“Usually applies to” lists what a typical moving company has in scope for each requirement; your own scope decides. See what's in scope.
“May wait on a POA&M” applies only if your overall score is at least 88 of 110, and the gap must then be closed within 180 days. See how Level 2 works.
3.11.1 Assess your risks
On a schedule you set, at least once a year, think through what could go wrong with DoD shipment information, how likely it is and how bad it would be, and write it down.
Usually applies to: Your whole operation: everything in scope, plus the people and places.
3 points if not met Cannot wait on a POA&M
Official wording: “Periodically assess the risk to organizational operations (including mission, functions, image, or reputation), organizational assets, and individuals, resulting from the operation of organizational systems and the associated processing, storage, or transmission of CUI.”
3.11.2 Scan for weaknesses
Regularly, and at least once a year, scan your computers, network and software for known security weaknesses, and again when new ones are announced.
Usually applies to: Office computers, laptops and servers, the router, firewall and Wi-Fi equipment, and any website or portal you run. Your IT company or a scanning service usually does the scanning.
5 points if not met Cannot wait on a POA&M
Official wording: “Scan for vulnerabilities in organizational systems and applications periodically and when new vulnerabilities affecting those systems and applications are identified.”
3.11.3 Fix what you find
Fix the weaknesses the scans find, the most serious first.
Usually applies to: Whatever the scans find, on the same systems.
1 point if not met May wait on a POA&M
Official wording: “Remediate vulnerabilities in accordance with risk assessments.”
Sources: official wording, NIST SP 800-171 Rev 2; points, 32 CFR 170.24; plans of action, 32 CFR 170.21. The plain-English explanations are ours.
