The latest Release Update (RU7) for Symantec Endpoint Protection is. Endpoint Protection and Symantec Network Access Control 11.0.7.
Hi Scott,
You are right - The answer is yes. An upgraded SEPM (v12.1) can continue to manage SEP 11.0.x clients.
As usual, taking a backup of the SEPM key and database is recommended as a precaution to ensure, worst case, you have a restore point.
Past that, the process should be straightforward.
One potential 'gotcha' to watch out for is when you get as far as considering upgrade of the SEP 11 clients to SEP 12.1, by default, existing client-server communication settings are maintained in install packages. If you setup a new 12.1 SEPM (i.e. decide to install the SEPM v12.1 on a seperate machine), you will need to change communication settings in Installation Settings to allow the client to move to a new SEPM.