You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Usability and Security Considerations for Public Safety Mobile Authentication provide? (Section 19) ne ..............................................34 | | 6.2 Future Directions........................................................................................... | | 34 | | Appendix A-Acronyms............................................................................................36 Appendix B-References ..........................................................................................38 | | List of Tables | In the United States over 10 000 jurisdictions employ public safety personnel to respond to emergency situations every day. These first responders treat life-threatening injuries, deal with the consequences of natural disasters, fight crime, and combat terrorism. To perform these duties, emergency responders must undergo unique training, utilize specialized equipment, and access a variety of information systems. The use of specialized tools, information systems, and protective equipment places first responders within a unique environment to perform their jobs. Identifying methods to facilitate first responders' operations within their specialized environments can shorten response times and allow emergencies to be more effectively managed, hopefully saving more lives in the process. Surely, firefighters must be protected from heat, emergency medical technicians (EMTs) from blood borne pathogens, and law enforcement officers (LEOs) from projectiles - but what other factors exist?

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Usability and Security Considerations for Public Safety Mobile Authentication.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain Efforts to Standardize Personal Data according to NIST Approaches to Privacy and Security in Computer Systems_ Proceedings of a Conference Held at the National Bureau of Standards March 4-5, 1974 According to Approaches to Privacy and Security in Computer Systems_ Proceedings of a Conference Held at the National Bureau of Standards March 4-5, 1974, Efforts to Standardize Personal Data: There are government agencies urging the standardization of codes for personal identification, location, time, personal characteristics, and medical and physical status descriptors. It is obvious that universally applied codes in these areas would aid in the accumulation and interchange of meaningful personal data, and would reduce the cost of building a data bank. However, the key code necessary to concentrate personal data from several sources is some universally accepted system of linking this coded data to an individual. The pragmatic computer systems designer will specify Social Security number as this identifier unless the public is aware of the dangers of the universal use of the number as a key to personal and private data. It must be apparent that the computer systems designer in industry is only following the lead of the computer systems designer in most government agencies where Social Security number has really become Federal Identification Number. ADAPSO recommends that government and industry efforts to standardize the encoding of personal data descriptors for the purpose of information interchange include the question of personal data ownership.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Approaches to Privacy and Security in Computer Systems_ Proceedings of a Conference Held at the National Bureau of Standards March 4-5, 1974.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Security Assurance Requirements for Linux Application Container Deployments say about 6 Assurance Requirements for Image Integrity Solutions? (Part 1) According to Security Assurance Requirements for Linux Application Container Deployments, 6 Assurance Requirements for Image Integrity Solutions: 6 Assurance Requirements for Image Integrity Solutions The integrity of the container images is of paramount importance since they are converted to running instances, some of which may host mission-critical applications. The image countermeasures covered in the Container Security Guide include recommendations for monitoring images for malware and other vulnerabilities, proper image configuration, separating secrets from image files, and ensuring trust in images through cryptographic signatures and regular updates. The security solutions needed for carrying out these recommendations should include the following assurance requirements: - (a) There should exist a means to create metadata linking each image to its base image. - (b) There should exist a feature to rebuild the image automatically if the linked base image changes [6]. - (c) When any changes are made to the base image or dependent image (e.g., patching a vulnerability), changes should not be made to the running containers. Instead, the corresponding image should be recreated and the container re-launched using the modified image. Thus, a single master, or golden image, is to be maintained for any service. - (d) When employing 'image signing' solutions for digitally signing and uniquely identifying each image, the following requirements should be met [6]: 1. There should be robust key management to minimize the possibility of key compromise. One approach is to have a PKI system that issues a certificate to each developer exclusively for signing the image. The private key associated with this certificate will then be the 'signing key' that is used to sign all container images in a repository. 2. Replay attacks must be mitigated by embedding expiration timestamps in signed container images. Alternatively, a special key can be used to sign the metadata for the repository, ensuring that the images in the repository do not contain stale versions of the image with valid signatures.

Explanation: NIST cybersecurity publication covering vulnerability management. Topics: vulnerability, malware. Contains technical security guidance that could inform defensive posture. Source: Security Assurance Requirements for Linux Application Container Deployments.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control PD-5 in Satellite Ground Segment_ Applying the Cybersecurity Framework to Satellite Command and Control? (Part 115) Control PD-5: reporting, and notification are identified and performance criteria are defined. PCCs responsible for hosted payloads should have an agreement on these roles and responsibilities with the host's MOC. | [NIST-SP800-53r5] CA-2, CA-7, PM-14 | | DE.DP-2 : Detection activities comply with all applicable requirements | Organizations should confirm that their detection activities comply with applicable requirements. Organizations with MOCs responsible for hosting third- party payloads should perform detection activities in accordance with pre-defined agreements for hosted payloads.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: cybersecurity framework, fips, security control. General security reference material without sensitive content. Source: Satellite Ground Segment_ Applying the Cybersecurity Framework to Satellite Command and Control.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control TE-1 in Mobile Device Security_ Bring Your Own Device (BYOD)? (Part 82) Control TE-1: | AC-17(2): Protection of Confidentiality and Integrity Using Encryption SC-8: Transmission Confidentiality and Integrity | A.8.2.3: Handling of Assets A.13.1.1: Network Controls A.13.2.1: Information Transfer Policies and Procedures A.13.2.3: Electronic Messaging A.14.1.2: Securing Application Services on Public Networks A.14.1.3: Protecting Application Services Transactions | CSC 13: Data Protection CSC 14: Controlled Access Based on the Need to Know | OV-SPP-002: Cyber Policy and Strategy Planner OV-MGT-002: Communications Security (COMSEC) Manager OV-LGA-002: Privacy Officer/Privacy Compliance Manager | | Specific product used | Function | Applicable NIST Cybersecurity Framework Subcategories | Applicable NIST SP 800-53 Revision 5 Controls | ISO/IEC 27001:2013 | CIS 6 | Applicable NIST SP 800-181 NICE Framework Work Roles (2017) | |-------------------------|------------|-------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------| | | | PR.PT-4: Communications and control networks are protected.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: nist sp, cybersecurity framework, fips. General security reference material without sensitive content. Source: Mobile Device Security_ Bring Your Own Device (BYOD).


