NIST SP 800-172r3 fpd: Enhanced Security Requirements for Protecting Controlled Unclassified Information

Withdrawn Draft Warning Notice The attached draft document has been withdrawn and is provided solely for historical purposes. It has been followed by the document identified below. Withdrawal Date May 13, 2026 Original Release Date September 29, 2025

The attached draft document is followed by: Stage Final Series/Number NIST SP 800-172r3 Title Enhanced Security Requirements for Protecting Controlled Unclassified Information Publication Date May 2026 DOI https://doi.org/10.6028/NIST.SP.800-172r3 CSRC URL https://csrc.nist.gov/pubs/sp/800/172/r3/final Additional Information

NIST Special Publication 800 NIST SP 800-172r3 fpd

Enhanced Security Requirements for Protecting Controlled Unclassified Information Final Public Draft Ron Ross Victoria Pillitteri

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-172r3.fpd

NIST Special Publication 800 NIST SP 800-172r3 fpd

Enhanced Security Requirements for Protecting Controlled Unclassified Information Final Public Draft Ron Ross Victoria Pillitteri

Computer Security Division Information Technology Laboratory

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-172r3.fpd

September 2025

U.S. Department of Commerce Howard Lutnick, Secretary National Institute of Standards and Technology Craig Burkhardt, Acting Under Secretary of Commerce for Standards and Technology and Acting NIST Director

NIST SP 800-172r3 fpd (Final Public Draft) September 2025

Enhanced Security Requirements for Protecting CUI

Certain equipment, instruments, software, or materials, commercial or non-commercial, are identified in this paper in order to specify the experimental procedure adequately. Such identification does not imply recommendation or endorsement of any product or service by NIST, nor does it imply that the materials or equipment identified are necessarily the best available for the purpose. There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may be used by federal agencies even before the completion of such companion publications. Thus, until each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning and transition purposes, federal agencies may wish to closely follow the development of these new publications by NIST. Organizations are encouraged to review all draft publications during public comment periods and provide feedback to NIST. Many NIST cybersecurity publications, other than the ones noted above, are available at https://csrc.nist.gov/publications. Authority This publication has been developed by NIST in accordance with its statutory responsibilities under the Federal Information Security Modernization Act (FISMA) of 2014, 44 U.S.C. § 3551 et seq., Public Law (P.L.) 113-283. NIST is responsible for developing information security standards and guidelines, including minimum requirements for federal information systems, but such standards and guidelines shall not apply to national security systems without the express approval of appropriate federal officials exercising policy authority over such systems. This guideline is consistent with the requirements of the Office of Management and Budget (OMB) Circular A-130. Nothing in this publication should be taken to contradict the standards and guidelines made mandatory and binding on federal agencies by the Secretary of Commerce under statutory authority. Nor should these guidelines be interpreted as altering or superseding the existing authorities of the Secretary of Commerce, Director of the OMB, or any other federal official. This publication may be used by nongovernmental organizations on a voluntary basis and is not subject to copyright in the United States. Attribution would, however, be appreciated by NIST. NIST Technical Series Policies Copyright, Use, and Licensing Statements NIST Technical Series Publication Identifier Syntax Publication History Approved by the NIST Editorial Review Board on YYYY-MM-DD [Will be added to final publication.] Supersedes NIST Series XXX (Month Year) DOI [Will be added to final publication, if applicable.] How to Cite this NIST Technical Series Publication: Ross R, Pillitteri V (2025) Enhanced Security Requirements for Protecting Controlled Unclassified Information. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) NIST SP 800172r3 fpd. https://doi.org/10.6028/NIST.SP.800-172r3.fpd Author ORCID iDs Ron Ross: 0000-0002-1099-9757 Victoria Pillitteri: 0000-0002-7446-7506

NIST SP 800-172r3 fpd (Final Public Draft) September 2025

Enhanced Security Requirements for Protecting CUI

Public Comment Period September 29, 2025 – November 14, 2025 January 16, 2026 Submit Comments 800-171comments@list.nist.gov National Institute of Standards and Technology Attn: Computer Security Division, Information Technology Laboratory 100 Bureau Drive (Mail Stop 8930) Gaithersburg, MD 20899-8930 All comments submitted during the public comment period will be posted to the NIST page. with contact information redacted. All technical content will be posted as submitted, so commenters should not include information they do not wish to be posted (e.g., personal or business information). Additional Information Additional information about this publication is available at https://csrc.nist.gov/pubs/sp/800/172/r3/fpd, including related content, potential updates, and document history. All comments are subject to release under the Freedom of Information Act (FOIA).

NIST SP 800-172r3 fpd (Final Public Draft) September 2025

Enhanced Security Requirements for Protecting CUI

1

Abstract

2 3 4 5 6 7 8 9 10 11

The protection of Controlled Unclassified Information (CUI) resident in nonfederal systems and organizations is of paramount importance to federal agencies and can directly impact the ability of the Federal Government to successfully conduct its essential missions and functions. This publication provides federal agencies with recommended security requirements for protecting the confidentiality, integrity, and availability of CUI when it is resident in a nonfederal system and organization and associated with a critical program or high value asset (HVA). The security requirements apply to the components of nonfederal systems that process, store, or transmit CUI or that provide protection for such components. The enhanced security requirements are intended for use by federal agencies in contractual vehicles or other agreements established between those agencies and nonfederal organizations.

12

Keywords

13 14 15 16

advanced persistent threat; contractor systems; controlled unclassified information; CUI registry; enhanced security requirement; Executive Order 13556; FISMA; NIST Special Publication 800-172; NIST Special Publication 800-53; nonfederal organizations; nonfederal systems; security assessment; security control; security requirement.

17

Reports on Computer Systems Technology

18 19 20 21 22 23 24 25 26 27

The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the Nation’s measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology. ITL’s responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in federal information systems. The Special Publication 800-series reports on ITL’s research, guidelines, and outreach efforts in information system security, and its collaborative activities with industry, government, and academic organizations.

i

NIST SP 800-172r3 fpd (Final Public Draft) September 2025

Enhanced Security Requirements for Protecting CUI

28

Audience

29 30

This publication serves a diverse group of individuals and organizations in the public and private sectors, including individuals with:

31 32 33

•

System development life cycle responsibilities (e.g., program managers, mission/business owners, information owners/stewards, system designers and developers, system/security engineers, systems integrators)

34

•

Acquisition or procurement responsibilities (e.g., contracting officers)

35 36 37

•

System, security, or risk management and oversight responsibilities (e.g., authorizing officials, chief information officers, chief information security officers, system owners, information security managers)

38 39

•

Security assessment and monitoring responsibilities (e.g., auditors, system evaluators, assessors, independent verifiers/validators, analysts)

40

The above roles and responsibilities can be viewed from two perspectives:

41 42

•

Federal perspective: The entity establishing and conveying security assessment requirements in contractual vehicles or other types of agreements

43 44

•

Nonfederal perspective: The entity responding to and complying with the security assessment requirements set forth in contracts or agreements

ii

NIST SP 800-172r3 fpd (Final Public Draft) September 2025

Enhanced Security Requirements for Protecting CUI

45

Note to Reviewers

46 47

The following provides a summary of the significant changes that have been made to SP 800172 in transitioning to Revision 3:

48 49

•

Streamlined introductory information in Sec. 1 and Sec. 2 to improve clarity and understanding

50 51

•

Increased specificity of the enhanced security requirements to remove ambiguity, improve the effectiveness of implementation, and clarify the scope of assessments

52 53

•

Grouped enhanced security requirements, where possible, to improve understanding and the efficiency of implementations and assessments

54

•

Removed outdated and redundant enhanced security requirements

55 56 57

•

Added new enhanced security requirements based on (1) the latest threat intelligence, (2) empirical data from cyber-attacks, and (3) the expansion of security objectives to include integrity and availability

58 59

•

Added new requirement families for consistency with SP 800-171r3, Revision 3: Planning (PL), System and Services Acquisition (SA), and Supply Chain Risk Management (SR)

60

•

Added titles to the enhanced security requirements

61

•

Restructured and streamlined the security requirement discussion sections

62 63

•

Revised the enhanced security requirements for consistency with the source security control language in SP 800-53

64 65

•

Revised the structure of the References, Acronyms, and Glossary sections for greater clarity and ease of use

66 67

•

Removed appendix with mapping table for security controls and protection strategies and transferred information to the individual security requirements in Sec. 3

68

•

Added new appendix that summarizes the enhanced security requirements

69 70

•

Added new appendix that lists organization-defined parameters for the enhanced security requirements

71

•

Implemented a one-time “revision number” change for consistency with SP 800-171r3

72 73

NIST is specifically interested in comments, feedback, and recommendations on the following topics:

74 75

•

The additional enhanced security requirements to select from to protect critical systems and high value assets

76 77

•

The mappings between the enhanced security requirements to the SP 800-160 protect strategies and adversary effects

78

•

The usefulness of the information in supplementary Appendices C, D, and E

iii

NIST SP 800-172r3 fpd (Final Public Draft) September 2025

Enhanced Security Requirements for Protecting CUI

79 80 81 82

Reviewers are encouraged to comment on all or parts of SP 800-172, Revision 3 fpd. NIST requests that all comments be submitted to 800-171comments@list.nist.gov by 11:59 p.m. Eastern Standard Time (EST) on November 14, 2025. Commenters are encouraged to use the comment template provided with the document announcement.

83 84 85

Comments received in response to this request will be posted on the Protecting CUI project site after the due date. Submitters’ names and affiliations (when provided) will be included, while contact information will be removed

86

iv

NIST SP 800-172r3 fpd (Final Public Draft) September 2025

Enhanced Security Requirements for Protecting CUI

87

Call for Patent Claims

88 89 90 91 92 93 94

This public review includes a call for information on essential patent claims (claims whose use would be required for compliance with the guidance or requirements in this Information Technology Laboratory (ITL) draft publication). Such guidance and/or requirements may be directly stated in this ITL Publication or by reference to another publication. This call also includes disclosure, where known, of the existence of pending U.S. or foreign patent applications relating to this ITL draft publication and of any relevant unexpired U.S. or foreign patents.

95 96

ITL may require from the patent holder, or a party authorized to make assurances on its behalf, in written or electronic form, either:

97 98

a) assurance in the form of a general disclaimer to the effect that such party does not hold and does not currently intend holding any essential patent claim(s); or

99 100 101

b) assurance that a license to such essential patent claim(s) will be made available to applicants desiring to utilize the license for the purpose of complying with the guidance or requirements in this ITL draft publication either:

102 103

i.

under reasonable terms and conditions that are demonstrably free of any unfair discrimination; or

104 105

ii.

without compensation and under reasonable terms and conditions that are demonstrably free of any unfair discrimination.

106 107 108 109 110

Such assurance shall indicate that the patent holder (or third party authorized to make assurances on its behalf) will include in any documents transferring ownership of patents subject to the assurance, provisions sufficient to ensure that the commitments in the assurance are binding on the transferee, and that the transferee will similarly include appropriate provisions in the event of future transfers with the goal of binding each successor-in-interest.

111 112

The assurance shall also indicate that it is intended to be binding on successors-in-interest regardless of whether such provisions are included in the relevant transfer documents.

113

Such statements should be addressed to: 800-171comments@list.nist.gov

v

NIST SP 800-172r3 fpd (Final Public Draft) September 2025

Enhanced Security Requirements for Protecting CUI

114

Table of Contents

115

1. Introduction ...................................................................................................................................1

116 117 118

2. The Fundamentals ..........................................................................................................................4

119 120 121 122

3. The Requirements ..........................................................................................................................9

123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140

References.......................................................................................................................................79

141

Appendix A. Acronyms .....................................................................................................................82

142

Appendix B. Glossary .......................................................................................................................85

143

Appendix C. Summary of Enhanced Security Requirements ...............................................................93

144

Appendix D. Adversary Effects..........................................................................................................98

145

Appendix E. Organization-Defined Parameters ............................................................................... 104

146

Appendix F. Change Log ................................................................................................................. 108

vi

NIST SP 800-172r3 fpd (Final Public Draft) September 2025

Enhanced Security Requirements for Protecting CUI

147

List of Tables

148

Table 1. Enhanced security requirement families ................................................................................6

149

Table 2. Enhanced security requirements..........................................................................................93

150

Table 3. Effects of cyber resiliency techniques on adversarial threat events .......................................99

151

Table 4. Organization-defined parameters ...................................................................................... 104

152

Table 5. Change Log .................................................................................Error! Bookmark not defined.

153

List of Figures

154

Fig. 1. Multidimensional protection strategy .......................................................................................5

vii

NIST SP 800-172r3 fpd (Final Public Draft) September 2025

Enhanced Security Requirements for Protecting CUI

155

Acknowledgments

156 157 158 159 160 161 162 163 164 165 166

The authors gratefully acknowledge and appreciate the contributions from individuals and organizations in the public and private sectors whose constructive comments improved the overall quality, thoroughness, and usefulness of this publication. In particular, the authors wish to thank Jeffrey Eyink from the Department of Defense (DOD) Chief Information Office for his contributions to this update. The authors also wish to thank the NIST technical editing and production staff – Jim Foti, Jeff Brewer, Eduardo Takamura, Jeremy Licata, Isabel Van Wyk, and Cristina Ritfeld – for their outstanding support in preparing this document for publication. NIST also acknowledges the Howard County, MD mentoring program at Mt. Hebron High School in its ongoing commitment to developing the next generation of cybersecurity professionals. In particular, the authors recognize and thank Rithwik Puli for his outstanding contributions to the content in this publication.

167

Historical Contributions

168 169

The authors also acknowledge the following organizations and individuals for their historic contributions to this publication:

170 171

•

Organizations: Department of Defense, Institute for Defense Analyses, The MITRE Corporation

172

•

Individuals: Gary Guissanie, Ryan Wagner, Richard Graubart, Deb Bodeau

viii

NIST SP 800-172r3 fpd (Final Public Draft) September 2025

Enhanced Security Requirements for Protecting CUI

173

1. Introduction

174 175 176 177 178 179 180 181 182 183 184 185

Executive Order (EO) 13556 [1] established a government-wide program to standardize how the executive branch handles Controlled Unclassified Information (CUI). 1 EO 13556 required that the CUI program emphasize government-wide openness, transparency, and uniformity and that the program implementation take place in a manner consistent with Office of Management and Budget (OMB) policies and National Institute of Standards and Technology (NIST) standards and guidelines. The National Archives and Records Administration (NARA), as the CUI program Executive Agent, provides information, guidance, policy, and requirements on handling CUI [4]. This includes approved CUI categories and category descriptions, the basis for safeguarding and dissemination controls, and procedures for the use of CUI. 2 The CUI federal regulation provides guidance to federal agencies on the designation, safeguarding, marking, dissemination, decontrolling, and disposition of CUI; establishes self-inspection and oversight requirements; and delineates other facets of the program. [5]

186 187 188 189 190 191 192 193 194

The CUI regulation requires federal agencies that use federal information systems 3 to process, store, or transmit CUI to comply with NIST standards and guidelines. The responsibility of federal agencies to protect CUI does not change when such information is shared with nonfederal organizations. 4 Therefore, a similar level of protection is needed when CUI is processed, stored, or transmitted by nonfederal organizations using nonfederal systems. The requirements for protecting CUI in nonfederal systems and organizations must comply with Federal Information Processing Standards (FIPS) 199 [6] and FIPS 200 [7] to maintain a consistent level of protection. The requirements are derived from the controls in NIST Special Publication (SP) 800-53 [8].

195 196 197 198 199 200 201 202 203

In certain situations, CUI may be associated with a critical program 5 or a high value asset. 6 These programs and assets are potential targets for the advanced persistent threat (APT). An APT is an adversary or adversarial group that possesses the expertise and resources that allow it to create opportunities to achieve its objectives by using multiple attack vectors, including cyber, physical, and deception. These objectives include establishing and extending footholds within the systems of targeted organizations for the purpose of exfiltrating information; undermining or impeding critical aspects of a mission, function, program, or organization; or positioning itself to carry out these objectives in the future. The APT pursues its objectives repeatedly over an extended period, attempts to avoids detection, adapts to defenders’ efforts 1 CUI is any information that a law, regulation, or government-wide policy requires to have safeguarding or dissemination controls, excluding information that is classified under EO 13526 [2], or any predecessor or successor order, or the Atomic Energy Act [3] as amended. 2 Procedures for the use of CUI include marking, safeguarding, transporting, disseminating, reusing, and disposing of the information. 3 A federal information system is a system that is used or operated by an executive agency, by a contractor of an executive agency, or by another organization on behalf of an executive agency. Any system that does not meet the definition of a federal information system is designated as a nonfederal system. 4 A nonfederal organization is any entity that owns, operates, or maintains a nonfederal system.

5 The definition of a critical program may vary from organization to organization. For example, the Department of Defense defines a critical program as one that significantly increases capabilities and mission effectiveness or extends the expected effective life of an essential system or capability [9]. 6 See OMB Memorandum M-19-03 [10].

1

NIST SP 800-172r3 fpd (Final Public Draft) September 2025

Enhanced Security Requirements for Protecting CUI

204 205 206

to resist it, and is determined to maintain the level of interaction needed to execute its objectives. CUI associated with critical programs or high value assets is at increased risk and requires additional protection because the APT is likely to target such information.

207 208 209 210 211 212 213 214

The APT is dangerous to the national and economic security interests of the United States since organizations depend on systems 7 of all types, including information technology (IT) systems, operational technology (OT) systems, and (3) Internet of Things (IoT) devices. The convergence of these types of systems and devices has brought forth a new class of systems known as cyberphysical systems, many of which are in sectors of United States critical infrastructure, including energy, transportation, defense, manufacturing, healthcare, finance, and information and communications. Therefore, CUI that is processed, stored, or transmitted by any systems related to a critical program or high value asset requires additional protection from the APT.

215

1.1. Purpose and Applicability

216 217 218 219 220 221 222 223 224 225 226 227

This publication provides federal agencies with a set of recommended enhanced security requirements8 for protecting the confidentiality, integrity, and availability of CUI when such information is resident in nonfederal systems and organizations and where there are no specific safeguarding requirements prescribed by the authorizing law, regulation, or government-wide policy for the CUI category listed in the CUI registry [4].9 The enhanced security requirements address the protection of CUI by promoting penetration-resistant architecture, damage-limiting operations, and cyber resiliency. 10 The security requirements supplement the requirements in SP 800-171 [12] and apply to components 11 of nonfederal systems that process, store, or transmit CUI associated with a critical program or a high value asset or that provide protection for such components. The requirements are intended for use by federal agencies in contractual vehicles or other agreements that are established between those agencies and nonfederal organizations.

228 229 230 231 232 233

There are three types of enhanced security requirements in this publication: (1) requirements that enhance a security requirement in SP 800-171 [12]; (2) requirements that are sourced to security controls tailored out of the SP 800-53B [13] moderate baseline in SP 800-171; and (3) requirements that are not directly related to the security requirements in SP 800-171 but are can be used to strengthen the protection of CUI associated with critical programs or high value assets. The type of security requirement is noted in the discussion section of each requirement. 7 The term “system” is used to represent the people, processes, and technologies involved in the processing, storage, or transmission of CUI. 8 The term “requirements” is used in this guideline to describe the stakeholder protection needs of a particular system or organization.

Stakeholder protection needs and corresponding security requirements may be derived from many sources (e.g., laws, Executive Orders, directives, regulations, policies, standards, mission and business needs, or risk assessments). 9 Nonfederal organizations that collect or maintain information on behalf of a federal agency or that use or operate a system on behalf of an agency must comply with the requirements in FISMA [11]. 10 Protecting the integrity and availability of the means used to achieve confidentiality protection is within the scope of this publication. While outside of the explicit purpose of this publication, the APT may seek to harm organizations, individuals, or the Nation by compromising the integrity and availability of CUI upon which mission and business functions depend, such as software that is categorized as CUI. 11 System components include, but are not limited to, mainframes, workstations, servers, notebook computers, input and output devices, operating systems, network components, virtual machines, database management systems, firmware, applications, cyber-physical components (e.g., programmable logic controllers [PLC] or medical devices), and mobile devices (e.g., smartphones and tablets).

2

NIST SP 800-172r3 fpd (Final Public Draft) September 2025

Enhanced Security Requirements for Protecting CUI

234 235 236 237 238 239 240 241 242 243 244

Appropriately scoping security requirements is an important factor in determining protectionrelated investment decisions and managing security risks for nonfederal organizations. If nonfederal organizations designate specific system components to process, store, or transmit CUI associated with a critical program or a high value asset, those organizations may limit the scope of the security requirements by isolating the system components in a separate CUI security domain. Isolation can be achieved by applying architectural and design concepts (e.g., implementing subnetworks with firewalls, software-defined perimeters, micro-segmentation, zero trust network architectures, and information flow control mechanisms). Security domains may employ physical separation, logical separation, or a combination of both. This approach can provide adequate security for CUI and avoid increasing the organization’s security posture beyond what it requires to protect its missions, functions, operations, and assets.

245 246 247 248 249 250 251 252

This publication does not provide guidance on which organizational programs or assets are determined to be critical or of high value. Those determinations are made by the federal agencies mandating the use of the security requirements for additional protection and can be guided and informed by laws, Executive Orders, directives, regulations, or policies. Additionally, this publication does not provide guidance on specific types of threats or attack scenarios that justify the use of the security requirements. Finally, there is no expectation that all of the security requirements will be needed in every situation. Rather, requirements are selected by federal agencies based on mission needs and risk.

253

1.2. Organization of This Publication

254

The remainder of this publication is organized as follows:

255 256

•

Section 2 describes the assumptions and methodology used to develop the enhanced security requirements and the organization and structure of the requirements.

257 258

•

Section 3 lists the enhanced security requirements for protecting the confidentiality, integrity, and availability of CUI in nonfederal systems and organizations.

259

The following sections provide additional information to support the protection of CUI:

260

•

References

261

•

Appendix A: Acronyms

262

•

Appendix B: Glossary

263

•

Appendix C: Summary of Enhanced Security Requirements

264

•

Appendix D: Adversary Effects

265

•

Appendix E: Organization-Defined Parameters

266

•

Appendix F: Change Log

3

NIST SP 800-172r3 fpd (Final Public Draft) September 2025

Enhanced Security Requirements for Protecting CUI

267

2. The Fundamentals

268 269 270

This section describes the assumptions and methodology used to develop the enhanced security requirements for nonfederal systems and organizations to protect the confidentiality, integrity, and availability of CUI associated with critical systems or high value assets.

271

2.1. Enhanced Security Requirement Assumptions

272 273

The enhanced security requirements in this publication are based on the following assumptions:

274 275

•

Federal information that is designated as CUI has the same value whether such information resides in a federal or nonfederal system or organization.

276 277

•

Statutory and regulatory requirements for the protection of CUI are consistent in federal and nonfederal systems and organizations.

278 279

•

Safeguards implemented to protect CUI are consistent in federal and nonfederal systems and organizations.

280

•

The impact value for CUI is no less than moderate. 12

281 282

•

The security requirements in SP 800-171 [12] have been satisfied to provide the foundational level of protection for CUI.

283 284

•

Additional safeguards are necessary to protect CUI that is associated with critical programs or high value assets. 13

285 286

•

Nonfederal organizations can directly implement a variety of potential security solutions or use external service providers to satisfy the security requirements.

287

2.2. Enhanced Security Requirement Development Methodology

288 289

The enhanced security requirements provide the capability to achieve a multidimensional, defense-in-depth protection strategy [13] that includes:

290 291 292

•

Penetration-resistant architecture: An architecture that uses technology, engineering, and procedures to limit the opportunities for an adversary to compromise an organizational system and to achieve a persistent presence in the system.

293 294 295 296

•

Damage-limiting operations: Procedural and operational measures that use system capabilities to maximize the ability of an organization to detect successful system compromises by an adversary and to limit the effects of such compromises (both detected and undetected).

12 In accordance with 32 CFR 2002 [5], CUI is categorized at no less than the FIPS 199 [6] moderate confidentiality impact value. However, when federal law, regulation, or government-wide policy establishing the control of CUI specifies controls that differ from those of the moderate control baseline, then the applicable law, regulation, or government-wide policy is followed. 13 Additional protections are required to protect CUI that is associated with critical programs and high value assets because such information is more likely to be targeted by the APT and is, therefore, at greater risk.

4

NIST SP 800-172r3 fpd (Final Public Draft) September 2025

297 298 299 300 301 302 303 304 305 306 307 308

•

Enhanced Security Requirements for Protecting CUI

Cyber resiliency: The ability to anticipate, withstand, recover from, and adapt to adverse conditions, stresses, attacks, or compromises on systems that use or are enabled by cyber resources. Cyber resiliency is intended to enable organizational missions or business objectives that depend on cyber resources to be achieved in a contested cyber environment.

This strategy recognizes that the APT may find ways to compromise established defenses despite the best safeguards implemented by organizations. When this occurs, organizations must have access to additional safeguards to detect, outmaneuver, confuse, deceive, mislead, and impede the adversary — that is, removing the adversary’s tactical advantage and protecting the organization’s critical programs and high value assets. Figure 1 shows the complementary nature of the enhanced security requirements when they are implemented as part of a multidimensional protection strategy.

309 310 311 312 313 314 315 316 317 318 319 320 321 322 323 324 325

Enhanced Security Requirements Focus on the Advanced Persistent Threat

PenetrationResistant Architecture (PRA)

DamageLimiting Operations (DLO)

Cyber Resiliency (CRS)

Defense-inDepth Protection Strategy

NIST SP 800-172

Foundational Security Requirements NIST SP 800-171

326 327 328 329

Fig. 1. Multidimensional protection strategy

330 331 332 333

The enhanced security requirements are derived from the security controls and control enhancements in SP 800-53 [8]. The requirements address safeguards to protect CUI from the APT and ensure the cyber resiliency of systems and organizations. The security requirements focus on the following key elements, which are essential to addressing the APT:

334

•

Applying a threat-centric approach to security requirement specification

335 336

•

Employing system and security architectures that support logical and physical isolation using system and network segmentation techniques, virtual machines, and containers

5

NIST SP 800-172r3 fpd (Final Public Draft) September 2025

Enhanced Security Requirements for Protecting CUI

337

•

Implementing dual authorization controls for critical or sensitive operations

338

•

Limiting persistent storage to isolated enclaves or domains

339

•

Implementing a comply-to-connect approach for systems and networks

340 341

•

Extending configuration management requirements by establishing authoritative sources for addressing changes to systems and system components

342 343

•

Periodically refreshing or upgrading organizational systems and system components to a known state or developing new systems or components

344 345

•

Employing a security operations center with advanced analytics to support continuous monitoring and the protection of systems

346 347 348

•

Using deception to confuse and mislead adversaries regarding the information they use for decision-making, the value and authenticity of the information they attempt to exfiltrate, or the environment in which they are operating

349 350

Similar to the security requirements in SP 800-171 [12], the enhanced security requirements are organized into 17 families, as illustrated in Table 1.

