SP 800-171 sets a baseline for protecting Controlled Unclassified Information (CUI), but it was never designed to stop a well-resourced state actor that is already inside the network. NIST SP 800-172 Rev. 3, published as final on 13 May 2026 alongside its assessment companion SP 800-172A Rev. 3, adds enhanced security requirements for CUI tied to critical programmes and high value assets, aimed at advanced persistent threats (APTs). This guide covers what changed from the 2021 edition, how the requirements are structured and selected, the identity and non-human identity requirements, how to implement and evidence them, and how they relate to CMMC Level 3, which still references the 2021 text. It is for security leads, architects and compliance teams in the defence industrial base and other contractors handling high-value CUI, and builds on the NIST SP 800-171 and CMMC 2.0 Guide.
Key takeaways
- Rev. 3 replaces the 2021 edition. NIST withdrew the February 2021 SP 800-172 on 13 May 2026; Rev. 3 now covers confidentiality, integrity and availability of CUI, not only confidentiality.
- It is a menu, not a baseline. NIST states there is no expectation that agencies will select all enhanced requirements; the contract or agreement says which ones apply and sets the parameters.
- Numbering now follows SP 800-171 Rev. 3. Identifiers take the form 03.FF.NNE across 17 families, and the sequence number does not mean the requirement enhances the same-numbered 800-171 requirement.
- Identity is central. The 03.05 family adds bidirectional cryptographic device authentication, device attestation, a ban on embedded unencrypted authenticators and identity providers that manage user, device and non-person identities.
- CMMC Level 3 has not moved yet. 32 CFR 170.14 selects 24 requirements from the February 2021 edition, and DoD has said it will adopt Rev. 3 publications only through future rulemaking.
What it is and who it applies to
SP 800-172 Rev. 3 ("Enhanced Security Requirements for Protecting Controlled Unclassified Information") supplements SP 800-171 Rev. 3. It applies to nonfederal systems and organisations when the CUI they hold is associated with a critical programme or a high value asset (HVA), which NIST identifies as likely APT targets. The requirements apply only to the system components that process, store or transmit that CUI, or that protect those components, and federal agencies convey them through contracts, grants or other agreements.
- Who uses it: defence contractors on programmes designated for enhanced protection, research organisations and suppliers handling HVA data, and agencies writing those contract clauses.
- What it is not: a replacement for SP 800-171. Every enhanced requirement assumes the 800-171 baseline is already in place.
- Scope limiting: NIST notes that isolating the relevant components in a separate CUI security domain can limit where the enhanced requirements apply. See the CMMC Scoping Guide.
- Authoritative text: NIST publishes the requirements as a PDF, a CPRT dataset and OSCAL; the CSRC page states the PDF governs where they differ.
| Document | Status (checked 27 October 2026) | Role |
|---|---|---|
| SP 800-172 Rev. 3 | Final, 13 May 2026 | Enhanced security requirements |
| SP 800-172A Rev. 3 | Final, 13 May 2026; supersedes SP 800-172A (March 2022) | Assessment procedures for the enhanced requirements |
| SP 800-172 (February 2021) | Withdrawn 13 May 2026 | Still the version referenced by CMMC Level 3 in 32 CFR 170.14 |
| SP 800-171 Rev. 3 / 171A Rev. 3 | Final | Baseline the enhanced requirements build on; see the NIST SP 800-171A Rev 3 Assessment Guide |
Structure and key requirements
Rev. 3 organises the enhanced requirements into the same 17 families as SP 800-171 Rev. 3, including Planning, System and Services Acquisition and Supply Chain Risk Management. Each requirement carries a protection strategy tag and the SP 800-53 controls it derives from. Several identifiers are marked withdrawn, with pointers to where their content moved.
Three protection strategies
- Penetration-resistant architecture (PRA): make initial compromise and lateral movement harder, for example cryptographic device authentication, attribute-based access control and component isolation.
- Damage-limiting operations (DLO): assume compromise and limit what an adversary achieves, for example a security operations centre, account monitoring for atypical usage and dual authorisation.
