What is NIST SP 800-160?
NIST SP 800-160 engineering guidance establishes principles, concepts, activities, and tasks for building trustworthy secure systems through systems security engineering. The current Volume 1 Revision 1, Engineering Trustworthy Secure Systems, was published in November 2022. It treats security as an engineered system property shaped throughout the life cycle rather than as a collection of controls added after design.
The publication draws on multidisciplinary systems engineering and applies across system purposes, types, sizes, and complexity levels. It addresses stakeholder protection needs, requirements, architecture, design, verification, validation, assurance, resilience, and trade-offs. It complements control catalogs such as NIST SP 800-53 but does not replace them, prescribe one development method, or create a certification.
What is NIST SP 800-160 used for?
Organizations use the publication to integrate security into concept development, requirements analysis, architecture, implementation, integration, operation, maintenance, and disposal. It helps engineering and security teams establish traceability from mission and business needs to security requirements, design evidence, verification criteria, and accepted residual risk.
For leaders, NIST SP 800-160 supports design reviews, acquisition decisions, supplier expectations, mission assurance, and resilience planning for complex or high-consequence systems. Effective use depends on defined engineering governance, cross-functional ownership, evidence expectations, and explicit treatment of cost, performance, schedule, safety, privacy, and operational constraints.
