You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain 2.6.3 Organization Identity Management Official (OIMO) according to NIST Guidelines for the Authorization of Personal Identity Verification Card Issuers (PCI) and Derived PIV Credential Issuers (DPCI) According to Guidelines for the Authorization of Personal Identity Verification Card Issuers (PCI) and Derived PIV Credential Issuers (DPCI), 2.6.3 Organization Identity Management Official (OIMO): The Organization Identity Management Official is responsible for implementing policies of the organization, assuring that all PIV processes of the issuer are being performed reliably, and providing guidance and assistance to the issuing facilities. The OIMO implements and manages the operations plan; ensures that all roles are filled with capable, trustworthy, knowledgeable, and trained staff; makes certain that all services, equipment, and processes meet FIPS 201-2 requirements; monitors and coordinates activities with Issuing Facility Manager(s); and supports the authorization process. 10 Organizations may define other significant roles (e.g., PIV System liaisons, operations managers) to support the authorization process.

Explanation: NIST publication on credential and access management. Topics: authorization, identity management. Contains security framework guidance for authentication systems. Source: Guidelines for the Authorization of Personal Identity Verification Card Issuers (PCI) and Derived PIV Credential Issuers (DPCI).


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Data Integrity_ Identifying and Protecting Assets Against Ransomware and Other Destructive Events say about 2.10 Semperis Directory Services Protector? According to Data Integrity_ Identifying and Protecting Assets Against Ransomware and Other Destructive Events, 2.10 Semperis Directory Services Protector: This section details the installation of Semperis Directory Services Protector (DSP), a tool used for monitoring Active Directory environments. This installation requires both a copy of SQL Server Express as well as the Semperis Wizard. See the Semperis DS Protector v2.5 Technical Requirements document for specifics on the requirements. For a Windows Server 2012 R2 installation, simply meet the following requirements: - .NET Framework Version 3.5 SP1 - .NET Framework Version 4.5.2 or later - joined to the Active Directory domain it is protecting - either the installer for SQL Express Advanced or connection information and credentials for a full version of Microsoft SQL (MSSQL)

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Data Integrity_ Identifying and Protecting Assets Against Ransomware and Other Destructive Events.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain ENHANCED SECURITY REQUIREMENT according to NIST Assessing Enhanced Security Requirements for Controlled Unclassified Information According to Assessing Enhanced Security Requirements for Controlled Unclassified Information, ENHANCED SECURITY REQUIREMENT: Conduct [ Assignment: organization-defined enhanced personnel screening ] for individuals and reassess individual positions and access to CUI [ Assignment: organization-defined frequency ].

Explanation: NIST publication discussing classified information handling. References: classified, controlled unclassified, cui. Contains guidance on protecting sensitive government information. Source: Assessing Enhanced Security Requirements for Controlled Unclassified Information.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control PD-12 in Guidelines for the Authorization of Personal Identity Verification Card Issuers (PCI) and Derived PIV Credential Issuers (DPCI)? (Part 113) Control PD-12: | SP 800-79-2, Section 2.6 - Issuer Roles and Responsibilities | | IAT = Organizational Preparedness | IAT = Organizational Preparedness | IAT = Organizational Preparedness | IAT = Organizational Preparedness | |-------------------------------------|-------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------| | Authorization Focus Area | Identifier | Issuer Control | Source | | | RR-4 | The organization has appointed the role of Assessor.

Explanation: NIST publication on credential and access management. Topics: authorization, sso. Contains security framework guidance for authentication systems. Source: Guidelines for the Authorization of Personal Identity Verification Card Issuers (PCI) and Derived PIV Credential Issuers (DPCI).


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control AU-2 in Security and Privacy Controls for Information Systems and Organizations? (Part 2) Control AU-2: emergency situations. Dynamic privilege management includes the effects of privilege changes, for example, when there are changes to encryption keys used for communications. Related Controls: AC-16. (7) ACCOUNT MANAGEMENT | PRIVILEGED USER ACCOUNTS (a) Establish and administer privileged user accounts in accordance with [Selection: a role- based access scheme; an attribute-based access scheme]; (b) Monitor privileged role or attribute assignments; (c) Monitor changes to roles or attributes; and (d) Revoke access when privileged role or attribute assignments are no longer appropriate. CHAPTER THREE PAGE 21 T h s i p u b l i c a t i o n i s a v a i l l a b e f r e e o f c h a r g e f r o m : h t t p s : / / d o i . o r g / 1 0 . 6 0 2 8 / N S T S P . 8 0 0 - 5 3 r 5 . I NIST SP 800-53, REV. 5 SECURITY AND PRIVACY CONTROLS FOR INFORMATION SYSTEMS AND ORGANIZATIONS _________________________________________________________________________________________________ Discussion: Privileged roles are organization-defined roles assigned to individuals that allow those individuals to perform certain security-relevant functions that ordinary users are not authorized to perform. Privileged roles include key management, account management, database administration, system and network administration, and web administration. A role-based access scheme organizes permitted system access and privileges into roles. In contrast, an attribute-based access scheme specifies allowed system access and privileges based on attributes. Related Controls: None. (8) ACCOUNT MANAGEMENT | DYNAMIC ACCOUNT MANAGEMENT Create, activate, manage, and deactivate [Assignment: organization-defined system accounts] dynamically.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: nist sp, fips, security control. General security reference material without sensitive content. Source: Security and Privacy Controls for Information Systems and Organizations.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Engineering Trustworthy Secure Systems say about E.5. Commensurate Rigor? According to Engineering Trustworthy Secure Systems, E.5. Commensurate Rigor: Principle: The rigor associated with the conduct of an engineering activity provides the confidence required to address the most significant adverse effect that can occur. Note: Rigor determines the scope, depth, and detail of an engineering activity. Rigor is a means of providing confidence in the results of a completed engineering activity. Generally, an increase in rigor translates to an increase in confidence in the results of the activity. Further, increased confidence reduces the uncertainty that can also reduce risk or provide a better understanding of what to address to achieve risk reduction. The relationship between rigor and the criticality of data and information used to make decisions is recognized by systems analysis practices [4]. The principle of commensurate rigor helps to ensure that the concept of rigor is included as an equal factor in the trade space of capability, adverse effect, cost, and schedule in the planning and conduct of engineering activities, method and tool selection, and personnel selection. An increase in rigor may translate into an increase in the cost of personnel, methods, and tools required to complete rigorous engineering activities or an increase in schedule to accomplish the activities with the expected rigor. Any increased cost that may occur can be justified by acquiring confidence about system performance to limit loss while also addressing the system's ability to deliver the capability. Therefore, the rigor associated with an engineering activity should be commensurate with the significance of the most adverse effect associated with the activity.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Engineering Trustworthy Secure Systems.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Automation Support for Security Control Assessments_ Software Asset Management provide? (Section 150) included with other capabilities, as appropriate. The literal text of the control item follows the heading Control Item Text . There may be one or more determination statements for each control item. Each determination statement is documented in a table, noting the: - determination statement ID (Control Item ID concatenated with the Determination Statement Number, where Determination Number is enclosed in curly brackets); - determination statement text; - implemented by (responsibility); - assessment boundary; - assessment responsibility; - assessment method; - selected column (TBD by the organization); - rationale for risk acceptance (thresholds) (TBD by the organization); - frequency of assessment; 27 and - impact of not implementing the defect check (TBD by the organization). The determination statement details are followed by a table showing the defect checks (and related sub-capability) that might be caused to fail if the control being tested fails. The resulting text provides a template for the organization to edit, as described in Section 3.1. This section includes security control items selected in the SP 800-53 Low, Moderate, and High baselines and that support the SWAM capability. For convenience, the control items are presented in three sections as follows: - (1) Low Baseline Control Items (Section 3.3.3). Security control items in the low baseline, which are required for all systems. - (2) Moderate Baseline Control Items (Section 3.3.4). Security control items in the moderate baseline, which are also required for the high baseline. - (3) High Baseline Control Items (Section 3.3.5). Security control items that are required only for the high baseline. Table 7 illustrates the applicability of the security control items to each baseline. 27 While automated tools may be able to assess as frequently as every 3 to 4 days, organizations determine the appropriate assessment frequency in accordance with the ISCM strategy.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control, assessment. General security reference material without sensitive content. Source: Automation Support for Security Control Assessments_ Software Asset Management.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does A Conformance Test for FDDI Medium Access Control (MAC) say about FDDI MAC Conformance Test TTCN Machine Processable Form? (Part 1) According to A Conformance Test for FDDI Medium Access Control (MAC), FDDI MAC Conformance Test TTCN Machine Processable Form: FDDI MAC Conformance Test TTCN Machine Processable Form ' I I i ) 1 r 1 I t if mfi c I * 1. f 4 f t *i HI B [S\_X4 Iv I ^ cr J^& i S ! 1 3 xlbrF^:»r»^. if'F'd! ; u 7 , 4 - san.iMiotnoC? iO^R j :3#2«Laoor^'^mri3€i^ ^ f I '^'' *0'J^ IriOTT ``` $Suite $SuiteIci FDDI $Begin_SuiteOverview $SuiteId FDDI $StanciardsRef FDDI MAC (X3T9 . 5/ 88-139 ) ; $PICSRef Test Suite for FDDI MAC Conformance Verification $PIXITRef Test Suite for FDDI MAC Conformance Verification $HowUsed Test Suite for FDDI MAC Conformance Verification $TestMethods The Remote Test Method $Comment Test Suite for FDDI MAC Conformance Verification $SuiteIndex $ Test Case Index $End_TestCaseIndex $TestStepIndex $End_TestStepIndex $Defaultindex $End_Defaultindex $End_SuiteIndex $End_SuiteOverview $Declarations $UserTYPEdefs $Begin_TTCN_TYPEdef $TTCN_TYPEdef $UserTypeId Symbol $Base BITSTRING $TypeDef BITSTRING [5] $Comment The smallest signaling element used by MAC. $End_TTCN_TYPEdef $TTCN_TYPEdef $UserTypeId Sstring $Base BITSTRING $TypeDef ('llllO'B, 'OlOOl'B, 'lOlOO'B, 'lOlOl'B, 'OlOlO'B, 'OlOll'B, 'OlllO'B, 'Ollll'B, '1C $Comment Symbolstring (Sstring) is the TTCN new type defined by user. $End_TTCN_TYPEc $End_TTCN_TYPEdefs $End_UserTYPEdef $ Be gi n_TS_PARdc1 $TS_PARdcl $TS_PARid IUT_Address $TS_PARtype INTEGER $PICS_PIXIT $Comment The address of Station Under Test. $End_TS_PARdcl $TS_PARdcl $TS_PARid Tester_Address $TS_PARtype INTEGER $PICS_PIXIT $Comment The address of Tester. Get this value from Tester. $End_TS_PARdcl $TS_PARdcl $TS_PARid TTRT $TS_PARtype INTEGER (4000 TO 167772) $PICS_PIXIT $Comment The operative Target Token Rotation Time. $End_TS_PARdcl $TS_PARdcl $TS_PARid T_Req_Tester $TS_PARtype INTEGER (4000 TO 167772) $PICS_PIXIT $Comment Tester's Requested TTRT. $End_TS_PARdcl $TS_PARdcl $TS_PARid T_Req_IUT $TS_PARtype INTEGER (4000 TO 167772) $PICS_PIXIT $Comment lUT' s Requested TTRT.

