NIST SP 800-172 enhanced security requirements

National Institute of Standards and Technology (NIST) Special Publication (SP) 800-172 adds enhanced security requirements for protecting sensitive unclassified information against advanced persistent threats. It supplements SP 800-171 for controlled unclassified information (CUI) associated with critical programs or high value assets. (SP 800-172 Revision 3)

Revision 3 is the current NIST edition. Cybersecurity Maturity Model Certification (CMMC) still selects requirements from the February 2021 edition. Choose the edition named by your agreement before building a checklist. (NIST release, 32 CFR 170.2)

NIST 800-172 vs 800-171

SP 800-171 supplies the foundation; SP 800-172 adds protection for higher-risk work. Completing the enhanced requirements does not replace the foundation.

SP 800-171 focuses on CUI confidentiality in nonfederal systems. The scope includes systems handling CUI and components protecting those systems. Agencies convey the requirements through contracts or other agreements. (SP 800-171 Revision 3)

The enhanced requirements address confidentiality, integrity, and availability. Agencies select the requirements needed for their mission and risks. NIST does not expect every agency to select every enhancement. (SP 800-172, How to use this publication)

For the foundation and defense contract version rules, read NIST SP 800-171 in one read.

What enhanced security requirements add for CUI

The enhancements target attackers who keep trying, adapt, and seek lasting access.

An advanced persistent threat (APT) has substantial resources and expertise. The attacker can combine technical attacks, physical access, and deception. APT protection therefore requires more than blocking a known malicious file. (SP 800-172, Introduction)

The standard organizes protection around 3 approaches:

Examples include isolating systems, checking devices before connection, maintaining trusted configurations, and using threat information in defensive operations. These measures work together. A network boundary alone does not demonstrate the full protection strategy. (SP 800-172, Chapter 2)

For planning, turn each selected requirement into a concrete question. Which systems does it cover? Who operates the safeguard? What evidence shows that it works?

Which SP 800-172 revision is current?

Revision 3 became final on May 13, 2026. NIST also released SP 800-172A Revision 3 that day.

The revision expands requirements addressing access, network segmentation, asset management, and supply chain security. It aligns the structure and families with SP 800-171 Revision 3. NIST used a one-time revision-number change to align the publications. (NIST release)

The publication dates appear on the SP 800-171 page and SP 800-172A Revision 3 page.

NIST marks the 2021 SP 800-172 and 2022 SP 800-172A withdrawn. That publication status differs from incorporation into a regulation. Title 32 of the Code of Federal Regulations (CFR) incorporates February 2021 and March 2022, respectively, for CMMC. (32 CFR 170.2)

What are the SP 800-172 families?

Revision 3 uses 17 families aligned with SP 800-171 Revision 3. The following table groups their names for quick reference. (SP 800-172 Revision 3, Table 1)

Use family names to assign owners. Use individual requirement identifiers to track implementation and evidence. A family-level statement such as “access control complete” is too broad for an assessment worksheet.

Which 800-172 requirements does CMMC Level 3 select?

CMMC Level 3 selects 24 requirements from the February 2021 edition, with Department of Defense (DoD) parameters. Table 1 in section 170.14(c)(4) lists them. (32 CFR Part 170)

Keep those identifiers and DoD parameter values together. Do not substitute Revision 3 numbering into this regulatory list.

The CMMC levels guide explains the Level 2 prerequisite, government assessment, and rollout status.

What is NIST SP 800-172A?

SP 800-172A supplies assessment procedures for checking the enhanced requirements. It supports self-assessments, independent assessments, and government assessments. (SP 800-172A Revision 3)

The procedures identify assessment objectives and possible evidence. They use 3 methods:

The listed evidence objects are options, not a demand to produce every listed artifact. Select sufficient evidence for the objectives and required assessment rigor. (SP 800-172A Revision 3, Sections 1 and 2)

For the older CMMC requirements, the March 2022 procedures provide the matching objectives. For example, 3.6.1e checks whether a security operations center exists, operates for the defined period, and is maintained. (SP 800-172A, 3.6.1e)

Prepare an evidence worksheet in this order:

1. Record the selected requirement and its exact edition.
2. Fill in the required parameter values.
3. Copy the matching assessment objective identifiers.
4. Identify records, people, and demonstrations supporting each objective.
5. Record gaps with an owner and a completion date.

