CMMC RM.2.143 - Remediate Vulnerabilities identified in Risk Assessments

CMMC RM.2.143 - Remediate Vulnerabilities identified in Risk Assessments

Requirement text: RM.2.143: Remediate vulnerabilities in accordance with risk assessments.

DISCUSSION FROM SOURCE: DRAFT NIST SP 800-171 R2
Vulnerabilities discovered, for example, via the scanning conducted in response to RM.2.142,
are remediated with consideration of the related assessment of risk. The consideration of
risk influences the prioritization of remediation efforts and the level of effort to be expended
in the remediation for specific vulnerabilities.

CMMC CLARIFICATION
Review the prioritized list of vulnerabilities generated from the vulnerability scanner. Not
all vulnerabilities may affect an organization the same. Review the risks of not remediating
the discovered vulnerabilities. The organization should build upon the prioritized list and
develop a prioritized mitigation plan for closing the vulnerabilities identified and track their
completion.

Example
You are in charge of IT at your organization. Part of your job is to look for weaknesses in
your software that may provide ways for hackers to get into your network and do harm. You
perform vulnerability scans to try and find these weaknesses. The output of a scan is a list
of the potential weaknesses, also called vulnerabilities. You should review the
vulnerabilities and determine how they will affect your organization. You should create a
prioritized list of the vulnerabilities you should fix, fix them, and record a completion date
and time by each item. If you decide not to fix them, you should document the reasoning,
and you should continue to monitor these vulnerabilities.

References
• NIST SP 800-171 Rev 1 3.11.3
• CIS Controls v7.1 3.7
• NIST CSF v1.1 RS.MI-3
• CERT RMM v1.2 VAR:SG3.SP1
• NIST SP 800-53 Rev 4 RA-5

    • Related Articles

    • CMMC RM.3.144 - Perform Risk Assessments Periodically

      Requirement text: RM.3.144: Periodically perform risk assessments to identify and prioritize risks according to the defined risk categories, risk sources, and risk measurement criteria. DISCUSSION FROM SOURCE: NIST CSF V1.1 The organization ...

    • Risk Assessment: SP 800-171 Security Family 3.11

      Companies are dependent upon information technology and associated systems. While the increasing number of information technology products used in various companies and industries can be beneficial, in some instances they may also introduce serious ...

    • CMMC RM.2.141 - Periodically Assess Risk to Organizational Operations

      Requirement text: RM.2.141: Periodically assess the risk to organizational operations (including mission, functions, image, or reputation), organizational assets, and individuals, resulting from the operation of organizational systems and the ...

    • CMMC RM.3.146 - Implement Risk Mitigation Plans

      Requirement text: RM.3.146: Develop and implement risk mitigation plans. DISCUSSION FROM SOURCE: CERT RMM V1.2 When the consequences of risk exceed the organization’s risk thresholds and are determined to be unacceptable, the organization must act to ...

    • CMMC RM.4.148 - Manage Supply Chain Risk

      Requirement text: RM.4.148: Develop and update as required, a plan for managing supply chain risks associated with the IT supply chain. DISCUSSION FROM SOURCE: DRAFT NIST SP 800-171B The growing dependence on products, systems, and services from ...