You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control HA-3 in Recommendation for Key Management_ Part 1 – General? (Part 30) Control HA-3: private key may be used to generate signatures) is often shorter than the recipient-usage period (i.e., the period during which the signature may be verified by the public signatureverification key). In this case, the private key is intended for use for a fixed period of time, after which the key owner shall destroy 56 the private key. The public key may be available for a longer period for verifying signatures. The cryptoperiod of a private source-authentication key that is used to sign challenge information is basically the same as the cryptoperiod of the associated public key (i.e., the public source-authentication key). That is, when the private key is no longer to be used to sign challenges, the public key is no longer needed. In this case, the originator and recipient-usage periods are the same. - For key transport keys, the public key-transport key is used to apply protection (i.e., encrypt data), so its cryptoperiod would be considered to be an originator-usage period; the private key-transport key is used to decrypt the encrypted data, so its cryptoperiod to be the recipient-usage period. The originator-usage period (i.e., the period during which the public key may be used for encryption) is often shorter than the recipient-usage period (i.e., the period during which the encrypted information may be decrypted). - For key-agreement algorithms, the cryptoperiods of the two keys of the key pair are usually the same. Where public keys are distributed in public-key certificates, each certificate has a validity period indicated by the notBefore and notAfter dates in the certificate. Certificates may be renewed (i.e., a new certificate containing the same public key may be issued with a new validity period).

Explanation: NIST publication on credential and access management. Topics: authentication, key management, sso. Contains security framework guidance for authentication systems. Source: Recommendation for Key Management_ Part 1 – General.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is The CIA triad represents the three pillars of information security according to Data Integrity_ Identifying and Protecting Assets Against Ransomware and Other Destructive Events? The CIA triad represents the three pillars of information security: confidentiality, integrity, and availability, as follows:

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Data Integrity_ Identifying and Protecting Assets Against Ransomware and Other Destructive Events.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Cybersecurity Framework Manufacturing Profile Low Impact Level Example Implementations Guide_ Volume 3 – Discrete-based Manufacturing System Use Case provide? (Section 190) his would be a new domain controller in a new forest. Mention a Root Domain name as applicable to your environment. <!-- image --> 11. Set a Directory Services Restore Mode password in the next step. Click Next. 12. Under ' DNS Options ' leave the default options selected. Click Next. <!-- image --> <!-- image --> 13. Confirm the NETBIOS domain name under Additional Options . Click Next . 14. Leave the default folder paths as it is Under Paths . Click Next. <!-- image --> <!-- image --> 15. Confirm all the settings On the Review Options page. Click Next . 16. Click Install on the Prerequisites Check to launch the installation process. The server will auto reboot upon completion. 17. Login with domain administrator credentials upon reboot. Open Server Manager and click on Active Directory Users and Computers under Tools to manage your AD. <!-- image --> <!-- image --> All the Linux systems from the work-cell were joined to the AD domain lan.lab using Centrify Express . The initial domain join process is a onetime task and involves a system restart. The procedure to join Ubuntu Linux Systems to Active Directory domain using Centrify is mentioned below. In addition, DNS records for each Linux host were manually created on the Active Directory server. Connectivity between your Linux clients and AD server: Ensure the Linux clients can reach the AD Domain Controller. Configure the appropriate DNS settings on the Linux client. Set the search domain to domain name of Active Directory. Verify the DNS-settings in the /etc/resolv.conf file of your Linux server. The following instructions are for a Debian/Ubuntu system: 1. Download the Centrify Express (CentrifyDC) free package from https://launchpad.net or https://www.centrify.com/express/linux/download/ as per CPU architecture of the Linux client. 2. Install the package: dpkg -i <package\_name> 3. Install any dependencies if prompted. Re-run when done. 4.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: cybersecurity framework, fips, security control. General security reference material without sensitive content. Source: Cybersecurity Framework Manufacturing Profile Low Impact Level Example Implementations Guide_ Volume 3 – Discrete-based Manufacturing System Use Case.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control RA-1 in Guide to Operational Technology (OT) Security? (Part 176) Control RA-1: t of Japan and sent a massive tsunami inland toward the nuclear plant. The tsunami compromised the plant’s seawall, flooding much of the plant, including the location housing the emergency generators. This emergency power was critical for operating the control rooms and providing coolant water for the reactors. The loss of coolant caused the reactor cores to overheat to the point where the fuel’s zirconium cladding reacted with water, releasing hydrogen gas and fueling large explosions in three of the four reactor buildings. This resulted in large-scale radiation leakage that has impacted plant employees, nearby citizens, and the local environment. Post-event analysis found that the plant’s emergency response center had insufficient secure communication lines to provide other areas of the plant with information on key safety-related instrumentation. C.3.4. Accidental Events • • • • 29 While a ping sweep was being performed on [N][D] Vulnerability scanner incidents. an active SCADA network that controlled 9-foot robotic arms, one arm became active and swung around 180 degrees. The controller for the arm was in standby mode before the ping sweep was initiated. In a separate incident, a ping sweep was being performed on an ICS network to identify the hosts that were attached to the network for inventory purposes, and it caused a system that controlled the creation of integrated circuits in the fabrication plant to hang. This test resulted in the destruction of $50,000 worth of wafers. 30 [N][D] Penetration testing incident. consulting organization to conduct penetration testing on its corporate IT network. The consulting organization carelessly ventured into a part of the network that was directly connected to the SCADA system. The penetration test locked up the SCADA system, and the utility was not able to send gas through its pipelines for four hours. A natural gas utility hired an IT security In 2019, a U.S.

Explanation: NIST cybersecurity publication covering vulnerability management. Topics: vulnerability, penetration test. Contains technical security guidance that could inform defensive posture. Source: Guide to Operational Technology (OT) Security.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Guide for Conducting Risk Assessments say about REPRESENTATIVE THREAT EVENTS INITIATED BY THREAT SOURCES? (Part 15) According to Guide for Conducting Risk Assessments, REPRESENTATIVE THREAT EVENTS INITIATED BY THREAT SOURCES: s to which information is supplied, from carrying out operations. | | Compromise design, manufacture, and/or distribution of information system components (including hardware, software, and firmware). | Adversary compromises the design, manufacture, and/or distribution of critical information system components at selected suppliers. | | Conduct an attack (i.e., direct/coordinate attack tools or activities). | Conduct an attack (i.e., direct/coordinate attack tools or activities). | | Conduct communications interception attacks. | Adversary takes advantage of communications that are either unencrypted or use weak encryption (e.g., encryption containing publically known flaws), targets those communications, and gains access to transmitted information and channels. | | Conduct wireless jamming attacks. | Adversary takes measures to interfere with wireless communications so as to impede or prevent communications from reaching intended recipients. | | Conduct attacks using unauthorized ports, protocols and services. | Adversary conducts attacks using ports, protocols, and services for ingress and egress that are not authorized for use by organizations. | | Conduct attacks leveraging traffic/data movement allowed across perimeter. | Adversary makes use of permitted information flows (e.g., email communication, removable storage) to compromise internal information systems, which allows adversary to obtain and exfiltrate sensitive information through perimeters. | | Conduct simple Denial of Service (DoS) attack. | Adversary attempts to make an Internet-accessible resource unavailable to intended users, or prevent the resource from functioning efficiently or at all, temporarily or indefinitely. | | Conduct Distributed Denial of Service (DDoS) attacks. | Adversary uses multiple compromised information systems to attack a single target, thereby causing denial of service for users of the targeted information systems. | | Conduct targeted Denial of Service (DoS) attacks.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control, assessment. General security reference material without sensitive content. Source: Guide for Conducting Risk Assessments.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is Discussion according to NIST_SP_800-53r5_Security_Privacy_Controls? Discussion: Organizations identify software that may be of concern regarding its origin or

