Requirements 3.11
3.11 Risk Assessment: the NIST SP 800-171 requirements
The 3 requirements of family 3.11, Risk Assessment, in NIST SP 800-171 Rev 2, worth 9 points of a SPRS score under 32 CFR 170.24. For each: NIST's text, what it costs when not met, the objectives an assessor determines under NIST SP 800-171A, and how to meet it. To mark each one and work out your score, use the free calculator.
3.11.1 Risk Assessment
Periodically assess the risk to organizational operations (including mission, functions, image, or reputation), organizational assets, and individuals, resulting from the operation of organizational systems and the associated processing, storage, or transmission of CUI.
Points: 3 points.
Assessment objectives (NIST SP 800-171A)
- [a]the frequency to assess risk to organizational operations, organizational assets, and individuals is defined.
- [b]risk to organizational operations, organizational assets, and individuals resulting from the operation of an organizational system that processes, stores, or transmits CUI is assessed with the defined frequency.
How to meet it
Conduct and document a periodic (at least annual) risk assessment covering threats to CUI confidentiality across your operations, assets, and people: a straightforward spreadsheet of threats, vulnerabilities, likelihood, impact, and planned treatment satisfies this at small scale; NIST SP 800-30 provides the method. Repeat after major changes like new systems or offices. Evidence: the dated risk assessment report and the risk register with treatment decisions.
3.11.2 Vulnerability Scanning
Scan for vulnerabilities in organizational systems and applications periodically and when new vulnerabilities affecting those systems and applications are identified.
Points: 5 points.
Assessment objectives (NIST SP 800-171A)
- [a]the frequency to scan for vulnerabilities in organizational systems and applications is defined.
- [b]vulnerability scans are performed on organizational systems with the defined frequency.
- [c]vulnerability scans are performed on applications with the defined frequency.
- [d]vulnerability scans are performed on organizational systems when new vulnerabilities are identified.
- [e]vulnerability scans are performed on applications when new vulnerabilities are identified.
How to meet it
Deploy a vulnerability scanner (Nessus Essentials is free for small environments; Tenable, Qualys, or Defender Vulnerability Management scale up) and scan on a defined cadence (monthly is a common baseline) plus after new vulnerabilities are announced for your stack. Scan both infrastructure and applications, authenticated where possible. Evidence: the scan schedule/policy and recent scan reports covering the CUI environment.
3.11.3 Vulnerability Remediation
Remediate vulnerabilities in accordance with risk assessments.
Points: 1 point.
Assessment objectives (NIST SP 800-171A)
- [a]vulnerabilities are identified.
- [b]vulnerabilities are remediated in accordance with risk assessments.
How to meet it
Establish a remediation SLA tied to severity (for example: critical 7-15 days, high 30, medium 90), track findings to closure in a ticket or register, and document risk acceptance with sign-off for anything you deliberately defer. Rescan to verify fixes rather than trusting the patch report. Evidence: the remediation SLA, closed remediation tickets, and before/after scan results.