Framework · NIST SP 800-223
The reference architecture NIST published for high-performance computing: four function zones, a threat analysis that follows them, and a scope set deliberately narrow. What the publication says, what it does not say about your control framework, and how to put it on a running cluster.
High-Performance Computing Security: Architecture, Threat Analysis, and Security Posture
The four function zones
One system boundary. Four different security problems inside it.
The publication
NIST Special Publication 800-223 is titled High-Performance Computing Security: Architecture, Threat Analysis, and Security Posture. It went out as a public draft on 6 February 2023 and was published as final on 9 February 2024.
It answers a question supercomputing had been answering site by site for decades: what, exactly, is the thing being secured? A cluster is a login plane, a management plane, compute nodes on a high-speed fabric, and parallel storage measured in petabytes, each with its own exposure and its own tolerance for the controls you would otherwise apply everywhere.
SP 800-223 supplies the picture. It divides an HPC system into four function zones, walks the components inside each one, works through the threats zone by zone, and closes on security posture recommendations. What it deliberately does not supply is a control list. Its introduction says so in plain words: the publication “is intended to be a conceptual guide, not a checklist of requirements.”
Who it binds is easy to get wrong in both directions. SP 800-223 was developed under NIST’s FISMA authority, which covers minimum requirements for federal information systems, and the same front matter states that it “may be used by nongovernmental organizations on a voluntary basis.” Federal statutory basis, explicit voluntary path for everyone else.
The author list says where it came from: NIST staff alongside contributors from Los Alamos, Sandia, Oak Ridge, MIT Lincoln Laboratory, the Laboratory for Physical Sciences, the DoD HPCMP, Amazon, and the universities of Alabama, Florida and South Carolina. People who operate these machines put their names on it.
The record
The reference architecture
The core move in SP 800-223 is to stop treating a cluster as one system. It divides an HPC system into four function zones, and the division earns its keep because each zone has a different exposure, a different job, and a different set of controls that survives contact with it.
Scroll the diagram to see the whole machine
Nodes connected to external networks, such as the broader organizational network or the internet. This zone authenticates and authorizes the access and connections of users and administrators. Its components are login nodes, data transfer nodes and web portal nodes, and the publication notes that a Science DMZ is often used for the data transfer nodes rather than a pass-through firewall, because of the performance cost.
Management nodes and cloud service clusters through which administrators configure and manage the system. It carries a separate security posture, reached by bastion host or VPN, on networks not routed beyond the perimeter. It holds the scheduler and workflow management, named as Slurm and Kubernetes, and the basic services: DNS, DHCP, LDAP, NTP, log management and version-controlled repositories.
A pool of compute nodes connected by one or more high-speed networks, running parallel jobs at scale. Nodes carry CPUs, memory, disk and network interfaces, and often GPUs or other accelerators. The named interconnects are InfiniBand, Omni-Path, Slingshot and Ethernet, and a separate non-HPC cluster internal network links the zone back to management and access.
High-speed parallel file systems holding user data, built for very large data sets and fast reading and writing, with capacity the publication describes as often measured in petabytes and reaching up to exabytes. Lustre, GPFS and IBM Spectrum Scale are named. Alongside them: campaign storage with retention measured in years, archival storage measured in decades, and burst buffers.
Two notes worth having
Three variants sit in Appendix A rather than the core four-zone model: diskless booting, virtualized and containerized environments, and cloud HPC, where the publication takes up the shared responsibility model with the cloud provider. Extensions, not a fifth zone.
SP 800-223 writes the zone names in lower case in running prose. SP 800-234 capitalizes them and adds a short form, Computing Zone. Either register is defensible; mixing them inside one document is what causes the confusion.
Section 3
Section 3 comes in three parts: what makes HPC different, what threatens each zone, and what threatens the machine regardless of zone. Thirteen named items, listed here as the publication names them.
Before naming a single threat, the publication names the conditions that make HPC security its own discipline.
One subsection each, in this order. This is where the architecture pays: a threat is attributed to a place rather than to the cluster in general.
Threats that do not belong to any one zone, including one that is a direct consequence of how these machines are designed.
Section 4 sits outside the threat analysis and is where the publication gets closest to telling you what to do. Six subsections, every one a recommendation.
