Risk Assessment
Risk Assessment is about knowing your own weaknesses before an adversary does: scanning for vulnerabilities and judging the risk they pose. It turns security from guesswork into a managed program.
The 3 Risk Assessment requirements
9 assessment objectives across this family.
- 3.11.1Risk AssessmentsPeriodically assess the risk to organizational operations (including mission, functions, image, or reputation), organizational assets, and individuals, resulting from the operation of organizational systems and the associated processing, storage, or transmission of CUI.3 pt✕ POA&M
- 3.11.2Vulnerability ScanScan for vulnerabilities in organizational systems and applications periodically and when new vulnerabilities affecting those systems and applications are identified.5 pt✕ POA&M
- 3.11.3Vulnerability RemediationRemediate vulnerabilities in accordance with risk assessments.1 pt
Build Risk Assessment, and all 14 families, with an officer
The Level 2 workspace walks your team through all 110 requirements at the objective level, drafts your SSP section by section from your own record for your team to read and accept, gives a prime or your own internal auditor a read only seat on the same record, and a credentialed officer reviews every step.
Book a free advisory callNo credit card, and Level 1 and Level 2 are both open, so sign up for the level your contracts call for. Self assessed and self attested: you score yourself in SPRS on a three year cycle and your senior official affirms it every year. As of September 3, 2026 a class deviation directs contracting officers to remove third party assessment from contracts. The program rule still provides for it, so your solicitation sets the track. Your team builds the same evidence either way. DFARS 252.204-7012 is unaffected, and the NIST SP 800-171 Rev 2 baseline is unchanged.
Questions, answered
How many CMMC Level 2 requirements are in Risk Assessment?+
The Risk Assessment family (RA) has 3 of the 110 CMMC Level 2 requirements, assessed against 9 objectives from NIST SP 800-171A.
What is the Risk Assessment family about?+
Risk Assessment is about knowing your own weaknesses before an adversary does: scanning for vulnerabilities and judging the risk they pose. It turns security from guesswork into a managed program.