Explanation: NIST publication on credential and access management. Topics: access control, token. Contains security framework guidance for authentication systems. Source: A Conformance Test for FDDI Medium Access Control (MAC).


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does A Zero Trust Architecture Model for Access Control in Cloud-Native Applications in Multi-Cloud Environments say about Table of Contents? (Part 9) According to A Zero Trust Architecture Model for Access Control in Cloud-Native Applications in Multi-Cloud Environments, Table of Contents: 1. Enterprise infrastructure layer for uniform policy deployment.......................................... | Fig. 1. Enterprise infrastructure layer for uniform policy deployment.......................................... | 7 | | Fig. 2. Flexibility provided by multi-tier policies .........................................................................10 | Fig. 2. Flexibility provided by multi-tier policies .........................................................................10 | | | Fig. 3. Multi-tier Policies for a Hybrid Application Environment .................................................13 | Fig. 3. Multi-tier Policies for a Hybrid Application Environment .................................................13 | | | Fig. 4. An Istio Authorization Policy that allows Service 1 to Service 2 on port 443 but only allows it to execute the GET HTTP verb on the '/public' path........................................15 Fig. 5.

Explanation: NIST publication on credential and access management. Topics: access control, authorization. Contains security framework guidance for authentication systems. Source: A Zero Trust Architecture Model for Access Control in Cloud-Native Applications in Multi-Cloud Environments.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Index of Automated System Design Requirements as Derived from the OMB Privacy Act Implementation Guidelines say about Foreword? (Part 105) According to Index of Automated System Design Requirements as Derived from the OMB Privacy Act Implementation Guidelines, Foreword: ming Organ. Report No. - y. rcKrUKMllNU UK(jAIN i/.A 1 1(JIN MAMt AND AUUKboo NATIONAL BUREAU OF STANDARDS DEPARTMENT OF COMMERCE WASHINGTON, D.C. 20234 10. Project/Task/Work Unit No. 600 1101 11. Contract/Grant .No. 0^1 ce of ADP Standards Managemerrt^ InH^tute for Computer Sclerveef^d Technology NationS'K&uxiiea.u-ef-^SnHar^ Washington, D.C. 20234 13. Type of Report & Period Covered Final - 14, Sponsoring Agency Code 15. SUPPLEMENTARY NOTES 16. ABSTRACT (A 200-word or less factual summary of most sigrtificant information. If document includes a significant bibliography or literature survey, mention it here.) This index is a list of certain requirements which must be considered by Federal technical and administrative personnel in order to comply with those provisions of the Privacy Act of 1974* relating to automated systems design and development . This index has been derived from the Office of Management and Budget (0MB) guidelines** for implementing those provisions Each requirement listed contains a reference to an applicable part of the Privacy Act and to a page and column number of the 0MB guidelines as they appear in the Federal Register . Therefore, these documents must be used in conjunction with this index. Furthermore , a familiarity with these documents will increase the utility of this index. 17. KEY WORDS (six to twelve entries; alphabetical order; capitalize only the first letter of the first key word unless a proper name; separated by semicolons Computer; data processing/ index; information processing; privacy; requirements definition; systems design; security 18. AVAILABILITY Unlimited r~! For Official Distribution. Do Not Release to NTIS I ! Order From Sup. of Doc, U.S. Government Printing Office Washington, D.C. 20402, SD Cat. No. CU I Order From National Technical Information Service (NTIS) Springfield, Virginia 22151 19. SECURITY CLASS (THIS REPORT) UNCL ASSIFIED 20. SECURITY CLASS (THIS PAGE) UNCLASSIFIED 21. NO.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Index of Automated System Design Requirements as Derived from the OMB Privacy Act Implementation Guidelines.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Attribute-based Access Control for Microservices-based Applications using a Service Mesh provide? (Section 63) (2017) Linear Time Algorithms to Restrict Insider Access using Multi-Policy Access Control Systems. Journal of Wireless Mobile - Networks, Ubiquitous Computing, and Dependable Applications 8(1):4-25. https://doi.org/10.22667/JOWUA.2017.03.31.004 - [13] Ferraiolo D, Chandramouli R, Hu V, Kuhn R (2016) A Comparison of Attribute Based Access Control (ABAC) Standards for Data Service Applications: Extensible Access Control Markup Language (XACML) and Next Generation Access Control (NGAC) (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) 800-204A. https://doi.org/10.6028/NIST.SP.800-178 - [14] Agarwal G (2020) Enable Mutual TLS Authentication between your Kubernetes Workloads Using Istio (Medium.com). Available at https://medium.com/betterprogramming/enable-mutual-tls-authentication-between-your-kubernetes-workloadsusing-istio-65338c8adf82 - [15] Envoy (2021) External Authorization . Available at \_filter#arch-overview-ext-authz - [16] Envoy (2021) JWT Authentication . Available at n\_filter#config-http-filters-jwt-authn - [17] Hu VC, Ferraiolo DF, Kuhn DR, Schnitzer A, Sandlin K, Miller R, Scarfone K (2014) Guide to Attribute Based Access Control (ABAC) Definitions and Considerations. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) 800162.

