03.11.01 Risk assessment: requirements and evidence

03.11.01 risk assessment: what the requirement asks and why it is hard

Requirement 03.11.01 asks the organization to assess the risk of unauthorized disclosure of CUI that arises from processing, storing or transmitting it, including the risk from suppliers and other supply chain relationships, and to update that assessment at a frequency the organization defines. If a contract or a CMMC assessment now asks for a current, CUI-specific risk assessment that covers suppliers, a generic enterprise risk register will not satisfy it. The assessor will look for an analysis tied to the systems, data flows and third parties that actually touch CUI. Under Rev. 2, the same ground was covered by requirement 3.11.1, but Rev. 3 made 03.11.01 more detailed and foundational, so the work now has to show the specific tasks behind the conclusion, not just the conclusion.

The one organization-defined parameter in 03.11.01 is the frequency for updating the risk assessment. NIST does not set that value, and where a federal agency does not specify it, the nonfederal organization must choose and document it to complete the requirement. Confirm with the contracting agency whether it has published a value and write down the frequency your organization adopts, the trigger events that force an earlier update (such as a significant system change, a new supplier handling CUI, or a confirmed incident), and who approves both. An assessor will test whether the stated frequency was followed, so set a value you can actually meet.

Leaving this requirement open is expensive. In the CMMC Level 2 scoring methodology, the Rev. 2 equivalent appears as RA.L2-3.11.1 and carries 3 points. Under 32 CFR 170.21, a requirement with that status cannot be placed on a plan of action and milestones to reach Conditional status, so an unmet risk assessment can block that status outright. Budget for a first assessment that is scoped to CUI systems and suppliers, plus recurring updates on the frequency you set. Ask any implementation partner or auditor to state in writing which parts of the assessment they prepare, which evidence your team produces, and which steps only the organization's own leadership can sign off.

Which systems, data and suppliers a 03.11.01 risk assessment must cover

The risk assessment under 03.11.01 is only as complete as its boundary. The cards below name the scoping decisions that change how much work the assessment involves, from the CUI flows inside the authorized boundary to the suppliers and owners who sit around it.

Map every CUI flow, not just every system

Start from how CUI moves: where it is created, received, processed, stored, printed, copied, backed up and transmitted out. A risk assessment that lists only servers misses email relays, file transfer tools, collaboration platforms and backup targets where CUI actually sits. For each flow, record the systems, people and networks it crosses, then confirm the assessment covers the unauthorized disclosure risk at each hop. Ask whether the data flow diagram matches what engineers observe in production.

Decide what sits inside the authorized boundary

Whether a component is inside the boundary determines whether it is in the risk assessment. Systems that process or store CUI, and the security protection assets that defend them, usually belong inside. Shared identity providers, logging platforms and administrative workstations are frequent edge cases. Document each inclusion or exclusion decision with its reasoning, because an assessor will test whether the boundary matches the system security plan.

Include cloud and managed service providers

A cloud platform, managed email service or outsourced help desk that stores or transmits CUI creates disclosure risk the organization does not fully control. The assessment should record what the provider holds, where the data resides, who can administer it and how the provider reports incidents. Confirm whether the provider's own security evidence covers the CUI scope, and identify the responsibilities that remain with your organization under the shared model.

Trace subcontractors and component suppliers

Subcontractors that receive CUI, and suppliers of hardware, firmware or software components inside the boundary, both introduce supply chain risk that 03.11.01 expects you to assess. Ask which subcontractors handle CUI, whether they have their own access to your systems, and how they are bound to protect it. For components, ask who maintains the code, where updates come from and whether a compromised update could expose CUI. Record each supplier in the assessment with its exposure.

Assign who owns each risk decision

The assessment needs named owners who can accept, mitigate or transfer each disclosure risk. Typical roles include the system owner, the CISO or security lead, the privacy or contracts function for supplier terms, and the executive who accepts residual risk. Decide who reviews the assessment, who is interviewed during the assessment, and who signs off updates. An assessor will ask personnel with risk assessment and supply chain responsibilities to describe their role, so the record should match what they say.

Set the update trigger and frequency

03.11.01 leaves the update frequency as an organization-defined parameter, so your organization must set it and be able to show it is followed. Decide what triggers an out-of-cycle update, such as a new CUI flow, a supplier change, a significant incident or a boundary change. Confirm the chosen frequency appears in your policy and procedures, and that the assessment history shows updates were made on that schedule.

