# NIST 800-171 3.11.3 Remediate vulnerabilities in accordance with risk assessments.

- Source: https://support.icompaas.com/support/solutions/articles/62000229329-nist-800-171-3-11-3-remediate-vulnerabilities-in-accordance-with-risk-assessments-
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [NIST](https://support.icompaas.com/support/solutions/62000112528) › [800-171](https://support.icompaas.com/support/solutions/folders/62000168440)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description:**   

Vulnerabilities discovered, for example, via the scanning conducted in response to 3..2, are remediated with consideration of the related assessment of risk. The consideration of risk influences the prioritization of remediation efforts and the level of effort to be expended in the remediation for specific vulnerabilities. 

  

**Priority**: High   

  

**Category**: Vulnerability Management 

  

**Services Associated with AWS:**   

-   AWS Inspector, AWS Shield, AWS WAF, AWS Security Hub  
    

  

**Objective Evidence:**   

-   Administrative: documented policies, standards & procedures
-   Administrative: supporting documentation to demonstrate how a Risk Management Program (RMP) is implemented
-   Administrative: supporting documentation of a prioritized risk register 
-   Administrative: supporting documentation of remediation activities being performed
-   Administrative: supporting documentation to demonstrate change management practices reviewed/approved the request(s)
-   Technical: screenshot of ITAM or CMDB console 

  

Possible Technology Considerations : 

-   Secure Baseline Configurations (SBC)
-   Patch Management Solution 

  

**What needs to be answered :**  

  

Do system owners and company managers upon recognition of any vulnerability provide an action plan for remediation, acceptance, avoidance, or transference of the vulnerability risk? Does the plan include a reasonable time frame for implementation? Are all high vulnerabilities prioritized? Does the Plan of Action call out remedial security actions to mitigate risk to company operations, assets, employees and other organizations? 

-   Remediation of Vulnerabilities Based on Risk Assessments  
    Description: This check verifies that identified vulnerabilities, such as those discovered through scanning procedures, are remediated considering the corresponding risk assessments. The consideration of risk is crucial to determine the prioritization of remediation efforts and the extent of resources to be deployed for remediation of specific vulnerabilities.
-   Prioritization of Remediation Efforts Based on Risk Assessment  
    Description: This check ensures that the risk assessments guide the prioritization of remediation efforts for identified vulnerabilities. High-risk vulnerabilities should be addressed promptly to mitigate potential threats.
-   Deployment of Resources for Remediation Based on Risk Assessment  
    Description: This check confirms that the deployment of resources for remediation of vulnerabilities is proportional to the assessed risk. Greater resources should be committed to high-risk vulnerabilities to ensure rapid and effective remediation. 

  

**More Details:**   

Regular assessments of risk performed and policies/training updated based on assessment results.

## Related compliance guidance

- [NIST SP 800-53 Rev. 5: a practical implementation guide for cloud teams](https://support.icompaas.com/compliance/nist-sp-800-53-rev-5): How the 800-53 catalogue, baselines and the Risk Management Framework fit together, and which controls take the most work in the cloud.
- [NIST SP 800-171 and CMMC: a practical guide to protecting CUI in the cloud](https://support.icompaas.com/compliance/nist-sp-800-171-rev-3): If the driver is a DoD or federal contract handling CUI, 800-171 (and CMMC) is the scope you actually need.