Editor's note: CMMC has been updated several times since this post was first published, most recently when the Department of War suspended Phase 2 in July 2026. We have also rebranded: Intech Hawaii is now Intech Pacific. We updated this post in October 2026 to reflect the current state of the program. For the latest information, see our CMMC Overview and our CMMC Calendar.
Last updated: October 2026
NIST 800-171 requirement 3.11.1 requires you to periodically assess risk to your operations, assets, and people from running the systems that handle Controlled Unclassified Information (CUI). For contractors meeting NIST 800-171 in Hawaii, that risk assessment has to cover more than hackers. It has to include hurricanes, wildfires, power outages, equipment failure, and the fact that our islands depend on a limited number of undersea cables. Requirement 3.11.1 is worth 3 points in the SPRS scoring methodology, which means it cannot be placed on a POA&M for conditional Level 2 status. This post explains what the requirement asks for, where companies go wrong, and how to build a risk assessment that holds up.
Why Risk Assessments Matter for CMMC Requirement 3.11.1
CMMC exists to protect the Defense Industrial Base and the information that supports the warfighter. A risk assessment is how you decide where to spend effort protecting that information. It is not a form to fill out once.
The requirement is not new. DFARS 252.204-7012 has required all 110 NIST SP 800-171 requirements, including 3.11.1, since December 31, 2017. Phase 2 of CMMC is suspended at the time of this update, but 7012 and your SPRS affirmations remain in effect.
What Does NIST 800-171 Requirement 3.11.1 Mean?
Requirement 3.11.1 reads: periodically assess the risk to organizational operations (including mission, functions, image, or reputation), organizational assets, and individuals, resulting from the operation of organizational systems and the associated processing, storage, or transmission of CUI.
NIST SP 800-171A breaks it into two assessment objectives:
- The frequency for assessing risk is defined.
- Risk is assessed with that defined frequency.
That means you need a documented frequency (annual is common) and evidence that you actually performed the assessment on schedule. A risk register with no date and no follow-through does not meet the requirement.
In SPRS scoring, 3.11.1 is a 3-point requirement. Because generally only 1-point requirements can be on a POA&M, 3.11.1 has to be fully met before you can reach conditional Level 2 status.
Risk Assessment Misconceptions
Putting too much weight on external attackers. Hackers matter. Business email compromise, ransomware, and token theft are the threats I see most often targeting Hawaii businesses. But a risk assessment that only lists cyber threats misses half the picture.
Overlooking non-cyber issues. Power, weather, and infrastructure failures take systems down as reliably as malware. The requirement covers risk to operations, not only risk from attackers.
Missing the big picture in threat modeling. A narrow model that looks at one server or one application leaves gaps. Model the whole CUI environment, including people, facilities, cloud services, and providers.
Examining Internal and External Security Risks
Environmental threats. Keep disaster recovery plans current and backups in more than one location. For Hawaii, store at least one copy of critical data off-island.
Infrastructure risks. Use UPS units and generators for systems that must stay up. Know how long each will last.
Equipment failures and security gaps. Maintain and test security tools on a schedule. A firewall that has not been patched or a backup that has never been restored is a risk.
Redundancy. Build backup systems and alternate configurations for critical services, including a second internet path where possible.
A comprehensive strategy. Combine regular risk assessments with business continuity planning so the findings turn into action.
NIST 800-171 in Hawaii and Guam: Local Risks Your Assessment Should Include
Hawaii and Guam contractors face risks that mainland templates do not cover. Add these to your risk register:
- Hurricanes and typhoons. Hawaii faces hurricanes. Guam faces typhoons. Both can cause extended power and connectivity outages.
- Tsunamis and flooding. Many Honolulu offices sit in low-lying areas.
- The 2023 Maui wildfires showed that our islands are not isolated from large-scale disasters.
- Undersea cable dependency. Hawaii connects to the rest of the world through a limited number of undersea cables. A cable cut or landing station issue can affect access to cloud services that hold your CUI.
- Supply chain delays. Replacement hardware takes longer to arrive in Hawaii, and longer still in Guam. A failed server can mean a long outage if you have no spare.
- Limited local talent and providers. Fewer providers means fewer options when one fails.
- Island isolation. You cannot drive to an alternate site in another state. Your recovery plan has to work from where you are or from the cloud.
I learned business continuity in New York. During the 2003 blackout, I learned to think bigger about what can cause downtime. During Superstorm Sandy, years of disaster recovery planning paid off because we knew exactly what to do. The specific events in Hawaii are different. The lesson is the same: you need a plan, and it has to be practiced. This is the part of 3.11.1 that mainland templates miss, and it shapes how we approach every CMMC Hawaii risk assessment.
Conducting a Comprehensive Risk Assessment
- Identify potential threats. List cyber and non-cyber threats to the CUI environment.
- Assess the impact. Estimate immediate and long-term effects on operations, contracts, and people.
- Prioritize by likelihood and severity. Rank risks and build mitigation strategies for the top items.
- Review and update regularly. Repeat on your defined frequency and after major changes.
NIST SP 800-30, Guide for Conducting Risk Assessments, provides a solid framework for this process.
How Ignoring Non-Cyber Threats Can Put Your CMMC Compliance at Risk
The risk of falling out of compliance. A risk assessment that ignores non-cyber threats does not cover operations as the requirement describes. It also weakens related requirements such as vulnerability scanning (3.11.2) and remediation (3.11.3).
What is at stake during an assessment. Assessors examine your risk assessment and interview the people who perform it. A missing or stale assessment costs 3 points and blocks conditional status.
Legal and financial consequences. Your SPRS score is a representation to the government. Affirming a requirement as met when it is not creates False Claims Act exposure. Outages also bring downtime, contract delays, and higher insurance costs.
Staying prepared and compliant. Assess both cyber and non-cyber threats on schedule and keep the evidence.
Best Practices for a Comprehensive Risk Assessment
Take a holistic view. Include human error, insider risk, providers, and facilities.
Follow proven standards. Use NIST SP 800-30 for method and ISO 27001 for broader governance ideas.
Use technology and expert insight. A SIEM and vulnerability scanner surface data. Experienced people turn it into decisions.
Practice through scenarios and testing. Run tabletop exercises for a ransomware event, a hurricane, and a cable outage. Record what you learn.
Your Next Step Toward Stronger Risk Assessments
Intech Pacific is the only CMMC Level 2 certified MSP in Hawaii and Guam.