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: NIST_SP_800-53r5_Security_Privacy_Controls.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Guidelines for Derived Personal Identity Verification (PIV) Credentials say about B.1.2 Derived PIV Application Data Model Elements? (Part 2) According to Guidelines for Derived Personal Identity Verification (PIV) Credentials, B.1.2 Derived PIV Application Data Model Elements: sent in the Derived PIV Application if the Derived PIV Application contains any retired key management private keys, but may be present even if no such keys are present in the Derived PIV Application. The requirements for the Key History object are as described in Section 3.3.3 of [SP800-73Part1] except for the following: - o References to ' keysWithOnCardCerts ' should be interpreted as keys for which the corresponding certificate is populated within the Derived PIV Application. - o References to ' keysWithOffCardCerts ' should be interpreted as keys for which the corresponding certificate is not populated within the Derived PIV Application. - o References to ' offCardCertURL ' should be interpreted as a URL that points to a file containing the certificates corresponding to all of the retired key management private keys within the Derived PIV Application including those for which the corresponding certificate is stored within the Derived PIV Application. -  Retired X.509 Certificates for Key Management -The read access control rules for the Retired X.509 Certificates for Key Management and PKI cryptographic function access rules for corresponding private keys are as described in Section 3.3.4 of [SP800-73Part1] . -  Security ObjectThe Security Object shall be present in the Derived PIV Application if either the Discovery Object or the Key History object is present, and shall be absent otherwise. The requirements for the Security Object are as described in Section 3.1.7 of [SP800-73Part1] , except for the following: - o The Security Object for a Derived PIV Application is signed using a private key whose corresponding public key is contained in a PIV content signing certificate that satisfies the requirements for certificates used to verify signatures on Cardholder Unique Identifiers (CHUID), as specified in Section 4.2.1 of [FIPS201]. - o The signature field of the Security Object, tag 0xBB, shall include the Derived PIV Credential Issuer's certificate.

Explanation: NIST publication on credential and access management. Topics: access control, pki, key management. Contains security framework guidance for authentication systems. Source: Guidelines for Derived Personal Identity Verification (PIV) Credentials.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control HA-3 in Computer Security Division 2014 Annual Report? (Part 56) Control HA-3: and then developed a SHA-3 standardization plan, which was presented at numerous cryptography conferences in 2013, and posted at the NIST hash website, indicated below, for public feedback. On May 28, 2014, NIST CSD announced Draft FIPS 202, SHA-3 Standard: Permutation-Based Hash and Extendable-Output Functions, in the Federal Register (79 FR 30549) and requested comments. The announcement also proposed a revision of the Applicability Clause (#6) of the Announcement Section of FIPS 180-4, Secure Hash Standard, to allow the use of hash algorithms specified in either FIPS 180-4 or FIPS 202 for federal applications that require a cryptographic hash algorithm. The revision was necessary because the original text in FIPS 180-4 mandates the use of hash algorithms specified in FIPS 180-4 only. The other sections of FIPS 180-4 remain unchanged. The ninetyday public comment period for Draft FIPS 202 and the revision in FIPS 180-4 ended on August 26, 2014. The CSD also hosted a SHA-3 workshop at the University of California, Santa Barbara, on August 22, 2014 to obtain feedback on the proposed SHA-3 Standard, and on additional modes of operation based on SHA-3 that are being considered for standardization. Approximately 75 participants from around the world attended the workshop. The CSD received much feedback throughout the year, especially during the week of the workshop. Official comments received on Draft FIPS 202 and on the revision of the Applicability Clause of FIPS 180-4 are posted at http:/ /csrc.nist.gov/groups/ST/hash/sha-3/fips-202-publiccomments-aug2014.html. CSD is in the process of addressing these comments, and incorporating them, as appropriate, in the final versions of FIPS 202 and FIPS 180-4, to be approved by the Secretary of Commerce. NIST will announce the final approval by the Secretary in the Federal Register.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Computer Security Division 2014 Annual Report.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does General Access Control Guidance for Cloud Systems provide? (Section 2) er statutory authority. Nor should these guidelines be interpreted as altering or superseding the existing authorities of the Secretary of Commerce, Director of the OMB, or any other federal official. This publication may be used by nongovernmental organizations on a voluntary basis and is not subject to copyright in the United States. Attribution would, however, be appreciated by NIST. National Institute of Standards and Technology Special Publication 800-210 Natl. Inst. Stand. Technol. Spec. Publ. 800-210, 34 pages (July 2020) CODEN: NSPUE2 This publication is available free of charge from: Certain commercial entities, equipment, or materials may be identified in this document in order to describe an experimental procedure or concept adequately. Such identification is not intended to imply recommendation or endorsement by NIST, nor is it intended to imply that the entities, materials, or equipment are necessarily the best available for the purpose. There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may be used by federal agencies even before the completion of such companion publications. Thus, until each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning and transition purposes, federal agencies may wish to closely follow the development of these new publications by NIST. Organizations are encouraged to review all draft publications during public comment periods and provide feedback to NIST. Many NIST cybersecurity publications, other than the ones noted above, are available at

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: General Access Control Guidance for Cloud Systems.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain 3. Introduction to CSF Profiles and Tiers according to NIST The NIST Cybersecurity Framework (CSF) 2.0 According to The NIST Cybersecurity Framework (CSF) 2.0, 3. Introduction to CSF Profiles and Tiers: This section defines the concepts of CSF Profiles and Tiers.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: cybersecurity framework, csf, fips. General security reference material without sensitive content. Source: The NIST Cybersecurity Framework (CSF) 2.0.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is Primitive authentication mechanisms that perform the task of either according to A Methodology for Developing Authentication Assurance Level Taxonomy for Smart Card-based Identity Verification? Primitive authentication mechanisms that perform the task of either: (a) verifying the binding of the person identifier with a personal trait sample (e.g., biometric) and perform a comparison of a live sample of a biometric from a cardholder with the validated trait stored on the card (PUM-6, PUM-7 and PUM-8), or (b) verifying cardholder knowledge of a secret shared between the himself/herself (PUM-4) address the threat of an imposter presenting somebody else's token to the authentication system (FF-T1).

Explanation: NIST publication on credential and access management. Topics: authentication, token. Contains security framework guidance for authentication systems. Source: A Methodology for Developing Authentication Assurance Level Taxonomy for Smart Card-based Identity Verification.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Third-Round Report of the SHA-3 Cryptographic Hash Algorithm Competition say about 1.2 Background? (Part 4) According to Third-Round Report of the SHA-3 Cryptographic Hash Algorithm Competition, 1.2 Background: announcement on October 2, 2012 [29], and officially ended the SHA-3 competition. Table 2 shows the competition timeline, including major events leading to the start of the SHA-3 competition. Table 2. SHA-3 Competition Timeline | Date | Event | |-----------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | 10/31-11/1/2005 | Cryptographic Hash Workshop [30], NIST, Gaithersburg, Maryland. | | 8/24-8/25/2006 | Second Cryptographic Hash Workshop [31], UCSB, California. | | 1/23/2007 | Algorithm(s) for the Revision of Federal Information Processing Standard | | 11/2/2007 | Issued the Federal Register Notice Announcing a Request for Candidate Algorithm Nominations for a New Cryptographic Hash Algorithm (SHA-3) Family [6]. SHA-3 competition began. | | 10/31/2008 | SHA-3 Submission Deadline. | | 12/10/2008 | First-round candidates announced. The first round began. | | 2/25-2/28/2009 | First SHA-3 Candidate Conference [32],KU Leuven, Belgium. | | 7/24/2009 | Second-round candidates announced. The first round ended. | | 9/28/2009 | Second-round candidates posted for public review. The second round began. | | 8/23-8/24/2010 | Second SHA-3 Candidate Conference [33], UCSB, California. | | 12/9/2010 | SHA-3 finalists announced. The second round ended. | | 1/31/2011 | Third-round candidates posted for public review. The third round began. | | 3/22-3/23/2012 | Third SHA-3 Candidate Conference [15], Washington, D.C. | | 10/2/2012 | Keccak announced as the SHA-3 winner. SHA-3 competition ended. |

