CA.L2-3.12.1 security control assessment guide

What CA.L2-3.12.1 requires and why it cannot be deferred

If you are the compliance lead for a defense contractor, CA.L2-3.12.1 asks you to show an assessor two things: that your security controls are checked on a defined schedule, and that the results of those checks lead to action. The requirement comes from NIST SP 800-171 Rev. 2, requirement 3.12.1, and asks the organization to periodically assess its security controls to determine whether they are effective in their application. NIST SP 800-171A, the assessment guide, splits this into two objectives: first, define how often control assessments happen, and second, assess the controls at that frequency to determine whether they are effective. An assessor will look for both. A written frequency without dated assessment results fails the second objective, and results without a defined schedule fails the first.

The risk behind the requirement is drift. A control that was configured correctly at deployment can quietly stop working as systems change, accounts accumulate, patches lapse or a firewall rule is added for a one-time task. Periodic assessment is how you catch that before an assessor or an attacker does. The interval is yours to set under the CMMC rule, but it may be no longer than one year. Whatever interval you choose, your assessment plan and your records must match it, and the assessor will compare the two. CA.L2-3.12.1 is worth 5 points on the CMMC scoring methodology in 32 CFR 170.24. Because it is worth more than 1 point, it cannot go on a plan of action and milestones under 32 CFR 170.21, so it must be MET for you to reach Conditional or Final Level 2 status.

The requirement sits alongside three related requirements that readers often confuse with it. CA.L2-3.12.2 covers operational plans of action for deficiencies found after implementation, with no fixed deadline. CA.L2-3.12.3 covers continuous monitoring between periodic assessments. CA.L2-3.12.4 covers the system security plan, which describes your boundaries and how each requirement is implemented. CA.L2-3.12.1 is the periodic, point-in-time check. Confirm the current status of CMMC Phase II certification with your contracting officer before you plan around a particular assessment date. The Department of War suspended Phase II in July 2026, while Phase I self-assessments, SPRS postings and DFARS 252.204-7012 obligations remain in place.

Which systems and assessment scopes CA.L2-3.12.1 covers

Before any control is tested, the organization decides which systems the assessment covers. Each boundary decision below changes how many systems, people and records an assessor will examine, and how much evidence must be produced for each one.

The CUI system boundary

The assessment covers every system that stores, processes or transmits CUI, along with the components that provide security protection for them. Define the boundary in writing before testing starts, since an assessor tests the periodic assessment process against that boundary. Confirm which applications, databases, file shares and collaboration tools fall inside it, and record the assessment interval the organization sets for each part of it.

Organizational systems inside the boundary

Every organizational system inside the boundary needs its own record of which controls apply and when they were last assessed. A workstation fleet, a build server and a reporting database may each need different assessment cadences and different test steps. Inventory these systems first, then group them by type so one assessment plan can cover similar assets consistently.

Shared enterprise services

Identity providers, centralized logging, endpoint management and vulnerability scanners often serve systems inside and outside the boundary. Assessors will check whether these shared services protect CUI systems as implemented, so the assessment must show how they are configured for that scope. Confirm with the service owner which tenant, domain or policy sets apply to CUI systems, and whether their own assessment results are available for reuse.

External service providers holding CUI

Cloud platforms, managed service providers and hosted collaboration tools that store or process CUI sit inside the assessed scope, even when another company operates them. The organization remains responsible for assessing the controls it relies on. Ask each provider for the evidence it can share, such as its security documentation and its own assessment results, and record which requirements the provider meets and which remain with the organization.

Specialized assets such as OT and test equipment

Operational technology, lab instruments and test equipment often cannot run standard agents or receive frequent patches. When these assets process CUI or connect to a CUI system, they must be assessed on the same terms, with compensating controls documented where a standard control cannot be applied. Confirm which devices connect to the boundary, which vendor limits apply, and how the assessment will record the reason a control is implemented differently.

