Unfortunately might be a couple more CR's.
https://govmatters.tv/countdown-to-next-spend...itol-hill/

https://govmatters.tv/impact-of-crs-shutdown-...n-efforts/

GOV Contractors and NIST 800-171
https://govmatters.tv/government-contractors-...-deadline/

Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations
https://csrc.nist.gov/publications/detail/sp/...ev-1/final

800-171 Update NOV 2017
https://csrc.nist.gov/publications/detail/sp/800-171a/draft

https://csrc.nist.gov/CSRC/media/Publications...-draft.pdf

Quote:

---

This publication contains procedures to assess the CUI security requirements in NIST Special Publication 800-171. The content in this publication is derived from NIST Special Publication 800-53A, which provides assessment procedures to determine the
effectiveness of the security controls in NIST Special Publication
800-53. Therefore, organizations are encouraged to consult the
NIST publication when developing plans to assess CUI security
requirements.

---

Quote:

---

NIST Special Publication 800-63 provides guidance on digital identities. 3

---

NIST SP 800-53 Revision 5
https://csrc.nist.gov/csrc/media/publications...-draft.pdf

Quote:

---

mobile devices include , for example, configuration management, device identification and authentication

---

Quote:

---

Multifactor authentication requires the use of two or more different factors to achieve authentication. Factors are defined as follows: something you know, for example, a personal identification number (PIN); something you have, for example, a physical authenticator or cryptographic private key stored in hardware or software; or something you are, for example, a biometric .

---

SP 800-63-3 Digital Identity Guidelines
https://csrc.nist.gov/publications/detail/sp/800-63/3/final

Quote:

---

The guidelines cover identity proofing and authentication of users (such as employees, contractors, or private individuals) interacting with government IT systems over open networks.

---

Quote:

---

5.1.3.1 Out-of-Band Authenticators The out-of-band authenticator SHALL establish a separate channel with the verifier in order to retrieve the out-of-band secret or authentication request. This channel is considered to be out-of-band with respect to the primary communication channel ( even if it terminates on the same device) provided the device does not leak information from one channel to the other without the authorization of the claimant.

---

$SFOR/BST STRONG!!!!