NIST SP 800-172

Enhanced Security Requirements for Protecting Controlled Unclassified Information

Publication Date: February 2, 2021
Current Status: Final (Rev. 3 in draft as of September 2025)
Authority: Federal agency contract requirements

Overview

NIST SP 800-172 provides enhanced security requirements for protecting Controlled Unclassified Information (CUI) in nonfederal systems when that CUI is associated with critical programs or high-value assets (HVA). Unlike SP 800-171 which focuses primarily on confidentiality, SP 800-172 addresses confidentiality, integrity, and availability.

Purpose and Threat Focus

Primary Purpose

Supplement SP 800-171 with enhanced requirements when CUI protection requires defense against Advanced Persistent Threats (APTs).

APT Characteristics:

• Sophisticated levels of expertise


• Significant resources to conduct sustained campaigns


• Multiple attack vectors (cyber, physical, deception)


• Patient and persistent


• Adapt tactics to defender responses


• Nation-state or nation-state-sponsored actors

Three-Dimensional Defense Strategy

1. Penetration-Resistant Architecture

• Hardened systems designed to prevent initial compromise


• Multi-layered security controls


• Defense-in-depth approach


• Zero-trust principles

2. Damage-Limiting Operations

• Containment capabilities when breach occurs


• Limit lateral movement and data exfiltration


• Quick detection and response


• Minimize blast radius of successful attacks

3. Cyber Resiliency and Survivability

• Maintain mission capability under attack


• Graceful degradation of services


• Rapid recovery capabilities


• Continuous operations during incidents

Relationship to SP 800-171

SUPPLEMENTS, NOT REPLACES

• Organizations MUST implement SP 800-171 first


• SP 800-172 provides ADDITIONAL enhanced requirements


• Both must be satisfied when SP 800-172 is required


• SP 800-171 = baseline, SP 800-172 = enhanced protection

Security Requirement Families

Enhanced Requirements for 13 of 17 Families

SP 800-172 includes enhanced requirements for:

1. AC - Access Control


2. AT - Awareness and Training


3. CA - Assessment, Authorization and Monitoring


4. CM - Configuration Management


5. IA - Identification and Authentication


6. IR - Incident Response


7. PL - Planning


8. PS - Personnel Security


9. RA - Risk Assessment


10. SA - System and Services Acquisition


11. SC - System and Communications Protection


12. SI - System and Information Integrity


13. SR - Supply Chain Risk Management

Does NOT include enhanced requirements for:

• AU - Audit and Accountability


• MA - Maintenance


• MP - Media Protection


• PE - Physical and Environmental Protection

When SP 800-172 is Required

SP 800-171 Required When:

• Federal contract involves CUI (standard protection)


• Baseline protection for ALL CUI

SP 800-172 Required When:

CUI is associated with Critical Programs or High-Value Assets

Critical Program Definition:
Program that significantly:

• Increases capabilities and mission effectiveness, OR


• Extends expected effective life of essential system/capability

High-Value Asset (HVA) Categories:

1. Informational Value

- Information/system of high value to government or adversaries
- Contains especially sensitive data
- Mission-critical information

1. Mission Essential

- Agency cannot accomplish Primary Mission Essential Functions (PMEF)
- Required per Presidential Policy Directive 40 (PPD-40)
- Without asset, agency mission fails within expected timelines

1. Federal Civilian Enterprise Essential (FCEE)

- Serves critical function in federal civilian enterprise security/resilience
- Cross-agency dependencies
- Infrastructure criticality

Decision Matrix

Scenario	Standard Required
----------	------------------
Handling basic CUI	SP 800-171 only
CUI associated with critical program	SP 800-171 + SP 800-172
CUI designated as HVA	SP 800-171 + SP 800-172
APT threat assessment indicates elevated risk	SP 800-171 + SP 800-172
Defense contractor on critical weapon system	Likely SP 800-171 + SP 800-172

Determination: Federal agency designates whether CUI requires enhanced protection

Mandatory vs Voluntary

Voluntary Base Framework:

• NIST is non-regulatory agency


• SP 800-172 is guideline, not regulation

Becomes MANDATORY when:

• Federal agency specifies SP 800-172 in contract


• Grant agreement requires enhanced protection


• DoD contract includes SP 800-172 requirements


• Federal point of contact designates CUI as critical program/HVA

Compliance Verification:

• Contact prime contractor for subcontract requirements


• Consult federal point of contact for contract


• Review contract language for specific requirements


• Verify CUI designation (critical program vs standard)

Applicable Industries

Primary Industries:

1. Defense Contractors - Prime contractors on sensitive DoD programs


2. Research Institutions - Universities with federal research grants on critical programs


3. Aerospace and Aviation - Critical aircraft/space systems


4. Technology and IT Services - Federal IT contractors on HVA systems


5. Energy Sector - Nuclear facilities, critical power grid


6. Healthcare and Biotech - Federal healthcare contractors, biodefense research


7. Manufacturing - Defense manufacturing for critical systems

Massachusetts Organizations Potentially Affected:

• Raytheon (critical defense systems)


• General Dynamics (national security programs)


• MIT (sensitive federal research)


• Boston University (federal research on critical programs)


• Biotech companies (biodefense, emerging technologies)

Enforcement

Enforcement Mechanism:

Contractual requirements enforced by:

• DoD Contracting Officers (DFARS)


• DCMA - Defense Contract Management Agency


• CMMC Accreditation Body (CMMC Level 3+)


• Federal contracting agencies (DoE, NASA, etc.)