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control PE-6 in Identity and Access Management for Electric Utilities? (Part 251) Control PE-6: ing the ConneXium Tofino Configurator, right-click Tofino SAs in the Project Explorer pane, and then select Apply. If the project asks you to save, click OK. . 6 0 2 8 / N I S T . S P 1 8 0 0 - 2 . . NIST SP 1800-2C: Identity and Access Management for Electric Utilities 293 Figure 16-17 Apply Configuration Pane T h i s p u b l i c a t i o n i s a v a i l l a b e f r e e o f c h a r g e f r o m : h t t p : / / d o i . o r g / 1 0 . 6 0 2 8 / N I S T . S P 1 8 0 0 - 2 . In the Apply Configuration pane (Figure 16-17), ensure that your SA is selected in the table at the top, and that the USB Drive radio button is selected. Browse to the top-level directory of your USB drive, and then click Finish. A popup window (Figure 16-18) will notify you of successful completion. Figure 16-18 Loadable USB Drive Popup . NIST SP 1800-2C: Identity and Access Management for Electric Utilities 294 T h i s p u b l i c a t i o n i s a v a i l l a b e f r e e o f c h a r g e f r o m : h t t p : / / d o i . o r g / 1 0 . 6 0 2 8 / N I S T . S P 1 8 0 0 - 2 . . Ensure that the firewall has been powered on and has been running for at least one minute, and then plug the USB device that was used to copy the Tofino configuration into the USB port on the back of the firewall. Press the Save/Load/Reset button twice, setting it to the Load setting (Pressing it once should turn the indicator light to green; pressing it again will change the indicator light from green to amber). After a few seconds, the device will begin displaying lights that move from right to left across the light-emitting diodes (LEDs) on the back, indicating that the configuration is being loaded. Once the lights stop moving from right to left, wait a few seconds, and ensure that the Fault LED does not light up. Remove the USB drive, and place it back into the computer running the ConneXium Tofino Configurator software. Right-click Tofino SAs in the Project Explorer pane, and then select Verify.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: nist sp, fips, security control. General security reference material without sensitive content. Source: Identity and Access Management for Electric Utilities.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Design Alternatives for Computer Network Security say about 3.2.2 Organization of the Table? (Part 4) According to Design Alternatives for Computer Network Security, 3.2.2 Organization of the Table: es not affect its usage. j ; i A flexible organization which meets all of the known requirements for the SC's access control function has been defined by Kaufman (KAU-74) , and is summarized below. This approach has particular merit in that it can efficiently handle both the simple initial usage and more complex future usage in an open-ended manner The basic profile of a requestor (sxibject) would be stored in a block of information which would also include access authorization in terms of (object, capability) pairs. Considerable factoring, and hence compaction, is possible as indicated in Figure 3-2. Item "a" in the figure shows an entry which is a direct (object-capability) pair, which might simply represent access to a particular HOST machine. In contrast, the second entry in the access authorization table is a pointer to "b" which is an arbitrary capability list for an object which, in this example, is owned by this siabject. The third entry is also a pointer, but in this case to an access group. Another subject is also shown to be a member of this group. The fourth item is another direct representation, and the fifth is a pointer to "d"; an access group in which a further level of factoring has been applied, i.e., with several objects sharing the same capability list. The example situation depicted in the figure is intended to illustrate the open-endedness of the approach, rather than suggesting that compaction by means of the various factoring schemes is necessary. We shall discuss the aspects in which factoring both helps and complicates matters in siibsequent sections of this report. A rather subtle issue that must be considered in the design of the SC is whether the access table should be structured by subject or by object, i.e., the factoring could be either: <subject> (set of <object>, <capability> pairs) <object> (set of <subject>, <capability> pairs). or Figure 3-2.

Explanation: NIST publication on credential and access management. Topics: access control, authorization. Contains security framework guidance for authentication systems. Source: Design Alternatives for Computer Network Security.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Security Content Automation Protocol (SCAP) Version 1.3 Validation Program Test Requirements say about 1.4 Superseded Validation Programs? According to Security Content Automation Protocol (SCAP) Version 1.3 Validation Program Test Requirements, 1.4 Superseded Validation Programs: This publication supersedes the Security Content Automation Protocol (SCAP) Version 1.2 Validation Program Test Requirements revision 4. The previous revisions of the program for SCAP 1.0 and 1.1 have been also deprecated. 6 For a complete list of mappings, please refer to [NIST SP 800-126 R3].

Explanation: NIST cybersecurity documentation and standards guidance. Topics: nist sp, fips, security control. General security reference material without sensitive content. Source: Security Content Automation Protocol (SCAP) Version 1.3 Validation Program Test Requirements.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Guide to Intrusion Detection and Prevention Systems (IDPS) say about 2.1 Uses of IDPS Technologies? (Part 1) According to Guide to Intrusion Detection and Prevention Systems (IDPS), 2.1 Uses of IDPS Technologies: 2.1 Uses of IDPS Technologies IDPSs are primarily focused on identifying possible incidents. For example, an IDPS could detect when an attacker has successfully compromised a system by exploiting a vulnerability in the system. The IDPS could then report the incident to security administrators, who could quickly initiate incident response actions to minimize the damage caused by the incident. 3 The IDPS could also log information that could be used by the incident handlers. 4 Many IDPSs can also be configured to recognize violations of security policies. For example, some IDPSs can be configured with firewall ruleset-like settings, allowing them to identify network traffic that violates the organization's security or acceptable use policies. Also, some IDPSs can monitor file transfers and identify ones that might be suspicious, such as copying a large database onto a user's laptop. Many IDPSs can also identify reconnaissance activity, which may indicate that an attack is imminent. For example, some attack tools and forms of malware, particularly worms, perform reconnaissance activities such as host and port scans to identify targets for subsequent attacks. An IDPS might be able to block reconnaissance and notify security administrators, who can take actions if needed to alter other security controls to prevent related incidents. Because reconnaissance activity is so frequent on the Internet, reconnaissance detection is often performed primarily on protected internal networks. 2 This term is used for the purposes of this publication. It has not been widely used in the security community, and the reason for using it in this publication is strictly brevity, not to replace the well-established 'IDS' and 'IPS' terms. 3 If the IDPS had successfully prevented the attack, security administrators still might want to be notified of the attack. This is particularly important if the target has a known vulnerability that the attack could have exploited.

Explanation: NIST cybersecurity publication covering vulnerability management. Topics: vulnerability, exploit, malware. Contains technical security guidance that could inform defensive posture. Source: Guide to Intrusion Detection and Prevention Systems (IDPS).


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Guidelines on Electronic Mail Security say about 6.7 Checklist for Securing Mail Servers and Content? (Part 5) According to Guidelines on Electronic Mail Security, 6.7 Checklist for Securing Mail Servers and Content: to strip suspicious active content from messages | | | Configure lexical analysis if required | | | Take steps to prevent address spoofing, such as blocking emails from external locations using internal 'From' addresses | | | Create a security policy that addresses content filtering | | | Have the security policy reviewed by appropriate legal, privacy, and human resources authorities | | | Add a legal disclaimer to emails, if required | | | Educate users on the dangers of malware and how to minimize those dangers | | | Notify users when an outbreak occurs | | | Block spam-sending servers | | | Configure mail gateways or firewalls to use LDAP lookup to confirm the existence of email recipients | | | Configure mail server to block email from open relay blacklists or DNS blacklists, if required | | | Configure mail server to block email from specific domains, if required | | | Use authenticated mail relay | | | Configure authenticated mail relay on the server | | | Secure access to the mail server | | | Configure mail server to use encrypted authentication | | | Enable Web access to email |

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Guidelines on Electronic Mail Security.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Identifying and Categorizing Data Types for Public Safety Mobile Applications_ Workshop Report provide? (Section 23) lete loss of an organization's ability to carry out its mission, severe financial loss, and/or catastrophic harm to individuals involving loss of life or serious life threatening injuries. NIST FIPS 199 provides a compact representation for an information type's security categorization [7]: ``` Security Category (SC) information type = {( confidentiality , impact ), ( integrity , impact ), ( availability , impact )} ``` Finally, NIST FIPS 199 describes applying a security categorization to an information system. U.S. law defines an information system as 'a discrete set of information resources organized for the collection, processing, maintenance, use, sharing, or disposition of information' [8]. By this definition, a public safety mobile device is an information system. Applying a security categorization to an information system entails identifying the impact level for each of the cybersecurity objectives-confidentiality, integrity, and availability-for the information system. To do this, an organization must first identify each of the information type categorizations associated with that system. The highest impact level for each security objective becomes the impact level for that objective for the information system.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Identifying and Categorizing Data Types for Public Safety Mobile Applications_ Workshop Report.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Considerations for Identity Management in Public Safety Mobile Networks provide? (Section 54) without the need for external hardware. Like removable hardware security modules, they typically have the ability to securely store cryptographic keys and perform cryptographic operations in hardware. This approach potentially provides unique security features not supported by other approaches, as small, trusted hardware is often presumed to provide a greater level of assurance in their operation. Many modern mobile devices provide some form of embedded hardware token but mobile operating system vendors and hardware manufacturers often restrict access by third-party developers. Therefore, specific approaches will depend on whatever hardware, firmware, and software support is ultimately provided by these parties. Remote device authentication will be the method of authentication mobile devices use to gain access to the NPSBN. Software and hardware tokens can be leveraged for remote device authentication and used in a manner similar to remote user authentication. After provisioning, these devices could then prove its identity to a verifier by proving knowledge of a credential. This approach may require the establishment and management of a public key infrastructure (PKI) and for this, the existing Federal PKI could be leveraged. A greater level of assurance would be achieved if credentials were stored in hardware protected storage locations. A major difference would be the lack of user interaction in providing a password or PIN to unlock a credential for use. It is possible that during an emergency, the NPSBN will not function as intended, possibly due to the NPSBN directly being attacked (e.g., jamming) or some other reason (e.g., flood, terrorist attack). In the instance of the network ceasing to function, devices may still be able to operate by communicating via the cellular tower, without the use of the core network.

