What this requirement asks
Provide protection from malicious code at designated locations within organizational systems.
This is a CMMC Level 2 requirement in the System & Information Integrity family, drawn from NIST SP 800-171 Rev. 2. An assessor evaluates it objective by objective — every objective below must be supported by evidence, not just described in a policy.
Assessment objectives (2)
- 3.14.2[a] — designated locations for malicious code protection are identified
- 3.14.2[b] — protection from malicious code at designated locations is provided
What an assessor examines
Examine:
- System and information integrity policy
- configuration management policy and procedures
- procedures addressing malicious code protection
- records of malicious code protection updates
- malicious code protection mechanisms
- system security plan
- system configuration settings and associated documentation
- record of actions initiated by malicious code protection mechanisms in response to malicious code detection
- scan results from malicious code protection mechanisms
- system design documentation
- system audit logs and records
- other relevant documents or records
Interview:
- System or network administrators
- personnel with information security responsibilities
- personnel installing, configuring, and maintaining the system
- personnel with responsibility for malicious code protection
- personnel with configuration management responsibility
Test:
- Organizational processes for employing, updating, and configuring malicious code protection mechanisms
- organizational process for addressing false positives and resulting potential impact
- mechanisms supporting or implementing employing, updating, and configuring malicious code protection mechanisms
- mechanisms supporting or implementing malicious code scanning and subsequent actions
Evidence that defends it
Show policies, detections, update status
Check your readiness
Score this requirement against your own environment with the Level 2 self-assessment checklist, or estimate your SPRS score with the free CMMC compliance tool. Self-reported answers are planning signals only — they do not establish a verified or assessor-accepted result.