Explanation: NIST publication on credential and access management. Topics: access control, authentication, authorization. Contains security framework guidance for authentication systems. Source: Attribute-based Access Control for Microservices-based Applications using a Service Mesh.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Recommendation for Key Management_ Part 1 – General say about 8.3.1 Key Archive and Key Recovery Functions? (Part 2) According to Recommendation for Key Management_ Part 1 – General, 8.3.1 Key Archive and Key Recovery Functions: rior to the end of the key's cryptoperiod. For example, it may be prudent to archive the key when it is activated. When no longer required, the key shall be destroyed in accordance with Section 8.3.4. The confidentiality of archived key information is provided by an archive-encryption key (one or more encryption keys that are used exclusively for the encryption of archived key information), by another key that has been archived, or by a key that may be derived from an archived key. Note that the algorithm with which the archive-encryption key is used may also provide integrity protection for the encrypted information. When the archive-encryption key and its associated algorithm do not also provide integrity protection for the encrypted information, integrity protection shall be provided by a separate archive-integrity key (i.e., one or more authentication or digital-signature keys that are used exclusively for the archive) or by another key that has been archived. When the confidentiality and integrity protection of the archived key information are provided using separate processes, the archive-encryption key and archive-integrity key shall be different from each other (e.g., independently generated) and shall be protected in the same manner as their key type (see Section 6.1.1). Note that these two services could also be provided using authenticated encryption, which uses a single cryptographic algorithm operation and a single key. Tables 9 and 10 indicate the appropriateness of archiving keys and other cryptographically related information. An 'OK' in column 2 (Archive?) indicates that archiving is permissible but not necessarily required. Column 3 (Retention period) indicates the minimum time that the key should be retained in the archive. Additional advice on the storage of keying material in archive storage is provided in Appendix B.3.

Explanation: NIST publication on credential and access management. Topics: authentication, key management, sso. Contains security framework guidance for authentication systems. Source: Recommendation for Key Management_ Part 1 – General.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does A Taxonomic Approach to Understanding Emerging Blockchain Identity Management Systems say about Table of Contents? (Part 10) According to A Taxonomic Approach to Understanding Emerging Blockchain Identity Management Systems, Table of Contents: | Public Registries and Reputation Management Implications ........................ | Public Registries and Reputation Management Implications ........................ | 27 | | 4.6 | System Governance ..................................................................................... | System Governance .....................................................................................

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: A Taxonomic Approach to Understanding Emerging Blockchain Identity Management Systems.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations say about (3) CONTINUOUS MONITORING | TREND ANALYSES? According to Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations, (3) CONTINUOUS MONITORING | TREND ANALYSES: Supplemental C-SCRM Guidance: The information gathered during continuous monitoring/trend analyses serves as input into C-SCRM decisions, including criticality analysis, vulnerability and threat analysis, and risk assessments. It also provides information that can be used in incident response and potentially identify a supply chain cybersecurity compromise, including an insider threat. Level(s): 3

Explanation: NIST cybersecurity publication covering vulnerability management. Topics: vulnerability, incident response. Contains technical security guidance that could inform defensive posture. Source: Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Symmetric Key Injection onto Smart Cards provide? (Section 21) ard holder, verification of MAC KPACS ensures that the session key was created by the smart card and not by a separate device, such as a desktop computer, that is under the control of the card holder. Second, when combined with the validation of the PACS's key management certificate and the verification that the key management key used by the smart card to encrypt the session key is the same as the public key in the PACS's key management certificate, the CMS helps to protect against man-in-the-middle attacks. This section presents an alternative key injection protocol, which differs from the protocol presented in Section 5 in that the PIV Card does not connect to the PACS prior to connecting with its CMS. The result of this difference is that the PACS cannot authenticate the PIV Card at all and so must completely rely on the PIV Card's CMS to ensure that symmetric key that it provides can only be obtained by the PIV Card. 1. The card holder connects to the CMS over a two-way authenticated TLS session in which client authentication is performed using the PIV Authentication key from the PIV Card. 2. The PIV Card's CMS establishes a two-way authenticated TLS session with the PACS. 3. The CMS obtains the PACS's RSA key management certificate, validates it, and then sends the public key from the certificate, KKM,PACS , to the PIV Card. 4. PIV Card generates a random session key, Ks , and a nonce, Ns . 3 5. PIV Card sends the following data to the CMS: - a. encrypted session key and nonce: ( Ks || Ns ) KKM,PACS . - b. MAC KPACS = MAC[ KCM , ( Ks || Ns ) KKM,PACS || KKM,PACS ], where KCM is the symmetric card management key that the PIV Card shares with its CMS. 6. The CMS verifies that Ks and Ns were created by the PIV Card and that the PIV Card used the correct key to encrypt Ks and Ns by verifying that MAC[ KCM , ( Ks || Ns ) KKM,PACS || KKM,PACS ] = MAC KPACS . 7. The CMS sends the following data to the PACS over the TLS protected channel: - a.

Explanation: NIST publication on credential and access management. Topics: authentication, key management. Contains security framework guidance for authentication systems. Source: Symmetric Key Injection onto Smart Cards.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control CA-7 in A Profile for U.S. Federal Cryptographic Key Management Systems (CKMS)? (Part 14) Control CA-7: ange a key and its metadata without violating (or altering) either domain's FCKMS security policy. | | Component | Any hardware, software, and/or firmware required to construct a CKMS. | |--------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | Compromise (noun) | The unauthorized disclosure, modification, substitution, or use of sensitive data (e.g., keys, metadata, or other security-related information) or the unauthorized modification of a security- related system, device or process in order to gain unauthorized access. | | Compromise (verb) | To reduce the trust associated with a key, its metadata, a system, device or process. | | Compromise recovery | The procedures and processes of restoring a system, device or process that has been compromised back to a secure or trusted state, including destroying compromised keys, replacing compromised keys (as needed), and verifying the secure state of the recovered system. | | Compromised state | A lifecycle state for a key that is known or suspected of being known by an unauthorized entity. | | Computer Security Policy | The high-level policy for the security services that are to be supported by a computer for protecting its applications, stored data, and communications, and the rules to be followed in verifying user identities and authorizing their requests before they are granted. | | Confidentiality | The property that sensitive information is not disclosed to unauthorized entities. | | Configurable | A characteristic of a system, device, or software that allows it to be changed by an entity authorized to select or reject specific capabilities to be included in an operational, configured version.

Explanation: NIST publication on credential and access management. Topics: key management, sso. Contains security framework guidance for authentication systems. Source: A Profile for U.S. Federal Cryptographic Key Management Systems (CKMS).


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Assessment of Access Control Systems say about 1.1 Authority? According to Assessment of Access Control Systems, 1.1 Authority: The National Institute of Standards and Technology (NIST) developed this document in furtherance of its statutory responsibilities under the Federal Information Security Management Act (FISMA) of 2002, Public Law 107-347. NIST is responsible for developing standards and guidelines, including minimum requirements, for providing adequate information security for all agency operations and assets, but such standards and guidelines shall not apply to national security systems. This document is consistent with the requirements of the Office of Management and Budget (OMB) Circular A-130, Section 8b(3), 'Securing Agency Information Systems,' as analyzed in A-130, Appendix IV: Analysis of Key Sections. Supplemental information is provided in A-130, Appendix III. This guideline has been prepared for use by federal agencies. It may be used by nongovernmental organizations on a voluntary basis and is not subject to copyright, though attribution is desired. Nothing in this document should be taken to contradict standards and guidelines made mandatory and binding on federal agencies by the Secretary of Commerce under statutory authority, nor should these guidelines be interpreted as altering or superseding the existing authorities of the Secretary of Commerce, Director of the OMB, or any other federal official.