Explanation: NIST publication on credential and access management. Topics: authentication, identity management, pki. Contains security framework guidance for authentication systems. Source: Considerations for Identity Management in Public Safety Mobile Networks.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Dramatically Reducing Software Vulnerabilities_ Report to the White House Office of Science and Technology Policy provide? (Section 26) es. Industry requires evidence of the extent of such vulnerabilities, in addition to knowledge in determining which techniques are most effective in developing software with far fewer vulnerabilities. With effective measures that can function as market signals, industry can favor and select low vulnerability software, thus encouraging development of better software [Grigg08]. Additionally, and more critically, industry requires guidance in identifying the best places in code to deploy mitigations or other actions. This evidence comes from measuring, in the broadest sense, or assessing the properties of software. In order to produce the list of approaches, the Office of Science and Technology Policy (OSTP) asked NIST to lead a community-based effort. The report was developed during an eight-month period. Given the compressed time frame, the focus of the report was kept to the criteria described above to highlight promising approaches rather than perform a comprehensive analysis. NIST consulted with multiple experts in the software assurance community including: - Two OSTP-hosted inter-agency roundtables; - Half-day session at the Software and Supply Chain Assurance (SSCA) Summer Forum; - All-day workshop on Software Measures and Metrics to Reduce Security Vulnerabilities; - Two-day workshop on Reducing Software Defects and Vulnerabilities, hosted by the Software Productivity, Sustainability, and Quality (SPSQ) Working Group of the Networking and Information Technology Research and Development (NITRD) Program and - Public comment from 4 to 18 October 2016. The report is organized into two major sections. The first, Section 2, enumerates technical approaches and the second, Section 3, addresses measures. Section 2 has subsections for technical approaches to deal with vulnerabilities in software. These include formal methods, such as sound static program analyses, model checkers and Boolean Satisfiability (SAT) solvers.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Dramatically Reducing Software Vulnerabilities_ Report to the White House Office of Science and Technology Policy.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Automation Support for Security Control Assessments_ Software Asset Management provide? (Section 8) Control Items Affecting Desired and/or Actual State from All Defect Checks in this Volume................................................................................................................G-1 | | Figure 1:SWAM Impact on an Attack Step Model ........................................................................7 | | |------------------------------------------------------------------------------------------------------------------------------------|----------------| | Figure 2: Definition and Discussion of Software File for SWAM................................................10 | | | Figure 3: Definition and Discussion of Software Products for SWAM........................................10 | | | Figure 4: SWAMConcept of Operations (CONOPS)...................................................................16 | | | Figure 5: Primary Roles in Automated Assessment of SWAM....................................................22 | | | Figure 6: Main Steps in Adapting the Plan Template....................................................................24 | | | Figure 7: Sub-Steps to Select Defect Checks to Automate............................................................24 | | | Figure 8: Sub-Steps to Adapt Roles to the Organization...............................................................25 | | | Figure 9: Sub-Steps to Automate Selected Defect Checks............................................................26 | | | List of Tables | List of Tables | | Table 1:SWAM Impact on an Attack Step Model..........................................................................8 | | | Table 2: Traceability among Requirement Levels...........................................................................9 | | | Table 3: Example SWAMActual State Data Requirements .........................................................14 | | | Table 4: Example SWAMDesired State Data Requirements .......................................................15 | | | Table 5: Operational and Managerial Roles for SWAM...............................................................20 | | | Table 6: Mapping of Attack Steps to Security Sub-Capability......................................................74 | | | Table 7: Applicability

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control, assessment. General security reference material without sensitive content. Source: Automation Support for Security Control Assessments_ Software Asset Management.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control AM-1 in Securing Property Management Systems? (Part 59) Control AM-1: stered guests or sponsors should not be able to access or view sensitive customer data. | | actual results | ACL manages view of permissions of the logged-in users. Users could only view data they were authorized to view within the Solidres PMS. | | disposition | pass | ## 7.1.5 Test Case PMS-04 (Guest Reservation Editable) Table 7-8 contains test case requirements, associated test case, and descriptions of the test scenario for entering a reservation and editing the reservation. Table 7-8 Guest Reservation Editable | Test Case Field | Description | |----------------------------------------------------|---------------------------------------------------------------------------------------------------------------| | requirement tested | (CR 1) creating a guest reservation and having the ability of only an authorized user to edit the reservation | | description | Enter a guest reservation into the PMS. Verify that it is in the PMS and that it is retrievable and editable.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Securing Property Management Systems.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain 1.2.3 General Infrastructure Requirements according to NIST Mobile Application Single Sign-On_ Improving Authentication for Public Safety First Responders According to Mobile Application Single Sign-On_ Improving Authentication for Public Safety First Responders, 1.2.3 General Infrastructure Requirements: Some general infrastructure elements must be in place to support the components of this build guide. These are assumed to exist in the environment prior to the installation of the architecture components in this guide. The details of how these services are implemented are not directly relevant to the build. -  DNS-All server names are expected to be resolvable in DNS. This is especially important for FIDO functionality, as the application identification (App ID) associated with cryptographic keys is derived from the host name used in application uniform resource locators (URLs). -  Network Time Protocol (NTP)-Time synchronization among servers is important. A clock difference of five minutes or more is sufficient to cause JavaScript Object Notation (JSON) Web Token (JWT) validation to fail, for example. All servers should be configured to synchronize time with a reliable NTP source. -  Certificate Authority (CA)-Hypertext Transfer Protocol Secure (HTTPS) connections should be used throughout the architecture. Transport Layer Security (TLS) certificates are required for all servers in the build. If an in-house CA is used to issue certificates, the root and any intermediate certificates must be provisioned to the trust stores in client mobile devices and servers.

Explanation: NIST publication on credential and access management. Topics: authentication, certificate authority, token. Contains security framework guidance for authentication systems. Source: Mobile Application Single Sign-On_ Improving Authentication for Public Safety First Responders.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Derived Personal Identity Verification (PIV) Credentials (DPC) Proof of Concept Research provide? (Section 77) The EvoSTS returns an OWA access token to the user's browser and it is presented to the Office 365 OWA endpoint. The user is now authenticated into his or her Office 365 mailbox as shown in Figure 59. Figure 59: Office 365 Mailbox Outlook Web Access <!-- image --> The user can now use his or her Derived PIV End Entity Signature Certificate for S/MIME digital signature as shown in Figures 60 through 63. OWA S/MIME 38 requires the use of Internet Explorer 9 or higher, installation of the owasmime.msi ActiveX control available from outlook.office365.com, and the Derived PIV End Entity Signature Certificate described in Section 4.8.2 of this report. 38 Figure 60: OWA S/MIME <!-- image --> Figure 61: OWA S/MIME Digital Signature <!-- image --> Figure 62: Digitally Signed Message <!-- image --> The recipient validates the signed message as shown in Figure 63. Figure 63: Validated Digitally Signed Message <!-- image --> Modern authentication 39 is Microsoft's implementation of the SAML 2.0 and OAuth 2.0 protocols for rich applications (non-browser-based) using the Microsoft Azure Active Directory Authentication Library (ADAL). ADAL is available on different platforms and allows client application developers to authenticate users to both on-premises AD and cloud-based resources. 40 ADAL is provided as an open source implementation. 41 The OAuth-based authentication stack used by new Office applications includes cross-platform support (e.g., iOS, Mac OS X, Android, Windows). The March 2015 update to Office 2013 includes productionready ADAL functionality. With this update, Outlook 2013 can perform X.509 authentication to its Office 365 mailbox. At the time of this report, the associated Office 365 Exchange tenant must be enabled 42 for modern authentication, and the Outlook client must be configured to use modern authentication protocols.

