Contractors Should Prepare As NIST Finalizes Enhanced Security Requirements For Protecting Controlled Unclassified Information

On May 13, 2026, the National Institute of Standards and Technology (NIST) finalized a revision to Special Publication (SP) 800-172r3 (Revision 3), Enhanced Security Requirements for Protecting Controlled Unclassified Information (CUI), which provides a selection of recommended cybersecurity controls for protecting CUI resident on a nonfederal information system when associated with a “high value asset” or “critical program.” The revised publication highlights the importance of contractors being able to identify CUI and having plans to implement SP 800-172r3 controls even before the revisions are adopted into the Department of War (DOW) Cybersecurity Maturity Model Certification (CMMC) Program.