NIST 800-171 3.14 System and Information Integrity
System and Information Integrity keeps systems patched and free of malicious code: timely flaw correction, malware protection that stays current and scans files, action on security advisories, and monitoring for attacks and unauthorized use.
7 requirementsup to 31 SPRS points0 can go on a CMMC POA&M
The 7 System and Information Integrity requirements
- 3.14.1 Flaw RemediationSI.L2-3.14.1Identify, report, and correct system flaws in a timely manner.
- 3.14.2 Malware ProtectionSI.L2-3.14.2Provide protection from malicious code at designated locations within organizational systems.
- 3.14.3 Security AdvisoriesSI.L2-3.14.3Monitor system security alerts and advisories and take action in response.
- 3.14.4 Malware UpdatesSI.L2-3.14.4Update malicious code protection mechanisms when new releases are available.
- 3.14.5 Malware ScanningSI.L2-3.14.5Perform periodic scans of organizational systems and real-time scans of files from external sources as files are downloaded, opened, or executed.
- 3.14.6 Attack MonitoringSI.L2-3.14.6Monitor organizational systems, including inbound and outbound communications traffic, to detect attacks and indicators of potential attacks.
- 3.14.7 Unauthorized UseSI.L2-3.14.7Identify unauthorized use of organizational systems.
System and Information Integrity: points and the CMMC POA&M
- Q-01
How many SPRS points can the System and Information Integrity family cost?
Up to 31 of the 313 points a score can lose: 5 worth 5 points and 2 worth 3.
- Q-02
Which System and Information Integrity requirements can go on a CMMC POA&M?
None of them. 32 CFR 170.21(a)(2)(ii) admits only requirements worth 1 point. Every one of them is worth more than 1 point.
Know the family. Keep the evidence for every requirement in it.
- Published
- Last updated
- Unchanged since publication