Explanation: NIST publication on credential and access management. Topics: authentication, token, sso. Contains security framework guidance for authentication systems. Source: Derived Personal Identity Verification (PIV) Credentials (DPC) Proof of Concept Research.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is Discussion according to Security and Privacy Controls for Information Systems and Organizations? Discussion: Before permitting the use of shared or group accounts, organizations consider

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Security and Privacy Controls for Information Systems and Organizations.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain 3.3.1 Office 365 Exchange according to NIST Domain Name System-Based Electronic Mail Security According to Domain Name System-Based Electronic Mail Security, 3.3.1 Office 365 Exchange: Server-to-server encryption (Scenario 1) is available on Exchange for Office 365. Office 365 encrypts users' data while it's on Microsoft servers and while it's being transmitted between the user and Microsoft. Office 365 provides controls for end users and administrators to fine tune what kind of encryption is desired to protect files and email communications. Some technical library links for specific topics are as follows: -  Information on encryption using Office 365 Exchange can be found at https://technet.microsoft.com/en-us/library/dn569286.aspx. -  Information regarding the different types of email encryption options in Office 365 including Office Message Encryption (OME), S/MIME, Information Rights Management (IRM) can be found at https://technet.microsoft.com/en-us/library/dn948533.aspx. -  Information regarding definition of rules regarding email message encryption and decryption can be found at https://technet.microsoft.com/en-us/library/dn569289.aspx. -  Information regarding sending, viewing, and replying to encrypted messages can be found at https://technet.microsoft.com/en-us/library/dn569287.aspx. -  Service information for message encryption can be found at https://technet.microsoft.com/enus/library/dn569286.aspx.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Domain Name System-Based Electronic Mail Security.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Case Studies in Cyber Supply Chain Risk Management_ Summary of Findings and Recommendations provide? (Section 19) are utilized to prioritize supplier risks. <!-- image --> 6. Industry standards and best practices, such as ISO/IEC 20001 and SOC 2 compliance reports, are used to evaluate supplier cyber risks. 7. NIST CSF assessments are used by the acquirers and suppliers to determine the maturity of C-SCRM practices. 8. Risks of tariffs and data regionalization are evaluated to manage supply chains that span across multiple countries. Most organizations communicate with suppliers on a regular basis via traditional enterprise communication methods, including email, phone, communications platforms (e.g., Skype, Zoom, etc.), and supplier portals (e.g., iSupplier). Organizations also survey their critical suppliers annually to ensure people, data, and policies are maintained and up to date relative to supporting the contracts. These surveys include a variety of cybersecurity practices, such as supplier personnel receiving security training, physical security measures, use of security cameras and adequacy of camera recording storage, IT and network security measures, security organizational data on external networks, and assessment of applicable compliance levels. <!-- image --> Oversight of supplier C-SCRM practices is an important subject to every organization that was interviewed. Topics such as how to best monitor vendor quality against SLAs, company policies, and industry standards primarily drove the conversation. Additionally, organizations were focused on improving their vendors' security practices. 1. Prominence of industry standards and frameworks: Whether organizations looked to international, national, or industry-specific publications, all utilize multiple frameworks to evaluate the quality of their internal and vendor-specific C-SCRM practices. Organizations also frequently supplement these frameworks with legal or certification-based requirements. 2.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: csf, fips, security control. General security reference material without sensitive content. Source: Case Studies in Cyber Supply Chain Risk Management_ Summary of Findings and Recommendations.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Identifying and Estimating Cybersecurity Risk for Enterprise Risk Management say about Appendix A-Acronyms? (Part 2) According to Identifying and Estimating Cybersecurity Risk for Enterprise Risk Management, Appendix A-Acronyms: | AIS | Automated Indicator Sharing | |-------|---------------------------------------------------------------------------| | ALE | Annualized Loss Expectancy | | APT | Advanced Persistent Threat | | AWARE | Agency-Wide Adaptive Risk Enumeration | | BIA | Business Impact Analysis | | CCE | Common Configuration Enumeration | | CDM | Continuous Diagnostics and Mitigation | | CI | Confidence Interval | | CMDB | Configuration Management Database | | CPE | Common Platform Enumeration | | CSRM | Cybersecurity Risk Management | | CSRR | Cybersecurity risk register | | CTI | Cyber Threat Intelligence | | CVE | Common Vulnerabilities and Exposures | | CVSS | Common Vulnerability Scoring System | | DIB | Defense Industrial Base | | DCISE | DoD-Defense Industrial Base Collaborative Information Sharing Environment | | ERM | Enterprise Risk Management | | ERP | Enterprise Risk Profile | | ERR | Enterprise Risk Register | | ETA | Event Tree Analysis | | EV | Expected Value | HVA High-Value Asset IDS Intrusion Detection Systems IEC International Electrotechnical Commission IoC Indicators of Compromise ISAC Information Sharing Analysis Center ISAO Information Sharing and Analysis Organization ITAM Information Technology Asset Management ITL Information Technology Laboratory KPI Key performance indicator

Explanation: NIST cybersecurity publication covering vulnerability management. Topics: vulnerability, intrusion detection. Contains technical security guidance that could inform defensive posture. Source: Identifying and Estimating Cybersecurity Risk for Enterprise Risk Management.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain Authority Key Identifier : according to NIST NIST Test Personal Identity Verification (PIV) Cards Version 2 According to NIST Test Personal Identity Verification (PIV) Cards Version 2, Authority Key Identifier :: 77:6E:68:4A:1D:98:AF:46:CD:26:90:96:28:C3:E4:FD:CD:55:79:2C Key Usage : critical Digital Signature

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: NIST Test Personal Identity Verification (PIV) Cards Version 2.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain USER AWARENESS AND TRAINING according to NIST Security of Personal Computer Systems_ A Management Guide According to Security of Personal Computer Systems_ A Management Guide, USER AWARENESS AND TRAINING: Are users provided with adequate training and awareness of organizational information security policies and their individual responsibil ities? In each of the areas discussed in this questionnaire, are users provided adequate training in the performance of required procedures and the use of necessary equipment or systems?

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Security of Personal Computer Systems_ A Management Guide.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Recommendation for Key Management_ Part 2 – Best Practices for Key Management Organizations say about (b) General Provisions -? (Part 3) According to Recommendation for Key Management_ Part 2 – Best Practices for Key Management Organizations, (b) General Provisions -: ee, revocation or status information access fee, key recovery fee, reimbursement for information desk services, fees for other services such as policy information, refund policy). Publication and Repositories - This subsection contains any applicable policies regarding 1) a key and/or certificate source's obligations, where keys are not locally generated, to publish information regarding its practices, its products (e.g., keys and/or certificates), and 93 E.g., PKI CA, PKI repository, PKI RA, PKI subscriber, key recovery agent (KRA) and/or PKI relying party in public key management and central oversight authority, key centers, multiple-center groups, service agents, and client nodes in the case of symmetric key management. the current status of such products; 2) the frequency of publication; 3) access control on published information (e.g., policies, practice statements, certificates, key and/or certificate status, RKNs); and 4) requirements pertaining to the use of repositories operated by private-sector CAs or by other independent parties. Compliance Audit 94 - This subsection addresses any high-level policies regarding 1) the frequency of compliance audits for CKMS entities, 2) the identity/qualifications of the compliance auditor, 3) the auditor's relationship to the entity being audited, 4) topics covered under the compliance audit, 95 5) actions taken as a result of a deficiency found during a compliance audit, and 6) the dissemination of compliance audit results.

