Risk Assessment

Risk Assessment is the intelligence function. Know your risks, find your vulnerabilities, and fix them in order of severity.

The Big Picture

The assessor will ask for three things: your risk assessment document, your most recent vulnerability scan results, and your remediation records showing you’re fixing what the scans find. All three must exist, be current, and be connected — risks should drive priorities, scans should find flaws, and remediation should close them.

The Pipeline

Assess (3.11.1) — Formal risk assessment at a defined frequency (annually is standard). Identify threats, vulnerabilities, likelihood, and impact. Results drive your security priorities.

Scan (3.11.2) — Regular vulnerability scans across all CUI systems, plus ad-hoc scans when critical new vulnerabilities are disclosed.

Fix (3.11.3) — Remediate vulnerabilities by risk priority. Critical first. Track every finding to closure.

---

All 3 Requirements

Ref	Short Name	What It Covers
3.11.1	Assess Your Risks	Formal risk assessments at defined intervals
3.11.2	Scan for Vulnerabilities	Regular and event-driven vulnerability scanning
3.11.3	Fix What You Find	Remediate by risk priority, track to closure