, each party has different actions, which are presented separately below. However, note that parties U and V must use identical orderings of the bit strings that are input to the key-derivation method. Party U shall execute the following actions to a) establish a shared secret value Z with party V, and b) derive secret keying material from Z . Actions: Party U generates a shared secret and derives secret keying material as follows: 1. Generate an ephemeral key pair ( rU, tU ) from the domain parameters D as specified in Section 5.6.1.1. Send the public key tU to party V. 2.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Recommendation for Pair-Wise Key-Establishment Schemes Using Discrete Logarithm Cryptography.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain ADVERSARY EFFECTS according to NIST Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171 According to Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171, ADVERSARY EFFECTS: See [SP 800-160-2]: [ Preclude (Preempt); Expose (Detect)]. - 3.11.7e Develop a plan for managing supply chain risks associated with organizational systems and system components; update the plan [ Assignment: organization-defined frequency ].

Explanation: NIST publication discussing classified information handling. References: classified, controlled unclassified. Contains guidance on protecting sensitive government information. Source: Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control SI-11 in Guidelines for Smart Grid Cybersecurity? (Part 58) Control SI-11: Supreme Court concluded that the Maine PUC had resolved the privacy, trespass, and Fourth Amendment claims against the utility, but did not state exactly how the Maine PUC concluded that was the case. Finally, the Maine Supreme Court also affirmed that the plaintiffs’ constitutional Fourth and Fifth Amendment claims brought against the Maine PUC were properly dismissed as without merit. Therefore, the Maine Supreme Court invalidated the portion of the Maine PUC’s decision regarding health and safety, remanding it back to the Maine PUC for further proceedings to resolve that issue, and otherwise affirmed the rest of its decision. 5.3.2.5 Contractual Approaches and Issues Related to Consumer Agreements Opt-Out Provisions In response to both potential privacy and health concerns, some state legislatures and regulatory commissions have required that the customer be given the option to opt-out of smart meter implementation as part of a contract for service with a utility, or to have an installed smart meter 40 United States v. Jones, 565 US ___, 132 S.Ct. 945 (2012), p. 3 (Justice Sotomayor’s concurring opinion p.5). 41 Golden Valley, 8922. 42 Golden Valley, 8922. 19 removed.43 Additionally, some utilities have voluntarily offered this option for their customers.44 The Friedman case discussed above reviewed the procedural grounds for a Maine PUC decision regarding proposed opt-out provisions. 5.3.3 Applicability of Existing Data Protection Laws and Regulations to the Smart Grid Personally identifiable information (PII) has no single, authoritative, legal definition. Fair Information Practice Principles (FIPPs) provide the most generally accepted, rather than legal, definition. However, as noted in above, there are a number of laws and regulations, each of which protects different specific types of information.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Guidelines for Smart Grid Cybersecurity.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Improving Enterprise Patching for General IT Systems_ Utilizing Existing Tools and Performing Processes in Better Ways provide? (Section 111) Such identification is not intended to imply special status or relationship with NIST or recommendation or endorsement by NIST or NCCoE; neither is it intended to imply that the entities, equipment, products, or materials are necessarily the best available for the purpose. While NIST and the NCCoE address goals of improving management of cybersecurity and privacy risk through outreach and application of standards and best practices, it is the stakeholder's responsibility to fully perform a risk assessment to include the current threat, vulnerabilities, likelihood of a compromise, and the impact should the threat be realized before adopting cybersecurity measures such as this recommendation. National Institute of Standards and Technology Special Publication 1800-31C, Natl. Inst. Stand. Technol. Spec. Publ. 1800-31C, 128 pages, (April 2022), CODEN: NSPUE2 As a private-public partnership, we are always seeking feedback on our practice guides. We are particularly interested in seeing how businesses apply NCCoE reference designs in the real world. If you have implemented the reference design, or have questions about applying it in your environment, please email us at cyberhygiene@nist.gov. All comments are subject to release under the Freedom of Information Act. National Cybersecurity Center of Excellence 100 Bureau Drive Mailstop 2002 National Institute of Standards and Technology Gaithersburg, MD 20899 Email: nccoe@nist.gov The National Cybersecurity Center of Excellence (NCCoE), a part of the National Institute of Standards and Technology (NIST), is a collaborative hub where industry organizations, government agencies, and academic institutions work together to address businesses' most pressing cybersecurity issues. This public-private partnership enables the creation of practical cybersecurity solutions for specific industries, as well as for broad, cross-sector technology challenges.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control, assessment. General security reference material without sensitive content. Source: Improving Enterprise Patching for General IT Systems_ Utilizing Existing Tools and Performing Processes in Better Ways.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control CM-1 in Multifactor Authentication for E-Commerce_ Risk-Based, FIDO Universal Second Factor Implementations for Purchasers? (Part 79) Control CM-1: provided to assist implementation. ## B.1 Availability of Skills An organization has a workforce able to implement the multifactor authentication (MFA) capabilities described in this practice guide. Work roles in the National Initiative for Cybersecurity Education (NICE) Cybersecurity Workforce Framework [18] are identified in Appendix A to assist organizations to see which work roles perform the tasks necessary to implement the capabilities contained in this practice guide. A NICE Framework work role is composed of specific knowledge, skills, and abilities required to perform tasks in that work role. ## B.2 Uniqueness of Lab Environment The example implementations were developed in a lab environment. They do not reflect the complexity of a production environment, and production deployment processes were not used. Before production deployment, it should be confirmed that the example implementation capabilities meet the organization's architecture, reliability, and scalability requirements. ## B.3 MFA Decreases Account Takeover Opportunities Using customer identification (ID) and password alone for authentication provides increased opportunities for account takeover, compared with the additional use of MFA. ## B.4 Web Browser and Returning Purchaser Accounts A web browser, not a mobile application, was used to make the purchase from the electronic commerce (e-commerce) platform's website. A returning purchaser had an account with the online retailer. ## B.5 Support of MFA Devices The purchaser expects the retailer to be committed to the continued use and support of Universal Second Factor (U2F) because the returning purchaser has invested time and/or expense in obtaining the authenticator device.

