- ClassificationCategoryCybersecurityDomainCybersecurityFramework FamilyNIST Special Publications
- Regulatory ContextTypeGuidanceLegal InstrumentGuidanceSectorCross-SectorIndustryCross-Industry
- Region / PublisherRegionNorth AmericaRegion DetailUnited StatesPublisherNational Institute of Standards and Technology (NIST), with The MITRE Corporation as co-author
- VersioningVersionRevision 1 (November 2022); supersedes Volume 1 of November 2016 (updated March 21, 2018)Effective DateNovember 2022Issue DateNovember 2022 (approved November 8, 2022); original edition November 2016
- AdoptionAdoption ModelVoluntaryImplementation ComplexityHigh
- Official ReferenceOpen Link in New TabSource
License included / downloadable: Yes
SP 800-160 Vol. 1 Rev. 1 is a U.S. government publication, free of charge from NIST and not subject to copyright in the United States (attribution is appreciated). Appendices G to K reproduce ISO/IEC/IEEE 15288 content under IEEE permission, so the standard itself is a separate paid purchase; the platform links to NIST's text.
Framework text is licensed by its publisher and is included only where stated above.
- NIST SP 800-160 Volume 1 Revision 1, Engineering Trustworthy Secure Systems, is the NIST guide to systems security engineering.
- Published November 2022 by NIST and The MITRE Corporation, it supersedes the 2016 Volume 1 as updated in 2018.
- It is voluntary guidance; OMB Memorandum M-19-03 requires federal agencies to apply its principles to all high-value assets.
- It covers asset-loss concepts, three contexts (problem, solution, trustworthiness), 30 design principles, and 30 life cycle processes.
- Protection requirements come from stakeholder concerns about asset loss and are engineered in as part of the system life cycle.
Overview
NIST SP 800-160 Volume 1 Revision 1, Engineering Trustworthy Secure Systems, is the NIST guide to systems security engineering: principles, concepts, activities and tasks for building security into the engineering of any system, from concept to retirement. Ron Ross of NIST, with Mark Winstead and Michael McEvilley of The MITRE Corporation, published it in November 2022 as voluntary guidance for systems engineers, security engineers and the people who govern, acquire, assess and operate systems. It supersedes the original Volume 1 of November 2016, which was updated on March 21, 2018.
NIST developed the publication under the Federal Information Security Modernization Act of 2014. Section 1.1 says its considerations apply to all federal systems other than national security systems, that state, local and tribal governments and private sector entities are encouraged to use it, and, in a footnote, that OMB Memorandum M-19-03 requires federal agencies to implement its principles, concepts, techniques and system life cycle processes for all high-value assets. The preface places it in the context of Executive Order 14028 and its call for engineering-based protection of both information technology and operational technology.
The publication has four chapters and twelve appendices: systems engineering concepts (Chapter 2), system security concepts built on assets and loss (Chapter 3), the systems security engineering framework with problem, solution and trustworthiness contexts (Chapter 4), then appendices on security policy, trustworthy secure design, 30 design principles, trustworthiness and assurance, and the 30 system life cycle processes with their security tasks. Its Disclaimer asks that it be used as a supplement to ISO/IEC/IEEE 15288.
Why does it matter?
Security that is added after a system is designed leaves gaps that controls alone cannot close. SP 800-160 Vol. 1 treats security as an engineering discipline: the requirements for protection come from stakeholder concerns about asset loss, they are managed like any other engineering requirement, and the protection is engineered in as part of the system life cycle. For organizations that build, integrate or buy high-value systems, it supplies a shared vocabulary and a defined set of tasks to ask for and to check.
Key benefits include:
- Security engineered in
Chapter 1 states that protection is engineered into architecture, design, implementation and technology selection, and that security requirements cannot be handled independently or after the fact.
- A defined meaning of adequately secure
Section 3.2 sets two tests: the system meets minimum tolerable levels of security and is as secure as reasonably practicable (ASARP), balanced against cost, schedule and performance.
- Protection driven by asset loss
Sections 3.4 to 3.6 start from assets, six asset classes and two loss control objectives, so protection needs follow what stakeholders cannot afford to lose.
- Evidence-based trust
Section 4.3 grounds trustworthiness in an assurance case: claims derived from security objectives, supported by evidence and valid arguments.
