What this requirement asks
Identify, report, and correct system flaws in a timely manner.
This is a CMMC Level 2 requirement in the System & Information Integrity family, drawn from NIST SP 800-171 Rev. 2. An assessor evaluates it objective by objective — every objective below must be supported by evidence, not just described in a policy.
Assessment objectives (6)
- 3.14.1[a] — the time within which to identify system flaws is specified
- 3.14.1[b] — system flaws are identified within the specified time frame
- 3.14.1[c] — the time within which to report system flaws is specified
- 3.14.1[d] — system flaws are reported within the specified time frame
- 3.14.1[e] — the time within which to correct system flaws is specified
- 3.14.1[f] — system flaws are corrected within the specified time frame
What an assessor examines
Examine:
- System and information integrity policy
- procedures addressing flaw remediation
- procedures addressing configuration management
- system security plan
- list of flaws and vulnerabilities potentially affecting the system
- list of recent security flaw remediation actions performed on the system (e.g., list of installed patches, service packs, hot fixes, and other software updates to correct system flaws)
- test results from the installation of software and firmware updates to correct system flaws
- installation/change control records for security-relevant software and firmware updates
- other relevant documents or records
Interview:
- System or network administrators
- personnel with information security responsibilities
- personnel installing, configuring, and maintaining the system
- personnel with responsibility for flaw remediation
- personnel with configuration management responsibility
Test:
- Organizational processes for identifying, reporting, and correcting system flaws
- organizational process for installing software and firmware updates
- mechanisms
Evidence that defends it
Show cycle from scan → fix → rescan
Check your readiness
Score this requirement against your own environment with the Level 2 self-assessment checklist, or estimate your SPRS score with the free CMMC compliance tool. Self-reported answers are planning signals only — they do not establish a verified or assessor-accepted result.