CMMC Risk Assessment (3.11 RA): 3 requirements, scanning and remediation

Level 1 does not ask you to scan. Risk assessment is one of the eight families that only appear from Level 2 up, so the 15 FAR 52.204-21 requirements behind a Level 1 self-assessment never reach 3.11.1 to 3.11.3.

At Level 2 all three apply, and 3.11.2 is where implementations diverge most. It does not name an interval, a tool or a scan type — it says periodically and when new vulnerabilities affecting the system are identified, which means your period has to be written down and your process has to react to advisories rather than only to the calendar. 3.11.3 then ties remediation back to the assessment, so a scan report nobody triaged is a finding waiting to happen.

Level 3 layers enhanced requirements from NIST SP 800-172 onto a Final Level 2, assessed by DIBCAC.

Uniqcli does not assess risk, run scans, triage findings or produce a risk assessment — none of that is a supplier function, and anyone offering it is offering you a consultancy engagement under an equipment invoice. The assessment, the periodicity, the triage and the remediation decisions are your program's. The program stays yours to run — the policy, the decisions, the cadence and the evidence an assessor actually reads. What a supplier puts behind it is the tooling, the licensing and the integration work.

The licensing is genuinely quotable. Vulnerability-scanning subscriptions ride the same distribution as everything else we sell: Tenable's Nessus, Nessus Manager and Passive Vulnerability Scanner lines are priced across hundreds of rows in our catalog, Sophos carries vulnerability-scanning add-ons, and McAfee's scanning modules appear alongside them. Software is sourced through authorized US distribution rather than held on a shelf, so availability language does not apply to it. Qualys and Rapid7 are not in our catalog at all, and we will say so rather than promise to find them. Naming a manufacturer describes the market, not a Uniqcli partnership or endorsement.

The deployment leg is real too. Standing a scanning estate up — sizing and racking the collectors, configuring credentialed access to the systems in scope, and recording what was changed — is work we scope alongside the licenses. It produces a working scanner. It does not produce a finding, a priority or a decision.

We are not an assessor, a C3PAO or an RPO, and we hold no CMMC level. We quote against the SSP you already have — hardware, licensing and the integration work around them — not a generic bundle assembled around a level number.