---
title: "NIST 800-171 3.11 Risk Assessment"
description: "The 3 NIST SP 800-171 Risk Assessment requirements (3.11, CMMC RA): text, SPRS points, POA&M rules and evidence."
url: https://policycortex.com/nist-800-171/risk-assessment
sealed: 2026-11-11
amended: 2026-11-11
register: nist-800-171/risk-assessment
records: 4
digest: sha3:f37b0f14dc64ecb08d3823018bb766794dbaf6d6147621ce258d4342267306f1
---

# NIST 800-171 3.11 Risk Assessment

NIST 800-171 / Risk Assessment

Risk Assessment asks for periodic risk assessments of the systems that handle CUI, vulnerability scanning on a schedule and when new flaws are announced, and remediation of what the scans find in order of risk.

3 requirements · up to 9 SPRS points · 1 can go on a CMMC POA&M

## The 3 Risk Assessment requirements

| Requirement | CMMC practice | SPRS points | Requirement text |
|---|---|---|---|
| [3.11.1 Risk Assessment](https://policycortex.com/nist-800-171/risk-assessment/3.11.1) | RA.L2-3.11.1 | 3 points | Periodically assess the risk to organizational operations (including mission, functions, image, or reputation), organizational assets, and individuals, resulting from the operation of organizational systems and the associated processing, storage, or transmission of CUI. |
| [3.11.2 Vulnerability Scanning](https://policycortex.com/nist-800-171/risk-assessment/3.11.2) | RA.L2-3.11.2 | 5 points | Scan for vulnerabilities in organizational systems and applications periodically and when new vulnerabilities affecting those systems and applications are identified. |
| [3.11.3 Fixing Vulnerabilities](https://policycortex.com/nist-800-171/risk-assessment/3.11.3) | RA.L2-3.11.3 | 1 point | Remediate vulnerabilities in accordance with risk assessments. |

## Risk Assessment: points and the CMMC POA&M

**Q: How many SPRS points can the Risk Assessment family cost?**
A: Up to 9 of the 313 points a score can lose: 1 worth 5 points, 1 worth 3 and 1 worth 1.

**Q: Which Risk Assessment requirements can go on a CMMC POA&M?**
A: 1 of the 3: 3.11.3, worth 1 point. The others are worth more than 1 point, which 32 CFR 170.21(a)(2)(ii) does not admit. The score must also be at least 88.

## Related pages

- **Calculator**: [SPRS score calculator: mark the Risk Assessment requirements and see what they cost.](https://policycortex.com/sprs-score-calculator#family-RA)
- **Sample package**: [Sample package: an SSP, a POA&M and an evidence chain the product generated from demonstration data.](https://policycortex.com/sample-package)
- **Previous family**: [3.10 Physical Protection](https://policycortex.com/nist-800-171/physical-protection)
- **Next family**: [3.12 Security Assessment](https://policycortex.com/nist-800-171/security-assessment)
- **All requirements**: [All 110 NIST SP 800-171 requirements, by family.](https://policycortex.com/nist-800-171)

Know the family. Keep the evidence for every requirement in it. [Request Access](https://app.policycortex.com/auth?mode=request-access) · [Book a call](https://policycortex.com/book)

## Register colophon

| Seq | Label | SHA3-256 | Prev |
|---|---|---|---|
| REC 0000 | FAMILY | ff0891c9c236 | 8dd06a1da638 |
| REC 0001 | REQUIREMENTS | b7c1d7dc7622 | ff0891c9c236 |
| REC 0002 | POINTS AND POA&M | 0f4f65df6d2b | b7c1d7dc7622 |
| REC 0003 | RELATED | f37b0f14dc64 | 0f4f65df6d2b |

Head sha3:f37b0f14dc64ecb08d3823018bb766794dbaf6d6147621ce258d4342267306f1. Each digest is SHA3-256 over the previous digest, the register key, the record label, and the record copy; a second party can recompute it from this document.