Out-of-scope systems and documented boundaries

Systems that neither handle CUI nor provide security protection to CUI systems can sit outside the assessed scope. Drawing this line requires evidence, such as network segmentation tests and data flow diagrams, that an assessor can verify. Weak or undocumented separation pulls more systems into scope and increases the number of controls that must be assessed on the periodic cycle.

How a CMMC assessor tests whether security controls are assessed

This table compares each NIST SP 800-171A assessment objective for CA.L2-3.12.1 with the objects an assessor examines, the evidence to prepare and the findings that most often cause a NOT MET result. Read it as a checklist: a requirement is MET only when every applicable objective is satisfied with evidence in final form.

Assessment element	What the assessor checks	Evidence to prepare	Common findings
Objective a: frequency defined	The organization has set and documented how often security controls are assessed, and the interval is no longer than one year	Written assessment policy or plan stating the interval, approved by the responsible owner and dated	No stated frequency, an interval longer than one year, or a frequency that exists only in conversation
Objective b: controls assessed at that frequency	Assessments were carried out at the defined interval and determined whether each control is effective in its application	Dated assessment records covering the in-scope controls, with the method and the person who performed each assessment	Undated assessments, gaps longer than the defined interval, or controls skipped without explanation
Security assessment planning	A documented process exists for scoping, selecting controls and scheduling assessments	Assessment schedule, scope statement and the procedures used to select assessment methods	Plan is generic, does not name the systems in scope, or was never followed
Security assessment plan	The plan defines the assessment objectives, methods and objects for each control	Approved plan version with revision history showing who signed it and when	Plan is a draft, is missing for some systems, or does not match the controls actually assessed
Assessment reporting	Results are documented and communicated to the responsible owners	Final assessment report with findings per control, the date issued and the recipients	Draft report only, no final version, or findings listed without a determination of effectiveness
Mechanisms that support assessment	Tools and procedures that produce assessment data are tested and their output is retained	Tool configuration records, scan or test outputs and the logs showing they ran as scheduled	Scanners or checks that were never validated, outputs not retained, or results that cannot be traced to a control
Proposed control changes and remediation	Assessment results lead to proposed new or updated controls, remediation plans and newly identified risks	Remediation plan entries, risk register updates and change requests linked to specific assessment findings	Results with no follow-up, risks found but not recorded, or remediation with no owner or date

Steps to build a periodic control assessment program

This sequence turns CA.L2-3.12.1 from a one-time exercise into a repeatable cycle: a defined interval, a written plan, recorded results and tracked follow-up. Each step leaves a record an assessor can test against the assessment objectives in NIST SP 800-171A.

Set and document the assessment interval
The organization sets how often each security control is assessed and writes that interval into its assessment procedure. The CMMC rule lets the contractor choose the interval for 'periodically,' but it may not exceed one year, so the document should state the interval and the reason for it. The step is done when the approved procedure names the interval, the owner of each assessment and the systems in scope. An assessor will ask to see this document and whether the schedule has been followed.
Write the security assessment plan
The assessment lead writes a plan that defines scope, the controls to be tested, the test methods (interviews, examination of documents and technical testing) and the people who will perform each test. The plan should map to the assessment objectives in NIST SP 800-171A so that each control can be shown to meet them. It is complete when the plan is approved by the system owner and covers every system within the CUI boundary. Assessors commonly ask for this plan before reviewing any results.
Run the assessment against the plan
Assessors, who may be internal staff or an outside party, execute the tests in the plan and collect the evidence each test produces. Technical tests can use configuration scanners, log reviews and access reviews, while interviews confirm how people actually operate the controls. The step ends when every planned test has an outcome, and any test that could not run is recorded with the reason. The evidence collected here is what supports a MET or NOT MET determination later.
Record results in final form
Each assessment result is written up with the control identifier, the test performed, the evidence reviewed, the determination, the date and the name of the assessor. Only final records count toward a MET determination, so drafts and unsigned worksheets should be replaced before the cycle closes. The record is complete when a third party can follow each result back to its evidence without asking the author. This is the documented result that assessors test for first.
Convert findings into controls, plans and risks
Each deficiency is turned into one of three outputs: a proposed new or updated control, a remediation plan with an owner and target, or a newly identified risk entered in the risk register. Typical outputs of a control assessment are exactly these three items, so each finding should land in one of them. The step is done when every finding has a linked output and nothing is left in an informal list. An assessor will check that open findings trace to a named owner and an action.
Update the SSP and track each output
The system security plan is updated to reflect any control changes, and the remediation items are tracked to closure in the change or ticketing system. Changes to controls should also be reviewed against the configuration baseline so that the documented state matches what is running. The step is complete when the SSP revision date matches the assessment cycle and each remediation item shows its closure evidence. Assessors commonly compare the SSP against the latest assessment results, so mismatches are a frequent finding.