Explanation: NIST publication on credential and access management. Topics: access control, pki, key management. Contains security framework guidance for authentication systems. Source: Recommendation for Key Management_ Part 2 – Best Practices for Key Management Organizations.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does 2017 NIST_ITL Cybersecurity Program Annual Report say about Personal Identity Verification (PIV)? (Part 1) According to 2017 NIST_ITL Cybersecurity Program Annual Report, Personal Identity Verification (PIV): Personal Identity Verification (PIV) Figure 27: Government Employees Use PIV Cards for Facility Access <!-- image --> In response to Homeland Security Presidential Directive-12 (HSPD-12), Policy for a Common Identification Standard for Federal Employees and Contractors , the following NIST standard was developed, FIPS 201, Personal Identity Verification (PIV) of Federal Employees and Contractors . FIPS 201 was approved by the Secretary of Commerce in February 2005. HSPD-12 called for the creation of a new identity credential for federal employees and contractors. FIPS 201 is the technical specification for both the PIV identity credential and the PIV system that produces, manages, and uses the credential. Within NIST's ITL, this work is a collaborative effort of the CSD and the IAD. CSD activities in FY 2017 directly supported the latest revision of FIPS 201 (i.e., FIPS 2012) by updating the relevant publications associated with FIPS 201-2 and by initiating implementations of the credential on mobile devices. CSD performed the following activities during FY 2017 in support of HSPD-12: - Coordinated with the revision team in the ACD to update SP 800-63, titled The Digital Identity Guidelines , and ensured close alignment with the PIV Standard in areas of enrollment, identity proofing, authentication and credential lifecycle management. - With industry CRADA partners, built sample solutions at the NCCoE to demonstrate the issuance and use of PIV Credentials on mobile devices using commercial technologies. For more information visit https:/ /nccoe.nist.gov/ projects/building-blocks/piv-credentials.

Explanation: NIST publication on credential and access management. Topics: authentication, sso. Contains security framework guidance for authentication systems. Source: 2017 NIST_ITL Cybersecurity Program Annual Report.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Risk Management Framework for Information Systems and Organizations_ A System Life Cycle Approach for Security and Privacy say about REAUTHORIZATION? (Part 3) According to Risk Management Framework for Information Systems and Organizations_ A System Life Cycle Approach for Security and Privacy, REAUTHORIZATION: \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ reports, and plans of action and milestones-focused only on specific problems or ongoing issues, or as comprehensive as the initial authorization. The authorizing official signs an updated authorization decision document based on the current risk determination and acceptance of risk to organizational operations and assets, individuals, other organizations, and the Nation. In all situations where there is a decision to reauthorize a system or the common controls inherited by organizational systems, the maximum reuse of authorization information is encouraged to minimize the time and expense associated with the reauthorization effort (subject to organizational reuse policy).

Explanation: NIST publication on credential and access management. Topics: authorization, sso. Contains security framework guidance for authentication systems. Source: Risk Management Framework for Information Systems and Organizations_ A System Life Cycle Approach for Security and Privacy.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control AM-1 in Foundational PNT Profile_ Applying the Cybersecurity Framework for the Responsible Use of Positioning, Navigation, and Timing (PNT) Services? (Part 209) Control AM-1: | Identify the role of the organization or critical infrastructure in providing PNT services. Organizations using a PNT source to re- broadcast or transmit PNT data must be aware of how changes can impact PNT data and signals downstream. [BE-1, BE-2] Suppliers and third-party testing and certification . Consider relevant conformance testing, certification requirements, and processes. [SC-2] Identify vulnerabilities, including sources of errors, and threats in the PNT supply chain. For example, when PNT services are transferred through multiple parties and locations. [RA-1, RA-3] Assure the total uncertainty remains within industry standards and regulatory requirements. [GV-4] | Suppliers and third-party partners understand their roles and responsibilities. [AT-3] Hardware component authentication such as radio-frequency identification (RFIDs), physically unclonable functions (PUFs), or other markers. [AC-1, AC-6, AC-7] Hardware lifecycle management can include, but not limited to, consideration of the acquisition, integration, deployment, operations and maintenance, repair, and replacement of PNT components and services. [DS-3] | Clarify monitoring and detection responsibilities and support open communication channels among supply chain to analyze and support root cause determination of anomalous PNT data or signal output . [AE- 3] Understand risk impacts among supply chain partners . Policies and procedures, including lessons learned over time, are adequately documented and shared with stakeholders. [AE-4] PNT data alert thresholds are established. [AE-5] Verify PNT device integrity . Identify and document known limitations. [DS-6, DS-8] | Execute contingency procedures and assess functionality of systems relying on complementary PNT services or other third- party services . Notify downstream users of potential PNT data availability and integrity impacts. Record new threats and vulnerabilities.

Explanation: NIST publication on credential and access management. Topics: authentication, sso. Contains security framework guidance for authentication systems. Source: Foundational PNT Profile_ Applying the Cybersecurity Framework for the Responsible Use of Positioning, Navigation, and Timing (PNT) Services.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does The Technical Specification for the Security Content Automation Protocol (SCAP)_ SCAP Version 1.1 say about 5.1 Compliance Checking? (Part 1) According to The Technical Specification for the Security Content Automation Protocol (SCAP)_ SCAP Version 1.1, 5.1 Compliance Checking: 5.1 Compliance Checking SCAP content can be used to compare system characteristics and settings against an SCAP-expressed checklist in an automated fashion. This can verify that operating systems and applications comply with security checklists and identify any deviations from those checklists. The SCAP source data stream component that MUST be included for compliance checking is the XCCDF Benchmark, which expresses the checklist. Each rule in the XCCDF Benchmark SHALL reference one of the following: -  An OVAL compliance definition. This definition SHALL be contained in an OVAL Compliance component, which holds the definitions of the compliance checks used by the checklist. The OVAL Compliance component SHALL have at least one OVAL definition of class compliance, MAY have one or more additional OVAL definitions of classes compliance and/or inventory, and SHALL NOT have any other classes of OVAL definitions. An XCCDF Benchmark's rules MAY reference one or more OVAL compliance definitions in an OVAL Compliance component. -  An OCIL questionnaire. This questionnaire SHALL be contained in an OCIL Questionnaire component, which holds the questionnaires that collect information that OVAL is not being used to collect, such as posing questions to users or harvesting configuration information from an existing database. An XCCDF Benchmark's rules MAY reference one or more OCIL questionnaires in an OCIL Questionnaire component. -  An OVAL Patch component. The OVAL Patch component holds definitions for patch compliance checks. These checks may be needed if an organization includes patch verification in its compliance activities. The OVAL Patch component SHALL have at least one OVAL definition of class patch, MAY have one or more additional OVAL definitions of classes compliance and/or inventory, and SHALL NOT have any other classes of OVAL definitions.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: The Technical Specification for the Security Content Automation Protocol (SCAP)_ SCAP Version 1.1.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control IS-95 in Guidelines on Mobile Device Forensics? (Part 102) Control IS-95: Table 5: Example Record Structure | Field | Key | Description | |------------------------|-------|---------------------------------------------------------------------------------------------------------------------------------| | Record Type | M | Mobile originated | | Served IMSI | M | IMSI of the calling party | | Served IMEI | C | IMEI of the calling ME, if available | | Served MSISDN | O | The primary MSISDN of the calling party | | Called Number | M | The address of the called party, e.g., the number dialed by the calling subscriber | | Translated Number | O | The called number after digit translation within the MSC(if applicable) | | Connected Number | O | The number of the connected party if different from the Called Number | | Roaming Number | O | The Mobile Station Roaming Number employed to route this connection, if applicable | | Recording Entity | M | The E.164 number of the visitedMSC producing the record | | Incoming TKGP | O | The MSCtrunk group on which the call originated, usually from the BSS | | Outgoing TKGP | O | The trunk group on which the call left theMSC | | Location | M | The identity of the cell in

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Guidelines on Mobile Device Forensics.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is in the implementation of the system according to Security and Privacy Controls for Information Systems and Organizations? in the implementation of the system: [Assignment: organization-defined system components].