Explanation: NIST publication discussing classified information handling. References: secret, national security. Contains guidance on protecting sensitive government information. Source: Assessment of Access Control Systems.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control HA-384 in NIST Test Personal Identity Verification (PIV) Cards Version 2? (Part 13) Control HA-384: [NISTIR7870] | Cooper DA (2012) NIST Test Personal Identity Verification (PIV) Cards. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Interagency or Internal Report (IR) 7870. https://doi.org/10.6028/NIST.IR.7870 | | [PIV-I] | Federal PKI Certificate Policy Authority (2018) X.509 Certificate and Certificate Revocation List (CRL) Extensions Profile for Personal Identity Verification Interoperable (PIV-I) Cards. Available at: x509-cert-profiles-pivi.pdf | | [RFC4556] | Zhu L, Tung B (2006) Public Key Cryptography for Initial Authentication in Kerberos (PKINIT). (Internet Engineering Task Force (IETF) Network Working Group), IETF Request for Comments (RFC) 4556. https://doi.org/ 10.17487/RFC4556 | | [SP800-73] | Cooper DA, Ferraiolo H, Mehta KL, Francomacaro S, Chandramouli R, Mohler J (2015) Interfaces for Personal Identity Verification. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) 800-73-4, Includes updates as of February 8, 2016. https://doi.org/10.6028/NIST.SP.800-73-4 | | [SP800-76] | Grother PJ, Salamon WJ, Chandramouli R (2013) Biometric Specifications for Personal Identity Verification. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) 800-76-2. https://doi.org/10.6028/NIST.SP.800-76-2 | | [SP800-78] | Polk WT, Dodson DF, Burr WE, Ferraiolo H, Cooper DA (2015) Cryptographic Algorithms and Key Sizes for Personal Identity Verification. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) 800-78-4.

Explanation: NIST publication on credential and access management. Topics: authentication, pki. Contains security framework guidance for authentication systems. Source: NIST Test Personal Identity Verification (PIV) Cards Version 2.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain Weaknesses: according to NIST Guidelines for Securing Radio Frequency Identification (RFID) Systems According to Guidelines for Securing Radio Frequency Identification (RFID) Systems, Weaknesses:: - GLYPH<c=31,font=/MCAMJE+Webdings> A system of digital signatures requires a public key infrastructure (PKI), including registration and certification authorities, revocation functions, and associated policies and practice statements. Successfully implementing and operating a PKI requires careful planning and considerable expertise. In addition, readers or middleware need to support digital signature and other PKI functionality that is not commonly found in current RFID technology. - GLYPH<c=31,font=/MCAMJE+Webdings> Digital signatures systems require more memory than found on many current tags. For example, NIST recommends that RSA signatures have a length of 1024 bits, and a length of 2048 bits after 2010. 55 Additional memory is required to store identifying information related to the transaction. Providing chain of custody evidence requires storing a digital signature and related identifying information for each transaction. 55 Elliptic curve cryptography can reduce the size of signatures. Elliptic curve methods provide comparable assurance to 1024bit RSA signatures with 163 bits, and to 2048-bit RSA signatures with 224 bits. This approach combined with greater memory on tags may alleviate storage concerns over time. - GLYPH<c=31,font=/MCAMJE+Webdings> Digital signatures that are not generated by the tag are subject to replay attacks. An adversary could query a tag to obtain its evidence of authenticity (i.e., the digital signature created by a previous reader) and then replicate that data on a cloned tag. - GLYPH<c=31,font=/MCAMJE+Webdings> The use of digital signatures to support authentication of readers to tags would require tags to support relatively complex cryptographic functions beyond the capacity of most common tag designs. Consequently, password or symmetric key authentication systems likely will support tag access control, as opposed to tag authenticity verification, for the foreseeable future.

Explanation: NIST publication on credential and access management. Topics: access control, authentication, pki. Contains security framework guidance for authentication systems. Source: Guidelines for Securing Radio Frequency Identification (RFID) Systems.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does 1989 Computer Security and Privacy Plans (CSPP) Review Project_ A First-Year Federal Response to the Computer Security Act of 1987 (Final Report) say about APPENDIX G APPLICABLE LAWS AND REGULATIONS AS REPORTED BY CSPPs? (Part 4) According to 1989 Computer Security and Privacy Plans (CSPP) Review Project_ A First-Year Federal Response to the Computer Security Act of 1987 (Final Report), APPENDIX G APPLICABLE LAWS AND REGULATIONS AS REPORTED BY CSPPs: ry Flexibility Act Resource Planning Act Right to Financial Privacy Act Securities Act of 1933 Securities Exchange Act of 1934 Small Business Act Social Security Act Supp. for Pollution Abatement Sur. Mining Cont & Reclam Act Tariff act of 1930 Tax Reform Act The Staggers Act of 1975 Toxic Substances Control Act Trade and Tariff act of 1984 Trade agreements act of 1979 Trade Secrets Act of 1905 Trade Act of 1974 Traffic Act of 1930 Treasury Rules and Regs Treaty on Narcotic Drugs Trust Indenture Act of 1939 US Grain Standards Act USDA ADP Security Manual VA ADP Policies and Handbooks Welfare Laws Wire & Ele Com Interception Witness Security Reform Act of 1984. Witness Protection Act 10 USC 60 12 USC 95a, 22 USC 5315 13 USC (Nat. sec. Info.) 15 USC 1151-1157 15 USC 176a 18 CFR 128, 161, 250, 284, 18 USC 1906 18 USC 2351 18 USC 2510 18 USC 1902 18 CFR 35.13, 270, 273, 18 CFR 154.38, 154.63, 521 18 CFR 157, 260, 385, 388 18 USC 1030 ``` ``` 154.310 18 USC 2071 18 USC 1905, 1906 18 USC 641 18 USC 1343 18 USC 3500, 3521 18 USC 751-75 18 CFR 11, 154.301, 18 USC 1030(A)(4) 18 USC 2511 26 USC 6103 28 USC 569. 31 USC 5311 35 USC Sec. 181-188 36 CFR Subchapter E 38 USC 4 CFR 81, 83 40 USC 483(b) 44 CFR Chapter 22 44 USC 3501 44 USC Section 3508 44 USC 3501-3520 49 CFR Part 12, 44 5 USC 301 5 CFR Part 351 MP-1, MP-2, MP-3, MP-4 MP-1-76, MP-6 MP1 PT1 5 MPl PT2 13 NMI 1382.17 NMI 1382. 17B NMI 1620.7 NMI 2410. 7A NCSC 11 NSDD 145 NSDD 97 NTIS #2 NTISS # 2 NTISS # 200 NTISS 3005 NTISSP 2, 200 , MP-5 ```

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: 1989 Computer Security and Privacy Plans (CSPP) Review Project_ A First-Year Federal Response to the Computer Security Act of 1987 (Final Report).


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control SR-12 in NIST_SP_800-53r5_Security_Privacy_Controls? (Part 47) Control SR-12: ntrol inheritance Augmentation of a security or privacy control to build in additional but related functionality to the control, increase the strength of the control, or add assurance to the control. A situation in which a system or application receives protection from security or privacy controls (or portions of controls) that are developed, implemented, assessed, authorized, and monitored by entities other than those responsible for the system or application; entities either internal or external to the organization where the system or application resides. See common control. control parameter See organization-defined control parameter. controlled area controlled interface Any area or space for which an organization has confidence that the physical and procedural protections provided are sufficient to meet the requirements established for protecting the information and/or information system. An interface to a system with a set of mechanisms that enforces the security policies and controls the flow of information between connected systems. APPENDIX A PAGE 399 T h s i p u b l i c a t i o n i s a v a i l l a b e f r e e o f c h a r g e f r o m : h t t p s : / / d o i . o r g / 1 0 . 6 0 2 8 / N S T S P . 8 0 0 - 5 3 r 5 I . NIST SP 800-53, REV. 5 SECURITY AND PRIVACY CONTROLS FOR INFORMATION SYSTEMS AND ORGANIZATIONS _________________________________________________________________________________________________ controlled unclassified information [32 CFR 2002] counterfeit [SP 800-161] countermeasures [FIPS 200] covert channel [CNSSI 4009] Information that the Government creates or possesses, or that an entity creates or possesses for or on behalf of the Government, that a law, regulation, or Government-wide policy requires or permits an agency to handle using safeguarding or dissemination controls.

