03.11.01 Risk assessment
Assessing the risk, including supply chain risk, of unauthorized disclosure from processing, storing or transmitting CUI, and updating the risk assessment at a defined frequency.
03.11 Risk assessment
Rev. 3 risk assessment requirements: assessing the risk of unauthorized disclosure of CUI (including supply chain risk), vulnerability monitoring, scanning and remediation, and responding to findings.
03.11.02 Vulnerability monitoring and scanning
Monitoring and scanning for vulnerabilities at defined frequencies and when new ones emerge, remediating within defined response times and keeping the scanned vulnerability set current. Rev. 3 folded Rev. 2's remediation requirement (3.11.3) into it.
03.11.04 Risk response
Responding to findings from security assessments, monitoring and audits, the step that turns assessment results into action; new in Rev. 3.
