RA.L2-3.11.1
RIsk Assessments
Source and approval
CMMC Assessment Guide — Level 2 · Revision 2.13
Publisher approved · Complete cited source edition 2026-10-31
Read the official guideSee RA.L2-3.11.1 in the reference catalog with its NIST cross-references
Official requirement
Periodically assess the risk to organizational operations (including mission, functions, image, or reputation), organizational assets, and individuals, resulting from the operation of organizational systems and the associated processing, storage, or transmission of CUI.
Assessment objectives
a. the frequency to assess risk to organizational operations, organizational assets, and individuals is defined; and
b. risk to organizational operations, organizational assets, and individuals resulting from the operation of an organizational system that processes, stores, or transmits CUI is assessed with the defined frequency.
Implementation guidance
Editorial examples to help you plan. Adapt them to your environment; the official requirement and objectives remain authoritative.
In plain language
Periodically assess risks to operations, assets, and people from using systems that handle controlled information.
Implementation example
Example from the source assessment guide (not a mandatory implementation): You are a system administrator. You and your team members are working on a big government contract requiring you to store CUI. As part of your periodic (e.g., annual) risk assessment exercise, you evaluate the new risk involved with storing CUI [a,b]. When conducting the assessment you consider increased legal exposure, financial requirements of safeguarding CUI, potentially elevated attention from external attackers, and other factors. 173 NIST SP 800-30, Guide for Conducting Risk Assessments, September 2012. After determining how storing CUI affects your overall risk profile, you use that as a basis for a conversation on how that risk should be mitigated.
Evidence examples
Examples suggested by the source guide (not an exhaustive or mandatory checklist): Risk assessment policy; security planning policy and procedures; procedures addressing organizational risk assessments; system security plan; risk assessment; risk assessment results; risk assessment reviews; risk assessment updates; other relevant documents or records
Common mistakes
Equating a vulnerability scan with the full organizational risk assessment.