NIST SP 800-172

No changes recorded yet — we are watching, and nothing has been published.

1. 2026-07-13 DoD CIO memo suspends the November 2026 CMMC Phase 2 transition; contracting officers are told to remove or revise CMMC requirements in solicitations and contracts
2. 2026-05-13 SP 800-172 Rev. 3 and SP 800-172A Rev. 3 published; the February 2021 edition and the March 2022 SP 800-172A withdrawn
3. 2024-12-16 CMMC program rule (32 CFR 170) takes effect; Level 3 uses selected SP 800-172 (Feb 2021) requirements assessed with SP 800-172A (Mar 2022)
4. 2022-03-15 SP 800-172A, assessment procedures for the enhanced requirements, published

1. 2026-05-13
   SP 800-172 Rev. 3 Major versionCurrent

   Supplements SP 800-171 Rev. 3; the number jumped from the original edition to "Rev. 3" in a one-time change to match SP 800-171. source

   More

   • The requirements are more specific and follow SP 800-53 wording, with new numbering and titles.
   • Integrity and availability join confidentiality as objectives.
   • Planning, System and Services Acquisition and Supply Chain Risk Management families were added and outdated requirements removed.
   • SP 800-172A Rev. 3 (assessment procedures) was published the same day.
2. 2025-09-29
   SP 800-172 Rev. 3 (final public draft) Draft

   Final public draft, released with the first draft of SP 800-172A Rev. 3; comments closed 16 January 2026. source

3. 2024-11-13
   SP 800-172 Rev. 3 (initial public draft) Draft

   Initial public draft of Rev. 3; comments closed 17 January 2025. source

4. 2021-02-02
   SP 800-172 Major version

   First edition, "Enhanced Security Requirements for Protecting Controlled Unclassified Information: A Supplement to NIST Special Publication 800-171", developed from the 2019 draft SP 800-171B. source

   More

   • Withdrawn by NIST on 13 May 2026 but still the edition CMMC Level 3 uses.
5. 2020-07-06
   SP 800-172 (draft) Draft

   Public draft under the new number SP 800-172. source

The enhanced requirements apply only when a federal agency selects them; in defense contracting, CMMC Level 3 requires the 24 requirements in 32 CFR 170.14 table 1.

Only when selected

The enhanced requirements apply only when a federal agency selects them, through a contract or other agreement, for CUI associated with a critical program or high value asset. source

Selection

NIST expects agencies to pick only those needed, based on mission and risk. source

CMMC Level 3

In defense contracting, CMMC Level 3 requires the 24 requirements in 32 CFR 170.14 table 1, drawn from the February 2021 edition, with DoD-assigned parameters. source

SP 800-172A gives the assessment procedures; under CMMC, a Level 3 certification assessment is performed by DCMA's DIBCAC.

NIST

SP 800-172A provides federal agencies with assessment procedures for the enhanced security requirements. source

NIST and CMMC

NIST is not involved in the design, development, or implementation of the CMMC model, accreditation body, or certification. source

CMMC Level 3

Under CMMC, a Level 3 certification assessment is performed by DCMA's DIBCAC and requires a Final Level 2 (C3PAO) status for the same scope first. source

Reassessment

Level 3 must be reassessed every three years, with an affirmation at each assessment and annually. source

NIST is not a regulatory agency; under the CMMC rule, Level 3 status is a condition of contract award.

Not a regulator

NIST is not a regulatory agency. source

Contract award

Under the CMMC rule, the required Level 3 status must be met before award of any contract or subcontract that calls for it; if it expires during performance, standard contractual remedies apply. source

Since July 2026

Since July 2026 DoD has suspended the Phase 2 transition and permits Level 1 (Self) or Level 2 (Self) assessments in procurement requests. source

1. Standard NIST SP 800-172 Rev. 3 – Enhanced Security Requirements for Protecting CUI (PDF)
2. Standard NIST SP 800-172A Rev. 3 – Assessing Enhanced Security Requirements for CUI (PDF)
3. Standard NIST SP 800-172, February 2021 (withdrawn by NIST; used by CMMC Level 3)
4. Law text 32 CFR 170.14 – CMMC Model (Level 3 requirements table)

1. NIST SP 800-171

   SP 800-171 is the baseline set of CUI requirements; SP 800-172 adds enhanced requirements on top of it for high-value or critical programs.

2. CMMC

   CMMC is DoD's certification program; its Level 3 uses 24 requirements from SP 800-172 (February 2021) and is assessed by DIBCAC.

3. DFARS 252.204-7012

   DFARS 252.204-7012 makes SP 800-171 binding on DoD contractors; SP 800-172 applies only where a contract selects its enhanced requirements.

4. NIST SP 800-53

   SP 800-53 is the federal control catalog; SP 800-172 Rev. 3 aligns its wording with SP 800-53 source controls for nonfederal systems.

Verified against official sources on 18 October 2026. We monitor the official sources for this framework. Watching since 19 September 2026. Subscribe to NIST SP 800-172 (RSS)