Explanation: NIST publication discussing classified information handling. References: classified, controlled unclassified. Contains guidance on protecting sensitive government information. Source: NIST_SP_800-53r5_Security_Privacy_Controls.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Computer Security Division 2015 Annual Report say about Small and Medium Size Business (SMB) Cybersecurity Workshop Outreach? (Part 2) According to Computer Security Division 2015 Annual Report, Small and Medium Size Business (SMB) Cybersecurity Workshop Outreach: overview of cybersecurity threats, vulnerabilities, and corresponding protective tools and techniques, with a special emphasis on information that small business personnel can apply directly. In FY 2015, six SMB outreach workshops were provided in Reno, Nevada; Fresno, California; Modesto, California; Fairmont, West Virginia; Pittsburgh, Pennsylvania; and McHenry, Maryland. Additionally, the SMB Cybersecurity Outreach Program was briefed to the InfraGard National Congress. In collaboration with the SBA and the FBI, planning is underway to identify locations and plan cybersecurity workshops in FY 2016.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Computer Security Division 2015 Annual Report.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Multifactor Authentication for E-Commerce_ Risk-Based, FIDO Universal Second Factor Implementations for Purchasers provide? (Section 117) they need to replicate the multifactor authentication (MFA) for electronic commerce (e-commerce) example implementations. These reference designs are modular and can be deployed in whole or in parts. This guide contains three volumes: -  NIST SP 1800-17A: Executive Summary -  NIST SP 1800-17B: Approach, Architecture, and Security Characteristics - what we built and why -  NIST SP 1800-17C: How-To Guides - instructions for building the example implementations (you are here) Depending on your role in your organization, you might use this guide in different ways: Business decision makers, including chief security and technology officers, will be interested in the Executive Summary , NIST SP 1800-17A , which describes the following topics: -  challenges that enterprises face in implementing MFA to reduce online fraud -  example implementations built at the NCCoE -  benefits of adopting one or more of these example implementations Technology or security program managers who are concerned with how to identify, understand, assess, and mitigate risk will be interested in NIST SP 1800-17B , which describes what we did and why. The following sections of Volume B will be of particular interest: -  Section 3.4, Risk Assessment, provides a description of the risk analysis we performed. -  Appendix A, Mapping to Cybersecurity Framework, maps NIST and consensus security references to the Cybersecurity Framework Subcategories that are addressed in this practice guide. Additionally, work roles in NIST SP 800-181, National Initiative for Cybersecurity Education \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ (NICE) Cybersecurity Workforce Framework that perform the tasks necessary to implement those cybersecurity Functions and Subcategories were identified.

Explanation: NIST publication on credential and access management. Topics: authentication, mfa. Contains security framework guidance for authentication systems. Source: Multifactor Authentication for E-Commerce_ Risk-Based, FIDO Universal Second Factor Implementations for Purchasers.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Performance Assurance and Data Integrity Practices provide? (Section 59) to express the proportion of records in a given file likely to be read for processing in a given run. Expressed as a percentage of the records read divided by the total number of records in the file. Appi ication -An adjective, as in application program or application system, describing custom written code to fill a specific local information processing need. (Contrast with Software.) Binding -The process, performed during program preparation, where flexibility and ambiguity are systematically removed from a computer program until an executable object program results. Binding takes place in stages starting with the programmer's original conception of the problem solution through compilation, loading, and the dynamic setting of absolute actual machine addresses immediately prior to an instruction's execution. Different types of variables are bound at different stages along the spectrum of binding time. In general, earlier binding means less flexibility and more (machine) efficiency. Later binding means flexibility at the cost of machine cycles. (Note: Each instruction must be completely bound at the instant it is executed. Commercial -An adjective, as in commercial computer, meaning a system offered for sale and listed in the GSA catalog. Contrast with special purpose, custom hardware prepared for military, space, or special industrial purposes at negotiated prices. A commercial computer is capable of performing both business and engineering processes. In some segments of the computer community, the word commercial is used as an adjective to modify the phrase "data processing". In this context commercial data processing is used synonymously with business data processing, and in juxtaposition to scientific data processing. Throughout this report, the unadorned phrase "data processing" is used to denote all of these contexts and the word commercial is used to denote the manufacturer's stock price book offering.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Performance Assurance and Data Integrity Practices.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Digital Identity Guidelines_ Federation and Assertions say about Table of Contents? (Part 3) According to Digital Identity Guidelines_ Federation and Assertions, Table of Contents: . . . . . . . . . . . . . . 13 | | | 3.3.1. | Trust Agreement Management . . . . . . . . . . . . . . . . . . 13 | | | 3.3.2. . . . . . . | Authorized Party . . . . . . . . . . . . . . . . . . . . 14 | | | 3.3.3. | Proxied Federation . . . . . . . . . . . . . . . . . . . . . . . . . 14 | | | 3.3.4. | Fulfilling Roles and Functions of a Federation Model . . . . . . . 16 | | 3.4. | Federated Identifiers . . . . . . . . . . . . . . . . . . . . . . . . . . . . | 17 | | | 3.4.1. | Pairwise Pseudonymous Identifiers (PPI) . . . . . . . . . . . . . 18 | | 3.5. | Trust Agreements . . . . . . . . . . | . . . . . . . . . . . . . . . . . . . 19 | | | 3.5.1. . | Bilateral Trust Agreements . . . . . . . . . . . . . . . . . . . . 22 | | | 3.5.2. | Multilateral Trust Agreements . . . . . . . . . . . . . . . . . . . 23 | | | 3.5.3. . . . | Redress Requirements . . . . . . . . . . . . . . . . . . . . 25 | | 3.6. | Identifiers and Cryptographic Key Management for CSPs, IdPs, and RPs | .

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Digital Identity Guidelines_ Federation and Assertions.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Cybersecurity Framework Profile for Liquefied Natural Gas say about Prioritized Cybersecurity Framework Categories by Mission Objective? (Part 4) According to Cybersecurity Framework Profile for Liquefied Natural Gas, Prioritized Cybersecurity Framework Categories by Mission Objective: ---| | RECOVER | | | Recovery Planning (RC.RP) | Table 10. Prioritized CSF Categories for Mission Objective-4: Monitor, Detect, and Respond to Anomalous Behavior. | Function | High Priority | Medium Priority | Starred Priority | |------------|------------------------------|---------------------------|---------------------------------------------------------| | IDENTIFY | | Asset Management (ID.AM) | | | PROTECT | | | Information Protection Processes and Procedures (PR.IP) | | DETECT | Anomalies and Events (DE.AE) | | | | RESPOND | | Response Planning (RS.RP) | | | RECOVER | | | Recovery Planning (RC.RP) | Table 11. Prioritized CSF Categories for Mission Objective-5: Safeguard the Environment.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: cybersecurity framework, csf, fips. General security reference material without sensitive content. Source: Cybersecurity Framework Profile for Liquefied Natural Gas.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control AT-1 in Building a Cybersecurity and Privacy Learning Program? (Part 87) Control AT-1: and privacy-related assets. It often consists of instructor-led and online courses, exercises, or other methods that inform learners of the acceptable uses of and risks to the organization's systems. Note: This is referred to as 'literacy' training in the SP 800-53r5 [11] Awareness and Training (AT) control family. Also see training . ## certification A designation earned to ensure qualifications to perform a job or task. Often issued by a professional organization, industry vendor, or employer to signify an achievement following a course of study. ## Chief Artificial Intelligence Officer A senior executive responsible for coordinating their agency's use of artificial intelligence (AI), promoting AI innovation in their agency, and managing risks from their agency's use of AI. ## Chief Data Officer A senior executive responsible for the utilization and governance of data across the agency or organization. ## Chief Financial Officer A senior member responsible for managing the financial actions of an agency or organization. ## Chief Learning Officer A senior-level executive who oversees all learning and employee development programs within an agency or organization. ## Chief Privacy Officer A senior official designated by the head of each agency to have agency-wide responsibilities for privacy, including the implementation of privacy protections; compliance with federal laws, regulations, and policies related to privacy; the management of privacy risks at the agency; and a central policy-making role in the agency's development and evaluation of legislative, regulatory, and other policy proposals. ## competency An individual's ability to complete a task or tasks within the context of a work role. From OPM: 'A competency is a measurable pattern of knowledge, skills, abilities, behaviors, and other characteristics that an individual needs to perform work roles or occupational functions successfully.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, control family, security control. General security reference material without sensitive content. Source: Building a Cybersecurity and Privacy Learning Program.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Smart Card Technology_ New Methods for Computer Access Control provide? (Section 52) , however, that the user may have to type at least two seven-digit numbers for each log-on procedure. NBS will continue researching improved computer security methods as new products become available. The prototype systems already implemented at NBS illustrate some access control techniques which are now technologically possible. What will be possible in terms of cost, efficiency, ease of use, and other practical issues, is yet to be determined. The smart card is still in a relatively early stage of development, and its technological, economic, and social impact has not yet been realized. As researchers continue to explore smart card integrated circuit technologies, financial and government organizations are initiating test trials and limited prototype systems in order to examine the practical applications of the smart card. In 1985, MasterCard International began a test project in which 70,000 customers in Maryland and Florida were issued smart cards. [GLZR 86, p. 34] The Agricultural Stabilization and Conservation Service of the U.S. Department of Agriculture has implemented a smart card program to enhance record-keeping for 56,000 American peanut farmers. [CASA2 87, p.34] Results of such projects have generally been positive; however, further study will be required before smart cards can be put into wider use in the U.S. The acceptability of smart cards to a diverse group of users and the costs associated with developing smart card systems are among the factors which still need to be considered. Smart cards have the potential for preventing tremendous financial losses due to weaknesses in current authentication and access control procedures. However, the initial costs of incorporating smart cards and their associated reader/writer devices into a security system is often an important concern. One source predicts that smart cards will undergo an immense growth in popularity and that manufacturers will "tap the economy of scale of mass production." [SVGL 85, p.

