RA.L2-3.11.3
Vulnerability Remediation
Source and approval
CMMC Assessment Guide — Level 2 · Revision 2.13
Publisher approved · Complete cited source edition 2026-10-31
Read the official guideSee RA.L2-3.11.3 in the reference catalog with its NIST cross-references
Official requirement
Remediate vulnerabilities in accordance with risk assessments.
Assessment objectives
a. vulnerabilities are identified; and
b. vulnerabilities are remediated in accordance with risk assessments.
Implementation guidance
Editorial examples to help you plan. Adapt them to your environment; the official requirement and objectives remain authoritative.
In plain language
Remediate vulnerabilities according to the organization's risk assessments.
Implementation example
Example from the source assessment guide (not a mandatory implementation): You are a system administrator. Each quarter you receive a list of vulnerabilities generated by your company ’s vulnerability scanner [a]. You prioritize that list and note which vulnerabilities should be targeted as soon as possible as well as which vulnerabilities you can safely defer addressing at this time. You document the reasoning behind accepting the risk of the unremediated flaws and note to continue to monitor these vulnerabilities in case you need to revise the decision at a later date [b].
Evidence examples
Examples suggested by the source guide (not an exhaustive or mandatory checklist): Risk assessment policy; procedures addressing vulnerability scanning; risk assessment; system security plan; security assessment report; vulnerability scanning tools and associated configuration documentation; vulnerability scanning results; patch and vulnerability management records; other relevant documents or records
Common mistakes
Closing a vulnerability ticket without applying and verifying an effective remediation.