Key Facts
- Regulator
- National Institute of Standards and Technology (NIST)
- Latest version
- NIST SP 800-172 Rev. 3, Enhanced Security Requirements for Protecting Controlled Unclassified Information (final). It supersedes SP 800-172 (February 2021).
- Effective
- 13 May 2026
- Official text
- csrc.nist.gov ↗
What is NIST 800-172?
NIST 800-172 is NIST Special Publication 800-172, Enhanced Security Requirements for Protecting Controlled Unclassified Information. It supplements NIST SP 800-171 to protect against advanced persistent threats. US federal agencies apply it through contracts with nonfederal organisations that handle controlled unclassified information tied to a critical programme or high value asset.
The current version is NIST SP 800-172 Rev. 3, published in final form on 13 May 2026. It supersedes the original SP 800-172 of February 2021, which NIST withdrew on the same date. Rev. 3 first went through an initial public draft (13 November 2024) and a final public draft (29 September 2025). The revision is complete; the NIST publication page holds the current text.
Controlled unclassified information (CUI) is information a federal agency needs protected but that is not classified. SP 800-172 covers the confidentiality, integrity and availability of CUI that sits in a nonfederal system.
Why it matters
The prime contractor's flow-down clause names 800-172. You have worked from 800-171, and this is a different conversation.
SP 800-172 matters because it is the layer above the baseline. Where an agency judges that CUI tied to a critical programme or high value asset faces advanced persistent threats, it can require these enhanced requirements in a contract or agreement. The usual first encounter is a contract clause or a questionnaire from a US customer, not a search for the standard.
A requirement an agency never selected isn't a requirement of yours.
Who it applies to
SP 800-172 is for federal agencies to use. Nonfederal organisations meet it only when an agency requires it.
- Who must: nonfederal organisations whose contract or agreement with a federal agency specifies enhanced requirements for CUI tied to a critical programme or high value asset.
- Which parts of the organisation: the components of nonfederal systems that process, store or transmit CUI, or that protect those components.
- Who usually doesn't: firms that hold no CUI, and firms whose CUI is not tied to a critical programme or high value asset.
The obligation is contractual. SP 800-172 is not a law in itself, and it binds an organisation only through the agreement that names it.
For most UK firms the closest familiar framework is ISO 27001, a certifiable management-system standard. SP 800-172 is different: a set of enhanced requirements an agency applies by contract. An ISO 27001 certificate does not by itself show you meet them.
The UK position
No UK law or regulator requires SP 800-172. It is a US federal publication.
A UK firm meets it commercially. The route is a contract with a US federal agency, or a US prime contractor passing the requirements down, where CUI tied to a high value asset or critical programme is involved. Outside that situation, a UK firm rarely meets NIST 800-172.
Key requirements
SP 800-172 Rev. 3 is a set of enhanced security requirements, not a single control checklist. Its main features are:
- Selection by the agency. NIST does not expect agencies to select every enhanced requirement. Each agency chooses according to its mission needs and risk assessments.
- A narrow scope. The requirements cover the parts of a nonfederal system that handle CUI, or protect the components that do, for CUI associated with a critical programme or high value asset.
- Protection against advanced persistent threats. The enhanced requirements exist for threats a baseline is not designed to meet.
- Three objectives. Rev. 3 protects the confidentiality, integrity and availability of CUI.
- A companion for assessment. SP 800-172A Rev. 3, published alongside it, sets out how the enhanced requirements are assessed: as a self-assessment, an independent third-party assessment or a government-sponsored assessment.
A baseline stops the common attacker. The enhanced requirements are written for the persistent one.
NIST 800-172 vs 800-171
SP 800-171 sets the baseline requirements for protecting CUI. SP 800-172 adds enhanced requirements on top, and only for CUI tied to critical programmes or high value assets. NIST describes 800-172 as a supplement to 800-171. The 2021 edition described the enhanced requirements as supplementing the basic and derived requirements in 800-171.
In practice that means 800-172 does not replace 800-171. An organisation meets the baseline first, and any enhanced requirements are layered on where the agency asks.
What Rev. 3 changed
According to the initial public draft, Rev. 3 made these changes to the 2021 edition:
- updated numbering and added titles to the requirements;
- added three families for consistency with SP 800-171 Rev. 3: Planning (PL), System and Services Acquisition (SA) and Supply Chain Risk Management (SR);
- aligned the wording with SP 800-53 and removed outdated requirements;
- added requirements drawn from recent threat intelligence and data from cyber attacks, and widened the security objectives from confidentiality alone to include integrity and availability.
The 2021 edition's page is retained as the withdrawn record.
Frequently asked questions
NIST SP 800-171 is the baseline for any CUI held in a nonfederal system. NIST 800-172 is a narrower layer on top: it reaches only CUI tied to a critical programme or high value asset, and only the enhanced requirements an agency picks. A firm can hold an 800-171 obligation for years without ever being asked for 800-172.
No. NIST moved straight from the original NIST 800-172 of February 2021 to Rev. 3, a one-time jump in the revision number so that it lines up with SP 800-171 Rev. 3. There was never a Rev. 1 or Rev. 2. Rev. 3, final since 13 May 2026, is the current edition.
Not on its own. NIST calls the enhanced requirements recommended, and they bind an organisation only once a federal agency writes them into a contract or agreement. For a subcontractor the trigger is usually the prime's flow-down terms. If neither your contract nor a prime's flow-down names NIST 800-172, you have no obligation to meet it.
Only through contracts. NIST 800-172 has no force in UK law. A UK firm meets it when it supplies a US federal agency, or sits in a US prime's supply chain, and handles CUI tied to a critical programme or high value asset. UK certifications such as ISO 27001 or Cyber Essentials do not stand in for NIST 800-172.
No. The contract or agreement records which enhanced requirements the agency selected, so that list, not the full NIST 800-172 catalogue, is what an organisation must meet. Where the requirements arrive through a prime contractor, ask the prime for the agency's selection before scoping any work.