3.11.1 — Assess Your Risks

The One-Liner

If you haven’t formally assessed risks to your CUI environment, you’re guessing what to protect.

What It Says

Periodically assess the risk to organizational operations (including mission, functions, image, or reputation), organizational assets, and individuals, resulting from the operation of organizational systems and the associated processing, storage, or transmission of CUI.

What It Actually Means

Conduct formal risk assessments at a defined frequency (annually is standard). Using a methodology like NIST SP 800-30: identify threats (external attackers, insider threats, natural disasters), identify vulnerabilities (technical and procedural), assess likelihood and impact, and calculate risk. Results feed your POA&M, security investments, and control priorities. This isn’t a one-time exercise — risks change as your environment, contracts, and the threat landscape evolve.

---

Pass or Fail

Your assessor needs a “yes” to every row:

#	Question	What “yes” looks like
1	Is the risk assessment frequency defined?	Policy specifies: at least annually and after significant changes
2	Are risk assessments conducted with the defined frequency?	Dated risk assessment document showing threats, vulnerabilities, likelihood, impact, and risk ratings

---

What to Have Ready on Assessment Day

Documents they’ll review: Risk assessment policy; risk assessment methodology documentation; risk assessment results; risk register; system security plan; POA&M showing risk-driven priorities

People they’ll talk to: Personnel with risk assessment and vulnerability management responsibilities; information security personnel

Live demos they’ll ask for: “Show me your most recent risk assessment document.” “What methodology did you use?” “How do results feed your security priorities?” “When was it last updated?”

---

The Assessor’s Playbook

These are the actual questions. Have answers ready.

• “Show me your risk assessment. When was it last conducted?”
• “What methodology did you use?”
• “How do risk assessment results feed your security priorities?”
• “Are risks tracked and updated over time?”

Real-World Example

A defense contractor conducts an annual risk assessment per NIST SP 800-30. The assessment identifies 15 risk scenarios — from phishing-based credential theft (likelihood: high, impact: high) to physical theft of a CUI laptop (likelihood: medium, impact: high). Each risk is rated, and the top risks feed the POA&M and annual security budget. The assessment is updated mid-year when a new cloud service is deployed. The assessor reviews the risk assessment document, checks the date, and asks how the top-rated risks influenced security investments.

---

Where Companies Trip Up

No formal assessment. Security decisions based on gut feeling rather than documented analysis. Conduct a formal risk assessment per NIST SP 800-30.

One-and-done. Assessed two years ago and never updated. Risks change — reassess annually and after significant changes.

No action on findings. Risks identified but nothing changes. Risk assessment results should feed your POA&M and investment priorities.

---

How to Talk About This

To a CEO or Board

We conduct annual risk assessments and use the results to prioritize our security investments and remediation efforts. Risks are tracked and updated as our environment evolves.

To an Engineering Team

Annual risk assessment per NIST SP 800-30. Risk register: threats, vulnerabilities, likelihood, impact, rating. Results feed POA&M and budget. Updated after significant changes. Risk register reviewed quarterly.

---

Connected Requirements

Requirement	Why it matters here
3.11.2 — Scan for Vulnerabilities	Vulnerability scanning feeds the technical vulnerability identification
3.11.3 — Fix What You Find	Remediation prioritized by risk assessment results
3.12.2 — Track Every Gap	POA&M driven by risk assessment findings

---

Implementation (coming soon)

Step-by-step setup for Microsoft 365 / Entra ID, AWS, Azure, and GCP — console steps, CLI commands, and evidence screenshots.

---

CMMC Practice ID: RA.L2-3.11.1 | SPRS Weight: 3 points | POA&M Eligible: No