What this requirement asks
Monitor system security alerts and advisories and take action in response.
This is a CMMC Level 2 requirement in the System & Information Integrity family, drawn from NIST SP 800-171 Rev. 2. An assessor evaluates it objective by objective — every objective below must be supported by evidence, not just described in a policy.
Assessment objectives (3)
- 3.14.3[a] — response actions to system security alerts and advisories are identified
- 3.14.3[b] — system security alerts and advisories are monitored
- 3.14.3[c] — actions in response to system security alerts and advisories are taken
What an assessor examines
Examine:
- System and information integrity policy
- procedures addressing security alerts, advisories, and directives
- system security plan
- records of security alerts and advisories
- other relevant documents or records
Interview:
- Personnel with security alert and advisory responsibilities
- personnel implementing, operating, maintaining, and using the system
- personnel, organizational elements, and external organizations to whom alerts, advisories, and directives are to be disseminated
- system or network administrators
- personnel with information security responsibilities
Test:
- Organizational processes for defining, receiving, generating, disseminating, and complying with security alerts, advisories, and directives
- mechanisms supporting or implementing definition, receipt, generation, and dissemination of security alerts, advisories, and directives
- mechanisms supporting or implementing security directives
Evidence that defends it
Show subscription/ticket workflows
Check your readiness
Score this requirement against your own environment with the Level 2 self-assessment checklist, or estimate your SPRS score with the free CMMC compliance tool. Self-reported answers are planning signals only — they do not establish a verified or assessor-accepted result.