What this requirement asks
Periodically assess the security controls in organizational systems to determine if the controls are effective in their application.
This is a CMMC Level 2 requirement in the Security Assessment family, drawn from NIST SP 800-171 Rev. 2. An assessor evaluates it objective by objective — every objective below must be supported by evidence, not just described in a policy.
Assessment objectives (2)
- 3.12.1[a] — the frequency of security control assessments is defined
- 3.12.1[b] — security controls are assessed with the defined frequency to determine if the controls are effective in their application
What an assessor examines
Examine:
- Security assessment and authorization policy
- procedures addressing security assessment planning
- procedures addressing security assessments
- security assessment plan
- system security plan
- other relevant documents or records
Interview:
- Personnel with security assessment responsibilities
- personnel with information security responsibilities
Test:
- Mechanisms supporting security assessment, security assessment plan development, and security assessment reporting
Evidence that defends it
Upload internal assessment results
Check your readiness
Score this requirement against your own environment with the Level 2 self-assessment checklist, or estimate your SPRS score with the free CMMC compliance tool. Self-reported answers are planning signals only — they do not establish a verified or assessor-accepted result.