Search CSRC

While the public comment period on SP 800-171 and SP 800-171A continues, the SP 800-172 update has begun. Here’s what you can expect. The enhanced security requirements for protecting CUI will be modified to match the structure of the requirements in SP 800-171, Revision 3. The enhanced security requirements will align with the structure and content of the controls and control enhancements in SP 800-53, Revision 5. Enhanced security requirements will be added to address new threats and vulnerabilities. Changes to the enhanced security requirements will support the future development of...

Overlay Name: NIST SP 800-171, Rev 3, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations Overlay Publication Date: May 2024 Technology or System: Controlled Unclassified Information Overlay Author: Ron Ross (NIST), Victoria Pillitteri (NIST) Comments: Supplement to SP 800-171, Revision 3, identifying controls for protecting the confidentiality of Controlled Unclassified Information (CUI) based on SP 800-53, Revision 5, and SP 800-53B. The control overlay serves as an alternative method to capture the security requirements in SP 800-171, Revision 3, and...

Comments Received on SP 800-172r3 (FPD) Below are comments received on the final public draft of SP 800-172r3, Enhanced Security Requirements for Protecting Controlled Unclassified Informa tion The public comment period closed on January 16, 2026. All comments submitted during the public comment period for Draft NIST SP 800-172r3 will be posted below without change or redaction, so commenters should not include information they do not wish to be posted (e.g., personal or business information). Date Received From 29 September 2025 Aboubacar Camara...

NIST has published the final versions of Special Publication (SP) 800-171r3 (Revision 3), Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations, and SP 800-171Ar3, Assessing Security Requirements for Controlled Unclassified Information.

NIST seeks information for a planned update of the Controlled Unclassified Information series of publications (SP 800-171, -171A, -172, and -172A). The public comment period is open through September 16, 2022.

The National Institute of Standards and Technology (NIST), in coordination with the Department of Defense (DoD) and the National Archives and Records Administration (NARA), is hosting an informational workshop providing an overview of Controlled Unclassified Information (CUI), the Defense Acquisition Regulations System (DFARS) Safeguarding Covered Defense Information and Cyber Incident Reporting Clause, and NIST Special Publications 800-171 and 800-171A. This workshop will also feature panels of Federal Government representatives discussing expectations for evaluating evidence and implementing...

On January 10, 2024, from 1 p.m. to 2 p.m. EST, NIST will host a webinar to provide an overview of the significant changes in draft Special Publication (SP) 800-171r3 (Revision 3) and SP 800-171Ar3. Both drafts are available concurrently for public comment through the extended deadline of January 26, 2024.. During this webinar, the authors will: Provide an overview of the significant changes in the final public draft of SP 800-171r3 and the initial public draft of SP 800-171Ar3 Describe the design principles and rationale behind the changes Identify areas where NIST seeks additional and...

Abstract: The protection of Controlled Unclassified Information (CUI) resident in nonfederal systems and organizations is of paramount importance to federal agencies and can directly impact the ability of the Federal Government to successfully conduct its essential missions and functions. This publication pro...

Abstract: The protection of controlled unclassified information (CUI) resident in nonfederal systems and organizations is of paramount importance to federal agencies and can directly impact the ability of the Federal Government to successfully conduct its essential missions and functions. This publication pro...

Abstract: This bulletin summarizes the information found in NIST SP 800-171A: Assessing Security Requirements for Controlled Unclassified Information (CUI) which provides federal and nonfederal organizations with assessment procedures and a methodology that can be employed to conduct assessments of the CUI se...

Abstract: This bulletin summarizes the information presented in NIST SP 800-171: Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations. The publication the protection of Controlled Unclassified Information (CUI) while residing in nonfederal information systems and...

The new enhanced security requirements in SP 800-172r3 support cyber resiliency objectives, focus on protecting CUI, and are consistent with the source controls in SP 800-53r5. SP 800-172Ar3 provides a set of assessment procedures for the enhanced security requirements. Comments are due November 14, 2025.

The initial public draft (ipd) of NIST Special Publication (SP) 800-172 Revision 3, Enhanced Security Requirements for Protecting Controlled Unclassified Information (CUI), is available for comment. The public comment period is open through January 17, 2025.

In July 2022, NIST issued a Pre-Draft Call for Comments on the Controlled Unclassified Information (CUI) series of publications.

NIST has released Draft Special Publication (SP) 800-172A, "Assessing Enhanced Security Requirements for Controlled Unclassified Information." Public comments are due June 11, 2021.

NIST has released a final public draft for comment: Draft Special Publication (SP) 800-172. The comment period ends on August 21, 2020.

Type: Presentation

Type: Presentation

Type: Presentation

Abstract: Unmanaged cybersecurity risks can wreak havoc on a community. This is no less true for the U.S. scientific research ecosystem, particularly members of the higher education research community, which can be characterized by its fundamentally open, collaborative culture and web of highly decentralized...

Abstract: The protection of Controlled Unclassified Information (CUI) resident in nonfederal systems and organizations is of paramount importance to federal agencies and can directly impact the ability of the federal government to successfully conduct its essential missions and functions. This publication pro...

Type: Presentation