NIST 800-172 Revision 3 Expands CUI Requirements, and Most Businesses Lack the Infrastructure

NIST 800-172 Revision 3, published on May 13, 2026, expands the enhanced security requirements for Controlled Unclassified Information into network segmentation, asset management and supply chain security. Those requirements describe how systems are built and run, so a policy binder cannot satisfy them. Most small contractors will need different infrastructure, not more paperwork, if an agency writes these requirements into a contract.

What changed in NIST 800-172 Revision 3

The National Institute of Standards and Technology announced on May 13, 2026 that the final revision expands requirements covering access controls, network segmentation, asset management and supply chain security. It adds mappings to the protection strategies in NIST SP 800-160, restructures the document to match NIST SP 800-171 Revision 3, and ships a matching assessment guide, SP 800-172A Revision 3. NIST also released the requirements and assessment procedures as machine-readable data, so they can be loaded into tools rather than copied out of a PDF.

The publication page describes the purpose plainly: it is a supplement to NIST SP 800-171, written to protect against advanced persistent threats, and it applies to CUI tied to critical programs and high value assets. NIST also says there is no expectation that agencies will select every enhanced requirement. Agencies pick the ones that fit a program and write them into the contract.

How NIST 800-172 relates to CMMC

Under 32 CFR 170.14, CMMC Level 2 requirements are identical to NIST SP 800-171 Revision 2, and Level 3 requirements are selected from the February 2021 edition of the enhanced requirements. The new revision does not change the CMMC rule by itself. It does show where agencies are heading, and an agency can name the newer requirements in an individual contract.

The publications stack on each other. This is how they fit together as of November 2026:

• NIST SP 800-53 Revision 5: the federal control catalog the others draw their source controls from
  • NIST SP 800-171 Revision 3 (May 2024): the baseline for protecting CUI in contractor systems
    • NIST SP 800-172 Revision 3 (May 2026): enhanced requirements an agency selects for CUI on critical programs
  • CMMC under 32 CFR part 170, still on the older editions
    • Level 2: NIST SP 800-171 Revision 2
    • Level 3: requirements selected from NIST SP 800-172, February 2021

What a CMMC Level 3 assessment adds

Level 3 is where the enhanced requirements already bite. Under 32 CFR 170.18, government assessors perform the Level 3 assessment every three years, and a current Level 2 certification is a prerequisite. The plan-of-action rules in 32 CFR 170.21 name the requirements that can never be deferred at Level 3, and they read like an infrastructure list: a security operations center, a cyber incident response team, threat-informed risk assessment, a supply chain risk plan and response, and specialized asset security. You either run those or you do not pass.

Three areas of NIST 800-172 that need live infrastructure

The revision covers a lot of ground. Three areas stand out because no document can meet them.

Segmentation that holds after a break in

Segmentation here means architectural separation between the systems that handle CUI and everything else. A VLAN label or a firewall rule from three years ago does not count. The test is whether an attacker who gets one account can reach the rest of the network. On a flat network the answer is yes, and that is the common case in small firms.

Supply chain and asset records that stay current

Asset management and supply chain security push past a component list produced once at release time. The intent is a current, central record of what is running and where it came from, checked whenever something changes. A software bill of materials filed in a drawer does not stop a compromised dependency from running in your environment.

Systems designed to keep working under attack

NIST 800-172 is written for advanced persistent threats, which means it assumes a capable adversary may already be inside. The mapping to NIST SP 800-160 resiliency strategies points the same way: detect the compromise, limit how far it spreads, and recover without losing data integrity. That is a design decision made when infrastructure is built, not a setting changed later.

The gap was already there

Defense contractors have owed NIST SP 800-171 under DFARS 252.204-7012 since the end of 2017. The enhanced requirements do not create a new gap so much as measure an old one. Firms that never segmented their networks, never kept a live asset inventory and never practiced recovery will find the enhanced requirements land on top of unfinished work.

Claiming compliance you cannot show has a price. The Department of Justice announced in March 2025 that defense contractor MORSECORP agreed to pay $4.6 million to resolve False Claims Act allegations that it failed to meet the cybersecurity requirements in its Army and Air Force contracts, including a self-reported score that an outside consultant found was far too high.

The timeline also moved. In July 2026 the Pentagon suspended the CMMC Phase II requirements and opened a review of the program, Breaking Defense reported, and a class deviation signed September 3, 2026 limits contracts to CMMC self-assessments while still requiring baseline compliance with NIST SP 800-171 Revision 2. Since this note was written, Federal News Network reported on October 27, 2026 that implementing NIST 800-171 Revision 3 has been on hold at the department, and that finalizing that move is one of the reform task force's recommendations. Self-assessment against NIST SP 800-171 still applies, and agencies can still put enhanced requirements into contracts.

Build it, or run on something built for it

Building segmented, monitored, recoverable infrastructure from scratch is slow and expensive for a small contractor. The alternative is to keep CUI in a small, dedicated environment designed with these requirements as the baseline, run by people whose job is to keep it that way.

LTFI brings the same habits to the rest of the business: Kief Studio runs it on a dedicated server for each company, patched and watched by us, with an activity log of every action. It runs your operations, not your CUI enclave. If you are weighing whether your current setup can carry these requirements, read our note on CMMC readiness, see what LTFI does, or book a walkthrough.

Frequently asked questions