NIST SP 800-172: the enhanced requirements behind CMMC Level 3
Published 2026-10-25, 11 min read
NIST SP 800-172 is a supplement to NIST SP 800-171: extra requirements for CUI that is tied to a critical program or a high value asset, written to stand up to an advanced persistent threat. For a DoD contractor it matters in one place, CMMC Level 3, which DCMA DIBCAC assesses after a Final Level 2 (C3PAO).
- 35in NIST's set
- Enhanced requirements in the February 2021 edition, the one the CMMC rule names. SP 800-172 Feb2021
- 24for Level 3
- Requirements CMMC selected from that set, with DoD's own values filled into the blanks. § 170.14(c)(4)
- 20of 24
- The lowest score that still earns a Conditional Level 3, with 7 requirements that may never wait on a POA&M. § 170.21(a)(3)
- 103in Rev 3
- Requirements in NIST's May 2026 revision. The CMMC rule has not adopted it. SP 800-172r3
If your contracts name Level 1 or Level 2, nothing in 800-172 applies to you. Level 2 is the 110 requirements of NIST SP 800-171 Rev 2.
- In force today
- DFARS 252.204-7012 still applies: NIST SP 800-171 Rev 2 on systems that hold covered defense information, cyber incidents reported to DoD within 72 hours, and FedRAMP Moderate or equivalent for any cloud that holds it. DFARS 252.204-7012(b)(2), (c)
- Suspended
- Phase 2, due in November 2026, is suspended for every contractor, whatever its size: contracts are not adding the third-party Level 2 (C3PAO) or Level 3 (DIBCAC) requirements. DoW CIO memo of 2026-07-13, applied by Class Deviation 2026-O0025 Rev 3
- Not yet known
- The outcome of the CMMC Reform Task Force review is not confirmed as of 2026-10-23: no report or rule change has been published. Federal Register search, 2026-10-23
What NIST SP 800-172 is
NIST SP 800-171 is the baseline for any contractor system that holds CUI. NIST SP 800-172, published in February 2021 as Enhanced Security Requirements for Protecting Controlled Unclassified Information, sits on top of it. It is not meant for every system with CUI on it. NIST scopes it to the parts of a system that hold, or protect, CUI tied to a critical program or a high value asset, and it leaves the choice to the agency: the requirements reach a contractor only through a contract or other agreement that names them.
The threat it is written for is the advanced persistent threat: an attacker with the time and money to get in quietly and stay. Against that, 800-172 groups its requirements under three strategies.
Penetration-resistant architecture
Make the systems that hold the CUI hard to get into at all: isolation, strong device identity, tight control over what may connect.
Damage-limiting operations
Assume someone gets in and limit what they can reach and how long they stay: hunting, a response team on call, a watch on the network.
Cyber resiliency and survivability
Keep the work and the information sound while under attack: trusted software, known-good configurations, a real inventory.
The February 2021 edition holds 35 requirements. They use the same family names as 800-171, and an “e” on the number marks them as enhanced (3.6.1e, 3.11.2e). Only 10 of the 14 families carry any: Audit and Accountability, Maintenance, Media Protection and Physical Protection have none. Many requirements leave a blank, an organization-defined parameter, for the agency to fill in: how often, how fast, from which sources. How the base standard works, family by family, is in what is NIST SP 800-171.
The 24 CMMC Level 3 requirements from NIST SP 800-172
CMMC does not adopt 800-172 whole. Level 3 adds 24 requirements selected from NIST SP 800-172 to the 110 of Level 2, and 32 CFR 170.14(c)(4) prints them in a table with DoD's values already written into NIST's blanks. Each takes a CMMC id built from the family, the level and NIST's number: 3.6.1e becomes IR.L3-3.6.1e. The table below is that list, word for word.
