Prepare for NIST 800-172 enhanced CUI protection with less effort

NIST SP 800-172 is a NIST publication of enhanced security requirements for protecting controlled unclassified information (CUI) in nonfederal systems against advanced persistent threats. It supplements NIST SP 800-171 with measures such as security operations centres, threat hunting, penetration testing, deception and supply chain protections. Revision 3, released in May 2026, contains 103 active requirements across 17 families and supersedes the February 2021 edition.

Only organisations whose federal agency customer selects NIST 800-172 requirements in a contract, grant or other agreement must comply. Agencies do this for CUI associated with critical programmes or high value assets. NIST states there is no expectation that every enhanced requirement will be selected. In defence contracting, the main route is CMMC Level 3, which applies 24 selected requirements to certain Department of Defense suppliers.

NIST SP 800-171 is the baseline for protecting CUI in nonfederal systems, while NIST SP 800-172 adds enhanced requirements for CUI that advanced persistent threats are likely to target. You implement 800-171 first, then the 800-172 requirements an agency selects. The enhanced requirements add capabilities such as threat hunting, a security operations centre, dual authorisation, system diversity and deception techniques.

CMMC Level 3 is built from 24 requirements selected from the February 2021 edition of NIST SP 800-172, with Department of Defense values set for the organisation-defined parameters. Contractors must also meet CMMC Level 2, which is based on NIST SP 800-171 Revision 2. CMMC Level 3 assessments are carried out by the government rather than by a third-party assessment organisation.

Revision 3, published by NIST in May 2026, renumbers requirements to match NIST SP 800-171 Revision 3 (for example 03.01.01E) and expands the catalogue to 17 families. It adds requirements on access control, network segmentation, asset management and supply chain security, and maps requirements to SP 800-160 protection strategies and adversary effects. The companion assessment guide, SP 800-172A, was revised at the same time.

Start by confirming that NIST SP 800-171 is fully implemented, then identify which enhanced requirements your agency contract selects and the parameter values it sets. Document each selected requirement in your system security plan, implement the technical and procedural measures, and gather evidence. NIST SP 800-172A gives the assessment procedures, which show what an assessor will examine, interview and test.

ISO 27001 is a voluntary, certifiable international standard for an information security management system, while NIST SP 800-172 is a set of enhanced requirements applied to US federal CUI through contracts. Many controls overlap, such as asset management, incident response and supplier security, so evidence can often serve both. ISO 27001 certification does not by itself satisfy NIST 800-172 requirements.

NIST SP 800-172 is mapped in OneClickComply's control library and is available on request rather than as a live, self-serve framework today. The mapping links the enhanced requirements to the same controls used for NIST SP 800-171, so evidence collected once can count towards both. OneClickComply does not issue CMMC certifications or guarantee compliance.