351

Table 1. Enhanced security requirement families Access Control

Maintenance

Security Assessment and Monitoring

Awareness and Training

Media Protection

System and Communications Protection

Audit and Accountability

Personnel Security

System and Information Integrity

Configuration Management

Physical Protection

Planning

Identification and Authentication

Risk Assessment

System and Services Acquisition

Incident Response

Supply Chain Risk Management

352 353 354 355 356 357 358 359

Each family contains the security requirements related to the general security topic of the family. 14 The structure of the security requirements is the same as the requirements in SP 800171 [12]. The enhanced security requirements are distinguished from the security requirements in SP 800-171 by appending the letter “E” to the requirement numbers. However, the sequential numbering of enhanced security requirements in SP 800-172 does not mean that an enhanced security requirement (e.g., 03.01.01E) is an enhancement to the similarly numbered requirement (e.g., 03.01.01) in SP 800-171.

360 361 362 363 364

Organization-defined parameters (ODPs) are used in certain enhanced security requirements. ODPs provide flexibility through the use of assignment and selection operations to allow federal agencies and nonfederal organizations to specify values for the designated parameters in the requirements. 15 Assignment and selection operations provide the capability to customize the enhanced security requirements based on specific protection needs. The determination of ODP Certain enhanced security requirements may not align with the families in SP 800-53 [8]. NIST does not establish or assign values for ODPs. If ODP values for selected security requirements are not formally established or assigned by a federal agency or a consortium of federal agencies, nonfederal organizations must assign those values to complete the requirements. 14 15

6

NIST SP 800-172r3 fpd (Final Public Draft) September 2025

Enhanced Security Requirements for Protecting CUI

365 366 367 368 369 370 371 372 373 374

values can be guided and informed by laws, Executive Orders, directives, regulations, policies, standards, guidance, or mission and business needs. Once specified, the values for the ODPs become part of the requirement. A discussion section is included with each requirement. It is derived from the control discussion section in SP 800-53 [8] and provides additional information to facilitate the implementation and assessment of the requirement. The discussion section is informative, not normative. It is not intended to extend the scope of a requirement or influence the solutions that organizations may implement to satisfy a requirement. The use of examples is notional, not exhaustive, and does not reflect the potential options available to organizations. If applicable, the security requirement in SP 800-171 [12] that is enhanced by the requirement is noted in this section.

375 376 377

A protection strategy section describes which of the three elements of the multidimensional protection strategy (i.e., penetration-resistant architecture [PRA], damage-limiting operations [DLO], and cyber resiliency [CRS]) are addressed by the enhanced security requirement.

378 379 380 381 382 383

An adversary effects section describes the potential effects of implementing the enhanced security requirement on risk, specifically by reducing the likelihood of the occurrence of threat events, the ability of threat events to cause harm, and the extent of that harm. Five desired effects on the adversary can be identified: redirect, preclude, impede, limit, and expose. Each adversary effect is further decomposed to include specific impacts on risk and expected results. The adversary effects are described in SP 800-160v2, (Volume 2) [13] and in Appendix D.

384 385 386 387 388

Finally, a references section lists the source controls 16 from SP 800-53 [8] that are associated with the enhanced security requirement. The hyperlink associated with each control provides access to the NIST Cybersecurity and Privacy Reference Tool (CPRT),17 which includes references to a variety of supporting technical publications. The structure and content of an enhanced security requirement is provided in the example below.

389

03.13.08E Decoys

390 391

Use components within organizational systems specifically designed to be the target of malicious attacks for detecting, deflecting, and analyzing such attacks.

392

DISCUSSION

393 394 395 396 397 398

Decoys (i.e., honeypots, honeynets, or deception nets) are established to attract adversaries and deflect attacks away from the operational systems that support organizational missions and business functions. The use of decoys requires some supporting isolation measures to ensure that any deflected malicious code does not infect organizational systems. This requirement does not enhance a specific requirement in SP 800-171 but can be used to strengthen the protection of CUI associated with critical programs or high value assets.

399

PROTECTION STRATEGY

400

DLO, CRS With few exceptions, the security controls in SP 800-53 [8] are policy-, technology-, and sector-neutral, meaning that the controls focus on the fundamental measures necessary to protect information across the information life cycle. 17 The final version of SP 800-172r3 and SP 800-172Ar3 will be also be available on CPRT. 16

7

NIST SP 800-172r3 fpd (Final Public Draft) September 2025

401

ADVERSARY EFFECTS

402

Expose (Detect), Limit (Reduce)

403

REFERENCES

404

Source Control: SC-26

Enhanced Security Requirements for Protecting CUI

405

2.3. Enhanced Security Requirement Selection

406 407 408 409 410 411

Organizations18 can select the enhanced security requirements either comprehensively or selectively as part of their overarching risk management strategy. However, there are dependencies among certain requirements that may affect the selection process. The decision to select specific enhanced security requirements is based on the mission and business needs of the federal agency, group of agencies, or the Federal Government (i.e., federal entity) and is guided and informed by ongoing assessments of risk.

412 413 414 415 416

Federal agencies may limit application as long as the needed protection is achieved, such as by applying the enhanced security requirements to the components of nonfederal systems that process, store, or transmit CUI that is associated with a critical program or high value asset; provide protection for such components; or provide a direct attack path to such components (e.g., due to established trust relationships between system components). 19

417 418 419 420 421 422

The security requirements for a nonfederal system processing, storing, or transmitting CUI that is associated with a critical program or a high value asset are conveyed to the nonfederal organization by the federal entity in a contract, grant, or other agreement. The implementation guidance associated with the security requirements is beyond the scope of this publication. Organizations have flexibility in the methods, techniques, technologies, and approaches used to satisfy the requirements. 20

18 The term “organization” is context-dependent. For example, in an enhanced security requirement with an ODP, organization can refer to the federal agency or the nonfederal organization that establishes the parameter values for the requirement. 19 System components include mainframes, workstations, servers, input and output devices, network components, operating systems, virtual machines, applications, cyber-physical components (e.g., programmable logic controllers [PLC] or medical devices), and mobile devices (e.g., smartphones and tablets). 20 Implementation guidance can be included in the contractual vehicles or other agreements established between federal agencies and nonfederal organizations.

8

NIST SP 800-172r3 fpd (Final Public Draft) September 2025

Enhanced Security Requirements for Protecting CUI

423

3. The Requirements

424 425 426 427 428 429 430 431 432 433

This section describes enhanced security requirements that are designed to protect the confidentiality, integrity, and availability of CUI in nonfederal systems and organizations. The enhanced security requirements are not required for any particular category or article of CUI. However, if a federal agency determines that CUI is associated with a critical program or a high value asset, the CUI and the system that processes, stores, or transmits such information are potential targets for the APT and, therefore, may require increased protection. Such protection is expressed through the enhanced security requirements and is mandated by a federal agency in a contract, grant, or other agreement. The enhanced security requirements are selected either comprehensively or selectively in addition to the foundational requirements in SP 800171 [12].

434 435 436 437 438 439 440 441

Enhanced security requirements support one or more protection strategies with potential effects on adversaries. The strategies and adversary effects are included in the supplementary information for each enhanced security requirement to assist organizations in ascertaining whether the requirement is appropriate. Ideally, the selected requirements should be balanced across the three protection strategies. Selecting requirements that fall exclusively in one area could result in an unbalanced response strategy for dealing with the APT. Similarly , organizations should attempt to have as broad a set of effects on an adversary as possible, given their specific mission or business objectives.

442 443

Certain security requirements have been withdrawn because they are no longer relevant, or they are covered by other requirements in SP 800-171 [12] and this publication.

ENHANCED SECURITY REQUIREMENT ASSESSMENT SP 800-172A provides a set of procedures to assess the security requirements described in this publication. The assessment procedures are based on the procedures described in SP 800-53A [15].

444 445

3.1. Access Control

446

03.01.01E Dual Authorization

447 448

Enforce dual authorization for [Assignment: organization-defined privileged commands and/or other organization-defined actions].

449

DISCUSSION

450 451 452 453

Dual authorization is also known as two-person control. Dual authorization reduces risk related to insider threats, including adversaries who have obtained credentials. Dual authorization requires the approval of two authorized individuals to execute privileged commands and/or other organizational actions that may affect the 9

NIST SP 800-172r3 fpd (Final Public Draft) September 2025

Enhanced Security Requirements for Protecting CUI

454 455 456 457 458

protection of CUI. To reduce the risk of collusion, organizations consider rotating dual authorization duties to other individuals. Organizations also consider the risk associated with implementing dual authorization when immediate responses are necessary to ensure public and environmental safety. This requirement enhances SP 800-171 requirement 03.01.02.

459

PROTECTION STRATEGY

460

PRA

461

ADVERSARY EFFECTS

462

Preclude (Preempt), Impede (Exert)

463

REFERENCES

464

Source Control: AC-03(02)

465

03.01.02E Non-Organizationally Owned Systems - Restricted Use

466 467

Restrict the use of non-organizationally owned systems or system components to process, store, or transmit CUI using [Assignment: organization-defined restrictions].

468

DISCUSSION

469 470 471 472 473 474 475 476 477 478 479 480 481 482

Non-organizationally owned systems or system components include systems or system components owned by other organizations as well as personally owned devices. These also include systems and system components that are leased, part of subscription services, government-furnished equipment, or “bring your own” devices. There are risks to using non-organizationally owned systems or components. In some cases, the risk is sufficiently high as to prohibit such use. In other cases, the use of such systems or system components may be allowed but restricted in some way. Restrictions include requiring the implementation of approved safeguards prior to authorizing connections to non-organizationally owned systems and components; limiting access to types of information, services, or applications; using virtualization techniques to limit processing and storage activities to system components that are provisioned by the organization; and agreeing to the terms and conditions for usage. This requirement enhances SP 800-171 requirement 03.01.20.

483

PROTECTION STRATEGY

484

PRA

485

ADVERSARY EFFECTS

486

Preclude (Preempt), Impede (Contain, Exert)

10

NIST SP 800-172r3 fpd (Final Public Draft) September 2025

487

REFERENCES

488

Source Control: AC-20(03)

489 490 491

Enhanced Security Requirements for Protecting CUI

03.01.03E Withdrawn Addressed by 03.01.09E, 03.01.10E, and 03.01.03 (SP 800-171). 03.01.04E Concurrent Session Control

492 493

Limit the number of concurrent sessions for each [Assignment: organization-defined account and/or account type] to [Assignment: organization-defined number].

494

DISCUSSION

495 496 497 498 499 500 501 502 503

Organizations may define the maximum number of concurrent sessions for system accounts globally, by account type, by account, or any combination thereof. For example, organizations may limit the number of concurrent sessions for system administrators or other individuals working in particularly sensitive domains or mission-critical applications. Concurrent session control addresses concurrent sessions for system accounts. It does not, however, address concurrent sessions by single users via multiple system accounts. This requirement does not enhance a specific requirement in SP 800-171 but can be used to strengthen the protection of CUI associated with critical programs or high value assets.

504

PROTECTION STRATEGY

505

PRA

506

ADVERSARY EFFECTS

507

Preclude (Preempt), Impede (Contain, Exert)

508

REFERENCES

509

Source Control: AC-10

510

03.01.05E Remote Access Monitoring and Control

511

Employ automated mechanisms to monitor and control remote access methods.

512

DISCUSSION

513 514 515 516 517

Monitoring and controlling remote access methods allows organizations to detect attacks and ensure compliance with remote access policies. This is accomplished by auditing the connection activities of remote users on system components, including servers, notebook computers, workstations, smart phones, tablets, and wearables. This requirement enhances SP 800-171 requirement 03.01.02.

11

NIST SP 800-172r3 fpd (Final Public Draft) September 2025

518

PROTECTION STRATEGY

519

PRA, DLO

520

ADVERSARY EFFECTS

521

Preclude (Preempt), Impede (Exert)

522

REFERENCES

523

Source Control: AC-17(01)

524

Enhanced Security Requirements for Protecting CUI

03.01.06E Protection of Remote Access Mechanism Information

525 526

Protect information about remote access mechanisms from unauthorized use and disclosure.

527

DISCUSSION

528 529 530 531 532 533

Access to organizational information about remote access mechanisms by nonorganizational entities can increase the risk of unauthorized use and disclosure. The organization considers including remote access requirements in the information exchange agreements with other organizations, as applicable. Remote access requirements can also be included in rules of behavior and access agreements. This requirement enhances SP 800-171 requirement 03.01.12.

534

PROTECTION STRATEGY

535

PRA

536

ADVERSARY EFFECTS

537

Preclude (Preempt), Impede (Exert)

538

REFERENCES

539

Source Control: AC-17(06)

540

03.01.07E Automated Audit Actions for Account Management

541 542

Use automated mechanisms to audit account creation, modification, enabling, disabling, and removal actions.

543

DISCUSSION

544 545 546 547 548

The use of automated mechanisms to audit account management activities provides more timely and comprehensive data to guide and inform needed actions by system administrators. Security information and event management (SIEM) tools can help automate account management activities. This requirement enhances SP 800-171 requirement 03.01.01. 12

NIST SP 800-172r3 fpd (Final Public Draft) September 2025

Enhanced Security Requirements for Protecting CUI

549

PROTECTION STRATEGY

550

PRA, DLO

551

ADVERSARY EFFECTS

552

Preclude (Preempt), Impede (Exert)

553

REFERENCES

554

Source Control: AC-02(04)

555

03.01.08E Account Monitoring for Atypical Usage

556

a. Monitor system accounts for [Assignment: organization-defined atypical usage].

557 558

b. Report atypical usage of system accounts to [Assignment: organization-defined personnel or roles].

559

DISCUSSION

560 561 562 563

Atypical usage includes accessing systems at certain times of the day or from locations that are not consistent with the normal usage patterns of individuals. Monitoring for atypical usage may reveal rogue behavior by individuals or an attack in progress. This requirement enhances SP 800-171 requirement 03.01.01.

564

PROTECTION STRATEGY

565

DLO

566

ADVERSARY EFFECTS

567

Expose (Detect)

568

REFERENCES

569

Source Control: AC-02(12)

570

03.01.09E Attribute-Based Access Control

571

a. Enforce attribute-based access control policy over defined subjects and objects.

572 573

b. Control access based upon [Assignment: organization-defined attributes to assume access permissions].

574

DISCUSSION

575 576 577 578

Attribute-based access control is an access control policy that restricts system access to authorized users based on specified organizational attributes (e.g., job function, role, identity), action attributes (e.g., read, write, delete), environmental attributes (e.g., time of day, location), and resource attributes (e.g., document classification).

13

NIST SP 800-172r3 fpd (Final Public Draft) September 2025

Enhanced Security Requirements for Protecting CUI

579 580 581 582 583 584 585 586

Organizations can create rules based on specified attributes and the authorizations (i.e., privileges) to perform needed operations on the systems associated with organization-defined attributes and rules. When users are assigned to attributes defined in attribute-based access control policies or rules, they can be provisioned to a system with the appropriate privileges or dynamically granted access to a protected resource. Attribute-based access control can be implemented as either a mandatory or discretionary form of access control. This requirement enhances SP 800-171 requirement 03.01.02.

587

PROTECTION STRATEGY

588

PRA

589

ADVERSARY EFFECTS

590

Preclude (Preempt), Impede (Exert)

591

REFERENCES

592

Source Control: AC-03(13)

593

03.01.10E Object Security Attributes

594 595 596 597

Use [Assignment: organization-defined security attributes] associated with [Assignment: organization-defined information, source, and destination objects] to enforce [Assignment: organization-defined information flow control policies] as a basis for flow control decisions.

598

DISCUSSION

599 600 601 602 603 604 605 606 607 608 609 610 611 612 613

Organizations implement information flow control policies and enforcement mechanisms to control the flow of CUI between designated sources and destinations within systems and between connected systems. Flow control is based on the characteristics of the information and/or the information path. Enforcement occurs, for example, in boundary protection devices that employ rule sets or establish configuration settings that restrict system services, provide a packet-filtering capability based on header information, or provide a message-filtering capability based on message content. Information flow enforcement mechanisms compare the security attributes associated with information (i.e., data content and structure) and source and destination objects and respond appropriately when the enforcement mechanisms encounter information flows that are not explicitly allowed by information flow policies. Security attributes can also include source and destination addresses employed in traffic filter firewalls. Flow enforcement using explicit security attributes can be used, for example, to control the release of certain types of information. This requirement enhances SP 800-171 requirement 03.01.03.

614

PROTECTION STRATEGY 14

NIST SP 800-172r3 fpd (Final Public Draft) September 2025

615

PRA

616

ADVERSARY EFFECTS

617

Preclude (Preempt), Impede (Exert)

618

REFERENCES

619

Source Control: AC-04(01)

620

03.01.11E Role-Based Access Control

Enhanced Security Requirements for Protecting CUI

621

a. Enforce a role-based access control policy over defined subjects and objects.

622 623

b. Control access based upon [Assignment: organization-defined roles and users authorized to assume such roles].

624

DISCUSSION

625 626 627 628 629 630 631 632 633 634 635 636 637

Role-based access control (RBAC) is an access control policy that enforces access to objects and system functions based on the defined role (i.e., job function) of the subject. Organizations can create specific roles based on job functions and the authorizations (i.e., privileges) to perform needed operations on the systems associated with the organization-defined roles. When users are assigned to specific roles, they inherit the authorizations or privileges defined for those roles. RBAC simplifies privilege administration for organizations because privileges are not assigned directly to every user (which can be a large number of individuals) but are instead acquired through role assignments. RBAC can also increase security risks if individuals assigned to a role are given access to information beyond what they need to support organizational mission or business functions. RBAC can be implemented as a mandatory or discretionary form of access control. This requirement enhances SP 800-171 requirement 03.01.02.

638

PROTECTION STRATEGY

639

PRA

640

ADVERSARY EFFECTS

641

Preclude (Preempt), Impede (Exert)

642

REFERENCES

643

Source Control: AC-03(07)

644 645 646

03.01.12E Physical or Logical Separation of CUI Flows Separate CUI flows logically or physically using [Assignment: organization-defined mechanisms and/or techniques]. 15

NIST SP 800-172r3 fpd (Final Public Draft) September 2025

Enhanced Security Requirements for Protecting CUI

647

DISCUSSION

648 649 650 651

Enforcing the separation of information flows associated with defined types of data can enhance protection by ensuring that CUI is not commingled while in transit and by enabling flow control by transmission paths that are not otherwise achievable. This requirement enhances SP 800-171 requirement 03.01.03.

652

PROTECTION STRATEGY

653

PRA

654

ADVERSARY EFFECTS

655

Preclude (Preempt), Impede (Exert)

656

REFERENCES

657

Source Control: AC-04(21)

658

03.01.13E Metadata

659 660

Enforce information flow control based on [Assignment: organization-defined metadata].

661

DISCUSSION

662 663 664 665 666 667 668 669 670 671

Metadata is information that describes the characteristics of data. Metadata can include structural metadata that describes data structures or descriptive metadata that describes data content. The enforcement of allowed information flows based on metadata enables simpler and more effective flow control. Organizations consider the trustworthiness of metadata regarding data accuracy (i.e., knowledge that the metadata values are correct with respect to the data), data integrity (i.e., protecting against unauthorized changes to metadata tags), and the binding of metadata to the data payload (i.e., employing sufficiently strong binding techniques with appropriate assurance). This requirement enhances SP 800-171 requirement 03.01.03.

672

PROTECTION STRATEGY

673

PRA

674

ADVERSARY EFFECTS

675

Preclude (Preempt), Impede (Exert)

16

NIST SP 800-172r3 fpd (Final Public Draft) September 2025

676

REFERENCES

677

Source Control: AC-04(06)

678

Enhanced Security Requirements for Protecting CUI

03.01.14E Security Policy Filters

679 680 681

a. Enforce information flow control using [Assignment: organization-defined security policy filters] as a basis for flow control decisions for [Assignment: organization-defined information flows].

682 683 684

b. [Selection (one or more): Block; Strip; Modify; Quarantine] data after a filter processing failure in accordance with [Assignment: organization-defined security policy].

685

DISCUSSION

686 687 688 689 690 691 692 693 694 695 696

Security policy filters for data structures check for maximum file lengths, maximum field sizes, and data/file types for structured and unstructured data. Security policy filters for data content check for specific words, enumerated values or data value ranges, and hidden content. Structured data permits the interpretation of data content by applications. Unstructured data refers to digital information without a data structure or with a data structure that does not facilitate the development of rule sets to address the criticality or sensitivity of information conveyed by the data or the flow enforcement decisions. Unstructured data consists of bitmap objects that are inherently non-language-based (e.g., image, video, or audio files) and textual objects that are based on written or printed languages. This requirement enhances SP 800-171 requirement 03.01.03.

697

PROTECTION STRATEGY

698

PRA

699

ADVERSARY EFFECTS

700

Preclude (Preempt), Impede (Exert)

701

REFERENCES

702

Source Control: AC-04(08)

703 704 705 706

03.01.15E Data Type Identifiers Use [Assignment: organization-defined data type identifiers] to validate data that is essential for information flow decisions when transferring CUI between security domains.

17

NIST SP 800-172r3 fpd (Final Public Draft) September 2025

Enhanced Security Requirements for Protecting CUI

707

DISCUSSION

708 709 710 711 712 713 714 715

Data type identifiers include filenames, file types, file signatures or tokens, and multiple internal file signatures or tokens. Systems only allow for the transfer of data that is compliant with data type format specifications. The identification and validation of data types is based on defined specifications associated with each allowed data format. The filename and number alone are not used for data type identification. Content is validated syntactically and semantically against its specification to ensure that it is the proper data type. This requirement enhances SP 800-171 requirement 03.01.03.

716

PROTECTION STRATEGY

717

PRA

718

ADVERSARY EFFECTS

719

Preclude (Preempt), Impede (Exert)

720

REFERENCES

721

Source Control: AC-04(12)

722

03.01.16E Decomposition Into Policy-Relevant Subcomponents

723 724 725

Decompose CUI into [Assignment: organization-defined policy-relevant subcomponents] for submission to policy enforcement mechanisms when transferring CUI between different security domains.

726

DISCUSSION

727 728 729 730 731 732 733

Decomposing CUI into policy-relevant subcomponents prior to information transfer facilitates policy decisions on source, destination, certificates, and other securityrelated component differentiators. Policy enforcement mechanisms apply filtering, inspection, and/or sanitization rules to the policy-relevant subcomponents of information to facilitate flow enforcement prior to transferring such information to different security domains. This requirement enhances SP 800-171 requirement 03.01.03.

734

PROTECTION STRATEGY

735

PRA

736

ADVERSARY EFFECTS

737

Preclude (Preempt), Impede (Exert)

738

REFERENCES

739

Source Control: AC-04(13) 18

NIST SP 800-172r3 fpd (Final Public Draft) September 2025

740

Enhanced Security Requirements for Protecting CUI

03.01.17E Detection of Unsanctioned CUI

741 742

a. Examine CUI for the presence of [Assignment: organization-defined unsanctioned information] when transferring information between different security domains.

743 744

b. Prohibit the transfer of the CUI defined in 03.01.17E.a in accordance with the [Assignment: organization-defined security policy].

745

DISCUSSION

746 747 748 749

Unsanctioned information includes malicious code, information that is inappropriate for release from the source network, or executable code that could disrupt or harm services or systems on the destination network. This requirement enhances SP 800171 requirement 03.01.03.

750

PROTECTION STRATEGY

751

PRA

752

ADVERSARY EFFECTS

753

Preclude (Preempt), Impede (Exert)

754

REFERENCES

755

Source Control: AC-04(15)

756

3.2. Awareness and Training

757

03.02.01E Advanced Literacy and Awareness Training

758

a. Provide security literacy training to system users:

759

1. On the advanced persistent threat,

760 761 762

2. On recognizing suspicious communications and anomalous behavior in systems using [Assignment: organization-defined indicators of malicious code], and

763

3. On the cyber threat environment.

764 765

b. Update security literacy training content [Assignment: organization-defined frequency] and following [Assignment: organization-defined events].

766

DISCUSSION

767 768 769 770 771

An effective way to detect APTs, address the cyber threat environment, and preclude successful attacks is to provide specific literacy training for individuals. Threat literacy training includes educating individuals on the various ways that APTs can infiltrate the organization (e.g., through websites, emails, pop-ups, articles, and social engineering) and describes techniques for recognizing suspicious emails, the 19

NIST SP 800-172r3 fpd (Final Public Draft) September 2025

Enhanced Security Requirements for Protecting CUI

772 773 774 775 776 777 778 779 780 781

use of removable systems in non-secure settings, and the potential targeting of individuals at home. Personnel are also trained on what constitutes suspicious communications and how to respond to such communications. Training personnel on how to recognize anomalous behaviors in systems can provide organizations with early warning of the presence of malicious code. Recognizing anomalous behavior in systems can supplement the malicious code detection and protection tools and systems used by organizations. Since threats continue to change over time, threat literacy training is dynamic. Moreover, threat literacy training is not performed in isolation from the system operations that support organizational missions and business functions. This requirement enhances SP 800-171 requirement 03.02.01.

782

PROTECTION STRATEGY

783

DLO, PRA

784

ADVERSARY EFFECTS

785

Preclude (Preempt), Expose (Detect)

786

REFERENCES

787

Source Controls: AT-02(04), AT-02(05), AT-02(06)

788

03.02.02E Literacy and Awareness Training Practical Exercises

789

Provide practical exercises in literacy training that simulate events and incidents.

790

DISCUSSION

791 792 793 794

Practical exercises include no-notice social engineering attempts to collect information, gain unauthorized access, or simulate the adverse impact of opening malicious email attachments or invoking malicious web links via spear phishing attacks. This requirement enhances SP 800-171 requirement 03.02.01.

795

PROTECTION STRATEGY

796

DLO

797

ADVERSARY EFFECTS

798

Preclude (Preempt), Expose (Detect)

799

REFERENCES

800

Source Control: AT-02(01)

20

NIST SP 800-172r3 fpd (Final Public Draft) September 2025

801

Enhanced Security Requirements for Protecting CUI

03.02.03E Literacy and Awareness Training Feedback

802 803

Provide feedback on organizational training results to the following personnel [Assignment: organization-defined personnel].

804

DISCUSSION

805 806 807 808 809 810 811

Training feedback includes literacy and role-based training results, which can indicate a potentially serious problem, especially the failures of personnel in critical roles. Managers should be made aware of such situations so that they can respond accordingly. Training feedback supports the evaluation and update of organizational training content and methodology. This requirement does not enhance a specific requirement in SP 800-171 but can be used to strengthen the protection of CUI associated with critical programs or high value assets.

