Build cyber-resilient systems with NIST SP 800-160 Vol. 2
NIST SP 800-160 Vol. 2 Rev. 1 is NIST guidance, published in December 2021, on engineering systems that stay resilient against advanced cyber threats. It sets out a cyber resiliency engineering framework of goals, objectives, techniques, implementation approaches and design principles. It also identifies the NIST SP 800-53 Rev. 5 controls that support each cyber resiliency technique.
Is NIST SP 800-160 Vol. 2 right for your organisation?
It is mainly used by US federal agencies, defence contractors and critical infrastructure operators that must assume a capable adversary may already be inside their systems. Systems engineers and security architects use it when designing new systems or modernising existing ones. Other organisations adopt it voluntarily to strengthen resilience beyond baseline security controls.
Adopting it is voluntary, though customers and auditors often expect it.
- Issued by
- National Institute of Standards and Technology (NIST), with The MITRE Corporation
- Full title
- Developing Cyber-Resilient Systems: A Systems Security Engineering Approach
- Latest version
- Volume 2, Revision 1 (December 2021)
- Status
- Voluntary guidance; not a certifiable standard
- Applies to
- Systems engineering for federal and critical systems, and any organisation that adopts it
- Related controls
- NIST SP 800-53 Rev. 5 controls supporting cyber resiliency (Appendix E)
- Assessment route
- No certification; assessed through the NIST SP 800-53 controls it maps to
- Type
- Guidance (voluntary)
- Region
- United States, US
- In OneClickComply
- Supported today
OneClickComply makes it simple
NIST SP 800-160 Vol. 2 is mapped in OneClickComply's control library and is available on request. Because its techniques are implemented through NIST SP 800-53 controls, OneClickComply's control mapping lets evidence you already collect for frameworks such as NIST 800-53, ISO 27001 or SOC 2 count towards the resiliency controls. Continuous monitoring, the risk register and our in-house auditors help you show those controls keep working.
Requirements covered
4 cyber resiliency goals, 8 objectives, 14 techniques with their implementation approaches, and 5 strategic and 14 structural design principles, supported by the NIST SP 800-53 controls listed in Appendix E.
Manual NIST SP 800-160 Vol. 2 vs. OneClickComply
- Working through a long publication of goals, objectives, techniques and design principles by hand
- Tracing each resiliency technique to the right NIST SP 800-53 controls in spreadsheets
- Collecting screenshots from many tools to show privilege restriction, redundancy and monitoring are in place
- Finding out months later that a segmentation rule or backup job quietly stopped working
- Repeating the same evidence work for NIST 800-53, ISO 27001 and other frameworks
- A structured control set in OneClickComply that reflects the publication's resiliency constructs
- Control mapping that links resiliency work to the NIST SP 800-53 controls it depends on
- Evidence gathered automatically from connected tools and the Companion AI browser agent
- Continuous monitoring with alerts as soon as a resiliency control drifts
- Evidence collected once and reused across every framework it applies to
Everything you need for NIST SP 800-160 Vol. 2
Cyber resiliency controls mapped to the NIST SP 800-53 controls you already run
Automated evidence collection from 13,000+ integrations, including logging, backup and identity tools
Continuous monitoring that alerts you when segmentation, privilege or integrity controls drift
OneClickFix for supported misconfigurations, with every change logged as evidence
Risk register to record adversity scenarios, critical assets and resiliency decisions
Ask an Auditor and virtual CISO support for applying resiliency techniques to your architecture
Three steps to NIST SP 800-160 Vol. 2 compliance
Connect & scan
Connect your cloud, identity and SaaS tools. OneClickComply checks them against NIST SP 800-160 Vol. 2 and shows you exactly where you stand.
Fix & generate
OneClickFix remediates technical gaps in one click, and AutoComplete generates NIST SP 800-160 Vol. 2-aligned policies from your real environment.
Monitor & evidence
Continuous monitoring keeps you compliant, and our in-house audit team is on hand when you need expert guidance.
NIST SP 800-160 Vol. 2 Rev. 1 requirements
The publication's cyber resiliency constructs from Chapter 2 and Appendix D: 4 goals, 8 objectives, 14 techniques and 19 design principles, numbered in the order NIST lists them; implementation approaches and the supporting NIST SP 800-53 controls are not listed individually.
| Reference | Requirement |
|---|---|
| Goal 1 | Anticipate |
| Goal 2 | Withstand |
| Goal 3 | Recover |
| Goal 4 | Adapt |
| Objective 1 | Prevent or Avoid |
| Objective 2 | Prepare |
| Objective 3 | Continue |
| Objective 4 | Constrain |
| Objective 5 | Reconstitute |
| Objective 6 | Understand |
| Objective 7 | Transform |
| Objective 8 | Re-Architect |
| Technique 1 | Adaptive Response |
| Technique 2 | Analytic Monitoring |
| Technique 3 | Contextual Awareness |
| Technique 4 | Coordinated Protection |
| Technique 5 | Deception |
| Technique 6 | Diversity |
| Technique 7 | Dynamic Positioning |
| Technique 8 | Non-Persistence |
Always check the official NIST SP 800-160 Vol. 2 text for the exact wording.
