NIST 800-171 3.14.7 (SI.L2-3.14.7): Unauthorized Use

What 3.14.7 means in practice

Define what authorized use of the system looks like, then watch for use outside it, such as sign-ins at odd hours or from unusual places, access to data outside someone's job, or new accounts nobody requested. Unauthorized use can come from an insider with valid credentials, so watching only for outside attackers does not meet it.

SPRS points and the CMMC POA&M

What an assessor checks for 3.14.7

NIST SP 800-171A gives 2 determination statements for 3.14.7, each found satisfied or other than satisfied. Determine if:

1. 3.14.7[a] authorized use of the system is defined.
2. 3.14.7[b] unauthorized use of the system is identified.

NIST SP 800-171A (June 2018), assessment objectives for 3.14.7

Evidence that shows 3.14.7 is met

• The definition of authorized use, usually in the acceptable use policy.
• Detection rules for unauthorized use.
• Records of investigations into suspected unauthorized use.

How PolicyCortex gathers the evidence

PolicyCortex reads this evidence with the collectors below, read only, and grades 3.14.7 from it. Each line says what the product checks.

• Microsoft Sentinel: Automation and alert rules. Checks that Microsoft Sentinel or Defender alert rules are configured to detect attacks and misuse.
• Microsoft Defender for Cloud: Secure score and security contacts. Checks that security alert notifications reach the security team.