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Third-Round Report of the SHA-3 Cryptographic Hash Algorithm Competition.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Cloud Computing Synopsis and Recommendations provide? (Section 87) , access to the application is over a network connecting the SaaS provider with the consumer. For public or outsourced SaaS, most application program logic is executed on the cloud provider's servers. The consumer's browser 11 provides: (1) the consumer interface that captures consumer keystrokes and other inputs, and produces output in the form of graphics/sound, and (2) the data export that outputs data to local storage devices such as USB devices or printers. To protect application data exchanged between the consumer's browser and the cloud provider over the network, cryptography is required. Typically, the consumer's browser and the cloud provider's server begin a session by first negotiating a shared key using one of several standard key exchange protocols (e.g., TLS[Die08] or SSL[Net96]). The consumer's browser and the cloud provider can then use the key to encrypt communications. 12 The consumer and provider can then exchange credentials to prove their 11 The consumer may use a browser or other thin-client application to communicate with a SaaS cloud; in practice, browsers are often used as they require no additional installation. For simplicity, this document describes the consumer-side software simply as a "browser." 12 This protection is not without risk however because past implementation errors or protocol flaws have enabled man-in-themiddle attacks that could allow an attacker to hijack a consumer's cloud resources [Mar09]. identities to one another. Generally, a consumer provides an account name and password or other authentication credential such as a time-based hardware token value. The SaaS provider's main responsibility to the consumer is to ensure that the software that it supplies is solidly supported and tested. Another key requirement is that SaaS applications be scalable to increasingly larger consumer workloads.

Explanation: NIST publication on credential and access management. Topics: authentication, token. Contains security framework guidance for authentication systems. Source: Cloud Computing Synopsis and Recommendations.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control ES-1 in Guide to Secure Web Services? (Part 33) Control ES-1: and then initiate a choreography among the services. The rate service may be implemented as an orchestration, as all of the involved Web services would be internal to the rate service's organization. To fully calculate the interest rates that the loan service will use, the rate service consists of a chain of SOAP requests and responses passed from one internal Web service to another to gather the necessary information to respond with accurate rates. Each transaction within the orchestration is controlled by the rate service, so that requests and responses occur in the proper order and failures do not propagate throughout the transaction. Once complete, the rate service returns the result of the orchestration to the loan service, as shown in Figure 2-8. Figure 2-8. The Rate Service as an Orchestration <!-- image --> ## 2.2 Elements of Security Because a Web service relies on some of the same underlying HTTP and Web-based architecture as common Web applications, it is susceptible to similar threats and vulnerabilities. Web services security is based on several important concepts, including 11 : - Identification and Authentication: Verifying the identity of a user, process, or device, often as a prerequisite to allowing access to resources in an information system. - Authorization. The permission to use a computer resource, granted, directly or indirectly, by an application or system owner. - Integrity. The property that data has not been altered in an unauthorized manner while in storage, during processing, or in transit. - Non-repudiation. Assurance that the sender of information is provided with proof of delivery and the recipient is provided with proof of the sender's identity, so neither can later deny having processed the information. 11 The definitions are taken from NIST IR 7298, Glossary of Key Information Security Terms and NIST SP 800-100, Information Security Handbook: A Guide for Managers, available at http://csrc.nist.gov/publications/nistpubs/.

Explanation: NIST publication on credential and access management. Topics: authentication, authorization. Contains security framework guidance for authentication systems. Source: Guide to Secure Web Services.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control HA-3 in Computer Security Division 2013 Annual Report? (Part 48) Control HA-3: o holds bimonthly meetings and an annual 2-day conference to discuss current issues and developments of interest to those responsible for protecting sensitive (unclassified) federal systems. Participation in Forum meetings is open to Federal Government employees, and their designated support contractors, who participate in the management of their organization's information security program. Topics of discussion at Forum meetings in FY 2013 included briefings from various federal agencies on Preparing for and Responding to Certification Authority Compromise and Fraudulent Certificate Issuance; Software Assurance: Enabling Security throughout the Software Development Lifecycle; Use of Cybersecurity Function Code; Census Risk Management Program Implementation; National Cybersecurity Center of Excellence (NCCoE); demonstration of Trusted Geolocation in the Cloud; and Policy Machine: Enabling an Enterprise-wide, Data Centric Computing Environment. This year's annual 2-day offsite meeting featured updates on the computer security activities of the Government Accountability Office (GAO), General Services Administration (GSA), Bureau of the Fiscal Service, and NIST. Recent administration guidance directing federal agencies to reduce travel and conference budgets significantly reduced attendance. Technical sessions included briefings on evolving cybersecurity strategies, IT security concerns during a consolidation (merger), supply chain risk management activities, the National Vulnerability Database (NVD), SP 800-53 Revision 4, continuous monitoring, industrial control systems security, and EO 13636. On August 8, 2013, a Cybersecurity and Risk Management Training Workshop was held at the Department of Commerce with over 500 registrants. Attendees gained a greater understanding of the Risk Management Framework (RMF) and its practical application. Dr.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: risk management framework, rmf, fips. General security reference material without sensitive content. Source: Computer Security Division 2013 Annual Report.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Personal Identity Verification Card Management Report provide? (Section 38) so be accomplished by passing a custom attribute to C\_CreateObject with the OID to be passed to pivPutData. These complexities are attributed to the nature of the fixed data model that PIV uses. - a. The PIV Client API provides some mechanisms for doing card personalization, specifically to write existing data objects and to generate keys and change default PINs on the card. Currently, no CMSs use this API for abstract card management and personalization. - a. Personal Computer Smart Card (PC/SC) is commonly used to communicate directly to the card from the back-end CMS. It has the most control of the card but also the least amount of card abstraction depending on how it is used. PC/SC does contain a card abstraction layer, which may find more use in upcoming versions of Microsoft operating systems. Each of these lacks an abstract means to perform card application management with ISO 7816-13 or Global Platform. Consequently, card application management is often performed with PC/SC communicating directly with the card over a Secure Sockets Layer (SSL) connection from a CMS server issuing commands to the card. Often, the CMS will use a hybrid combination of PC/SC and PKCS#11 to meet all the requirements to issue and manage cards securely. Standard APIs and operating systems provide reasonable support for the usage of already managed and personalized identity tokens. It is expected that the abstract management and personalization of identity tokens will be addressed in future revisions of standard APIs and operating systems. The PIV suite of standards and specifications define a foundation for interoperability of smart card identity tokens across federal agencies. Many organizations are investigating the need to augment the card management and personalization capabilities of the PIV suite.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Personal Identity Verification Card Management Report.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is Discussion according to Security and Privacy Controls for Information Systems and Organizations? Discussion: The principle of performance security states that security mechanisms are

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Security and Privacy Controls for Information Systems and Organizations.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Government Smart Card Interoperability Specification, Version 2.1 provide? (Section 175) ssociated with a Data Model. However, if the smart card uses any of the data elements defined in Data Model then it must use the container and TLV format specified by that Data Model for that element. The SEIWG [SEIW] string is defined as the minimum interoperability mechanism for card holder authentication. The SEIWG strings and files are therefore mandatory for both contact and contactless GSC cards. This specification defines two Data Models. The GSC Data Model was developed for version 1.0 of the GSC-IS (see Appendix C). The GSC Data Model is sometimes referred to as the 'J.8' Data Model, since it was first defined in Section J.8 of the Smart Access Common ID Card contract. The second Data Model was developed for the DoD Common Access Card (CAC) and is referred to as the CAC Data Model (see Appendix D). Applications can discover which Data Model a given card supports by examining the Registered Data Model field of the card's Card Capabilities Container (see Chapter 6). The Registered Data Model field shall contain a 0x01 if the card is using the GSC-IS Data Model defined in Appendix C, or a 0x02 if the card conforms to the CAC Data Model in Appendix D. Error Detection Codes (EDC) are only mandated for the GSC-IS Data Model. All container data elements are stored in SIMPLE-TLV format. Each SIMPLE-TLV data object shall consist of a tag field, a length field and an optional value field. For VM cards implementing the VM card edge interface, the SIMPLE-TLV format is split into a T-Buffer and V-Buffer. (See description in Section 8.4) The tag field T shall consist of a single byte encoding only a number from 1 to 254. No class or construction types are coded. The values '0x00' and '0xFF' are invalid for tag fields. The tag value 0xFE is reserved for the mandatory EDC data object in each container. The scope of tag values is at the container level, so the same tag value could appear in different containers and have different meanings.