- Any development method
Section 1.3 says the life cycle processes fit waterfall, spiral, DevOps, agile and other approaches, and can be applied recursively, iteratively or in parallel.
How does it work?
Chapters 2 and 3 build the concepts. A system is an arrangement of elements that exhibit behavior the parts alone do not (2.1), and security is freedom from the conditions that can cause a loss of assets with unacceptable consequences (3.1). The system must deliver both the user intent and the design intent, and its primary control objective is Mediated Access, enforcing rules for allowed and disallowed behavior. Section 3.6 reasons about loss through five elements: context, confidence, significance, addressing loss and cause of loss.
Chapter 4 organizes the work in a systems security engineering framework of three interacting contexts. The problem context defines security objectives, security requirements, measures of success and life cycle security concepts. The solution context defines, realizes and produces evidence for the security aspects of the solution. The trustworthiness context develops and maintains the assurance case. NIST says the framework runs as a closed, iterative loop, not a sequence of steps, and rests on a shared base of system security analysis (Section H.6).
The appendices turn the concepts into practice. Appendix D describes the trustworthy secure design approach and Appendix E lists the 30 principles, from Anomaly Detection to Trustworthy System Control. Appendices G to K cover the 30 life cycle processes in four groups, each with a security purpose, security outcomes and security activities and tasks. Section 1.3 says organizations are not expected to use everything: teams select what fits their purpose.
Key Elements
- Concept of security (3.1)
Security is freedom from conditions that can cause loss of assets with unacceptable consequences; only intended behaviors and outcomes occur, and access is mediated by consistent security policy rules.
- Adequately secure (3.2)
Minimum tolerable levels of security plus as secure as reasonably practicable, judged on evidence and against the system's states, including secure, insecure and indeterminate states.
- Assets and loss (3.4, 3.5)
Six asset classes (Table 1) and two loss control objectives, loss prevention and loss limitation (Table 2), with loss recovery and loss delay as the two means of limiting loss.
- Systems security engineering framework (Chapter 4)
The problem, solution and trustworthiness contexts, with system security analysis as the common base.
- Principles for trustworthy secure design (Appendix E)
Thirty principles in Table 4, such as Defense in Depth, Least Privilege, Mediated Access, Protective Failure, Protective Recovery and Reduced Complexity.
- Trustworthiness and assurance (Appendix F)
Trust and trustworthiness, and assurance as confidence in a requirement, with the rigor of evidence matched to the assurance sought.
- System life cycle processes (Appendices G to K)
Fourteen technical, eight technical management, six organizational project-enabling and two agreement processes, written as security tasks aligned with ISO/IEC/IEEE 15288.
What does it cover?
Section 1.1 states that the considerations apply to all federal systems other than national security systems, which may use them with approval, and that state, local and tribal governments and private sector entities are encouraged to consider them. They apply to a new capability, the modification or evolution of an existing system, its retirement, dedicated security or high-confidence systems, and a system of systems, in information technology and operational technology alike. Section 1.2 names the audience: systems engineers, security engineers and other engineering professionals, plus people who govern risk, verify and assess, acquire and manage projects, operate and sustain systems, supply products, or teach.
What are its objectives?
Section 1.1 lists five intended outcomes for the publication.
Provide a basis for a discipline of systems security engineering as part of systems engineering, in terms of principles, concepts, activities and tasks.
Foster a common mindset to deliver security for any system, whatever its purpose, type, scope, size, complexity or life cycle stage.
Show how selected systems security engineering principles, concepts, activities and tasks apply to systems engineering activities.
Advance systems security engineering as a discipline that can be applied and studied.
Serve as a basis for education and training programs, individual certifications and other assessment criteria.
Framework in Context
SP 800-160 Vol. 1 is paired with Volume 2 Revision 1, Developing Cyber Resilient Systems: A Systems Security Engineering Approach (2021), which its references cite and which NIST lists as the other volume of the publication. Its life cycle processes in Appendices G to K are based on ISO/IEC/IEEE 15288:2015, reprinted with IEEE permission, so the Disclaimer recommends owning the international standard to understand them. Revision 1 renewed the focus on design principles and concepts, moved the detailed processes into separate appendices and eliminated two earlier design principle categories (Appendix L). The publication contains no control catalog.
