Mapped to NIST 800-171 Requirement: 3.11.1
CMMC Assessment Objective: RA.L2-3.11.1[b]
What This Control Means
After identifying your CUI-related risks (RA.L2-3.11.1[a]), you must document:
• What risks were identified
• Where they exist (e.g., systems, locations, personnel)
• How they affect the processing, storage, and transmission of CUI
• What methods were used to evaluate and classify those risks
This documentation forms the core of your risk management strategy.
Why It Matters
Without documented risks:
• You can’t justify your safeguards or security decisions
• You may overlook serious threats to CUI
• Assessors will view your risk program as incomplete
• There’s no baseline for mitigation or remediation planning
Documentation shows your organization has formally acknowledged the threats to CUI.
How to Implement It
1. Capture Results from Your Risk Assessment
• Include risk descriptions, likelihood, impact, and severity scores
• Tie each risk to specific CUI systems, locations, or workflows
2. Use a Risk Register or Matrix
• List each risk with:
◦ Risk source (technical, human, environmental, etc.)
◦ CUI asset or process affected
◦ Risk owner
◦ Date assessed and next review
3. Include Supporting Materials
• Threat models
• Vulnerability scan summaries
• Insider threat indicators
• Cloud vendor risk evaluations (if applicable)
4. Link to Compliance Documentation
• Reference risks in your SSP, POA&M, and system risk profile
Evidence the Assessor Will Look For
• A documented risk assessment or risk register identifying CUI-specific risks
• Clear links between risk items and CUI system components
• Notes from internal or external assessment activities
• Reference to risk documentation in other compliance artifacts (e.g., SSP, POA&M)
Common Gaps
• General risk documents that don’t mention CUI at all
• No formal register or evaluation method
• Risks are known internally but undocumented
• Risks identified without linking them to specific CUI systems
How Cuick Trac Helps
Cuick Trac supports this requirement by:
• Generating and maintaining a documented CUI-specific risk register
• Linking each risk to a system, data flow, or user role
• Storing risk identification outputs with timestamps and scoring
• Aligning with NIST 800-30 and CMMC guidance for structured evaluation
• Making documentation easy to retrieve for audits and internal reviews
With Cuick Trac, you don’t just identify CUI risks—you document and own them.
Final CTA
If it’s not documented, it’s not defensible.
Schedule a Cuick Trac demo to document your CUI-related risks and build a foundation for compliant risk management.