Explanation: NIST publication on credential and access management. Topics: authentication, sso. Contains security framework guidance for authentication systems. Source: Government Smart Card Interoperability Specification, Version 2.1.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Conformance Test Architecture and Test Suite for ANSI_NIST-ITL 1-2007 provide? (Section 157) | 18.1 | It is required that the first two fields of the record are ordered, and the field containing the image data shall be the last physical field in the record. | 2 | M | 13.001::LEN_First | First(Field in Record) ST Type(Record) EQ 13 AND Field EQ 13.001 | | | | | | 13::FixedPosition- Fields | 18.1 | It is required that the first two fields of the record are ordered, and the field containing the image data shall be the last physical field in the record. | 2 | M | 13.002::IDC_Second | Second(Field in Record) ST Type(Record) EQ 13 AND Field EQ 13.002 | | | | | | 13::FixedPosition- Fields | 18.1 | It is required that the first two fields of the record are ordered, and the field containing the image data shall be the last physical field in the record. | 2 | M | 13.999::DATA_Last | Last(Field in Record) ST Type(Record) EQ 13 AND Field EQ 13.999 | | | | | | 13::Len=Bytes | 18.1.1 | Field 13.001: Logical record length (LEN) This mandatory ASCII field shall contain the total count of the number of bytes in the Type-13 logical record.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Conformance Test Architecture and Test Suite for ANSI_NIST-ITL 1-2007.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does A Data Protection Approach for Cloud-Native Applications provide? (Section 7) ical step in data protection. Unlike the former, which only secures stored information, in-transit categorization actively monitors and secures data as they move across services and network protocols. This shift to real-time data analysis within the network brings new observability capabilities, eliminating the need for traffic mirroring and data duplication. To address the need for data categorization during travel across services, a relatively new class of in-proxy applications called the WebAssembly [1] program (also called a WASM module) has been increasingly deployed. A WASM module is a lightweight executable compiled to low-level bytecode. This bytecode can be: - (a) Generated from code written in any language using their associated WebAssembly compilers, including C, C++, and Rust - (b) Run using a WASM runtime in an isolated virtual machine (VM) within the proxy, which allows developers to enhance applications with necessary functionality and run them as efficiently as native code in the proxies. Over the last few years, the Envoy WASM VM as enabled new types of compute and traffic processing capabilities and allowed for custom WASM modules to be built and deployed in a sandboxed and fault-tolerant manner. [3] h Additionally, the following features of WebAssembly modules make them particularly effective for data protection: - Data Discovery and Categorization: WASM modules can dynamically identify and categorize data as they traverse the network, ensuring that sensitive information is recognized and handled appropriately. - Dynamic Data Masking (DDM): WASM modules can apply DDM techniques to redact or mask sensitive information in transit, enhancing privacy and security. - User and Entity Behavior Analytics (UEBA): WASM modules can analyze user and entity behaviors in real time, detecting anomalies and potential security threats.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: A Data Protection Approach for Cloud-Native Applications.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Guide to Secure Web Services say about 2.8 Web Services' Interfaces with Network/Infrastructure Security Architectures? (Part 2) According to Guide to Secure Web Services, 2.8 Web Services' Interfaces with Network/Infrastructure Security Architectures: ely than others to have bugs. An additional security feature provided by Java and .NET frameworks is sandboxing, which is designed to separate all actions of the Web service from the operating system. Sandboxing affords added benefits to developers and administrators: stricter permissions and capabilities than those provided by the operating system can be applied to a Web service, and the sandbox helps to prevent the Web service from inadvertently or maliciously harming the underlying operating system, providing the sandbox itself is robust against attack. Web services frameworks provide a number of benefits to developers in addition to well-tested tools and libraries: automatic creation of WSDL descriptors, client and server stubs, and potentially some implementation code. While this support can greatly improve the productivity of the development team, some developers may begin to rely on these tools when developing Web services and may not fully understand the code that is automatically generated. Should such developers be required to use a different development environment for Web services, they may not be adaptable and may inadvertently introduce security vulnerabilities. Additionally, the use of non-vetted, automatically generated code can itself lead to security vulnerabilities; most automatically generated code is intended merely to guide and aid developers, not for production use. Developers need to be fully versed in the libraries supported by the framework when dealing with libraries that perform authentication, authorization, and other security functions that are not supported by the base framework. For example, XACML and SAML provide a flexible and platform-independent framework for distributed authorization. To properly implement XACML and SAML support may require overriding the framework's authentication mechanism at various points, which could lead to potential vulnerabilities in the Web service application.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain 8.1.2 Network Architecture according to NIST Cybersecurity Framework Manufacturing Profile Low Impact Level Example Implementations Guide_ Volume 1 – General Implementation Guidance According to Cybersecurity Framework Manufacturing Profile Low Impact Level Example Implementations Guide_ Volume 1 – General Implementation Guidance, 8.1.2 Network Architecture: The PCS network is segmented from the main Laboratory LAN by a boundary router. The router uses a dynamic routing protocol, Open Shortest Path First (OSPF), to communicate with the main top-level router. The network architecture is shown in Figure 8-3. All network traffic needs to go through the boundary router to access the main Laboratory LAN. There are two virtual network segments in the system. Each network is managed by an Ethernet switch. The HMI and the Controller are in virtual network VLAN-1, while the Plant Simulator, Data Historian, OPC DA Server, and PLC are in virtual network VLAN-2. VLAN-1 simulates a central control room environment where the HMI and the controllers are virtually located in the same network segment. VLAN-2 simulates the process operation environment which typically consists of the operating plant, PLCs, OPC server, and the Data Historian. Figure 8-3 PCS Network Architecture <!-- image -->

Explanation: NIST cybersecurity documentation and standards guidance. Topics: cybersecurity framework, fips, security control. General security reference material without sensitive content. Source: Cybersecurity Framework Manufacturing Profile Low Impact Level Example Implementations Guide_ Volume 1 – General Implementation Guidance.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Module-Lattice-Based Key-Encapsulation Mechanism Standard say about 1.1 Purpose and Scope? According to Module-Lattice-Based Key-Encapsulation Mechanism Standard, 1.1 Purpose and Scope: This standard specifies the Module-Lattice-Based Key-Encapsulation Mechanism (ML-KEM). A key-encapsulation mechanism (KEM) is a set of algorithms that can be used to establish a shared secret key between two parties communicating over a public channel. A KEM is a particular type of key establishment scheme. Other NISTapproved key establishment schemes are specified in NIST Special Publication (SP) 800-56A, Recommendation for Pair-Wise Key-Establishment Schemes Using Discrete Logarithm-Based Cryptography [2], and SP 800-56B, Recommendation for Pair-Wise Key Establishment Schemes Using Integer Factorization Cryptography [3]. The key establishment schemes specified in SP 800-56A and SP 800-56B are vulnerable to attacks that use sufficiently-capable quantum computers. ML-KEM is an approved alternative that is presently believed to be secure, even against adversaries in possession of a large-scale fault-tolerant quantum computer. ML-KEM is derived from the round-three version of the CRYSTALS-KYBER KEM [4], a submission in the NIST Post-Quantum Cryptography Standardization project. For the differences between ML-KEM and CRYSTALS-KYBER, see Appendix C. This standard specifies the algorithms and parameter sets of the ML-KEM scheme. It aims to provide sufficient information to implement ML-KEM in a manner that can pass validation (see https://csrc.nist.gov/projects/cryptographic-module-validation-program). For general definitions and properties of KEMs, including requirements for the secure use of KEMs in applications, see SP 800-227 [1]. This standard specifies three parameter sets for ML-KEM that offer different trade-offs in security strength versus performance. All three parameter sets of ML-KEM are approved to protect sensitive, non-classified communication systems of the U.S. Federal Government.