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Mobile Application Single Sign-On_ Improving Authentication for Public Safety First Responders provide? (Section 196) OS and dependent software, including Java and Tomcat. The database can be installed on the same host as Tomcat, or remotely. Provision a TLS certificate for the server and configure Tomcat to use TLS. -  The configuration for push notifications to support OOB authentication is not required for this build; push notifications would be used when the mobile device is used to authenticate logins or transactions initiated on a separate device. -  Follow the instructions to generate an encryption key and encrypt database credentials in the installation script. Encrypting the push notification credentials is not required, unless that functionality will be used. -  For this lab build, the standalone installation was used. The standalone option uses the PostgreSQL database on the same host as the Authentication Server and also installs the Tutorial application. -  After running the installation script, delete the encryption key ( NNL\_ENCRYPTION\_KEY\_BASE64 ) from nnl-install-conf.sh . -  For this lab build, the default policies and authenticators were used. In a production deployment, policies could be defined to control the authenticator types that could be registered and used to authenticate. -  Provisioning a Facet ID is not necessary for the OOB integration with Nok Nok Labs Passport, as used in the lab. If the Nok Nok Labs SDK were integrated with a custom mobile application, then the Facet ID would need to be configured, and the facets.uaf file would need to be published at a URL where it is accessible to clients. -  Application link/universal link integration (optional)-In the lab, the default setting using an application link under was used. This is acceptable for testing, but in a production deployment, an application link pointing to the IdP's actual domain name would typically be used.

Explanation: NIST publication on credential and access management. Topics: authentication, single sign-on. Contains security framework guidance for authentication systems. Source: Mobile Application Single Sign-On_ Improving Authentication for Public Safety First Responders.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Guide to Secure Web Services provide? (Section 48) Each requirement may have any number of standards that support it. For example, both SSL/TLS and WS-Security provide confidentiality, integrity and authentication support for the messaging dimension, while the accountability requirement of the resource protection dimension does not have any supporting standards. The notion of core services has yet to be completely defined. Traditionally, these are services that can be used by any of the Web services in an organization's SOA. Two examples are the Open Grid Services Architecture (OGSA), developed for the Globus Grid, and the Department of Defense's (DoD's) Net- Centric Enterprise Services (NCES), developed for the Global Information Grid. Both OGSA and NCES provide a set of services available throughout an organization that are commonly used or essential to most Web services, such as discovery, authentication, and authorization. OGSA provides a comprehensive list of what can be offered as core services: service management, service communication, policy services, and security services. Most SOAs use these same categories of core services but may provide differing names: - Service management services : assist in managing a SOA by providing mechanisms to install, maintain, monitor, and troubleshoot Web services. - Service communication services : provide support for various types of communications models between services: queued messaging, publish-subscribe event notification, and distributed logging services. - Policy services : provide a framework for creating, administering, and managing policies for the infrastructure; these policies cover security, resource allocation, and performance. - Security services : provide support for different security models, mechanisms, protocols, and technologies that extend core Web services security protocols to support activities such as authorization, authentication, trust policy enforcement, and credential transformation. 17 Figure 2-10.

Explanation: NIST publication on credential and access management. Topics: authentication, authorization. Contains security framework guidance for authentication systems. Source: Guide to Secure Web Services.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Protecting the Integrity of Internet Routing_ Border Gateway Protocol (BGP) Route Origin Validation say about Procedure? According to Protecting the Integrity of Internet Routing_ Border Gateway Protocol (BGP) Route Origin Validation, Procedure: 1. Verify that there are no published ROAs that cover the route 10.100.0.0/16. 2. AS 65511 originates a BGP route advertisement for 10.100.0.0/16. 3. Verify that the RUT evaluates this route advertisement as not found . 4. Verify that this route is installed in the routing table. 5. AS 65511 publishes an ROA for its address space authorizing a different AS to originate addresses for it: (10.100.0.0/16, 16, AS65510). 6. Verify that the RUT now evaluates the route to 10.100.0.0/16 that AS 65511 originated as invalid . 7. Verify that this route is still in the routing table. For IPv6, use IP address FD10:100:100:1::/64 in place of 10.100.0.0/16.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Protecting the Integrity of Internet Routing_ Border Gateway Protocol (BGP) Route Origin Validation.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Practical Combinatorial Testing say about 3.3.2 Cost Factors? According to Practical Combinatorial Testing, 3.3.2 Cost Factors: Using combinatorial methods to design test configurations is probably the most widely used combinatorial approach because it is quick and easy to do and typically delivers significant improvements to testing. Combinatorial testing for input parameters can provide better test coverage at lower cost than conventional tests, and can be extended to high strength coverage to provide much better assurance.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Practical Combinatorial Testing.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is Basic Data according to Cell Phone Forensic Tools_ an Overview and Analysis? Basic Data: The following data was found and reported: IMSI, ICCID, Language Preference (LP), Abbreviated Dialing Numbers (ADN), Last Numbers Dialed (LND) and active/deleted SMS messages. (Meet)

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Cell Phone Forensic Tools_ an Overview and Analysis.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control SR-4 in Blockchain and Related Technologies to Support Manufacturing Supply Chain Traceability_ Needs and Industry Perspectives? (Part 53) Control SR-4: ovides a sense of completeness as a research agenda, as it progresses from pointed prerequisites (identity), through emergence of patterns, to anticipation of great scale (ecosystem interoperability). ## 7.1 Identity The theme of identity relates to long standing challenges arising from digital representations in cyberspace. The digital aspects of accountability and its consequences make the challenges particularly difficult. Two areas arise: assured links between uncommunicative physical objects and their data records and likewise, linkage of digital identities to human individuals, communicating sensors, and organizational entities. Two aspects of the identity emerging technology field are: 1.) Non-invasive means of marking physical objects without corrupting them (e.g., cyber-physical anchors), 2.) Privacy respecting means allowing humans and organizational entities to assert their identities for accountability. Additionally, identity as linkage to physical objects and human individuals may be very wellknown within an ecosystem but uncertainty may be introduced when mapping across intersecting ecosystems or by other challenges. Further challenges arise when inspecting parts virtually / remotely when uncertainties can be introduced. Consider including probabilistic aspects with identity with potential utilities such as cost functions. Impacts : Traceability is strengthened when an ecosystem provides: 1.) Provable linkage between physical goods and data records, 2.) Consistent, repeatable, and understandable means of establishing and using identity. ## 7.2 Message content standards The theme of message content standards encompasses the form and vocabulary for traceability transactions. What is the minimum set of data elements and the associated message or process context to support a successful traceability project? Can strategies from previous efforts at design criteria, such as an hour-glass model [35] serve as guidance?

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Blockchain and Related Technologies to Support Manufacturing Supply Chain Traceability_ Needs and Industry Perspectives.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Satellite Ground Segment_ Applying the Cybersecurity Framework to Satellite Command and Control provide? (Section 91) is is especially relevant to the ground segment. Space assets are high-cost, high-value assets that are inaccessible, have a limited ability to act autonomously, and are reliant on the ground segment. Response and business continuity plans for the ground segment need to be executed in a manner that is consistent with the space segment's ability to operate autonomously and in the case of a congested orbital slot, | [IEC61850-90-12] 5.8, 4.12- 4.14 [NIST-SP800-53r5] CP-1, CP-2, CP-7, CP-10, IR-1, IR- 7, IR-8, IR-9, PE-17 [NIST-SP800-61r2] [NIST-SP800-160V1] 6.5, 6.6, Appendix F.2 | | PR.IP-10 : Response and recovery plans are tested. | Organizations should assess preparedness by testing incident response and recovery plans to verify effectiveness and for training purposes. Organizations should also consider qualification and periodic testing to assess the response and recovery plans as the satellites lose capabilities due to age or changes to space operations that would significantly impact the performance requirements for the ground segment. Organizations should review the results of testing to determine the efficiency and effectiveness of the plans as well as readiness to execute the plans. The results can also be used to inform other Cybersecurity Framework Functions, such as Detect. Testing and verification of recovery plans should be done in a manner that does not impact operations. Consider the use of test environments (refer to PR.DS- 7).

Explanation: NIST cybersecurity documentation and standards guidance. Topics: cybersecurity framework, fips, security control. General security reference material without sensitive content. Source: Satellite Ground Segment_ Applying the Cybersecurity Framework to Satellite Command and Control.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is References according to NIST_SP_800-53r5_Security_Privacy_Controls? References: [OMB A-130], [SP 800-37].