Evidence that shows security controls are assessed

An assessor testing CA.L2-3.12.1 looks for a chain of records: a defined assessment frequency, a plan that governs each assessment, final reports, test outputs, and the registers that track what the assessment found. Each artifact below should be dated, scoped and signed, and kept current between assessments, because a gap in one link weakens the others.

Approved assessment frequency

This is the organization's written interval for assessing security controls, which NIST SP 800-171A treats as the first assessment objective for 3.12.1. Under 32 CFR 170.14(d), the contractor sets the interval for periodic requirements, but it may be no longer than one year. The artifact passes when it names a specific interval, is approved by a responsible owner, carries a date, and matches the schedule in the assessment plan. Confirm the approval record is current, since an interval that exists only in an unsigned draft will not satisfy an assessor.

Security assessment plan

The plan defines what is assessed, how, by whom and against which criteria. It should list the security requirements in scope, the assessment procedures, the roles that perform and review the work, and the system boundary it covers. Assessors check that the plan's scope matches the system described in the System Security Plan. The plan passes when it is approved, dated, and tied to the frequency in the approved schedule. Keep it under version control so that each change has an owner and a reason.

Final assessment reports

Each completed assessment produces a report with a date, the systems and scope assessed, the procedures run, the results for each requirement, and the sign-off of the person accountable for the outcome. Only final reports count. A draft with open comments or unresolved results does not meet the bar, because MET status requires that evidence be in final form. Keep prior reports in the repository so that an assessor can see a consistent cadence across cycles rather than one report assembled at audit time.

Control test records and outputs

These are the raw results behind each report: configuration scan exports, screenshots or query results, interview notes, and tool logs showing when each control was tested and what it returned. Tools such as Wazuh Security Configuration Assessment and Fleet policies can generate timestamped pass and fail results that show whether a control was effective at a given moment. Check that each record names the control, the system, the date and the tester, and that failing results link to a documented disposition. Confirm that exported results can be retained for the full period your interval requires.

Register of proposed control changes and remediation plans

The CMMC Assessment Guide lists proposed new or updated controls and remediation plans as typical outputs of a control assessment. This register records each proposed change, the finding that prompted it, the owner, the target date and the status. Assessors look for a link from every failed or partial test to an entry here, and for evidence that approved changes were carried into the SSP and configuration baselines. Review the register at each assessment cycle so that closed items show verification, not just a closed status.

Log of newly identified risks

Assessments often surface risks that were not in the risk register before the test, such as an unmanaged integration or a control that depends on a vendor's unpatched component. This log captures each new risk with its description, affected system, likelihood and impact rating, owner, and the decision taken: accept, mitigate, transfer or avoid. Feed accepted risks into the risk assessment process so they are reviewed on schedule. The log passes when every entry has a documented decision and an owner, and when it is reconciled with the risk register after each assessment.

What meeting CA.L2-3.12.1 costs in money and effort

This table compares the cost components of running periodic security control assessments for CA.L2-3.12.1, who is paid for each, whether it is one-time or recurring, and what moves it up or down. Use it to structure a written quote and to see where self-hosted open-source tooling reduces license spend. No dollar figures are given because none are supplied for this requirement.

