Requirements 3.12
3.12 Security Assessment: the NIST SP 800-171 requirements
The 4 requirements of family 3.12, Security Assessment, in NIST SP 800-171 Rev 2, worth 13 points of a SPRS score under 32 CFR 170.24. For each: NIST's text, what it costs when not met, the objectives an assessor determines under NIST SP 800-171A, and how to meet it. To mark each one and work out your score, use the free calculator.
3.12.1 Security Control Assessment
Periodically assess the security controls in organizational systems to determine if the controls are effective in their application.
Points: 5 points.
Assessment objectives (NIST SP 800-171A)
- [a]The frequency of security control assessments is defined.
- [b]Security controls are assessed with the defined frequency to determine if the controls are effective in their application.
How to meet it
Perform a periodic self-assessment of all 110 requirements using the NIST SP 800-171A assessment objectives, scoring each as met or not met, at least annually: this platform's engagement workflow is designed to produce exactly this artifact. Have someone other than the implementer assess where headcount allows. Evidence: the dated assessment report with per-control results and assessor name.
3.12.2 Plan of Action
Develop and implement plans of action designed to correct deficiencies and reduce or eliminate vulnerabilities in organizational systems.
Points: 3 points.
Assessment objectives (NIST SP 800-171A)
- [a]Deficiencies and vulnerabilities to be addressed by the plan of action are identified.
- [b]A plan of action is developed to correct identified deficiencies and reduce or eliminate identified vulnerabilities.
- [c]The plan of action is implemented to correct identified deficiencies and reduce or eliminate identified vulnerabilities.
How to meet it
Create and actively maintain a Plan of Action & Milestones (POA&M) for every deficiency: the weakness, remediation milestones with dates, responsible party, and resources needed. Review it monthly and close items with evidence; note that under CMMC, POA&M items are only permitted for limited lower-weight requirements and must close within 180 days. Evidence: the current POA&M with milestone dates and the review/closure history.
3.12.3 Security Control Monitoring
Monitor security controls on an ongoing basis to ensure the continued effectiveness of the controls.
Points: 5 points.
Assessment objectives (NIST SP 800-171A)
- [a]Security controls are monitored on an ongoing basis to ensure the continued effectiveness of those controls.
How to meet it
Monitor your controls on an ongoing basis rather than only at assessment time: a monthly or quarterly checklist verifying key controls still operate (MFA coverage, patch compliance, log review occurring, backup restores tested), with results recorded. Automate what you can via compliance dashboards in your management tooling. Evidence: the continuous monitoring plan/schedule and completed monitoring records.
3.12.4 System Security Plan
Develop, document, and periodically update system security plans that describe system boundaries, system environments of operation, how security requirements are implemented, and the relationships with or connections to other systems.
Points: No points of its own; without a system security plan there is no score.
A plan of action (POA&M) may never hold this requirement: a CMMC Level 2 status needs it met, whatever the score.
Assessment objectives (NIST SP 800-171A)
- [a]A system security plan is developed.
- [b]The system boundary is described and documented in the system security plan.
- [c]The system environment of operation is described and documented in the system security plan.
- [d]The security requirements identified and approved by the designated authority as non-applicable are identified.
- [e]The method of security requirement implementation is described and documented in the system security plan.
- [f]The relationship with or connection to other systems is described and documented in the system security plan.
- [g]The frequency to update the system security plan is defined.
- [h]System security plan is updated with the defined frequency.
How to meet it
Develop a System Security Plan describing your system boundary, environment, how CUI flows, and how each of the 110 requirements is implemented (or not yet). This is the priority document: without an SSP you cannot submit an SPRS score at all (DoD assessment methodology treats a missing SSP as having no completed assessment to report) and it is the first artifact any CMMC assessor requests. Use the NIST SP 800-171 SSP template as the skeleton and update it as the environment changes. Evidence: the current, dated, approved SSP with a revision history.