Periodically assess risk to operations, assets, and individuals
Risk Assessment · NIST SP 800-171 Rev 2
Requirement
Periodically assess the risk to organizational operations (including mission, functions, image, or reputation), organizational assets, and individuals, resulting from the operation of organizational systems and the associated processing, storage, or transmission of CUI
Discussion
Clearly defined system boundaries are a prerequisite for effective risk assessments. Such risk assessments consider threats, vulnerabilities, likelihood, and impact to organizational operations, organizational assets, and individuals based on the operation and use of organizational systems. Risk assessments also consider risk from external parties (e.g., service providers, contractors operating systems on behalf of the organization, individuals accessing organizational systems, outsourcing entit
How this affects your SPRS score
Under the DoD Assessment Methodology, a perfect SPRS score is 110. If this control is not met, 3 points is subtracted from your score.
Want your estimated SPRS score?
Answer 15 quick questions covering the highest-impact controls and get an instant estimate.
Estimate my SPRS score →Source: NIST SP 800-171 Rev 2 (public domain) · SPRS weighting per the DoD Assessment Methodology · This is reference information, not an official assessment.