NIST Issues Proposed Revision To Cybersecurity Controls And Requirements To Protect Information On Non-Federal Information Systems

On May 10, 2023, the National Institute of Standards and Technology (NIST) released a public draft of Revision 3 to NIST Special Publication (SP) 800-171, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations (Revision 3), which establishes security controls that apply to non-federal information systems that store, process, or transmit controlled unclassified information (CUI) or that provide protection for such components, and only where no other applicable law, regulation, or policy prescribes different or more specific safeguarding requirements. This proposed revision accounts for over a year of data collection and public comments to better align cybersecurity requirements between federal and non-federal information systems to address specific threats to CUI, such as defense information, export-controlled information, health information, personally identifiable information, critical energy infrastructure information, and