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: NIST_SP_800-53r5_Security_Privacy_Controls.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does NIST_SP_800-37r2_Risk_Management_Framework say about GLOSSARY? (Part 49) According to NIST_SP_800-37r2_Risk_Management_Framework, GLOSSARY: ents. | | | Note 5: System elements and information resources (as defined at 44 U.S.C. Sec. 3502 and in this document) are interchangeable terms as used in this document. | | system development life cycle | The scope of activities associated with a system, encompassing the system's initiation, development and acquisition, implementation, operation and maintenance, and ultimately its disposal that instigates another system initiation. | | system privacy officer | Individual with assigned responsibility for maintaining the appropriate operational privacy posture for a system or program. | | systems privacy engineer | Individual assigned responsibility for conducting systems privacy engineering activities. | \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ | systems privacy engineering | Process that captures and refines privacy requirements and ensures their integration into information technology component products and information systems through purposeful privacy design or configuration. | |------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | systems security engineer | Individual assigned responsibility for conducting systems security engineering activities.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: NIST_SP_800-37r2_Risk_Management_Framework.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain ASSESSMENT OBJECTIVE according to NIST Assessing Security Requirements for Controlled Unclassified Information According to Assessing Security Requirements for Controlled Unclassified Information, ASSESSMENT OBJECTIVE: Determine if: A.03.03.01.ODP[01]: event types selected for logging within the system are defined . A.03.03.01.ODP[02]: the frequency of event types selected for logging are reviewed and updated. A.03.03.01.a: the following event types are specified for logging within the system: <A.03.03.01.ODP[01]: event types> . the event types selected for logging are reviewed A.03.03.01.b[01]: <A.03.03.01.ODP[02]: frequency> . the event types selected for logging are updated A.03.03.01.b[02]: <A.03.03.01.ODP[02]: frequency> .

Explanation: NIST publication discussing classified information handling. References: classified, controlled unclassified. Contains guidance on protecting sensitive government information. Source: Assessing Security Requirements for Controlled Unclassified Information.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does ISCMA_ An Information Security Continuous Monitoring Program Assessment say about JUDGEMENT VALUES? (Part 2) According to ISCMA_ An Information Security Continuous Monitoring Program Assessment, JUDGEMENT VALUES: wever, the additional granularity facilitates analysis in ISCMAx, as described in Section 4.6. The examples throughout this report will illustrate both the recommended and the alternate judgment sets. In addition, ISCMAx is provided in two configurations: one preconfigured for the recommended judgment set and one preconfigured for the alternate judgment set.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control, assessment. General security reference material without sensitive content. Source: ISCMA_ An Information Security Continuous Monitoring Program Assessment.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Foundational Cybersecurity Activities for IoT Device Manufacturers provide? (Section 34) curity needs and goals for the IoT device's expected customers and use cases, manufacturers can determine how to address those needs and goals in order to help customers mitigate cybersecurity risks. For each cybersecurity need or goal, the manufacturer can answer this question: which one or more of the following is a suitable means (or combination of means) to achieve the need or goal? - The IoT device can provide the technical means through its device cybersecurity capabilities (for example, by using device cybersecurity capabilities built into the device's operating system, or by having the device's application software provide device cybersecurity capabilities). - Another device related to the IoT device (e.g., an IoT gateway or hub also from the manufacturer, a third-party IoT gateway or hub) can provide the technical means on behalf of the IoT device (e.g., acting as an intermediary between the IoT device and other networks while providing command and control functionality for the IoT device). - Other systems and services that may or may not be acting on behalf of the manufacturer can provide the technical means (e.g., a cloud-based service that securely stores data for each IoT device, internet service providers and other infrastructure providers). - In addition to and support of technical means, non-technical means can also be provided by manufacturers or other organizations and services acting on behalf of the manufacturer (e.g., communication of lifespan and support expectations, disclosure of flaw remediation plans). - The customer can select and implement other technical and non-technical means for mitigating cybersecurity risks. (The customer can also choose to respond to cybersecurity risks in other ways, including accepting or transferring it.) For example, an IoT device may be intended for use in a customer facility with stringent physical security controls in place.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Foundational Cybersecurity Activities for IoT Device Manufacturers.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control ES-1 in Guidelines on Firewalls and Firewall Policy? (Part 74) Control ES-1: ment function in accordance with the organization's policies and strategies. - GLYPH<c=31,font=/EDBFEN+Webdings> Performance. Solutions provide adequate performance during normal and peak usage. In many cases, the best way to test performance under the load of a prototype implementation is to use simulated traffic generators on a live test network to mimic the actual characteristics of expected traffic as closely as possible. Simulating the loads caused by DoS attacks can also be helpful in assessing firewall performance. Testing should incorporate a variety of applications that will traverse the firewall, especially those that are most likely to be affected by network throughput or latency issues. - GLYPH<c=31,font=/EDBFEN+Webdings> Security of the Implementation. The firewall implementation itself may contain vulnerabilities and weaknesses that attackers could exploit. Organizations with high security needs may want to perform vulnerability assessments against firewall components. - GLYPH<c=31,font=/EDBFEN+Webdings> Component Interoperability. Components of the firewall solution must function together properly. This is of greatest concern when a variety of components from different vendors are used. - GLYPH<c=31,font=/EDBFEN+Webdings> Policy Synchronization. If there are multiple firewalls running synchronized policies or groups of rules, test that the synchronization works in various scenarios (such as if one or more nodes are offline). - GLYPH<c=31,font=/EDBFEN+Webdings> Additional Features. Additional features that will be used by the firewall-such as VPN and antimalware capabilities-should be tested to ensure they are working properly. ## 5.4 Deploy Once testing is complete and all issues have been resolved, the next phase of the firewall planning and implementation model is deployment, which should be done in accordance with organization policies.

Explanation: NIST cybersecurity publication covering vulnerability management. Topics: vulnerability, exploit, malware. Contains technical security guidance that could inform defensive posture. Source: Guidelines on Firewalls and Firewall Policy.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain 4.3 Policies Based on User Identity according to NIST Guidelines on Firewalls and Firewall Policy According to Guidelines on Firewalls and Firewall Policy, 4.3 Policies Based on User Identity: Traditional packet filtering does not see the identities of the users who are communicating in the traffic traversing the firewall, so firewall technologies without more advanced capabilities cannot have policies that allow or deny access based on those identities. However, many other firewall technologies can see these identities and therefore enact policies based on user authentication. One of the most common ways to enforce user identity policy at a firewall is by using a VPN. Both IPsec VPNs and SSL VPNs have many ways to authenticate users, such as with secrets that are provisioned on a user-by-user basis, with multi-factor authentication (e.g., time-based cryptographic tokens protected with PINs), or with digital certificates controlled by each user. NAC has also become a popular method for firewalls to allow or deny users access to particular network resources. In addition, application firewalls and proxies can allow or deny access to users based on the user authentication within the applications themselves. Firewalls that enforce policies based on user identity should be able to reflect these policies in their logs. That is, it is probably not useful to only log the IP address from which a particular user connected if the user was allowed in by a user-specific policy; it is also important to log the user's identity as well.