What to do next

• Identify the agreement that requires enhanced protection and the edition it names.
• Separate the SP 800-171 foundation from the selected SP 800-172 enhancements.
• For CMMC, retain the 24 regulatory identifiers and DoD parameter values.
• Pair each requirement with assessment procedures from the matching edition.
• Assign evidence owners before scheduling an assessment.

Azcuna's BABEL reads, translates, and searches foreign-language documents entirely on-device, with no cloud and no connection, and keeps every claim tied to the passage it came from.

Questions people ask

What is NIST SP 800-172?

NIST SP 800-172 provides enhanced security requirements for controlled unclassified information associated with critical programs or high value assets. It supplements SP 800-171 against advanced persistent threats. Federal agencies select requirements based on mission needs and risk, then convey them through contracts or other agreements.

What is the difference between NIST 800-172 and 800-171?

SP 800-171 provides foundational requirements for protecting CUI confidentiality on nonfederal systems. SP 800-172 supplements that foundation with enhanced protection against advanced persistent threats. The enhanced requirements address confidentiality, integrity, and availability. Implementing selected enhancements does not replace the underlying SP 800-171 requirements.

Is NIST SP 800-172 Revision 3 final?

Yes. NIST released SP 800-172 Revision 3 and SP 800-172A Revision 3 on May 13, 2026. The publications align with the SP 800-171 Revision 3 structure. NIST withdrew the older editions, but a regulation or agreement can still specify those editions.

What is NIST SP 800-172A?

SP 800-172A provides procedures for assessing the enhanced security requirements in SP 800-172. Assessors examine evidence, interview responsible people, and test safeguards. The procedures support different assessment types and levels of rigor. Use the edition matching the requirements that govern the assessment.

Does CMMC Level 3 require all of NIST SP 800-172?

No. Table 1 in 32 CFR 170.14(c)(4) selects 24 requirements from the February 2021 SP 800-172 and supplies Department of Defense parameter values. The current NIST Revision 3 catalog is different. Use the regulatory selection when preparing a CMMC Level 3 requirement list.

Sources

1. 1Enhanced Security Requirements for Protecting Controlled Unclassified Information, NIST SP 800-172r3 · National Institute of Standards and Technology
2. 2NIST Releases SP 800-172r3 and SP 800-172Ar3: Enhanced Security Requirements and Assessment Procedures for Protecting CUI · National Institute of Standards and Technology
3. 332 CFR Part 170 - Cybersecurity Maturity Model Certification (CMMC) Program · Electronic Code of Federal Regulations
4. 4Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations, SP 800-171 Rev. 3 · National Institute of Standards and Technology
5. 5Enhanced Security Requirements for Protecting Controlled Unclassified Information: A Supplement to NIST Special Publication 800-171 · National Institute of Standards and Technology
6. 6Assessing Enhanced Security Requirements for Controlled Unclassified Information, SP 800-172A Rev. 3 · National Institute of Standards and Technology
7. 7SP 800-172 (Withdrawn), Enhanced Security Requirements for Protecting Controlled Unclassified Information: A Supplement to NIST Special Publication 800-171 · National Institute of Standards and Technology
8. 8SP 800-172A (Withdrawn), Assessing Enhanced Security Requirements for Controlled Unclassified Information · National Institute of Standards and Technology
9. 9Assessing Enhanced Security Requirements for Controlled Unclassified Information, NIST SP 800-172Ar3 · National Institute of Standards and Technology
10. 10Assessing Enhanced Security Requirements for Controlled Unclassified Information, NIST SP 800-172A · National Institute of Standards and Technology

Where this shows up in our work

• ELLMENT, the offline LLM for E-2D crews answers a crew's question from the aircraft's own manuals and cites the page, with no network.
• ELLMENT for HC-130J, the offline AI crewman listens to recorded crew calls, checks them against the crew's own checklist and cites the page, with no network.
• BABEL, offline multilingual translation and search translates and searches foreign-language documents on-device, every fact tied to its source passage.
• TRACE, the offline S1000D and IETM viewer opens S1000D, MIL-STD-3001 and PDF technical manuals on a tablet with every marking intact.