- Cyber resiliency (CRS): keep operating through attack and recover. NIST recommends balancing selections across all three rather than buying only prevention.
Representative requirements by family
| Family | Examples in Rev. 3 | What changes in practice |
|---|---|---|
| 03.01 Access Control | 03.01.01E Dual Authorization; 03.01.08E Account Monitoring for Atypical Usage; 03.01.09E Attribute-Based Access Control; 03.01.12E Physical or Logical Separation of CUI Flows; 03.01.17E Detection of Unsanctioned CUI | Two-person rules for named privileged actions; behavioural monitoring of accounts; data-flow separation |
| 03.02 Awareness and Training | 03.02.01E Advanced Literacy and Awareness Training; 03.02.02E Practical Exercises; 03.02.04E Anti-Counterfeit Training | Exercises that simulate APT tradecraft, not annual slides |
| 03.03 Audit and Accountability | 03.03.01E audit storage on separate systems; 03.03.02E real-time alerts for audit failures; 03.03.04E integrated analysis | Logs held where a domain admin cannot erase them |
| 03.04 Configuration Management | 03.04.02E Automated Unauthorized Component Detection; 03.04.03E automated inventory; 03.04.05E dual authorisation for changes | Automated isolation or notification when unknown components appear |
| 03.05 Identification and Authentication | 03.05.01E to 03.05.07E (see next section) | Device and workload identity, not only user MFA |
| 03.06 Incident Response | 03.06.01E Security Operations Center; 03.06.02E Integrated Incident Response Team; 03.06.03E Behavior Analysis | A standing SOC capability, in-house or contracted |
| 03.08 Media Protection | 03.08.02E dual authorisation for backup deletion; 03.08.03E testing backups; 03.08.04E recovery and reconstitution | Backups that one stolen admin account cannot destroy |
| 03.11 Risk Assessment | 03.11.02E Threat Hunting; 03.11.03E Predictive Cyber Analytics; 03.11.09E Indicators of Compromise; 03.11.10E Criticality Analysis | Proactive hunting against the assumption of compromise |
| 03.12 Security Assessment and Monitoring | 03.12.01E Penetration Testing; 03.12.02E Independent Assessors; 03.12.04E Internal System Connections | Adversary-informed testing of the CUI domain |
| 03.13 System and Communications Protection | 03.13.01E Heterogeneity; 03.13.03E Concealment and Misdirection; 03.13.04E Isolation of System Components; 03.13.08E Decoys | Diversity, deception and isolation to raise attacker cost |
Most requirements contain organisation-defined parameters (ODPs) in assignment or selection brackets. NIST does not set ODP values: the agency does, and if it has not, the organisation must assign them itself and record them (Appendix E lists them). The change analysis spreadsheet on the CSRC page maps the 2021 requirements to Rev. 3 and is the fastest way to update an existing programme.
Identity and NHI requirements
The enhanced identity requirements reach beyond people. 03.05.07E explicitly covers non-person identities, which makes Rev. 3 one of the few NIST CUI documents that names workload and machine identity directly.
