NIST SP 800-172A Rev. 3 (assessing enhanced security requirements for CUI), explained

NIST SP 800-172A Revision 3, "Assessing Enhanced Security Requirements for Controlled Unclassified Information," is the companion assessment-procedures document to SP 800-172 — it tells an assessor how to determine whether the enhanced, advanced-persistent-threat-focused requirements a nonfederal organization implemented are actually in place. Per its own abstract, the publication "provides federal agencies with assessment procedures for the enhanced security requirements in NIST SP 800-172," with procedures "flexible and can be tailored to the needs of federal agencies and assessors," supporting "(1) self-assessments; (2) independent, third-party assessments; or (3) government-sponsored assessments," conducted "with varying degrees of rigor based on federal agency-defined depth and coverage attributes." Authored by Victoria Pillitteri and Ron Ross, Revision 3 was approved by the NIST Editorial Review Board on 2026-04-27 and published in May 2026, superseding the original edition of 15 March 2022.

Built directly on SP 800-171A's model

Section 1.2 of the publication is explicit about its own lineage: Section 2 "mirrors the material included [in] SP 800-171A, Sec. 2, with minor updates to reflect the enhanced security requirements and assessment procedures." That means the same building blocks carry over from our SP 800-171A guide:

• Three assessment methods — examine ("the process of reviewing, studying, inspecting, or analyzing assessment objects"), interview ("the process of holding discussions with individuals or groups about assessment objects"), and test ("the process of exercising assessment objects... under specified conditions to compare actual with expected behavior").
• Four assessment object categories — specifications (documented artifacts), mechanisms (hardware/software/firmware safeguards), activities (protection-related actions involving people), and individuals.
• Depth and coverage attributes, which Section 2.1 says define "the rigor, scope, and level of effort for the assessment as well as the degree of assurance" — for the full basic/focused/comprehensive definitions, the publication points to SP 800-53A, Appendix D rather than redefining them.

Section 2.2 confirms the same lineage for the overall process: "The assessment procedures in this publication are based on and sourced to the assessment procedures in SP 800-53A."

The one real difference: the trailing "E"

Every determination statement in SP 800-172A carries a trailing "E" before its segment separators, marking it as targeting an SP 800-172 enhanced requirement rather than a baseline SP 800-171 one. The publication's own worked example:

03.01.01E Dual Authorization — ASSESSMENT OBJECTIVE: Determine if A.03.01.01E.ODP[01]: privileged commands and/or other actions requiring dual authorization are defined, and A.03.01.01E: dual authorization is enforced for them. REFERENCES — Source Assessment Procedures: AC-03(02).

As with SP 800-171A, organization-defined parameters (ODPs) appear as ODP[nn] in square brackets, and square brackets separately mark where one requirement has been decomposed into several granular determination statements (e.g., A.03.10.03E.a[01] through [04]).

17 families, 103 active procedures

Section 3 groups its procedures into the same 17 families Table 1 of SP 800-172 defines: Access Control, Awareness and Training, Audit and Accountability, Configuration Management, Identification and Authentication, Incident Response, Maintenance, Media Protection, Personnel Security, Physical Protection, Planning, Risk Assessment, Security Assessment and Monitoring, System and Communications Protection, System and Information Integrity, System and Services Acquisition, and Supply Chain Risk Management.

Reading the final PDF directly, exactly 12 requirement identifiers are marked "Withdrawn" and carry no assessment procedure: 03.01.03E, 03.04.01E, 03.09.01E, 03.09.02E, 03.11.04E through 03.11.07E, 03.14.02E, 03.14.03E, 03.14.06E, and 03.14.07E. That matches, identifier for identifier, the 12 withdrawn requirements our SP 800-172 guide found by counting SP 800-172's own requirement table — leaving active assessment procedures for the same 103 enhanced requirements currently in force.

Findings and the assurance case

Applying a procedure produces one of two findings (Section 2.1): satisfied, where "the assessment objective has been met, producing a fully acceptable result," or other than satisfied, covering either a genuine anomaly needing remediation or a case where "the assessor was unable to obtain sufficient information to make the specific determination called for." Section 2.2 frames this evidence as part of a broader assurance case — "a body of evidence organized into an argument demonstrating" compliance — that can combine the publication's own system-level procedures with independent third-party product assessments. The publication specifically cites Common Criteria Testing Laboratories evaluating products under ISO/IEC 15408 and Cryptographic Module Validation Program testing laboratories evaluating modules under FIPS 140 as examples of assessments that can feed into the same assurance case.

What changed from the 2022 edition

Appendix F's change log lists four changes from the original 15 March 2022 edition: restructuring the assessment procedure syntax to align with SP 800-53A, adding assessment procedures for the new and revised requirements introduced in SP 800-172 Revision 3, adding a references section naming each procedure's source SP 800-53A control, and a one-time version-number change to stay aligned with SP 800-172 Revision 3's own numbering.

A workable starting point

1. Only build to this after SP 800-172 itself applies. Like its parent publication, SP 800-172A only matters once a federal agency has designated specific CUI as tied to a critical program or high-value asset and conveyed a selected requirement subset in a contract.
2. Reuse SP 800-171A assessment skills directly. The methodology, object categories, and depth/coverage model are unchanged — the only new habit to build is reading the trailing "E" correctly and following each procedure's REFERENCES line back to its SP 800-53A source control.
3. Decide which assessment type fits before planning. Self-assessment, independent third-party assessment, and government-sponsored assessment are explicitly presented as equally valid starting points — the right choice depends on who needs to rely on the resulting assurance case.
4. Don't treat the full object list as a checklist. As with SP 800-53A and SP 800-171A, the broad list of potential methods and objects for a procedure "does not necessarily reflect and should not be directly associated with actual compliance or noncompliance" on its own.
5. Track SP 800-172 and SP 800-172A as a pair. Both were revised to Rev. 3 together in May 2026; confirm any CMMC or contract reference points to the revision you expect before relying on a specific procedure.

SoftWSP's firmware and device security assessments can produce the examine/interview/test-style evidence — traceable to a determination statement and its SP 800-53A source control — that an SP 800-172A-style assessment of critical-program or high-value-asset CUI expects: see Device & Firmware Security.

This guide summarises NIST SP 800-172A Revision 3 (May 2026) and the related SP 800-172/SP 800-53A publication pages; it is not a substitute for the full text and does not constitute compliance or legal advice.