Standards guide

NIST SP 800-160: Systems Security Engineering

NIST SP 800-160 is NIST's series on systems security engineering: engineering security into a system across its whole life cycle. Volume 1 Revision 1 (November 2022) is "Engineering Trustworthy Secure Systems". Volume 2 Revision 1 (December 2021) covers cyber-resilient systems. It describes processes and tasks, not a checklist of controls.

This page is a plain-language orientation, not a replacement for the NIST text. It explains the two volumes, the four process groups in Volume 1, how it differs from SP 800-53, and where PlayCISO tools let you practise the thinking. Last reviewed 3 November 2026.

Updated 3 November 2026

The volumes

Volume	Published	What it is for
Vol. 1 Rev. 1: Engineering Trustworthy Secure Systems	November 2022	A basis of principles, concepts, activities and tasks for security engineering that applies to any system regardless of purpose, type, scope, size, complexity or life cycle stage (NIST abstract).
Vol. 2 Rev. 1: Developing Cyber-Resilient Systems	December 2021	Cyber resiliency as an engineering discipline used with systems security engineering. See cyber resilience.

Volume 1 states its intent as advancing systems engineering for "contested operational environments" and serving as a basis for education, training, professional certifications and assessment criteria.

How Volume 1 is organised

Volume 1 builds on the systems engineering life cycle processes and adds the security considerations for each. Its Table 5 groups them into four process groups, with appendices for each. Counting the entries in the table of contents:

Process group	Appendix	Processes listed	Examples
Technical	H	14	Business or mission analysis, system requirements, architecture, design, verification, validation, operation, disposal
Technical management	I	8	Risk management, configuration management, measurement, quality assurance
Organizational project-enabling	J	6	Infrastructure, portfolio, human resource and knowledge management
Agreement	K	2	Acquisition and supply

Before the process appendices, Volume 1 covers system security concepts: assets, loss and loss control, protection needs, and what it means for a system to be adequately secure. Those concepts are the part most security leaders find useful.

SP 800-160 compared with other NIST documents

SP 800-53 is a catalogue of controls you select and assess. SP 800-160 describes the engineering work that decides what to build and how to demonstrate it. Use them together: engineering defines the need, controls provide the safeguards.
NIST CSF 2.0 organises outcomes for managing cybersecurity risk across an organisation. See the NIST CSF tool.
NIST SSDF is a set of secure software development practices. Practise with the SSDF self-assessment and the secure SDLC guide.
SP 800-115 covers security testing and assessment, the verification side. See penetration testing explained.

Practise the ideas

List assets and losses. Name what the system protects and what loss would matter. Use the threat model tool.
State protection needs as requirements. Turn each loss into a testable requirement and record trade-offs in a risk register.
Choose an architecture that limits damage. Segmentation, least privilege, safe failure. The cyber resilience guide covers recovery goals.
Verify and validate. Test that the system does what the requirement says, and that the requirement was the right one.
Keep going after release. Operation, maintenance and disposal are part of the life cycle, so security work continues.

Frequently asked questions

What is NIST SP 800-160?

NIST SP 800-160 is a series on systems security engineering: building security into a system through its whole life cycle rather than adding it at the end. Volume 1 Revision 1, "Engineering Trustworthy Secure Systems" (November 2022), sets out principles, concepts, activities and tasks. Volume 2 Revision 1, "Developing Cyber-Resilient Systems" (December 2021), applies the approach to systems that must survive attacks.

What is systems security engineering?

NIST’s Volume 1 abstract describes it as advancing systems engineering to develop trustworthy systems for contested operational environments. In practice it means treating security as an engineering discipline with requirements, architecture, verification and validation, alongside the other qualities a system needs, from the first idea to disposal.

Is SP 800-160 a control catalogue like SP 800-53?

No. It describes engineering processes, activities and tasks. It does not give a list of controls to tick off. It is meant to inform how you decide what to build and verify, while a control catalogue says what safeguards to select.

What are the volumes of SP 800-160?

Volume 1 Revision 1 (November 2022) covers engineering trustworthy secure systems. Volume 2 Revision 1 (December 2021) covers developing cyber-resilient systems. Check NIST’s publication pages for any further volumes and their status, because the series has changed over time.

Who should read SP 800-160?

Systems and security architects, engineers who design products and platforms, assurance and risk teams, and educators. NIST says the intent is also to serve as a basis for educational and training programmes, professional certifications and assessment criteria. Most security leaders need the ideas rather than every task.

How is it related to secure by design?

Both ask for security to be designed in from the start. SP 800-160 is the older, engineering-focused statement of that idea. Practical software checklists such as the NIST Secure Software Development Framework (SSDF) sit alongside it; our SSDF self-assessment and secure SDLC guide cover the software side.

What does cyber resiliency mean in SP 800-160 Volume 2?

NIST’s glossary, drawing on SP 800-160 Vol. 2 Rev. 1, defines cyber resiliency as the ability to anticipate, withstand, recover from and adapt to adverse conditions, stresses, attacks or compromises on systems that use cyber resources. Our cyber resilience guide explains the practical side.

Do I have to comply with SP 800-160?

It is guidance, not a certification scheme. US federal systems and contractors may be pointed to it through other requirements, and some programmes cite it in contracts. Check which of your obligations name it before treating it as mandatory.