Cost component	One-time or recurring	What drives it up or down	How to keep it down
Tooling and licenses	Recurring	Number of platforms in scope, per-seat or per-endpoint pricing, and whether scanners and GRC tools are commercial	Use open-source options such as CISO Assistant (AGPL-3.0-only) for assessment tracking, Wazuh (GPL-2.0-only) for configuration checks and Fleet (MIT) for device policies, then confirm licensing and support terms in writing
Assessment plan and procedure design	One-time, revisited when systems change	Number of system boundaries, assessment objects and the frequency interval the organization sets under 32 CFR 170.14(d)	Define one assessment plan template reused across systems, and keep the interval at the organization's chosen cadence rather than a longer one than needed
Internal engineering and compliance time	Recurring	Size of the assessment team, how many controls are tested by hand, and how many assessment cycles run each year	Automate configuration and policy checks so staff review results instead of collecting screenshots
Test execution and evidence capture	Recurring	Number of controls tested manually, number of endpoints and servers, and how results are stored	Export machine-readable results to a central record and keep final-form reports so evidence does not need to be rebuilt
Remediation and proposed control changes	Recurring, variable	Number of findings, complexity of fixes, and whether changes need formal change control	Track findings in one register with owners and dates, and fix recurring issues at the configuration baseline
Evidence upkeep	Recurring	How long records are retained, how often reports are reissued, and how many systems share evidence	Store assessment results in a single system with version history and consistent naming
External testing or review	Recurring or optional	Scope of independent review, whether a consultant reviews the plan, and the depth of testing requested	Limit external work to independent checks of the assessment plan and sample evidence, and confirm exact scope in writing
Assessor time during certification or self-assessment	Periodic, tied to the assessment cycle	Number of objectives to verify, evidence readiness, and whether final-form documents are available	Prepare final-form evidence before the assessment, since assessors judge only completed documents

Open-source tools that produce assessment evidence

Three open-source platforms can hold or generate parts of the evidence a CA.L2-3.12.1 assessment depends on. Each covers a different piece: the assessment record, endpoint configuration checks and per-device policy results. None of them replaces the testing that an assessor performs against the NIST SP 800-171A objectives.

CISO Assistant for assessment records

CISO Assistant is an AGPL-3.0-only platform that ships more than 200 frameworks and runs audits and compliance assessments against them, with automatic mapping between frameworks. For CA.L2-3.12.1, it can hold the assessment plan, the periodic assessment cycle for each control and the results each cycle produces. It does not run the tests, and it cannot decide whether an objective is met. Confirm that the NIST SP 800-171 Rev. 2 content you need is in the version you deploy, and have counsel review AGPL-3.0-only obligations before you modify or host it for others.

Wazuh configuration assessment checks

Wazuh Security Configuration Assessment is GPL-2.0-only and scans monitored endpoints for misconfigurations using YAML policies. Most policies are based on CIS benchmarks, and you can add custom policies that check files, directories, registry keys and running processes. Each finding comes with remediation advice, which gives 3.12.1 a dated, repeatable record of configuration state between formal assessments. It does not decide whether a control is effective in its application, and it cannot judge controls such as personnel screening or physical access. Map each policy to the requirement it supports, and review GPL-2.0-only terms with counsel before distributing agent builds.

Fleet policy pass and fail results

Fleet is MIT licensed, and its policies are yes or no questions asked of devices as osquery queries. The policies page shows which devices in each fleet pass or fail each policy. For 3.12.1, that per-device view can show whether a chosen set of endpoint settings, such as disk encryption or screen lock, held at the time of assessment. A failing device is evidence of a finding, so decide in advance how failures feed the assessment results and any plan of action. Fleet does not write the assessment plan or propose control changes, and a policy only covers what its query can see. Confirm that each query returns reliable results on your operating systems before you cite it.

Who owns, implements and independently assesses 3.12.1

Your organization owns CA.L2-3.12.1 in full. The control is not satisfied by a tool or a partner; it is satisfied by a documented assessment program that your leadership sets, funds and acts on. Under 32 CFR 170.14(d), your team chooses the assessment interval for the word "periodically," but that interval may be no longer than one year, so the decision and its justification belong to you.

