NIST SP 800-160: systems security engineering, explained
NIST SP 800-160 is a two-volume NIST Special Publication on systems security engineering. Volume 1, "Engineering Trustworthy Secure Systems" (current version Revision 1, published November 2022), states its own purpose as describing "a basis for establishing principles, concepts, activities, and tasks for engineering trustworthy secure systems," meant to be applied "within systems engineering efforts to foster a common mindset to deliver security for any system, regardless of the system's purpose, type, scope, size, complexity, or the stage of its system life cycle." Volume 2, "Developing Cyber-Resilient Systems: A Systems Security Engineering Approach" (current version Revision 1, published December 2021), narrows the focus to cyber resiliency — engineering systems that keep functioning, or degrade gracefully, under attack rather than assuming every attack can be stopped.
Volume 1: security engineering as a discipline, not an afterthought
NIST's own abstract for Volume 1 Revision 1 states the publication's intent is "to advance systems engineering in developing trustworthy systems for contested operational environments (generally referred to as systems security engineering) and to serve as a basis for developing educational and training programs, professional certifications, and other assessment criteria." The framing throughout Volume 1 is deliberately general-purpose: the same principles, concepts, activities and tasks are meant to apply "regardless of the system's purpose, type, scope, size, complexity, or the stage of its system life cycle" — in other words, Volume 1 is not a checklist for one kind of product, but a shared vocabulary and method for building security considerations into any systems-engineering effort from the start, rather than retrofitting them after a design is already fixed.
Volume 2: engineering for resiliency, not just prevention
Volume 2 Revision 1 addresses a narrower and more specific problem: how to "architect, design, develop, implement, maintain, and sustain the trustworthiness of systems" that must keep operating under adversarial conditions. NIST describes the goal as building systems able to "anticipate, withstand, recover from, and adapt to adverse conditions, stresses, attacks, or compromises." Framed in risk-management terms, cyber resiliency engineering aims to "reduce the mission, business, organizational, enterprise, or sector risk of depending on cyber resources" — an acknowledgment that some attacks will succeed regardless of preventive controls, and that systems need to be engineered to survive and recover from that outcome, not just to resist it. NIST positions Volume 2 as complementing Volume 1 and working "alongside other NIST frameworks including the Risk Management Framework (SP 800-37) and Security Controls guidance (SP 800-53)."
How the two volumes and the wider NIST stack fit together
| Publication | Role |
|---|---|
| SP 800-160 Vol. 1 | Principles, concepts, activities and tasks for engineering security into any system's life cycle |
| SP 800-160 Vol. 2 | Specialized companion: engineering systems to anticipate, withstand, recover from and adapt to attacks (cyber resiliency) |
| SP 800-37 (see our guide) | Risk Management Framework — the process for selecting, implementing, assessing and authorizing controls |
| SP 800-53 (see our guide) | The control catalog itself — the "what" that SP 800-37's process selects from |
Read together, SP 800-53 is the catalog of available security and privacy controls, SP 800-37 is the process for choosing and authorizing which controls apply to a given system, and SP 800-160 is the systems-engineering discipline that determines how security requirements — including resiliency requirements — get engineered into a system's architecture and life cycle in the first place, rather than selected and bolted on afterward. For device makers and firmware teams, Volume 1's life-cycle framing is the more directly relevant starting point; Volume 2's resiliency focus becomes relevant once a product's threat model includes the expectation that some compromise will occur and the system needs to keep operating or recover gracefully.
A workable starting point
- Treat Volume 1 as a vocabulary and process, not a product-specific checklist — its value is in making security an engineering discipline applied from initial requirements through disposal, not a separate review step at the end.
- Only reach for Volume 2's resiliency concepts once your threat model assumes some attacks will succeed — resiliency engineering (anticipate/withstand/recover/adapt) is a different design goal from baseline prevention, and conflating the two leads to either over-engineering simple systems or under-engineering systems that genuinely need to survive compromise.
- Use SP 800-160 alongside SP 800-37 and SP 800-53, not instead of them — NIST explicitly frames the three as complementary layers (engineering discipline, risk-management process, control catalog) rather than alternative approaches to the same problem.
SoftWSP's device and firmware security work can help build security engineering into your product's architecture and life cycle from the start, rather than retrofitting it after design decisions are already locked in: see device & firmware security services.
This guide summarises NIST's public CSRC publication pages for SP 800-160 Volumes 1 and 2; it does not constitute legal or compliance advice.
Frequently asked questions
What is NIST SP 800-160?
A two-volume NIST Special Publication on systems security engineering. Volume 1, titled "Engineering Trustworthy Secure Systems," states its own purpose as describing "a basis for establishing principles, concepts, activities, and tasks for engineering trustworthy secure systems," applicable "within systems engineering efforts to foster a common mindset to deliver security for any system, regardless of the system's purpose, type, scope, size, complexity, or the stage of its system life cycle." Volume 2, titled "Developing Cyber-Resilient Systems: A Systems Security Engineering Approach," addresses the narrower discipline of cyber resiliency engineering — building systems able to "anticipate, withstand, recover from, and adapt to adverse conditions, stresses, attacks, or compromises."
What's the difference between Volume 1 and Volume 2?
Volume 1 (current version: Revision 1, published November 2022) is the general-purpose foundation — it sets out principles, concepts, activities and tasks for building security into systems engineering broadly, intended partly "to advance systems engineering in developing trustworthy systems for contested operational environments" and to underpin educational programs, certifications and assessment criteria. Volume 2 (current version: Revision 1, published December 2021) is the specialized companion focused specifically on cyber resiliency: how to architect and sustain systems that keep operating, or degrade gracefully, under adversarial conditions rather than systems security engineering in general.
Why does cyber resiliency need its own volume?
Because resiliency is a distinct engineering goal from baseline security. SP 800-160 Vol. 2 Rev. 1 frames cyber resiliency, from a risk-management perspective, as aiming to "reduce the mission, business, organizational, enterprise, or sector risk of depending on cyber resources" — the assumption is not that every attack can be prevented, but that systems must keep functioning, recover, or adapt when some attacks succeed. That is a different design question from the general security-engineering principles in Volume 1, which is why NIST split it into its own volume rather than folding it in as a chapter.
How does SP 800-160 relate to SP 800-37 and SP 800-53?
NIST positions the three as complementary layers rather than overlapping ones: SP 800-160 Vol. 2 Rev. 1 is described as working "alongside other NIST frameworks including the Risk Management Framework (SP 800-37) and Security Controls guidance (SP 800-53)." In practice, SP 800-53 (see our [guide](/guides/nist-sp-800-53-security-privacy-controls/)) supplies the catalog of security and privacy controls, SP 800-37 (see our [Risk Management Framework guide](/guides/nist-sp-800-37-risk-management-framework/)) supplies the process for selecting, implementing, and authorizing those controls, and SP 800-160 supplies the systems-engineering discipline — how security requirements get engineered into a system's architecture and life cycle in the first place, including resiliency-specific engineering in Volume 2.