AC.L2-3.11.2[a] — Risk Assessment (Vulnerability Assessments)
Domain: Risk Assessment (RA) | Practice: RA.L2-3.11.2 | Objective ID: 3.11.2[a]
Assessment Objective: Vulnerabilities are identified and documented.
Summary
AC.L2-3.11.2[a] requires organizations to identify and document system and software vulnerabilities through periodic vulnerability assessments. Organizations must maintain a vulnerability registry tied to CUI systems.
Key Requirements
Documented vulnerability scanning process. Automated scanning tools configured and operational. Vulnerability database or registry maintained. Regular assessment cadence (at least annual). Cross-references to remediation efforts and POA&M.
NDS Support
Cyberwatch provides third-party vulnerability assessment and validation services to support AC.L2-3.11.2[a] compliance.