Frequency decisions: Set and document the assessment interval, the systems in scope and the triggers that force an out-of-cycle assessment, such as a major change to the boundary.
Assessment execution: Perform the assessments yourselves or direct staff to perform them against the objectives in NIST SP 800-171A.
Results and sign-off: Review documented results, approve proposed control changes and accept the remediation plans and newly identified risks.
Accountable owners: Name control owners who answer for the evidence behind each requirement.
Retained records: Keep final-form results, dated and signed, because drafts do not satisfy an objective.

Before relying on this model, confirm with your contracting officer and your C3PAO or self-assessment plan which parts of the assessment record you must produce and in what form.",

Where organizations fall short on control assessment

Most CA.L2-3.12.1 failures come from process gaps rather than missing tools. The cards below cover the places where assessments lose their value: undefined frequency, untested objectives, unfinished evidence, results that stall, documents that disagree and the wrong system boundary.

No documented assessment frequency

The first assessment objective in NIST SP 800-171A requires the organization to define how often controls are assessed. Under 32 CFR 170.14(d), the organization sets that interval for periodic requirements, but it may not exceed one year. Check that the interval is written in a policy or assessment plan, that it is no longer than one year, and that assessment dates in the record match it. An assessor will ask for the plan before reviewing any results.

Assessments that skip the objectives

A common pattern is a review meeting or a checklist signed without testing anything. SP 800-171A asks the assessor to test whether each control is effective at the defined frequency, including the assessment plan, the assessment procedures and the reporting. Check that every assessment names the controls tested, the method used (examine, interview or test) and the objective each result supports. A result that cannot be traced to an objective will not support a MET finding.

Draft reports treated as final

Assessors score a requirement as MET only when every applicable objective is satisfied with evidence in final form. Draft assessment reports, unsigned tables and spreadsheets with pending comments do not qualify. Before an assessment, confirm that each report is version-controlled, dated, approved by a named owner and stored where it can be produced on request. Because CA.L2-3.12.1 is a 5-point requirement, a draft that leaves it unfinished cannot be moved to a POA&M.

Results that never reach remediation

A typical assessment output is a set of documented results, proposed new or updated controls, remediation plans and newly identified risks. Many teams record the findings but never open tickets, assign owners or update the risk register. Check that every NOT MET or partially effective control produces a tracked item with an owner, a due date and a link back to the assessment that found it. This connects CA.L2-3.12.1 to the operational work in CA.L2-3.12.2.

SSP sections out of step with results

The system security plan describes how each requirement is implemented. When an assessment finds that a control has changed, failed or been replaced, the SSP often still describes the old state. Compare each assessed control against the SSP narrative and diagram, then record the change, the approver and the date. Assessors compare these two documents, so a mismatch raises questions about both.

Assessments scoped to the wrong boundary

An assessment that covers a corporate network but leaves out the enclave, a cloud tenant, a remote support tool or a contractor-managed device tests the wrong system. Confirm the assessment boundary matches the boundary in the SSP and includes every asset that stores, processes or transmits CUI, along with the security protection assets that support it. Document any excluded component with its justification, and confirm the inventory used for sampling is current.

How much effort and cost does a control assessment program take?

How long and how much effort does a control assessment program take to stand up?

The effort depends on how many systems are in scope, how many of the 110 Level 2 requirements the organization already meets, and how much evidence is already documented. Standing up the program has a one-time cost: defining the assessment frequency, writing an assessment plan, selecting test methods for each control, and building a reporting template. After that, the program recurs at the interval the organization sets, which can be no longer than one year under 32 CFR 170.14(d). Ask any partner for a written scope listing the systems, the requirements covered and the deliverables before you compare numbers, because the scope is what drives the quote.

Can a small team run a control assessment program in-house?