Explanation: NIST publication discussing classified information handling. References: classified, secret. Contains guidance on protecting sensitive government information. Source: Module-Lattice-Based Key-Encapsulation Mechanism Standard.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Information Security Handbook_ A Guide for Managers provide? (Section 33) | Step 4 - Risk Analysis................................................................... | 88 | | | | 10.1.4.1 Control Analysis................................................................ | 88 | | | | 10.1.4.2 Likelihood Determination.................................................... | 89 | | | | 10.1.4.3 Impact Analysis ................................................................

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Information Security Handbook_ A Guide for Managers.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control HA-256 in Trust Model for Security Automation Data 1.0 (TMSAD)? (Part 28) Control HA-256: N. Borenstein, (1996). Multipurpose Internet Mail Extensions (MIME) Part One: Format of Internet Message Bodies . November 1996. See [RFC2119] Bradner, S. (1997). Key words for use in RFCs to Indicate Requirement Levels . March 1997. See [RFC4051] Eastlake, D. (2005). Additional XML Security Uniform Resource Identifiers (URIs) . April 2005. See [XML-C14N] Boyer, John (2001). Canonical XML Version 1.0, W3C Recommendation, March 2001. See http://www.w3.org/TR/2001/REC-xml-c14n-20010315 or [XML-C14N11] Boyer, John and Glenn Marcy (2008). Canonical XML Version 1.1 , W3C Recommendation, May 2008. See http://www.w3.org/TR/2008/REC-xml-c14n11-20080502. [XMLDSIG] Eastlake, Donald, et al. (2008). XML Signature Syntax and Processing, 2 nd Edition , W3C Recommendation, June 2008. See http://www.w3.org/TR/xmldsig-core/. [XML-exc-C14N] Boyer, John, Donald Eastlake, and Joseph Reagle (2002). Exclusive XML Canonicalization Version 1.0 , W3C Recommendation, July 2002. See [XPath] Clark, James and Steve DeRose (1999). XML Path Language (XPath) Version 1.0 , W3C Recommendation. October 1999. See http://www.w3.org/TR/1999/REC-xpath-19991116. [XPath Filter-2] Boyer, John, Merlin Hughes, and Joseph Reagle (2002). XML-Signature XPath Filter 2.0 , W3C Recommendation, November 2002. See ## B.2 Informative References [RFC4050] Blake-Wilson, S., et al. (2005). Using the Elliptic Curve Signature Algorithm (ECDSA) for XML Digital Signatures . April 2005. See [SP800-57] United States. National Institute of Standards and Technology. Special Publication 800-57, Recommendation for Key Management - Part 1: General . March 2007.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Trust Model for Security Automation Data 1.0 (TMSAD).


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Trusted Cloud_ Security Practice Guide for VMware Hybrid Cloud Infrastructure as a Service (IaaS) Environments say about 3 Approach? (Part 2) According to Trusted Cloud_ Security Practice Guide for VMware Hybrid Cloud Infrastructure as a Service (IaaS) Environments, 3 Approach: data encryption and key management servers; and cloud services. Cooperative Research and Development Agreements (CRADAs) were established with qualified respondents, and 'build teams' were assembled. The following actions were performed by the build teams: -  fleshing out the initial architecture and composing the collaborators' components into demonstration prototypes -  documenting the architecture and design implementation, including the steps taken to install and configure each component of the demonstration environment -  conducting security and functional testing of the demonstration environment, and then conducting and documenting the results of a risk assessment and a security characteristics analysis -  working with industry collaborators to suggest future considerations

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control, assessment. General security reference material without sensitive content. Source: Trusted Cloud_ Security Practice Guide for VMware Hybrid Cloud Infrastructure as a Service (IaaS) Environments.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule_ A Cybersecurity Resource Guide say about 5.2.4. Device and Media Controls (§ 164.310(d))? (Part 6) According to Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule_ A Cybersecurity Resource Guide, 5.2.4. Device and Media Controls (§ 164.310(d)): | • Ensure that an individual is responsible for and records the receipt and removal of hardware and software with ePHI. | • Has a process been implemented to maintain a record of the movements of and persons responsible for hardware and electronic media that contain ePHI? • Where is data stored (i.e., what type of media)? • What procedures already exist to track hardware and software within the organization (e.g., an enterprise inventory management system)? • If workforce members are allowed to remove electronic media that contain or may be used to access ePHI, do procedures exist to track the media externally? • Who is responsible for maintaining records of hardware and software? | | 4. Develop Data Backup and Storage Procedures Implementation Specification (Addressable) | • Create a retrievable exact copy of ePHI, when needed, before movement of equipment. • Ensure that an exact retrievable copy of the data is retained and protected to maintain the integrity of ePHI during equipment relocation. | • Has a process been implemented to create a retrievable, exact copy of ePHI when needed and before the movement of equipment? • Are backup files maintained off-site to ensure data availability in the event that data is lost while transporting or moving electronic media that contain ePHI? • If data were to be unavailable while media are transported or moved for a period of time, what would the business impact be? |

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule_ A Cybersecurity Resource Guide.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Cybersecurity Framework Manufacturing Profile Low Impact Level Example Implementations Guide_ Volume 2 – Process-based Manufacturing System Use Case say about Sample Risk Management Log? According to Cybersecurity Framework Manufacturing Profile Low Impact Level Example Implementations Guide_ Volume 2 – Process-based Manufacturing System Use Case, Sample Risk Management Log: The Risk Management Log will be maintained by the Director of Operations and reviewed in the monthly senior management meeting. This log captures the results of the latest risk analysis and the status of planned corrective actions. | Risk | Category (Technical, Management, Contractual, External) | Probability | Impact | Risk Score | Risk Mitigation Strategy (e.g. Avoid, Transfer, Mitigate or Accept the risk) | Actions required | Status (Open, closed, In Progress) | Due Date | |--------|-----------------------------------------------------------|---------------|----------|--------------|--------------------------------------------------------------------------------|--------------------|--------------------------------------|------------|

Explanation: NIST cybersecurity documentation and standards guidance. Topics: cybersecurity framework, fips, security control. General security reference material without sensitive content. Source: Cybersecurity Framework Manufacturing Profile Low Impact Level Example Implementations Guide_ Volume 2 – Process-based Manufacturing System Use Case.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Securing Small-Business and Home Internet of Things (IoT) Devices_ Mitigating Network-Based Attacks Using Manufacturer Usage Description (MUD) provide? (Section 196) es Micronets components, the Micronets Microservices layer, the Intelligent Services and Business Logic layer, and the Micronets API framework are each described in their respective subsections below. Figure 8-1 Logical Architecture—Build 3 8.3.1.1 MUD Capability As shown in Figure 8-1, Build 3 includes integrated support for MUD in the form of a MUD registry, a MUD manager, a MUD-capable Micronets Manager, and a MUD-capable Micronets Gateway. Support NIST SP 1800-15B: Securing Small-Business and Home Internet of Things Devices 133 This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.1800-15 This publication is available freeof charge from:https://doi.org/10.6028/NIST.SP.1800-15 for MUD also requires access to a MUD file server that hosts MUD files for the MUD-capable IoT devices being onboarded. Build 3 is based on Release 1 of Wi-Fi Easy Connect, which does not include a mechanism for explicitly conveying the device’s MUD file URL as part of the device bootstrapping information. To work around this deficiency, Build 3 uses both the information element field and the public key field in the device bootstrapping information to determine the device’s MUD file URL. These two fields are used in the following manner:  The information element field indicates the device’s MUD file server. The value in the information element field identifies the device’s manufacturer, and it is assumed that each manufacturer has a well-known location for serving MUD files.  The public key field both conveys the device’s public key and identifies the specific file on the manufacturer’s MUD file server that is the device’s MUD file.  The Micronets Manager extracts these two values from the bootstrapping information and provides them to the MUD registry lookup service, which in turn responds with the URL of the MUD file associated with an onboarded device.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: nist sp, fips, security control. General security reference material without sensitive content. Source: Securing Small-Business and Home Internet of Things (IoT) Devices_ Mitigating Network-Based Attacks Using Manufacturer Usage Description (MUD).


