NIST Special Publication (SP) 800-172 provides federal agencies with a set of enhanced security requirements for protecting the confidentiality, integrity, and availability of controlled unclassified information (CUI) in nonfederal systems and organizations from the advanced persistent threat when the CUI is associated with a critical program or high value asset. The APT is an adversary that possesses sophisticated levels of expertise and significant resources that allow it to achieve its objectives by using both cyber and physical attack vectors. The objectives of the APT include establishing and extending footholds within the infrastructure of the targeted organization for the purposes of exfiltrating information; undermining or impeding critical aspects of a mission, program, or organization; or positioning itself to carry out these objectives in the future. The APT pursues its objectives repeatedly over an extended period, adapts to defenders’ efforts to resist it, and is determined to maintain the level of interaction needed to execute its objectives.

The enhanced security requirements provide the foundation for a multidimensional, defense-in-depth protection strategy through (1) penetration-resistant architecture, (2) damage-limiting operations, and (3) designing for cyber resiliency and survivability that support and reinforce one another. This strategy recognizes that, despite the best protection measures implemented by organizations, the APT may find ways to breach primary boundary defenses and deploy malicious code within a defender’s system. When this situation occurs, organizations must have access to additional safeguards and countermeasures to outmaneuver, confuse, deceive, mislead, and impede the adversary—that is, to take away the adversary’s tactical advantage and protect and preserve the organization’s critical programs and high value assets.

The enhanced security requirements, as identified and selected by a federal agency, can be implemented in addition to the basic and derived requirements of NIST SP 800-171 since those requirements are not designed to fully address high-end threats, such as the APT. The enhanced security requirements apply to the components of nonfederal systems that process, store, or transmit CUI or that provide protection for such components when the designated CUI is associated with a critical program or high value asset.

Please direct questions and comments to sec-cert@nist.gov.