| Requirement | What DoD's version asks | On a POA&M |
|---|---|---|
| AC.L3-3.1.2e | Restrict access to systems and system components to only those information resources that are owned, provisioned, or issued by the organization. | May wait |
| AC.L3-3.1.3e | Employ secure information transfer solutions to control information flows between security domains on connected systems. | May wait |
| AT.L3-3.2.1e | Provide awareness training upon initial hire, following a significant cyber event, and at least annually, focused on recognizing and responding to threats from social engineering, advanced persistent threat actors, breaches, and suspicious behaviors; update the training at least annually or when there are significant changes to the threat. | May wait |
| AT.L3-3.2.2e | Include practical exercises in awareness training for all users, tailored by roles, to include general users, users with specialized roles, and privileged users, that are aligned with current threat scenarios and provide feedback to individuals involved in the training and their supervisors. | May wait |
| CM.L3-3.4.1e | Establish and maintain an authoritative source and repository to provide a trusted source and accountability for approved and implemented system components. | May wait |
| CM.L3-3.4.2e | Employ automated mechanisms to detect misconfigured or unauthorized system components; after detection, remove the components or place the components in a quarantine or remediation network to facilitate patching, re-configuration, or other mitigations. | May wait |
| CM.L3-3.4.3e | Employ automated discovery and management tools to maintain an up-to-date, complete, accurate, and readily available inventory of system components. | May wait |
| IA.L3-3.5.1e | Identify and authenticate systems and system components, where possible, before establishing a network connection using bidirectional authentication that is cryptographically based and replay resistant. | May wait |
| IA.L3-3.5.3e | Employ automated or manual/procedural mechanisms to prohibit system components from connecting to organizational systems unless the components are known, authenticated, in a properly configured state, or in a trust profile. | May wait |
| IR.L3-3.6.1e | Establish and maintain a security operations center capability that operates 24/7, with allowance for remote/on-call staff. | Never |
| IR.L3-3.6.2e | Establish and maintain a cyber-incident response team that can be deployed by the organization within 24 hours. | Never |
| PS.L3-3.9.2e | Ensure that organizational systems are protected if adverse information develops or is obtained about individuals with access to CUI. | May wait |
| RA.L3-3.11.1e | Employ threat intelligence, at a minimum from open or commercial sources, and any DoD-provided sources, as part of a risk assessment to guide and inform the development of organizational systems, security architectures, selection of security solutions, monitoring, threat hunting, and response and recovery activities. | Never |
| RA.L3-3.11.2e | Conduct cyber threat hunting activities on an on-going aperiodic basis or when indications warrant, to search for indicators of compromise in organizational systems and detect, track, and disrupt threats that evade existing controls. | May wait |
| RA.L3-3.11.3e | Employ advanced automation and analytics capabilities in support of analysts to predict and identify risks to organizations, systems, and system components. | May wait |
| RA.L3-3.11.4e | Document or reference in the system security plan the security solution selected, the rationale for the security solution, and the risk determination. | Never |
| RA.L3-3.11.5e | Assess the effectiveness of security solutions at least annually or upon receipt of relevant cyber threat information, or in response to a relevant cyber incident, to address anticipated risk to organizational systems and the organization based on current and accumulated threat intelligence. | May wait |
| RA.L3-3.11.6e | Assess, respond to, and monitor supply chain risks associated with organizational systems and system components. | Never |
| RA.L3-3.11.7e | Develop a plan for managing supply chain risks associated with organizational systems and system components; update the plan at least annually, and upon receipt of relevant cyber threat information, or in response to a relevant cyber incident. | Never |
| CA.L3-3.12.1e | Conduct penetration testing at least annually or when significant security changes are made to the system, leveraging automated scanning tools and ad hoc tests using subject matter experts. | May wait |
| SC.L3-3.13.4e | Employ physical isolation techniques or logical isolation techniques or both in organizational systems and system components. | May wait |
| SI.L3-3.14.1e | Verify the integrity of security critical and essential software using root of trust mechanisms or cryptographic signatures. | May wait |
| SI.L3-3.14.3e | Ensure that specialized assets including IoT, IIoT, OT, GFE, Restricted Information Systems, and test equipment are included in the scope of the specified enhanced security requirements or are segregated in purpose-specific networks. | Never |
| SI.L3-3.14.6e | Use threat indicator information and effective mitigations obtained from, at a minimum, open or commercial sources, and any DoD-provided sources, to guide and inform intrusion detection and threat hunting. | May wait |
Read down the list and the shape is plain. 7 of the 24 sit in Risk Assessment (threat intelligence, threat hunting, analytics, supply chain risk); the rest is what a staffed security team runs every day: a network watched around the clock, an inventory kept by tools, devices that prove what they are before they connect, a penetration test at least once a year.
The other 11 requirements of the February 2021 edition are not part of CMMC: 3.1.1e (dual authorization for critical or sensitive operations); 3.5.2e (automated password management where MFA is not supported); 3.9.1e (enhanced personnel screening); 3.13.1e (diversity in system components); 3.13.2e (planned unpredictability in operations); 3.13.3e (means to confuse and mislead adversaries); 3.13.5e (distributing and relocating system functions); 3.14.2e (ongoing monitoring for anomalous behavior); 3.14.4e (refreshing components from a known, trusted state); 3.14.5e (reviewing storage locations and removing CUI no longer needed); 3.14.7e (verifying the correctness of critical components). An agency outside CMMC may still select them in its own contract. If the question is what Level 2 asks first, start with the CMMC Level 2 requirements.