812

PROTECTION STRATEGY

813

DLO

814

ADVERSARY EFFECTS

815

Preclude (Preempt), Expose (Detect)

816

REFERENCES

817

Source Control: AT-06

818

03.02.04E Anti-Counterfeit Training

819 820

Train [Assignment: organization-defined personnel or roles] to detect counterfeit system components.

821

DISCUSSION

822 823 824

System components include hardware, software, and firmware components as well as the documentation for those components. This requirement is sourced to a control tailored out of the SP 800-53B [13] moderate baseline in SP 800-171.

825

PROTECTION STRATEGY

826

DLO

827

ADVERSARY EFFECTS

828

Preclude (Preempt), Expose (Detect)

829

REFERENCES

830

Source Control: SR-11(01)

21

NIST SP 800-172r3 fpd (Final Public Draft) September 2025

Enhanced Security Requirements for Protecting CUI

831

3.3. Audit and Accountability

832

03.03.01E Protection of Audit Record Storage in Separate Physical Systems or Components

833 834

Store audit records in a repository that is part of a physically different system or system component than the system or component being audited.

835

DISCUSSION

836 837 838 839 840 841 842 843

Storing audit records in a repository that is separate from the audited system or system component helps to ensure that a compromise of the system being audited does not also result in a compromise of the audit records. Storing audit records on separate physical systems or components preserves the confidentiality, integrity, and availability of audit records and facilitates the management of audit records as an organization-wide activity. Storing audit records on separate systems or system components applies to the initial generation and backup or long-term storage of audit records. This requirement enhances SP 800-171 requirement 03.03.08.

844

PROTECTION STRATEGY

845

DLO

846

ADVERSARY EFFECTS

847

Preclude (Preempt), Impede (Exert)

848

REFERENCES

849

Source Control: AU-09(02)

850

03.03.02E Real-Time Alerts for Audit Processing Failures

851 852 853 854

Provide an alert within [Assignment: organization-defined real-time period] to [Assignment: organization-defined personnel, roles, and/or locations] when the following audit failure events occur: [Assignment: organization-defined audit logging failure events requiring real-time alerts].

855

DISCUSSION

856 857 858 859

Alerts provide organizations with urgent messages. Real-time alerts provide these messages at information technology speed (i.e., the time from event detection to alert occurs in seconds or less). This requirement enhances SP 800-171 requirement 03.03.04.

860

PROTECTION STRATEGY

861

DLO

22

NIST SP 800-172r3 fpd (Final Public Draft) September 2025

862

ADVERSARY EFFECTS

863

Preclude (Preempt), Impede (Exert)

864

REFERENCES

865

Source Control: AU-05(02)

866

Enhanced Security Requirements for Protecting CUI

03.03.03E Dual Authorization for Audit Information and Actions

867 868

Enforce dual authorization for [Selection (one or more): movement; deletion] of [Assignment: organization-defined audit information].

869

DISCUSSION

870 871 872 873 874 875 876 877 878 879

Dual authorization is also known as two-person control since it requires the approval of two authorized individuals to reduce the risk related to insider threat when executing audit functions. Dual authorization reduces risks related to insider threats, including adversaries who have obtained credentials. Organizations may choose different selection options for different types of audit information. To reduce the risk of collusion, organizations consider rotating dual authorization duties to other individuals. Organizations consider the risk associated with implementing dual authorization when immediate responses are necessary to ensure public and environmental safety. This requirement enhances SP 800-171 requirement 03.03.08. It is also related to requirement 03.01.01E.

880

PROTECTION STRATEGY

881

PRA, DLO

882

ADVERSARY EFFECTS

883

Preclude (Preempt), Impede (Exert)

884

REFERENCES

885

Source Control: AU-09(05)

886

03.03.04E Integrated Analysis of Audit Records

887 888 889 890 891

Integrate analysis of audit records with analysis of [Selection (one or more): vulnerability scanning information; performance data; system monitoring information; [Assignment: organization-defined data/information collected from other sources]] to further enhance the ability to identify inappropriate or unusual activity.

892

DISCUSSION

893

Integrated analysis of audit records requires that the analysis of information 23

NIST SP 800-172r3 fpd (Final Public Draft) September 2025

Enhanced Security Requirements for Protecting CUI

894 895 896 897 898 899 900 901 902 903 904 905 906 907

generated by scanning, monitoring, or other data collection activities is integrated with the analysis of audit record information. Security information and event management (SIEM) tools can facilitate audit record aggregation or consolidation from multiple system components as well as audit record correlation and analysis. The use of standardized audit record analysis scripts developed by organizations (with localized script adjustments, as necessary) provides more cost-effective approaches to analyzing audit record information. The correlation of audit record information with vulnerability scanning information is important in determining the veracity of vulnerability scans of the system and in correlating attack detection events with scanning results. Correlation with performance data can uncover denialof-service (DoS) attacks or other types of attacks that result in the unauthorized use of resources. Correlation with system monitoring information can also assist in uncovering attacks and relating audit information to operational situations. This requirement enhances SP 800-171 requirement 03.03.05.

908

PROTECTION STRATEGY

909

DLO

910

ADVERSARY EFFECTS

911

Preclude (Preempt), Expose (Detect)

912

REFERENCES

913

Source Control: AU-06(05)

914

3.4. Configuration Management

915

03.04.01E Withdrawn

916 917 918

Addressed by 03.04.08E, 03.14.04E, 03.17.03E, 03.17.04E, 03.17.05E, 03.04.01 (SP 800-171), 03.04.03 (SP 800-171), and 03.04.10 (SP 800-171). 03.04.02E Automated Unauthorized Component Detection

919 920

a. Detect the presence of unauthorized or misconfigured system components using [Assignment: organization-defined automated mechanisms].

921 922 923 924

b. Take the following actions when unauthorized or misconfigured components are detected: [Selection (one or more): disable network access by such components; isolate the components; notify [Assignment: organization-defined personnel or roles]].

24

NIST SP 800-172r3 fpd (Final Public Draft) September 2025

Enhanced Security Requirements for Protecting CUI

925

DISCUSSION

926 927 928 929 930 931 932 933 934 935 936 937

Monitoring for unauthorized or misconfigured components may be accomplished on an ongoing basis or by the periodic scanning of systems for that purpose. Automated mechanisms may also be used to prevent the connection of unauthorized or misconfigured system components. Automated mechanisms can be implemented in systems or in separate system components. When acquiring and implementing automated mechanisms, organizations consider whether such mechanisms depend on the ability of the system component to support an agent or supplicant in order to be detected since some types of components do not have or cannot support agents (e.g., IoT devices, sensors). Isolation can be achieved, for example, by placing unauthorized system components in separate domains or subnets or quarantining such components. This type of component isolation is commonly referred to as “sandboxing.” This requirement enhances SP 800-171 requirement 03.04.10.

938

PROTECTION STRATEGY

939

PRA, DLO

940

ADVERSARY EFFECTS

941

Preclude (Expunge, Preempt); Impede (Contain); Expose (Detect)

942

REFERENCES

943

Source Control: CM-06(01); CM-06(02); CM-08(03)

944

03.04.03E Automated Maintenance of System Component Inventory

945 946 947

Maintain the currency, completeness, accuracy, and availability of the inventory of system components using [Assignment: organization-defined automated mechanisms].

948

DISCUSSION

949 950 951 952 953 954 955 956 957 958 959 960

The system component inventory includes system-specific information required for component accountability and to provide support to identify, control, monitor, and verify configuration items based on the authoritative source. The information necessary for the accountability of system components includes the system name, hardware and software component owners, hardware inventory specifications, software license information, software version numbers, and—for networked components—the machine names and network addresses. Inventory specifications include the manufacturer, supplier information, component type, date of receipt, cost, model, serial number, and physical location. System component inventory information can include historic versioning of the information that can be used to track changes in the inventory and its ownership over the lifecycle of the system component inventory. Organizations also use automated mechanisms to implement

25

NIST SP 800-172r3 fpd (Final Public Draft) September 2025

Enhanced Security Requirements for Protecting CUI

961 962 963 964 965 966

and maintain authoritative (i.e., up-to-date, complete, accurate, and available) baseline configurations for systems that include hardware and software inventory tools, configuration management tools, and network management tools. Tools can be used to track version numbers on operating systems, applications, types of software installed, and current patch levels. This requirement enhances SP 800-171 requirement 03.04.10.

967

PROTECTION STRATEGY

968

PRA, DLO

969

ADVERSARY EFFECTS

970

Preclude (Preempt), Impede (Exert), Expose (Detect)

971

REFERENCES

972

Source Control: CM-08(02)

973

03.04.04E Automation Support for Baseline Configuration

974 975 976

Maintain the currency, completeness, accuracy, and availability of the baseline configuration of the system using [Assignment: organization-defined automated mechanisms].

977

DISCUSSION

978 979 980 981 982 983 984 985 986

Automated mechanisms that help organizations maintain consistent baseline configurations for systems include configuration management tools; hardware, software, and firmware inventory tools; and network management tools. Automated tools can be used to track version numbers on operating systems, applications, the types of software installed, and current patch levels. Automation support for accuracy and currency can be satisfied by the implementation of 03.04.03E for organizations that combine system component inventory and baseline configuration activities. This requirement enhances SP 800-171 requirement 03.04.01.

987

PROTECTION STRATEGY

988

PRA, DLO

989

ADVERSARY EFFECTS

990

Preclude (Preempt), Impede (Exert), Expose (Detect)

991

REFERENCES

992

Source Control: CM-02(02)

26

NIST SP 800-172r3 fpd (Final Public Draft) September 2025

993

Enhanced Security Requirements for Protecting CUI

03.04.05E Dual Authorization for System Changes

994 995

Enforce dual authorization for implementing changes to [Assignment: organizationdefined system components and system-level information].

996

DISCUSSION

997 998 999 1000 1001 1002 1003 1004 1005 1006

Dual authorization is also known as two-person control. Organizations employ dual authorization to help ensure that any changes to selected system components and system-level information cannot occur unless two qualified individuals approve and implement such changes. Requiring two individuals to implement system changes provides an increased level of assurance that the proposed changes are correct implementations of approved changes. The individuals are also accountable for the changes that have been implemented. To reduce the risk of collusion, organizations consider rotating dual authorization duties to other individuals. System-level information includes operational procedures. This requirement enhances SP 800171 requirement 03.04.05.

1007

PROTECTION STRATEGY

1008

PRA

1009

ADVERSARY EFFECTS

1010

Preclude (Preempt), Impede (Exert)

1011

REFERENCES

1012

Source Control: CM-5(04)

1013

03.04.06E Retention of Previous Configurations

1014 1015

Retain [Assignment: organization-defined number] previous versions of baseline configurations of the system to support rollback.

1016

DISCUSSION

1017 1018 1019 1020

Retaining previous versions of baseline configurations to support rollback includes configuration files for hardware, software, and firmware, configuration records, and associated documentation. This requirement enhances SP 800-171 requirement 03.04.01.

1021

PROTECTION STRATEGY

1022

DLO, CRS

27

NIST SP 800-172r3 fpd (Final Public Draft) September 2025

Enhanced Security Requirements for Protecting CUI

1023

ADVERSARY EFFECTS

1024

Preclude (Preempt), Impede (Exert), Limit (Shorten, Reduce)

1025

REFERENCES

1026

Source Control: CM-02(03)

1027

03.04.07E Testing, Validation, and Documentation of Changes

1028 1029

Test, validate, and document changes to the system before finalizing the implementation of the changes.

1030

DISCUSSION

1031 1032 1033 1034 1035 1036 1037 1038 1039 1040 1041

Changes to systems include modifications to hardware, software, or firmware components and defined configuration settings. Organizations ensure that testing does not interfere with system operations that support organizational missions and business functions. Individuals or groups that conduct the tests understand the system security policies and procedures associated with the specific facilities or processes. Operational systems may need to be taken offline or replicated to the extent feasible before testing can be conducted. If systems must be taken offline for testing, the tests are scheduled to occur during planned system outages whenever possible. If the testing cannot be conducted on operational systems, organizations employ compensating protection measures. This requirement enhances SP 800-171 requirement 03.04.03.

1042

PROTECTION STRATEGY

1043

PRA

1044

ADVERSARY EFFECTS

1045

Preclude (Preempt), Impede (Exert)

1046

REFERENCES

1047

Source Control: CM-03(02)

1048

03.04.08E Centralized Repository

1049

Provide a centralized repository for the inventory of system components.

1050

DISCUSSION

1051 1052 1053 1054

Organizations may implement centralized system component inventories that include components from all organizational systems. Centralized repositories of component inventories provide opportunities for efficiencies in accounting for organizational hardware, software, and firmware assets. Such repositories can help 28

NIST SP 800-172r3 fpd (Final Public Draft) September 2025

Enhanced Security Requirements for Protecting CUI

1055 1056 1057

organizations rapidly identify the location and responsible individuals of system components that have been compromised, breached, or are otherwise in need of mitigation actions. This requirement enhances SP 800-171 requirement 03.04.10.

1058

PROTECTION STRATEGY

1059

PRA

1060

ADVERSARY EFFECTS

1061

Preclude (Preempt), Impede (Exert)

1062

REFERENCES

1063

Source Control: CM-08(07)

1064

3.5. Identification and Authentication

1065

03.05.01E Cryptographic Bidirectional Authentication

1066 1067 1068

Authenticate [Assignment: organization-defined devices and/or types of devices] before establishing a system connection using bidirectional authentication that is cryptographically based.

1069

DISCUSSION

1070 1071 1072

Bidirectional authentication provides stronger protection to validate the identity of other devices for connections that are of greater risk. This requirement enhances SP 800-171 requirement 03.05.02.

1073

PROTECTION STRATEGY

1074

PRA

1075

ADVERSARY EFFECTS

1076

Preclude (Preempt, Negate), Impede (Exert), Expose (Detect)

1077

REFERENCES

1078

Source Controls: IA-03(01)

1079

03.05.02E Password Managers

1080 1081

a. Employ [Assignment: organization-defined password managers] to generate and manage passwords.

1082

b. Protect the passwords using [Assignment: organization-defined controls].

1083

DISCUSSION 29

NIST SP 800-172r3 fpd (Final Public Draft) September 2025

Enhanced Security Requirements for Protecting CUI

1084 1085 1086 1087

A potential risk of using password managers is that adversaries can target the collection of passwords generated by the password manager. Therefore, the passwords require strong protection, including encrypting the passwords. This requirement enhances SP 800-171 requirement 03.05.07.

1088

PROTECTION STRATEGY

1089

PRA

1090

ADVERSARY EFFECTS

1091

Preclude (Preempt), Impede (Delay, Exert)

1092

REFERENCES

1093

Source Control: IA-05(18)

1094

03.05.03E Device Attestation

1095 1096

Handle device identification and authentication based on attestation by [Assignment: organization-defined configuration management process].

1097

DISCUSSION

1098 1099 1100 1101 1102 1103 1104 1105

Device attestation refers to the identification and authentication of a device based on its configuration and known operating state. Device attestation can be determined via a cryptographic hash of the device. If device attestation is the means of identification and authentication, then it is important that patches and updates to the device are handled via a configuration management process such that the patches and updates are done securely and do not disrupt identification and authentication to other devices. This requirement enhances SP 800-171 requirement 03.05.02.

1106

PROTECTION STRATEGY

1107

PRA

1108

ADVERSARY EFFECTS

1109

Preclude (Preempt), Impede (Exert), Expose (Detect)

1110

REFERENCES

1111

Source Control: IA-03(04)

30

NIST SP 800-172r3 fpd (Final Public Draft) September 2025

1112

Enhanced Security Requirements for Protecting CUI

03.05.04E No Embedded Unencrypted Static Authenticators

1113 1114

Ensure that unencrypted static authenticators are not embedded in applications or other forms of static storage.

1115

DISCUSSION

1116 1117 1118 1119 1120

In addition to applications, other forms of static storage include access scripts and function keys. Organizations exercise caution when determining whether embedded or stored authenticators are encrypted or unencrypted. If authenticators are used in the manner stored, then those representations are considered unencrypted authenticators. This requirement enhances SP 800-171 requirement 03.05.07.

1121

PROTECTION STRATEGY

1122

PRA

1123

ADVERSARY EFFECTS

1124

Preclude (Preempt), Impede (Exert)

1125

REFERENCES

1126

Source Control: IA-05(07)

1127

03.05.05E Expiration of Cached Authenticators

1128 1129

Prohibit the use of cached authenticators after [Assignment: organization-defined time period].

1130

DISCUSSION

1131 1132 1133 1134

Cached authenticators are used to authenticate to a local machine when the network is not available. If cached authentication information is out of date, the validity of the authentication information may be questionable. This requirement enhances SP 800-171 requirement 03.05.07.

1135

PROTECTION STRATEGY

1136

PRA

31

NIST SP 800-172r3 fpd (Final Public Draft) September 2025

1137

ADVERSARY EFFECTS

1138

Preclude (Preempt), Impede (Exert)

1139

REFERENCES

1140

Source Control: IA-05(13)

1141

Enhanced Security Requirements for Protecting CUI

03.05.06E Identity Proofing

1142 1143 1144

a. Identity proof users that require accounts for logical access to systems based on appropriate identity assurance level requirements as specified in applicable standards and guidelines.

1145

b. Resolve user identities to a unique individual.

1146

c. Collect, validate, and verify identity evidence.

1147

DISCUSSION

1148 1149 1150 1151 1152 1153 1154

Identity proofing is the process of collecting, validating, and verifying user identity information to establish credentials for accessing a system. Identity proofing is intended to mitigate threats to the registration of users and the establishment of their accounts. Organizations may be subject to laws, Executive Orders, directives, regulations, or policies that address the collection of identity evidence. This requirement is sourced to a control tailored out of the SP 800-53B [13] moderate baseline in SP 800-171.

1155

PROTECTION STRATEGY

1156

PRA

1157

ADVERSARY EFFECTS

1158

Preclude (Preempt), Impede (Exert)

1159

REFERENCES

1160

Source Control: IA-12

1161 1162 1163 1164 1165 1166

03.05.07E Identity Providers and Authorization Servers Employ identity providers and authorization servers to manage user, device, and non-person entity identities, attributes, and access rights that support authentication and authorization decisions in accordance with [Assignment: organization-defined identification and authentication policy] using [Assignment: organization-defined mechanisms].

32

NIST SP 800-172r3 fpd (Final Public Draft) September 2025

Enhanced Security Requirements for Protecting CUI

1167

DISCUSSION

1168 1169 1170 1171 1172 1173 1174 1175 1176

Identity providers (both internal and external to the organization) manage user, device, and non-person entity authenticators and issue statements (often called identity assertions) that attest to the identities of other systems or system components. Authorization servers create and issue access tokens to identified and authenticated users and devices that can be used to gain access to organizational systems or information resources. For example, single sign-on (SSO) provides identity provider and authorization server functions. This requirement does not enhance a specific requirement in SP 800-171 but can be used to strengthen the protection of CUI associated with critical programs or high value assets.

1177

PROTECTION STRATEGY

1178

PRA

1179

ADVERSARY EFFECTS

1180

Preclude (Preempt), Impede (Exert)

1181

REFERENCES

1182

Source Control: IA-13

1183

3.6. Incident Response

1184

03.06.01E Security Operations Center

1185

Establish and maintain a security operations center.

1186

DISCUSSION

1187 1188 1189 1190 1191 1192 1193 1194 1195 1196 1197 1198 1199 1200

A security operations center (SOC) is the focal point for security operations and computer network defense for an organization. The purpose of the SOC is to defend and monitor an organization’s systems and networks on an ongoing basis. The SOC is also responsible for detecting, analyzing, and responding to security incidents in a timely manner. The SOC is staffed with skilled technical and operational personnel (e.g., security analysts, incident response personnel, systems security engineers) and implements a combination of technical, management, and operational controls (including monitoring, scanning, and forensics tools) to monitor, fuse, correlate, analyze, and respond to threat and security-relevant event data from multiple sources. These sources include perimeter defenses, network devices (e.g., routers, switches), and endpoint agent data feeds. The SOC provides a holistic situational awareness capability to help organizations determine the security posture of the system and organization. A SOC capability can be obtained in a variety of ways. Larger organizations may implement a dedicated SOC, while smaller organizations

33

NIST SP 800-172r3 fpd (Final Public Draft) September 2025

Enhanced Security Requirements for Protecting CUI

1201 1202

may employ third-party organizations to provide this capability. This requirement enhances SP 800-171 requirement 03.06.01.

1203

PROTECTION STRATEGY

1204

DLO

1205

ADVERSARY EFFECTS

1206

Limit (Shorten, Reduce); Expose (Detect, Reveal)

1207

REFERENCES

1208

Source Control: IR-04(14)

1209

03.06.02E Integrated Incident Response Team

1210 1211 1212

Establish and maintain an integrated incident response team that can be deployed to any location identified by the organization in [Assignment: organization-defined time period].

1213

DISCUSSION

1214 1215 1216 1217 1218 1219 1220

An integrated incident response team is a group of individuals who assess, document, and respond to incidents so that organizational systems and networks can recover quickly and implement the necessary controls to avoid future incidents. Incident response team personnel include forensic and malicious code analysts, tool developers, systems security engineers, and real-time operations personnel. The incident handling capability includes performing rapid forensic preservation of evidence and analysis of and response to intrusions.

1221 1222 1223 1224 1225 1226 1227 1228 1229 1230 1231 1232 1233

An integrated incident response team facilitates information sharing and allows organizational personnel (e.g., developers, implementers, and operators) to leverage team knowledge of the threat and implement defensive measures that enable organizations to deter intrusions more effectively. Moreover, integrated teams promote the rapid detection of intrusions, the development of appropriate mitigations, and the deployment of effective defensive measures. Integrated incident response teams are better able to identify adversary tactics, techniques, and procedures that are linked to the operations tempo or specific mission and business functions and to define responsive actions in a way that does not disrupt those mission and business functions. Incident response teams can be distributed within organizations to make the capability resilient. For some organizations, the incident response team can be a cross-organizational entity. This requirement enhances SP 800-171 requirement 03.06.01.

1234

PROTECTION STRATEGY

1235

DLO 34

NIST SP 800-172r3 fpd (Final Public Draft) September 2025

Enhanced Security Requirements for Protecting CUI

1236

ADVERSARY EFFECTS

1237 1238

Preclude (Expunge), Impede (Contain, Exert), Limit (Shorten, Reduce), Expose (Scrutinize)

1239

REFERENCES

1240

Source Control: IR-04(11)

1241

03.06.03E Behavior Analysis

1242 1243

Analyze anomalous or suspected adversarial behavior in or related to [Assignment: organization-defined environments or resources].

1244

DISCUSSION

1245 1246 1247 1248 1249 1250 1251 1252

If the organization maintains a deception environment, an analysis of behaviors in that environment, including resources targeted by the adversary and the timing of the incident or event, can provide significant insights into adversarial tactics, techniques, and procedures. External to a deception environment, the analysis of anomalous behavior (e.g., changes in system performance or usage patterns) or suspected adversarial behavior (e.g., changes in searches for the location of specific resources) can give the organization such insight. This requirement enhances SP 800171 requirement 03.06.01.

1253

PROTECTION STRATEGY

1254

DLO

1255

ADVERSARY EFFECTS

1256

Expose (Detect, Reveal)

1257

REFERENCES

1258

Source Control: IR-04(13)

1259

03.06.04E Automated Tracking, Data Collection, and Analysis for Incident Monitoring

1260 1261

Track incidents and collect and analyze incident information using [Assignment: organization-defined automated mechanisms].

1262

DISCUSSION

1263 1264 1265 1266

Automated mechanisms for tracking incidents and collecting and analyzing incident information include Computer Incident Response Centers or other electronic databases of incidents and network monitoring devices. This requirement enhances SP 800-171 requirement 03.06.02.

35

NIST SP 800-172r3 fpd (Final Public Draft) September 2025

1267

PROTECTION STRATEGY

1268

PRA, DLO

1269

ADVERSARY EFFECTS

1270

Expose (Detect, Reveal)

1271

REFERENCES

1272

Source Control: IR-05(01)

Enhanced Security Requirements for Protecting CUI

1273

3.7. Maintenance

1274

03.07.01E Software Updates and Patches for Maintenance Tools

1275 1276

Inspect maintenance tools to ensure the latest software updates and patches are installed.

1277

DISCUSSION

1278 1279 1280

Maintenance tools using outdated and/or unpatched software can provide a threat vector for adversaries and result in a significant vulnerability for organizations. This requirement enhances SP 800-171 requirement 03.07.04.

1281

PROTECTION STRATEGY

1282

PRA

1283

ADVERSARY EFFECTS

1284

Preclude (Preempt)

1285

REFERENCES

1286

Source Control: MA-03(06)

1287

3.8. Media Protection

1288

03.08.01E Dual Authorization for Media Sanitization

1289 1290

Enforce dual authorization for the sanitization of [Assignment: organization-defined system media containing CUI].

1291

DISCUSSION

1292 1293 1294

Dual authorization is also known as two-person control. Dual authorization reduces risk related to insider threats, including adversaries who have obtained credentials. Organizations employ dual authorization to help ensure that the sanitization of 36

NIST SP 800-172r3 fpd (Final Public Draft) September 2025

Enhanced Security Requirements for Protecting CUI

1295 1296 1297 1298 1299 1300 1301 1302 1303 1304

system media cannot occur unless two technically qualified individuals conduct the designated task. Individuals who sanitize system media possess sufficient skills and expertise to determine whether the proposed sanitization reflects applicable federal and organizational standards, policies, and procedures. Dual authorization also helps to ensure that sanitization occurs as intended to protect against errors and false claims of having performed the sanitization actions. To reduce the risk of collusion, organizations consider rotating dual authorization duties to other individuals. Organizations consider the risks associated with implementing dual authorization when immediate responses are necessary to help ensure public and environmental safety. This requirement enhances SP 800-171 requirement 03.08.03.

1305

PROTECTION STRATEGY

1306

PRA

1307

ADVERSARY EFFECTS

1308

Preclude (Preempt), Impede (Exert)

1309

REFERENCES

1310

Source Control: MP-06(07)

1311

03.08.02E Dual Authorization for System Backup Deletion and Destruction

1312 1313

Enforce dual authorization for the deletion or destruction of [Assignment: organization-defined system backup information].