| Requirement | Summary | SP 800-53 source | NHI implication |
|---|---|---|---|
| 03.05.01E Cryptographic Bidirectional Authentication | Authenticate defined devices to each other with cryptography before establishing a connection | IA-3(1) | Mutual TLS or equivalent between services and devices; manage the certificates as identities |
| 03.05.02E Password Managers | Use defined password managers to generate and manage passwords, protected by defined safeguards | IA-5(18) | Vault-generated secrets for service accounts that still need passwords |
| 03.05.03E Device Attestation | Identify and authenticate devices based on attestation by a defined configuration management process | IA-3(4) | TPM-backed or platform attestation before a device or workload gets credentials |
| 03.05.04E No Embedded Unencrypted Static Authenticators | Do not embed unencrypted static authenticators in applications or static storage such as scripts or function keys | IA-5(7) | Secret scanning and removal of hard-coded keys from code and scripts |
| 03.05.05E Expiration of Cached Authenticators | Prohibit use of cached authenticators after a defined period | IA-5(13) | Short token lifetimes and bounded offline credential caching |
| 03.05.06E Identity Proofing | Proof users who need logical access to applicable assurance levels and bind identity to one individual | IA-12 | Applies to people, including those who sponsor or own service accounts |
| 03.05.07E Identity Providers and Authorization Servers | Use identity providers and authorisation servers to manage user, device and non-person identities, attributes and access rights | IA-13 | Workloads get identities and tokens from a central IdP or authorisation server, not local accounts |
| 03.01.01E Dual Authorization | Require two authorised individuals for defined privileged commands or actions | AC-3(2) | Apply to service principal creation, key export and pipeline permission changes |
| 03.01.08E Account Monitoring for Atypical Usage | Monitor system accounts for atypical usage and report to defined roles | AC-2(12) | Baseline service account behaviour and alert on new hosts, times or APIs |
APT intrusions increasingly rely on valid accounts and machine secrets rather than malware. In the Salt Typhoon Telecom Intrusions, a China-linked group logged in with legitimate credentials, harvested device secrets such as SNMP community strings and TACACS keys, and kept access for more than three years in one case. 03.05.04E, 03.01.08E and 03.11.02E threat hunting address exactly that pattern. See the Workload Identity Federation Guide and the Non-Human Identity (NHI) Guide.
Implementation steps
- Confirm the obligation. Read the contract clause: which enhanced requirements are selected, which edition (2021 or Rev. 3) and which ODP values the agency assigned. Do not implement the full catalogue speculatively.
- Confirm the 800-171 baseline. Gaps in the baseline undermine every enhanced requirement; close them first.
- Define the CUI security domain. Isolate the components that handle critical programme or HVA CUI, so enhanced controls apply to a bounded enclave rather than the whole enterprise.
- Map 2021 to Rev. 3. If you already implemented the 2021 edition (for example for CMMC Level 3), use NIST's change analysis to identify new, renumbered and withdrawn requirements, and keep both identifiers in your system security plan while CMMC still references the 2021 text.
- Assign and record ODPs for every selected requirement the agency left open, with a rationale an assessor can review.
- Sequence by dependency. NIST notes dependencies between requirements. Typical order: inventory and component detection (03.04), identity infrastructure (03.05.07E, 03.05.01E), logging separation (03.03), SOC and hunting (03.06, 03.11), then deception and heterogeneity (03.13).
- Pilot and test. Run device attestation and mutual authentication in monitor-only mode before enforcing, and keep a rollback path (temporary exemption groups with expiry) for systems that fail attestation.
- Exercise the damage-limiting controls. Test dual authorisation, backup restoration (03.08.03E) and recovery (03.08.04E) with a red team or tabletop that assumes domain compromise.
Evidence and assessment
SP 800-172A Rev. 3 provides assessment procedures that agencies can tailor, and supports self-assessment, independent third-party assessment and government-led assessment, with rigour set by depth and coverage. As in the other NIST assessment publications, procedures use examine, interview and test methods against defined objects. See the NIST SP 800-53A Guide for how those methods work.
| Requirement area | Evidence that convinces | Metric to track |
|---|---|---|
| 03.05.01E / 03.05.03E | Device certificate inventory, attestation policy, connection logs showing failed unattested devices | Percentage of in-domain devices and workloads authenticating with attested, certificate-based identity |
| 03.05.04E | Secret scanning reports across repositories and images, remediation tickets | Open embedded-secret findings in the CUI domain; median time to remove |
| 03.05.07E | IdP and authorisation server configuration, list of non-person identities and their token lifetimes | Percentage of workloads using IdP-issued identities rather than local or static accounts |
| 03.01.08E / 03.06.01E | Account behaviour baselines, SOC runbooks, alert records and response times | Mean time to detect atypical service account use |
| 03.11.02E | Hunt hypotheses, queries, findings and closure records | Hunts completed per quarter against current APT intelligence |
| 03.08.03E / 03.08.04E | Restore test records and reconstitution exercise reports | Successful restore rate and time to reconstitute critical services |
Mapping to other frameworks
- SP 800-53 Rev. 5: each enhanced requirement lists its source controls, for example IA-13 Identity Providers and Authorization Servers, IA-3(1), AC-2(12), CM-8(3) and IR-4(14). Organisations already operating a moderate or high 800-53 baseline will find many requirements partly covered. See the NIST SP 800-53 Guide.
