---
title: "NIST 800-171 3.14 System and Information Integrity"
description: "The 7 NIST SP 800-171 System and Information Integrity requirements (3.14, CMMC SI): text, SPRS points, POA&M rules and evidence."
url: https://policycortex.com/nist-800-171/system-and-information-integrity
sealed: 2026-11-11
amended: 2026-11-11
register: nist-800-171/system-and-information-integrity
records: 4
digest: sha3:039716c0d4c5730bfbba94ea77a844edbc1a4d7e45c152cb08afb4ef7ae8bc36
---

# NIST 800-171 3.14 System and Information Integrity

NIST 800-171 / System and Information Integrity

System and Information Integrity keeps systems patched and free of malicious code: timely flaw correction, malware protection that stays current and scans files, action on security advisories, and monitoring for attacks and unauthorized use.

7 requirements · up to 31 SPRS points · 0 can go on a CMMC POA&M

## The 7 System and Information Integrity requirements

| Requirement | CMMC practice | SPRS points | Requirement text |
|---|---|---|---|
| [3.14.1 Flaw Remediation](https://policycortex.com/nist-800-171/system-and-information-integrity/3.14.1) | SI.L2-3.14.1 | 5 points | Identify, report, and correct system flaws in a timely manner. |
| [3.14.2 Malware Protection](https://policycortex.com/nist-800-171/system-and-information-integrity/3.14.2) | SI.L2-3.14.2 | 5 points | Provide protection from malicious code at designated locations within organizational systems. |
| [3.14.3 Security Advisories](https://policycortex.com/nist-800-171/system-and-information-integrity/3.14.3) | SI.L2-3.14.3 | 5 points | Monitor system security alerts and advisories and take action in response. |
| [3.14.4 Malware Updates](https://policycortex.com/nist-800-171/system-and-information-integrity/3.14.4) | SI.L2-3.14.4 | 5 points | Update malicious code protection mechanisms when new releases are available. |
| [3.14.5 Malware Scanning](https://policycortex.com/nist-800-171/system-and-information-integrity/3.14.5) | SI.L2-3.14.5 | 3 points | Perform periodic scans of organizational systems and real-time scans of files from external sources as files are downloaded, opened, or executed. |
| [3.14.6 Attack Monitoring](https://policycortex.com/nist-800-171/system-and-information-integrity/3.14.6) | SI.L2-3.14.6 | 5 points | Monitor organizational systems, including inbound and outbound communications traffic, to detect attacks and indicators of potential attacks. |
| [3.14.7 Unauthorized Use](https://policycortex.com/nist-800-171/system-and-information-integrity/3.14.7) | SI.L2-3.14.7 | 3 points | Identify unauthorized use of organizational systems. |

## System and Information Integrity: points and the CMMC POA&M

**Q: How many SPRS points can the System and Information Integrity family cost?**
A: Up to 31 of the 313 points a score can lose: 5 worth 5 points and 2 worth 3.

**Q: Which System and Information Integrity requirements can go on a CMMC POA&M?**
A: None of them. 32 CFR 170.21(a)(2)(ii) admits only requirements worth 1 point. Every one of them is worth more than 1 point.

## Related pages

- **Calculator**: [SPRS score calculator: mark the System and Information Integrity requirements and see what they cost.](https://policycortex.com/sprs-score-calculator#family-SI)
- **Sample package**: [Sample package: an SSP, a POA&M and an evidence chain the product generated from demonstration data.](https://policycortex.com/sample-package)
- **Previous family**: [3.13 System and Communications Protection](https://policycortex.com/nist-800-171/system-and-communications-protection)
- **All requirements**: [All 110 NIST SP 800-171 requirements, by family.](https://policycortex.com/nist-800-171)

Know the family. Keep the evidence for every requirement in it. [Request Access](https://app.policycortex.com/auth?mode=request-access) · [Book a call](https://policycortex.com/book)

## Register colophon

| Seq | Label | SHA3-256 | Prev |
|---|---|---|---|
| REC 0000 | FAMILY | 47889ab80582 | 8f4527b39113 |
| REC 0001 | REQUIREMENTS | 1d0ad83859d4 | 47889ab80582 |
| REC 0002 | POINTS AND POA&M | 9ed78299596d | 1d0ad83859d4 |
| REC 0003 | RELATED | 039716c0d4c5 | 9ed78299596d |

Head sha3:039716c0d4c5730bfbba94ea77a844edbc1a4d7e45c152cb08afb4ef7ae8bc36. Each digest is SHA3-256 over the previous digest, the register key, the record label, and the record copy; a second party can recompute it from this document.