1314

DISCUSSION

1315 1316 1317 1318 1319 1320 1321 1322 1323 1324 1325

Dual authorization is also known as two-person control. Dual authorization reduces risk related to insider threats, including adversaries who have obtained credentials. Dual authorization ensures that the deletion or destruction of backup information cannot occur unless two qualified individuals carry out the task. Individuals who delete or destroy backup information possess the knowledge, skills, or expertise to determine whether the proposed deletion or destruction of such information reflects organizational policies and procedures. To reduce the risk of collusion, organizations often rotate dual authorization duties among various individuals. Organizations also consider the risk associated with implementing dual authorization when immediate responses are necessary to ensure public and environmental safety. This requirement enhances SP 800-171 requirement 03.08.09.

1326

PROTECTION STRATEGY

1327

PRA

37

NIST SP 800-172r3 fpd (Final Public Draft) September 2025

1328

ADVERSARY EFFECTS

1329

Preclude (Preempt), Impede (Exert)

1330

REFERENCES

1331

Source Control: CP-09(07)

1332

Enhanced Security Requirements for Protecting CUI

03.08.03E Testing System Backups for Reliability and Integrity

1333 1334

Test backup information [Assignment: organization-defined frequency] to verify media reliability and information integrity.

1335

DISCUSSION

1336 1337 1338 1339 1340 1341 1342 1343 1344

Organizations need assurance that backup information can be reliably retrieved. Reliability pertains to the systems and system components in which the backup information is stored, the operations used to retrieve the information, and the integrity of the information being retrieved. Independent and specialized tests can be used for each of these aspects of reliability. For example, decrypting and transporting (or transmitting) a random sample of backup files from the alternate storage or backup site and comparing the information to the same information at the primary processing site can provide such assurance. This requirement enhances SP 800-171 requirement 03.08.09.

1345

PROTECTION STRATEGY

1346

PRA, CRS

1347

ADVERSARY EFFECTS

1348

Preclude (Preempt), Impede (Exert), Limit (Shorten, Reduce)

1349

REFERENCES

1350

Source Control: CP-09(01)

1351

03.08.04E System Recovery and Reconstitution

1352 1353 1354

Provide for the recovery and reconstitution of the system to a known state within [Assignment: organization-defined time period consistent with recovery time and recovery point objectives] after a disruption, compromise, or failure.

1355

DISCUSSION

1356 1357 1358 1359

Recovery is executing contingency plan activities to restore organizational mission and business functions. Reconstitution occurs following recovery operations and includes activities for returning systems to fully operational states. Recovery and reconstitution operations reflect mission and business priorities; recovery point, 38

NIST SP 800-172r3 fpd (Final Public Draft) September 2025

Enhanced Security Requirements for Protecting CUI

1360 1361 1362 1363 1364 1365 1366 1367 1368 1369 1370

recovery time, and reconstitution objectives; and organizational metrics consistent with contingency plan requirements. Reconstitution includes the deactivation of interim system capabilities that may have been needed during recovery operations. Reconstitution also includes assessments of fully restored system capabilities, the reestablishment of continuous monitoring activities, and activities to prepare the system and organization for future disruptions, breaches, compromises, or failures. Recovery and reconstitution capabilities can include automated mechanisms and manual procedures. Organizations establish recovery time and recovery point objectives as part of contingency planning. This requirement does not enhance a specific requirement in SP 800-171 but can be used to strengthen the protection of CUI associated with critical programs or high value assets.

1371

PROTECTION STRATEGY

1372

CRS

1373

ADVERSARY EFFECTS

1374

Limit (Shorten, Reduce)

1375

REFERENCES

1376

Source Control: CP-10

1377

3.9. Personnel Security

1378

03.09.01E Withdrawn

1379 1380 1381 1382

Addressed by 03.09.01 (SP 800-171). 03.09.02E Withdrawn Addressed by 03.01.01 (SP 800-171) and 03.09.01 (SP 800-171). 03.09.03E Access Agreements

1383 1384

a. Develop and document access agreements for systems processing, storing, or transmitting CUI.

1385 1386

b. Review and update the access agreements [Assignment: organization-defined frequency].

1387 1388

c. Verify that individuals requiring access to CUI and systems processing, storing, or transmitting CUI:

1389

1. Sign appropriate access agreements prior to being granted access; and

39

NIST SP 800-172r3 fpd (Final Public Draft) September 2025

1390 1391 1392

Enhanced Security Requirements for Protecting CUI

2. Re-sign access agreements to maintain access to systems when access agreements have been updated or [Assignment: organization-defined frequency].

1393

DISCUSSION

1394 1395 1396 1397 1398 1399

Access agreements include nondisclosure agreements, acceptable use agreements, rules of behavior, and conflict-of-interest agreements. Signed access agreements include an acknowledgement that individuals have read, understand, and agree to abide by the constraints associated with systems processing, storing, or transmitting CUI to which they have authorized access. This requirement is sourced to a control tailored out of the SP 800-53B [13] moderate baseline in SP 800-171.

1400

PROTECTION STRATEGY

1401

PRA

1402

ADVERSARY EFFECTS

1403

Preclude (Preempt)

1404

REFERENCES

1405

Source Control: PS-06

1406

03.09.04E Citizenship Requirements

1407 1408

Verify that individuals accessing a system that processes, stores, or transmits CUI meet [Assignment: organization-defined citizenship requirements].

1409

DISCUSSION

1410 1411 1412

Organizations may determine that individuals who need access to CUI associated with a high value asset or critical program require U.S. citizenship status. This requirement enhances SP 800-171 requirement 03.09.01.

1413

PROTECTION STRATEGY

1414

PRA

1415

ADVERSARY EFFECTS

1416

Preclude (Preempt)

1417

REFERENCES

1418

Source Control: PS-03(04)

40

NIST SP 800-172r3 fpd (Final Public Draft) September 2025

Enhanced Security Requirements for Protecting CUI

1419

3.10. Physical Protection

1420

03.10.01E Intrusion Alarms and Surveillance Equipment

1421 1422

Monitor physical access to the facility where the system resides using physical intrusion alarms and surveillance equipment.

1423

DISCUSSION

1424 1425 1426 1427 1428 1429 1430 1431

Physical intrusion alarms can be used to alert security personnel when unauthorized access to the facility is attempted. Alarm systems work in conjunction with physical barriers, physical access control systems, and facility security guards by triggering a response when these other forms of security have been compromised or breached. Physical intrusion alarms can include different types of sensor devices, including motion sensors, contact sensors, and broken glass sensors. Surveillance equipment includes video cameras installed at strategic locations throughout the facility. This requirement enhances SP 800-171 requirement 03.10.02.

1432

PROTECTION STRATEGY

1433

DLO

1434

ADVERSARY EFFECTS

1435

Expose (Detect, Reveal)

1436

REFERENCES

1437

Source Control: PE-06(01)

1438

03.10.02E Delivery and Removal of System Components

1439 1440

a. Authorize and control [Assignment: organization-defined types of system components] entering and exiting the facility.

1441

b. Maintain records of the system components.

1442

DISCUSSION

1443 1444 1445 1446 1447

Enforcing authorizations for the entry and exit of system components may require restricting access to delivery areas and isolating the areas from the system and media libraries. This requirement does not enhance a specific requirement in SP 800-171 but can be used to strengthen the protection of CUI associated with critical programs or high value assets.

1448

PROTECTION STRATEGY

1449

PRA

41

NIST SP 800-172r3 fpd (Final Public Draft) September 2025

1450

ADVERSARY EFFECTS

1451

Preclude (Preempt)

1452

REFERENCES

1453

Source Control: PE-16

1454

3.11. Risk Assessment

1455

03.11.01E Threat Awareness Program

Enhanced Security Requirements for Protecting CUI

1456 1457

Implement a threat awareness program that includes a cross-organization information-sharing capability for threat intelligence.

1458

DISCUSSION

1459 1460 1461 1462 1463 1464 1465 1466 1467 1468 1469 1470 1471 1472

Because of the constantly changing and increasing sophistication of adversaries, especially the advanced persistent threat (APT), it may be likely that adversaries can successfully breach or compromise organizational systems. One of the techniques that organizations can use to address this concern is to share threat information. This can include the tactics, techniques, and procedures that organizations have experienced; mitigations that organizations have found to be effective against certain types of threats; and threat intelligence (i.e., indications and warnings about threats). Threat information sharing may be bilateral or multilateral. Bilateral threat sharing includes government-to-commercial and government-to-government cooperatives. Multilateral threat sharing can include organizations taking part in threat-sharing consortia. Threat information may require special agreements and protection, or it may be freely shared. This requirement does not enhance a specific requirement in SP 800-171 but can be used to strengthen the protection of CUI associated with critical programs or high value assets.

1473

PROTECTION STRATEGY

1474

DLO

1475

ADVERSARY EFFECTS

1476

Preclude (Negate), Impede (Exert), Expose (Detect)

1477

REFERENCES

1478

Source Controls: PM-16

1479 1480

03.11.02E Threat Hunting a. Establish and maintain a cyber threat-hunting capability to:

42

NIST SP 800-172r3 fpd (Final Public Draft) September 2025

Enhanced Security Requirements for Protecting CUI

1481

1. Search for indicators of compromise in organizational systems and

1482

2. Detect, track, and disrupt threats that evade existing safeguards.

1483 1484

b. Employ the threat-hunting capability [Assignment: organization-defined frequency].

1485

DISCUSSION

1486 1487 1488 1489 1490 1491 1492 1493 1494 1495 1496 1497 1498 1499 1500

Threat hunting is an active means of cyber defense in contrast to traditional protection measures, such as firewalls, intrusion detection and prevention systems, quarantining malicious code in sandboxes, and Security Information and Event Management (SIEM) technologies and systems. Cyber threat hunting involves proactively searching organizational systems, networks, and infrastructure for advanced threats. The objective is to track and disrupt adversaries as early as possible in the attack sequence and to measurably improve the speed and accuracy of responses. Indications of compromise include unusual network traffic, unusual file changes, and the presence of malicious code. Threat-hunting teams leverage existing threat intelligence and may create new threat intelligence that is shared with peer organizations, Information Sharing and Analysis Organizations (ISAO), Information Sharing and Analysis Centers (ISAC), and relevant government departments and agencies. This requirement does not enhance a specific requirement in SP 800-171 but can be used to strengthen the protection of CUI associated with critical programs or high value assets.

1501

PROTECTION STRATEGY

1502

DLO

1503

ADVERSARY EFFECTS

1504

Preclude (Expunge), Limit (Shorten, Reduce), Expose (Detect, Scrutinize)

1505

REFERENCES

1506

Source Control: RA-10

1507

03.11.03E Predictive Cyber Analytics

1508 1509 1510

Employ the following advanced automation and analytics capabilities to predict and identify risks to [Assignment: organization-defined systems or system components]: [Assignment: organization-defined advanced automation and analytics capabilities].

1511

DISCUSSION

1512 1513 1514 1515

A properly resourced security operations center (SOC) or computer incident response team (CIRT) may be overwhelmed by the volume of information generated by the proliferation of security tools and appliances unless it employs advanced automation and analytics to analyze the data. Advanced automation and predictive 43

NIST SP 800-172r3 fpd (Final Public Draft) September 2025

Enhanced Security Requirements for Protecting CUI

1516 1517 1518 1519 1520 1521 1522 1523 1524 1525

analytics capabilities are typically supported by artificial intelligence concepts and machine learning. Examples include automated threat discovery and response (which includes broad-based collection, context-based analysis, and adaptive response capabilities), automated workflow operations, and machine-assisted decision tools. However, sophisticated adversaries may be able to extract information related to analytic parameters and retrain the machine learning to classify malicious activity as benign. Accordingly, machine learning is augmented by human monitoring to help ensure that sophisticated adversaries are not able to conceal their activities. This requirement enhances SP 800-171 requirement 03.11.01.

1526

PROTECTION STRATEGY

1527

DLO

1528

ADVERSARY EFFECTS

1529

Preclude (Expunge), Limit (Shorten, Reduce), Expose (Detect, Scrutinize)

1530

REFERENCES

1531

Source Control: RA-03(04)

1532 1533 1534 1535 1536 1537 1538 1539 1540 1541 1542 1543 1544 1545

03.11.04E Withdrawn Addressed by 03.15.01E, 03.11.01 (SP 800-171), 03.11.04 (SP 800-171), and 03.15.02 (SP 800-171). 03.11.05E Withdrawn Addressed by 03.11.01E, 03.11.03E, 03.11.01 (SP 800-171), 03.11.04 (SP 800-171), 03.12.01 (SP 800-171), and 03.12.03 (SP 800-171). 03.11.06E Withdrawn Addressed by 03.12.03E, 03.11.01 (SP 800-171), 03.11.04 (SP 800-171), 03.12.01 (SP 800-171), 03.12.03 (SP 800-171), and 03.17.03 (SP 800-171). 03.11.07E Withdrawn Addressed by 03.17.01 (SP 800-171). 03.11.08E Dynamic Threat Awareness Determine the current cyber threat environment on an ongoing basis using [Assignment: organization-defined means].

44

NIST SP 800-172r3 fpd (Final Public Draft) September 2025

Enhanced Security Requirements for Protecting CUI

1546

DISCUSSION

1547 1548 1549 1550 1551

The threat awareness information that is gathered feeds into the organization’s security operations to ensure that procedures are updated in response to the changing threat environment. For example, at higher threat levels, organizations may change the privilege or authentication thresholds required to perform certain operations. This requirement enhances SP 800-171 requirement 03.11.01.

1552

PROTECTION STRATEGY

1553

DLO

1554

ADVERSARY EFFECTS

1555

Expose (Detect, Reveal)

1556

REFERENCES

1557

Source Control: RA-03(03)

1558

03.11.09E Indicators of Compromise

1559 1560 1561

Discover, collect, and distribute to [Assignment: organization-defined personnel or roles], indicators of compromise provided by [Assignment: organization-defined sources].

1562

DISCUSSION

1563 1564 1565 1566 1567 1568 1569 1570 1571 1572 1573 1574 1575 1576

Indicators of compromise (IOCs) are forensic artifacts from intrusions that are identified on organizational systems at the host or network level. IOCs provide valuable information on systems that have been compromised. IOCs can include the creation of registry key values. IOCs for network traffic include universal resource locator (URL) or protocol elements that indicate malicious code command and control servers. The rapid distribution and adoption of IOCs can improve information security by reducing the time that systems and organizations are vulnerable to the same exploit or attack. Threat indicators, signatures, tactics, techniques, procedures, and other IOCs may be available via government and non-government cooperatives, including the Forum of Incident Response and Security Teams (FIRST), the Computer Emergency Response Team Coordination Center (CERT/CC), the United States Computer Emergency Readiness Team (US-CERT), and the Defense Industrial Base (DIB) Cybersecurity Information Sharing Program. This requirement enhances SP 800-171 requirement 03.14.06.

1577

PROTECTION STRATEGY

1578

DLO

1579

ADVERSARY EFFECTS

45

NIST SP 800-172r3 fpd (Final Public Draft) September 2025

1580

Expose (Detect, Reveal)

1581

REFERENCES

1582

Source Control: SI-04(24)

1583

Enhanced Security Requirements for Protecting CUI

03.11.10E Criticality Analysis

1584 1585 1586 1587

Identify critical system components and functions by performing a criticality analysis for [Assignment: organization-defined systems, system components, or system services] at [Assignment: organization-defined decision points in the system development life cycle].

1588

DISCUSSION

1589 1590 1591 1592 1593 1594 1595 1596 1597 1598 1599 1600 1601 1602 1603 1604 1605

Organizations conduct a functional decomposition of a system to identify missioncritical functions and system components. The functional decomposition includes the identification of organizational missions supported by the system, the specific functions to perform those missions, and traceability to the hardware, software, and firmware components that implement those functions, including when the functions are shared by components within and external to the system. The operational environment of a system or a system component may impact its criticality, including the connections to and dependencies on other systems, devices, system-of-systems, and outsourced IT services. System components that allow unmediated access to critical system components or functions are considered critical due to the inherent vulnerabilities that such components create. Criticality analysis is performed when an architecture or design is being developed, modified, or upgraded. If such analysis is performed early and throughout the system development life cycle, organizations may be able to modify the system design to reduce the critical nature of these functions and components, such as by adding redundancy or alternate paths into the system design. This requirement is sourced to a control tailored out of the SP 80053B [13] moderate baseline in SP 800-171.

1606

PROTECTION STRATEGY

1607

PRA

1608

ADVERSARY EFFECTS

1609

Preclude (Preempt)

1610

REFERENCES

1611

Source Control: RA-09

46

NIST SP 800-172r3 fpd (Final Public Draft) September 2025

1612

Enhanced Security Requirements for Protecting CUI

03.11.11E Discoverable Information

1613 1614

Determine information about the system that is discoverable and take [Assignment: organization-defined corrective actions].

1615

DISCUSSION

1616 1617 1618 1619 1620 1621 1622 1623 1624

Discoverable information includes information that adversaries could obtain without compromising or breaching the system, such as by collecting information that the system is exposing or by conducting extensive web searches. Corrective actions include notifying organizational personnel, removing designated information, or changing the system to make the designated information less relevant or attractive to adversaries. This requirement excludes intentionally discoverable information that may be part of a decoy capability (e.g., honeypots, honeynets, or deception nets) implemented by the organization. This requirement enhances SP 800-171 requirement 03.11.02.

1625

PROTECTION STRATEGY

1626

DLO

1627

ADVERSARY EFFECTS

1628

Expose (Reveal)

1629

REFERENCES

1630

Source Control: RA-05(04)

1631

03.11.12E Automated Means for Sharing Threat Intelligence

1632 1633

Employ automated mechanisms to maximize the effectiveness of sharing threat intelligence information.

1634

DISCUSSION

1635 1636 1637 1638 1639 1640 1641 1642

To maximize the effectiveness of monitoring and sharing threat intelligence information, it is important to know what threat observables and indicators the sensors need to be searching for. By using well-established frameworks, services, and automated tools, organizations improve their ability to rapidly share and feed the relevant threat detection signatures into monitoring tools. This requirement does not enhance a specific requirement in SP 800-171 but can be used to strengthen the protection of CUI associated with critical programs or high value assets.

1643

PROTECTION STRATEGY

1644

DLO

47

NIST SP 800-172r3 fpd (Final Public Draft) September 2025

Enhanced Security Requirements for Protecting CUI

1645

ADVERSARY EFFECTS

1646

Preclude (Negate), Impede (Exert), Expose (Detect)

1647

REFERENCES

1648

Source Controls: PM-16(01)

1649

3.12. Security Assessment and Monitoring

1650

03.12.01E Penetration Testing

1651 1652

Conduct penetration testing [Assignment: organization-defined frequency] on [Assignment: organization-defined systems or system components].

1653

DISCUSSION

1654 1655 1656 1657 1658 1659 1660 1661 1662 1663 1664 1665 1666 1667 1668 1669 1670 1671 1672 1673 1674

Penetration testing is a specialized type of assessment conducted on systems or system components to identify vulnerabilities that could be exploited by adversaries. It is conducted by penetration testing agents and teams with particular skills and experience that include technical expertise in network, operating system, and application-level security. Penetration testing can be used to validate vulnerabilities or to determine a system’s penetration resistance to adversaries within specified constraints, such as time, resources, and skills. It can be conducted internally or externally on the hardware, software, or firmware components of a system and can exercise both physical and technical controls. A standard method for conducting penetration testing includes pretest analysis based on full knowledge of the system, pretest identification of potential vulnerabilities based on the pretest analysis, and testing designed to determine the exploitability of vulnerabilities. All parties agree to the specified rules of engagement before the commencement of penetration testing. Organizations may also supplement penetration testing with red team exercises. Red teams attempt to duplicate the actions of adversaries in carrying out attacks against organizations and provide an in-depth analysis of security-related weaknesses or deficiencies. Organizations correlate the rules of engagement for penetration tests and red teaming exercises (if used) with the tools, techniques, and procedures that they anticipate adversaries may employ. This requirement does not enhance a specific requirement in SP 800-171 but can be used to strengthen the protection of CUI associated with critical programs or high value assets.

1675

PROTECTION STRATEGY

1676

PRA, DLO

1677

ADVERSARY EFFECTS

1678

Preclude (Preempt), Impede (Exert), Expose (Detect)

48

NIST SP 800-172r3 fpd (Final Public Draft) September 2025

1679

REFERENCES

1680

Source Control: CA-08

1681

03.12.02E Independent Assessors

Enhanced Security Requirements for Protecting CUI

1682 1683

Use independent assessors or assessment teams to conduct security requirement assessments.

1684

DISCUSSION

1685 1686 1687 1688 1689 1690 1691 1692 1693 1694 1695 1696 1697

Independent assessors or assessment teams are individuals or groups who conduct impartial assessments of systems. Impartiality means that assessors are free from any perceived or actual conflicts of interest regarding the development, operation, sustainment, or management of the systems under assessment or the determination of security requirement effectiveness. To achieve impartiality, assessors do not create a mutual or conflicting interest with the organizations where the assessments are being conducted, assess their own work, act as management or employees of the organizations they are serving, or place themselves in positions of advocacy for the organizations acquiring their services. Independent assessments can be obtained from entities that are internal or external to organizations. Organizations determine whether the level of assessor independence provides sufficient assurance such that the assessment results are sound and can be used to make effective risk-based decisions. This requirement enhances SP 800-171 requirement 03.12.01.

1698

PROTECTION STRATEGY

1699

PRA

1700

ADVERSARY EFFECTS

1701

Preclude (Preempt)

1702

REFERENCES

1703

Source Control: CA-02(01)

1704 1705 1706

03.12.03E Risk Monitoring Ensure risk monitoring is an integral part of the continuous monitoring strategy that includes effectiveness monitoring, compliance monitoring, change monitoring.

49

NIST SP 800-172r3 fpd (Final Public Draft) September 2025

Enhanced Security Requirements for Protecting CUI

1707

DISCUSSION

1708 1709 1710 1711 1712 1713 1714

Risk monitoring is guided and informed by the established organizational risk tolerance. Effectiveness monitoring determines the ongoing effectiveness of the implemented risk response measures. Compliance monitoring verifies that required risk response measures are implemented. It also verifies that security requirements are satisfied. Change monitoring identifies changes to organizational systems and environments of operation that may affect security risk. This requirement enhances SP 800-171 requirement 03.12.03.

1715

PROTECTION STRATEGY

1716

PRA, DLO

1717

ADVERSARY EFFECTS

1718

Preclude (Preempt), Impede (Exert), Expose (Detect)

1719

REFERENCES

1720

Source Control: CA-07(04)

1721

03.12.04E Internal System Connections

1722 1723

a. Authorize internal connections of [Assignment: organization-defined system components or classes of components] to the system.

1724 1725

b. Document, for each internal connection, the interface characteristics, security requirements, and the nature of the information communicated.

1726 1727

c. Terminate internal system connections after [Assignment: organization-defined conditions].

1728 1729

d. Review [Assignment: organization-defined frequency] the continued need for each internal connection.

1730

DISCUSSION

1731 1732 1733 1734 1735 1736 1737 1738 1739 1740 1741

Internal system connections are connections between organizational systems and separate constituent system components (i.e., connections between components that are part of the same system), including components that are used for system development. Intra-system connections include connections with mobile devices, notebook and desktop computers, tablets, printers, copiers, facsimile machines, scanners, sensors, and servers. Organizations can authorize internal connections for a class of system components with common characteristics and/or configurations, including printers, scanners, and copiers with a specified processing, transmission, and storage capability or smart phones and tablets with a specific baseline configuration. The continued need for an internal system connection is reviewed from the perspective of whether it provides support for organizational missions or

50

NIST SP 800-172r3 fpd (Final Public Draft) September 2025

Enhanced Security Requirements for Protecting CUI

1742 1743

business functions. This requirement is sourced to a control tailored out of the SP 800-53B [13] moderate baseline in SP 800-171.

1744

PROTECTION STRATEGY

1745

PRA

1746

ADVERSARY EFFECTS

1747

Preclude (Preempt), Impede (Exert)

1748

REFERENCES

1749

Source Control: CA-09

1750

3.13. System and Communications Protection

1751

03.13.01E Heterogeneity

1752 1753 1754

Employ a diverse set of information technologies for the following system components in the implementation of the system: [Assignment: organizationdefined system components].

1755

DISCUSSION

1756 1757 1758 1759 1760 1761 1762 1763 1764 1765 1766

Increasing the diversity of information technologies within organizational systems reduces the impact of exploitations or compromises of specific technologies. Such diversity protects against common mode failures, including those failures induced by supply chain attacks. Diversity in information technologies also reduces the likelihood that the means adversaries use to compromise one system component will be effective against other system components, thus further increasing the adversary work factor to successfully complete planned attacks. An increase in diversity may add complexity and management overhead that could ultimately lead to mistakes and unauthorized configurations. This requirement does not enhance a specific requirement in SP 800-171 but can be used to strengthen the protection of CUI associated with critical programs or high value assets.

1767

PROTECTION STRATEGY

1768

PRA, CRS

1769

ADVERSARY EFFECTS

1770

Preclude (Preempt), Impede (Contain, Exert), Limit (Reduce)

1771

REFERENCES

1772

Source Control: SC-29

51

NIST SP 800-172r3 fpd (Final Public Draft) September 2025

1773

Enhanced Security Requirements for Protecting CUI

03.13.02E Randomness

1774 1775

Employ [Assignment: organization-defined techniques] to introduce randomness into organizational operations and assets.

1776

DISCUSSION

1777 1778 1779 1780 1781 1782 1783 1784 1785 1786 1787

Randomness introduces increased levels of uncertainty for adversaries regarding the actions that organizations take to defend their systems against attacks. Such actions may impede the ability of adversaries to correctly target organizational systems that support critical missions or business functions. Uncertainty may cause adversaries to hesitate before initiating or continuing attacks. Misdirection techniques that involve randomness include performing certain routine actions at different times of day, employing different information technologies, using different suppliers, and rotating the roles and responsibilities of organizational personnel. This requirement does not enhance a specific requirement in SP 800-171 but can be used to strengthen the protection of CUI associated with critical programs or high value assets. This requirement also depends on the selection of 03.13.03E.

1788

PROTECTION STRATEGY

1789

PRA, CRS

1790

ADVERSARY EFFECTS

1791

Preclude (Preempt), Impede (Exert), Redirect (Deceive)

1792

REFERENCES

1793

Source Control: SC-30(02)

1794

03.13.03E Concealment and Misdirection

1795 1796 1797

Employ the following concealment and misdirection techniques to mislead adversaries: [Assignment: organization-defined concealment and misdirection techniques].

