Risk Business

Lyrics

[Intro] Yeah CMMC Level 2 Risk Assessment domain Three eleven on the track You cannot protect what you do not understand Let’s assess it [Verse 1 – Risk Assessments] First draw the boundary, know what you defend Every system and connection from beginning to end C.U.I processed, transmitted, or stored Know what could happen if the risk gets ignored Threats at the door, weaknesses inside Likelihood and impact, put them side by side Mission and assets, reputation too And the people depending on the work that you do Set the frequency, write it in the plan Assess on schedule, make sure people understand Internal systems, outside parties in the mix Service providers can introduce new risks Do not guess and do not assume Put the facts and the findings in the risk review Business level, system level, every phase Risk can change, so reassess it on defined days [Hook] Know the risk Know the score Find the weakness before it finds your door Scan the system Read the signs Fix the biggest problems first in line Know the risk Track the threat Do not leave a vulnerability unchecked Assess, scan, remediate That is how we keep the C.U.I safe [Verse 2 – Vulnerability Scanning] Now scan the network, every asset in scope Missing one device can unravel the rope Servers and desktops, laptops on the road Virtual machines carrying the workload Firewalls and switches, containers in the stack Printers on the network cannot slip through the cracks Applications too, whether purchased or designed Custom-built software needs a closer eye Define how often scans are going to run Not a one-time task when the audit has begun Schedule them wisely so the business stays alive But make sure every required system gets reviewed on time Keep the scanner current with the newest known flaws Updated definitions are part of the cause Patch levels, services, protocols, and ports Misconfigurations showing up in reports Remote computers cannot hide out of sight Scan them when connected and confirm they are right The threats keep changing, so the scan must too Fresh vulnerability data gives a clearer view [DJ Scratch] Assess it Scan it Rank it Track it Fix it Verify it Do not forget it [Hook] Know the risk Know the score Find the weakness before it finds your door Scan the system Read the signs Fix the biggest problems first in line Know the risk Track the threat Do not leave a vulnerability unchecked Assess, scan, remediate That is how we keep the C.U.I safe [Verse 3 – Vulnerability Remediation] Scan found a problem, now what will you do A list means nothing if you never follow through Identify the weakness, understand the effect Then use the risk assessment to decide what comes next Critical at the top, do not bury the lead Prioritize the flaws by the danger and need Some get patched, some mitigated another way Some risks may be transferred or accepted for the day But acceptance needs a reason written down Not a silent decision when nobody is around Document the choice and continue to review Because tomorrow’s threat can change what you knew Assign an owner, establish the date Track remediation and verify the state Do not close the ticket just because someone said Confirm the vulnerability is actually dead Every finding followed from beginning to end Risk-based action is the message that we send Assess it, scan it, then correct the flaw That is Risk Assessment under CMMC law [Bridge – Call and Response] What do we assess? Mission, people, systems, and assets What do we scan? Every required device and application What do we fix? The highest-risk vulnerabilities first What do we track? Every finding until the work is complete [Final Hook] Know the risk Know the score Find the weakness before it finds your door Scan the system Read the signs Fix the biggest problems first in line Set the schedule Run the scan Document the risk and follow the plan Assess, scan, remediate That is how we keep the C.U.I safe [Outro] Three eleven one Assess the risk Three eleven two Scan the system Three eleven three Remediate by risk CMMC Know the risk before the risk knows you