Security Assessment is the family that governs the compliance program itself: periodically assessing whether controls work, planning fixes, monitoring continuously, and maintaining the System Security Plan. Its four requirements carry 13 points.
It also contains the strangest requirement in NIST SP 800-171. Requirement 3.12.4, the System Security Plan, is worth zero points — the only unscored requirement in the standard — yet its absence means an assessment "could not be completed due to incomplete information." A requirement worth nothing that voids everything.
What the Security Assessment family covers
Security Assessment contains 4 requirements, numbered 3.12.1 to 3.12.4 in NIST SP 800-171 Revision 2. In CMMC Level 2 they carry the practice prefix CA.L2, so 3.12.1 appears as CA.L2-3.12.1.
3.12.1 requires periodic assessment of control effectiveness. 3.12.2 requires plans of action to correct deficiencies — the POA&M. 3.12.3 requires ongoing monitoring of controls. 3.12.4 requires developing, documenting and periodically updating the SSP. For templates, see the SSP template and the POA&M template.
| Requirement | What it requires | SPRS points | POA&M |
|---|---|---|---|
| 3.12.1 | Periodically assess security controls to determine if they are effective | 5 | No |
| 3.12.2 | Develop and implement plans of action to correct deficiencies and reduce or eliminate vulnerabilities | 3 | No |
| 3.12.3 | Monitor security controls on an ongoing basis to ensure their continued effectiveness | 5 | No |
| 3.12.4 | Develop, document and periodically update system security plans | Unscored | Never |
Point values from the DoD Assessment Methodology v1.2.1. POA&M eligibility under 32 CFR 170.21.
What it costs you in SPRS points
The family puts 13 of the 313 deductible points in the SPRS score at risk. The five-point requirements are 3.12.1 and 3.12.3. 3.12.2 is worth three points.
The five-point requirements are 3.12.1 and 3.12.3: assessing controls periodically and monitoring them continuously. These are the requirements that keep an SPRS score honest between formal assessments.
The zero-point trap
Under the DoD Assessment Methodology, the score starts at 110 and points are subtracted for unimplemented requirements. 3.12.4 has no points to subtract. But an assessor cannot evaluate the other 109 requirements without knowing the boundary and how each requirement is met, which is what the SSP provides. No SSP, no valid score.
That is why 3.12.4 is one of the six requirements that can never be placed on a POA&M. It is also why the SSP is the first document every reviewer asks for. A thin or outdated SSP does not fail 3.12.4 by itself, but it undermines every other requirement it describes.
Continuous monitoring without a large team
Requirements 3.12.1 and 3.12.3 do not require a security operations center. They require knowing whether controls still work. A quarterly review of a sample of requirements, a monthly look at key indicators — patch compliance, MFA coverage, failed logons, backup success — and an annual full self-assessment, all recorded, is a realistic program for most small and mid-sized contractors. Our managed services run this cadence for clients.
What you can and cannot defer
Under 32 CFR 170.21 only one-point requirements may be placed on a POA&M, with the single exception of 3.13.11 when encryption exists but is not FIPS-validated. In this family that makes nothing eligible for deferral. 3.12.4 is on the list of six requirements that can never be deferred, whatever the point value.
3.12.2 is worth three points and cannot be deferred — an organization cannot defer having a plan of action. 3.12.4 can never be deferred. That leaves nothing in this family eligible for a POA&M.
Evidence assessors expect
Assessors work at the level of the objectives in NIST SP 800-171A and use examine, interview and test. For this family, have the following ready — the full evidence package checklist covers all 14 families:
- A current SSP with boundary, environment, asset categories and an implementation statement per requirement.
- A POA&M with owners, milestones and dates.
- Records of periodic control assessments, internal or external.
- Continuous monitoring outputs such as dashboards, reports and review records.
- Revision history showing the SSP is updated.
Frequently asked questions
Why is the SSP worth zero points?
Because it is a precondition for scoring rather than a control to be scored. Without it, the assessment cannot produce a valid score at all.
How often must the SSP be updated?
NIST SP 800-171 says periodically. Annually and after significant changes is the common practice.
Does an internal self-assessment satisfy 3.12.1?
Yes, if it is documented, periodic and actually tests whether controls are effective.
Is the POA&M the same as 3.12.2?
Yes. 3.12.2 requires plans of action to correct deficiencies; the POA&M is how almost every organization satisfies it.