1798

DISCUSSION

1799 1800 1801 1802 1803 1804 1805 1806 1807

Concealment and misdirection techniques can significantly reduce the targeting capabilities of adversaries (i.e., window of opportunity and available attack surface) to initiate and complete attacks. For example, virtualization techniques provide organizations with the ability to disguise systems, potentially reducing the likelihood of successful attacks without the cost of having multiple platforms. The increased use of specific concealment and misdirection techniques and methods, including randomness, uncertainty, and virtualization, may sufficiently confuse and mislead adversaries and subsequently increase the risk of discovery or exposing tradecraft. Concealment and misdirection techniques may provide additional time to perform 52

NIST SP 800-172r3 fpd (Final Public Draft) September 2025

Enhanced Security Requirements for Protecting CUI

1808 1809 1810 1811 1812

core mission and business functions. The implementation of concealment and misdirection techniques may add to the complexity and management overhead required for the system. This requirement does not enhance a specific requirement in SP 800-171 but can be used to strengthen the protection of CUI associated with critical programs or high value assets.

1813

PROTECTION STRATEGY

1814

PRA, CRS

1815

ADVERSARY EFFECTS

1816

Preclude (Preempt), Impede (Exert), Redirect (Deceive)

1817

REFERENCES

1818

Source Control: SC-30

1819

03.13.04E Isolation of System Components

1820 1821

Employ boundary protection mechanisms to isolate [Assignment: organizationdefined system components].

1822

DISCUSSION

1823 1824 1825 1826 1827 1828 1829 1830 1831 1832

Organizations can isolate system components that perform different mission or business functions. Isolating system components with boundary protection mechanisms provides the capability for increased protection of individual system components and to more effectively control information flows between those components. The degree of isolation varies depending on the mechanisms selected. Boundary protection mechanisms include routers, gateways, and firewalls that separate system components into physically separate networks or subnetworks; cross-domain devices that separate subnetworks; virtualization techniques; and the encryption of information flows among system components using distinct encryption keys. This requirement enhances SP 800-171 requirement 03.13.01.

1833

PROTECTION STRATEGY

1834

PRA

1835

ADVERSARY EFFECTS

1836

Preclude (Preempt), Impede (Exert), Limit (Reduce)

1837

REFERENCES

1838

Source Control: SC-07(21)

53

NIST SP 800-172r3 fpd (Final Public Draft) September 2025

1839

Enhanced Security Requirements for Protecting CUI

03.13.05E Change Processing and Storage Locations

1840 1841 1842

Change the location of [Assignment: organization-defined processing and/or storage] [Selection (one): [Assignment: organization-defined time frequency]; at random time intervals].

1843

DISCUSSION

1844 1845 1846 1847 1848 1849 1850 1851 1852 1853 1854 1855 1856 1857 1858 1859 1860 1861

Adversaries target critical missions and business functions and the systems that support those missions and business functions while also trying to minimize the exposure of their existence and tradecraft. The static, homogeneous, and deterministic nature of organizational systems targeted by adversaries make such systems more susceptible to attacks with less adversary cost and effort to be successful. Changing processing and storage locations (also referred to as moving target defense) addresses the advanced persistent threat using techniques such as virtualization, distributed processing, and replication. This enables organizations to relocate the system components (i.e., processing, storage) that support critical missions and business functions. Changing the locations of processing activities and/or storage sites introduces a degree of uncertainty to the targeting activities of adversaries. The targeting uncertainty increases the work factor of adversaries and makes compromises or breaches of the organizational systems more difficult and time-consuming. Uncertainty also increases the chances that adversaries may inadvertently disclose aspects of their tradecraft while attempting to locate critical organizational assets. This requirement does not enhance a specific requirement in SP 800-171 but can be used to strengthen the protection of CUI associated with critical programs or high value assets.

1862

PROTECTION STRATEGY

1863

CRS, DLO

1864

ADVERSARY EFFECTS

1865

Preclude (Preempt, Negate), Impede (Contain, Exert), Limit (Reduce)

1866

REFERENCES

1867

Source Control: SC-30(03)

1868

03.13.06E Platform-Independent Applications

1869 1870

Include within organizational systems the following platform independent applications: [Assignment: organization-defined platform-independent applications].

1871

DISCUSSION

1872 1873

Platforms are the hardware, software, and firmware components used to execute the organization’s software applications. Platforms include operating systems, the 54

NIST SP 800-172r3 fpd (Final Public Draft) September 2025

Enhanced Security Requirements for Protecting CUI

1874 1875 1876 1877 1878 1879 1880 1881

underlying computer architectures, or both. Platform-independent applications are applications with the capability to execute on multiple platforms. Such applications promote portability and reconstitution on different platforms. The portability of applications and the ability to reconstitute applications on different platforms increase the availability of mission-essential functions within organizations when systems with specific operating systems are under attack. This requirement does not enhance a specific requirement in SP 800-171 but can be used to strengthen the protection of CUI associated with critical programs or high value assets.

1882

PROTECTION STRATEGY

1883

CRS

1884

ADVERSARY EFFECTS

1885

Limit (Shorten, Reduce)

1886

REFERENCES

1887

Source Control: SC-27

1888

03.13.07E Virtualization Techniques

1889 1890 1891

Employ virtualization techniques to support the deployment of a diversity of operating systems and applications that are changed [Assignment: organizationdefined frequency].

1892

DISCUSSION

1893 1894 1895 1896 1897 1898 1899 1900 1901 1902

While frequent changes to operating systems and applications can pose significant configuration management challenges, the changes can result in an increased work factor for adversaries to conduct successful attacks. Changing virtual operating systems or applications, as opposed to changing actual operating systems or applications, provides virtual changes that impede attacker success while reducing configuration management efforts. Virtualization techniques can assist in isolating untrustworthy software or software of dubious provenance into confined execution environments. This requirement does not enhance a specific requirement in SP 800171 but can be used to strengthen the protection of CUI associated with critical programs or high value assets.

1903

PROTECTION STRATEGY

1904

PRA, CRS

1905

ADVERSARY EFFECTS

1906

Preclude (Preempt), Impede (Exert), Limit (Reduce)

55

NIST SP 800-172r3 fpd (Final Public Draft) September 2025

1907

REFERENCES

1908

Source Control: SC-29(01)

1909

Enhanced Security Requirements for Protecting CUI

03.13.08E Decoys

1910 1911

Include components within organizational systems specifically designed to be the target of malicious attacks for detecting, deflecting, and analyzing such attacks.

1912

DISCUSSION

1913 1914 1915 1916 1917 1918 1919

Decoys (i.e., honeypots, honeynets, or deception nets) are established to attract adversaries and deflect attacks away from the operational systems that support organizational missions and business functions. The use of decoys requires some supporting isolation measures to ensure that any deflected malicious code does not infect organizational systems. This requirement does not enhance a specific requirement in SP 800-171 but can be used to strengthen the protection of CUI associated with critical programs or high value assets.

1920

PROTECTION STRATEGY

1921

DLO, CRS

1922

ADVERSARY EFFECTS

1923

Expose (Detect), Limit (Reduce)

1924

REFERENCES

1925

Source Control: SC-26

1926

03.13.09E Isolation of Security Tools, Mechanisms, and Support Components

1927 1928 1929 1930

Isolate [Assignment: organization-defined information security tools, mechanisms, and support components] from other internal system components by implementing physically separate subnetworks with managed interfaces to other components of the system.

1931

DISCUSSION

1932 1933 1934 1935 1936

Physically separate subnetworks with managed interfaces are useful for isolating computer network defenses from critical operational processing networks to prevent adversaries from discovering the analysis and forensics techniques employed by organizations. This requirement enhances SP 800-171 requirement 03.13.01.

56

NIST SP 800-172r3 fpd (Final Public Draft) September 2025

1937

PROTECTION STRATEGY

1938

PRA

1939

ADVERSARY EFFECTS

1940

Preclude (Preempt), Impede (Exert)

1941

REFERENCES

1942

Source Control: SC-07(13)

1943

Enhanced Security Requirements for Protecting CUI

03.13.10E Separate Subnetworks

1944 1945

Implement separate network addresses to connect to systems in different security domains.

1946

DISCUSSION

1947 1948 1949

The decomposition of systems into subnetworks (i.e., subnets) helps to provide the appropriate level of protection for network connections to different security domains. This requirement enhances SP 800-171 requirement 03.13.01.

1950

PROTECTION STRATEGY

1951

PRA

1952

ADVERSARY EFFECTS

1953

Preclude (Preempt), Impede (Exert), Limit (Reduce)

1954

REFERENCES

1955

Source Control: SC-07(22)

1956

03.13.11E Thin Nodes

1957 1958

Employ minimal functionality and information storage on the following system components: [Assignment: organization-defined system components].

1959

DISCUSSION

1960 1961 1962 1963 1964 1965

The deployment of system components with minimal functionality reduces the need to secure every endpoint and may reduce the exposure of information, systems, and services to attacks. Reduced or minimal functionality includes diskless nodes and thin client technologies. This requirement does not enhance a specific requirement in SP 800-171 but can be used to strengthen the protection of CUI associated with critical programs or high value assets.

1966

PROTECTION STRATEGY 57

NIST SP 800-172r3 fpd (Final Public Draft) September 2025

Enhanced Security Requirements for Protecting CUI

1967

PRA

1968

ADVERSARY EFFECTS

1969

Preclude (Preempt), Impede (Contain)

1970

REFERENCES

1971

Source Control: SC-25

1972

03.13.12E Denial-of-Service Protection

1973 1974 1975

a. [Selection (one): Protect against; Limit] the effects of the following types of denial-of-service events: [Assignment: organization-defined types of denial-ofservice events].

1976 1977 1978

b. Employ the following safeguards to prevent the denial-of-service events[Assignment: organization-defined safeguards by type of denial-of-service event].

1979

DISCUSSION

1980 1981 1982 1983 1984 1985 1986 1987 1988 1989 1990

Denial-of-service events may occur due to a variety of internal and external causes, such as an attack by an adversary or a lack of planning to support organizational needs with respect to capacity and bandwidth. Such attacks can occur across a wide range of network protocols (e.g., IPv4, IPv6). A variety of technologies are available to limit or eliminate the origination and effects of denial-of-service events. For example, boundary protection devices can filter certain types of packets to protect system components on internal networks from being directly affected by or the source of denial-of-service attacks. Employing increased network capacity and bandwidth combined with service redundancy also reduces the susceptibility to denial-of-service events. This requirement is sourced to a control tailored out of the SP 800-53B [13] moderate baseline in SP 800-171.

1991

PROTECTION STRATEGY

1992

PRA, CRS

1993

ADVERSARY EFFECTS

1994

Preclude (Preempt, Negate), Impede (Exert), Limit (Reduce)

1995

REFERENCES

1996

Source Control: SC-05

58

NIST SP 800-172r3 fpd (Final Public Draft) September 2025

1997

Enhanced Security Requirements for Protecting CUI

03.13.13E Port and Input/Output Device Access

1998 1999 2000 2001

[Selection (one): Physically; Logically] disable or remove [Assignment: organizationdefined connection ports or input/output devices] on the following systems or system components: [Assignment: organization-defined systems or system components].

2002

DISCUSSION

2003 2004 2005 2006 2007 2008 2009 2010 2011

Connection ports include Universal Serial Bus (USB), Thunderbolt, and Firewire (IEEE 1394). Input/output (I/O) devices include optical drives (e.g., compact disc and digital versatile disc drives), printers, and network attached storage devices. Disabling or removing such connection ports and I/O devices helps prevent the exfiltration of information from systems and the introduction of malicious code from those ports or devices. Physically disabling or removing ports and/or devices is the stronger action. This requirement does not enhance a specific requirement in SP 800-171 but can be used to strengthen the protection of CUI associated with critical programs or high value assets.

2012

PROTECTION STRATEGY

2013

PRA

2014

ADVERSARY EFFECTS

2015

Preclude (Preempt), Impede (Contain)

2016

REFERENCES

2017

Source Control: SC-41

2018

03.13.14E Detonation Chambers

2019 2020

Employ a detonation chamber capability within [Assignment: organization-defined system, system component, or location].

2021

DISCUSSION

2022 2023 2024 2025 2026 2027 2028 2029 2030 2031

Detonation chambers (also known as dynamic execution environments) allow organizations to open email attachments, execute untrusted or suspicious applications, and execute URL requests in the safety of an isolated environment or a virtualized sandbox. Protected and isolated execution environments provide a means of determining whether the associated attachments or applications contain malicious code. While related to the concept of deception nets, the employment of detonation chambers is not intended to maintain a long-term environment in which adversaries can operate and their actions can be observed. Rather, detonation chambers are intended to quickly identify malicious code and either reduce the likelihood that the code is propagated to user environments of operation or prevent 59

NIST SP 800-172r3 fpd (Final Public Draft) September 2025

Enhanced Security Requirements for Protecting CUI

2032 2033 2034

such propagation completely. This requirement does not enhance a specific requirement in SP 800-171 but can be used to strengthen the protection of CUI associated with critical programs or high value assets.

2035

PROTECTION STRATEGY

2036

PRA, DLO

2037

ADVERSARY EFFECTS

2038

Preclude (Preempt, Negate), Impede (Contain, Exert), Expose (Detect, Reveal)

2039

REFERENCES

2040

Source Control: SC-44

2041

03.13.15E Separate Subnets to Isolate System Components and Functions

2042 2043 2044

Implement [Selection (one): physically; logically] separate subnetworks to isolate the following critical system components and functions: [Assignment: organizationdefined critical system components and functions].

2045

DISCUSSION

2046 2047 2048 2049 2050 2051 2052 2053

Separating critical system components and functions from other noncritical system components and functions through separate subnetworks may be necessary to reduce susceptibility to a catastrophic or debilitating breach or compromise that results in system failure. For example, physically separating the command-andcontrol function from the in-flight entertainment function through separate subnetworks in a commercial aircraft provides an increased level of assurance in the trustworthiness of critical system functions. This requirement enhances SP 800-171 requirement 03.13.01.

2054

PROTECTION STRATEGY

2055

PRA

2056

ADVERSARY EFFECTS

2057

Preclude (Preempt), Impede (Exert), Limit (Reduce)

2058

REFERENCES

2059

Source Control: SC-07(29)

2060 2061 2062

03.13.16E System Partitioning Partition the system into [Assignment: organization-defined system components] residing in separate [Selection (one): physical; logical] domains or environments

60

NIST SP 800-172r3 fpd (Final Public Draft) September 2025

Enhanced Security Requirements for Protecting CUI

2063 2064

based on [Assignment: organization-defined circumstances for physical or logical separation of components].

2065

DISCUSSION

2066 2067 2068 2069 2070 2071 2072 2073

System partitioning is part of a defense-in-depth protection strategy. Organizations determine the degree of physical separation of system components. Physical separation options include physically distinct components in separate racks in the same room, critical components in separate rooms, and geographical separation of critical components. Managed interfaces restrict or prohibit network access and information flow among partitioned system components. This requirement does not enhance a specific requirement in SP 800-171 but can be used to strengthen the protection of CUI associated with critical programs or high value assets.

2074

PROTECTION STRATEGY

2075

PRA, DLO

2076

ADVERSARY EFFECTS

2077

Preclude (Preempt), Impede (Exert), Limit (Reduce)

2078

REFERENCES

2079

Source Control: SC-32

2080

3.14. System and Information Integrity

2081

03.14.01E Software, Firmware, and Information Integrity

2082 2083 2084

a. Employ integrity verification tools to detect unauthorized changes to the following software, firmware, and information: [Assignment: organizationdefined software, firmware, and information].

2085 2086 2087

b. Take the following actions when unauthorized changes to the software, firmware, and information are detected: [Assignment: organization-defined actions].

2088

DISCUSSION

2089 2090 2091 2092 2093 2094 2095 2096

Verifying the integrity of security-critical or essential software is an important capability since corrupted software is the primary attack vector used by adversaries to undermine or disrupt the proper functioning of systems. Unauthorized changes to software, firmware, and information can occur due to errors or malicious activity. Software includes boot firmware, operating systems with key internal components (e.g., kernels or drivers), middleware, and applications. Firmware interfaces include Unified Extensible Firmware Interface (UEFI) and Basic Input/Output Systems (BIOS). Information includes CUI and metadata that contains security attributes associated 61

NIST SP 800-172r3 fpd (Final Public Draft) September 2025

Enhanced Security Requirements for Protecting CUI

2097 2098 2099 2100 2101 2102 2103 2104 2105

with information. Integrity-checking mechanisms—including parity checks, cyclical redundancy checks, cryptographic hashes, and associated tools—can automatically monitor the integrity of systems and hosted applications. There are many ways to verify software integrity throughout the system development life cycle. Root of trust mechanisms (e.g., secure boot, trusted platform modules, UEFI) verify that only trusted code is executed during boot processes. The employment of cryptographic signatures ensures the integrity and authenticity of critical software that stores, processes, or transmits, CUI. This requirement is sourced to a control tailored out of the SP 800-53B [13] moderate baseline in SP 800-171.

2106

PROTECTION STRATEGY

2107

PRA, DLO

2108

ADVERSARY EFFECTS

2109

Preclude (Preempt), Expose (Detect)

2110

REFERENCES

2111

Source Control: SI-07

2112 2113 2114 2115 2116 2117

03.14.02E Withdrawn Addressed by 03.14.06 (SP 800-171). 03.14.03E Withdrawn Addressed by 03.15.01E, 03.13.16E, 03.12.01 (SP 800-171), 03.13.01 (SP 800-171), and 03.16.01 (SP 800-171). 03.14.04E Refresh From Trusted Sources

2118 2119 2120

Obtain software and data employed during system component, and service refreshes from the following trusted sources: [Assignment: organization-defined trusted sources].

2121

DISCUSSION

2122 2123 2124 2125

Trusted sources include software and data from write-once, read-only media or from selected offline secure storage facilities. This requirement does not enhance a specific requirement in SP 800-171 but can be used to strengthen the protection of CUI associated with critical programs or high value assets.

2126

PROTECTION STRATEGY

2127

PRA

62

NIST SP 800-172r3 fpd (Final Public Draft) September 2025

2128

ADVERSARY EFFECTS

2129

Preclude (Preempt), Impede (Exert)

2130

REFERENCES

2131

Source Control: SI-14(01)

2132

Enhanced Security Requirements for Protecting CUI

03.14.05E Non-Persistent Information

2133 2134 2135

a. [Selection (one): Refresh [Assignment: organization-defined information] [Assignment: organization-defined frequency]; Generate [Assignment: organization-defined information] on demand].

2136

b. Delete information when no longer needed.

2137

DISCUSSION

2138 2139 2140 2141 2142 2143 2144 2145

Retaining information longer than is required makes that information a potential target for advanced adversaries searching for high value assets to compromise through unauthorized disclosure, unauthorized modification, or exfiltration. For system-related information, unnecessary retention provides adversaries with information that can assist in their reconnaissance and lateral movement through the system. This requirement does not enhance a specific requirement in SP 800-171 but can be used to strengthen the protection of CUI associated with critical programs or high value assets.

2146

PROTECTION STRATEGY

2147

PRA

2148

ADVERSARY EFFECTS

2149

Preclude (Preempt), Impede (Exert)

2150

REFERENCES

2151

Source Control: SI-14(02)

2152 2153 2154 2155

03.14.06E Withdrawn Addressed by 03.11.02E and 03.11.09E. 03.14.07E Withdrawn Addressed by 03.14.08E, 03.14.10E, 03.14.14E, 03.17.03E, 03.16.01 (SP 800-171)

63

NIST SP 800-172r3 fpd (Final Public Draft) September 2025

2156

Enhanced Security Requirements for Protecting CUI

03.14.08E Integrity Checks

2157 2158 2159 2160

Perform an integrity check of [Assignment: organization-defined software, firmware, and information] [Selection (one or more): at startup; at [Assignment: organizationdefined transitional states or security-relevant events]; [Assignment: organizationdefined frequency]].

2161

DISCUSSION

2162 2163 2164 2165 2166

Security-relevant events include the identification of new threats to which organizational systems are susceptible and the installation of hardware, software, or firmware. Transitional states include system startup, restart, shutdown, and abort. This requirement is sourced to a control tailored out of the SP 800-53B [13] moderate baseline in SP 800-171.

2167

PROTECTION STRATEGY

2168

PRA

2169

ADVERSARY EFFECTS

2170

Preclude (Preempt), Impede (Exert)

2171

REFERENCES

2172

Source Control: SI-07(01)

2173

03.14.09E Cryptographic Protection

2174 2175

Implement cryptographic mechanisms to detect unauthorized changes to software, firmware, and information.

2176

DISCUSSION

2177 2178 2179 2180 2181 2182 2183 2184

Cryptographic mechanisms used to protect integrity include digital signatures and the computation and application of signed hashes using asymmetric cryptography, protecting the confidentiality of the key used to generate the hash, and using the public key to verify the hash information. Organizations that use cryptographic mechanisms also consider cryptographic key management solutions. This requirement does not enhance a specific requirement in SP 800-171 but can be used to strengthen the protection of CUI associated with critical programs or high value assets.

2185

PROTECTION STRATEGY

2186

PRA, DLO

2187

ADVERSARY EFFECTS

2188

Preclude (Preempt), Impede (Exert), Expose (Detect) 64

NIST SP 800-172r3 fpd (Final Public Draft) September 2025

2189

REFERENCES

2190

Source Control: SI-07(06)

2191

Enhanced Security Requirements for Protecting CUI

03.14.10E Protection of Boot Firmware

2192 2193 2194

Implement the following mechanisms to protect the integrity of boot firmware in [Assignment: organization-defined system components]: [Assignment: organizationdefined mechanisms].

2195

DISCUSSION

2196 2197 2198 2199 2200 2201 2202 2203 2204 2205

Unauthorized modifications to boot firmware may indicate a sophisticated, targeted attack. These types of targeted attacks can result in a permanent denial of service or a persistent malicious code presence. These situations can occur if the firmware is corrupted or malicious code is embedded in the firmware. System components can protect the integrity of boot firmware in organizational systems by verifying the integrity and authenticity of updates to the firmware prior to applying changes to the system component and preventing unauthorized processes from modifying the boot firmware. This requirement does not enhance a specific requirement in SP 800171 but can be used to strengthen the protection of CUI associated with critical programs or high value assets.

2206

PROTECTION STRATEGY

2207

PRA

2208

ADVERSARY EFFECTS

2209

Preclude (Preempt), Impede (Exert)

2210

REFERENCES

2211

Source Control: SI-07(10)

2212

03.14.11E Integration of Detection and Response

2213 2214 2215

Incorporate the detection of the following unauthorized changes into the organizational incident response capability: [Assignment: organization-defined security-relevant changes to the system].

2216

DISCUSSION

2217 2218 2219 2220 2221

Integrating detection and response ensures that detected events are tracked, monitored, corrected, and available for historical purposes. Maintaining historical records is important to identify and discern adversary actions over an extended time period and for possible legal actions. Security-relevant changes include unauthorized changes to established configuration settings or the unauthorized elevation of

65

NIST SP 800-172r3 fpd (Final Public Draft) September 2025

Enhanced Security Requirements for Protecting CUI

2222 2223

system privileges. This requirement is sourced to a control tailored out of the SP 800-53B [13] moderate baseline in SP 800-171.

2224

PROTECTION STRATEGY

2225

DLO

2226

ADVERSARY EFFECTS

2227

Expose (Detect)

2228

REFERENCES

2229

Source Control: SI-07(07)

2230

03.14.12E Information Input Validation

2231 2232

Check the validity of the following information inputs: [Assignment: organizationdefined information inputs to the system].

2233

DISCUSSION

2234 2235 2236 2237 2238 2239 2240 2241 2242 2243 2244 2245 2246 2247 2248 2249 2250

Checking the valid syntax and semantics of system inputs—including character set, length, numerical range, and acceptable values—verifies that inputs match specified definitions for format and content. Valid inputs are likely to vary from field to field within a software application. Applications typically follow well-defined protocols that use structured messages (i.e., commands or queries) to communicate between software modules or system components. Structured messages can contain raw or unstructured data interspersed with metadata or control information. If software applications use attacker-supplied inputs to construct structured messages without properly encoding such messages, the attacker could insert malicious commands or special characters that can cause the data to be interpreted as control information or metadata. Consequently, the module or component that receives the corrupted output will perform incorrect operations or otherwise interpret the data incorrectly. Prescreening inputs prior to passing them to interpreters prevents content from being unintentionally interpreted as commands. Input validation ensures accurate and correct inputs and prevents attacks, such as cross-site scripting and a variety of injection attacks. This requirement is sourced to a control tailored out of the SP 80053B [13] moderate baseline in SP 800-171.

2251

PROTECTION STRATEGY

2252

PRA

2253

ADVERSARY EFFECTS

2254

Preclude (Preempt)

66

NIST SP 800-172r3 fpd (Final Public Draft) September 2025

2255

REFERENCES

2256

Source Control: SI-10

2257

Enhanced Security Requirements for Protecting CUI

03.14.13E Error Handling

2258 2259

a. Generate error messages that provide information necessary for corrective actions without revealing information that could be exploited.

2260 2261

b. Reveal error messages only to [Assignment: organization-defined personnel or roles].

2262

DISCUSSION

2263 2264 2265 2266 2267 2268 2269 2270 2271 2272

Organizations consider the structure and content of error messages. The extent to which systems can handle error conditions is guided and informed by organizational policy and operational requirements. Exploitable information includes stack traces and implementation details; erroneous logon attempts with passwords mistakenly entered as the username; mission or business information that can be derived from, if not stated explicitly by, the information recorded; and personally identifiable information, such as account numbers, Social Security numbers, and credit card numbers. Error messages may also provide a covert channel for transmitting information. This requirement is sourced to a control tailored out of the SP 800-53B [13] moderate baseline in SP 800-171.

2273

PROTECTION STRATEGY

2274

PRA

2275

ADVERSARY EFFECTS

2276

Preclude (Preempt)

2277

REFERENCES

2278

Source Control: SI-11

2279

03.14.14E Memory Protection

2280 2281

Implement the following safeguards to protect the system memory from unauthorized code execution: [Assignment: organization-defined safeguards].

2282

DISCUSSION

2283 2284 2285 2286 2287

Some adversaries launch attacks with the intent of executing code in non-executable regions of memory or in memory locations that are prohibited. The safeguards used to protect memory include data execution prevention and address space layout randomization (ASLR). Data execution prevention safeguards can be hardware- or software-enforced with hardware enforcement providing the greater strength of 67

NIST SP 800-172r3 fpd (Final Public Draft) September 2025

Enhanced Security Requirements for Protecting CUI

2288 2289

mechanism. This requirement is sourced to a control tailored out of the SP 800-53B [13] moderate baseline in SP 800-171.

2290

PROTECTION STRATEGY

2291

PRA

2292

ADVERSARY EFFECTS

2293

Preclude (Preempt), Impede (Exert)

2294

REFERENCES

2295

Source Control: SI-16

2296

03.14.15E Non-Persistent System Components and Services

2297 2298

a. Implement non-persistent [Assignment: organization-defined system components and services] .

