CybersecurityGuideline

NIST SP 800-172

Enhanced Security Requirements for Protecting Controlled Unclassified Information: A Supplement to NIST Special Publication 800-171

NIST SP 800-172 elaborates enhanced security requirements for protecting Controlled Unclassified Information (CUI) in nonfederal systems and organizations. It aims to mitigate risks posed by Advanced Persistent Threats (APT) through a defense-in-depth approach, building on the foundational requirements in NIST SP 800-171.

Book your strategy call View source ↗

Overview

This document serves as a supplement to NIST SP 800-171, providing federal agencies with a model to establish enhanced security measures specifically aimed at protecting the confidentiality, integrity, and availability of Controlled Unclassified Information (CUI) in critical programs and high-value assets within nonfederal systems. Its requirements are tailored to address sophisticated Advanced Persistent Threats (APT), which employ cyber and physical attack vectors to breach defenses. The publication incorporates penetration-resistant architecture, damage-limiting operations, and cyber resiliency strategies to safeguard federal missions effectively. Key updates include revised scoping guidance, requirements flexibility, customization options, and threat modeling for defensive measures. The enhanced security measures must be implemented in addition to SP 800-171 requirements when specific safeguarding mandates are absent.

Related in Cybersecurity

CybersecurityControl setGuideline

ITSG-33 — IT Security Risk Management: A Lifecycle Approach (ITSG-33)

ITSG-33 is a guideline developed by the Canadian Centre for Cyber Security to help government departments manage IT security risks effectively. It outlines activities at both departmental and project levels, providing a structured process for integrating security considerations into IT environments and maintaining authorization to operate.

Canadian Centre for Cyber Security • Canada

View details

CybersecurityStandard

ESMA Minimum Standard IT Security Controls

The ESMA Minimum Standard IT Security Controls is a cybersecurity and compliance framework that defines the minimum security requirements service providers must implement to protect ESMA systems, applications, data, and information services.

European Securities and Markets Authority (ESMA) • EU

View details

CybersecurityStandardFramework

DISP 2020 — Defence Industry Security Program (DISP)– Suitability Assessment (2020)

The Defence Industry Security Program (DISP) is an Australian Defence membership program that helps organizations implement and demonstrate appropriate security controls for participating in Defence projects and managing Defence-related information and assets.

Australian Department of Defence • Australia • v2020

View details

CybersecurityStandardFramework

DISP 2022 — Defence Industry Security Program – Suitability Requirements (2022)

The Defence Industry Security Program (DISP) is an Australian Defence security assurance program that helps organizations meet security requirements for Defence contracts and projects by implementing appropriate governance, personnel, physical, and information security controls.

Australian Government • Australia • v2022

View details

Ready to manage these frameworks?

6clicks maps regulations to controls, evidence and risks — automatically.

Book your strategy call