What this requirement asks
Develop and implement plans of action designed to correct deficiencies and reduce or eliminate vulnerabilities in organizational systems.
This is a CMMC Level 2 requirement in the Security Assessment family, drawn from NIST SP 800-171 Rev. 2. An assessor evaluates it objective by objective — every objective below must be supported by evidence, not just described in a policy.
Assessment objectives (3)
- 3.12.2[a] — deficiencies and vulnerabilities to be addressed by the plan of action are identified
- 3.12.2[b] — a plan of action is developed to correct identified deficiencies and reduce or eliminate identified vulnerabilities
- 3.12.2[c] — the plan of action is implemented to correct identified deficiencies and reduce or eliminate identified vulnerabilities
What an assessor examines
Examine:
- Security assessment and authorization policy
- procedures addressing plan of action
- system security plan
- security assessment plan
- security assessment report
- security assessment evidence
- plan of action
- other relevant documents or records
Interview:
- Personnel with plan of action development and implementation responsibilities
- personnel with information security responsibilities
Test:
- Mechanisms for developing, implementing, and maintaining plan of action
Evidence that defends it
Ensure SSP is current, scoped, mapped to controls
Check your readiness
Score this requirement against your own environment with the Level 2 self-assessment checklist, or estimate your SPRS score with the free CMMC compliance tool. Self-reported answers are planning signals only — they do not establish a verified or assessor-accepted result.