Explanation: NIST publication on credential and access management. Topics: authentication, mfa. Contains security framework guidance for authentication systems. Source: Multifactor Authentication for E-Commerce_ Risk-Based, FIDO Universal Second Factor Implementations for Purchasers.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Security of SQL-Based Implementations of Product Data Exchange Using STEP provide? (Section 15) write up'. A user may read an object with a lower level; an object will be written with the highest level of any objects involved. For example, a user with SECRET clearance can read SENSITIVE objects. If that user uses a SECRET object and a SENSITIVE object as input, the output of the process will be labeled as SECRET. SQL can be used when a MAC policy is required, but not every SQL processor is suited to the task. SQL has no built in feature for handling labels, however nothing in the standard prevents an implementation from using and main- ^SQL does not require audit trail generation. This must be added as a value-added enhancement to the SQL processor. taining this information. First, an appropriate MAC implementation of SQL for the target OS is required. If the target OS is a MAC system, the Trusted Computing Base (TCB) subset architecture and Trusted Subject architecture can be used. If the target OS is not a MAC system, the integrity lock architecture is requiredfi. Add-on tools for detection and elimination of inference and aggregation are required. Authentication and auditing requirements are identical to those for role-based systems. The Clark-Wilson framework[CW89], the most complete model for integrity, specifies an access control policy which depends upon the user's identity, the program to be executed, and the set of data files that will be accessed. The critical programs are called trusted 'processes., or TPs, and the data files are known as constrained data items, or CDIs. Few systems support such complex access control decisions. The complexity of the access control decision closes the confidentiality loophole associated with the DAC policies. With DAC policies, user A may disclose information intended solely for user B. User B can then copy that information and make it available to anyone. In the Clark-Wilson framework it is possible to permit users to access an object, without allowing them to copy it.