Explanation: NIST publication on credential and access management. Topics: authentication, multi-factor, token. Contains security framework guidance for authentication systems. Source: Guidelines on Firewalls and Firewall Policy.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Identifying and Estimating Cybersecurity Risk for Enterprise Risk Management provide? (Section 59) considering input from subject matter experts helps avoid 'following the herd' to unreasonable conclusions | Following Trends | | Tendency to over-focus on opportunities or issues that come readily to mind because one has recently heard or read about them | Concern that VPN confidentiality is insecure because quantum computing will make modern encryption obsolete and unreliable | Detailed and realistic risk analysis (Section 2.3) helps to evaluate the true probability of threats | Availability | While it is critical that enterprises address potential negative impacts on mission and business objectives, it is equally important (and required for federal agencies) that enterprises also plan for success.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Identifying and Estimating Cybersecurity Risk for Enterprise Risk Management.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control PL-4 in Security and Privacy Controls for Information Systems and Organizations? (Part 2) Control PL-4: acknowledgment portion of the control, may be satisfied by the literacy training and awareness and role-based training programs conducted by organizations if such training includes rules of behavior. Documented acknowledgements for rules of behavior include electronic or physical signatures and electronic agreement check boxes or radio buttons. Related Controls: AC-2, AC-6, AC-8, AC-9, AC-17, AC-18, AC-19, AC-20, AT-2, AT-3, CM-11, IA-2,

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Security and Privacy Controls for Information Systems and Organizations.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Proceedings of the Workshop of the Federal Criteria for Information Technology Security say about a. What Should be the Steps to Harmonization?? According to Proceedings of the Workshop of the Federal Criteria for Information Technology Security, a. What Should be the Steps to Harmonization?: Some comments expressed concern about the inherent feasibility of achieving harmonization. It was noted that there are four IT security criteria now in existence, in varying degrees of completion. The concern was how we can move from that posture to a single criteria that can be agreed upon by a large number of nations. A proposal has been made that the CCEB should focus its work on the common core, the toolset, and not on developing or agreeing on profiles.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Proceedings of the Workshop of the Federal Criteria for Information Technology Security.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control HA-1 in 4th Annual PKI R&D Workshop _Multiple Paths to Trust_ Proceedings? (Part 263) Control HA-1: tore has another type of object called attestation signature or simply attestation . It is a signature block on someone else's 1 Some of our users like to call this 'the poor man's smartcard'. We try to tell them this is a particularly nasty misnomer - not only because certain media such as USB 'pen drives' are actually more expensive than smartcards (even including the cost of the reader), but also because they lack the tamper-proofness and crypto capabilities of the latter. certificate made by the private key of a user to indicate that it trusts that certificate (typically a root CA). This signature is detached - that is, it is stored in a separate file in a file format of our own devising; we will have more to say about attestations in section 2.1.1. . - Chaining: after the certificates are loaded from the physical stores, the CSM tries to chain them. First, duplicates are discarded and certificates issued by the same CA are sorted by their notBefore fields and assembled as a doublylinked list. The best current certificate is selected by applying two criteria: a) it is the one with the most recent notBefore and b) it must be still within validity (that is, with the current date/time before its notAfter field). If no certificate satisfies both requirements, we settle for the one that satisfies only (a). After that we build several indices for fast lookup: one keyed by the certificate's SHA1 hash, other by its Subject Key Identifier extension [7] and another by subject DN. This last one has a peculiarity: only the best current certificates make to this index; the future and previous editions don't get there.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: 4th Annual PKI R&D Workshop _Multiple Paths to Trust_ Proceedings.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain Acknowledgments according to NIST Attribute-based Access Control for Microservices-based Applications using a Service Mesh According to Attribute-based Access Control for Microservices-based Applications using a Service Mesh, Acknowledgments: The authors express their sincere thanks to Mr. David Ferraiolo of NIST for initiating this effort to provide a targeted deployment guidance in the form of an authentication and authorization framework in a service mesh environment used for protecting microservices-based applications. They also express thanks to Isabel Van Wyk of NIST for her detailed editorial review.

Explanation: NIST publication on credential and access management. Topics: access control, authentication, authorization. Contains security framework guidance for authentication systems. Source: Attribute-based Access Control for Microservices-based Applications using a Service Mesh.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does NIST Test Personal Identity Verification (PIV) Cards Version 2 provide? (Section 169) CN=Expired Test RSA 2048-bit CA for Test PIV Cards, ou=Test CA, o=Test Certificates 2010, c=US Validity : Not Before: Apr 3 19:56:01 2008 GMT, Not After: Apr 3 19:56:01 2010 GMT Subject : CN=Test E. Cardholder XV, ou=Test Agency, ou=Test Department, o=Test Government, c=US Subject Public Key Info : rsaEncryption, 2048-bit modulus, e=65537 78:85:E1:08:24:11:82:3A:34:41:59:94:D4:80:BF:23:EB:06:C9:1B 19:A6:D2:91:F3:37:A8:F8:BB:F0:6E:02:0B:85:B2:A6:8E:93:BC:AB ldap://smime2.nist.gov/cn=Expired%20Test%20RSA%202048- bit%20CA%20for%20Test%20PIV%20Cards,ou=Test%20CA,o=Test%20Certificates%20 2010,c=US?certificateRevocationList;binary CA Issuers - CA Issuers - ldap://smime2.nist.gov/cn=Expired%20Test%20RSA%202048- bit%20CA%20for%20Test%20PIV%20Cards,ou=Test%20CA,o=Test%20Certificates%20 2010,c=US?cACertificate;binary,crossCertificatePair;binary OCSP - Key Usage : critical Key Encipherment id\_fpki\_common\_hardware email:test.cardholder15@mail.example.com Serial Number : 1508 (0x5e4) Signature Algorithm : ecdsa-with-SHA256 Issuer : CN=Test ECC P-256 CA for Test PIV Cards, ou=Test CA, o=Test Certificates 2010, c=US Validity : Not Before: Sep 25 23:18:12 2008 GMT, Not After: Sep 25 23:18:12 2010 GMT Subject : CN=Test E.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: NIST Test Personal Identity Verification (PIV) Cards Version 2.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Domestic Disaster Recovery Plan for PCs, OIS, and Small VS systems provide? (Section 19) A.' .'iA A-'^ v.K.'^smA V r> <• >..M w^i .•i..mc>» 'i*' 1 »ii< i«it«hft iM' You may wish to perform operational testing at your selected backup facility once or twice a year. Each testing session should last for no more than one day and should be cleared in advance with both system managers. Before testing you should consult with your equipment vendor to insure that proper procedures are followed when transporting and reloading your media. Testing shold be performed in the same mode of operation (shared or dedicated) as provided for in the mutual assistance agreement. Operational testing is beneficial because it identifies incompatibilities between the two systems. For this reason, it is important that the system managers at both data processing sites receive advance notice of software and hardware changes. I'.'." x * •'» ry»r • -.t) ; or- \^£5 *;<».» f: S'i'^ ' .*'.v • . , .i. ' 'ty n '"> od-'S :Xj5, X».H,x,ds.*i*cJ r,,T>J-S'fcqE«iA d,«.fi 'f.. .»;'. . 1 •' . , »,4 a. -pJxijSH'&J . ac. , rlaar'jj" '«<Sr ,t i» 4i'I£^-.. I .i«5SER.w,r-»r i , - PUBUCATION OR REPORT NUMBER NIST.114A U.S. DEPARTMENT OF COMMERCE (REV. 3-89) NATIONAL INSTITUTE OF STANDARDS AND TECHNOLOGY 1 . NISTIR 4359 2. PERFORMING ORGANIZATION REPORT NUMBER 3. PUBUCATION DATE AUGUST 1990 4. TITLE AND SUBTITLE Domestic Disaster Recovery Plan for PC's, OIS, and Small VS Systems 5. AUTHOR(S) US Department of State 6. PERFORMING ORGANIZATION (IF JOINT OR OTHER THAN NIST, SEE INSTRUCTIONS) U.S. DEPARTMENT OF COMMERCE NATIONAL INSTITUTE OF STANDARDS AND TECHNOLOGY GAITHERSBURG, MD 20899 7. CONTRACT/ORANT NUMBER 8. TYPE OF REPORT AND PERIOD COVERED NISTIR 9. SPONSORING ORGANIZATION NAME AND COMPLETE ADDRESS (STREET, CITY, STATE, ZIP) Reprinted by permission of the U.S. Department of State, Office of Information Security, Washington, DC 20520 and the Advanced Information Management, Inc. Woodbridge, VA 22192 10.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Domestic Disaster Recovery Plan for PCs, OIS, and Small VS systems.