What this requirement asks
Remediate vulnerabilities in accordance with risk assessments.
This is a CMMC Level 2 requirement in the Risk Assessment family, drawn from NIST SP 800-171 Rev. 2. An assessor evaluates it objective by objective — every objective below must be supported by evidence, not just described in a policy.
Assessment objectives (2)
- 3.11.3[a] — vulnerabilities are identified
- 3.11.3[b] — vulnerabilities are remediated in accordance with risk assessments
What an assessor examines
Examine:
- Risk assessment policy
- procedures addressing vulnerability scanning
- risk assessment
- system security plan
- security assessment report
- vulnerability scanning tools and associated configuration documentation
- vulnerability scanning results
- patch and vulnerability management records
- other relevant documents or records
Interview:
- Personnel with risk assessment, security assessment and vulnerability scanning responsibilities
- personnel with vulnerability scan analysis responsibilities
- personnel with vulnerability remediation responsibilities
- personnel with information security responsibilities
- system or network administrators
Test:
- Organizational processes for vulnerability scanning, analysis, remediation, and information sharing
- mechanisms supporting or implementing vulnerability scanning, analysis, remediation, and information sharing
Check your readiness
Score this requirement against your own environment with the Level 2 self-assessment checklist, or estimate your SPRS score with the free CMMC compliance tool. Self-reported answers are planning signals only — they do not establish a verified or assessor-accepted result.