NIST 800-171 Controls · Risk Assessment
RA.2.003 — Remediate Vulnerabilities Per Risk Assessments
Remediate vulnerabilities in accordance with risk assessments.
What RA.2.003 means in plain English
Finding vulnerabilities is only half the job — you have to actually fix them. When your vulnerability scans find a critical problem, patch it or mitigate it based on how severe it is. Critical and High issues should be fixed within 30 days. If you cannot fix something immediately, document it in your Plan of Action and Milestones (POA&M) with a target date and who is responsible. Do not just run scans and ignore the results — that is worse than not scanning at all because it shows you knew and did nothing.
The assessment question
“Do you remediate identified vulnerabilities based on their risk severity within defined timeframes (e.g., Critical within 14 days, High within 30 days), and do you track open vulnerabilities in a Plan of Action and Milestones (POA&M)?”
How to implement RA.2.003
- Establish remediation timeframes in your Vulnerability Management Procedure: Critical = 14 days, High = 30 days, Medium = 90 days, Low = next scheduled maintenance window.
- After each vulnerability scan, create a remediation task list in your POA&M spreadsheet: vulnerability ID, affected system, severity, owner, planned fix date, and status.
- Apply patches promptly using Windows Update for Servers and workstations, or WSUS if you have it. For third-party software, use tools like Patch My PC (free for home, affordable for business) or Ninite Pro.
- After applying patches or mitigations, re-scan the affected systems to verify the vulnerability is actually fixed. Document the verification.
- Review your POA&M monthly to ensure nothing is overdue and escalate any items that are past their target date.
Evidence your assessor will ask for
- POA&M with tracked vulnerabilities showing severity, owner, target date, and remediation status
- Evidence that critical and high vulnerabilities were remediated within defined timeframes
- Re-scan reports showing vulnerabilities were verified as fixed after remediation
- Written Vulnerability Management Procedure with defined remediation timeframes
- Patch management logs showing when patches were applied
Does AI prompt monitoring help with this control? Honestly, no.
RA.2.003 is met through the remediation steps above, not through AI traffic controls — an AI prompt firewall neither satisfies nor substitutes for it. We map AI monitoring only to the controls it genuinely evidences (flow control, boundary protection, audit, and incident support); for the full picture of where it does help, see the mapping guide linked below.
Full mapping: which 800-171 controls AI prompt monitoring evidences →
More Risk Assessment controls
Score yourself against all 110 controls
The free ShieldReady assessment walks every NIST 800-171 requirement, computes your SPRS score, and shows exactly which gaps cost the most points.