NIST 800-171 3.11 Risk Assessment
Risk Assessment asks for periodic risk assessments of the systems that handle CUI, vulnerability scanning on a schedule and when new flaws are announced, and remediation of what the scans find in order of risk.
3 requirementsup to 9 SPRS points1 can go on a CMMC POA&M
The 3 Risk Assessment requirements
- 3.11.1 Risk AssessmentRA.L2-3.11.1Periodically assess the risk to organizational operations (including mission, functions, image, or reputation), organizational assets, and individuals, resulting from the operation of organizational systems and the associated processing, storage, or transmission of CUI.
- 3.11.2 Vulnerability ScanningRA.L2-3.11.2Scan for vulnerabilities in organizational systems and applications periodically and when new vulnerabilities affecting those systems and applications are identified.
- 3.11.3 Fixing VulnerabilitiesRA.L2-3.11.3Remediate vulnerabilities in accordance with risk assessments.
Risk Assessment: points and the CMMC POA&M
- Q-01
How many SPRS points can the Risk Assessment family cost?
Up to 9 of the 313 points a score can lose: 1 worth 5 points, 1 worth 3 and 1 worth 1.
- Q-02
Which Risk Assessment requirements can go on a CMMC POA&M?
1 of the 3: 3.11.3, worth 1 point. The others are worth more than 1 point, which 32 CFR 170.21(a)(2)(ii) does not admit. The score must also be at least 88.
Know the family. Keep the evidence for every requirement in it.
- Published
- Last updated
- Unchanged since publication