SI.L2-3.14.1 Flaw remediation
Identifying, reporting and correcting system flaws within time frames the organization specifies, through vendor notification review and patch management. A 5-point requirement and a Level 1 safeguard.
SI System and information integrity
The seven CMMC Level 2 system and information integrity requirements: flaw remediation, malicious code protection and updates, security alerts, system and file scanning, and monitoring for attacks and unauthorized use.
SI.L2-3.14.2 Malicious code protection
Providing protection from malicious code at designated locations, such as firewalls, email gateways and endpoints. A 5-point requirement and a Level 1 safeguard.
SI.L2-3.14.3 Security alerts and advisories
Monitoring security alerts and advisories from relevant external sources and acting on them, with defined response actions and records. A 5-point requirement in the scoring methodology.
SI.L2-3.14.4 Update malicious code protection
Updating malicious code protection mechanisms, such as anti-malware definitions and engines, whenever new releases are available. A 5-point requirement with a single objective and a Level 1 counterpart.
SI.L2-3.14.5 System and file scanning
Running periodic malicious code scans of systems and real-time scans of files from external sources as they are downloaded, opened or executed. A 3-point requirement and a Level 1 safeguard.
SI.L2-3.14.6 Monitor communications for attacks
Monitoring systems and inbound and outbound traffic to detect attacks and indicators of potential attack, with monitoring devices or agents placed at strategic points. A 5-point requirement.
SI.L2-3.14.7 Identify unauthorized use
Defining authorized use of systems by role and identifying unauthorized use through log review, intrusion detection and other monitoring. A 3-point requirement in the scoring methodology.
