System and Information Integrity Policy
Covers the CMMC / NIST SP 800-171 System and Information Integrity family for Your Organization: flaw remediation, malicious code protection, security alerts and advisories, system monitoring, and detection of unauthorized use.
Maps to CMMC Level 2 SI.L2-3.14.1 · CMMC Level 2 SI.L2-3.14.2 · CMMC Level 2 SI.L2-3.14.3 · CMMC Level 2 SI.L2-3.14.4 · CMMC Level 2 SI.L2-3.14.5 · CMMC Level 2 SI.L2-3.14.6 · CMMC Level 2 SI.L2-3.14.7 · FedRAMP Moderate SI-2 · FedRAMP Moderate SI-3 · FedRAMP Moderate SI-4 · FedRAMP Moderate SI-5 · NIST SP 800-171 Revision 3 03.14.01 · NIST SP 800-171 Revision 3 03.14.02 · NIST SP 800-171 Revision 3 03.14.03 · NIST SP 800-171 Revision 3 03.14.06
Read it now — the PDF opens either way.
Purpose
This policy sets how Your Organization finds and fixes system flaws, protects against malicious code, tracks security alerts, and monitors systems for attacks and unauthorized use. It covers the System and Information Integrity requirements of NIST SP 800-171: practices 3.14.1 to 3.14.7 of Revision 2, as used by CMMC Level 2, and requirements 03.14.01, 03.14.02, 03.14.03 and 03.14.06 of Revision 3. It also supports the matching controls in other frameworks.
Scope
This policy applies to all Your Organization information systems, including servers, workstations, network devices, cloud services, and applications, with particular attention to systems that store, process, or transmit Controlled Unclassified Information (CUI) or other sensitive data, and to the people who administer them.
6 more sections in the full template
Roles and responsibilities · Requirements · Exceptions · Enforcement · Evidence · Review cadence. Download the full document above, or open it in CMDash to fill in your organization name and effective date automatically.
Use this policy for real, not just on paper
“Open in CMDash” pre-selects the System and Information Integrity Policy template the first time you create a policy — your organization name and today’s date fill in automatically, and it lands as a DRAFT you can edit before publishing.