Explanation: NIST publication on credential and access management. Topics: access control, authentication, sso. Contains security framework guidance for authentication systems. Source: Security of SQL-Based Implementations of Product Data Exchange Using STEP.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control AC-1 in Cybersecurity Framework Manufacturing Profile? (Part 12) Control AC-1: lities or services that were impaired due to a cybersecurity event. The activities in the Recover Function support timely recovery to normal operations to reduce the impact from a cybersecurity event. Examples of outcome Categories within this Function include: Recovery Planning; Improvements; and Communications. The Manufacturing Profile for the Cybersecurity Framework presents detailed implementation language for the cybersecurity standards expressed in the Framework categories and subcategories. The Profile is intended to support cybersecurity outcomes based on business needs that the manufacturer has selected from the Framework Categories and Subcategories [2]. The Profile can be characterized as the alignment of standards, guidelines, and practices to the Framework Core in a practical implementation scenario. ## 4. Manufacturing Profile Development Approach The manufacturing profile was developed to be an actionable approach for implementing cybersecurity controls into a manufacturing system and its environment. The specific statements in the subcategories in Section 7 are derived from the security controls of the NIST SP 800-53 Rev.4 [4], and are customized to the manufacturing domain using relevant informative references. The general informative references of ISA/IEC 62443 [5] from the Framework are also listed in the References column. COBIT 5 is sourced for subcategories that have no corresponding 800-53 references. Additional input came from NIST SP 800-82, Rev. 2, both in section 6.2 (Guidance on the Application of Security Controls to ICS) and in Appendix G (ICS Overlay) [3]. For informative references to an entire control family, or set of controls (such as subcategory ID.GV-1's informative reference to all 'policy and procedures' controls), the approach took a holistic view of the controls comprising the family/set. Section 7 provides the customized CSF subcategory language developed using informative references relevant to the manufacturing domain.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: nist sp, cybersecurity framework, csf. General security reference material without sensitive content. Source: Cybersecurity Framework Manufacturing Profile.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain 4.8 Security Standards for Multi-Vendor Systems according to NIST Assessing Federal and Commercial Information Security Needs According to Assessing Federal and Commercial Information Security Needs, 4.8 Security Standards for Multi-Vendor Systems: Those interviewed felt that security standards that allow comprehensive implementation of security across a multi-vendor environment have failed to emerge. The possible standards would provide for: - o interfacing many systems, both present and future; - o a single user view of security services across a wide range of operating systems; and - o security features inter-operating with other security services on both local and remote machines, without the need to train users in new security products. The need to implement security should not limit an organization in choosing the best solution and integrating it into their existing system. Security technology must support users working effectively together. I !

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Assessing Federal and Commercial Information Security Needs.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain Technical Groups to Pt ovide Support according to NIST Proceedings of the Workshop of the Federal Criteria for Information Technology Security According to Proceedings of the Workshop of the Federal Criteria for Information Technology Security, Technical Groups to Pt ovide Support: The EB may establish and utilize special Technical Groups (TGs), as needed, to help develop q)ecific technical areas of the CC. These TGs will operate under the direction of the EB for the time needed to perform their assigned tasks. They will be staffed in a iqiresentative way, in a pattern like that of the EB.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Proceedings of the Workshop of the Federal Criteria for Information Technology Security.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Usability of PIV Smartcards for Logical Access say about 5.2.4 Laptop Readers? According to Usability of PIV Smartcards for Logical Access, 5.2.4 Laptop Readers: Laptops with built-in readers, like the one in Figure 2 (right), appeared to be relatively problem-free. This was true for systems that were used off-site for telework or travel as well as for systems that were docked while on-site.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Usability of PIV Smartcards for Logical Access.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain Process: according to NIST Recommendation for Random Number Generation Using Deterministic Random Bit Generators According to Recommendation for Random Number Generation Using Deterministic Random Bit Generators, Process:: 1. If ( reseed\_counter > 100 000), then Return ('Reseed required', Null , V , Key , reseed\_counter ). 2. If ( additional\_input ≠ Null ), then 3. 2.1 additional\_input = Block\_Cipher\_df ( additional\_input , 256). 4. 2.2 ( Key , V ) = CTR\_DRBG\_Update ( additional\_input , Key , V ). Else additional\_input = 0 256 . 3. temp = Null . 4. While ( len ( temp ) < requested\_number\_of\_bits ) do: 3. 4.1 V = ( V + 1) mod 2 128 . 4. 4.2 output\_block = AES\_ECB\_Encrypt ( Key , V ). 5. 4.3 temp = temp || output\_block . 5. returned\_bits = leftmost ( temp , requested\_number\_of\_bits ) 6. ( Key , V ) = CTR\_DRBG\_Update ( additional\_input , Key , V ) 7. reseed\_counter = reseed\_counter + 1. 8. Return ('Success', returned\_bits , V , Key , reseed\_counter ).

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Recommendation for Random Number Generation Using Deterministic Random Bit Generators.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Cybersecurity Framework Profile for Electric Vehicle Extreme Fast Charging Infrastructure provide? (Section 289) NIST IR 8473 October 2023 October 2023 Radio Frequency Respond Software Bill of Material Software Development Lifecycle Supervisory Control and Data Acquisition Supply Chain Risk Management Secure Digital Service Level Agreement Tactics, Techniques, and Procedures Tabletop Exercise Vehicle-To-Grid Extreme Fast Charging