How DoD filled in NIST's blanks
NIST writes many 800-172 requirements with a blank: an organization-defined parameter, shown as “[Assignment: …]”. NIST leaves the value to whoever imposes the requirement. For CMMC Level 3, DoD set the values in the rule itself, so a Level 3 shop does not get to choose how fast its response team deploys. Five of the blanks, side by side:
| Requirement | NIST SP 800-172 (Feb 2021) | CMMC Level 3 |
|---|---|---|
| Security operations center3.6.1e | “operates [Assignment: organization-defined time period]” | “operates 24/7, with allowance for remote/on-call staff” |
| Incident response team3.6.2e | “can be deployed by the organization within [Assignment: organization-defined time period]” | “can be deployed by the organization within 24 hours” |
| Penetration testing3.12.1e | “Conduct penetration testing [Assignment: organization-defined frequency]” | “at least annually or when significant security changes are made to the system” |
| Awareness training3.2.1e | “Provide awareness training [Assignment: organization-defined frequency]” | “upon initial hire, following a significant cyber event, and at least annually” |
| Threat intelligence3.11.1e | “Employ [Assignment: organization-defined sources of threat intelligence]” | “at a minimum from open or commercial sources, and any DoD-provided sources” |
Where the rule leaves a word like “periodically” open, 32 CFR 170.14(d) caps it: the interval is yours to set, but no longer than one year. Write the interval you chose into the system security plan; that is where an assessor looks for it.
NIST SP 800-172A and the Level 3 assessment
NIST SP 800-172A (March 2022) is the companion that says how each 800-172 requirement is checked: what an assessor examines, whom they interview and what they test. 32 CFR 170.18 names that edition, with SP 800-171A for the Level 2 checks, as the procedure DCMA's Defense Industrial Base Cybersecurity Assessment Center (DIBCAC) follows. Nobody but DIBCAC assesses Level 3: there is no self-assessment and no C3PAO route.
Hold a Final Level 2 (C3PAO)
On the same systems, or a larger set around them. A Conditional Level 2 is not enough, and any Level 2 POA&M items must be closed before Level 3 starts. § 170.18(a)(1); § 170.19(e)
Ask DIBCAC
Email the DCMA DIBCAC point of contact with your Level 2 assessment's unique identifier. DIBCAC checks the Level 2 status and schedules you. § 170.18(c)(1)(ii)
Be assessed
Government assessors test the requirements with the SP 800-172A procedures (examine, interview, test) and may re-check Level 2 requirements. A NOT MET can be re-evaluated for 10 business days after the active assessment. § 170.18(c)(1)(iii), (c)(2)
Score and status
One point per requirement, 24 at most. All MET is a Final Level 3 (DIBCAC); 20 or more with a POA&M that leaves out the 7 named requirements is a Conditional one, closed out by DIBCAC within 180 days. § 170.24(c)(3); § 170.21(a)(3)
Affirm and repeat
A senior official affirms at each assessment and every year. Level 3 is reassessed every three years, and so is the Level 2 (C3PAO) underneath it. Hashed evidence is kept six years. § 170.18(a)(1)–(2), (c)(4)
A cloud does not carry the 24 for you. The rule says they apply to every environment where the CUI is processed, stored or transmitted; a requirement you inherit from a cloud provider still has to be shown, through the provider's customer responsibility matrix and the evidence behind it. A service provider that is not a cloud, such as an MSP that handles your CUI, is assessed inside your scope against both levels. How Level 2 certification works, and what a C3PAO does, is in how to get CMMC certified.
