Periodically assess the risk to organizational operations, assets, and individuals
📖 What This Means
This practice requires organizations to regularly evaluate the risks that could affect their operations, assets, and people. It’s about understanding what could go wrong, how likely it is to happen, and what the impact would be if it did. For example, a company might assess the risk of a cyberattack on their customer data or the risk of a natural disaster disrupting their operations. By doing this periodically, organizations can stay ahead of potential threats and take steps to mitigate them before they cause harm. Think of it like checking the weather forecast before planning an outdoor event—it helps you prepare for what might come.
🎯 Why It Matters
Failing to assess risks can leave organizations vulnerable to cyberattacks, data breaches, and operational disruptions. For instance, the 2021 Colonial Pipeline ransomware attack caused widespread fuel shortages and cost millions in recovery. The DoD emphasizes this control because protecting Controlled Unclassified Information (CUI) and ensuring mission readiness are critical. Without periodic risk assessments, organizations may miss evolving threats, leading to financial losses, reputational damage, and non-compliance with CMMC requirements.
✅ How to Implement
- 1. Use cloud-native tools like AWS Inspector or Azure Security Center to perform automated vulnerability scans.
- 2. Configure logging and monitoring to track access and changes to cloud resources.
- 3. Review cloud provider security advisories and update configurations accordingly.
- 4. Conduct periodic penetration testing on cloud-hosted applications.
- 5. Document findings in a risk assessment report and share with stakeholders.
📋 Evidence Examples
Risk Assessment Report
Vulnerability Scan Results
Remediation Plan
Audit Logs
Training Records
📝 SSP Guidance
Use this guidance when writing the System Security Plan (SSP) narrative for this control.
How to Write the SSP Narrative
For RA.L2-3.11.1 ("Periodically assess the risk to organizational operations, assets, and individuals"), your SSP narrative should specifically describe: (1) the tools and technologies you use to implement this control, (2) the configuration or process that enforces it, (3) who is responsible for maintaining it, and (4) what evidence proves it's working. Describe your risk assessment program, including methodology, frequency, vulnerability scanning tools and schedule, insider threat monitoring, and how risk decisions are documented. Be specific -- name your actual products, settings, and responsible personnel.
Example SSP Narratives
"RA.L2-3.11.1 is implemented using cloud-native controls. [Organization] uses [specific cloud service/feature] to periodically assess the risk to organizational operations, assets, and individua.... The configuration is managed through [Azure Policy/AWS Config/Terraform] and monitored via [SIEM tool]. Responsible party: [IT Security Manager]. Evidence: [specific artifact, e.g., 'Azure AD Conditional Access policy screenshot, CloudTrail logs']."
"RA.L2-3.11.1 is implemented through on-premise infrastructure controls. [Organization] uses [Active Directory/Group Policy/specific tool] to periodically assess the risk to organizational operations, assets, and individua.... Configuration is documented in [location] and audited [frequency]. Responsible party: [System Administrator]. Evidence: [specific artifact, e.g., 'Group Policy export, Windows Event logs']."
"RA.L2-3.11.1 is implemented across both cloud and on-premise environments. [Organization] uses [Azure AD Connect/hybrid tool] to ensure consistent enforcement. Cloud resources are managed via [cloud tool] and on-premise systems via [on-prem tool]. Both environments report to [centralized SIEM]. Responsible party: [IT Director]. Evidence: [artifacts from both environments]."
System Boundary Considerations
- • Define the risk assessment scope (CUI systems and supporting infrastructure)
- • Document vulnerability scanning coverage
- • Specify risk register maintenance process
- • Ensure this control covers all systems within your defined CUI boundary where periodically assess the risk to organizational operations, assets, and individuals applies
- • Document any systems where this control is not applicable and explain why
Key Documentation to Reference in SSP
- 📄 Risk Assessment Policy
- 📄 Risk assessment report
- 📄 Risk register
- 📄 Vulnerability scan reports
- 📄 Evidence artifacts specific to RA.L2-3.11.1
- 📄 POA&M entry if control is not fully implemented
What the Assessor Looks For
The assessor will review your risk assessment methodology, verify vulnerability scanning frequency and coverage, check that identified risks are tracked in a risk register, and confirm executive risk acceptance decisions are documented.
💬 Self-Assessment Questions
Use these questions to assess your compliance. Each "NO" answer provides specific remediation guidance.
Question 1: Do you have a documented risk assessment policy?
Question 2: Are vulnerability scans performed at least monthly?
Question 3: Are risks categorized by severity and impact?
Question 4: Is there a remediation plan for identified risks?
Question 5: Are risk assessment findings reviewed and updated quarterly?
⚠️ Common Mistakes (What Auditors Flag)
1. Not scanning all systems
2. Outdated risk assessments
3. No remediation plan
4. Inconsistent reporting
5. Ignoring insider threats
📚 Parent Policy
This practice is governed by the Risk Assessment Policy