@cmarieonline @AriaImagined You define how you assess per 3.12.1 Security Assessment and Monitoring of NIST-SP-800-171 risk register only one type of

@cmarieonline @AriaImagined You define how you assess per 3.12.1 Security Assessment and Monitoring of NIST-SP-800-171

risk register only one type of documentation one might use and is not req (though this will help with 3.11.01 Risk Assessment, and should be done as part of your overall security plan)