2299

b. Initiate non-persistent system components and services from a known state.

2300 2301 2302

c. Terminate non-persistent system components and services [Selection (one or more): upon end of session of use; [Assignment: organization-defined frequency]].

2303

DISCUSSION

2304 2305 2306 2307 2308 2309 2310 2311 2312 2313 2314 2315 2316

Implementation of non-persistent components and services mitigates risk from advanced persistent threats (APTs) by reducing the targeting capability of adversaries (i.e., window of opportunity and available attack surface) to initiate and complete attacks. By implementing the concept of non-persistence for selected system components and services, organizations can provide a trusted computing resource for a specific time period that does not give adversaries sufficient time to exploit vulnerabilities in their systems and operating environments. The use of nonpersistent components and services mitigates risk by limiting the targeting capability of adversaries (i.e., reducing the window of opportunity and available attack surface) to initiate and complete attacks. Non-persistent system components and services are activated as required from a known (trusted) state and terminated periodically or at the end of sessions. The use of non-persistent system components and services also increases the work factor of adversaries.

2317 2318 2319 2320 2321 2322

Non-persistence can be achieved by refreshing system components, periodically reimaging components, or using a variety of common virtualization techniques. Nonpersistent services can be implemented by using virtual machines or as new instances of processes on physical machines (persistent or non-persistent). The benefit of periodic refreshes of system components and services is that it does not require organizations to determine in advance whether compromises have occurred,

68

NIST SP 800-172r3 fpd (Final Public Draft) September 2025

Enhanced Security Requirements for Protecting CUI

2323 2324 2325 2326 2327 2328

which may be difficult or impossible. The refresh of selected system components and services occurs with sufficient frequency to prevent the spread or intended impact of attacks but not with such frequency that it makes the system unstable. This requirement does not enhance a specific requirement in SP 800-171 but can be used to strengthen the protection of CUI associated with critical programs or high value assets.

2329

PROTECTION STRATEGY

2330

PRA, CRS

2331

ADVERSARY EFFECTS

2332

Preclude (Preempt), Impede (Exert), Limit (Shorten, Reduce)

2333

REFERENCES

2334

Source Control: SI-14

2335

03.14.16E Tainting

2336 2337 2338

Embed data or capabilities in the following systems or system components to determine if CUI has been exfiltrated or improperly removed from the organization: [Assignment: organization-defined systems or system components].

2339

DISCUSSION

2340 2341 2342 2343 2344 2345 2346 2347 2348 2349 2350 2351 2352 2353 2354 2355 2356

Many cyber-attacks target organizational information or information that the organization holds on behalf of other entities with the intent to exfiltrate that information. In addition, insider attacks and erroneous user procedures can remove information from the system in violation of organizational policies. Tainting approaches can range from passive to active. A passive tainting approach can be as simple as adding false email names and addresses to an internal database. If the organization receives email at one of the false email addresses, it knows that the database has been compromised. Moreover, the organization knows that the email was sent by an unauthorized entity, so any packets it includes potentially contain malicious code, and the unauthorized entity may have potentially obtained a copy of the database. Another tainting approach includes embedding false data or steganographic data in files to enable the data to be found via open-source analysis. An active tainting approach can include embedding software in the data that is able to “call home,” thereby alerting the organization to its capture and possibly its location and the path by which it was exfiltrated or removed. This requirement does not enhance a specific requirement in SP 800-171 but can be used to strengthen the protection of CUI associated with critical programs or high value assets.

2357

PROTECTION STRATEGY

2358

DLO 69

NIST SP 800-172r3 fpd (Final Public Draft) September 2025

2359

ADVERSARY EFFECTS

2360

Expose (Detect)

2361

REFERENCES

2362

Source Control: SI-20

2363

Enhanced Security Requirements for Protecting CUI

03.14.17E System-Generated Alerts

2364 2365 2366

Alert [Assignment: organization-defined personnel or roles] when the following system-generated indications of compromise or potential compromise occur: [Assignment: organization-defined compromise indicators].

2367

DISCUSSION

2368 2369 2370 2371 2372 2373 2374 2375 2376 2377 2378

Alerts may be generated from different sources internal to the system, including audit records, inputs from malicious code protection mechanisms, intrusion detection or prevention mechanisms, or boundary protection devices such as firewalls, gateways, and routers. Compromise indicators could include CUI being accessed by unauthorized users or when CUI traverses architecture outside of defined data flows. Alerts can be automated and transmitted telephonically, by electronic mail messages, or by text messaging. Organizational personnel on the alert notification list can include system administrators, mission or business owners, system owners, information owners or stewards, chief information security officers, and system security officers. This requirement is sourced to a control tailored out of the SP 800-53B [13] moderate baseline in SP 800-171.

2379

PROTECTION STRATEGY

2380

DLO

2381

ADVERSARY EFFECTS

2382

Expose (Detect)

2383

REFERENCES

2384

Source Controls: SI-04(05)

2385

03.14.18E Automated Organization-Generated Alerts

2386 2387 2388 2389

Alert [Assignment: organization-defined personnel or roles] using [Assignment: organization-defined automated mechanisms] when the following indications of inappropriate or unusual activities with security implications occur: [Assignment: organization-defined activities that trigger alerts].

2390

DISCUSSION

70

NIST SP 800-172r3 fpd (Final Public Draft) September 2025

Enhanced Security Requirements for Protecting CUI

2391 2392 2393 2394 2395 2396

Organization-generated alerts are focused on information sources that are external to the system, such as suspicious activity reports and reports on potential insider threats. Organizational personnel on the system alert notification list include system administrators, mission or business owners, system owners, chief information security officers, and system security officers. This requirement enhances SP 800171 requirement 03.14.06.

2397

PROTECTION STRATEGY

2398

DLO

2399

ADVERSARY EFFECTS

2400

Expose (Detect)

2401

REFERENCES

2402

Source Controls: SI-04(12)

2403

3.15. Planning

2404

03.15.01E Security Architecture

2405

a. Develop a security architecture for the system that:

2406 2407

1. Describes the security requirements and approach to be taken for protecting the confidentiality, integrity, and availability of CUI,

2408 2409

2. Describes how the architecture is integrated into and supports the enterprise architecture, and

2410 2411

3. Describes any assumptions about, and dependencies on, external systems and services.

2412 2413

b. Review and update the security architecture [Assignment: organization-defined frequency] to reflect changes in the enterprise architecture.

2414 2415 2416

c. Reflect planned security architecture changes in system security plans, concept of operations, criticality analysis, organizational procedures, and procurements and acquisitions.

2417

DISCUSSION

2418 2419 2420 2421 2422 2423

The security architecture at the system level is consistent with the organization-wide security architecture, which is integral to and developed as part of the enterprise architecture. The security architecture includes an architectural description, the allocation of security functionality (i.e., safeguards and countermeasures), securityrelated information for external interfaces, information being exchanged across the interfaces, and the protection mechanisms associated with each interface. The

71

NIST SP 800-172r3 fpd (Final Public Draft) September 2025

Enhanced Security Requirements for Protecting CUI

2424 2425 2426 2427 2428

architectures can also include other information, such as user roles and the access privileges assigned to each role; security requirements; types of information processed, stored, and transmitted by the system; cybersecurity supply chain risk management (CSCRM) requirements; restoration priorities of information and system services; and other protection needs.

2429 2430 2431 2432 2433 2434 2435 2436 2437 2438 2439

With the use of modern computing technologies, it is becoming less common for organizations to control all information resources. There may be key dependencies on external services and service providers. Describing such dependencies as part of the security architecture is necessary for developing a comprehensive CUI protection strategy. Establishing, documenting, and maintaining a baseline configuration for organizational systems under configuration control is critical to implementing and maintaining an effective security architecture. Guidance on developing trustworthy, secure, and cyber-resilient systems using systems security engineering practices and security design concepts is provided in SP 800-160v2 [23]. This requirement is sourced to a control tailored out of the SP 800-53B [13] moderate baseline in SP 800-171.

2440

PROTECTION STRATEGY

2441

PRA

2442

ADVERSARY EFFECTS

2443

Preclude (Preempt), Impede (Exert)

2444

REFERENCES

2445

Source Control: PL-08

2446

03.15.02E Defense In Depth

2447 2448

a. Design the security architecture for the system using a defense-in-depth approach.

2449 2450

b. Allocate [Assignment: organization-defined security requirements] to [Assignment: organization-defined architectural layers and locations].

2451 2452

c. Ensure that the allocated requirements operate in a coordinated and mutually reinforcing manner.

2453

DISCUSSION

2454 2455 2456 2457 2458

Organizations strategically allocate security requirements and the associated protection mechanisms in the security architecture so that adversaries must overcome multiple defensive layers to achieve their objective. Requiring adversaries to defeat multiple defensive layers makes it more difficult to attack systems by increasing the work factor of the adversary. It also increases the likelihood of

72

NIST SP 800-172r3 fpd (Final Public Draft) September 2025

Enhanced Security Requirements for Protecting CUI

2459 2460 2461

detection. Defense-in-depth architectural approaches include modularity and layering, the separation of system and user functionality, and security function isolation.

2462 2463 2464 2465 2466 2467 2468 2469

The coordination of allocated security requirements is essential to help ensure that an attack that involves one requirement does not create adverse, unintended consequences (e.g., system lockout and cascading alarms) by interfering with other requirements. The value of organizational assets and the impacts or consequences of loss are important considerations in providing additional defensive layers. This requirement does not enhance a specific requirement in SP 800-171 but can be used to strengthen the protection of CUI associated with critical programs or high value assets.

2470

PROTECTION STRATEGY

2471

PRA, CRS

2472

ADVERSARY EFFECTS

2473

Preclude (Preempt), Impede (Exert), Limit (Reduce)

2474

REFERENCES

2475

Source Control: PL-08(01)

2476

03.15.03E Supplier Diversity

2477 2478 2479

Require that [Assignment: organization-defined safeguards] allocated to [Assignment: organization-defined locations and architectural layers] are obtained from different suppliers.

2480

DISCUSSION

2481 2482 2483 2484 2485 2486 2487 2488 2489 2490

Information technology products have different strengths and weaknesses. Providing a broad spectrum of products complements the individual offerings. For example, vendors that offer malicious code protection typically update their products at different times and develop solutions for known viruses, Trojans, or worms based on their priorities and development schedules. Deploying different types of products from a diversity of suppliers at different locations increases the likelihood that at least one of the products will detect the malicious code. This requirement does not enhance a specific requirement in SP 800-171 but can be used to strengthen the protection of CUI associated with critical programs or high value assets.

2491

PROTECTION STRATEGY

2492

PRA, CRS

73

NIST SP 800-172r3 fpd (Final Public Draft) September 2025

Enhanced Security Requirements for Protecting CUI

2493

ADVERSARY EFFECTS

2494

Preclude (Preempt, Negate), Impede (Exert), Limit (Reduce)

2495

REFERENCES

2496

Source Control: PL-08(02)

2497

3.16. System and Services Acquisition

2498

03.16.01E Specialization

2499 2500 2501 2502

Employ [Selection (one or more): design; modification; augmentation; reconfiguration] on [Assignment: organization-defined systems or system components] supporting mission-essential services or functions to increase the trustworthiness in those systems or components.

2503

DISCUSSION

2504 2505 2506 2507 2508 2509 2510 2511 2512 2513

Systems or system components that support mission-essential services or functions can be enhanced or strengthened to maximize the trustworthiness of the resource. Sometimes, this enhancement or strengthening is done at the design level. In other instances, it is done post-design, either through modifications of the system in question or by augmenting the system with additional components. For example, supplemental authentication or non-repudiation functions may be added to the system to enhance critical resources that depend on organization-defined resources. This requirement does not enhance a specific requirement in SP 800-171 but can be used to strengthen the protection of CUI associated with critical programs or high value assets.

2514

PROTECTION STRATEGY

2515

PRA

2516

ADVERSARY EFFECTS

2517

Preclude (Preempt), Impede (Exert)

2518

REFERENCES

2519

Source Control: SA-23

2520

3.17. Supply Chain Risk Management

2521

03.17.01E Notification Agreements

74

NIST SP 800-172r3 fpd (Final Public Draft) September 2025

Enhanced Security Requirements for Protecting CUI

2522 2523 2524 2525

Establish agreements and procedures with entities involved in the supply chain for the system, system component, or system service for the [Selection (one or more): notification of supply chain compromises; results of assessments or audits; [Assignment: organization-defined information]].

2526

DISCUSSION

2527 2528 2529 2530 2531 2532 2533 2534 2535

Establishing agreements and procedures facilitates communications among supply chain entities. Early notification of compromises and potential compromises in the supply chain that may adversely affect or have adversely affected organizational systems or system components is essential for organizations to effectively respond to such incidents. The results of assessments or audits may include open-source information that contributed to a decision or result and could be used to help the supply chain entity resolve a concern or improve its processes. This requirement is sourced to a control tailored out of the SP 800-53B [13] moderate baseline in SP 800-171.

2536

PROTECTION STRATEGY

2537

DLO

2538

ADVERSARY EFFECTS

2539

Expose (Detect), Limit (Shorten, Reduce)

2540

REFERENCES

2541

Source Control: SR-08

2542

03.17.02E Inspection of Systems or Components

2543 2544 2545 2546

Inspect the following systems or system components [Selection (one or more): at random; [Assignment: organization-defined frequency]; upon [Assignment: organization-defined indications of need for inspection]] to detect tampering: [Assignment: organization-defined systems or system components].

2547

DISCUSSION

2548 2549 2550 2551 2552 2553 2554

Inspecting systems or systems components for evidence of tampering addresses physical and logical tampering and is applied to systems and system components that are removed from organization-controlled areas. Indications of a need for inspection include changes in packaging, specifications, factory location, or entity in which the part is purchased, and when individuals return from travel to high-risk locations. This requirement is sourced to a control tailored out of the SP 800-53B [13] moderate baseline in SP 800-171.

75

NIST SP 800-172r3 fpd (Final Public Draft) September 2025

2555

PROTECTION STRATEGY

2556

DLO

2557

ADVERSARY EFFECTS

2558

Expose (Detect)

2559

REFERENCES

2560

Source Control: SR-10

2561

Enhanced Security Requirements for Protecting CUI

03.17.03E Component Authenticity

2562 2563

a. Develop and implement anti-counterfeit policy and procedures that include the means to detect and prevent counterfeit components from entering the system.

2564 2565 2566

b. Report counterfeit system components to [Selection (one or more): source of counterfeit component; [Assignment: organization-defined external reporting organizations]; [Assignment: organization-defined personnel or roles]].

2567

DISCUSSION

2568 2569 2570 2571 2572 2573

Sources of counterfeit components include manufacturers, developers, vendors, and contractors. Anti-counterfeiting policies and procedures support tamper resistance and provide a level of protection against the introduction of malicious code. External reporting organizations include the Cybersecurity and Infrastructure Security Agency (CISA). This requirement is sourced to a control tailored out of the SP 800-53B [13] moderate baseline in SP 800-171.

2574

PROTECTION STRATEGY

2575

PRA, DLO

2576

ADVERSARY EFFECTS

2577

Preclude (Preempt), Expose (Detect)

2578

REFERENCES

2579

Source Control: SR-11

2580

03.17.04E Provenance

2581 2582 2583

Document, monitor, and maintain valid provenance of the following systems, system components, and associated CUI: [Assignment: organization-defined systems, system components, and associated CUI].

2584

DISCUSSION

76

NIST SP 800-172r3 fpd (Final Public Draft) September 2025

Enhanced Security Requirements for Protecting CUI

2585 2586 2587 2588 2589 2590 2591 2592 2593 2594 2595 2596

Every system and system component has a point of origin and may be changed throughout its existence. Provenance is the chronology of the origin, development, ownership, location, and changes to a system or system component and associated data. It may also include personnel and processes used to interact with or make modifications to the system, component, or associated data. Organizations have methods to document, monitor, and maintain valid provenance baselines for systems, system components, and related data. These actions help track, assess, and document any changes to the provenance, including changes in supply chain elements or configuration, and help ensure non-repudiation of provenance information and the provenance change records. This requirement does not enhance a specific requirement in SP 800-171 but can be used to strengthen the protection of CUI associated with critical programs or high value assets.

2597

PROTECTION STRATEGY

2598

PRA, DLO

2599

ADVERSARY EFFECTS

2600

Expose (Detect)

2601

REFERENCES

2602

Source Control: SR-04

2603

03.17.05E Supply Chain Integrity – Pedigree

2604 2605 2606 2607

Employ [Assignment: organization-defined safeguards] and conduct [Assignment: organization-defined analysis] to ensure the integrity of the system and system components by validating the internal composition and provenance of critical or mission-essential technologies, products, and services.

2608

DISCUSSION

2609 2610 2611 2612 2613 2614 2615 2616 2617 2618 2619 2620 2621

Authoritative information regarding the internal composition of system components and the provenance of technology, products, and services provides a strong basis for trust. The validation of the internal composition and provenance of technologies, products, and services is referred to as the pedigree. For microelectronics, this includes the material composition of components. For software this includes the composition of open-source and proprietary code, including the version of the component at a given point in time. Pedigrees increase the assurance that the claims suppliers assert about the internal composition and provenance of the products, services, and technologies they provide are valid. The validation of the internal composition and provenance can be achieved by various evidentiary artifacts or records that manufacturers and suppliers produce during the research, development, design, manufacturing, acquisition, delivery, integration, operations, maintenance, and disposal of technology, products, and services. Evidentiary 77

NIST SP 800-172r3 fpd (Final Public Draft) September 2025

Enhanced Security Requirements for Protecting CUI

2622 2623 2624 2625 2626 2627

artifacts include software identification (SWID) tags, software component inventory, the manufacturers’ declarations of platform attributes (e.g., serial numbers, hardware component inventory), and measurements (e.g., firmware hashes) that are tightly bound to the hardware. This requirement does not enhance a specific requirement in SP 800-171 but can be used to strengthen the protection of CUI associated with critical programs or high value assets.

2628

PROTECTION STRATEGY

2629

DLO

2630

ADVERSARY EFFECTS

2631

Expose (Detect)

2632

REFERENCES

2633

Source Control: SR-04(04)

78

NIST SP 800-172r3 fpd (Final Public Draft) September 2025

Enhanced Security Requirements for Protecting CUI

2634

References

2635 2636 2637 2638 2639 2640 2641 2642 2643 2644 2645 2646 2647 2648 2649 2650 2651 2652 2653 2654 2655 2656 2657 2658 2659 2660 2661 2662 2663 2664 2665 2666 2667 2668 2669 2670 2671 2672 2673 2674

[1] Executive Order 13556 (2010) Controlled Unclassified Information. (The White House, Washington, DC), DCPD-201000942, November 4, 2010. Available at https://www.govinfo.gov/app/details/DCPD-201000942 [2] Executive Order 13526 (2009) Classified National Security Information. (The White House, Washington, DC), DCPD-200901022, December 29, 2009. Available at https://www.govinfo.gov/app/details/DCPD-200901022 [3] Atomic Energy Act (P.L. 83-703), August 1954. Available at https://www.govinfo.gov/app/details/STATUTE-68/STATUTE-68-Pg919 [4] National Archives and Records Administration (2019) Controlled Unclassified Information (CUI) Registry. Available at https://www.archives.gov/cui [5] 32 CFR Part 2002 (2016), Controlled Unclassified Information (CUI), September 2016. Available at https://www.govinfo.gov/content/pkg/CFR-2018-title32-vol6/pdf/CFR-2018title32-vol6-part2002.pdf [6] National Institute of Standards and Technology (2004) Standards for Security Categorization of Federal Information and Information Systems. (U.S. Department of Commerce, Washington, DC), Federal Information Processing Standards Publication (FIPS) 199. https://doi.org/10.6028/NIST.FIPS.199 [7] National Institute of Standards and Technology (2006) Minimum Security Requirements for Federal Information and Information Systems. (U.S. Department of Commerce, Washington, DC), Federal Information Processing Standards Publication (FIPS) 200. https://doi.org/10.6028/NIST.FIPS.200 [8] Joint Task Force (2020) Security and Privacy Controls for Information Systems and Organizations. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) NIST SP 800-53r5, Includes updates as of December 10, 2020. https://doi.org/10.6028/NIST.SP.800-53r5 [9] Department of Defense, Defense Acquisition University (2020), DAU Glossary of Defense Acquisition Acronyms and Terms. https://www.dau.edu/glossary/Pages/Glossary.aspx [10] Office of Management and Budget (2018) Strengthening the Cybersecurity of Federal Agencies by enhancing the High Value Asset Program. (The White House, Washington, DC), OMB Memorandum M-19-03, December 10, 2018. Available at https://www.whitehouse.gov/wp-content/uploads/2018/12/M-19-03.pdf [11] Federal Information Security Modernization Act (P.L. 113-283), December 2014. Available at https://www.govinfo.gov/app/details/PLAW-113publ283 [12] Ross RS, Pillitteri VY (2024) Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) NIST SP 800-171r3. https://doi.org/10.6028/NIST.SP.800-171r3 [13] Joint Task Force (2020) Control Baselines for Systems and Organizations. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) NIST SP 800-

79

NIST SP 800-172r3 fpd (Final Public Draft) September 2025

2675 2676 2677 2678 2679 2680 2681 2682 2683 2684 2685 2686 2687 2688 2689 2690 2691 2692 2693 2694 2695 2696 2697 2698 2699 2700 2701 2702 2703 2704 2705 2706 2707 2708 2709 2710 2711 2712 2713 2714

Enhanced Security Requirements for Protecting CUI

53B, Includes updates as of December 10, 2020. https://doi.org/10.6028/NIST.SP.800-53B [14] Ross RS, Pillitteri VY, Graubart R, Bodeau D, McQuaid R (2021) Developing Cyber-Resilient Systems: A Systems Security Engineering Approach. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) NIST SP 800-160v2r1. https://doi.org/10.6028/NIST.SP.800-160v2r1 [15] Johnson CS, Waltermire DA, Badger ML, Skorupka C, Snyder J (2016) Guide to Cyber Threat Information Sharing. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) NIST SP 800-150. https://doi.org/10.6028/NIST.SP.800-150 [16] Joint Task Force Transformation Initiative (2022) Assessing Security and Privacy Controls in Information Systems and Organizations. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) NIST SP 800-53Ar5. Includes updates as of December 10, 2020. https://doi.org/10.6028/NIST.SP.800-53Ar5 [17] Committee on National Security Systems (2022) Committee on National Security Systems (CNSS) Glossary. (National Security Agency, Fort George G. Meade, MD), CNSS Instruction 4009. Available at https://www.cnss.gov/CNSS/issuances/Instructions.cfm [18] Joint Task Force Transformation Initiative (2011) Managing Information Security Risk: Organization, Mission, and Information System View. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) NIST SP 800-39. https://doi.org/10.6028/NIST.SP.800-39 [19] Office of Management and Budget Circular A-130, Managing Information as a Strategic Resource, July 2016. Available at https://www.whitehouse.gov/wpcontent/uploads/legacy_drupal_files/omb/circulars/A130/a130revised.pdf [20] U.S. Government Accountability Office (2018) Weapons Systems Cybersecurity: DOD Just Beginning to Grapple with Scale of Vulnerabilities. (GAO, Washington, DC), Report to the Committee on Armed Services, U.S. Senate, GAO 19-128. Available at https://www.gao.gov/assets/700/694913.pdf [21] Title 44 U.S. Code, Sec. 3552, Definitions. 2017 ed. Available at https://www.govinfo.gov/app/details/USCODE-2017-title44/USCODE-2017-title44-chap35subchapII-sec3552 [22] Joint Task Force Transformation Initiative (2012) Guide for Conducting Risk Assessments. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) NIST SP 800-30r1. https://doi.org/10.6028/NIST.SP.800-30r1 [23] Ross R, Winstead M, McEvilley M (2022) Engineering Trustworthy Secure Systems. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) NIST SP 800-160v1r1. https://doi.org/10.6028/NIST.SP.800-160v1r1 [24] Title 40 U.S. Code, Sec. 11331, Responsibilities for Federal information systems standards. 2017 ed. Available at https://www.govinfo.gov/app/details/USCODE-2017title40/USCODE-2017-title40-subtitleIII-chap113-subchapIII-sec11331

80

NIST SP 800-172r3 fpd (Final Public Draft) September 2025

2715 2716 2717 2718 2719

Enhanced Security Requirements for Protecting CUI

[25] Title 44 U.S. Code, Sec. 3502, Definitions. 2017 ed. Available at https://www.govinfo.gov/app/details/USCODE-2021-title44/USCODE-2021-title44-chap35subchapI-sec3502 [26] National Institute of Standards and Technology (2019) Roots of Trust Project. Available at https://csrc.nist.gov/projects/hardware-roots-of-trust

81

NIST SP 800-172r3 fpd (Final Public Draft) September 2025

2720

Appendix A. Acronyms

2721 2722

APT Advanced Persistent Threat

2723 2724

ASLR Address Space Layout Randomization

2725 2726

BIOS Basic Input/Output System

2727 2728

CERT Computer Emergency Response Team

2729 2730

CERTCC CERT Coordination Center

2731 2732

CFR Code of Federal Regulations

2733 2734

CIRT Cyber Incident Response Team

2735 2736

CISA Cybersecurity and Infrastructure Security Agency

2737 2738

CNSS Committee on National Security Systems

2739 2740

CRS Cyber Resiliency

2741 2742

CUI Controlled Unclassified Information

2743 2744

DIB Defense Industrial Base

2745 2746

DLO Damage-Limiting Operations

2747 2748

EO Executive Order

2749 2750

FIPS Federal Information Processing Standards

2751 2752

FIRST Forum of Incident Response and Security Teams

2753 2754

FISMA Federal Information Security Modernization Act

2755 2756

FOIA Freedom of Information Act

2757

GAO

Enhanced Security Requirements for Protecting CUI

82

NIST SP 800-172r3 fpd (Final Public Draft) September 2025

2758

Government Accountability Office

2759 2760

HVA High Value Asset

2761 2762

IoT Internet of Things

2763 2764

ISAC Information Sharing and Analysis Centers

2765 2766

ISAO Information Sharing and Analysis Organizations

2767 2768

ISOO Information Security Oversight Office

2769 2770

IT Information Technology

2771 2772

ITL Information Technology Laboratory

2773 2774

NARA National Archives and Records Administration

2775 2776

NIST National Institute of Standards and Technology

2777 2778

NIST IR NIST Interagency or Internal Report

2779 2780

ODP Organization-Defined Parameter

2781 2782

OMB Office of Management and Budget

2783 2784

OT Operational Technology

2785 2786

PII Personal Identification Information

2787 2788

PLC Programmable Logic Controller

2789 2790

PRA Penetration-Resistant Architecture

2791 2792

ROI Return on Investment

2793 2794

SCRM Supply Chain Risk Management

2795 2796

SIEM Security Information and Event Management

Enhanced Security Requirements for Protecting CUI

83

NIST SP 800-172r3 fpd (Final Public Draft) September 2025

2797 2798

SOC Security Operations Center

2799 2800

SP Special Publication

2801 2802

TEE Trusted Execution Environment

2803 2804

TPM Trusted Platform Module

2805 2806

TTP Tactics, Techniques, and Procedures

2807 2808

USC United States Code

2809 2810

UEFI Unified Extensible Firmware Interface

Enhanced Security Requirements for Protecting CUI

84

NIST SP 800-172r3 fpd (Final Public Draft) September 2025

Enhanced Security Requirements for Protecting CUI

2811

Appendix B. Glossary

2812 2813 2814

Appendix B provides definitions for the terminology used in SP 800-172r1. The definitions are consistent with the definitions contained in the National Information Assurance Glossary [16] unless otherwise noted.