How assessors test 03.11.01 risk assessment evidence

This table maps each assessment method in SP 800-171A Rev. 3 to the objects an assessor pulls for 03.11.01, and lists the findings that most often stop a requirement from passing. Read it as a checklist of what to have ready before an assessor arrives, and note that the determination statements themselves should be read in the published assessment procedure.

Assessment method	Objects the assessor pulls	What the assessor is checking	Common finding
Examine	Risk assessment policy and procedures, security planning policy and procedures, procedures for organizational risk assessments	Whether written policy defines how risk is assessed, who owns it, and how often it is updated	Policy exists but names no update frequency, or the frequency value is blank
Examine	Completed risk assessment documents for the CUI environment	Whether the assessment covers processing, storage and transmission of CUI and names unauthorized disclosure as a risk	Assessment covers general IT risk but never mentions CUI disclosure
Interview	Personnel with risk assessment responsibilities	Whether the people who run assessments can explain the method, inputs and last update	Owners cannot describe how findings feed decisions or when the assessment was last refreshed
Interview	Personnel with supply chain risk management responsibilities	Whether supplier and service provider risks to CUI are considered in the assessment	No supply chain input, with suppliers handling CUI absent from the analysis
Test	Processes for conducting, documenting and reviewing organizational risk assessments	Whether the process runs as written, with evidence of review and sign-off	Process is documented but no review record exists for the last cycle
Test	Mechanisms for disseminating and updating risk assessments	Whether updated assessments reach the owners who act on them and replace superseded versions	Old versions remain in circulation, or updates are not triggered by system changes
Determination check	Organization-defined frequency for updating the risk assessment	Whether a defined frequency exists in the organization's own documents	Frequency is undefined, so the parameter check fails regardless of how well assessments run

How to build a 03.11.01 risk assessment, in order

This sequence turns the 03.11.01 requirement into a documented risk assessment that covers CUI processing, storage and transmission, supplier risk and a defined update frequency. Each step ends with an output an assessor can examine, interview against or test.

Define the CUI-focused scope and update frequency
Start by stating which systems, facilities, people and external providers fall inside the assessment boundary for CUI. Record the organization-defined frequency at which the risk assessment will be updated, because 03.11.01 has one organization-defined parameter that must have a value before the requirement can be met. If a contract or federal agency specifies the frequency, record that source. The output is a scope statement with the frequency written into the risk assessment policy and procedures, so an assessor can check the value against the document.
Inventory how CUI is processed, stored and transmitted
Map every place CUI enters, is held, moves or leaves the environment. Cover endpoints, servers, cloud services, backups, removable media, email, collaboration tools, printers and any hand-off to subcontractors. Compare this map with the asset inventory and data flow records your configuration management program keeps, and close any gaps. The output is a data flow diagram with a list of CUI locations that the assessor can trace back to real systems during examine and test activities.
Identify threats and unauthorized disclosure paths
For each CUI location, identify how it could be disclosed without authorization. Consider insider misuse, misdirected transmission, unmanaged devices, misconfigured storage, compromise of accounts, and loss of media. Use the findings from your vulnerability scans, incident records and audit logs as inputs rather than starting from a blank page. The output is a threat list tied to specific CUI assets, which lets a reviewer confirm that the assessment considered the actual ways CUI could be exposed.
Assess supply chain risk for CUI-handling suppliers
Identify every external provider that processes, stores, transmits or can reach CUI, including cloud services, managed service providers, maintenance vendors and software suppliers. For each, assess the risk that their handling of CUI could lead to unauthorized disclosure, using the contractual and security terms you hold. Requirement 03.11.01 expects supply chain risk to be addressed explicitly, and interviews will ask the personnel with supply chain responsibilities how they do this. The output is a supplier risk register linked to the CUI inventory.
Rate and record each risk
Score each identified risk using a method your organization defines and apply it the same way to every item. Record the likelihood basis, the impact on CUI confidentiality, existing safeguards and residual risk. Keep the method and the scoring rationale in the document, since reviewers test whether the process for conducting, documenting and reviewing the assessment works, not only its results. The output is a dated risk register that shows how each rating was reached.
Assign owners and record response decisions
For each risk, name an accountable owner and record the response decision: accept, mitigate, transfer or avoid. Where the decision is to mitigate, link the risk to the control, plan of action and milestones item or project that will address it. Feed the confirmed risks and their treatment into the system security plan so the plan describes the current risk posture of the CUI environment. The output is a response log with owners and a cross-reference to the system security plan, which assessors use to check that risk findings lead to decisions.
Set the review trigger and document the update cycle
Put the frequency value from the first step into the assessment schedule and define event-based triggers that force an earlier update, such as a significant system change, a new supplier handling CUI, a confirmed incident or a major vulnerability finding. Confirm the schedule with the contracting officer or agency if they specify one. The output is a documented update procedure and a completed review record that shows the assessment was revisited on time, which is the evidence reviewers ask for when they test the update requirement.

