RA.L2-3.11.1 Risk assessments
Periodically assessing the risk to operations, assets and individuals from operating systems that process, store or transmit CUI, at a frequency the organization defines, which 32 CFR 170.14(d) caps at one year.
RA Risk assessment
The three CMMC Level 2 risk assessment requirements: periodic risk assessments, vulnerability scanning, and remediating vulnerabilities according to risk.
RA.L2-3.11.2 Vulnerability scan
Scanning systems and applications for vulnerabilities at a defined frequency and whenever new relevant vulnerabilities are identified, covering every in-scope asset. A 5-point requirement in the scoring methodology.
RA.L2-3.11.3 Vulnerability remediation
Identifying vulnerabilities and remediating them according to risk assessments, prioritizing the most critical and tracking both fixes and accepted risks. Covers remediation records and the link to plans of action.
