NIST SP 800-172

United States

vFebruary 2021 edition

10 domains

35 controls

Enhanced Security Requirements for Protecting CUI

Verified

NIST SP 800-172 is a compliance framework from United States with 10 domains and 35 controls that map to 23 other frameworks. The largest domains are RA (7 controls), SI (7 controls), SC (5 controls). Every control below carries what it requires and what an assessor expects to see.

Maintained by Gerard BlokdykVerified against the published standard 31 May 2026Control text last updated 21 May 2026

Framework summaries on this platform are AI-assisted interpretations for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.

Framework Domains (10)

AC

3 controls

Controls in the AC domain of NIST SP 800-172 — 3 controls
Code	Title	Description
3.1.1e	Dual Authorization for Sensitive System Operations	Employ dual authorization to execute critical or sensitive system and organizational operations affecting CUI.
3.1.2e	Restrict Access to Organization-Owned, Provisioned, or Issued Information Resources	Restrict access to systems and components to only those information resources owned, provisioned, or issued by the organ...
3.1.3e	Employ Secure Information Transfer Solutions	Employ secure information transfer solutions to control information flows between security domains on connected systems.

AT

2 controls

Controls in the AT domain of NIST SP 800-172 — 2 controls
Code	Title	Description
3.2.1e	Provide Awareness Training on Advanced Persistent Threat	Provide awareness training upon initial hire, annually, and when system changes occur, focused on recognizing and respon...
3.2.2e	Practical Exercises in Awareness Training	Include practical exercises in awareness training for managers, senior executives, and selected personnel that reinforce...

CA

1 controls

Controls in the CA domain of NIST SP 800-172 — 1 controls
Code	Title	Description
3.12.1e	Penetration Testing by Independent Agents	Conduct penetration testing at least annually, leveraging automated scanning tools and ad hoc tests using subject matter...

CM

3 controls

Controls in the CM domain of NIST SP 800-172 — 3 controls
Code	Title	Description
3.4.1e	Authoritative Source for Software and Firmware	Establish and maintain an authoritative source and repository to provide a trusted source and accountability for approve...
3.4.2e	Automated Detection and Remediation of Unauthorized Software	Employ automated mechanisms to detect misconfigured or unauthorized system components; after detection, remove the compo...
3.4.3e	Automated Inventory of System Components	Employ automated discovery and management tools to maintain an up-to-date, complete, accurate, and readily available inv...

IA

3 controls

Controls in the IA domain of NIST SP 800-172 — 3 controls
Code	Title	Description
3.5.1e	Identification of Systems, Components, and Devices	Identify and authenticate systems and system components, where possible, before establishing a network connection using...
3.5.2e	Password Manager Use	Employ automated mechanisms for the generation, protection, rotation, and management of passwords for systems and accoun...
3.5.3e	Prohibit Connection of Unknown or Unverified System Components	Employ automated or manual and procedural mechanisms that prevent a system component from connecting to organizational s...

IR

2 controls

Controls in the IR domain of NIST SP 800-172 — 2 controls
Code	Title	Description
3.6.1e	Establish Security Operations Center (SOC)	Establish and maintain a security operations center that operates 24/7, with allowance for remote/on-call staff.
3.6.2e	Establish and Maintain a Cyber Incident Response Team	Establish and maintain a cyber incident response team that can be deployed by the organization within 24 hours.

PS

2 controls

Controls in the PS domain of NIST SP 800-172 — 2 controls
Code	Title	Description
3.9.1e	Enhanced Personnel Screening	Conduct enhanced personnel screening that reflects applicable laws, executive orders, directives, policies, regulations,...
3.9.2e	Insider Threat Program	Ensure organizational systems are protected if adverse information develops or is obtained about individuals with access...

RA

7 controls

Controls in the RA domain of NIST SP 800-172 — 7 controls
Code	Title	Description
3.11.1e	Threat-Aware Risk Assessment	Employ threat intelligence, at a minimum from open or commercial sources and any DoD-provided sources, as part of a risk...
3.11.2e	Threat Hunting	Conduct cyber threat hunting activities to search for indicators of compromise in organizational systems and detect, tra...
3.11.3e	Advanced Automation and Analytics Capabilities	Employ advanced automation and analytics capabilities in support of analysts to predict and identify risks to organizati...
3.11.4e	Security Solution Rationale Document	Document or reference in the system security plan the security solution selected, the rationale for the security solutio...
3.11.5e	Assess Effectiveness of Security Solutions	Assess the effectiveness of security solutions at least annually or upon receipt of relevant cyber threat information, o...
3.11.6e	Supply Chain Risk Assessment, Response, and Monitoring	Treats supply chain risk as a continuing cycle rather than a one-off review: identify the risk carried by systems, compo...
3.11.7e	Supply Chain Risk Management Plan	Develop a plan for managing supply chain risks; protect against supply chain risks; and update the plan at least annuall...

