How many SPRS points can the Security Assessment family cost?

Up to 13 of the 313 points a score can lose: 2 worth 5 points and 1 worth 3. 3.12.4 has no value of its own, but without it no score is produced.

Which Security Assessment requirements can go on a CMMC POA&M?

None of them. 32 CFR 170.21(a)(2)(ii) admits only requirements worth 1 point. 3.12.4 is never allowed, whatever the value (32 CFR 170.21(a)(2)(iii)). The others are worth more than 1 point.

NIST 800-171 3.12 Security Assessment

Security Assessment covers checking that controls work, plans of action for those that do not, ongoing monitoring, and the system security plan that describes the whole system. Without a system security plan an assessment cannot be completed.

4 requirementsup to 13 SPRS points0 can go on a CMMC POA&MPublished 2026-11-11

The 4 Security Assessment requirements

3.12.1 Control AssessmentCA.L2-3.12.1Periodically assess the security controls in organizational systems to determine if the controls are effective in their application.5 points
3.12.2 Plans of ActionCA.L2-3.12.2Develop and implement plans of action designed to correct deficiencies and reduce or eliminate vulnerabilities in organizational systems.3 points
3.12.3 Ongoing MonitoringCA.L2-3.12.3Monitor security controls on an ongoing basis to ensure the continued effectiveness of the controls.5 points
3.12.4 System Security PlanCA.L2-3.12.4Develop, document, and periodically update system security plans that describe system boundaries, system environments of operation, how security requirements are implemented, and the relationships with or connections to other systems.No point value

Security Assessment: points and the CMMC POA&M

Q-01
How many SPRS points can the Security Assessment family cost?
Up to 13 of the 313 points a score can lose: 2 worth 5 points and 1 worth 3. 3.12.4 has no value of its own, but without it no score is produced.
Q-02
Which Security Assessment requirements can go on a CMMC POA&M?
None of them. 32 CFR 170.21(a)(2)(ii) admits only requirements worth 1 point. 3.12.4 is never allowed, whatever the value (32 CFR 170.21(a)(2)(iii)). The others are worth more than 1 point.

Related pages

Calculator: SPRS score calculator: mark the Security Assessment requirements and see what they cost.
Sample package: Sample package: an SSP, a POA&M and an evidence chain the product generated from demonstration data.
Previous family: 3.11 Risk Assessment
Next family: 3.13 System and Communications Protection
All requirements: All 110 NIST SP 800-171 requirements, by family.

Related records

Guides and articles describe the work. The evidence that work produces is described in three proof pages, the architecture page, and the two pages on authorization.

proof.state: Proof of State. What the environment was, as of a date someone else picks: point-in-time records, content hashed and chained.
proof.change: Proof of Change. Who or what altered the environment, under what authority, with before and after state hashes.
proof.agency: Proof of Agency. What a machine was permitted to do before it acted, what it did, and what would have stopped it.
architecture: Architecture. How the chain is built and where the evidence is stored in each delivery mode.
authorization: Continuous ATO. How an authorizing official's decision is recorded with its package, and how the authorized system is checked against it every hour.
baseline: NIST SP 800-53. The Low, Moderate and High baselines as evidence, with the SSP, SAR and POA&M generated from one record.