03.11 Risk Assessment (RA)

Phase 1 - A suggested method would be to include in your policy, a statement that you will maintain a documented risk assessment process for all systems handling CUI. This process will adhere to NIST 800-171 Revision 3 guidelines, specifically focusing on the Risk Assessment family of controls. We will regularly identify, analyze, and document potential risks to CUI, including both internal and external threats. Our analysis will consider both the likelihood of a risk occurring and the potential impact it could have on the confidentiality, integrity, and availability of CUI. Based on this assessment, we will implement and maintain appropriate safeguards to mitigate these identified risks to an acceptable level, and we will review and update this risk assessment at least annually or whenever significant changes occur to our systems or environment.