NIST SP 800-171 Rev 2 · 3.12 Security Assessment

3.12.1 Periodic security control assessment

Periodically assess the security controls in organizational systems to determine if the controls are effective in their application.

SPRS weight: 5; 5 points deducted from 110 when not implemented.
CMMC level: L2; Level 2 only; not among the 17 Level 1 practices.
Assessment objectives: 2; From NIST SP 800-171A, each one a “determine if” an assessor answers.

What an assessor checks

NIST SP 800-171A breaks 3.12.1 into 2 objectives. Every one has to be met for the requirement to be met; a partial answer scores as not implemented.

[a]Determine if the frequency of security control assessments is defined.
[b]Determine if security controls are assessed with the defined frequency to determine if the controls are effective in their application.

Examine: [SELECT FROM: Security assessment and authorization policy; procedures addressing security assessment planning; procedures addressing security assessments; security assessment plan; security plan; other relevant documents or records].
Interview: [SELECT FROM: Personnel with security assessment responsibilities; personnel with information security responsibilities].
Test: [SELECT FROM: Mechanisms supporting security assessment, security assessment plan development, and security assessment reporting].

Not POA&M-eligible: above the 1-point ceiling · 5 points deducted

Worth 5 points. No requirement over 1 point may appear on a Level 2 POA&M, so this has to be closed before the assessment.

A POA&M is only permitted at a score of 88 or above, and closes in one 180-day window. Check a full gap list or compute your score.

This page and the MacTech CMMC MCP server render the same dataset. Ask your assistant and it will answer from the methodology, not from memory.

lookup_control 3.12.1
get_assessment_objectives 3.12.1
generate_poam_entries ["3.12.1"]

From MacZine