Written and maintained by CASRAI Editorial Board
Last updated
NIST SP 800-160 (also written NIST 800 160) is a series of guidance publications from the US National Institute of Standards and Technology on systems security engineering, the practice of building security into a system through its engineering life cycle. It is guidance, not a funding program or a certification scheme: there is nothing to apply for and no one to register with. The series has two volumes, and each has a current revision. According to the official NIST Computer Security Resource Center pages (checked 2026-10-29), those are Volume 1 Revision 1 (Engineering Trustworthy Secure Systems) and Volume 2 Revision 1 (Developing Cyber-Resilient Systems).
What NIST SP 800-160 is and who publishes it
NIST publishes SP 800-160 through its Computer Security Resource Center (CSRC). Volume 1 Revision 1 was authored by Ron Ross (NIST), Mark Winstead (MITRE) and Michael McEvilley (MITRE). Its abstract describes it as a basis for establishing principles, concepts, activities and tasks for engineering trustworthy secure systems, and says it applies regardless of the system’s purpose, type, scope, size, complexity or stage of its system life cycle. It aims to advance systems engineering for contested operational environments, generally referred to as systems security engineering.
NIST’s systems security engineering project page frames the discipline as contributing a broad-based, holistic security perspective within systems engineering. For research organisations, the publication is relevant background for anyone building or procuring research computing, instruments, data platforms or other systems where security has to be designed in, alongside the compliance topics covered in research security and cybersecurity.
Volume 1 versus Volume 2, and which revision is current
The two volumes address different problems, and both have been revised since first release. Cite the current revision, and note that each revision supersedes the earlier edition.
| Publication | Title | Current final version | Supersedes | DOI |
|---|---|---|---|---|
| SP 800-160 Vol. 1 Rev. 1 | Engineering Trustworthy Secure Systems | November 2022 | SP 800-160 Vol. 1 (2018-03-21) | 10.6028/NIST.SP.800-160v1r1 |
| SP 800-160 Vol. 2 Rev. 1 | Developing Cyber-Resilient Systems: A Systems Security Engineering Approach | 2021-12-09 | SP 800-160 Vol. 2 (2019-11-27) | 10.6028/NIST.SP.800-160v2r1 |
Volume 1: the engineering foundation
Volume 1 Revision 1 is the general-purpose volume. It sets out systems engineering fundamentals, system security concepts and a systems security engineering framework, then supplies life cycle processes in its appendices. Two drafts preceded the 2022 final version.
Volume 2: cyber resiliency
Volume 2 Revision 1 treats cyber resiliency engineering as a specialty discipline used alongside systems security engineering and resilience engineering. Its abstract says organisations adapt the handbook by selecting from goals, objectives, techniques, approaches and design principles, with the aim of systems that can anticipate, withstand, recover from and adapt to adverse conditions.
What Volume 1 Revision 1 contains
The 195-page publication is organised so that readers can find a process by number. The structure below follows the document’s table of contents.
- Chapters 2 to 4: systems engineering fundamentals and trust (Chapter 2), system security concepts (Chapter 3), and the systems security engineering framework with its problem, solution and trustworthiness contexts (Chapter 4).
- Appendices D to F: trustworthy secure design (D), principles for trustworthy secure design (E) and trustworthiness and assurance (F).
- Appendix G: an overview of the life cycle processes.
- Appendix H, technical processes (H.1 to H.14): includes Architecture Definition, Design Definition, System Analysis, Implementation, Integration, Verification, Transition, Validation, Operation, Maintenance and Disposal.
- Appendix I, technical management processes (I.1 to I.8): Project Planning, Assessment and Control, Decision Management, Risk Management, Configuration Management, Information Management, Measurement and Quality Assurance.
- Appendix J (J.1 to J.6) covers organisational project-enabling processes and Appendix K covers agreement processes. Appendix L is the change log.
How to use it: selectively, with any development method
NIST’s own “How to Use” text states the publication is intended as a reference and educational resource for systems engineers, engineering specialties, architects, designers and anyone involved in developing trustworthy secure systems. It also states that there is no expectation that all of the technical content will be used, and that appendices D to F (design, principles, trustworthiness and assurance) and G to K (life cycle processes) can be selectively employed.
The processes are described as working with waterfall, spiral, DevOps, agile and other approaches, and as applicable recursively, iteratively, concurrently, sequentially or in parallel. The publication also says the processes are intended to be tailored. NIST does not describe a certification, registration or approval step for using it; the abstract presents the work as a possible foundation for education, training, certification and assessment criteria, not as a certification itself.
Common mistakes
- Treating it as a checklist. NIST says full use of the technical content is not expected. Citing every process as “implemented” misreads the guidance.
- Citing the superseded edition. The 2018 Volume 1 and the 2019 Volume 2 have been replaced by Revision 1 of each.
- Mixing up the volumes. Volume 1 is the general engineering framework; Volume 2 is the cyber resiliency specialty.
- Assuming a method mandate. The text is described as compatible with agile, DevOps, waterfall and spiral approaches; it does not require a particular one.
- Expecting an application process. There is no eligibility, application or award.
Related NIST publications
The CSRC page for Volume 2 Revision 1 lists these related publications. The table names them; it does not claim a control-by-control mapping.
| Publication | Listed as related to |
|---|---|
| SP 800-160 Vol. 1 Rev. 1 | SP 800-160 Vol. 2 Rev. 1 |
| SP 800-37 (Risk Management Framework) | SP 800-160 Vol. 2 Rev. 1 |
| SP 800-53 | SP 800-160 Vol. 2 Rev. 1 |
| ISO/IEC/IEEE 15288:2015 | SP 800-160 Vol. 2 Rev. 1 |
For other NIST material on CASRAI, see NIST SP 800-171 and the NIST AI Risk Management Framework. For wider context on the engineering discipline behind the guidance, see what is software engineering.
FAQ
What is NIST 800 160?
It is NIST Special Publication 800-160, a two-volume guidance series on systems security engineering. Volume 1 covers engineering trustworthy secure systems and Volume 2 covers cyber-resilient systems.
Which version of NIST SP 800-160 is current?
According to the CSRC pages (checked 2026-10-29), Volume 1 Revision 1 (November 2022) and Volume 2 Revision 1 (final 2021-12-09).
Is NIST SP 800-160 a certification or a grant program?
No. It is guidance. NIST describes it as a reference and educational resource and says not all of its technical content is expected to be used.
Does it require a specific development method?
No. The processes are described as working with waterfall, spiral, DevOps, agile and other approaches.
Sources
- NIST CSRC, SP 800-160 Vol. 1 Rev. 1, Engineering Trustworthy Secure Systems: https://csrc.nist.gov/pubs/sp/800/160/v1/r1/final (checked 2026-10-29).
- NIST CSRC, SP 800-160 Vol. 2 Rev. 1, Developing Cyber-Resilient Systems: https://csrc.nist.gov/pubs/sp/800/160/v2/r1/final (checked 2026-10-29).
- NIST, SP 800-160 Vol. 1 Rev. 1 full text (PDF): https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-160v1r1.pdf (checked 2026-10-29).
- NIST CSRC, Systems Security Engineering project: https://csrc.nist.gov/projects/systems-security-engineering-project (checked 2026-10-29).