Explanation: NIST cybersecurity documentation and standards guidance. Topics: cybersecurity framework, fips, security control. General security reference material without sensitive content. Source: Cybersecurity Framework Profile for Electric Vehicle Extreme Fast Charging Infrastructure.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain Description according to NIST Security Analysis of First Responder Mobile and Wearable Devices According to Security Analysis of First Responder Mobile and Wearable Devices, Description: A firefighter is responding to an emergency and utilizing their fully functional Public Safety Broadband Network (PSBN) device. Without warning, the PSBN device ceases to function, and the firefighter is unable to determine the cause of the malfunction or put the device in an operational state. To continue their duties, the firefighter uses their personal mobile device to conduct needed tasks, including downloading and logging into public safety applications.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Security Analysis of First Responder Mobile and Wearable Devices.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Managing the Security of Information Exchanges say about 3.4 Discontinuing the Information Exchange? According to Managing the Security of Information Exchanges, 3.4 Discontinuing the Information Exchange: This section describes the process for discontinuing the information exchange, as shown in Figure 6. To the greatest extent possible, the information exchange is discontinued in a methodical manner to avoid system disruptions. Figure 6: Information Exchange Discontinue Phase <!-- image -->

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Managing the Security of Information Exchanges.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Automated Information System Security Accreditation Guidelines provide? (Section 2) s and Technology, Gaithersburg, MD, 20899. Additional copies of this publication may be purchased through the National Technical Information Service, Springfield, VA, 22161, telephone: (703) 487-4650. 30 November 1989 | SECTION | SECTION | SECTION | PAGE | |------------------------------------------|------------------------------------------|---------------------------------------------------------|------------------| | PURPOSE | PURPOSE | PURPOSE | 1 | | DEFINITION | DEFINITION | DEFINITION | 1 | | RESPONSIBILITY | RESPONSIBILITY | RESPONSIBILITY | 1 | | THE REQUIREMENT | THE REQUIREMENT | THE REQUIREMENT | 2 | | DPI AND DPA IDENTIFICATION | DPI AND DPA IDENTIFICATION | DPI AND DPA IDENTIFICATION | 2 | | SCHEDULE | SCHEDULE | SCHEDULE | 5 | | | 1. | PROPOSED DATES | 5 | | | 2. | ACTUAL COMPLETION DATES | 6 | | | 3.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Automated Information System Security Accreditation Guidelines.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Criticality Analysis Process Model_ Prioritizing Systems and Components say about 3.1 Process A - Define Criticality Analysis Procedure? (Part 4) According to Criticality Analysis Process Model_ Prioritizing Systems and Components, 3.1 Process A - Define Criticality Analysis Procedure: ent, or criticality analysis experience; individuals who developed the criticality analysis model being tailored. Informed: Individuals responsible for conducting any part of the criticality analysis. | | Related processes outside of criticality analysis | [NIST SP 800-39] - (3.1) Framing Risk [NIST SP 800-160] - (3.3.1) Project Planning Process [NIST SP 800-161] - (2.2.1) Frame |

Explanation: NIST cybersecurity documentation and standards guidance. Topics: nist sp, fips, security control. General security reference material without sensitive content. Source: Criticality Analysis Process Model_ Prioritizing Systems and Components.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does An Introduction to Information Security say about https://doi.org/10.6028/NIST.FIPS.199? (Part 6) According to An Introduction to Information Security, https://doi.org/10.6028/NIST.FIPS.199 /10.6028/NIST.SP.800-147 | | [SP800-152] | NIST Special Publication (SP) 800-152, A Profile for U.S. Federal Cryptographic Key Management Systems (CKMS) , National Institute of Standards and Technology, Gaithersburg, Maryland, October 2015, 147pp. https://doi.org/10.6028/NIST.SP.800-152 | | [SP800-155] | NIST Special Publication (SP) 800-155 (DRAFT), BIOS Integrity Measurement Guidelines , National Institute of Standards and Technology, Gaithersburg, Maryland, December 2011, 47pp. 155_Dec2011.pdf | | [SP800-160] | NIST Special Publication (SP) 800-160, Systems Security Engineering: Considerations for a Multidisciplinary Approach in the Engineering of Trustworthy Secure Systems , National Institute of Standards and Technology, Gaithersburg, Maryland, May 2016, 307pp. | | [SP800-161] | NIST Special Publication (SP) 800-161, Supply Chain Risk Management Practices for Federal Information Systems and Organizations , National Institute of Standards and Technology, Gaithersburg, Maryland, April 2015, 282pp. | | [SP800-162] | NIST Special Publication (SP) 800-162, Guide to Attribute Based Access Control (ABAC) Definition and Considerations, National Institute of Standards and Technology, Gaithersburg, Maryland, January 2014, 46pp.

