CA.L2-3.12.1
Security Control Assessment
Source and approval
CMMC Assessment Guide — Level 2 · Revision 2.13
Publisher approved · Complete cited source edition 2026-10-31
Read the official guideSee CA.L2-3.12.1 in the reference catalog with its NIST cross-references
Official requirement
Periodically assess the security controls in organizational systems to determine if the controls are effective in their application.
Assessment objectives
a. the frequency of security control assessments is defined; and
b. security controls are assessed with the defined frequency to determine if the controls are effective in their application.
Implementation guidance
Editorial examples to help you plan. Adapt them to your environment; the official requirement and objectives remain authoritative.
In plain language
Periodically assess security controls to determine whether they are effective.
Implementation example
Example from the source assessment guide (not a mandatory implementation): You are in charge of IT operations. You need to ensure that the security controls implemented within the system are achieving their objectives [b]. Taking the requirements outlined in your SSP as a guide, you conduct annual written reviews of the security controls to ensure they meet your organization’s needs. When you find controls that do not meet requirements, you propose updated or new controls, develop a written implementation plan, document new risks, and execute the changes.
Evidence examples
Examples suggested by the source guide (not an exhaustive or mandatory checklist): Security assessment and authorization policy; procedures addressing security assessment planning; procedures addressing security assessments; security assessment plan; system security plan; other relevant documents or records
Common mistakes
Confirming that a control exists without evaluating whether it achieves its intended result.