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Guide to IPsec VPNs provide? (Section 272) data, contains a topological drawing of the interconnection, and provides a signature line. The MOU/A documents the terms and conditions for sharing data and information resources in a secure manner. The MOU/A also defines the purpose of the interconnection, identifies relevant authorities, specifies the responsibilities of both organizations, and defines the terms of agreement, including the apportionment of costs and the timeline for terminating or reauthorizing the interconnection. The MOU/A should not include technical details on how the interconnection is established or maintained; that is the function of the ISA. Items that are typically part of the ISA include the following: - The information and data that will be made available, exchanged, or passed in only one direction between the systems through the IPsec gateways and the sensitivity of that information - The services offered over the VPN by each organization, if any - The user community that will be served by the VPN - A description of all system security technical services pertinent to the secure exchange of data between the systems; examples include the use of NIST-approved encryption 87 NIST SP 800-47, Security Guide for Interconnecting Information Technology Systems , contains information on interconnection agreements, as well as extensive guidance on planning, establishing, maintaining, and disconnecting system interconnections and developing an interconnection agreement [93]. 88 Appendices A and B of NIST SP 800-47 [93] contain detailed guidance on developing an ISA and an MOU/A, as well as a sample of each. Rather than develop an ISA and MOU/A, organizations may choose to incorporate this information into a formal contract, especially if the interconnection is to be established between a Federal agency and a commercial organization. In some cases, organizations may also decide to use established organizational procedures for documenting the agreement in lieu of an ISA and MOU/A.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: nist sp, fips, security control. General security reference material without sensitive content. Source: Guide to IPsec VPNs.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Overview and Considerations of Access Control Based on Attribute Encryption say about Table of Contents? (Part 2) According to Overview and Considerations of Access Control Based on Attribute Encryption, Table of Contents: ...................................................... | 5 | | 2.3. | Bilinear Pair Mapping.................................................................................................. | 7 | | 2.4. | Bilinear Pairing for Cryptography................................................................................ | 9 | | 3. | Identity-Based Encryption ..............................................................................................11 | | | 4. | Attribute-Based Encryption............................................................................................13 | | | 4.1. | Ciphertext-Policy Attribute-Based Encryption | ............................................................13 | | 4.2. | Key-Policy Attribute-Based Encryption ......................................................................18 | | | 5.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Overview and Considerations of Access Control Based on Attribute Encryption.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does An Analysis of Computer Security Safeguards for Detecting and Preventing Intentional Computer Misuse say about Safeguard Rankings? (Part 12) According to An Analysis of Computer Security Safeguards for Detecting and Preventing Intentional Computer Misuse, Safeguard Rankings: | | H | | CD | CO | | | | | | woo: | | CO QCcn4-)CQPj4-lCOt-( | | | | | | | | Vj | | | OXJ 03.-iV43a33 | | | | | | | | | | | c^ | | | | | | | | | | | | | | | | ^ | | | | | | | | | in | | | M-l •r4 TJ J-l 4J CO .-I CJ Cfl 44 M-l 0) CO -H 3 o CU -H x: di g O Q H O S Q O H Q •H a!

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: An Analysis of Computer Security Safeguards for Detecting and Preventing Intentional Computer Misuse.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Security Considerations for Voice Over IP Systems provide? (Section 68) \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ SIP is the IETF specified protocol for initiating a two-way communication session. It is considered by some to be simpler than H.323 [18][16], though it is now the largest RFC in IETF history. SIP is text based; thereby avoiding the ASN.1 associated parsing issues that exist with the H.323 protocol suite, if S/MIME is not used as part of SIP inherent security measures.. Also, SIP is an application level protocol, that is, it is decoupled from the protocol layer it is transported across. It can be carried by TCP, UDP, or SCTP. UDP may be used to decrease overhead and increase speed and efficiency, or TCP may be used if SSL/TLS is incorporated for security services. Newer implementations may use stream control transmission protocol (SCTP), developed in the IETF SIGTRAN working group (RFC 2960) specifically to transport signaling protocols. SCTP offers increased resistance to DoS attacks through a four-way handshake method, the ability to multi-home, and optional bundling of multiple user messages into a single SCTP packet. Additional security services can be used with SCTP via RFC 3436 (TLS over SCTP) or 3554 (SCTP over IP Sec). Unlike H.323, only one port is used in SIP (note that H.323 may also be used in a way that uses only one port - direct routed calls). The default value for this port is 5060. The architecture of a SIP network is different from the H.323 structure. A SIP network is made up of end points, a proxy and/or redirect server, location server, and registrar. A diagram is provided in Figure 5. In the SIP model, a user is not bound to a specific host (neither is this the case in H.323, gatekeeper provides address resolution). The user initially reports their location to a registrar, which may be integrated into a proxy or redirect server. This information is in turn stored in the external location server.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Security Considerations for Voice Over IP Systems.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does 6th Annual PKI R&D Workshop _Applications-Driven PKI_ Proceedings provide? (Section 66) ompliant manner and as electronic evidence in a court of law. Previously the lab employees had to print, hand sign, fax, mail and archive hard copy documents associated with the paper-based processes. The labs increased their competitive advantage by decreasing the time it takes to submit reports to clients (from 1-3 business days with a paper process to immediately available using an electronic process). The lab is using dual appliances in high availability configuration. In addition, SAPI was used to directly integrate report file signing into their LIMS system. Since signed documents need to be validated outside the organization, the lab had set up their system so that the CRL is published to an externally accessible web address (instead to the default location on their internal directory). The lab's root CA certificate was also published to an externally accessible web address along with instructions to clients on how to install this certificate in their local trusted root certificates store. It should be noted that since reports in this system are securely delivered to clients using a web portal, the lab's clients themselves are not necessarily concerned with validating the signatures. However the lab needs to protect itself from a scenario in which external parties may want to change a report to suit their needs. In this case the ability for stand-alone verification of a signed document outside of the lab's system is important for dispute resolution.

Explanation: NIST publication on credential and access management. Topics: pki, sso. Contains security framework guidance for authentication systems. Source: 6th Annual PKI R&D Workshop _Applications-Driven PKI_ Proceedings.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control AC-06(05) in Assessing Security Requirements for Controlled Unclassified Information? (Part 110) Control AC-06(05): orrectly, operating as intended, and producing the desired outcome with respect to meeting the security requirements for an information system or organization. [2] ## system See information system . ## system security plan A document that describes how an organization meets or plans to meet the security requirements for a system. In particular, the system security plan describes the system boundary, the environment in which the system operates, how the security requirements are satisfied, and the relationships with or connections to other systems. ## Appendix C. Security Requirement Assessment This appendix provides an overview of the process for assessing the security requirements in SP 800-171 [3]. The four-phase process is based on the methodology in SP 800-53A [5] 6 and includes: - Preparing for assessments - Developing assessment plans - Conducting assessments - Analyzing, documenting, and reporting assessment results ## C.1. Preparing for Assessments Thorough preparation by the organization and assessors is an important aspect of conducting an effective assessment. Preparatory activities address a range of issues relating to the cost, schedule, and conduct of the assessment.