Explanation: NIST publication on credential and access management. Topics: access control, key management. Contains security framework guidance for authentication systems. Source: An Introduction to Information Security.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Guide to Auditing for Controls and Security_ A System Development Life Cycle Approach say about 4.6.3 Audit Survey? (Part 2) According to Guide to Auditing for Controls and Security_ A System Development Life Cycle Approach, 4.6.3 Audit Survey: the risk to an acceptable level. The auditor's opinion is based on this assessment. The Validation, Verification, and Testing Plan provides the standards against which implementation will be measured. This plan defines the test conditions that will validate controls. This document will indicate how the project team plans to implement the controls. Assuming that the auditor has reviewed these documents, the two define precisely how the controls should be implemented, and thus provide the guideHnes for conducting the programming review. Training is an essential aspect of tlie proper performance of the operational MS. The auditor's concern in training is that the controls will be properly exercised. Thus, the analysis of the previously discussed two documents provides the background the auditor needs for evaluating training in the use of internal controls and security controls. 4.6.3.2 Review Programming and Training Phase Plans - Project teams which have firm implementation dates for AISs may need to make implementation compromises in order to meet those dates. If the project is late going into the Programming and Training Phase, the auditor could expect many of those compromises to occur. Two areas frequently compromised are implementation of internal and security controls (including documentation), and development of training programs. The elimination or curtailment of either or both of these areas may not directly impact the functional correctness of system outputs. In other words, the system may be able to produce the desired reports yet not in a controlled manner, or in an environment in which the users are trained. It is the intent of many project teams to install these areas after implementation. The auditor wants to ensure that the Project Plan is sufficient to guarantee that controls and training are adequately implemented. The plan should indicate who is responsible for these areas, and how they are to be implemented through specific documents.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control, assessment. General security reference material without sensitive content. Source: Guide to Auditing for Controls and Security_ A System Development Life Cycle Approach.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Security and Privacy Controls for Information Systems and Organizations provide? (Section 336) s: something you know (e.g., a personal identification number [PIN]), something you have (e.g., a physical authenticator such as a cryptographic private key), or something you are (e.g., a biometric). Multi-factor authentication solutions that feature physical authenticators include hardware authenticators that provide time-based or challenge-response outputs and smart cards such as the U.S. Government Personal Identity Verification (PIV) card or the Department of Defense (DoD) Common Access Card (CAC). In addition to authenticating users at the system level (i.e., at logon), organizations may employ authentication mechanisms at the application level, at their discretion, to provide increased security. Regardless of the type of access (i.e., local, network, remote), privileged accounts are authenticated using multi-factor options appropriate for the level of risk. Organizations can add additional security measures, such as additional or more rigorous authentication mechanisms, for specific types of access. Related Controls: AC-5, AC-6. (2) IDENTIFICATION AND AUTHENTICATION (ORGANIZATIONAL USERS) | MULTI-FACTOR AUTHENTICATION TO NON-PRIVILEGED ACCOUNTS CHAPTER THREE PAGE 132 T h s i p u b l i c a t i o n i s a v a i l l a b e f r e e o f c h a r g e f r o m : h t t p s : / / d o i . o r g / 1 0 . 6 0 2 8 / N S T S P . 8 0 0 - 5 3 r 5 I . NIST SP 800-53, REV. 5 SECURITY AND PRIVACY CONTROLS FOR INFORMATION SYSTEMS AND ORGANIZATIONS _________________________________________________________________________________________________ Implement multi-factor authentication for access to non-privileged accounts. Discussion: Multi-factor authentication requires the use of two or more different factors to achieve authentication.

Explanation: NIST publication on credential and access management. Topics: authentication, multi-factor. Contains security framework guidance for authentication systems. Source: Security and Privacy Controls for Information Systems and Organizations.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does NIST Big Data Interoperability Framework_ Volume 4, Security and Privacy Version 3 say about 3.1.2 NIELSEN HOMESCAN: PROJECT APOLLO? (Part 2) According to NIST Big Data Interoperability Framework_ Volume 4, Security and Privacy Version 3, 3.1.2 NIELSEN HOMESCAN: PROJECT APOLLO: Privacy Issues/Practices: - Privacy: There was a considerable amount of PII data. Survey participants are compensated in exchange for giving up segmentation data, demographics, and other information. - Security: There was traditional access security with group policy, implemented at the field level using the database engine, component-level application security, and physical access controls. - There were audit methods in place, but were only available to in-house staff. Opt-out data scrubbing was minimal.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: NIST Big Data Interoperability Framework_ Volume 4, Security and Privacy Version 3.