SC

5 controls

Controls in the SC domain of NIST SP 800-172 — 5 controls
Code	Title	Description
3.13.1e	Create Diversity in System Components to Limit Malicious Code Propagation	Introduce deliberate variety into a defined set of system components so that a single working technique cannot spread un...
3.13.2e	Introduce Unpredictability into System Operations	Make a defined set of changes to systems and system components, at a defined frequency, so that the attack surface stops...
3.13.3e	Confuse and Mislead Adversaries	Employ chosen technical and procedural means that corrupt the picture an adversary is working from. Misdirection routes...
3.13.4e	Physical and Logical Isolation Techniques	Employ physical isolation techniques, logical isolation techniques, or both across organizational systems and system com...
3.13.5e	Distribute and Relocate System Functions or Resources	Move a defined set of system functions or resources between locations at a defined frequency, so that what an adversary...

SI

7 controls

Controls in the SI domain of NIST SP 800-172 — 7 controls
Code	Title	Description
3.14.1e	Verify Integrity of Security Critical Software and Firmware	Verify the integrity of security critical and essential software using root of trust mechanisms or cryptographic signatu...
3.14.2e	Monitor Organizational Systems with Specialized Capabilities	Monitor organizational systems and system components on an ongoing basis for anomalous or suspicious behavior using adva...
3.14.3e	Include Systems in Scope of Enhanced Requirements or Segregate into Purpose-Specific Networks	Decide, for every system and system component in the inventory, whether it will be brought within the scope of the enhan...
3.14.4e	Refresh Systems and Components from a Trusted Baseline	Refresh organizational systems and system components from a known, trusted state at a defined frequency to reduce dwell...
3.14.5e	Review Persistent Storage and Remove CUI No Longer Needed	Conduct reviews of persistent organizational storage locations at a defined frequency and remove CUI that is no longer n...
3.14.6e	Use Threat Indicator Information for Detection	Use threat indicator information relevant to the information and systems being protected and effective mitigations obtai...
3.14.7e	Verify Correctness of Security Functions	Verify the correctness of security critical or essential software, firmware, and hardware components through review, ana...

Your Compliance Coverage

If you comply with NIST SP 800-172, you already cover:

NIST SP 800-161 Rev 1

100%

35 controls mapped

Compare →

NIST SP 800-53 Rev 5

100%

35 controls mapped

Compare →

C5 (Germany)

94%

33 controls mapped

Compare →

+ 20 more: Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 (94%), PCI DSS 4.0 (94%)

See all 23 mapped frameworks ↓

Maps to 23 other frameworks

35 total controls

NIST SP 800-161 Rev 1

35 source controls mapped|87 target controls covered

100%

NIST SP 800-53 Rev 5

35 source controls mapped|80 target controls covered

100%

C5 (Germany)

33 source controls mapped|46 target controls covered

94%

Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1

33 source controls mapped|62 target controls covered

94%

PCI DSS 4.0

33 source controls mapped|79 target controls covered

94%

NIST Cybersecurity Framework 2.0

33 source controls mapped|63 target controls covered

94%

FedRAMP High

32 source controls mapped|91 target controls covered

91%

FedRAMP Moderate

32 source controls mapped|92 target controls covered

91%

NIST SP 800-171 Rev 3

32 source controls mapped|49 target controls covered

91%

NIST SP 800-53 Revision 5.1 HIGH

31 source controls mapped|63 target controls covered

89%

NIST SP 800-53 Rev 5 MODERATE

31 source controls mapped|60 target controls covered

89%

ISO 27002:2022

31 source controls mapped|48 target controls covered

89%

ISO 27001:2022

31 source controls mapped|48 target controls covered

89%

CMMC 2.0

30 source controls mapped|50 target controls covered

86%

CIS Controls v8

28 source controls mapped|74 target controls covered

80%

Azure Security Benchmark

27 source controls mapped|51 target controls covered

77%

SOC 2

27 source controls mapped|24 target controls covered

77%

HIPAA Security Rule

26 source controls mapped|27 target controls covered

74%

NIST SP 800-66 Rev 2

26 source controls mapped|27 target controls covered

74%

NIST SP 800-53 Rev 5 LOW

25 source controls mapped|33 target controls covered

71%

NIST SP 800-218

16 source controls mapped|20 target controls covered

46%

ANSSI Guide d'hygiene informatique (42 mesures, v2.0)

15 source controls mapped|14 target controls covered

43%

ISO 22301:2019

6 source controls mapped|8 target controls covered

17%

Compare NIST SP 800-172 with NIST SP 800-161 Rev 1

What is NIST SP 800-172 and who does it apply to?

NIST SP 800-172 is a compliance framework from United States with 10 domains and 35 controls. Enhanced Security Requirements for Protecting CUI It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.

What does NIST SP 800-172 actually require?

NIST SP 800-172 has 35 controls organised across 10 domains. The largest domains are RA (7 controls), SI (7 controls), SC (5 controls). Each control defines specific requirements that organisations must implement to achieve compliance.

If I already comply with another framework, how much of NIST SP 800-172 do I already cover?

NIST SP 800-172 maps to 23 other compliance frameworks. The top mapping partners are NIST SP 800-161 Rev 1 (100% coverage), NIST SP 800-53 Rev 5 (100% coverage), C5 (Germany) (94% coverage). Use our comparison tool to explore control-level mappings between frameworks.

How do I implement NIST SP 800-172?

Start your NIST SP 800-172 compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about NIST SP 800-172 requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 35 controls and track your progress.

Start Your Compliance Journey

Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 686 frameworks.

Get Started Free →

Free forever — no credit card required