Watch the Deep Dive of this post
Urgent Cybersecurity Updates: What Government Contractors Need to Know About New NIST Guidance
The landscape for government contractors handling sensitive data is rapidly shifting. November 2025 marked a crucial period for new cybersecurity requirements, highlighted by the active rollout of the Cybersecurity Maturity Model Certification (CMMC) Program. Simultaneously, new guidance from the National Institute of Standards and Technology (NIST) signals enhanced security expectations for protecting critical federal information.
CMMC and NIST: A Busy Month for Compliance
The CMMC Program officially went into effect on November 10. Department of Defense (DOD) solicitations are now beginning to incorporate CMMC Program requirements. Contractors who process, store, or transmit Federal Contract Information (FCI) or Controlled Unclassified Information (CUI) in performance of a DOD contract must now adopt substantive security requirements based on the CMMC Level determined for the given work.
Alongside this significant program launch, NIST is seeking public comment on the Final Public Draft of its Special Publication (SP) 800-172r3 (Revision 3). This publication details Enhanced Security Requirements for Protecting Controlled Unclassified Information (CUI). These requirements are specifically designed to safeguard information residing on nonfederal information systems that might be associated with a “high value asset” or “critical program”.
Addressing Advanced Persistent Threats (APTs)
The security controls laid out in SP 800-172 are explicitly intended to guard against Advanced Persistent Threats (APTs). These highly capable, resourceful, and patient cybersecurity threat actors are generally associated with nation-states such as China, Russia, Iran, or North Korea.
The SP 800-172 Revision 3 requirements supplement and must be read in concert with NIST’s SP 800-171 Revision 3, which was updated in June 2024. Furthermore, NIST has also released the Initial Public Draft of the companion assessment publication, SP 800-172A, which provides procedures for organizations to determine if they are properly implementing the SP 800-172 security controls.
Fourteen New Controls Signal Supply Chain Focus
The latest draft of SP 800-172 includes fourteen (14) new controls. These additions address critical areas such as network segmentation, access controls, asset management, and crucial supply chain security practices.
Of particular interest is a new requirement to create and maintain a “centralized repository for the inventory of system components” (03.04.08E). This requirement aligns with broader trends in NIST guidance, including the Cybersecurity Framework, to more comprehensively address the software supply chain, reflecting the growing importance of a Software or Hardware Bill of Materials (SBOM/HBOM).
The public comment period for both SP 800-172 Revision 3 and SP 800-172A has been extended until January 16, 2026.
Planning Ahead for CMMC and Contract Requirements
While the current CMMC Level 3 status requires contractors to implement 24 controls from the older February 2021 version of SP 800-172, Revision 3 will not be immediately incorporated into the CMMC Program when finalized. Any adoption of these newer revisions would require future DOD rulemaking.
Despite the delay in formal CMMC incorporation, contractors should begin planning now for implementing the new proposed SP 800-172 controls. Federal agencies possess the ability to unilaterally choose to implement portions of SP 800-172 controls into selected contracts, grants, or other agreements involving particularly sensitive data. Preparing for these revisions now ensures readiness, regardless of the CMMC rulemaking timeline.
Tags: Cybersecurity, CMMC, NIST, Government Contracts, CUI, Controlled Unclassified Information, SP 800-172, Advanced Persistent Threats, Supply Chain Security, SBOM, HBOM, DOD, marketus