How is Athena different from Secureframe, Strike Graph, Paramify, Risk Cognizance, SMPL-C, or Kiteworks?

Those platforms optimize the contractor's readiness workflow — live SPRS tracking, AI controls dashboards, fast SSP/POA&M drafting, continuous control monitoring, LLM document analysis, or CUI data movement. Athena adds the assessor-facing submission layer that almost none of them ship: SAR narrative drafting, eMASS-ready JSON packaging, OSCAL output, and cryptographic provenance (SHA-256 + chain-of-custody) for every artifact a C3PAO or DIBCAC assessor opens on engagement day.

Does Athena replace Secureframe, Strike Graph, or Paramify?

No — Athena is the assessor-side submission layer that sits on top of whatever readiness GRC you already use. Bring evidence from any tool; Athena drafts the SAR, generates the POA&M with prioritized remediation, scores SPRS, and exports eMASS / OSCAL packages with provenance.

What does Athena export for a CMMC Level 2 assessment?

SAR draft with citations, POA&M with milestone estimates, SPRS scoring package, eMASS-ready JSON, OSCAL package, evidence binder with SHA-256 hashes, and a chain-of-custody manifest signed for the assessor.

How often do I need to run vulnerability scans for CMMC?

3.11.2 doesn't fix a number — you define the frequency in your policy and then meet it, plus scan when significant new vulnerabilities emerge. Monthly authenticated scans are a common, defensible cadence; document whatever you choose and stick to it.

Is vulnerability scanning the same as flaw remediation?

No. 3.11.2 is finding vulnerabilities (scanning). Fixing them in a timely way is flaw remediation (3.14.1). Assessors look for both the scans and evidence that findings get remediated.

CMMC 3.11.2 (Vulnerability Scanning): Evidence Examples & What Assessors Actually Check

Control: NIST SP 800-171 Rev. 2 §3.11.2 · CMMC Practice: RA.L2-3.11.2 · Updated June 2026

Plain-English answer

3.11.2 requires you to scan for vulnerabilities in your systems and applications on a defined frequency, and again when new vulnerabilities affecting them are identified. Three things an assessor checks: you defined a cadence, you actually scan on it (systems and apps), and you scan on new-vulnerability events — not just once a year.

Who this applies to

Every organization seeking CMMC Level 2 for a CUI environment.

Why it matters

You can't fix what you don't find. Scanning is how known vulnerabilities surface before an adversary uses them. It carries a weighted SPRS deduction if unmet (verify the exact value against the DoD Assessment Methodology).

Control lineage

CMMC Practice: RA.L2-3.11.2
NIST 800-171 Rev. 2: §3.11.2 — scan for vulnerabilities in organizational systems and applications periodically and when new vulnerabilities affecting them are identified.
NIST 800-171A objectives: [a] the scan frequency is defined; [b] systems are scanned on that frequency; [c] applications are scanned on that frequency; [d] systems are scanned when new vulnerabilities are identified; [e] applications are scanned when new vulnerabilities are identified.

What the assessor will EXAMINE

The vulnerability-management policy defining scan frequency for systems and applications.
Scan reports over time showing the cadence is met (authenticated scans preferred).
Coverage — that scans hit the in-scope assets, not a subset.
Evidence of event-driven scans when major vulnerabilities emerged.
SSP narrative for 3.11.2.

What the assessor will INTERVIEW & TEST

Interview: "How often do you scan, what's covered, and what triggers an off-cycle scan?" — point to the policy + the scan history.
Test: Review recent scan reports for cadence, coverage, and that they're authenticated (not just unauthenticated network scans).
Test: Confirm a sampled in-scope asset appears in the scan results.

Evidence examples (produce these)

Vulnerability-management policy with defined scan frequency.
A series of dated scan reports (systems and applications) showing the cadence.
Asset coverage proof — scan targets reconciled to your inventory.
An example off-cycle scan tied to a new vulnerability.
SSP section 3.11.2 referencing the above.

Common failure patterns

Scanning happens but no defined frequency is documented — objective [a] fails.
Only unauthenticated scans, which miss most host-level vulnerabilities.
Systems scanned but applications aren't — objectives [c]/[e] fail.
Coverage gaps — assets that never get scanned.

SPRS impact & POA&M

SPRS: 3.11.2 carries a weighted deduction (verify the exact value). POA&M: confirm 3.11.2's POA&M eligibility against current CMMC rules before assuming it can be deferred.

Assessor-ready summary

You're good on 3.11.2 when a scan frequency is defined and met for both systems and applications; scans are authenticated and cover the in-scope inventory; off-cycle scans run on new vulnerabilities; and the SSP matches the practice. (Finding vulnerabilities is only half — remediating them is flaw remediation, 3.14.1.)

Can you show a clean scan history with full coverage? Get a vulnerability-management evidence map →

Athena prepares organizations for CMMC Level 2; certification rests with C3PAOs/DIBCAC. Verify all control facts against NIST SP 800-171 Rev. 2, NIST SP 800-171A, and current CMMC rules.