2815 2816 2817 2818 2819 2820 2821 2822

advanced persistent threat An adversary that possesses sophisticated levels of expertise and significant resources which allow it to create opportunities to achieve its objectives by using multiple attack vectors, including cyber, physical, and deception. These objectives typically include establishing and extending footholds within the IT infrastructure of the targeted organizations for purposes of exfiltrating information; undermining or impeding critical aspects of a mission, program, or organization; or positioning itself to carry out these objectives in the future. The advanced persistent threat pursues its objectives repeatedly over an extended period, adapts to defenders’ efforts to resist it, and is determined to maintain the level of interaction needed to execute its objectives. [17]

2823 2824 2825 2826

agency Any executive agency or department, military department, Federal Government corporation, Federal Governmentcontrolled corporation, or other establishment in the Executive Branch of the Federal Government or any independent regulatory agency. [18]

2827 2828

assessment See security control assessment.

2829 2830

assessor See security control assessor.

2831 2832 2833

attack surface The set of points on the boundary of a system, a system element, or an environment where an attacker can try to enter, cause an effect on, or extract data from that system, system element, or environment. [19]

2834 2835

audit record An individual entry in an audit log related to an audited event.

2836 2837 2838

authentication Verifying the identity of a user, process, or device, often as a prerequisite to allowing access to resources in a system. [7, adapted]

2839 2840

availability Ensuring timely and reliable access to and use of information. [20]

2841 2842 2843 2844

baseline configuration A documented set of specifications for a system or a configuration item within a system that has been formally reviewed and agreed on at a given point in time and which can be changed only through change control procedures.

2845 2846 2847

bidirectional authentication Two parties authenticating each other at the same time. Also known as mutual authentication or two-way authentication.

2848 2849

boundary Physical or logical perimeter of a system.

2850 2851

component See system component.

85

NIST SP 800-172r3 fpd (Final Public Draft) September 2025

Enhanced Security Requirements for Protecting CUI

2852 2853 2854

confidentiality Preserving authorized restrictions on information access and disclosure, including means for protecting personal privacy and proprietary information. [20]

2855 2856 2857 2858

configuration management A collection of activities focused on establishing and maintaining the integrity of information technology products and systems through the control of processes for initializing, changing, and monitoring the configurations of those products and systems throughout the system development life cycle.

2859 2860 2861

configuration settings The set of parameters that can be changed in hardware, software, or firmware that affect the security posture or functionality of the system.

2862 2863 2864 2865 2866

controlled unclassified information Information that law, regulation, or government-wide policy requires to have safeguarding or disseminating controls, excluding information that is classified under Executive Order 13526, Classified National Security Information, December 29, 2009, or any predecessor or successor order, or the Atomic Energy Act of 1954, as amended. [1]

2867 2868 2869

critical program (or technology) A program which significantly increases capability, mission effectiveness, or extends the expected effective life of an essential system/capability. [1]

2870 2871 2872 2873

CUI categories Those types of information for which laws, regulations, or government-wide policies require or permit agencies to exercise safeguarding or dissemination controls and which the CUI Executive Agent has approved and listed in the CUI Registry. [5]

2874 2875 2876 2877

CUI Executive Agent The National Archives and Records Administration (NARA), which implements the executive branch-wide CUI Program and oversees federal agency actions to comply with Executive Order 13556. NARA has delegated this authority to the Director of the Information Security Oversight Office (ISOO). [5]

2878 2879 2880 2881

CUI program The executive branch-wide program to standardize CUI handling by all federal agencies. The program includes the rules, organization, and procedures for CUI, established by Executive Order 13556, 32 CFR Part 2002, and the CUI Registry. [5]

2882 2883 2884

cyber-physical system Interacting digital, analog, physical, and human components engineered for function through integrated physics and logic.

2885 2886 2887

cyber resiliency The ability to anticipate, withstand, recover from, and adapt to adverse conditions, stresses, attacks, or compromises on systems that use or are enabled by cyber resources. [13]

2888 2889 2890 2891

damage-limiting operations Procedural and operational measures that use system capabilities to maximize the ability of an organization to detect successful system compromises by an adversary and to limit the effects of such compromises (both detected and undetected).

2892 2893 2894

defense-in-depth Information security strategy integrating people, technology, and operations capabilities to establish variable barriers across multiple layers and missions of the organization.

86

NIST SP 800-172r3 fpd (Final Public Draft) September 2025

Enhanced Security Requirements for Protecting CUI

2895 2896 2897

discussion Statements used to provide additional explanatory information for security controls or security control enhancements.

2898 2899 2900

disinformation The process of providing deliberately deceptive information to adversaries to mislead or confuse them regarding the security posture of the system or organization or the state of cyber preparedness.

2901 2902 2903 2904

dual authorization The system of storage and handling designed to prohibit individual access to certain resources by requiring the presence and actions of at least two authorized persons, each capable of detecting incorrect or unauthorized security procedures with respect to the task being performed. [16, adapted]

2905 2906 2907 2908 2909

enhanced security requirements Security requirements that can be implemented in addition to the requirements in NIST Special Publication 800171. The additional security requirements provide the foundation for a defense-in-depth protection strategy that includes three mutually supportive and reinforcing components: (1) penetration-resistant architecture, (2) damage-limiting operations, and (3) cyber resiliency.

2910 2911 2912 2913

executive agency An executive department specified in 5 U.S.C. Sec. 101; a military department specified in 5 U.S.C. Sec. 102; an independent establishment as defined in 5 U.S.C. Sec. 104(1); and a wholly owned Government corporation fully subject to the provisions of 31 U.S.C. Chapter 91. [18]

2914 2915

external network A network not controlled by the organization.

2916 2917 2918 2919

external system (or component) A system or component of a system that is outside of the authorization boundary established by the organization and for which the organization typically has no direct control over the application of required security controls or the assessment of security control effectiveness.

2920 2921

federal agency See executive agency.

2922 2923 2924

federal information system An information system used or operated by an executive agency, by a contractor of an executive agency, or by another organization on behalf of an executive agency. [23]

2925 2926 2927 2928

firmware Computer programs and data stored in hardware—typically in read-only memory (ROM) or programmable readonly memory (PROM)—such that programs and data cannot be dynamically written or modified during execution of the programs. See hardware and software.

2929 2930

hardware The material physical components of a system. See software and firmware.

2931 2932 2933

high value asset A designation of federal information or a federal information system when it relates to one or more of the following categories:

2934 2935

−

Informational Value: The information or information system that processes, stores, or transmits the information is of high value to the Government or its adversaries.

2936 2937

−

Mission-Essential: The agency that owns the information or information system cannot accomplish its Primary Mission-Essential Functions (PMEF), as approved in accordance with Presidential Policy Directive

87

NIST SP 800-172r3 fpd (Final Public Draft) September 2025

2938 2939 2940 2941

Enhanced Security Requirements for Protecting CUI

40 (PPD-40) National Continuity Policy, within expected timelines without the information or information system. −

Federal Civilian Enterprise Essential (FCEE): The information or information system serves a critical function in maintaining the security and resilience of the federal civilian enterprise. [10]

2942 2943 2944 2945 2946

impact With respect to security, the effect on organizational operations, organizational assets, individuals, other organizations, or the Nation (including the national security interests of the United States) of a loss of confidentiality, integrity, or availability of information or a system. With respect to privacy, the adverse effects that individuals could experience when an information system processes their PII.

2947 2948 2949

impact value The assessed worst-case potential impact that could result from a compromise of the confidentiality, integrity, or availability of information expressed as a value of low, moderate, or high. [6]

2950 2951 2952 2953

incident An occurrence that actually or imminently jeopardizes, without lawful authority, the confidentiality, integrity, or availability of information or an information system or constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies. [20]

2954 2955 2956

industrial Internet of Things The sensors, instruments, machines, and other devices that are networked together and use Internet connectivity to enhance industrial and manufacturing business processes and applications.

2957 2958 2959

information Any communication or representation of knowledge, such as facts, data, or opinions in any medium or form, including textual, numerical, graphic, cartographic, narrative, electronic, or audiovisual forms. [18]

2960 2961

information flow control Procedure to ensure that information transfers within a system are not made in violation of the security policy.

2962 2963

information resources Information and related resources, such as personnel, equipment, funds, and information technology. [24]

2964 2965 2966

information security The protection of information and systems from unauthorized access, use, disclosure, disruption, modification, or destruction in order to provide confidentiality, integrity, and availability. [20]

2967 2968 2969

information system A discrete set of information resources organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of information. [24]

2970 2971 2972 2973 2974 2975 2976 2977 2978 2979 2980 2981

information technology Any services, equipment, or interconnected system(s) or subsystem(s) of equipment, that are used in the automatic acquisition, storage, analysis, evaluation, manipulation, management, movement, control, display, switching, interchange, transmission, or reception of data or information by the agency. For purposes of this definition, such services or equipment if used by the agency directly or is used by a contractor under a contract with the agency that requires its use; or to a significant extent, its use in the performance of a service or the furnishing of a product. Information technology includes computers, ancillary equipment (including imaging peripherals, input, output, and storage devices necessary for security and surveillance), peripheral equipment designed to be controlled by the central processing unit of a computer, software, firmware and similar procedures, services (including cloud computing and help-desk services or other professional services which support any point of the life cycle of the equipment or service), and related resources. Information technology does not include any equipment that is acquired by a contractor incidental to a contract which does not require its use. [18]

88

NIST SP 800-172r3 fpd (Final Public Draft) September 2025

Enhanced Security Requirements for Protecting CUI

2982 2983 2984 2985

insider threat The threat that an insider will use their authorized access, wittingly or unwittingly, to do harm to the security of the United States. This threat can include damage to the United States through espionage, terrorism, unauthorized disclosure, or through the loss or degradation of departmental resources or capabilities.

2986 2987 2988

integrity Guarding against improper information modification or destruction and includes ensuring information nonrepudiation and authenticity. [20]

2989 2990 2991

Internet of Things The network of devices that contain the hardware, software, firmware, and actuators which allow the devices to connect, interact, and freely exchange data and information.

2992 2993 2994 2995

malicious code Software or firmware intended to perform an unauthorized process that will have an adverse impact on the confidentiality, integrity, or availability of a system. A virus, worm, Trojan horse, or other code-based entity that infects a host. Spyware and some forms of adware are also examples of malicious code.

2996 2997 2998 2999

media Physical devices or writing surfaces, including but not limited to magnetic tapes, optical disks, magnetic disks, Large-Scale Integration (LSI) memory chips, and printouts (but not including display media) onto which information is recorded, stored, or printed within a system. [7]

3000 3001 3002

misdirection The process of maintaining and employing deception resources or environments and directing adversary activities to those resources or environments.

3003 3004 3005 3006 3007 3008 3009

mobile device A portable computing device that has a small form factor such that it can easily be carried by a single individual; is designed to operate without a physical connection (e.g., wirelessly transmit or receive information); possesses local, non-removable or removable data storage; and includes a self-contained power source. Mobile devices may also include voice communication capabilities, on-board sensors that allow the devices to capture information, or built-in features that synchronize local data with remote locations. Examples include smartphones, tablets, and Ereaders.

3010 3011 3012 3013

moving target defense The concept of controlling change across multiple system dimensions in order to increase uncertainty and apparent complexity for attackers, reduce their window of opportunity, and increase the costs of their probing and attack efforts.

3014 3015

mutual authentication The process of both entities involved in a transaction verifying each other. See bidirectional authentication.

3016 3017 3018

network A system implemented with a collection of interconnected components. Such components may include routers, hubs, cabling, telecommunications controllers, key distribution centers, and technical control devices.

3019 3020 3021

network access Access to a system by a user (or a process acting on behalf of a user) communicating through a network (e.g., local area network, wide area network, Internet).

3022 3023

nonfederal organization An entity that owns, operates, or maintains a nonfederal system.

3024 3025

nonfederal system A system that does not meet the criteria for a federal system.

89

NIST SP 800-172r3 fpd (Final Public Draft) September 2025

Enhanced Security Requirements for Protecting CUI

3026 3027 3028 3029

on behalf of (an agency) A situation that occurs when (i) a non-executive branch entity uses or operates an information system or maintains or collects information for the purpose of processing, storing, or transmitting federal information; and (ii) those activities are not incidental to providing a service or product to the Government. [5]

3030 3031 3032

operational technology The hardware, software, and firmware components of a system used to detect or cause changes in physical processes through the direct control and monitoring of physical devices.

3033 3034

organization An entity of any size, complexity, or positioning within an organizational structure. [7, adapted]

3035 3036 3037

penetration-resistant architecture An architecture that uses technology and procedures to limit the opportunities for an adversary to compromise an organizational system and achieve a persistent presence in the system.

3038 3039 3040

personnel security The discipline of assessing the conduct, integrity, judgment, loyalty, reliability, and stability of individuals for duties and responsibilities requiring trustworthiness. [8]

3041 3042 3043 3044

potential impact The loss of confidentiality, integrity, or availability could be expected to have (i) a limited adverse effect (FIPS Publication 199 low); (ii) a serious adverse effect (FIPS Publication 199 moderate); or (iii) a severe or catastrophic adverse effect (FIPS Publication 199 high) on organizational operations, organizational assets, or individuals. [6]

3045 3046 3047 3048 3049

records The recordings (automated and manual) of evidence of activities performed or results achieved (e.g., forms, reports, test results), which serve as a basis for verifying that the organization and system are performing as intended. Also used to refer to units of related data fields (i.e., groups of data fields that can be accessed by a program and that contain the complete set of information on particular items).

3050 3051 3052

remote access Access to an organizational system by a user (or a process acting on behalf of a user) communicating through an external network (e.g., the Internet).

3053 3054 3055 3056

risk A measure of the extent to which an entity is threatened by a potential circumstance or event and typically is a function of (i) the adverse impact or magnitude of harm that would arise if the circumstance or event occurs and (ii) the likelihood of occurrence. [18]

3057 3058 3059 3060

risk assessment The process of identifying risks to organizational operations (including mission, functions, image, reputation), organizational assets, individuals, other organizations, and the Nation resulting from the operation of a system. [21]

3061 3062 3063 3064

roots of trust Highly reliable hardware, firmware, and software components that perform specific, critical security functions. Because roots of trust are inherently trusted, they must be secure by design. Roots of trust provide a firm foundation from which to build security and trust. [25]

3065 3066 3067

sanitization Actions taken to render data written on media unrecoverable by both ordinary and, for some forms of sanitization, extraordinary means. Process to remove information from media such that data recovery is not possible.

3068

security

90

NIST SP 800-172r3 fpd (Final Public Draft) September 2025

Enhanced Security Requirements for Protecting CUI

3069 3070 3071 3072

A condition that results from the establishment and maintenance of protective measures that enable an organization to perform its mission or critical functions despite risks posed by threats to its use of systems. Protective measures may involve a combination of deterrence, avoidance, prevention, detection, recovery, and correction that should form part of the organization’s risk management approach.

3073 3074

security assessment See security control assessment.

3075 3076 3077

security control The safeguards or countermeasures prescribed for an information system or an organization to protect the confidentiality, integrity, and availability of the system and its information. [18]

3078 3079 3080 3081

security control assessment The testing or evaluation of security controls to determine the extent to which the controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting the security requirements for an information system or organization. [18]

3082 3083

security domain A domain that implements a security policy and is administered by a single authority. [16, adapted]

3084 3085 3086

security functions The hardware, software, or firmware of the system responsible for enforcing the system security policy and supporting the isolation of code and data on which the protection is based.

3087 3088 3089

security solution The key design, architectural, and implementation choices made by organizations in satisfying specified security requirements for systems or system components.

3090 3091

system See information system.

3092 3093 3094

system component A discrete, identifiable information technology asset that represents a building block of a system and may include hardware, software, and firmware. [26]

3095 3096 3097 3098 3099

system security plan A document that describes how an organization meets the security requirements for a system or how an organization plans to meet the requirements. In particular, the system security plan describes the system boundary, the environment in which the system operates, how security requirements are implemented, and the relationships with or connections to other systems.

3100 3101

system service A capability provided by a system that facilitates information processing, storage, or transmission.

3102 3103 3104 3105

tactics, techniques, and procedures The behavior of an actor. A tactic is the highest-level description of the behavior; techniques provide a more detailed description of the behavior in the context of a tactic; and procedures provide a lower-level, highly detailed description of the behavior in the context of a technique. [14]

3106 3107 3108

tainting The process of embedding covert capabilities in information, systems, or system components to allow organizations to be alerted to the exfiltration of information.

3109

threat

91

NIST SP 800-172r3 fpd (Final Public Draft) September 2025

Enhanced Security Requirements for Protecting CUI

3110 3111 3112

Any circumstance or event with the potential to adversely impact organizational operations, organizational assets, individuals, other organizations, or the Nation through a system via unauthorized access, destruction, disclosure, modification of information, and/or denial of service. [21]

3113 3114 3115 3116

threat information Any information related to a threat that might help an organization protect itself against the threat or detect the activities of an actor. Major types of threat information include indicators, TTPs, security alerts, threat intelligence reports, and tool configurations. [14]

3117 3118 3119

threat intelligence Threat information that has been aggregated, transformed, analyzed, interpreted, or enriched to provide the necessary context for decision-making processes. [14]

92

NIST SP 800-172r3 fpd (Final Public Draft) September 2025

Enhanced Security Requirements for Protecting CUI

3120

Appendix C. Summary of Enhanced Security Requirements

3121 3122

This appendix provides a consolidated list of the enhanced security requirements in Sec. 3. The type of enhanced security requirement is indicated in the last column of Table 2.

3123 3124

•

A designation of “E” indicates that the security requirement enhances a requirement in SP 800-171 [12] and includes AP 800-171 requirement.

3125 3126 3127

•

A designation of “T” indicates that the security requirement is sourced to a control tailored out of the SP 800-53B [13] moderate baseline in SP 800-171 and includes the SP 800-53 control.

3128 3129 3130 3131

•

A designation of “S” indicates that the security requirement does not enhance a specific requirement in SP 800-171 but can be used to strengthen the protection of CUI associated with critical programs or high value assets. It includes the source control from SP 800-53.

3132

Table 2. Enhanced security requirements REQUIREMENT NUMBER

ENHANCED SECURITY REQUIREMENT

REQUIREMENT TYPE

Access Control 03.01.01E 03.01.02E 03.01.03E 03.01.04E

Dual Authorization Non-Organizationally Owned Systems - Restricted Use Withdrawn Concurrent Session Control

E E

03.01.02 03.01.20

S

03.01.05E 03.01.06E 03.01.07E 03.01.08E 03.01.09E 03.01.10E 03.01.11E 03.01.12E 03.01.13E 03.01.14E 03.01.15E 03.01.16E 03.01.17E

Remote Access Monitoring and Control Protection of Remote Access Mechanism Information Automated Audit Actions for Account Management Account Monitoring for Atypical Usage Attribute-Based Access Control Object Security Attributes Role-Based Access Control Physical or Logical Separation of Information Flows Metadata Security Policy Filters Data Type Identifiers Decomposition into Policy-Relevant Subcomponents Detection of Unsanctioned CUI Awareness and Training Advanced Literacy and Awareness Training Literacy and Awareness Training Practical Exercises Literacy and Awareness Training Feedback

E E E E E E E E E E E E E

SP 800-53, AC-10 03.01.02 03.01.02 03.01.01 03.01.01 03.01.02 03.01.03 03.01.02 03.01.03 03.01.03 03.01.03 03.01.03 03.01.03 03.01.03

03.02.01E 03.02.02E 03.02.03E

93

E E S

03.02.01 03.02.01 SP 800-53, AT-06

NIST SP 800-172r3 fpd (Final Public Draft) September 2025 REQUIREMENT NUMBER 03.02.04E

03.03.01E 03.03.02E 03.03.03E 03.03.04E 03.04.01E 03.04.02E 03.04.03E 03.04.04E 03.04.05E 03.04.06E 03.04.07E 03.04.08E 03.05.01E 03.05.02E 03.05.03E 03.05.04E 03.05.05E 03.05.06E 03.05.07E

Enhanced Security Requirements for Protecting CUI

ENHANCED SECURITY REQUIREMENT Anti-Counterfeit Training Audit and Accountability Protection of Audit Record Storage in Separate Physical Systems or Components Real-Time Alerts for Audit Processing Failures Dual Authorization for Audit Information and Actions Integrated Analysis of Audit Records Configuration Management Withdrawn Automated Unauthorized Component Detection Automation Maintenance of System Component Inventory Automation Support for Baseline Configuration Dual Authorization for System Changes Retention of Previous Configurations Testing, Validation, and Documentation of Changes Centralized Repository Identification and Authentication Cryptographic Bidirectional Authentication Password Managers Device Attestation No Embedded Unencrypted Static Authenticators Expiration of Cached Authenticators Identity Proofing Identity Providers and Authorization Servers

REQUIREMENT TYPE T

SP 800-53, SR-11(01)

E

03.03.08

E E E

03.03.04 03.03.08 03.03.05

E E E E E E E

03.04.10 03.04.10 03.04.01 03.04.05 03.04.01 03.04.03 03.04.10

E E E E E T S

03.05.02 03.05.07 03.05.02 03.05.07 03.05.07 IA-12 SP 800-53, IA-13

E E E E

03.06.01 03.06.01 03.06.01 03.06.02

E

03.04.07

E E E S

03.08.03 03.08.09 03.08.09 SP 800-53, CP-10

Incident Response 03.06.01E 03.06.02E 03.06.03E 03.06.04E

03.08.01E 03.08.02E 03.08.03E 03.08.04E

Security Operations Center Integrated Incident Response Team Behavior Analysis Automated Tracking, Data Collection, and Analysis for Incident Reporting Maintenance Software Updates and Patches for Maintenance Tools Media Protection Dual Authorization for Media Sanitization Dual Authorization for System Backup Deletion and Destruction Testing System Backups for Reliability and Integrity System Recovery and Reconstitution

03.09.01E

Withdrawn

03.07.01E

Personnel Security

94

NIST SP 800-172r3 fpd (Final Public Draft) September 2025 REQUIREMENT NUMBER

Enhanced Security Requirements for Protecting CUI

ENHANCED SECURITY REQUIREMENT

REQUIREMENT TYPE

03.09.02E 03.09.03E

Withdrawn Access Agreements

T

03.09.04E

Citizenship Requirements

E

03.10.01E 03.10.02E

Physical Protection Intrusion Alarms and Surveillance Equipment Delivery and Removal of System Components

E S

03.10.02 SP 800-53, PE-16 SP 800-53, PM-16 SP 800-53, RA-10 03.11.01

SP 800-53, PS-06 03.09.01

Risk Assessment 03.11.01E

Threat Awareness Program

S

03.11.02E

Threat Hunting

S

03.11.03E 03.11.04E 03.11.05E 03.11.06E 03.11.07E 03.11.08E 03.11.09E 03.11.10E

Predictive Cyber Analytics Withdrawn Withdrawn Withdrawn Withdrawn Dynamic Threat Awareness Indicators of Compromise Criticality Analysis

E

03.11.11E 03.11.12E

Discoverable Information Automated Means for Sharing Threat Intelligence

E S

03.12.01E

Security Assessment and Monitoring Penetration Testing

S

03.12.02E 03.12.03E 03.12.04E

Independent Assessors Risk Monitoring Internal System Connections

E E T

03.13.01E

Heterogeneity

S

03.13.02E

Randomness

S

03.13.03E

Concealment and Misdirection

S

03.13.04E 03.13.05E

Isolation of System Components Change Processing and Storage Locations

E S

E E T

03.11.01 03.14.06 SP 800-53, RA-09 03.11.02 SP 800-53, PM-16(01) SP 800-53, CA-08 03.12.01 03.12.03 SP 800-53, CA-09

System and Communications Protection

95

SP 800-53, SC-29 SP 800-53, SC-30(02) SP 800-53, SC-30 03.13.01 SP 800-53, SC-30(03)

NIST SP 800-172r3 fpd (Final Public Draft) September 2025 REQUIREMENT NUMBER

Enhanced Security Requirements for Protecting CUI

ENHANCED SECURITY REQUIREMENT

REQUIREMENT TYPE SP 800-53, SC-27 SP 800-53, SC-29(01) SP 800-53, SC-26 03.13.01 03.13.01 SP 800-53, SC-25 SP 800-53, SC-05 SP 800-53, SC-41 SP 800-53, SC-44 03.13.01 SP 800-53, SC-32

03.13.06E

Platform-Independent Applications

S

03.13.07E

Virtualization Techniques

S

03.13.08E

Decoys

S

03.13.09E 03.13.10E 03.13.11E

Isolation of Security Tool, Mechanism, and Support Component Separate Subnetworks Thin Nodes

E E S

03.13.12E

Denial-of-Service Protection

T

03.13.13E

Port and Input/Output Device Access

S

03.13.14E

Detonation Chambers

S

03.13.15E 03.13.16E

Separate Subnets to Isolate System Components and Functions System Partitioning

E S

03.14.01E

System and Information Integrity Software, Firmware, and Information Integrity

T

SP 800-53, SI-07

03.14.02E 03.14.03E 03.14.04E

Withdrawn Withdrawn Refresh from Trusted Sources

S

03.14.05E

Non-Persistent Information

S

SP 800-53, SI-14(01) SP 800-53, SI-14(02)

03.14.06E 03.14.07E 03.14.08E

Withdrawn Withdrawn Integrity Checks

T

03.14.09E

Cryptographic Protection

S

03.14.10E

Protection of Boot Firmware

S

03.14.11E

Integration of Detection and Response

T

03.14.12E

Information Input Validation

T

03.14.13E

Error Handling

T

03.14.14E

Memory Protection

T

96

SP 800-53, SI-07(01) SP 800-53, SI-07(06) SP 800-53, SI-07(10) SP 800-53, SI-07(07) SP 800-53, SI-10 SP 800-53, SI-11 SP 800-53, SI-16

NIST SP 800-172r3 fpd (Final Public Draft) September 2025 REQUIREMENT NUMBER

Enhanced Security Requirements for Protecting CUI

ENHANCED SECURITY REQUIREMENT

REQUIREMENT TYPE SP 800-53, SI-14 SP 800-53, SI-20 SP 800-53, SI-04(05) 03.14.06

03.14.15E

Non-Persistent System Components and Services

S

03.14.16E

Tainting

S

03.14.17E

System-Generated Alerts

T

03.14.18E

E

03.15.01E

Automated Organization-Generated Alerts Planning Security Architecture

03.15.02E

Defense In Depth

S

03.15.03E

Supplier Diversity

S

03.16.01E

Specialization

S

SP 800-53, SA-23

03.17.01E

Supply Chain Risk Management Notification Agreements

T

03.17.02E

Inspection of Systems or Components

T

03.17.03E

Component Authenticity

T

03.17.04E

Provenance

S

03.17.05E

Supply Chain Integrity – Pedigree

S

SP 800-53, SR-08 SP 800-53, SR-10 SP 800-53, SR-11 SP 800-53, SR-04 SP 800-53, SR-04(04)

T

SP 800-53, PL-08 SP 800-53, PL-08(01) SP 800-53, PL-08(02)

System and Services Acquisition

3133

97

NIST SP 800-172r3 fpd (Final Public Draft) September 2025

Enhanced Security Requirements for Protecting CUI

3134

Appendix D. Adversary Effects

3135 3136 3137 3138 3139 3140

Cyber resiliency solutions are only relevant if they have some effect on risk, specifically by reducing the likelihood of the occurrence of threat events,21 the ability of threat events to cause harm, and the extent of that harm.22 The types of analysis of system architectures, designs, implementations, and operations that are indicated for cyber resiliency can include considering the effects that alternatives could have on the threat events in scenarios of concern to organizations.

