Skip to main content
ControlFrameby LockedIn Labs
Framework library

Requirements & evidence

NIST SP 800-172

Enhanced security requirements for protecting controlled unclassified information tied to critical programs and high-value assets against advanced threats. It supplements SP 800-171 and does not apply to every CUI environment by default.

Edition on record
Rev. 3
Edition published
Source last checked

Understand the scope

What the framework covers.

The library records this framework for defense industrial base, federal contractors, critical programs, across US. The issuing authority determines applicability; your assessment scope should identify the organization, systems, services, and edition being assessed.

Areas of requirement

  • Access control
  • Asset management
  • Network segmentation
  • Supply-chain risk management
  • Cyber resiliency

The library tracks the authority and edition. A normalized requirement catalog is not available for this framework, so a requirement count is not stated here.

Source access and licensing

NIST publishes the final requirements and assessment procedures in human-readable and OSCAL formats; pin the final Rev. 3 artifacts before ingestion.

Prepare with context

The evidence behind
the requirements.

Evidence needs to demonstrate how a requirement is met within the assessment scope. Keep the source requirement, collection context, responsible owner, review decision, and period of applicability together.

A framework-specific collection workflow has not been activated. The reference material on this page can inform scoping and preparation; it does not establish evidence collection or assessment readiness.

ControlFrame availability

Framework reference available

Authority and version facts, with a parsed public catalog when available; no tenant blueprint or executable evidence method is activated.

How availability is determined

NIST SP 800-172 is tracked in the registry — authority, version ledger, verification — and nothing else is modelled for it yet. Import its catalog to begin.

Catalog status: Planned. Tracked metadata: we record the regime and its issuing authority for review. Registry presence does not mean automated monitoring is active. No control or requirement model is implemented.

Metadata only; Rev. 3 requirements and assessment procedures are not ingested, normalized, mapped to CMMC Level 3, or released as a product module.

Follow the source

Editions and transitions.

These are the editions recorded in the library, checked August 28, 2026. Confirm the applicable edition with the authority before beginning an assessment.

  • Rev. 3Current edition on record · Replaces 2021
  • 2021Superseded edition
Recorded change history

· NIST SP 800-172 Rev. 3 supersedes 2021 and is the current edition.

Check the basis

Sources you can follow.

Verified against the issuing authority’s own publication. Source verification was recorded on August 28, 2026.

Catalog provenance and record details

Framework record: nist-800-172-rev3.

Source artifact: acquisition required.

Parsed catalog: Not ingested.

Control families as published: Access control · Asset management · Network segmentation · Supply-chain risk management · Cyber resiliency.

Record last updated: August 28, 2026.

Common questions

A closer look.

What is NIST SP 800-172?

Enhanced security requirements for protecting controlled unclassified information tied to critical programs and high-value assets against advanced threats. It supplements SP 800-171 and does not apply to every CUI environment by default.

Who does NIST SP 800-172 apply to?

NIST SP 800-172 applies to defense industrial base, federal contractors, critical programs, US, per National Institute of Standards and Technology.

What is the current version of NIST SP 800-172?

The current edition is Rev. 3, issued by National Institute of Standards and Technology and published 2026-05-13. Source: https://csrc.nist.gov/pubs/sp/800/172/r3/final.

What does an assessment under NIST SP 800-172 require?

No control catalog has been ingested for NIST SP 800-172 yet — the registry tracks it as planned (Tracked metadata: we record the regime and its issuing authority for review. Registry presence does not mean automated monitoring is active. No control or requirement model is implemented), so an assessment under this framework currently requires the authority's own catalog rather than a ControlFrame-parsed one.

At a glance

NIST SP 800-172

Rev. 3

Framework reference
Authority and edition tracked
Evidence preparation
Framework reference available
Source confidence
Primary authority

A framework reference describes requirements. Evidence decisions belong to a scoped assessment and a named reviewer.

Continue exploring

Related frameworks.

NERC CIP

Commonly assessed together · The mandatory, auditable cybersecurity standards for the North American bulk electric system. NERC versions each CIP standard separately — there is no framework-wide version number.

NIST SP 800-171

Also applies to defense industrial base · NIST's current recommended security requirements for Controlled Unclassified Information in non-federal systems. Contractual applicability is agreement-specific; CMMC Phase I continues to use Rev. 2 rather than automatically inheriting Rev. 3.

HITRUST CSF

Commonly assessed together · A licensed cybersecurity and risk-management framework used across healthcare and other sectors. HITRUST offers scoped assessment and certification programs through its authorized processes; registry tracking claims no certification.

NIS2 Directive

Commonly assessed together · The EU directive establishing a cybersecurity baseline for essential and important entities across 18 critical sectors, with management accountability and incident reporting. Operational obligations depend on each Member State's transposing law.

Make the requirements
part of the work.

Explore how ControlFrame can organize NIST SP 800-172 requirements, evidence preparation, and review for your assessment scope.

Request a walkthrough
NIST SP 800-172 | ControlFrame