Explanation: NIST publication discussing classified information handling. References: classified, controlled unclassified. Contains guidance on protecting sensitive government information. Source: Assessing Security Requirements for Controlled Unclassified Information.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations say about PL-2 SYSTEM SECURITY AND PRIVACY PLANS? According to Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations, PL-2 SYSTEM SECURITY AND PRIVACY PLANS: Supplemental C-SCRM Guidance: The system security plan (SSP) should integrate CSCRM. The enterprise may choose to develop a stand-alone C-SCRM plan for an individual system or integrate SCRM controls into their SSP. The system security plan and/or system-level C-SCRM plan provide inputs into and take guidance from the CSCRM Strategy and Implementation Plan at Level 1 and the C-SCRM policy at Level 1 and Level 2. In addition to internal coordination, the enterprise should coordinate with suppliers, developers, system integrators, external system service providers, and other ICT/OT-related service providers to develop and maintain their SSPs. For example, building and operating a system requires a significant coordination and collaboration between the enterprise and system integrator personnel. Such coordination and collaboration should be addressed in the system security plan or stand-alone C-SCRM plan. These plans should also consider that suppliers or external service providers may not be able to customize to the acquirer's requirements. It is recommended that suppliers, developers, system integrators, external system service providers, and other ICT/OT-related service providers also develop C-SCRM plans for non-federal (i.e., contractor) systems that are processing federal agency information and flow down this requirement to relevant sub-level contractors. Section 2, Appendix C, and Appendix D provide guidance on C-SCRM strategies, policies, and plans. Controls in this publication (NIST SP 800-161, Rev. 1) should be used for the C-SCRM portion of the SSP.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: nist sp, fips, security control. General security reference material without sensitive content. Source: Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is Discussion according to Security and Privacy Controls for Information Systems and Organizations? Discussion: If a federal agency asks individuals to supply information that will become part

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Security and Privacy Controls for Information Systems and Organizations.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain 1.1 Authority according to NIST BIOS Protection Guidelines According to BIOS Protection Guidelines, 1.1 Authority: The National Institute of Standards and Technology (NIST) developed this document in furtherance of its statutory responsibilities under the Federal Information Security Management Act (FISMA) of 2002, Public Law 107-347. NIST is responsible for developing standards and guidelines, including minimum requirements, for providing adequate information security for all agency operations and assets; but such standards and guidelines shall not apply to national security systems. This guideline is consistent with the requirements of the Office of Management and Budget (OMB) Circular A-130, Section 8b(3), 'Securing Agency Information Systems,' as analyzed in A-130, Appendix IV: Analysis of Key Sections. Supplemental information is provided in A-130, Appendix III. This guideline has been prepared for use by Federal agencies. It may be used by nongovernmental organizations on a voluntary basis and is not subject to copyright, though attribution is desired. Nothing in this document should be taken to contradict standards and guidelines made mandatory and binding on Federal agencies by the Secretary of Commerce under statutory authority, nor should these guidelines be interpreted as altering or superseding the existing authorities of the Secretary of Commerce, Director of the OMB, or any other Federal official.

Explanation: NIST publication discussing classified information handling. References: secret, national security. Contains guidance on protecting sensitive government information. Source: BIOS Protection Guidelines.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Preliminary Functional Specifications of a Prototype Electronic Research Notebook for NIST say about Current Notekeeping Practice? According to Preliminary Functional Specifications of a Prototype Electronic Research Notebook for NIST, Current Notekeeping Practice: - Primary purpose of notekeeping - Notebook issuance - Types of notebook entries - Notebook maintenance

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Preliminary Functional Specifications of a Prototype Electronic Research Notebook for NIST.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Guide to SSL VPNs provide? (Section 18) active content, which allows them to provide functionality that is not accessible to SSL portal VPNs. Examples of active content include Java, JavaScript, Active X, or Flash applications or plug-ins. This publication discusses the fundamental technologies and features of SSL VPNs. It describes SSL and how it fits within the context of layered network security. It presents a phased approach to SSL VPN planning and implementation that can help in achieving successful SSL VPN deployments. It also compares the SSL VPN technology with IPsec VPNs and other VPN solutions. This information is particularly valuable for helping organizations to determine how best to deploy SSL VPNs within their specific network environments. Implementing the following recommendations should assist in facilitating more efficient and effective SSL VPN use for Federal departments and agencies. Some organizations, such as Federal agencies, have strict requirements for encryption and integrity protection. SSL VPNs should support the required algorithms for symmetric encryption, key exchange, and hash functions. For government agencies, traffic that requires protection must employ Federal 1 Detailed information on the IPsec components may be found in NIST Special Publication (SP) 800-77, Guide to IPsec VPNs , available from http://csrc.nist.gov/publications/nistpubs/. Information Processing Standard (FIPS)-compliant cryptographic algorithms and modules. Many of the cryptographic algorithms used in some SSL cipher suites are not FIPS-approved, and therefore are not allowed for use in SSL VPNs that are to be used in applications that must conform to FIPS 140-2. This means that to be run in FIPS-compliant mode, an SSL VPN gateway must only allow cipher suites that are allowed by FIPS 140-2. Some of the cryptographic requirements, including allowable hash functions and certificate key lengths, will change at the end of 2010.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: nist sp, fips, security control. General security reference material without sensitive content. Source: Guide to SSL VPNs.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control ES-1 in Guide to Storage Encryption Technologies for End User Devices? (Part 31) Control ES-1: m and permitting access to the encrypted data only after proper authentication is provided. Folder encryption is very similar to file encryption, only it addresses individual folders instead of files. Some OSs offer built-in file and/or folder encryption capabilities, 24 and many third-party programs are also available. Although folder encryption and virtual disk encryption sound similar-both a folder and a container are intended to contain and protect multiple files-there is a difference. A container is a single opaque file, meaning that no one can see what files or folders are inside the container until the container is decrypted. File/folder encryption is transparent, meaning that anyone with access to the filesystem can view the names and possibly other metadata for the encrypted files and folders, including files and folders within encrypted folders, if they are not protected through OS access control features. File/folder encryption is used on all types of storage for end user devices. File/folder encryption can be implemented in many ways, including through drivers, services, and applications. When a user attempts to open an encrypted file (either encrypted by itself or located in an encrypted folder), the software requires the user to first authenticate successfully. Once that has been done, the software will automatically decrypt the chosen file. Because it decrypts a single file at a time, the performance impact of file/folder encryption should be minimal. File/folder encryption is most commonly used on user data files, such as word processing documents and spreadsheets. File/folder encryption solutions can sometimes encrypt swap files, but typically not OS executables and hibernation files.

Explanation: NIST publication on credential and access management. Topics: access control, authentication. Contains security framework guidance for authentication systems. Source: Guide to Storage Encryption Technologies for End User Devices.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Hardware-Enabled Security_ Container Platform Security Prototype say about 3 Prototyping Stage 0? According to Hardware-Enabled Security_ Container Platform Security Prototype, 3 Prototyping Stage 0: This section describes stage 0 of the prototype implementation (platform attestation and measured worker node launch).