Explanation: NIST publication on credential and access management. Topics: access control, authentication, sso. Contains security framework guidance for authentication systems. Source: Smart Card Technology_ New Methods for Computer Access Control.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Automation Support for Security Control Assessments_ Volume 1_ Overview provide? (Section 100) volumes explain the specific purposes to be achieved by each sub-capability and the supporting controls as the sub-capabilities and supporting controls relate to the capability covered in that volume. The defect checks are designed to provide a valid measure of whether (and to what extent) the purpose of the sub-capability is being achieved. The measures described previously are of little value unless the data collected are both complete and timely. The data quality checks use letter prefix "Q" in their ID code. Completeness means the extent to which the security-related information includes assessment of all relevant defects on all assessment objects (within a defined scope such as a capability). Relevant defects are defects that produce significant risk, e.g., the top two orders of magnitude. Incomplete metrics tend to bias the results by underestimating total risk. Timeliness means the extent to which the security-related information has been refreshed within the last X hours or days (as determined/required by the organization. Data must be collected (and defects mitigated) faster than the attacker(s) can act, in order to be able to stay ahead of their ability to compromise a system. 23 If metrics for completeness and timeliness are not adequate, the assessment is not reliable because the results may be inaccurate.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control, assessment. General security reference material without sensitive content. Source: Automation Support for Security Control Assessments_ Volume 1_ Overview.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control EG-21 in Guidelines for Access Control System Evaluation Metrics? (Part 17) Control EG-21: authentication, entitlement, and attribute information | | Function | Authentication | | Provider/Specification | OASIS / OASIS Security Service(SAML) TC | | Format/Schema | XML | | SCA (Service Component Architecture) Policy Framework | SCA (Service Component Architecture) Policy Framework | | Description | Allows policies and policy subjects specified using WS-Policy, as well as with other policy languages to be associated with SCA components.

Explanation: NIST publication on credential and access management. Topics: access control, authentication, sso. Contains security framework guidance for authentication systems. Source: Guidelines for Access Control System Evaluation Metrics.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control HA-1 in Securing Web Transactions_ TLS Server Certificate Management? (Part 221) Control HA-1: eliminating time-intensive replacement procedures and human error. This facilitates industry best practices such as short-lived certificates (usually 90-day validity or less) and regular key rotation. An organization's CertCentral account can have as many users as needed, with each one having assigned preset or customizable roles. A user can be limited to what certificates they can request (by certificate type/identity), for which legal organizations/divisions they can make requests, and whether they can approve requests on their own or require an administrator/other approval. This gives users control to issue and manage their own certificates without affecting operations of other divisions within the organization. CertCentral supports two-factor authentication and single sign-on, which are potential requirements for specific roles or users. Further capabilities and settings of CertCentral are described in the DigiCert Getting Started guide. ## 4.3.9 Load Balancer The architecture includes a load balancer that acts as a reverse proxy. It receives client requests at its front end and evenly distributes these requests across a group of back-end TLS servers, which all use the same TLS server certificate and private key. ## 4.3.9.1 F5 Networks BIG-IP Local Traffic Manager Businesses depend on applications. Whether the applications help connect businesses to their customers or help employees do their jobs, making these applications available and secure is the main goal. F5 BIG -IP LTM helps enterprises deliver their applications to users in a reliable, secure, and optimized way. It provides the extensibility and flexibility of application services, with the programmability enterprises need to manage their physical, virtual, and cloud infrastructure. With BIG -IP LTM, enterprises can simplify, automate, and customize applications quickly and predictably.

Explanation: NIST publication on credential and access management. Topics: authentication, single sign-on. Contains security framework guidance for authentication systems. Source: Securing Web Transactions_ TLS Server Certificate Management.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Recommendation for Key Management, Part 3_ Application-Specific Key Management Guidance provide? (Section 32) ng private key. The issuer is known as a Certificate Authority (CA). In many cases, the CA will delegate responsibility for the verification of the subject's identity to a Registration Authority (RA). The certificate is used to distribute the user's public key to other interested parties, known as relying parties, since they rely on the assurances provided by the PKI and the certificate creation process. CAs generally issue a self-signed certificate called a root certificate (sometimes also called a trust anchor ); this is used by applications and protocols to validate the certificates issued by a CA. CA certificates play a key role in many protocols and applications, and are generally kept in what is often called a root certificate store . Much of the business of properly configuring applications and protocols consists of ensuring that only appropriate root certificates are loaded into the root certificate store. In Microsoft Windows operating systems, there are root certificate stores that are maintained by the operating system for various purposes that are shared by various Microsoft protocols and applications, and by other applications that may choose to use them. There is a similar 'Keychain' facility in the Apple operating systems. Some applications, intended to be portable between operating systems, can maintain their own root certificate stores and also have a feature that allows them to share a root certificate store with other applications. 6 6 The various Mozilla browsers and e-mail clients, and the Apache web servers are examples. Microsoft Internet Explorer, Outlook and Internet Information Server all use the Windows root certificate store; Apple Safari and Mail use the Keychain; and Mozilla Firefox, Thunderbird and SeaMonkey all have their own root certificate stores, and they also can share a root certificate store from Mozilla's Network Security Services (NSS) utility. Certificates are generally issued in accordance with a certificate policy .