NIST SP 800-160 Vol. 2 FAQs
What is NIST SP 800-160 Volume 2 Revision 1?
NIST SP 800-160 Volume 2 Revision 1, Developing Cyber-Resilient Systems: A Systems Security Engineering Approach, is NIST guidance published in December 2021. It treats cyber resiliency as an engineering discipline and gives a framework of goals, objectives, techniques, implementation approaches and design principles. These help organisations build systems that can anticipate, withstand, recover from and adapt to attacks, including by advanced persistent threats.
Is NIST SP 800-160 Vol. 2 mandatory?
No. NIST SP 800-160 Vol. 2 is guidance, not a binding standard. NIST developed it under its FISMA responsibilities for federal systems, and the publication states that non-governmental organisations may use it on a voluntary basis. In practice, federal agencies, defence programmes and contracts may call for cyber resiliency engineering, so check your own contractual and regulatory obligations.
What are the four cyber resiliency goals?
The four cyber resiliency goals in NIST SP 800-160 Vol. 2 are Anticipate, Withstand, Recover and Adapt. Anticipate means maintaining informed preparedness for adversity. Withstand means continuing essential mission or business functions despite adversity. Recover means restoring those functions during and after adversity. Adapt means modifying functions and supporting capabilities in response to predicted changes in the technical, operational or threat environment.
What are the 14 cyber resiliency techniques?
NIST SP 800-160 Vol. 2 defines 14 cyber resiliency techniques: Adaptive Response, Analytic Monitoring, Contextual Awareness, Coordinated Protection, Deception, Diversity, Dynamic Positioning, Non-Persistence, Privilege Restriction, Realignment, Redundancy, Segmentation, Substantiated Integrity and Unpredictability. Each technique is delivered through implementation approaches, and Appendix E lists the NIST SP 800-53 controls and enhancements that support it.
How does NIST SP 800-160 Vol. 2 relate to NIST SP 800-53 and ISO 27001?
NIST SP 800-160 Vol. 2 builds on NIST SP 800-53 Rev. 5 rather than replacing it. Appendix E identifies the 800-53 controls and enhancements that support each cyber resiliency technique, so resiliency is implemented through controls you may already operate. ISO 27001 has no formal link, but many of its Annex A controls, such as logging, backups and segmentation, overlap with the controls the publication relies on.
Can you get certified against NIST SP 800-160 Vol. 2?
No. There is no certification scheme for NIST SP 800-160 Vol. 2. Organisations apply it during systems engineering and show its effect through the NIST SP 800-53 controls it maps to, internal analysis and independent assessments. If you need a certificate, frameworks such as ISO 27001 or a SOC 2 report are the usual route, with cyber resiliency work strengthening those controls.
How do you apply NIST SP 800-160 Vol. 2?
You apply NIST SP 800-160 Vol. 2 by tailoring it, not by implementing everything. The publication describes a tailorable analysis process: understand the mission and threat context, establish a cyber resiliency baseline, analyse the system, define and analyse specific alternatives, and develop recommendations. Organisations then select the goals, objectives, techniques and design principles that fit their systems and implement them through supporting controls.
Does OneClickComply support NIST SP 800-160 Vol. 2?
NIST SP 800-160 Vol. 2 is mapped in OneClickComply's control library and is available on request, rather than being a framework you can switch on today. Because its techniques rely on NIST SP 800-53 controls, evidence you collect in OneClickComply for NIST 800-53, ISO 27001 or SOC 2 can be mapped towards it. Contact us to discuss enabling it for your organisation.
Related standards
All standards- NIST SP 800-82 Rev. 3Guidance · US
- NIST SP 800-171A Rev. 3Guidance · US
- NIST SP 800-82 Rev. 3 High OT OverlayGuidance · US
- NIST SP 800-82 Rev. 3 Moderate OT Overlay BaselineGuidance · US
- NIST SP 800-171AGuidance · US
- NIST SP 800-161 Rev. 1Guidance · US
- NIST SP 800-161 Rev. 1 Level 3 (Operational C-SCRM)Guidance · US
- NIST AI 600-1 Generative AI ProfileGuidance · US
Products that power NIST SP 800-160 Vol. 2 compliance
Get NIST SP 800-160 Vol. 2 ready, not stressed
Automate controls, gather evidence continuously and stay audit-ready, all on one platform.