NIST SP 800-172

This document serves as a supplement to NIST SP 800-171, providing federal agencies with a model to establish enhanced security measures specifically aimed at protecting the confidentiality, integrity, and availability of Controlled Unclassified Information (CUI) in critical programs and high-value assets within nonfederal systems. Its requirements are tailored to address sophisticated Advanced Persistent Threats (APT), which employ cyber and physical attack vectors to breach defenses. The publication incorporates penetration-resistant architecture, damage-limiting operations, and cyber resiliency strategies to safeguard federal missions effectively. Key updates include revised scoping guidance, requirements flexibility, customization options, and threat modeling for defensive measures. The enhanced security measures must be implemented in addition to SP 800-171 requirements when specific safeguarding mandates are absent.