NIST SP 800-172: every control, and what you already have

35 controls 23 frameworks share controls with it United States verified against its source document

Every control below is one this framework asks for. The right hand column counts how many other frameworks in our corpus carry the same control, which is the difference between doing this work once and doing it again for the next standard.

NIST SP 800-172 Enhanced CUI Protection Evidence & Implementation Kit

35 controls is the documentation set somebody has to write. This is that set, already written: an adopt-ready artifact for every control in policy and procedure text you edit rather than draft, and the evidence checklist an auditor asks for against each.

See what is in it, $249

The same set every buyer of this kit receives. Nothing here is produced on request.

What you already have

Frameworks whose controls overlap this one, most first. If you run any of them, the count is roughly what you have already evidenced.

If you run	Shared controls
NIST SP 800-161 Rev 1	35	measure it →
NIST SP 800-53 Rev 5	35	measure it →
C5 (Germany)	33	measure it →
Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1	33	measure it →
NIST Cybersecurity Framework 2.0	33	measure it →
PCI DSS 4.0	33	measure it →
FedRAMP High	32	measure it →
FedRAMP Moderate	32	measure it →
NIST SP 800-171 Rev 3	32	measure it →
ISO 27001:2022	31	measure it →
ISO 27002:2022	31	measure it →
NIST SP 800-53 Rev 5 MODERATE	31	measure it →

Every control

Code	Control	Also in
`3.1.1e`	Dual Authorization for Sensitive System Operations	19
`3.1.2e`	Restrict Access to Organization-Owned, Provisioned, or Issued Information Resources	19
`3.1.3e`	Employ Secure Information Transfer Solutions	20
`3.11.1e`	Threat-Aware Risk Assessment	22
`3.11.2e`	Threat Hunting	15
`3.11.3e`	Advanced Automation and Analytics Capabilities	18
`3.11.4e`	Security Solution Rationale Document	18
`3.11.5e`	Assess Effectiveness of Security Solutions	23
`3.11.6e`	Supply Chain Risk Assessment, Response, and Monitoring	20
`3.11.7e`	Supply Chain Risk Management Plan	19
`3.12.1e`	Penetration Testing by Independent Agents	22
`3.13.1e`	Create Diversity in System Components to Limit Malicious Code Propagation	18
`3.13.2e`	Introduce Unpredictability into System Operations	22
`3.13.3e`	Confuse and Mislead Adversaries	8
`3.13.4e`	Physical and Logical Isolation Techniques	7
`3.13.5e`	Distribute and Relocate System Functions or Resources	3
`3.14.1e`	Verify Integrity of Security Critical Software and Firmware	19
`3.14.2e`	Monitor Organizational Systems with Specialized Capabilities	21
`3.14.3e`	Include Systems in Scope of Enhanced Requirements or Segregate into Purpose-Specific Networks	20
`3.14.4e`	Refresh Systems and Components from a Trusted Baseline	19
`3.14.5e`	Review Persistent Storage and Remove CUI No Longer Needed	20
`3.14.6e`	Use Threat Indicator Information for Detection	19
`3.14.7e`	Verify Correctness of Security Functions	19
`3.2.1e`	Provide Awareness Training on Advanced Persistent Threat	22
`3.2.2e`	Practical Exercises in Awareness Training	19
`3.4.1e`	Authoritative Source for Software and Firmware	19
`3.4.2e`	Automated Detection and Remediation of Unauthorized Software	22
`3.4.3e`	Automated Inventory of System Components	19
`3.5.1e`	Identification of Systems, Components, and Devices	20
`3.5.2e`	Password Manager Use	20
`3.5.3e`	Prohibit Connection of Unknown or Unverified System Components	21
`3.6.1e`	Establish Security Operations Center (SOC)	20
`3.6.2e`	Establish and Maintain a Cyber Incident Response Team	22
`3.9.1e`	Enhanced Personnel Screening	18
`3.9.2e`	Insider Threat Program	16

Tell me when NIST SP 800-172 files something new

One email when a public company newly discloses something this framework governs, naming the company and what our corpus says it puts in scope. Nothing else, and one click to stop.

What an auditor will ask you to produce

The artefacts named on the failure modes this framework speaks to.

APT-specific training curriculum
training completion records
phishing simulation results
supply chain attack scenarios used in training
Wolfsberg questionnaires
Respondent AML programme reviews
asset discovery scan logs
CMDB sync reports
reconciliation reports between discovery and CMDB
agent coverage metrics

How programmes fail on this

Failure modes named by this framework and others. Each opens the full record.

no annual refresh named by 5 frameworks
shadow IT not captured named by 4 frameworks
No documented review cadence named by 3 frameworks

What this page is

A control-level reference for NIST SP 800-172, drawn from our framework corpus. Control codes and titles are references to the standard, not reproductions of it. The overlap counts and the auditor artefacts are our own work and are the part you will not find elsewhere.

Measure this against what you already run · All frameworks · Today's edition