Terms / Assessment
Assessment objective
One lettered determination statement inside a requirement. Every applicable objective must be met, or the whole requirement is scored not met.
Also called assessment objectives, determination statement.
Official Source Material
Assessment objective means a set of determination statements that, taken together, expresses the desired outcome for the assessment of a security requirement.
Source: 32 CFR 170.4, eCFR text current as of September 17, 2026
Practitioner Guidance
What it means in practice
The objective, not the requirement, is the unit an assessor scores.
Each of the 110 requirements breaks into lettered objectives in NIST SP 800-171A. An objective is a single determination statement: something that is either shown to be true or is not. All applicable objectives must be satisfied for the requirement to be met. This is the most useful thing to understand before you prepare for an assessment.
Objectives separate the defining from the doing.
A common shape asks you to define something, then to apply it. In AU.L2-3.3.1, one objective asks that the types of records to be audited are defined. Another asks that those records are actually produced. You can satisfy the first with a document and fail the second with a misconfigured system. Read the objectives and you can see where your own work is unbalanced.
Name the letter when you write your plan and when you discuss a finding.
Referring to objective [a] or objective [c] of a requirement is precise, and precision shortens an assessment. It also shows an assessor that you worked from the right document. A plan written at requirement level leaves the assessor to guess which objective your evidence addresses.
An objective can be not applicable, and that is treated as met.
Where an objective does not apply to your environment, it is assessed as not applicable and counts the same as met. Record why. The reasoning is what makes the finding defensible, and it is the first thing questioned when your environment changes.
What falls short
- Evidence that covers most objectives in a requirement. One unmet objective scores the requirement not met.
- A policy that restates the requirement. The objectives ask for specific determinations, and a restatement determines nothing.
- A claim that an objective is met with no record of the value you defined. Where an objective asks you to define something, the definition is the evidence.
Edge cases
- An objective asks for something a provider does. Record the inheritance and hold the provider's evidence against that objective.
- Two objectives seem to ask the same thing. Read the methods, because one is often examined and the other tested.
- An objective depends on an organization-defined parameter. Define the value, publish it in your plan, and then evidence against your own value.
Over-engineering
- A control narrative written per objective across all 110 requirements. Write at requirement level and index the evidence by objective.
- Buying a tool to generate objective-level narratives. The text is published, and the evidence still has to be yours.