Assessment NOTES: A CMMC assessor may want to review, observe, or test the following

·  Organizational policy and procedures related to Risk Assessment to determine what is assessed and how often risk assessments are performed.

·  Guidance used to implement the policy for risk assessments, and specifically the risk assessment of processing, storing, and transmission of CUI.  

·  Other authoritative sources of guidance the organization used such as NIST 800-30 - Guide for Conducting Risk Assessments.  

Typically, risk assessments are part of an ongoing process and integrated into change control processes and procedures, thus evidence may be requested such as logs, action reports or planned activities.

Threat Actors:   

i) may use an open source scanning tool against your public-facing infrastructure in the hopes of discovering an unpatched vulnerability

ii) may exploit any unpatched vulnerabilities and therefore compromise your entire network

·  Organizational policy and procedures related to Vulnerability Scanning to determine how often scans are run and if the results of the scans are provided to system owners in a timely manner.

·  List of known vulnerabilities to determine if updated within a defined frequency and when new vulnerabilities are discovered or announced by a third party.

·  Other processes that address, after actions, including the assessment of risk to organizational resources where patches or updates are not implemented.