RA-3 · Risk Assessment · NIST SP 800-53 Rev5
RA-3: Risk assessments identify threats to and vulnerabilities of the system
How NIST SP 800-53 Rev5 control RA-3 (Risk Assessment) maps to FedRAMP 20x Key Security Indicators, and the evidence scm.cc collects for it.
Educational resource only. scm.cc is not a FedRAMP Recognized Independent Assessor (3PAO) and is not FedRAMP-authorized; it grants no authorization, certification, or assessment outcome. FedRAMP.gov is the authoritative source. This is not legal advice.
What RA-3 requires
Risk assessments identify threats to and vulnerabilities of the system.
Paraphrased from NIST SP 800-53 Rev. 5 — Security and Privacy Controls for Information Systems and Organizations (checked 2026-10-31). scm.cc does not reproduce the official control text; read the NIST catalog for the normative wording.
FedRAMP 20x KSIs that cover RA-3
These Key Security Indicators officially cite RA-3 as a related SP 800-53 control, so satisfying them is how a 20x package demonstrates this control.
KSI-MLA-EVC — Evaluating Configurations
Monitoring, Logging, and Auditing · official related-control citation: ra-3
KSI-SCR-MIT — Mitigating Supply Chain Risk
Supply Chain Risk · official related-control citation: ra-3, ra-3.1
KSI-SCR-MON — Monitoring Supply Chain Risk
Supply Chain Risk · official related-control citation: ra-3
KSI-SVC-EIS — Evaluating and Improving Security
Service Configuration · official related-control citation: ra-3
Evidence scm.cc collects for RA-3
scm.cc tracks this as a document you attach; it validates that the artifact is present and replays it for a reviewer.
Related Risk Assessment controls
- RA-5 — Systems are scanned for vulnerabilities and findings are remediated on a schedule