The four CMMC Level 2 security assessment requirements: periodically assessing controls, operational plans of action, ongoing control monitoring, and the system security plan.
Periodically assessing whether security controls are effective, producing assessment results, proposed control changes, remediation plans and newly identified risks. A 5-point requirement assessed at least annually under the CMMC rule.
Developing and carrying out plans of action that correct deficiencies and reduce vulnerabilities. Distinct from an assessment POA&M: an operational plan of action has no fixed deadline and covers deficiencies found after implementation.
Monitoring security controls on an ongoing basis, more often than the periodic assessments of CA.L2-3.12.1, so management knows whether controls remain effective. A 5-point requirement with a single assessment objective.
Developing, documenting and periodically updating the SSP that describes system boundaries, environments of operation, how each requirement is implemented and connections to other systems. Without it, a CMMC assessment cannot be completed.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.