RA-3(3)

Requirement

Determine the current cyber threat environment on an ongoing basis using [Assignment: organization-defined means].

Discussion

The threat awareness information that is gathered feeds into the organization's information security operations to ensure that procedures are updated in response to the changing threat environment. For example, at higher threat levels, organizations may change the privilege or authentication thresholds required to perform certain operations.

NIST 800-53A Assessment Guidance

Examine

[SELECT FROM: Risk assessment policy; security planning policy and procedures; procedures addressing organizational assessments of risk; risk assessment; risk assessment results; risk assessment reviews; risk assessment updates; risk reports; system security plan; other relevant documents or records].

Interview

[SELECT FROM: Organizational personnel with risk assessment responsibilities; organizational personnel with security responsibilities].

Test

[SELECT FROM: Organizational processes for risk assessment; mechanisms supporting and/or conducting, documenting, reviewing, disseminating, and updating the risk assessment].

ID	Assessment Objectives
RA-03(03)	the current cyber threat environment is determined on an ongoing basis using <RA-03(03)_ODP means>.

Our CMMC Overview Course simplifies CMMC. Enroll so you can make informed decisions!