Guides / October 22, 2026
What Is NIST 800-172 and Does It Apply to Me?
Your contract mentions NIST 800-172 and you are not sure what it means. You also want to know whether it changes what you must do.
What is NIST 800-172?
NIST stands for the National Institute of Standards and Technology. It wrote SP 800-172 as a supplement to SP 800-171. SP stands for Special Publication, the label NIST gives these guides.
The 800-172 guide adds enhanced security requirements for one specific case. That case is CUI tied to a critical program or a high value asset. CUI stands for Controlled Unclassified Information, sensitive unclassified data the government marks for protection.
A critical program is a program whose failure would seriously hurt a federal mission. A high value asset is a system that would cause major harm if breached. The threat in mind is the APT. APT stands for advanced persistent threat, a skilled and well funded attacker. APTs pursue a target for months or years and adapt when blocked. (NIST Publishes SP 800-172)
NIST first published the guide in February 2021. Its requirements build on 800-171 but go further. They are designed for contracts where the stakes justify extra defense. NIST issued a revision 3 draft in November 2024. It sharpens the wording and adds families for planning, acquisition, and supply chain risk. (SP 800-172 Rev. 3, NIST)
How is it different from 800-171?
800-171 sets the baseline. Every contractor handling CUI on a Defense contract with clause 7012 follows it. DFARS stands for Defense Federal Acquisition Regulation Supplement. Clause 252.204-7012 defines adequate security as meeting 800-171. (DFARS 252.204-7012)
800-172 is different. It adds tougher requirements on top of the baseline. NIST groups them into three goals. First, make your systems hard to break into. Second, limit the damage if an attacker gets in. Third, design systems to survive attacks and recover fast. That last goal covers cyber resiliency, meaning the ability to keep working through an attack.
Not every contract needs this level. Federal agencies pick which requirements to require, based on mission need and risk. The chosen requirements then appear in the contract, grant, or solicitation. 800-172 is never automatic. It applies only when an agency says so in writing.
Does it apply to my contract?
Check the actual paper. Read your contract, your statement of work, and any solicitation you bid on. Search for "800-172" or "enhanced security requirements". If neither appears, the baseline 800-171 rules apply to you.
If 800-172 appears, read which requirements are named. Agencies select a subset, not the whole guide. Your contract should name the specific requirements. Note that prime contractors can flow these requirements down. If your prime says your work supports a critical program, ask for the list in writing.
When in doubt, ask your contracting officer. A contracting officer is the person who can change your contract terms. One email with your contract number gets you the real answer.
What should I do first if it does?
First, list exactly what your contract requires. Copy the named requirements into one checklist.
Second, compare that list against your current 800-171 work. You already have an SSP and a POA&M if you follow 7012. SSP stands for system security plan, your written map of how each requirement is met. POA&M stands for plan of action and milestones, your list of gaps and fix dates.
Third, mark each 800-172 requirement as met, partially met, or missing. Fourth, use real evidence for each answer. Examples include firewall rules, access control logs, backup test results, and incident response drill notes. Fifth, put every gap into the POA&M with an owner and a date.
Do not start by buying new tools. Start by knowing the exact gap.
Next step
If 800-172 appears in your contract, start from your 800-171 baseline and close the new gaps. PolicyCortex reads live configuration from your Azure tenant and evaluates it against NIST 800-53 and NIST 800-171. It then produces SSP, SAR, and POA&M output from the collected evidence. SAR stands for security assessment report, the record of what was tested and found. Its 33 collectors read conditional access, diagnostic settings, Defender posture, backup, and firewall settings. It re-verifies after you remediate. It is strongest in commercial Azure, with AWS covered. Learn more at https://policycortex.com.