Control 3.11.1

★What This Means in Plain English

You must regularly evaluate the risks to your organization from operating IT systems that process CUI. This means identifying threats, vulnerabilities, and potential impacts, and keeping this assessment current.

✓How Petronella Implements This Control

Petronella Technology Group implements this control through:

• Annual comprehensive risk assessment aligned with NIST SP 800-30 methodology
• Continuous vulnerability scanning using Sophos XDR and CrowdStrike Falcon
• Threat intelligence feeds from Arctic Wolf and CrowdStrike informing risk analysis
• Risk register maintained in ComplianceArmor with risk owners and mitigation plans
• Quarterly risk review meetings with management to update risk priorities

🔎Assessment Guidance

Assessors will review the risk assessment methodology and most recent assessment, verify that risks are identified with likelihood and impact ratings, check that the risk register is current, and confirm that risk assessments are performed at least annually.

⚠Common Implementation Gaps

• No documented risk assessment ever performed
• Risk assessment performed once and never updated
• No formal risk assessment methodology
• Risk register missing or not maintained
• Risk assessment does not specifically address CUI

⇄Cross-Framework Mapping