What this requirement asks
Scan for vulnerabilities in organizational systems and applications periodically and when new vulnerabilities affecting those systems and applications are identified.
This is a CMMC Level 2 requirement in the Risk Assessment family, drawn from NIST SP 800-171 Rev. 2. An assessor evaluates it objective by objective — every objective below must be supported by evidence, not just described in a policy.
Assessment objectives (5)
- 3.11.2[a] — the frequency to scan for vulnerabilities in organizational systems and applications is defined
- 3.11.2[b] — vulnerability scans are performed on organizational systems with the defined frequency
- 3.11.2[c] — vulnerability scans are performed on applications with the defined frequency
- 3.11.2[d] — vulnerability scans are performed on organizational systems when new vulnerabilities are identified
- 3.11.2[e] — vulnerability scans are performed on applications when new vulnerabilities are identified
What an assessor examines
Examine:
- Risk assessment policy
- procedures addressing vulnerability scanning
- risk assessment
- system security plan
- security assessment report
- vulnerability scanning tools and associated configuration documentation
- vulnerability scanning results
- patch and vulnerability management records
- other relevant documents or records
Interview:
- Personnel with risk assessment, security assessment and vulnerability scanning responsibilities
- personnel with vulnerability scan analysis and remediation responsibilities
- personnel with information security responsibilities
- system or network administrators
Test:
- Organizational processes for vulnerability scanning, analysis, remediation, and information sharing
- mechanisms supporting or implementing vulnerability scanning, analysis, remediation, and information sharing
Evidence that defends it
Show scan cadence, results, remediation closure
Check your readiness
Score this requirement against your own environment with the Level 2 self-assessment checklist, or estimate your SPRS score with the free CMMC compliance tool. Self-reported answers are planning signals only — they do not establish a verified or assessor-accepted result.