Common Framework Mappings
Organizations map SP 800-160 Vol. 1 to the control and assurance frameworks below so that engineering evidence can support each of them.
Mapped frameworks include:
CIS Controls v8.1
FedRAMP Rev. 5
IEC 62443
ISO 27001:2022
ISO 27002:2022
NIST CSF 2.0
NIST 800-53 Rev.5
SOC 2
How SmartSuite Supports NIST SP 800-160 Vol. 1
SmartSuite provides the system for managing controls, evidence, mappings, assessments, and reporting.
Use Cyber & IT Risk to track cyber risks, vulnerabilities and security controls against each system, Compliance Management to hold requirements, controls and evidence, and Workflow Orchestration to run life cycle reviews and approvals with owners, so security requirements, design decisions and assurance evidence stay linked for each system.
Security Requirements Register
Record stakeholder security requirements and security objectives per system, with owner, status and the design decision that satisfies each (problem context, Chapter 4).
Asset and Loss Register
List assets by the six classes in Table 1, the significance of loss and the loss control objective, prevention or limitation, chosen for each.
Design Principle Reviews
Run architecture reviews against the 30 Appendix E principles as workflow steps, with decisions, exceptions and approvers recorded.
Life Cycle Process Tracker
Track security tasks from the Appendix H to K processes, such as requirements definition, verification, validation and acquisition, as recurring tasks with owners.
Assurance Case Evidence
Link claims to the verification, validation and test evidence behind them and keep the reasoning for each system in one record (trustworthiness context).
Supplier Agreement Security Criteria
Keep the security criteria and acceptance conditions of supplier agreements in Third Party Risk Management, following the Appendix K acquisition and supply tasks.
Related frameworks
CIS Controls v8.1 is a prioritized set of 18 Controls and 153 Safeguards, in three Implementation Groups, with a new Govern function.
ISO/IEC 27001:2022 specifies requirements for an information security management system: Clauses 4 to 10, risk treatment, the Statement of Applicability and 93 Annex A controls.
ISO/IEC 27002:2022 is the reference set of 93 information security controls in four themes, with attributes and implementation guidance, that supports an ISO/IEC 27001 ISMS.
MITRE ATT&CK is a free knowledge base of adversary tactics, techniques and sub-techniques from The MITRE Corporation, updated twice a year; the current release is v20.0.
NIST CSF 2.0 (CSWP 29, February 26, 2024) is the voluntary cybersecurity framework with six Functions including Govern, 22 Categories, 106 Subcategories, Profiles and Tiers.
Frequently Asked Questions For NIST SP 800-160 (Systems Security Engineering)
It is NIST's guide to systems security engineering, Engineering Trustworthy Secure Systems, Revision 1, published in November 2022 and written by Ron Ross of NIST with Mark Winstead and Michael McEvilley of The MITRE Corporation. It supersedes the original Volume 1 of November 2016, updated March 21, 2018. It is voluntary guidance with no certification scheme.
Section 3.2 says an adequately secure system meets minimum tolerable levels of security, as determined by experience, analysis or both, and is as secure as reasonably practicable (ASARP). The judgment needs an evidence-based determination that security performance is optimized against all other performance objectives and constraints, and it depends on stakeholder needs and context.
Chapter 4 defines the problem context (security objectives, security requirements, measures of success and life cycle security concepts), the solution context (defining, realizing and producing evidence for the security aspects of the solution) and the trustworthiness context (developing and maintaining the assurance case and demonstrating it is satisfied). They run as a closed iterative loop, not a sequence.
Appendix E and Table 4 list 30 principles, including Anomaly Detection, Commensurate Rigor, Defense in Depth, Distributed Privilege, Least Functionality, Least Privilege, Mediated Access, Minimal Trusted Elements, Protective Failure, Protective Recovery, Reduced Complexity and Trustworthy System Control. Each has a principle statement and a note explaining it.
It is voluntary for organizations outside the federal government, and section 1.1 applies it to federal systems other than national security systems. A footnote says OMB Memorandum M-19-03 requires federal agencies to implement its principles, concepts, techniques and life cycle processes for all high-value assets. Its Disclaimer says to use the publication as a supplement to ISO/IEC/IEEE 15288, whose process content appears in Appendices G to K.
Put this framework to work in SmartSuite
Manage controls, risks, evidence, and audits in one platform designed for modern governance, risk, and compliance.