NIST SP 800-172 Rev. 3 gives federal agencies enhanced security requirements for protecting controlled unclassified information in nonfederal systems, to help defend against advanced persistent threats. It supplements SP 800-171 and applies only where an agency chooses to include it in a contract or agreement, for critical programs or high value assets.
What NIST says about it
According to NIST's publication page, the final version is dated 13 May 2026 and supersedes the version of 2 February 2021. Its purpose is to recommend enhanced requirements for stronger protection of the confidentiality, integrity and availability of CUI when that information sits in nonfederal systems and is tied to a critical program or high value asset. The document is meant to help defend against advanced persistent threats.
How it relates to SP 800-171
SP 800-171 covers baseline protection for CUI in nonfederal systems. SP 800-172 is a supplement. It adds enhanced requirements for higher-risk situations. Related documents include SP 800-171 Rev. 3 and its assessment companion, SP 800-171A Rev. 3.
Think of it as layers. The baseline comes first. The enhanced set is an add-on that applies to a subset of cases.
Who uses it, and how
NIST's text says federal agencies use it in contracts or other agreements with nonfederal organisations. It covers the components of nonfederal systems that process, store or transmit CUI, along with components that protect them, but only when an agency selects those components to manage CUI risk.
Agencies are not expected to select every requirement. Their choices depend on mission needs and ongoing risk assessments.
What this means in practice
- You do not "comply with 800-172" on your own initiative. A contract or agreement brings it in. If no contract says so, it is not a legal duty for you.
- Scope is selective. Expect a defined list of requirements and a defined system boundary, not a blanket rule.
- It builds on 800-171. If your baseline is weak, work there first.
Questions to ask your contracting contact
- Does the agreement name SP 800-172 Rev. 3 or an earlier version?
- Which requirements has the agency selected?
- Which systems are in scope?
- How will conformity be assessed, and by whom?
- What is the timeline?
Get answers in writing. Do not infer them from a blog post, including this one.
A word on wording
Avoid describing any of this as certification. NIST publishes guidance, and contract terms decide what is required of you.
Quick check
Is SP 800-172 a replacement for SP 800-171?
No. It is a supplement that adds enhanced requirements on top of the baseline.
Do all agencies select every requirement?
No. NIST says agencies are not expected to select every requirement and base choices on mission needs and risk assessment.
Sources
Last reviewed: 19 October 2026.
