NIST SP 800-172 (Draft) Enhanced Security Requirements for Protecting Controlled Unclassified Information: A Supplement to NIST Special Publication 800-171 (Final Public Draft)

こんにちは、丸山満彦です。

NISTがSP 800-172 (Draft) Enhanced Security Requirements for Protecting Controlled Unclassified Information: A Supplement to NIST Special Publication 800-171 (Final Public Draft)を公表し、意見募集をしていますね（8月21日締め切り）。

このSP 800-172（旧 NIST SP 800-171B）は、APTから、連邦政府機関以外のシステムや組織の重要なプログラムや高価値資産に関連するCUIの機密性、完全性、可用性を保護するための強化されたセキュリティ要件を提供するものです（SP 800-171はAPTを強く意識はしていなかった）。。。この強化されたセキュリティ要件は、

1. 侵入に強いアーキテクチャ、
2. ダメージを制限する運用、
3. APT に対する回復力

を提供し、新たな多次元的な防衛深層防御戦略の基盤を提供するということのようです。。。

● NIST-ITL
・2020.07.06 SP 800-172 (Draft)  Enhanced Security Requirements for Protecting Controlled Unclassified Information: A Supplement to NIST Special Publication 800-171 (Final Public Draft)

Abstract

The protection of Controlled Unclassified Information (CUI) resident in nonfederal systems and organizations is of paramount importance to federal agencies and can directly impact the ability of the Federal Government to successfully conduct its essential missions and functions. This publication provides federal agencies with recommended enhanced security requirements for protecting the confidentiality of CUI: (1) when the information is resident in nonfederal systems and organizations; (2) when the nonfederal organization is not collecting or maintaining information on behalf of a federal agency or using or operating a system on behalf of an agency; and (3) where there are no specific safeguarding requirements for protecting the confidentiality of CUI prescribed by the authorizing law, regulation, or government-wide policy for the CUI category listed in the CUI Registry. The enhanced requirements apply only to components of nonfederal systems that process, store, or transmit CUI or that provide security protection for such components when the designated CUI is associated with a critical program or high value asset. The enhanced requirements supplement the basic and derived security requirements in NIST Special Publication 800-171 and are intended for use by federal agencies in contractual vehicles or other agreements established between those agencies and nonfederal organizations.

・[PDF]

Draftから強化対策について表にしてみました。

・[html] 強化対策の一覧

目次↓

              Table of Contents

CHAPTER ONE INTRODUCTION
1.1 PURPOSE AND APPLICABILITY
1.2 TARGET AUDIENCE
1.3 ORGANIZATION OF THIS SPECIAL PUBLICATION

CHAPTER TWO THE FUNDAMENTALS
2.1 DEVELOPMENT APPROACH
2.2 ORGANIZATION AND STRUCTURE
2.3 FLEXIBLE APPLICATION

CHAPTER THREE THE REQUIREMENTS
3.1 ACCESS CONTROL
3.2 AWARENESS AND TRAINING
3.3 AUDIT AND ACCOUNTABILITY
3.4 CONFIGURATION MANAGEMENT
3.5 IDENTIFICATION AND AUTHENTICATION
3.6 INCIDENT RESPONSE
3.7 MAINTENANCE
3.8 MEDIA PROTECTION
3.9 PERSONNEL SECURITY
3.10 PHYSICAL PROTECTION
3.11 RISK ASSESSMENT
3.12 SECURITY ASSESSMENT
3.13 SYSTEM AND COMMUNICATIONS PROTECTION
3.14 SYSTEM AND INFORMATION INTEGRITY

REFERENCES

APPENDIX A GLOSSARY
APPENDIX B ACRONYMS
APPENDIX C MAPPING TABLES
APPENDIX D ADVERSARY EFFECTS