NIST SP 800-160 —Systems Security Engineering: Considerations for a Multidisciplinary Approach in the Engineering of Trustworthy Secure Systems

Overview

NIST SP 800-160 Vol. 1 Revision 1 is an updated systems security engineering publication providing comprehensive guidance for building trustworthy, secure, and cyber-resilient systems throughout the full systems engineering lifecycle.

Published by NIST, this revision applies to systems engineers, security architects, and program managers responsible for developing secure federal information systems. It covers updated systems security engineering principles, trustworthy system design, cyber resiliency engineering, and integration with enterprise risk management.

Organizations implement this framework by applying updated security engineering principles throughout system development, integrating resilience requirements into architecture design, and aligning engineering activities with NIST SP 800-53 Rev. 5 and the Risk Management Framework.

Why it Matters

NIST SP 800-160 Vol. 1 Rev. 1 provides an updated foundation for building security and resilience into systems from inception, reducing long-term risk exposure for critical federal systems.

Key benefits include:

• Build trustworthy systems from design

Integrate security, reliability, and resilience properties throughout the engineering lifecycle.

• Strengthen cyber resilience

Apply engineering techniques enabling systems to anticipate, withstand, recover from, and adapt to cyber threats.

• Support federal compliance

Meet NIST-based systems security engineering requirements for federal program offices and contractors.

• Reduce lifecycle security costs

Address security requirements early when design changes are least expensive.

• Align with risk management

Integrate engineering activities with NIST RMF, SP 800-53, and enterprise risk management programs.

How it Works

SP 800-160 Vol. 1 Rev. 1 integrates systems security engineering across concept, development, production, utilization, and retirement phases. It provides updated security design principles, trustworthy system properties, and cross-reference to current NIST standards.

Key Elements

• Updated Security Design Principles

Revised foundational principles for incorporating security into system architectures and engineering disciplines.

• Trustworthy System Properties

Defines security, reliability, safety, and resilience as integrated properties of trustworthy systems.

• Lifecycle Phase Integration

Maps security engineering activities across all systems lifecycle phases from concept through retirement.

Framework Scope

Applies to federal agencies and contractors developing, acquiring, or operating high-impact information systems requiring rigorous security engineering.

Framework Objectives

NIST SP 800-160 Vol. 1 Rev. 1 provides updated systems security engineering for building trustworthy, resilient federal systems.

• Integrate security and resilience engineering throughout the systems lifecycle
• Apply updated design principles creating systems with demonstrable security properties
• Support federal compliance with current NIST security engineering requirements
• Reduce security vulnerabilities through proactive engineering practices
• Align with NIST RMF and current SP 800-53 Rev. 5 requirements

Common Framework Mappings

Mapped frameworks include:

ISO/IEC/IEEE 15288

NIST Cybersecurity Framework

NIST SP 800-37

NIST SP 800-53

NIST SP 800-160 Vol. 2