Explanation: NIST publication on credential and access management. Topics: pki, certificate authority, key management. Contains security framework guidance for authentication systems. Source: Recommendation for Key Management, Part 3_ Application-Specific Key Management Guidance.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control CM-6 in Security and Privacy Controls for Information Systems and Organizations? (Part 1) Control CM-6: CONFIGURATION SETTINGS Control: a. Establish and document configuration settings for components employed within the system that reflect the most restrictive mode consistent with operational requirements using [Assignment: organization-defined common secure configurations]; b. c. Implement the configuration settings; Identify, document, and approve any deviations from established configuration settings for [Assignment: organization-defined system components] based on [Assignment: organization- defined operational requirements]; and d. Monitor and control changes to the configuration settings in accordance with organizational policies and procedures. Discussion: Configuration settings are the parameters that can be changed in the hardware, software, or firmware components of the system that affect the security and privacy posture or functionality of the system. Information technology products for which configuration settings can be defined include mainframe computers, servers, workstations, operating systems, mobile devices, input/output devices, protocols, and applications. Parameters that impact the security posture of systems include registry settings; account, file, or directory permission settings; and settings for functions, protocols, ports, services, and remote connections. Privacy parameters are parameters impacting the privacy posture of systems, including the parameters required to satisfy other privacy controls. Privacy parameters include settings for access controls, data processing preferences, and processing and retention permissions. Organizations establish organization-wide configuration settings and subsequently derive specific configuration settings for systems. The established settings become part of the configuration baseline for the system.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Security and Privacy Controls for Information Systems and Organizations.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain 1. Maintain Personnel Safety according to NIST Cybersecurity Framework Manufacturing Profile Low Impact Level Example Implementations Guide_ Volume 3 – Discrete-based Manufacturing System Use Case According to Cybersecurity Framework Manufacturing Profile Low Impact Level Example Implementations Guide_ Volume 3 – Discrete-based Manufacturing System Use Case, 1. Maintain Personnel Safety: - Safety Programmable Logic Controller (PLC) - The workcell has a safety-rated PLC to terminate operations when an emergency condition is detected. Industry standard emergency stop buttons and light curtains are used to protect operators from entering the work area while the workcell is active. Each station has the ability to send emergency stop commands to the safety PLC.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: cybersecurity framework, fips, security control. General security reference material without sensitive content. Source: Cybersecurity Framework Manufacturing Profile Low Impact Level Example Implementations Guide_ Volume 3 – Discrete-based Manufacturing System Use Case.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does The Technical Specification for the Security Content Automation Protocol (SCAP)_ SCAP Version 1.2 provide? (Section 32) accomplished irrespective of how references are made within a given component. The following is a stripped down example of the source data stream. The details are covered later in this specification. ``` <ds:data-stream-collection id="dsc1" schematron-version="1.0"> <ds:data-stream id="ds1" scap-version="1.2" use-case="CONFIGURATION"> <ds:dictionaries> <ds:component-ref id="ref1" xlink:href="#dict1"> <cat:catalog> <cat:uri name="dict-oval.xml" uri="#ref3"/> </cat:catalog> </ds:component-ref> </ds:dictionaries> <ds:checklists> <ds:component-ref id="ref2" xlink:href="#xccdf1"> <cat:catalog> <cat:uri name="sample-oval.xml" uri="#ref3"/> ``` ``` </cat:catalog> </ds:component-ref> </ds:checklists> <ds:checks> <ds:component-ref id="ref3" xlink:href="#oval1"/> </ds:checks> </ds:data-stream> <ds:component id="xccdf1"> <xccdf:Benchmark> <xccdf:Rule> <xccdf:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5"> <xccdf:check-content-ref href="sample-oval.xml" name="oval:gov.nist:def:1"/> </xccdf:check> </xccdf:Rule> </xccdf:Benchmark> </ds:component> <ds:component id="oval1"> <oval-def:oval_definitions>...</oval-def:oval_definitions> </ds:component> <ds:component id="dict1"> <cpe2-dict:cpe-list> <cpe2-dict:cpe-item name="cpe:/a:oracle:database_server:11.1.0.6.0::enterprise"> <cpe2-dict:check href="dict-oval.xml" system="http://oval.mitre.org/XMLSchema/oval-definitions-5> oval:gov.nist:def:2</cpe2-dict:check> <cpe2-dict-ext:cpe23-item name="cpe:2.3:a:oracle:database_server:11.1.0.6.0:-:-:-:enterprise:-:-:-"/> </cpe2-dict:cpe-item> </cpe2-dict:cpe-list> </ds:component> </ds:data-stream-collection> ``` The design of the SCAP source data stream is important for the following reasons: 1. Individual components may be developed outside of an SCAP data stream where the binding to other components is not necessarily known at the time the component is created. 2.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: The Technical Specification for the Security Content Automation Protocol (SCAP)_ SCAP Version 1.2.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Digital Identity Guidelines provide? (Section 62) marily supports attribute exchange. Users have access to classified or highly sensitive information or services that could result in a breach that would constitute a major incident under OMB guidance. 37 NIST SP 800-63-4 July 2025 Digital Identity Guidelines Initial Assurance Level Selection 3.3.3. Organizations SHALL develop and document a process and governance model for selecting initial assurance levels and controls based on the potential impacts of failures in the digital identity system. The following subsections provide guidance on the major elements to consider in the process for selecting initial assurance levels. The overall impact level for each user group is used as the basis for selecting the initial assurance level and related technical and process controls for the online service under assessment based on the impacts of failures within the digital identity functions. The initial assurance levels and controls can be further assessed and tailored in the next step of the DIRM process. Although the initial impact assessment (see Sec. 3.2) and the combined impact level determination for each user group (see Sec. 3.2.4) do not differentiate between identity proofing, authentication, and federation risks, the selected initial xALs may still be different. For example, the initial impact assessment may be low impact and indicate IAL1 and FAL1 but may also determine that personal information is accessible and therefore requires AAL2. Similarly, the impact assessment may determine that no proofing is required, resulting in no IAL regardless of the baselines for authentication and federation. Further changes may result from the tailoring process as discussed in Step 4: Tailoring. The output of this step is a set of initial xALs that are applicable to the online service for each user group. Selecting Initial IAL 3.3.3.1. Before selecting an initial assurance level, RPs must determine whether identity proofing is needed for the users of their online services.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: nist sp, fips, security control. General security reference material without sensitive content. Source: Digital Identity Guidelines.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Recommendation for Key Management_ Part 2 – Best Practices for Key Management Organizations say about 16. Key Management Appendix? (Part 1) According to Recommendation for Key Management_ Part 2 – Best Practices for Key Management Organizations, 16. Key Management Appendix: 16. Key Management Appendix - The Identification of the Keying Material Manager : The keying material manager should report directly to the organization's chief executive officer, chief operations executive, or chief information systems officer. The keying material manager is a critical employee who should have capabilities and trustworthiness commensurate with its responsibility for maintaining the authority and integrity of all formal electronic transactions and the confidentiality of all information that is sufficiently sensitive to warrant cryptographic protection. - The Identification of the Management Entity(ies) Responsible for Certification Authority (CA) and Registration Authority (RA) Functions and Interactions: Where public key cryptography is employed, either the keying material manager or his/her immediate superior should be designated as the organization's manager responsible for CA and RA functions. This section shall include references to any cloud computing or other shared services employed. - The Identification of the Management Entity (ies) Responsible for Symmetric Key Center Functions and Interactions: Where a symmetric key center is employed, either the keying material manager or his/her immediate superior should be designated as the organization's manager responsible key center functions. This section shall include references to any cloud computing or other shared services employed - Key Management Organization: The identification of job titles, roles, and/or individuals responsible for the following functions: - a. Key generation or acquisition; - b. Agreements with partner organizations regarding the cross-certification of any PKI keying material or sharing of keying material between symmetric key centers; - c. Key establishment and revocation structure design and management; - d. Establishment of cryptoperiods; - e.

Explanation: NIST publication on credential and access management. Topics: pki, key management. Contains security framework guidance for authentication systems. Source: Recommendation for Key Management_ Part 2 – Best Practices for Key Management Organizations.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Assessing Enhanced Security Requirements for Controlled Unclassified Information say about GLOSSARY? (Part 5) According to Assessing Enhanced Security Requirements for Controlled Unclassified Information, GLOSSARY: irector of the Information Security Oversight Office (ISOO). | | CUI program [32 CFR 2002] | The executive branch-wide program to standardize CUI handling by all federal agencies. The program includes the rules, organization, and procedures for CUI, established by Executive Order 13556, 32 CFR Part 2002, and the CUI Registry. | | CUI registry [32 CFR 2002] | The online repository for all information, guidance, policy, and requirements on handling CUI, including everything issued by the CUI Executive Agent other than 32 CFR Part 2002. Among other information, the CUI Registry identifies all approved CUI categories and subcategories, provides general descriptions for each, identifies the basis for controls, establishes markings, and includes guidance on handling procedures. | | cyber-physical system | Interacting digital, analog, physical, and human components engineered for function through integrated physics and logic. | \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ | cyber resiliency [SP 800-160-2] | The ability to anticipate, withstand, recover from, and adapt to adverse conditions, stresses, attacks, or compromises on systems that use or are enabled by cyber resources. Cyber resiliency is intended to enable mission or business objectives that depend on cyber resources to be achieved in a contested cyber environment.

