---
title: "NIST 800-171 3.12 Security Assessment"
description: "The 4 NIST SP 800-171 Security Assessment requirements (3.12, CMMC CA): text, SPRS points, POA&M rules and evidence."
url: https://policycortex.com/nist-800-171/security-assessment
sealed: 2026-11-11
amended: 2026-11-11
register: nist-800-171/security-assessment
records: 4
digest: sha3:33d9b7d9ef6fa2f02e1ec8f153516ec5e469f7d638bd0c96974b25c0970c6c46
---

# NIST 800-171 3.12 Security Assessment

NIST 800-171 / Security Assessment

Security Assessment covers checking that controls work, plans of action for those that do not, ongoing monitoring, and the system security plan that describes the whole system. Without a system security plan an assessment cannot be completed.

4 requirements · up to 13 SPRS points · 0 can go on a CMMC POA&M

## The 4 Security Assessment requirements

| Requirement | CMMC practice | SPRS points | Requirement text |
|---|---|---|---|
| [3.12.1 Control Assessment](https://policycortex.com/nist-800-171/security-assessment/3.12.1) | CA.L2-3.12.1 | 5 points | Periodically assess the security controls in organizational systems to determine if the controls are effective in their application. |
| [3.12.2 Plans of Action](https://policycortex.com/nist-800-171/security-assessment/3.12.2) | CA.L2-3.12.2 | 3 points | Develop and implement plans of action designed to correct deficiencies and reduce or eliminate vulnerabilities in organizational systems. |
| [3.12.3 Ongoing Monitoring](https://policycortex.com/nist-800-171/security-assessment/3.12.3) | CA.L2-3.12.3 | 5 points | Monitor security controls on an ongoing basis to ensure the continued effectiveness of the controls. |
| [3.12.4 System Security Plan](https://policycortex.com/nist-800-171/security-assessment/3.12.4) | CA.L2-3.12.4 | No point value | Develop, document, and periodically update system security plans that describe system boundaries, system environments of operation, how security requirements are implemented, and the relationships with or connections to other systems. |

## Security Assessment: points and the CMMC POA&M

**Q: How many SPRS points can the Security Assessment family cost?**
A: Up to 13 of the 313 points a score can lose: 2 worth 5 points and 1 worth 3. 3.12.4 has no value of its own, but without it no score is produced.

**Q: Which Security Assessment requirements can go on a CMMC POA&M?**
A: None of them. 32 CFR 170.21(a)(2)(ii) admits only requirements worth 1 point. 3.12.4 is never allowed, whatever the value (32 CFR 170.21(a)(2)(iii)). The others are worth more than 1 point.

## Related pages

- **Calculator**: [SPRS score calculator: mark the Security Assessment requirements and see what they cost.](https://policycortex.com/sprs-score-calculator#family-CA)
- **Sample package**: [Sample package: an SSP, a POA&M and an evidence chain the product generated from demonstration data.](https://policycortex.com/sample-package)
- **Previous family**: [3.11 Risk Assessment](https://policycortex.com/nist-800-171/risk-assessment)
- **Next family**: [3.13 System and Communications Protection](https://policycortex.com/nist-800-171/system-and-communications-protection)
- **All requirements**: [All 110 NIST SP 800-171 requirements, by family.](https://policycortex.com/nist-800-171)

Know the family. Keep the evidence for every requirement in it. [Request Access](https://app.policycortex.com/auth?mode=request-access) · [Book a call](https://policycortex.com/book)

## Register colophon

| Seq | Label | SHA3-256 | Prev |
|---|---|---|---|
| REC 0000 | FAMILY | 7974159cc7be | 2e24faec451a |
| REC 0001 | REQUIREMENTS | fa8de132b902 | 7974159cc7be |
| REC 0002 | POINTS AND POA&M | b61a86c5c1e2 | fa8de132b902 |
| REC 0003 | RELATED | 33d9b7d9ef6f | b61a86c5c1e2 |

Head sha3:33d9b7d9ef6fa2f02e1ec8f153516ec5e469f7d638bd0c96974b25c0970c6c46. Each digest is SHA3-256 over the previous digest, the register key, the record label, and the record copy; a second party can recompute it from this document.