Security assessment.

01What this family protects

CA protects the organization’s own ability to know whether its security controls are actually working — and to write that knowledge down where an assessor, a new IT hire, or the organization itself a year from now can find it. Without a current SSP, every other family’s implementation lives only in the memory of whoever set it up. CA is what turns that memory into a document.

02The rule says

All 4 requirements, condensed to their operative sentence. NIST SP 800-171 Rev. 2 §3.12 has the full text and discussion for each.

03In practice

The SSP (3.12.4) is the anchor document: it describes the system boundary, the environment the system operates in, how each Level 2 requirement is implemented (or planned, where a POA&M item is open), and how the system connects to anything else — an ESP’s tooling, a prime’s portal, a cloud service. NIST does not prescribe a specific format or template; what matters is that the information required is actually there and kept current as things change.

Periodic assessment (3.12.1) means checking, on some defined cadence, that the controls described in the SSP are actually operating as described — not assuming they still are because they did once. Ongoing monitoring (3.12.3) is the lighter-weight, more continuous cousin of the same idea: dashboards, periodic log review, or vulnerability-scan cadence that catches drift between formal assessments.

Plans of action (3.12.2) is where gaps found during assessment or monitoring get tracked to closure — the practice that produces a POA&M when Level 2 scoring allows one. A plan of action can live inside the SSP or as a separate document; either is fine, as long as it’s traceable.

04Where it fails

The usual gap is an SSP that describes an environment from a year or two ago: a server that’s been decommissioned, an MSP relationship that’s since changed, a CAD/CAM system that moved to a new vendor. None of that is a crisis on its own, but an assessor comparing the document to the live environment will notice, and every mismatch becomes a question about what else in the SSP is stale.

A second gap is treating 3.12.1’s periodic assessment as something that only happens once, right before a certification assessment, rather than as a standing internal practice. The rule says “periodically,” not “once, under deadline pressure.”

05What evidence may look like

The SSP itself, with a visible revision history; a record of internal assessment activity (a checklist, a completed worksheet, meeting notes from a review session); a plan-of-action document or tracker showing open items and target dates; and evidence that monitoring is actually happening — a dashboard export, a log-review cadence, or a vulnerability-scan report with a date on it.

06At the shop

07Commonly confused with

The Assessment. CA is the family of ongoing internal practices — assessing, monitoring, planning corrective action, maintaining the SSP. “The assessment” is the specific certification or self-assessment event where a C3PAO, DIBCAC, or the organization itself scores those practices against the 110 requirements. CA feeds the assessment; it isn’t the same thing as it.

A POA&M. The SSP (3.12.4) describes the system as it is, or is planned to be. A POA&M tracks specifically what is not yet MET and the plan to close it. The SSP references the POA&M where relevant; it is not the same document, and 3.12.4 itself can never be the thing a POA&M is tracking.

08Cross-desk links

None load-bearing for this family. The SSP and its assessment practices are specific to the CMMC program’s own machinery, covered in full on this desk’s System and Levels pages.

09Sources