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Hardware-Enabled Security_ Container Platform Security Prototype.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain 1.2.2.1 Client Systems and Mail User Agents (MUAs) according to NIST Domain Name System-Based Electronic Mail Security According to Domain Name System-Based Electronic Mail Security, 1.2.2.1 Client Systems and Mail User Agents (MUAs): Client systems environments demonstrated were Microsoft Office, an open-source Linux-based Thunderbird application, and Thunderbird with a Secure64-provided Apple Key Chain utility. This set includes both commercial products and open-source software. MUA capabilities associated with the client systems are used to invoke S/MIME digital signature and signature verification for email, but userto-user encryption is not demonstrated. Collaborators assisted in installation, integration tailoring as necessary, and testing of laboratory configurations.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Domain Name System-Based Electronic Mail Security.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain Disclaimer according to NIST Recommended Criteria for Cybersecurity Labeling for Consumer Internet of Things (IoT) Products According to Recommended Criteria for Cybersecurity Labeling for Consumer Internet of Things (IoT) Products, Disclaimer: Any mention of commercial products or reference to commercial organizations is for information only; it does not imply recommendation or endorsement by NIST, nor does it imply that the products mentioned are necessarily the best available for the purpose.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Recommended Criteria for Cybersecurity Labeling for Consumer Internet of Things (IoT) Products.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control AM-1 in Framework for Improving Critical Infrastructure Cybersecurity, Version 1.0? (Part 19) Control AM-1: | • CCS CSC 17 • COBIT 5 APO01.06, DSS06.06 • ISA 62443-3-3:2013 SR 3.1, SR 3.8, SR 4.1, SR 4.2 • ISO/IEC 27001:2013 A.8.2.3, A.13.1.1, A.13.2.1, A.13.2.3, A.14.1.2, A.14.1.3 • NIST SP 800-53 Rev. 4 SC-8 | | | Data Security (PR.DS): Information and records (data) are managed consistent with the organization's risk strategy to protect the confidentiality, integrity, and availability of information. | PR.DS-3: Assets are formally managed throughout removal, transfers, and disposition | • COBIT 5 BAI09.03 • ISA 62443-2-1:2009 4. 4.3.3.3.9, 4.3.4.4.1 • ISA 62443-3-3:2013 SR 4.2 • ISO/IEC 27001:2013 A.8.2.3, A.8.3.1, A.8.3.2, A.8.3.3, A.11.2.7 • NIST SP 800-53 Rev. 4 CM-8, MP-6, PE-16 | | | Data Security (PR.DS): Information and records (data) are managed consistent with the organization's risk strategy to protect the confidentiality, integrity, and availability of information.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: nist sp, fips, security control. General security reference material without sensitive content. Source: Framework for Improving Critical Infrastructure Cybersecurity, Version 1.0.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control UI-64 in Guidelines for the Secure Deployment of IPv6? (Part 315) Control UI-64: uthentication in IKEv2 , P. Eronen, H. Tschofenig, Y. Sheffer, September 2010. RFC 6027, IPsec Cluster Problem Statement , Y. Nir, October 2010. RFC 6052, IPv6 Addressing of IPv4/IPv6 Translators , C. Bao, C. Huitema, M. Bagnulo, M. Boucadair, X. Li, October 2010. RFC 6071, IP Security (IPsec) and Internet Key Exchange (IKE) Document Roadmap , S. Frankel, S. Krishnan, December 2010. ## IETF Internet Drafts IETF Internet Draft (expired), Distributed NAT for Broadband Deployments Post IPv4 Exhaustion . IETF Internet Draft, DNS64: DNS extensions for Network Address Translation from IPv6 Clients to IPv4 Servers , Work in Progress . IETF Internet Draft , Dual-Stack Lite Broadband Deployments Following IPv4 Exhaustion , Work in Progress. IETF Internet Draft, Framework for IPv4/IPv6 Translation , Work in Progress . IETF Internet Draft, Home Agent Reliability Protocol (HARP) , Work in Progress. IETF Internet Draft, IP/ICMP Translation Algorithm , Work in Progress . IETF Internet Draft, IPv6 Router Advertisement Guard , Work in Progress . IETF Internet Draft (expired), Mobile IPv6 Residual Threats. IETF Internet Draft, Mobility Support in IPv6 , Work in Progress. IETF Internet Draft, Stateful NAT64: Network Address and Protocol Translation from IPv6 Clients to IPv4 Servers , Work in Progress . IETF Internet Draft (expired), NAT-PT Security Considerations . IETF Internet Draft, Protocol Support for High Availability of IKEv2/IPsec , Work in Progress. IETF Internet Draft, A Quick Crash Detection Method for IKE , Work in Progress . IETF Internet Draft, Security Concerns with IP Tunneling , Work in Progress IETF Internet Draft, Transport Layer Security-based Mobile IPv6 Security Framework for Mobile Node to Home Agent Communication , Work in Progress . ## Other Sources of IPv6 Information Handbook of IPv4 to IPv6 Transition: Methodologies for Institutional and Corporate Networks , J. Amos and D. Mimili, Auer Bach, 2007. IP Addressing & Subnetting including IPv6 , J.D.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Guidelines for the Secure Deployment of IPv6.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does A Profile for U.S. Federal Cryptographic Key Management Systems (CKMS) say about 10.4 FCKMS Hardware Failure? (Part 2) According to A Profile for U.S. Federal Cryptographic Key Management Systems (CKMS), 10.4 FCKMS Hardware Failure: ns should attempt to find an optimum trade-off between redundancy and cost. FR:10.4 The CKMS design shall specify the strategy for backup and recovery from failures of hardware components and devices. | PR:10.15 | CP-9 (+2) | AFederal CKMS shall perform initial and periodic tests of backup and recovery capabilities of its critical FCKMS modules and devices. | |------------|-------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | PR:10.16 | | AFederal CKMS shall test the backup and recovery of services requiring high availability at least annually or in accordance with a Service Level Agreement. | | PR:10.17 | | AFederal CKMS shall perform tests of security-critical hardware monthly or in accordance with a Service Level Agreement. | | PR:10.18 | | AFederal CKMS shall repair or replace failed critical hardware and be returned to operational status within 24 hours of a failure or in accordance with a Service Level Agreement. | | PF:10.4 | | AFederal CKMS could repair or replace failed hardware and be returned to operational status within one hour of a failure when high availability is required. | | PF:10.5 | | AFederal CKMS could automatically verify the operational readiness of its backup services. |

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: A Profile for U.S. Federal Cryptographic Key Management Systems (CKMS).


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Securing Electronic Health Records on Mobile Devices say about puppet will install here? (Part 18) According to Securing Electronic Health Records on Mobile Devices, puppet will install here: es 29 Figure 7-3 Certificate Viewer – General T h i s p u b l i c a t i o n i s a v a i l l a b e f r e e o f c h a r g e f r o m : h t t p : / / d o i . o r g / 1 0 . 6 0 2 8 / N I S T . S P 1 8 0 0 - 1 . . d. Select the Details tab to view the detailed certificate information. From there you should have an Export button to export the certificate. Figure 7-4 Certificate Viewer – Details NIST SP 1800-1C: Securing Electronic Health Records on Mobile Devices 30 T h i s p u b l i c a t i o n i s a v a i l l a b e f r e e o f c h a r g e f r o m : h t t p : / / d o i . o r g / 1 0 . 6 0 2 8 / N I S T . S P 1 8 0 0 - 1 . . e. Save the certificate to a file. 4. Import the certificate into the local certificate store in ISE. a. From the ISE Administration Portal, use the navigation path Administration > System > Certificates > Certificate Store to perform the import action. b. Grant ISE Access to the Fiberlink MaaS360 Application Programming Interface (API). 5. Create a Fiberlink MaaS360 administrator account with an API role. a. Log on to the MaaS360 with an Administrator Account. b. Navigate to Setup > Administrators and click Add Administrator. c. Enter the new username and a corporate email address and click Next. d. Enter Roles for the newly created administrator and click Next. e. Verify the setting and press Save. 6. Add MDM server to ISE. a. Use the MaaS360 MDM admin account created above. b. Configure Cisco ISE to integrate with the MaaS360: Administration > MDM > External MDM Server, then click Add. c. Fill out the required information using the account created in Step 5 and the host name or IP address provided by Fiberlink. A sample result is given below: Figure 7-5 Identity Services Engine d. You can use the Test Connection button to test the connection between the Cisco ISE and the cloud MaaS360. A successful message will be displayed if the connection succeeds.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: nist sp, fips, security control. General security reference material without sensitive content. Source: Securing Electronic Health Records on Mobile Devices.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Cybersecurity for Smart Inverters_ Guidelines for Residential and Light Commercial Solar Energy Systems say about Guideline #2: Use Role-Based Access Control (RBAC)? (Part 2) According to Cybersecurity for Smart Inverters_ Guidelines for Residential and Light Commercial Solar Energy Systems, Guideline #2: Use Role-Based Access Control (RBAC): smart-inverter capabilities that require updates to role definitions. The assignment of people and organizations to roles should be reviewed periodically to ensure they are up to date and appropriate. 3 MFA is authentication using two or more of the following factors: (i) something you know (e.g., password/personal identification number [PIN]), (ii) something you have (e.g., cryptographic identification device, token), or (iii) something you are (e.g., biometric). 4 Reference [4] describes current best practices in a variety of authentication techniques, including MFA and passwords. Additional password best-practice guidance is provided by Cybersecurity and Infrastructure Security Agency (CISA) [5] and the Federal Bureau of Investigation (FBI) [6]. Fig. 4. Guideline #2 life cycle phase <!-- image --> A basic collection of roles for a smart inverter might include: - An Installer role with the access permissions needed to perform initial setup and configuration of the smart inverter. A smart-inverter manufacturer might include this as a default role along with a default user account, as described in Guideline #1 (Sec. 2.1). - A Maintainer role with the access permissions needed to install software updates, perform diagnostics, and make repairs. - A Homeowner role with the access permissions needed to monitor the operation of the smart inverter and respond to alerts.

Explanation: NIST publication on credential and access management. Topics: access control, authentication, mfa. Contains security framework guidance for authentication systems. Source: Cybersecurity for Smart Inverters_ Guidelines for Residential and Light Commercial Solar Energy Systems.