NIST Special Publication 800 NIST SP 800-171r3

The Security Requirements

03.11.01: Risk Assessment

Establishing the system boundary is a prerequisite to assessing the risk of the unauthorized disclosure of CUI. Risk assessments consider threats, vulnerabilities, likelihood, and adverse impacts to organizational operations and assets based on the operation and use of the system and the unauthorized disclosure of CUI…

03.11.02: Vulnerability Monitoring and Scanning

Organizations determine the required vulnerability scanning for system components and ensure that potential sources of vulnerabilities (e.g., networked printers, scanners, and copiers) are not overlooked. Vulnerability analyses for custom software may require additional approaches, such as static analysis, dynamic analysis, or binary analysis…

03.11.03: Withdrawn

Incorporated into 03.11.02.

03.11.04: Risk Response

This requirement addresses the need to determine an appropriate response to risk before generating a plan of action and milestones (POAM) entry.