What this requirement asks
Monitor organizational systems, including inbound and outbound communications traffic, to detect attacks and indicators of potential attacks.
This is a CMMC Level 2 requirement in the System & Information Integrity family, drawn from NIST SP 800-171 Rev. 2. An assessor evaluates it objective by objective — every objective below must be supported by evidence, not just described in a policy.
Assessment objectives (3)
- 3.14.6[a] — the system is monitored to detect attacks and indicators of potential attacks
- 3.14.6[b] — inbound communications traffic is monitored to detect attacks and indicators of potential attacks
- 3.14.6[c] — outbound communications traffic is monitored to detect attacks and indicators of potential attacks
What an assessor examines
Examine:
- System and information integrity policy
- procedures addressing system monitoring tools and techniques
- continuous monitoring strategy
- system and information integrity policy
- procedures addressing system monitoring tools and techniques
- facility diagram or layout
- system security plan
- system monitoring tools and techniques documentation
- system design documentation
- locations within system where monitoring devices are deployed
- system protocols
- system configuration settings and associated documentation
- system audit logs and records
- other relevant documents or records
Interview:
- System or network administrators
- personnel with information security responsibilities
- personnel installing, configuring, and maintaining the system
- personnel with responsibility monitoring the system
- personnel with responsibility for the intrusion detection system
Test:
- Organizational processes for system monitoring
- mechanisms supporting or implementing intrusion detection capability and system monitoring
- mechanisms supporting or implementing system monitoring capability
- organizational processes for intrusion detection and system monitoring
- mechanisms supporting or implementing the monitoring of inbound and outbound communications traffic
Evidence that defends it
Show alerting and investigations
Check your readiness
Score this requirement against your own environment with the Level 2 self-assessment checklist, or estimate your SPRS score with the free CMMC compliance tool. Self-reported answers are planning signals only — they do not establish a verified or assessor-accepted result.