- CMMC Level 3: 32 CFR 170.14 lists 24 requirements selected from the February 2021 edition with DoD-assigned parameters, numbered in the AC.L3-3.1.2e style. DoD's alignment note (February 2025) says Rev. 3 publications will be adopted only through future rulemaking, and Level 3 requires a final Level 2 certification from a C3PAO first. DoD's CMMC page also reports that Phase II, scheduled for 10 November 2026, was suspended on 13 July 2026; check current status before planning a Level 3 timeline. See the CMMC 2.0 Level 2 Assessment Guide.
- NIST CSF 2.0: the identity requirements sit under PR.AA-03 (users, services and hardware are authenticated); threat intelligence and hunting under ID.RA-02 and DE.AE-02; supply chain requirements under GV.SC-01.
- Zero trust: 03.05.07E, 03.01.09E and 03.13.04E align closely with the policy decision point and micro-segmentation model in the NIST SP 800-207 Zero Trust Architecture Guide.
- ATT&CK: the AC, IA and RA requirements target Valid Accounts (T1078) and the SR family targets Supply Chain Compromise (T1195).
Common pitfalls
- Implementing everything. The catalogue is a selection menu; building every requirement across the enterprise wastes budget better spent on the selected set in a well-scoped enclave.
- Mixing editions. A system security plan that cites Rev. 3 identifiers to a CMMC Level 3 assessor working from the 2021 list causes avoidable findings; maintain a crosswalk.
- Leaving ODPs blank. An unassigned parameter means the requirement is incomplete, even if the control works.
- Human-only identity. Proofing and MFA for people while services authenticate with static passwords leaves 03.05.04E and 03.05.07E unmet and is the route APTs use for persistence.
- A SOC that cannot see machine identities. 03.01.08E needs service account baselines; generic user analytics rarely cover them.
- Backups under the same admin domain. Without dual authorisation for deletion (03.08.02E), one compromised admin account can remove recovery options.
Practitioner checklist
- Obtain the list of selected enhanced requirements, the edition and the agency-assigned ODPs from the contract.
- Close SP 800-171 baseline gaps before starting enhanced work.
- Define and document the CUI security domain for critical programme or HVA data.
- Build a 2021-to-Rev. 3 crosswalk from NIST's change analysis and keep it in the SSP.
- Assign, justify and record every open ODP.
- Move workloads and devices to IdP-issued, attested, certificate-based identities and remove embedded authenticators.
- Baseline service account behaviour and feed it to the SOC for atypical-usage alerts.
- Apply dual authorisation to privileged identity changes and backup deletion.
- Run threat hunts against current APT intelligence and record the results.
- Prepare evidence using SP 800-172A Rev. 3 procedures before any assessment.
Standards and references
- NIST: SP 800-172 Rev. 3, Enhanced Security Requirements for Protecting Controlled Unclassified Information
- NIST: SP 800-172A Rev. 3, Assessing Enhanced Security Requirements for Controlled Unclassified Information
- NIST: SP 800-171 Rev. 3
- NIST: SP 800-53 Rev. 5
- Cornell LII: 32 CFR 170.14 CMMC model
- DoD CIO: CMMC Alignment to NIST Standards
- DoD CIO: About CMMC
- NIST: SP 800-172 (February 2021, withdrawn)
Related NHI Mgmt Group resources: NIST SP 800-171 and CMMC 2.0 Guide · NIST SP 800-171A Rev 3 Assessment Guide · CMMC Scoping Guide · Workload Identity Federation Guide. This guide summarises NIST SP 800-172 Rev. 3 and related CMMC rules and is not legal advice.