NIST Publishes Assessment Procedures for Enhanced Security Controls Used to Protect CUI
Client Alert | 1 min read | 03.18.22
The National Institute of Standards and Technology (NIST) recently published final assessment procedures for the enhanced security controls used to protect particularly sensitive forms of controlled unclassified information (CUI) from sophisticated adversaries. NIST SP 800-172A, Assessing Enhanced Security Requirements for Controlled Unclassified Information, articulates procedures and methods to assess contractor implementation of the 35 enhanced security controls found in NIST SP 800-172, Enhanced Security Requirements for Protecting Controlled Unclassified Information: A Supplement to NIST Special Publication 800-171. The publication can be used to conduct first, second, and third-party assessments with varying degrees of rigor based on the assessor’s desired level of assurance.
The enhanced controls and corresponding assessment procedures are expected to impact contractors handling CUI associated with critical programs and high value assets. The Department of Defense (DoD) also plans to incorporate the requirements from NIST SP 800-172 into Level 3 of the Cybersecurity Maturity Model Certification (CMMC) The assessment procedures and methods in NIST SP 800-172A are expected to inform the government-led assessments needed for DoD contractors to achieve certification at CMMC Level 3.
Insights
Client Alert | 8 min read | 06.30.25
AI Companies Prevail in Path-Breaking Decisions on Fair Use
Last week, artificial intelligence companies won two significant copyright infringement lawsuits brought by copyright holders, marking an important milestone in the development of the law around AI. These decisions – Bartz v. Anthropic and Kadrey v. Meta (decided on June 23 and 25, 2025, respectively), along with a February 2025 decision in Thomson Reuters v. ROSS Intelligence – suggest that AI companies have plausible defenses to the intellectual property claims that have dogged them since generative AI technologies became widely available several years ago. Whether AI companies can, in all cases, successfully assert that their use of copyrighted content is “fair” will depend on their circumstances and further development of the law by the courts and Congress.
Client Alert | 3 min read | 06.30.25
Client Alert | 3 min read | 06.26.25
FDA Targets Gene Editing Clinical Trials in China and other “Hostile Countries”
Client Alert | 3 min read | 06.26.25