What this requirement asks
Periodically assess the risk to organizational operations (including mission, functions, image, or reputation), organizational assets, and individuals, resulting from the operation of organizational systems and the associated processing, storage, or transmission of CUI.
This is a CMMC Level 2 requirement in the Risk Assessment family, drawn from NIST SP 800-171 Rev. 2. An assessor evaluates it objective by objective — every objective below must be supported by evidence, not just described in a policy.
Assessment objectives (2)
- 3.11.1[a] — the frequency to assess risk to organizational operations, organizational assets, and individuals is defined
- 3.11.1[b] — risk to organizational operations, organizational assets, and individuals resulting from the operation of an organizational system that processes, stores, or transmits CUI is assessed with the defined frequency
What an assessor examines
Examine:
- Risk assessment policy
- security planning policy and procedures
- procedures addressing organizational risk assessments
- system security plan
- risk assessment
- risk assessment results
- risk assessment reviews
- risk assessment updates
- other relevant documents or records
Interview:
- Personnel with risk assessment responsibilities
- personnel with information security responsibilities
Test:
- Organizational processes for risk assessment
- mechanisms supporting or for conducting, documenting, reviewing, disseminating, and updating the risk assessment
Evidence that defends it
Upload latest risk assessment and resulting actions
Check your readiness
Score this requirement against your own environment with the Level 2 self-assessment checklist, or estimate your SPRS score with the free CMMC compliance tool. Self-reported answers are planning signals only — they do not establish a verified or assessor-accepted result.