Yes, a small team can run it in-house if it has someone who understands NIST SP 800-171A, the assessment objectives for 3.12.1, and how to record results in final form. The work is recurring: each cycle tests controls against their objectives, records whether each is met with evidence, and turns gaps into proposed control changes, remediation plans and newly identified risks. Monitoring tools such as Wazuh or Fleet can produce some of that evidence automatically, but they do not decide whether a control is effective. Plan for the time to review results and keep the schedule, not only to collect data.

What does an implementation partner do for a control assessment program, and what does it not do?

An implementation partner can plan the assessment program, set up the tooling, prepare test procedures, collect and organize evidence, and document results for the organization's own review. It does not own the controls, decide whether a requirement is MET, or issue an assessment report or certificate. Only an independent assessor, such as a C3PAO for Level 2 certification, can do that. The organization remains responsible for its controls and for the accuracy of its System Security Plan and self-assessment submissions. Ask the partner to state in writing which tasks it performs and which remain with your team.

Can the assessment frequency for CA.L2-3.12.1 be set to less than one year?

Yes. Under 32 CFR 170.14(d), where CMMC uses the word periodically, the contractor sets the interval, but the interval may be no longer than one year. A shorter interval, such as quarterly, is allowed and can be justified by system change rate, risk or contract terms. A shorter cycle raises recurring effort, because each cycle needs test execution, evidence review and reporting. Document the chosen frequency in the assessment plan so an assessor can see how it was set and whether it was followed.

Why can't a 5-point requirement like CA.L2-3.12.1 go on a POA&M?

Under the CMMC Scoring Methodology, CA.L2-3.12.1 is a 5-point requirement. Under 32 CFR 170.21(a)(2), a requirement worth more than 1 point cannot be placed on a plan of action and milestones, so it must be MET to reach Conditional or Final Level 2 status. Any requirement not met is subtracted from the maximum score of 110. For planning, this means the assessment program must be operating and producing final evidence before the assessment, not after it. Check the current rule text and the status of the program in the Phase II section below before you rely on this timing.

How does the suspension of CMMC Phase II affect planning for a control assessment program?

On 13 July 2026, the Department of War suspended CMMC Phase II, which had been scheduled to start 10 November 2026 and would have required Level 2 C3PAO certification for applicable contracts. A 60-day review by a CMMC Reform Task Force followed. Phase I self-assessments, SPRS postings, annual affirmations and DFARS 252.204-7012 obligations remain in place. Because the timing of certification requirements is under review, build the assessment program to the requirement now, not to a guessed deadline, and confirm the current status with the contracting officer and the DoW CIO's CMMC pages before committing budget.

How DeployOpen prepares CA.L2-3.12.1 evidence

DeployOpen helps organizations set up the systems, control procedures and records that a CA.L2-3.12.1 assessment will examine, inside the organization's own infrastructure. The organization still owns its controls and its assessment decisions, and only an independent assessor can issue a Level 2 result.

How we scope

Engagements are fixed-scope, with the systems, assessment cycle and deliverables for CA.L2-3.12.1 agreed in writing before work starts.
The written scope names which systems, environments and assessment objects are covered, including the frequency the organization defines for periodic control assessments.
A quote follows from the written scope, so the organization can compare what is included and what it must provide itself.

How we build

We configure the self-hosted tools that collect assessment evidence, such as compliance tracking, configuration checks and endpoint policy results.
We set up assessment procedures and templates so each control review produces documented results, proposed control changes, remediation plans and newly identified risks.
We test that the evidence records are complete, dated and retained in final form, since a requirement is met only with final evidence.

How we hand over

We deliver the assessment plan, procedures, evidence records and tool configuration documentation as defined in the written scope.
We walk the organization's staff through how to run the next assessment cycle and where each evidence item is stored.
We do not issue audit reports or certifications. Independent assessors review the evidence and make the assessment determination.

How we support

Ongoing support, upgrades and continuous testing are available as a retainer after the initial engagement ends.
A retainer can cover keeping tool configurations current, refreshing evidence records and preparing for the next periodic assessment.
Confirm with DeployOpen in writing which support activities are in scope before the first assessment cycle begins.