Evidence that satisfies a 03.11.01 risk assessment and how to keep it current

An assessor testing 03.11.01 looks for a risk assessment that exists, reflects the current CUI environment, and is refreshed on the organization's defined schedule. The cards below cover each artifact an assessor expects and the routine that keeps it accurate between assessments.

Risk assessment policy and procedures

The policy states why the organization assesses risk to CUI, who owns the assessment, and what triggers an update. The procedures describe the steps: how data flows are gathered, how threats and vulnerabilities are rated, how supplier risk is included, and how results reach management. Check that the policy names a role accountable for the update frequency, that the procedures match what staff actually do, and that both carry a version number, an approval date and a scheduled review date. An assessor will compare the two against the practice in the report.

Dated risk assessment report with CUI data flows

The report is the core artifact. It should show the date of assessment, the system boundary, and a map of where CUI is processed, stored and transmitted, including endpoints, cloud services, backups and transfers to outside parties. Each identified risk of unauthorized disclosure needs a likelihood and impact rating, the controls that address it, and a residual rating. Keep the data flow diagram tied to the current system security plan, so a new service that handles CUI appears in both documents.

Supply chain risk input and supplier records

03.11.01 explicitly covers supply chain risk, so the assessment must draw on information about suppliers that touch CUI. Maintain a register of external service providers, hosting and support vendors, and open-source component sources, recording what data each can reach, what security terms apply, and when their assurance was last reviewed. Ask each supplier for its current security documentation and attestation status, and log the request and response. Gaps found here should flow into the report as their own risk entries.

Defined update frequency and its approval

03.11.01 has one organization-defined parameter, the frequency at which the risk assessment is updated, and NIST leaves the value to the organization or the contracting federal agency. Record the chosen interval in the policy, state who approved it and when, and confirm it with the contracting agency if the contract sets one. Assessors check that the stated interval is the one followed. Also define event-driven triggers, such as a new CUI system, a significant change to the environment, or a material supplier event, because these cannot wait for the calendar.

Review and change logs showing updates

A change log proves the assessment is living. Each entry should record the version, the date, the author, the reason for the update (scheduled, triggered or correction), and which risks were added, rescored or closed. Store the log with the report in version control or a document management system that preserves history and prevents silent edits. Ask whether the log shows a dated update for every interval the organization defined, and where it does not, record the gap and the reason.

Meeting and sign-off records

Assessors often ask who reviewed the risk assessment and who accepted the residual risk. Keep meeting minutes or review records showing the attendees, the risks discussed, the decisions made, and the signature or electronic approval of the accountable official. Link each accepted residual risk to the person with authority to accept it, and link any risk that needs remediation to a tracked item, which the vulnerability monitoring and risk response processes will then manage. Confirm that the sign-off names the role, not only a person who may leave the organization.

What a 03.11.01 risk assessment costs to meet

This table lists each cost component of meeting 03.11.01, who is paid for it, whether it is one-time or recurring, and what moves it up or down. No dollar figures or durations are given because none are published for this requirement, so use the drivers and quote items to compare written proposals. Open-source tooling removes license spend, not the staff time needed to run the assessment.

Cost component	One-time or recurring	What drives it up or down	What to request in a written quote
Tooling and licenses	Recurring if commercial, one-time setup	Self-hosted AGPL or Apache tools such as CISO Assistant remove license fees, but hosting, patching and backup still need staff time	Itemized list of licenses, hosting resources, support subscriptions and who maintains each tool
Initial risk assessment effort (engineering and compliance staff)	One-time	Number of systems, CUI flows and enclaves in scope, and whether risk criteria already exist in the organization	Scope statement listing systems, data flows and assessment deliverables, with named roles and hours
Recurring risk assessment updates	Recurring at the organization-defined frequency	The frequency the organization sets for 03.11.01, the rate of system and threat change, and the number of trigger events that force an early update	Stated update frequency, triggers for out-of-cycle reviews and the owner for each update
Supply chain questionnaires and supplier reviews	Recurring per supplier review cycle	Number of suppliers that handle CUI or connect to CUI systems, questionnaire depth and how many suppliers answer without follow-up	Supplier count in scope, questionnaire template, review cadence and who reviews the responses
External assessment support	Recurring if engaged for each cycle	Whether the implementation partner prepares evidence only, or also runs internal reviews before an assessor visit	Written statement that the partner prepares evidence and does not issue assessment results or reports
Auditor sampling of records	Recurring per assessment	Volume of risk assessments, supplier reviews and update records the assessor samples, and how well records are organized	Assessor's stated sampling approach and the evidence package the organization must supply in advance
Remediation of risk findings	Variable, one-time or recurring	Number and severity of identified risks, and whether risk response is funded in the same plan	Clear separation of assessment work from remediation work, with each finding tracked to an owner