• Agency Inspectors General

NIST Role:

• Does NOT have enforcement authority


• Provides guidelines and recommendations


• Does NOT determine compliance

Consequences of Non-Compliance:

• Contract non-performance findings


• Withholding of payments


• Contract termination


• Suspension or debarment from federal contracting


• Civil monetary penalties


• Criminal prosecution for fraud (extreme cases)

Relationship to CMMC

CMMC Level Structure:

• Level 1: Foundation (basic cybersecurity)


• Level 2: Based on SP 800-171 (110 controls)


• Level 3+: Incorporates SP 800-172 enhanced requirements

CMMC 2.0 Details:

• Final rule published October 2024


• Utilizes SP 800-171 and SP 800-172 requirements


• Assessment methodology based on SP 800-171A and SP 800-172A


• Higher CMMC levels incorporate SP 800-172


• Third-party assessments required (C3PAOs)

Assessment Requirements

SP 800-172A (Released March 2022)
Assessment procedures for evaluating SP 800-172 compliance

Assessment Types:

1. Self-assessments


2. Independent third-party assessments


3. Government-sponsored assessments


4. CMMC assessments for higher maturity levels

Assessment Characteristics:

• Flexible and customizable procedures


• Variable rigor based on depth and coverage


• Scalable to different environments


• Organization-defined parameters

Company Size Applicability

Size-Neutral Standard:

• NO company size thresholds or exemptions


• Applies regardless of organization size


• Same requirements for small and large contractors

Applicability Criteria:

• Federal contract specifies SP 800-172 compliance


• Organization handles CUI for critical programs/HVAs


• Contract includes appropriate DFARS or FAR clauses

Small Business Challenges:

• Resource constraints for implementation


• Limited IT security staff


• Budget limitations


• Technical expertise requirements

Support Available:

• SP 1318 Small Business Primer (for SP 800-171 baseline)


• MEP (Manufacturing Extension Partnership) assistance


• DoD procurement technical assistance centers


• No size-based exemptions despite challenges

Penalties for Non-Compliance

No Direct NIST Penalties:

• SP 800-172 is technical standard, not regulation


• Penalties through contract terms and regulations

Federal Contractor Consequences:

• Contract termination or suspension


• Financial penalties per contract terms


• Loss of access to federal systems


• Inability to compete for future contracts


• Potential debarment from federal contracting


• Required self-reporting of cybersecurity incidents

CMMC-Related Penalties:

• Cannot bid on contracts without required CMMC level


• Failed assessments prevent contract awards


• CMMC certification is "go/no-go" for applicable contracts

Private Sector Voluntary Adopters:

• No direct NIST-based penalties


• Enforcement through underlying regulations if applicable

Effective Dates

Publication Timeline:

• June 19, 2019: Draft as SP 800-171B released


• July 6, 2020: Draft as SP 800-172 released


• February 2, 2021: SP 800-172 Final published (Current)


• March 2022: SP 800-172A (Assessment Procedures) released


• September 29, 2025: SP 800-172 Rev. 3 (Final Public Draft) released


• January 16, 2026: Rev. 3 comment period closes

Implementation Timeline:

• No universal mandatory effective date


• Implementation determined by individual contracts


• Each contract specifies compliance timeline


• Agencies set deadlines based on mission needs

Implementation Guidance

Prerequisites:

1. Achieve SP 800-171 compliance first


2. Identify CUI within systems


3. Confirm critical program/HVA designation


4. Review contract requirements


5. Conduct risk assessment

Implementation Approach:

1. Gap Analysis - Assess current state against SP 800-172


2. System Security Plan - Document enhanced controls


3. Phased Implementation - High-priority controls first


4. Continuous Monitoring - Ongoing assessment and adaptation

Resources:

• SP 800-172A (assessment procedures)


• SP 1318 (small business primer for baseline)


• Federal agency guidance


• MEP centers


• Industry partnerships (DIB, etc.)

Massachusetts-Specific Considerations

Federal Standard:
No state-specific variations - applies uniformly across all states

When Massachusetts Organizations Must Comply:

• Defense contractors on critical DoD programs (Raytheon, General Dynamics)


• Research institutions with sensitive federal contracts (MIT, Harvard)


• Biotech companies on biodefense or emerging technology programs


• Technology companies with federal contracts involving HVAs


• State agencies processing federal CUI for critical programs

No State-Level Enforcement:
Massachusetts does not separately enforce NIST SP 800-172 - enforcement through federal contracts

Official Resources

• SP 800-172 Publication


• PDF Download


• SP 800-172A Assessment Procedures


• Project Page


• Email: [email protected]

Key Takeaways

1. Supplements SP 800-171 - not a replacement


2. Required for critical programs/HVAs - not all CUI


3. APT-focused defense - penetration-resistant, damage-limiting, resilient


4. Voluntary unless mandated by contract


5. 13 of 17 security families enhanced


6. Federal agency determines when required


7. CMMC Level 3+ incorporates SP 800-172


8. No company size exemptions


9. Assessment via SP 800-172A


10. Contractual enforcement - not direct NIST penalties

Protection Philosophy

SP 800-172 acknowledges that APTs may penetrate primary security boundaries, therefore focuses on:

• Prevention: Hardened, penetration-resistant architecture


• Detection: Quick identification of compromise


• Response: Damage limitation and containment


• Resilience: Mission continuity under attack


• Recovery: Rapid restoration of capabilities


• Adaptation: Continuous monitoring and improvement