NIST SP 800-172 Rev 3: what changed, and what did not
In May 2026 NIST published SP 800-172 Rev 3 and SP 800-172A Rev 3, and withdrew the February 2021 and March 2022 editions. The jump from no revision number to “Rev 3” is NIST lining the numbers up with SP 800-171 Rev 3, not a third rewrite. The new edition is much larger, and it now covers integrity and availability as well as confidentiality.
| The question | February 2021 | Rev 3 |
|---|---|---|
| Published | February 2021 | May 2026 |
| NIST's status | Withdrawn May 13, 2026 | Current |
| Requirements | 35 | 103 (115 numbers, 12 marked withdrawn) |
| Families | 14, four of them empty | 17, adding Planning, System and Services Acquisition, and Supply Chain Risk Management |
| Numbering | 3.6.1e, no titles | 03.06.01E, each with a title |
| Protects | Confidentiality of CUI | Confidentiality, integrity and availability |
| Assessment companion | SP 800-172A (March 2022) | SP 800-172A Rev 3 (May 2026) |
| CMMC Level 3 | The edition the rule names | Not adopted |
For CMMC, the date in the rule is what counts. 32 CFR 170.2 incorporates SP 800-172 “February 2021” and SP 800-172A “March 2022” by reference, so a Level 3 assessment is run against those editions until DoD amends the rule, whatever NIST has withdrawn. Where the CMMC program stands today is in the status box near the top of this page. The same split between NIST's current revision and the one DoD binds runs through Level 2; it is laid out in CMMC vs NIST SP 800-171.
Does a small shop need NIST SP 800-172?
Almost never directly. The enhanced requirements are meant for CUI tied to critical programs and high value assets, and Level 3's prerequisite, a Final Level 2 (C3PAO), is already more than most small shops are asked for. Where Level 3 stands in contracts today is in the status box near the top of this page. Find your row:
| If | Then |
|---|---|
| Your contract names Level 1 or Level 2, or only DFARS 252.204-7012 | 800-172 does not apply. Your standard is FAR 52.204-21 or NIST SP 800-171 Rev 2. § 170.14(c)(2)–(3) |
| A prime with a Level 3 requirement will send you CUI | Level 2 (C3PAO) is the minimum the rule sets for you, not Level 3. The prime's subcontract says what it flows down. § 170.23(a)(4) |
| Your own contract names Level 3 (DIBCAC) | The 24 requirements above, assessed by DIBCAC, after a Final Level 2 (C3PAO) on the same systems. § 170.18(a)–(b) |
| A civilian agency contract names SP 800-172 | Only the requirements that contract selects, with its values for the blanks. Ask for the list in writing. SP 800-172, abstract |
If you are not sure which level your work points to, the CMMC level finder walks the questions in a few minutes. If a prime has said “Level 3” out loud, ask whether that is their requirement or yours, and whether you will hold CUI at all.
Questions about NIST SP 800-172
What is the difference between NIST SP 800-171 and 800-172?
800-171 is the baseline for any nonfederal system that holds CUI; Level 2 is its 110 requirements (Rev 2). 800-172 adds enhanced requirements on top, only where an agency selects them for CUI tied to a critical program or high value asset. It does not replace anything in 800-171.
What is NIST SP 800-172A?
The assessment companion: for each 800-172 requirement it sets out what to examine, whom to interview and what to test. 32 CFR 170.18 has DIBCAC assess Level 3 with the March 2022 edition of 800-172A, alongside SP 800-171A for the Level 2 checks.
How many requirements are in NIST SP 800-172?
35 in the February 2021 edition, the one CMMC names. CMMC Level 3 uses 24 of them. The May 2026 Rev 3 is a larger, renumbered set that CMMC has not adopted.
Can a Level 3 requirement go on a POA&M?
Some can. A Conditional Level 3 needs a score of at least 20 of 24 (0.8 of the maximum), and 7 requirements may never be on the POA&M: IR.L3-3.6.1e, IR.L3-3.6.2e, RA.L3-3.11.1e, RA.L3-3.11.4e, RA.L3-3.11.6e, RA.L3-3.11.7e, SI.L3-3.14.3e. DIBCAC closes it out within 180 days, or the Conditional status expires.
Can a C3PAO or my RPO do the Level 3 assessment?
No. DCMA DIBCAC performs every Level 3 certification assessment on behalf of DoD. A C3PAO's part is the Final Level 2 (C3PAO) that has to come first. What a C3PAO does is in what is a C3PAO.
Does Rev 3 change what Level 3 asks today?
No. Part 170 incorporates the February 2021 edition by reference, and a Level 3 requirement keeps its 3.x.xe number (IR.L3-3.6.1e) until DoD amends the rule. Rev 3 renumbers everything (03.06.01E) and is worth reading as a sign of where the requirements may go.
Does a compliance tool cover 800-172?
Not by itself. A platform that maps controls to 800-172 helps you track the work and the evidence; it does not run a security operations center or a penetration test for you. The platforms are compared in CMMC compliance software.