Open-source tools that support 03.11.01 risk assessment evidence

Risk assessment under 03.11.01 needs a documented method, a register of risks tied to CUI handling, and threat information that informs which risks matter. The three open-source tools below each cover one part of that chain. None of them performs the assessment on its own, and the organization still owns the risk decisions.

Framework-based assessment records with CISO Assistant

CISO Assistant (AGPL-3.0-only) ships more than 200 frameworks, including NIST CSF, and can run audits and compliance assessments against them with automatic mapping between frameworks. For 03.11.01, it can hold the risk register, link each risk to the affected NIST SP 800-171 requirements and record the review date, which supports the update-frequency evidence an assessor will ask for. Confirm whether the Rev. 3 requirement set and your organization-defined update frequency are configured as you need them, and check how the AGPL-3.0-only license applies to your use and any modifications you distribute. The tool does not decide which risks are acceptable.

Threat indicator correlation with MISP

MISP (AGPL-3.0-only) correlates indicators by exact match and by advanced patterns such as fuzzy hashes and CIDR overlaps, records sightings and synchronizes events between instances with sharing groups. Those records can show an assessor that threat information from outside the organization was reviewed and linked to the systems that process, store or transmit CUI. Its output can inform threat-based entries in the risk register. Confirm which sharing communities and feeds your organization is permitted to use, and review the AGPL-3.0-only obligations before running it as a service for others. MISP does not identify your CUI flows or score likelihood and impact.

Structured threat intelligence with OpenCTI

OpenCTI (Apache-2.0) stores threat intelligence as STIX-based entities, relationships and containers, and ingests data through connectors, TAXII, RSS, CSV and JSON feeds or manual upload. For 03.11.01, this gives a traceable record of which threat actors and campaigns target your sector, and how those relate to the assets in scope. That lineage helps justify the disclosure risks recorded in the assessment. Confirm which connectors your environment can run, how feed quality is checked, and whether the Apache-2.0 terms fit your deployment. OpenCTI does not perform the risk assessment or the supply chain review that 03.11.01 also requires.

Who owns the 03.11.01 risk assessment, who can prepare it and who assesses it

Your organization owns the 03.11.01 risk assessment. It is the party that decides which risks to the confidentiality of CUI are acceptable, which treatments apply, how often the assessment is updated (the organization-defined parameter for this requirement), and who signs it off. A partner or auditor can inform those decisions, but they cannot take them on your behalf. Assessors look for evidence that named leaders own the assessment and act on it.

Risk decisions and acceptance: Senior leaders decide which residual risks to accept and document the reasons, including any supply chain risks they choose not to treat immediately.
Update frequency: Set the defined interval in writing, and record who approved it and why it fits your change rate and contract obligations.
Sign-off and approval: Name the approver, record the date and keep the signed version as evidence.
Interview readiness: Staff with risk assessment and supply chain responsibilities must explain the process to an assessor in their own words.
Ongoing operation: Run the reassessment, track changes to CUI systems and feed results into planning and response.

Check that your assessment names an accountable owner, a defined frequency and a dated approval, and that the people named can describe their role without notes.

What buyers ask about 03.11.01 cost, effort and outside help

How much effort does the initial 03.11.01 risk assessment take?

No researched figure exists for the hours or weeks the first 03.11.01 assessment takes, so request that estimate in writing. The effort depends on the size of the CUI environment, the number of systems and data flows that process, store or transmit CUI, and whether a current risk assessment already exists. 03.11.01 asks for an assessment of the risk of unauthorized disclosure, including supply chain risk, so the first pass covers each CUI flow, the threats to it, and the likelihood and impact of disclosure. Much of the early work is collecting system inventories, data flow diagrams, existing security plans and supplier lists before any analysis begins. A fixed-scope quote should itemize these activities, name who performs each one, and list the artifacts the client must supply.

How often must the CUI risk assessment be updated, and who sets it?

