NIST SP 800-172

Why does it matter?

NIST SP 800-172 exists because SP 800-171 assumes an ordinary threat. Section 2.1 of Revision 3 lists its assumptions: CUI has the same value in a federal or nonfederal system, its impact value is no less than moderate under 32 CFR 2002, the SP 800-171 requirements have already been satisfied, and additional safeguards are needed where CUI is tied to a critical program or high value asset because that information is more likely to be targeted by the APT. The enhanced requirements answer that gap with a strategy of penetration-resistant architecture, damage-limiting operations and cyber resiliency (Section 1.1), and the abstract is explicit that there is no expectation that an agency will select all of them.

Key benefits include:

• Built for the APT, not for everyone

Requirements apply only to components that process, store or transmit CUI associated with a critical program or high value asset, or that protect such components, and only when an agency selects them (Section 1.1 and 2.3).

• Three protection strategies

Penetration-resistant architecture, damage-limiting operations and cyber resiliency run through the requirement set, and Appendix D relates them to five effects on an adversary: redirect, preclude, impede, limit and expose.

• Every requirement has a source

Appendix C Table 2 gives each requirement a type, E, T or S, and the SP 800-171 requirement or SP 800-53 control it comes from, for example 03.01.01E Dual Authorization from 03.01.02 and AC-03(02).

• Parameters the agency sets

Appendix E Table 4 lists the organization-defined parameters, such as the privileged commands subject to dual authorization in 03.01.01E, so an agreement can fix them.

• A defined CMMC subset

32 CFR 170.14(c)(4) names the 24 requirements of the 2021 edition that make up CMMC Level 3, with the DoD's own parameter values.

How does it work?

Section 2.3 governs selection. Organizations may select the enhanced requirements comprehensively or selectively as part of their risk management strategy, noting that dependencies among requirements can affect the choice, and the decision rests on the mission and business needs of the federal agency, informed by ongoing risk assessments. Agencies may scope application to the components that handle the CUI in question, to components that protect them, and to components that offer a direct attack path to them through established trust relationships. The requirements are then placed in contractual vehicles or other agreements between the agency and the nonfederal organization.

Each requirement in Section 3 has an identifier and title, the requirement text with any ODPs in brackets, and a discussion that names its type and source. Three types exist (Section 2 and Appendix C): type E enhances a specific SP 800-171 requirement; type T is sourced to a control that was tailored out of the SP 800-53B moderate baseline when SP 800-171 was built; type S does not enhance a specific requirement but strengthens protection of CUI tied to critical programs or high value assets, and cites its SP 800-53 control. Examples from the Access Control family are 03.01.01E Dual Authorization (type E) and 03.01.04E Concurrent Session Control (type S, from AC-10).

The 2021 edition that CMMC uses was built differently. It held 35 enhanced requirements numbered 3.1.1e to 3.14.7e in ten of the fourteen SP 800-171 Rev. 2 families (Access Control, Awareness and Training, Configuration Management, Identification and Authentication, Incident Response, Personnel Security, Risk Assessment, Security Assessment, System and Communications Protection, System and Information Integrity), with Chapter Two on the fundamentals, Chapter Three on the requirements, Appendix C mapping tables to SP 800-53 and Appendix D on adversary effects. Appendix F of Revision 3 records what changed: more specific wording, grouped requirements, removal of outdated ones, new ones from current threat intelligence and the wider security objectives, titles, consistency with SP 800-53 language, and the new summary and ODP appendices.

Key Elements

• Section 1, Introduction

1.1 purpose and applicability, including the critical program and high value asset trigger, the three protection strategies and the note that nonfederal organizations operating systems on behalf of an agency fall under FISMA instead; 1.2 organization.

• Section 2, The Fundamentals

2.1 assumptions behind the requirements, 2.2 the development methodology, 2.3 selection and scoping of the requirements.

• Section 3, The Requirements

Enhanced requirements by family, 3.1 Access Control (03.01.01E to 03.01.17E) through 3.17 Supply Chain Risk Management (03.17.01E to 03.17.05E), each with discussion and source.

• Appendices A and B

Acronyms and the glossary.

• Appendix C, Summary of Enhanced Security Requirements

Table 2 lists every requirement with its type (E, T or S), its SP 800-171 source where one exists and its SP 800-53 control.

• Appendix D, Adversary Effects

The five desired effects on an adversary and Table 3 on how cyber resiliency techniques act on adversarial threat events.

• Appendices E and F

Table 4 of organization-defined parameters by family, and the change log from the February 2, 2021 edition, including the one-time revision number change.

What does it cover?

NIST SP 800-172 Rev. 3 applies to components of nonfederal systems that process, store or transmit CUI associated with a critical program or high value asset, or that provide protection for such components, and only where no law, regulation or governmentwide policy prescribes specific safeguards for that CUI category (Section 1.1). It is written for federal agencies to use in contractual vehicles and other agreements; footnote 10 notes that nonfederal organizations that operate a system or hold information on behalf of an agency fall under FISMA instead. The security objectives are confidentiality, integrity and availability. The February 2021 edition, withdrawn May 13, 2026, covered confidentiality only and is still the text CMMC Level 3 is built on.

What are its objectives?

Section 1.1, Section 2.3 and Appendix F set out what the requirements are for:

To provide additional protection for CUI associated with critical programs or high value assets when the SP 800-171 requirements are already satisfied (Section 2.1).

To promote penetration-resistant architecture, damage-limiting operations and cyber resiliency against the APT (Section 1.1).

To let agencies select and scope requirements by mission and business need, guided by ongoing risk assessments (Section 2.3).

To state each requirement specifically enough that implementation and assessment have a clear scope (Appendix F).

To protect the confidentiality, integrity and availability of CUI, an expansion from the 2021 edition's confidentiality focus (Appendix F).

Framework in Context

NIST SP 800-172 Rev. 3 supplements SP 800-171 Rev. 3, shares its 17 families, and is assessed with SP 800-172A Rev. 3, published the same day and superseding SP 800-172A of March 15, 2022. Its type T and S requirements point back to SP 800-53 Rev. 5 controls and the SP 800-53B moderate baseline. A change analysis against the 2021 edition and a CUI control overlay are published as supplemental materials. For the defense industrial base the governing texts are 32 CFR 170.14(c)(4), which fixes CMMC Level 3 as 24 requirements from the February 2021 edition, 32 CFR 170.18 on DIBCAC assessment, and DFARS 252.204-7021, which defines Conditional and Final Level 3 (DIBCAC) status.

Common Framework Mappings

NIST SP 800-172 is commonly mapped to the catalogs its requirements are sourced from and to the programs that select them, so the same control records can serve a CMMC Level 3 assessment and an agency agreement.

Mapped frameworks include:

CIS Controls v8.1

FedRAMP Rev. 5

ISO 27001:2022

ISO 27002:2022

NIST CSF 2.0

NIST 800-37 Rev.2

NIST 800-53 Rev.5

PCI DSS 4.0.1

SOC 2