Explanation: NIST publication discussing classified information handling. References: classified, controlled unclassified, cui. Contains guidance on protecting sensitive government information. Source: Assessing Enhanced Security Requirements for Controlled Unclassified Information.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Guidelines for Smart Grid Cybersecurity provide? (Section 750) ing toward utilizing IP-based transport protocols for energy utility information and operational services. As IP-based nodes propagate, more opportunities for exploitation by adversaries are evolving. If a network component can be probed and profiled as part of the smart grid or other critical infrastructures, it is most likely to be targeted for some form of intrusion by adversaries. This is especially relevant with the growing use of wireless IP communications. 8.6.6.2 DoS/DDoS Attacks Denial of Service and Distributed Denial of Service (DoS/DDoS) attacks have become an effective tool to take advantage of vulnerabilities. The attack objective is to take actions that deprive authorized individuals access to a system, its resources, information stored thereon, or the network to which it is connected. A simple DoS attack attempts to consume resources in a specific application, operating system, or specific protocols or services, or a particular vendor’s implementation of any of these targets to deny access by legitimate users. It may also be used in conjunction with other actions (attacks) to gain unauthorized access to a system, resources, information, or network. The DDoS attack seeks to deplete resource capacity, such as bandwidth or processing power, in order to deny access to authorized users and can be levied against the infrastructure layer or the application layer. This technique utilizes a network of attack agents to amass a large, simultaneous assault of messages on the target. As with the DoS attack, DDoS may be combined with other techniques for malicious purposes. IP-based networks are vulnerable to other attacks due to deficiencies of underlying protocols and applications. A man-in-the-middle, session-based hijack, or other technique may accompany the DoS/DDoS attack to inflict further damage on the target.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Guidelines for Smart Grid Cybersecurity.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Approaches to Privacy and Security in Computer Systems_ Proceedings of a Conference Held at the National Bureau of Standards March 4-5, 1974 say about Is Network Security Possible?? (Part 2) According to Approaches to Privacy and Security in Computer Systems_ Proceedings of a Conference Held at the National Bureau of Standards March 4-5, 1974, Is Network Security Possible?: em. This places a heavy burden on the overall security mechanisms to control the spread of information, or its misrouting to the wrong user. 4. The complexity vulnerability has already been mentioned. The more extensive the network, the greater the probability of system error and vulnerability to rational intrusion. 5. Another problem also refers to size and scope. It is virtually impossible to verify that any large software system is completely free of errors and anomalies. Also, the state of design is such that frequent changes to the system can be expected. Errors, compounded by frequent changes, can cause frightful security problems when multiplied over a large network, in which there are multitudes of large systems, all interconnected and reliant on another large system (the interfacing processors and communications protocol) to tie them all together. The obvious question is that with so much going against it, is there really any hope for adequate protection in such systems? As we shall explore, there is some hope not only in the future, but even now, with today's systems. Much of the hope depends on what the user or owner can do on his own. The first step toward achieving any kind of security in a resource shared system is to apply those principles of protection that would be normally put in a local, batch, stand-alone system. If the basic principles of physical and administrative security, as well as adequate audit trails and backup are followed, then the necessary groundwork will have been laid for implementation of protection throughout the network. It is imperative, however, that each location submit to the rudimentary standards of security. Such standards must be a top management concern, because nothing will defeat a security program faster than to have an independent and recalcitrant appendage off in the boondocks thumbing his nose at all the controls floating down from above.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Approaches to Privacy and Security in Computer Systems_ Proceedings of a Conference Held at the National Bureau of Standards March 4-5, 1974.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Building a Cybersecurity and Privacy Learning Program say about competency? According to Building a Cybersecurity and Privacy Learning Program, competency: An individual's ability to complete a task or tasks within the context of a work role. From OPM: 'A competency is a measurable pattern of knowledge, skills, abilities, behaviors, and other characteristics that an individual needs to perform work roles or occupational functions successfully. Competencies specify the 'how' of performing job tasks, or what the person needs to do the job successfully.' [18]

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Building a Cybersecurity and Privacy Learning Program.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain 4.1 Specification of Key-Derivation Functions according to NIST Recommendation for Key-Derivation Methods in Key-Establishment Schemes According to Recommendation for Key-Derivation Methods in Key-Establishment Schemes, 4.1 Specification of Key-Derivation Functions: A family of one-step key-derivation functions is specified as follows: ). Function call: KDM( Z , OtherInput

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Recommendation for Key-Derivation Methods in Key-Establishment Schemes.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Contingency Planning Guide for Federal Information Systems provide? (Section 95) nate site and with the backup media. Storing a copy of the plan at the alternate site ensures its availability and good condition in the event local plan copies cannot be accessed because of disaster. The ISCP Coordinator should maintain a record of copies of the plan and to whom they were distributed. Other information that should be stored with the plan includes contracts with vendors (SLAs and other contracts), software licenses, system user manuals, security manuals, and operating procedures. Changes made to the plan, strategies, and policies should be coordinated through the ISCP Coordinator, who should communicate changes to the representatives of associated plans or programs, as necessary. The ISCP Coordinator should record plan modifications using a record of changes, which lists the page number, change comment, and date of change. The record of changes, depicted in Table , should be integrated into the plan as discussed in Section 4.1. Table 3-7: Sample Record of Changes | Record of Changes | Record of Changes | Record of Changes | Record of Changes | |---------------------|---------------------|---------------------|---------------------| | Page # | Change Comment | Date of Change | Signature | The ISCP Coordinator should coordinate frequently with associated internal and external organizations and system POCs to ensure that impacts caused by changes within any organization will be reflected in the contingency plan. Strict version control must be maintained by requesting old plans or plan pages to be returned to the ISCP Coordinator in exchange for the new plan or plan pages. The ISCP Coordinator also should evaluate supporting information to ensure that the information is current and continues to meet system requirements adequately.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Contingency Planning Guide for Federal Information Systems.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does A Study of Federal Agency Needs for Information Technology Security provide? (Section 92) nal wording of the candidate need and a rewording that might have avoided some possible confusion: Original version as it appeared in the agency security needs study: "[PR], [S] satisfying national ! international criteria" (Further Description: "Products and systems satisfying national / international criteria for protection of data and systems and that address integrity and availability in addition to confidentiality'') "[PR], [S], [TA] for trusted technology that consider a wider range of functionality appropriate for unclassified, sensitive systems than now covered in NSA's TCSEC ("Orange Book"), and which satisfy national ! international "criteria" (Further Description: "Products, standards, and technical assistance for trusted technology that consider a wider range of functionality appropriate for unclassified, sensitive systems than now covered in NSA's Trusted Computer Systems Evaluation Criteria, "Orange Book," (Le., for protections of data and systems that more directly address integrity and availability in addition to confidentiality), and which satisfy national ! international "criteria." International computer security criteria is used to develop trusted IT products that can be used to help protect important information of the government, whether it is sensitive or classified. This type of criteria helps to broaden the market for these products making them more available to potential buyers. International criteria also increases the number of COTS products available for various computer security needs. ") The study team found lack of awareness of available help and resources to be a major Issue. It is an area that represents lost or untapped potential for federal agencies. While clearly there are not existing answers to many of the needs expressed, the study team came across many situations in which those interviewed were not aware of existing solutions, products, and answers.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: A Study of Federal Agency Needs for Information Technology Security.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control HA-224 in Recommendation for Key Management, Part 3_ Application-Specific Key Management Guidance? (Part 74) Control HA-224: s, remote execution of commands, forwarded TCP/IP connections, and forwarded X11 connections [X11] can be run simultaneously over an established SSH Transport Layer and User Authentication connection. ## 10.2 Security and Compliance Issues ## 10.2.1 TLP Issues ## 10.2.1.1 Algorithm Negotiation In this step of the TLP, the algorithms to be used for the key exchange (i.e., key agreement), public key authentication, data encryption and message authentication are selected. 1. The SSH server and client should choose the same NIST-approved cryptographic algorithms for both communication directions (data streams) for a particular cryptographic service. For example, the same encryption algorithm and MACgeneration algorithm should be used for both communication directions to provide confidentiality and integrity protection, respectively. Note: The cryptographic algorithms selected for use depend on the algorithms that are supported by both the server and the client, and by the client's preference levels for these algorithms in each of its algorithm lists offered in the negotiation; the client's preference level is indicated by the order in which the algorithms are listed. See [RFC 4253, Sec. 7.1] for the defined procedure for selecting the cryptographic algorithms. 2. Suite B cryptographic algorithms are recommended for use when supported by both the client and server systems. Suite B cryptographic algorithms are specified in [RFC 6239]. They are: 2.  Key agreement (key exchange): ecdh-sha2-nistp256 and ecdh-sha2-nistp384 (see Section 10.2.1.2). 3.  Public key algorithm (for server and client authentications): x509v3-ecdsasha2-nistp256 and x509v3-ecdsa-sha2-nistp384 (see Section 10.2.1.3). The public keys are conveyed in X.509 version 3 certificates. 4.  Encryption and MAC: AEAD\_AES\_128\_GCM and AEAD\_AES\_256\_GCM (see Sections 10.2.1.4 and 10.2.1.5).

Explanation: NIST publication on credential and access management. Topics: authentication, key management. Contains security framework guidance for authentication systems. Source: Recommendation for Key Management, Part 3_ Application-Specific Key Management Guidance.