Your organization sets the update frequency, because 03.11.01 has one organization-defined parameter for it. NIST does not assign a value. If a federal agency does not specify the value in the contract or agreement, the nonfederal organization must assign it to complete the requirement. Write the chosen interval into the risk assessment policy and the system security plan so an assessor can compare your practice to your stated value. Also define event-driven updates, such as a significant system change, a new supplier that handles CUI, or a material finding, because a fixed calendar alone may not reflect changing risk. Confirm with the contracting agency whether it has already specified a value before you set yours.

Can we perform the 03.11.01 risk assessment in-house?

Many organizations can perform the 03.11.01 risk assessment in-house if they have staff who understand the CUI environment and the threats to it. The requirement needs documented policy and procedures, an assessment of disclosure risk, supply chain input, and a record of updates. SP 800-171A Rev. 3 assesses this through interviews with personnel who hold risk assessment and supply chain risk management responsibilities, and through testing of the processes and mechanisms used to conduct, document, review and update the assessment. In-house teams often find it hard to review their own work objectively, keep scoring consistent, and maintain the update schedule. Decide early who owns the document, who reviews it, and how findings move into the plan of action and milestones.

What does an implementation partner need from us to start?

A partner needs accurate information about your environment and decisions that only your organization can make. Typical inputs include the CUI boundary, data flow descriptions, a current asset inventory, network diagrams, existing security plans and policies, the list of external service providers with their contract terms, and any prior assessment results. The partner also needs named owners who can answer questions, access to the staff who run the systems, and a decision on the frequency parameter. Ask the partner to list these inputs in the written scope with a due date for each. DeployOpen agrees scope, deliverables and timelines in writing before work starts, so any missing input should trigger a documented change to scope or schedule rather than an unrecorded delay.

Can a partner issue our 03.11.01 assessment or certify compliance?

No. A partner can prepare your systems, documentation and evidence for the 03.11.01 assessment, but it cannot issue an assessment result, attestation or certification. Only an independent assessor or certification body issues those. The organization owns its controls and remains responsible for their accuracy. The stakes are concrete for defense contractors: under the 32 CFR 170.24 scoring methodology, CMMC Level 2 practice 3.11.1 (RA.L2-3.11.1) is worth 3 points, and 32 CFR 170.21 does not allow it on a plan of action and milestones for Conditional status. Ask any partner to confirm in writing which tasks it performs and which the independent assessor performs.

How do we assess supply chain risk when suppliers will not share controls?

Start by recording which suppliers touch CUI, then assess the disclosure risk each one creates, even when a supplier will not share its controls. 03.11.01 explicitly includes supply chain risk, and Rev. 3 adds the supply chain risk management family, 03.17, to support that work. When a supplier declines to share control evidence, document the gap as a risk, limit the CUI it receives, review contract terms for security obligations and breach notice, and ask whether it holds independent attestations you can accept. Record the decision and name the executive who accepts any residual risk. Illustrative: a hosting provider that withholds its audit report may remain in use if the contract restricts CUI handling and a named executive accepts the residual risk in writing.

How DeployOpen scopes and prepares 03.11.01 risk assessment evidence

DeployOpen prepares the systems, documentation and evidence that support 03.11.01 Risk assessment inside your own infrastructure, under a written scope. Your organization owns the risk assessment and its conclusions, and an independent assessor or certification body issues any report or certificate.

How we scope

The written scope names the CUI systems, processing, storage and transmission paths the risk assessment must cover.
We confirm which third parties and supply chain dependencies fall inside the supply chain risk element of the assessment.
The scope records who sets the update frequency for the risk assessment, since that organization-defined parameter must be assigned for the requirement to be complete.

How we build

We set up the risk assessment policy, procedures and planning documents that assessors will examine for this requirement.
We configure the platforms that record, review and update risk assessments, such as CISO Assistant for audit and assessment tracking.
We test that the assessment process runs end to end, including review, dissemination and updates at the frequency you define.

How we hand over

You receive the risk assessment records, procedures, scope statement and update history mapped to the 03.11.01 determination statements.
We walk the personnel with risk assessment and supply chain responsibilities through the evidence they will be asked to explain.
Open items and gaps are listed in writing, so you can decide what to remediate before an assessor reviews the environment.

How we support

Ongoing support, upgrades and continuous testing are available as a retainer after handover.
Retainers can keep the risk assessment current as systems, suppliers and CUI flows change over time.
Assessment decisions, submissions and any independent assessment remain with your organization and the assessor you choose.

03.11.01 Risk assessment