This objective requires your organization to identify security flaws and vulnerabilities in your systems and applications—especially those that process, store, or transmit Controlled Unclassified Information (CUI)—so they can be mitigated or corrected promptly.