System and Information Integrity has the highest concentration of five-point requirements of any family: five of its seven requirements carry five points, giving it 31 points and a density of 4.43 per requirement. It covers patching, malware protection, security advisories, scanning and monitoring.
It is also home to 3.14.1, flaw remediation, the third most-failed requirement in DCMA DIBCAC data.
What the System and Information Integrity family covers
System and Information Integrity contains 7 requirements, numbered 3.14.1 to 3.14.7 in NIST SP 800-171 Revision 2. In CMMC Level 2 they carry the practice prefix SI.L2, so 3.14.1 appears as SI.L2-3.14.1.
The requirements cover identifying and correcting flaws (3.14.1), malicious code protection and updates (3.14.2, 3.14.4), acting on security alerts and advisories (3.14.3), scanning files (3.14.5), monitoring systems and traffic (3.14.6), and identifying unauthorized use (3.14.7). It works closely with Risk Assessment, whose scanning requirement feeds flaw remediation.
| Requirement | What it requires | SPRS points | POA&M |
|---|---|---|---|
| 3.14.1 | Identify, report and correct system flaws in a timely manner | 5 | No |
| 3.14.2 | Provide protection from malicious code at designated locations | 5 | No |
| 3.14.3 | Monitor system security alerts and advisories and take action in response | 5 | No |
| 3.14.4 | Update malicious code protection mechanisms when new releases are available | 5 | No |
| 3.14.5 | Perform periodic scans and real-time scans of files from external sources | 3 | No |
| 3.14.6 | Monitor systems, including inbound and outbound traffic, to detect attacks and indicators of attack | 5 | No |
| 3.14.7 | Identify unauthorized use of organizational systems | 3 | No |
Point values from the DoD Assessment Methodology v1.2.1. POA&M eligibility under 32 CFR 170.21.
What it costs you in SPRS points
The family puts 31 of the 313 deductible points in the SPRS score at risk. The five-point requirements are 3.14.1, 3.14.2, 3.14.3, 3.14.4 and 3.14.6. 3.14.5 and 3.14.7 are worth three points.
With five five-point requirements, an organization that has no patch process, no anti-malware and no monitoring loses most of 31 points at once — more than the entire Audit and Accountability family. None of the five-pointers can be deferred.
Why flaw remediation fails
3.14.1 fails for three reasons in DIBCAC's experience: no scanner to identify flaws, no patch management strategy, and no defined remediation timeline. "In a timely manner" is not defined by the standard, which means your policy must define it — commonly by severity — and your records must show you meet it.
The second common gap is 3.14.6, monitoring inbound and outbound traffic. Endpoint protection alone does not satisfy it; assessors expect network-level monitoring or a managed detection service that watches traffic for indicators of attack.
Implementation priorities for SI
Deploy patch management and anti-malware to every in-scope endpoint and server, with automatic updates and central reporting. Write remediation timeframes by severity into policy and measure against them monthly. Subscribe to CISA and vendor advisories and record what you did with each significant one. Add network monitoring at the boundary, often through a managed detection service, and define what counts as unauthorized use so that 3.14.7 has something to detect.
What you can and cannot defer
Under 32 CFR 170.21 only one-point requirements may be placed on a POA&M, with the single exception of 3.13.11 when encryption exists but is not FIPS-validated. In this family that makes nothing eligible for deferral.
Neither of the three-point requirements (3.14.5 and 3.14.7) is deferrable, and the five-pointers cannot be deferred either. Nothing in this family is eligible for a POA&M, which makes it a priority for any organization approaching an assessment.
Evidence assessors expect
Assessors work at the level of the objectives in NIST SP 800-171A and use examine, interview and test. For this family, have the following ready — the full evidence package checklist covers all 14 families:
- Patch compliance reports and a policy with remediation timelines by severity.
- Anti-malware deployment status and update settings.
- Records of subscribing to and acting on advisories, such as CISA alerts.
- Scan settings for files from external sources.
- Network monitoring or managed detection reports and alert handling records.
Frequently asked questions
What patch timeline do assessors expect?
The standard leaves it to you. Many organizations use 14 to 30 days for critical vulnerabilities and longer for lower severities, documented in policy.
Does Microsoft Defender satisfy 3.14.2?
It can, if deployed to all in-scope endpoints with updates enabled and monitored.
Is an EDR tool enough for 3.14.6?
It covers endpoint monitoring. Assessors usually also look for monitoring of network traffic at the boundary.
What about systems that cannot be patched?
Isolate them, document compensating controls in the SSP and, where they are specialized assets such as operational technology, record them as such. See the manufacturing guidance on legacy OT.