03.12.01 Security assessment
Assessing the security requirements for the system and its environment at a defined frequency to determine whether they are satisfied: the organization's periodic assessment against SP 800-171 itself.
03.12 Security assessment and monitoring
Rev. 3 security assessment and monitoring requirements: periodic assessment of the requirements, plans of action and milestones, continuous monitoring and agreements for exchanging CUI with other systems.
03.12.02 Plan of action and milestones
Keeping a plan of action and milestones (POA&M) that records planned remediation of weaknesses found in assessments and of known vulnerabilities, updated from assessments, audits and continuous monitoring.
03.12.03 Continuous monitoring
Developing and implementing a system-level continuous monitoring strategy that combines ongoing monitoring with security assessments.
03.12.05 Information exchange
Approving and managing exchanges of CUI with other systems through agreements such as interconnection security agreements or memoranda of understanding, documenting interfaces, requirements and responsibilities, and reviewing agreements on schedule; new in Rev. 3.