3141 3142 3143 3144

From the perspective of protecting a system against adversarial threats, five high-level, desired effects on the adversary can be identified: redirect, preclude, impede, limit, and expose. These effects are useful for discussion but are often too general to facilitate the definition of specific measures of effectiveness. Therefore, more specific classes of effects are defined:

3145

•

Deter, divert, and deceive in support of redirect

3146

•

Negate, preempt, and expunge in support of preclude

3147

•

Contain, degrade, delay, and exert in support of impede

3148

•

Shorten and reduce in support of limit

3149

•

Detect, reveal, and scrutinize in support of expose

3150 3151

These effects are tactical (i.e., local to a specific threat event or scenario), although it is possible that their repeated achievement could have strategic effects as well.

3152 3153 3154 3155 3156 3157 3158

Table 3 defines the effects, indicates how each effect could reduce risk, and illustrates how the use of certain approaches to implementing cyber resiliency techniques for protection against attack could have the identified effect.23 The term “defender” refers to the organization or organizational staff responsible for providing or applying protections. It should be noted that likelihoods and impact can be reduced, but risk cannot be eliminated. Thus, no effect can be assumed to be complete, even those with names that suggest completeness, such as negate, detect, or expunge.

21 The term “threat event” refers to an event or situation that has the potential to cause undesirable consequences or impacts. Threat events can be caused by adversarial or non-adversarial threat sources. However, this section emphasizes the effect on adversarial threats and specifically on the APT, for which threat events can be identified with adversary activities. 22 While different risk models are valid and useful, three elements are common across most models: (1) the likelihood of occurrence (i.e., the likelihood that a threat event or a threat scenario consisting of a set of interdependent events will occur or be initiated by an adversary), (2) the likelihood of impact (i.e., the likelihood that a threat event or threat scenario will result in an impact given vulnerabilities, weaknesses, and predisposing conditions), (3) and the level of the impact [21]. 23 For additional information on cyber resiliency techniques and approaches, see SP 800-160v2r1, Appendix H [13].

98

NIST SP 800-172r3 fpd (Final Public Draft) September 2025

3159

Enhanced Security Requirements for Protecting CUI

Table 3. Effects of cyber resiliency techniques on adversarial threat events

INTENDED EFFECT

IMPACT ON RISK

EXPECTED RESULTS

Redirect (includes deter, divert, and deceive): Direct threat events away from defender-chosen resources. Deter Discourage the adversary from undertaking further activities by instilling fear (e.g., of attribution or retribution) or doubt that those activities would achieve their intended effects (e.g., that targets exist). Divert Direct the threat event toward defender-chosen resources.

Reduce the likelihood of occurrence and (to a lesser extent) the likelihood of impact.

• The adversary’s efforts cease. • The adversary actions are mistargeted or misinformed.

Reduce the likelihood of occurrence.

• The adversary ceases or suspends activities. Example: The defender uses disinformation to make it appear as though the organization is better able to detect attacks than it is and is willing to launch major counterstrikes. Therefore, the adversary chooses to not launch an attack due to fear of detection and reprisal.

Reduce the likelihood of occurrence.

• The adversary refocuses activities on defender-chosen resources. • The adversary directs activities toward targets beyond the defender’s purview (e.g., other organizations). • The adversary does not affect resources that the defender has not selected to be targets. Example: The defender maintains an Internet-visible enclave with which untrusted external entities can interact and a private enclave accessible only via a VPN for trusted suppliers, partners, or customers (predefined segmentation). Example: The defender uses non-persistent information and obfuscation to hide critical resources combined with functional relocation of cyber resources and disinformation to lure the adversary toward a sandboxed enclave in which adversary actions cannot harm critical resources.

Deceive Lead the adversary to believe false information about defended systems, missions, organizations, or defender capabilities or TTPs.

Reduce the likelihood of occurrence and/or the likelihood of impact.

• The adversary’s efforts are wasted as the assumptions on which the adversary bases their attacks are false. • The adversary takes actions based on false information, thus revealing that they have obtained that information. Example: The defender strategically places false information (disinformation) about the cybersecurity investments that it plans to make. As a result, the adversary’s malware development is wasted by countering non-existent cybersecurity protections. Example: The defender uses selectively planted false information (disinformation) and honeynets (misdirection) to cause an adversary to focus its malware on virtual sandboxes while simultaneously employing obfuscation to hide the actual resources.

Preclude (includes expunge, preempt, and negate) Ensure that the threat event does not have an impact.

Reduce the likelihood of occurrence and/or the likelihood of impact.

• The adversary’s efforts or resources cannot be applied or are wasted.

99

NIST SP 800-172r3 fpd (Final Public Draft) September 2025

Enhanced Security Requirements for Protecting CUI

INTENDED EFFECT

IMPACT ON RISK

EXPECTED RESULTS

Expunge Remove resources that are known to be or are suspected of being unsafe, incorrect, or corrupted.

Reduce the likelihood of impact of subsequent events in the same threat scenario.

• A malfunctioning, misbehaving, or suspect resource is restored to normal operation. • The adversary loses a capability for some period as adversarydirected threat mechanisms (e.g., malicious code) are removed. • Adversary-controlled resources are so badly damaged that they cannot perform any function or be restored to a usable condition without being entirely rebuilt. Example: The defender uses virtualization to refresh critical software (non-persistent services) from a known good copy at random intervals (temporal unpredictability). As a result, malware that was implanted in the software is deleted.

Preempt Forestall or avoid conditions under which the threat event could occur or on which an attack is predicated.

Reduce the likelihood of occurrence.

• The adversary’s resources cannot be applied, or the adversary cannot perform activities (e.g., because the resources that the adversary requires are destroyed or made inaccessible). Example: An unneeded network connection is disabled (nonpersistent connectivity) so that an attack cannot be made via that interface. Example: A resource is repositioned (asset mobility) so it cannot be affected by a threat event in its new location.

Negate Create conditions under which the threat event cannot be expected to result in an impact.

Reduce the likelihood of impact.

• The adversary can launch an attack, but it will not even partially succeed. The adversary’s efforts are wasted as the assumptions on which the adversary based its attack are no longer valid, and as a result, the intended effects cannot be achieved. Example: Subtle variations in critical software are implemented (synthetic diversity) with the result that the adversary’s malware is no longer able to compromise the targeted software.

Impede (includes contain, degrade, delay, and exert) Make it more difficult for threat events to cause adverse impacts or consequences.

Reduce the likelihood and level of impact.

• Adversary activities are restricted in scope, fail to achieve full

Contain Restrict the effects of the threat event to a limited set of resources.

Reduce the level of impact.

• The adversary can affect fewer resources than planned. The value of the activity in achieving the adversary’s goals is reduced. Example: The defender organization makes changes to a combination of internal firewalls and logically separated networks (dynamic segmentation) to isolate enclaves in response to the detection of malware with the result that the effects of the malware are limited to the initially infected enclaves.

Degrade Decrease the expected consequences of the threat event.

Reduce the likelihood of impact and/or the level of impact.

• Not all of the resources targeted by the adversary are affected, or the targeted resources are affected to a lesser degree than the adversary sought. Example: The defender uses multiple browsers and operating systems (architectural diversity) on end-user systems and some critical servers. The result is that malware targeted at specific software can only compromise a subset of the targeted systems, and a sufficient number continue to operate to complete the mission or business function.

effect, do not take place in accordance with the adversary’s timeline, or require greater resources than the adversary had planned.

100

NIST SP 800-172r3 fpd (Final Public Draft) September 2025

Enhanced Security Requirements for Protecting CUI

INTENDED EFFECT

IMPACT ON RISK

EXPECTED RESULTS

Delay Increase the amount of time needed for the threat event to result in adverse impacts.

Reduce the likelihood of impact and/or the level of impact.

• The adversary achieves the intended effects but not within the intended period. Example: The protection measures (e.g., access controls, encryption) allocated to resources increase in number and strength based on resource criticality (calibrated defense-indepth). The frequency of authentication challenges varies randomly (temporal unpredictability) and with increased frequency for more critical resources. The result is that it takes the attacker more time to successfully compromise the targeted resources.

Exert Increase the level of effort or resources needed for an adversary to achieve a given result.

Reduce the likelihood of impact.

• The adversary gives up planned or partially completed activities in response to finding that additional effort or resources are needed. • The adversary achieves the intended effects in their desired timeframe but only by applying more resources. Thus, the adversary’s return on investment (ROI) is decreased. • The adversary reveals TTPs that they had planned to reserve for future use. Example: The defender enhances the defenses of moderatecriticality components with additional mitigations (calibrated defense-in-depth). To overcome these, the adversary must tailor and deploy TTPs that they were planning to reserve for use against higher value defender targets. Example: The defender adds a large amount of valid but useless information to a data store (obfuscation), requiring the adversary to exfiltrate and analyze more data before taking further actions.

Limit (includes shorten and reduce) Restrict the consequences of realized threat events by limiting the damage or effects they cause in terms of time, system resources, and/or mission or business impacts. Shorten Limit the duration of adverse consequences of a threat event.

Reduce the level and likelihood of impact of subsequent events in the same threat scenario.

• The adversary’s effectiveness is restricted.

Reduce the level of impact.

• The time period during which the adversary’s activities affect defender resources is limited. Example: The defender employs a diverse set of suppliers (supply chain diversity) for time-critical components. As a result, when an adversary’s attack on one supplier causes it to shut down, the defender can increase its use of the other suppliers, thus shortening the time when it is without the critical components.

101

NIST SP 800-172r3 fpd (Final Public Draft) September 2025

INTENDED EFFECT

Enhanced Security Requirements for Protecting CUI

IMPACT ON RISK

EXPECTED RESULTS

Reduce Decrease the degree of damage from a threat event. The degree of damage can have two dimensions: breadth (i.e., number of affected resources) and depth (i.e., level of harm to a given resource).

Reduce the level of impact.

• The level of damage to mission or business operations due to adversary activities is reduced with partial restoration or the reconstitution of all affected resources. Example: Resources determined to be corrupted or suspect (integrity checks, behavior validation) are restored from older, uncorrupted resources (protected backup and restore) with reduced functionality. • The level of damage to mission or business operations due to adversary activities is reduced with the full restoration or reconstitution of some of the affected resources. Example: The organization removes one of three compromised resources and provides a new resource (replacement, specialization) for the same or equivalent mission or business functionality.

Expose (includes detect, scrutinize, and reveal) Reduce risk due to the ignorance of threat events and possible replicated or similar threat events in the same or similar environments. Detect Identify threat events or their effects by discovering or discerning the fact that an event is occurring, has occurred, or is about to occur based on indicators, warnings, and precursor activities. Scrutinize Analyze threat events and the artifacts associated with threat events—particularly with respect to patterns of exploiting vulnerabilities, predisposing conditions, and weaknesses—to inform more effective detection and risk response.

Reduce the likelihood of impact.

• The adversary loses the advantage of stealth as defenders are better prepared by developing and sharing threat intelligence.

Reduce the likelihood and level of impact, depending on responses.

• The adversary’s activities become susceptible to defensive responses. Example: The defender continually moves its sensors (functional relocation of sensors), often at random times (temporal unpredictability), to common points of egress from the organization. They combine this with the use of beacon traps (tainting). The result is that the defender can quickly detect efforts by the adversary to exfiltrate sensitive information.

Reduce the likelihood of impact.

• The adversary loses the advantages of uncertainty, confusion, and doubt. • The defender understands the adversary better based on analysis of adversary activities, including the artifacts (e.g., malicious code) and effects associated with those activities and the correlation of activity-specific observations with other activities (as feasible), and can thus recognize adversary TTPs. Example: The defender deploys honeynets (misdirection), which invite attacks and allow the defender to apply their TTPs in a safe environment. The defender then analyzes (malware and forensic analysis) the malware captured in the honeynet to determine the nature of the attacker’s TTPs, allowing it to develop appropriate defenses.

102

NIST SP 800-172r3 fpd (Final Public Draft) September 2025

Enhanced Security Requirements for Protecting CUI

INTENDED EFFECT

IMPACT ON RISK

EXPECTED RESULTS

Reveal Increase the awareness of risk factors and the relative effectiveness of remediation approaches across the stakeholder community to support common, joint, or coordinated risk response.

Reduce the likelihood of impact, particularly in the future.

• The adversary loses the advantage of surprise and possible deniability. • The adversary’s ability to compromise one organization’s systems to attack another organization is impaired as awareness of adversary characteristics and behavior is increased across the stakeholder community (e.g., across all computer security incident response teams that support a given sector, that might be expected to be attacked by the same actor or actors). Example: The defender participates in threat information-sharing and uses dynamically updated threat intelligence data feeds (dynamic threat modeling) to inform actions (adaptive management).

3160

103

NIST SP 800-172r3 fpd (Final Public Draft) September 2025

Enhanced Security Requirements for Protecting CUI

3161

Appendix E. Organization-Defined Parameters

3162 3163 3164 3165 3166

This appendix lists the ODPs that are included in the enhanced security requirements in Sec. 3. The ODPs are listed sequentially by requirement family, beginning with the first requirement containing an ODP in the Access Control family and ending with the last requirement containing an ODP in the Supply Chain Risk Management family. Embedded ODPs are listed as a single entry in the table.

3167

Table 4. Organization-defined parameters ENHANCED SECURITY REQUIREMENT 03.01.01E 03.01.02E 03.01.04E 03.01.04E 03.01.08E 03.01.08E 03.01.09E 03.01.10E 03.01.10E 03.01.10E 03.01.11E 03.01.12E 03.01.13E 03.01.14E 03.01.14E 03.01.14E 03.01.14E 03.01.15E 03.01.16E 03.01.17E 03.01.17E 03.02.01E 03.02.01E 03.02.01E 03.02.03E 03.02.04E 03.03.02E 03.03.02E 03.03.02E 03.03.03E

ORGANIZATION-DEFINED PARAMETER [Assignment: organization-defined privileged commands and/or other organization-defined actions] [Assignment: organization-defined restrictions] [Assignment: organization-defined account and/or account type] [Assignment: organization-defined number] [Assignment: organization-defined atypical usage] [Assignment: organization-defined personnel or roles] [Assignment: organization-defined attributes to assume access permissions] [Assignment: organization-defined security attributes] [Assignment: organization-defined information, source, and destination objects] [Assignment: organization-defined information flow control policies] [Assignment: organization-defined roles and users authorized to assume such roles] [Assignment: organization-defined mechanisms and/or techniques] [Assignment: organization-defined metadata] [Assignment: organization-defined security policy filters] [Assignment: organization-defined information flows] [Selection (one or more): Block; Strip; Modify; Quarantine] [Assignment: organization-defined security policy] [Assignment: organization-defined data type identifiers] [Assignment: organization-defined policy-relevant subcomponents] [Assignment: organization-defined unsanctioned information] [Assignment: organization-defined security policy] [Assignment: organization-defined indicators of malicious code] [Assignment: organization-defined frequency] [Assignment: organization-defined events] [Assignment: organization-defined personnel] [Assignment: organization-defined personnel or roles] [Assignment: organization-defined real-time period] [Assignment: organization-defined personnel, roles, and/or locations] [Assignment: organization-defined audit logging failure events requiring real-time alerts] [Selection (one or more): movement; deletion]

104

NIST SP 800-172r3 fpd (Final Public Draft) September 2025 ENHANCED SECURITY REQUIREMENT 03.03.03E 03.03.04E

03.04.02E 03.04.02E 03.04.03E 03.04.04E 03.04.05E 03.04.06E 03.05.01E 03.05.02E 03.05.02E 03.05.03E 03.05.05E 03.05.07E 03.05.07E 03.06.02E 03.06.03E 03.06.04E 03.08.01E 03.08.02E 03.08.04E 03.09.03E 03.09.03E 03.09.04E 03.10.02E 03.11.02E 03.11.03E 03.11.03E 03.11.08E 03.11.09E 03.11.09E 03.11.10E 03.11.10E 03.11.11E 03.12.01E 03.12.01E 03.12.04E

Enhanced Security Requirements for Protecting CUI

ORGANIZATION-DEFINED PARAMETER [Assignment: organization-defined audit information] [Selection (one or more): vulnerability scanning information; performance data; system monitoring information; [Assignment: organization-defined data/information collected from other sources]] [Assignment: organization-defined automated mechanisms] [Selection (one or more): disable network access by such components; isolate the components; notify [Assignment: organization-defined personnel or roles]] [Assignment: organization-defined automated mechanisms] [Assignment: organization-defined automated mechanisms] [Assignment: organization-defined system components and system-level information] [Assignment: organization-defined number] [Assignment: organization-defined devices and/or types of devices] [Assignment: organization-defined password managers] [Assignment: organization-defined controls] [Assignment: organization-defined configuration management process] [Assignment: organization-defined time period] [Assignment: organization-defined identification and authentication policy] [Assignment: organization-defined mechanisms] [Assignment: organization-defined time period] [Assignment: organization-defined environments or resources] [Assignment: organization-defined automated mechanisms] [Assignment: organization-defined system media containing CUI] [Assignment: organization-defined system backup information] [Assignment: organization-defined time period consistent with recovery time and recovery point objectives] [Assignment: organization-defined frequency] [Assignment: organization-defined frequency] [Assignment: organization-defined citizenship requirements] [Assignment: organization-defined types of system components] [Assignment: organization-defined frequency] [Assignment: organization-defined systems or system components] [Assignment: organization-defined advanced automation and analytics capabilities] [Assignment: organization-defined means] [Assignment: organization-defined personnel or roles] [Assignment: organization-defined sources] [Assignment: organization-defined systems, system components, or system services] [Assignment: organization-defined decision points in the system development life cycle] [Assignment: organization-defined corrective actions] [Assignment: organization-defined frequency] [Assignment: organization-defined systems or system components] [Assignment: organization-defined system components or classes of components]

105

NIST SP 800-172r3 fpd (Final Public Draft) September 2025 ENHANCED SECURITY REQUIREMENT 03.12.04E 03.12.04E 03.13.01E 03.13.02E 03.13.03E 03.13.04E 03.13.05E 03.13.05E 03.13.06E 03.13.07E 03.13.09E 03.13.11E 03.13.12E 03.13.12E 03.13.12E 03.13.13E 03.13.13E 03.13.13E 03.13.14E 03.13.15E 03.13.15E 03.13.16E 03.13.16E 03.13.16E 03.14.01E 03.14.01E 03.14.04E 03.14.05E

03.14.08E 03.14.08E 03.14.10E 03.14.10E 03.14.11E 03.14.12E 03.14.13E

Enhanced Security Requirements for Protecting CUI

ORGANIZATION-DEFINED PARAMETER [Assignment: organization-defined conditions] [Assignment: organization-defined frequency] [Assignment: organization-defined system components] [Assignment: organization-defined techniques] [Assignment: organization-defined concealment and misdirection techniques] [Assignment: organization-defined system components] [Assignment: organization-defined processing and/or storage] [Selection (one): [Assignment: organization-defined time frequency]; at random time intervals] [Assignment: organization-defined platform-independent applications] [Assignment: organization-defined frequency] [Assignment: organization-defined information security tools, mechanisms, and support components] [Assignment: organization-defined system components] [Selection (one): Protect against; Limit] [Assignment: organization-defined types of denial-of-service events] [Assignment: organization-defined safeguards by type of denial-of-service event] [Selection (one): Physically; Logically] [Assignment: organization-defined connection ports or input/output devices] [Assignment: organization-defined systems or system components] [Assignment: organization-defined system, system component, or location] [Selection (one): physically; logically] [Assignment: organization-defined critical system components and functions] [Assignment: organization-defined system components] [Selection: physical; logical] [Assignment: organization-defined circumstances for physical or logical separation of components] [Assignment: organization-defined software, firmware, and information] [Assignment: organization-defined actions] [Assignment: organization-defined trusted sources] [Selection (one): Refresh [Assignment: organization-defined information] [Assignment: organization-defined frequency]; Generate [Assignment: organization-defined information] on demand] [Assignment: organization-defined software, firmware, and information] [Selection (one or more): at startup; at [Assignment: organization-defined transitional states or security-relevant events]; [Assignment: organization-defined frequency]] [Assignment: organization-defined system components] [Assignment: organization-defined mechanisms] [Assignment: organization-defined security-relevant changes to the system] [Assignment: organization-defined information inputs to the system] [Assignment: organization-defined personnel or roles]

106

NIST SP 800-172r3 fpd (Final Public Draft) September 2025 ENHANCED SECURITY REQUIREMENT 03.14.14E 03.14.15E 03.14.15E 03.14.16E 03.14.17E 03.14.17E 03.14.18E 03.14.18E 03.15.01E 03.15.02E 03.15.02E 03.15.03E 03.15.03E 03.16.01E 03.16.01E 03.17.01E 03.17.02E 03.17.02E 03.17.03E

03.17.04E 03.17.05E 03.17.05E

Enhanced Security Requirements for Protecting CUI

ORGANIZATION-DEFINED PARAMETER [Assignment: organization-defined safeguards] [Assignment: organization-defined system components and services] [Selection (one or more): upon end of session of use; at [Assignment: organization-defined frequency]] [Assignment: organization-defined systems or system components] [Assignment: organization-defined personnel or roles] [Assignment: organization-defined compromise indicators] [Assignment: organization-defined personnel or roles] [Assignment: organization-defined activities that trigger alerts] [Assignment: organization-defined frequency] [Assignment: organization-defined security requirements] [Assignment: organization-defined architectural layers and locations] [Assignment: organization-defined safeguards] [Assignment: organization-defined locations and architectural layers] [Selection (one or more): design; modification; augmentation; reconfiguration] [Assignment: organization-defined systems or system components] [Selection (one or more): notification of supply chain compromises; results of assessments or audits; provision of [Assignment: organization-defined information]] [Selection (one or more): at random; [Assignment: organization-defined frequency]; upon [Assignment: organization-defined indications of need for inspection]] [Assignment: organization-defined systems or system components] [Selection (one or more): source of counterfeit component; [Assignment: organizationdefined external reporting organizations]; [Assignment: organization-defined personnel or roles]] [Assignment: organization-defined systems, system components, and associated CUI] [Assignment: organization-defined safeguards] [Assignment: organization-defined analysis]

107

NIST SP 800-172r3 fpd (Final Public Draft) September 2025

Enhanced Security Requirements for Protecting CUI

3168

Appendix F. Change Log

3169 3170

This publication incorporates the following changes from the original edition (February 2, 2021):

3171 3172

•

Streamlined introductory information in Sec. 1 and Sec. 2 to improve clarity and understanding

3173 3174

•

Increased the specificity of the enhanced security requirements to remove ambiguity, improve the effectiveness of implementation, and clarify the scope of assessments

3175 3176

•

Grouped enhanced security requirements, where possible, to improve understanding and the efficiency of implementations and assessments

3177

•

Removed outdated and redundant enhanced security requirements

3178 3179 3180

•

Added new enhanced security requirements based on (1) the latest threat intelligence, (2) empirical data from cyber-attacks, and (3) the expansion of security objectives to include integrity and availability

3181

•

Added titles to the enhanced security requirements

3182

•

Restructured and streamlined the security requirement discussion sections

3183 3184

•

Revised the enhanced security requirements for consistency with the security control language in SP 800-53

3185 3186

•

Revised the structure of the References, Acronyms, and Glossary sections for greater clarity and ease of use

3187

•

Added Appendix C to summarize the enhanced security requirements

3188 3189

•

Added Appendix E to list organization-defined parameters for the enhanced security requirements

3190 3191 3192

•

Removed an appendix with a mapping table for security controls and protection strategies and transferred that information to the individual security requirements in Sec. 3

3193

•

Implemented a one-time “revision number” change for consistency with SP 800-171r3

3194 3195 3196 3197 3198 3199

Table 5 shows the changes incorporated into this publication. Errata updates can include corrections, clarifications, or other minor changes in the publication that are either editorial or substantive in nature. Any potential updates to this document that are not yet published in an errata update or a formal revision, including additional issues and potential corrections, will be posted as they are identified. See the publication details for this report. The current release of this publication does not include any errata updates.

3200

108

Related documents

• NIST SP 800-172A: Assessing Enhanced Security Requirements for Controlled Unclassified Information#2922
• NIST SP 800-172Ar3: Assessing Enhanced Security Requirements for Controlled Unclassified Information#180568
• NIST SP 800-171Ar3: Assessing Security Requirements for Controlled Unclassified Information#2919
• NIST SP 800-172r3: Enhanced Security Requirements for Protecting Controlled Unclassified Information#180569
• NIST SP 800-172: Enhanced Security Requirements for Protecting Controlled Unclassified Information: A Supplement to NIST Special Publication 800-171#2921