What this requirement asks
Identify unauthorized use of organizational systems.
This is a CMMC Level 2 requirement in the System & Information Integrity family, drawn from NIST SP 800-171 Rev. 2. An assessor evaluates it objective by objective — every objective below must be supported by evidence, not just described in a policy.
Assessment objectives (2)
- 3.14.7[a] — authorized use of the system is defined
- 3.14.7[b] — unauthorized use of the system is identified
What an assessor examines
Examine:
- Continuous monitoring strategy
- system and information integrity policy
- procedures addressing system monitoring tools and techniques
- facility diagram/layout
- system security plan
- system design documentation
- system monitoring tools and techniques documentation
- locations within system where monitoring devices are deployed
- system configuration settings and associated documentation
- other relevant documents or records
Interview:
- System or network administrators
- personnel with information security responsibilities
- personnel installing, configuring, and maintaining the system
- personnel with responsibility for monitoring the system
Test:
- Organizational processes for system monitoring
- mechanisms supporting or implementing system monitoring capability
Evidence that defends it
Show use cases and evidence of monitoring
Check your readiness
Score this requirement against your own environment with the Level 2 self-assessment checklist, or estimate your SPRS score with the free CMMC compliance tool. Self-reported answers are planning signals only — they do not establish a verified or assessor-accepted result.