The relationship question
Most people arrive at SP 800-223 already holding a control list from somewhere else: an SP 800-53 baseline, an SP 800-171 obligation attached to controlled unclassified information, an ISO 27001 certificate, or a contract that names CMMC. How SP 800-223 relates to any of them is narrower than most summaries suggest, so it is worth stating exactly.
SP 800-223 does not reference the NIST control catalog anywhere in its text. The relationship people assume between the two is real, but it lives in a different publication: SP 800-234, the HPC security overlay, which builds on SP 800-53 and cites SP 800-223 for the architecture. SP 800-223 was final more than two years earlier and does not cite it back.
The single reference sits inside the data storage zone threats, where the publication notes that data on an HPC system may include personally identifiable information, patient health information or controlled unclassified information, and may require compliance with standards such as HIPAA and NIST SP 800-171. A compliance-context aside, not a structural relationship.
SP 800-223 says nothing about contractual assessment regimes, and it is not the kind of document that would. That is the useful point: whatever obligation brought you here, SP 800-223 is not the thing that satisfies it. It is the thing that tells you where it lands.
What to take from this
Use SP 800-223 to describe the machine, and a control framework to state the requirements.
Where it earns its place is in the answers: asked how you segment, who administers the host, where the regulated data sits and what is allowed to leave, the four zones let you answer with boundaries instead of one undifferentiated system.
Architecture and overlay
SP 800-223 describes the machine. SP 800-234 tailors controls for it. Two halves of one answer, published more than two years apart, and read in that order for a reason.
The counting is worth getting right, because it is stated wrongly almost everywhere. The overlay’s table lists 288 controls: 287 carried over from the SP 800-53B moderate baseline, plus one control that is not in that baseline and was added for HPC, AC-10, Concurrent Session Control. Of those 288, exactly 60 carry tailoring in the form of supplemental guidance, added discussion, or both. AC-10 is one of the 60.
The tailoring is applied at five levels: the entire HPC system, which the overlay calls All Zones, then the Access Zone, the Management Zone, the Computing Zone and the Data Storage Zone individually. The overlay’s zones are SP 800-223’s zones: SP 800-234 reproduces the reference architecture, credits it, and points back to it for how connections between zones are defined. Which is why tailoring for the Computing Zone only means something once you know what that zone holds.
NIST SP 800-234, explainedHow the 60 are organized
Not by control family. SP 800-234 groups them thematically, into 14 groups.
Putting it on a real cluster
A reference architecture is not a project plan. The distance between reading SP 800-223 and having a cluster whose boundaries match it is the work, and it has to be done without taking the throughput the machine exists to deliver. Alvor runs that across four tracks.
Most running clusters are a partial match: a flat management network, data transfer nodes nobody segmented, static keys that travelled between sites. We walk the four zones on the machine itself, benchmark the workloads that matter, and hand back a threat model and a ranked gap register.
Explore AssessThe zone boundaries, the identity model, the scheduler isolation, and an enclave for regulated work, with every control placed against what it costs on the critical path.
Explore ArchitectThroughput is a release gate. A control ships when the benchmark confirms the science still runs as fast, and nothing is marked done on a closed ticket alone.
Explore BuildAllocations turn over and nodes get added. Monitoring stays jitter-aware and out of band, benchmarks are re-run on a schedule, and the zone boundaries are re-tested so the posture does not drift.
Explore OperateFrequently asked
Sources: NIST SP 800-223, final 9 February 2024, and NIST SP 800-234, final 4 May 2026, both read in full. Publication dates from the document history on the NIST Computer Security Resource Center.
Further reading
AI teams inside ordinary companies now run HPC-class machines holding models and training data. Why the enterprise security stack misses them, and how the NIST SP 800-223 zone architecture applies.
How research computing centres meet NIST SP 800-171 and CMMC obligations for controlled unclassified information on shared clusters: the enclave pattern, scoping, and the SP 800-223 zones it builds on.
Ten enterprise controls, from EDR to change control, and what happens to each on a supercomputer: why it breaks, and the HPC-native control that replaces it, mapped to NIST SP 800-223 and SP 800-234.
A national-scale system, a campus research cluster, or a GPU estate that arrived as an AI project. Tell us what it runs and what it has to protect, and we scope the work in writing before anyone touches a node.