SI.L2-3.14.6 and SI.L2-3.14.7 — CMMC Monitoring and Unauthorized Use Detection

The Requirements

SI.L2-3.14.6 and SI.L2-3.14.7 are the final two requirements in the System and Information Integrity (SI) domain of NIST SP 800-171 Rev 2. The SI domain contains seven requirements covering flaw remediation, malicious code protection, security alert monitoring, and system monitoring. These two sit at the end of that list and address a capability many smaller organizations lack entirely: active monitoring with detection logic.

For full SI domain context:

Point Values and POA&M Eligibility

SI.L2-3.14.6 carries a 5-point SPRS deduction. SI.L2-3.14.7 carries a 3-point deduction. These values come directly from the NIST SP 800-171 DoD Assessment Methodology, which classifies 3.14.6 as a derived security requirement worth 5 points because failing to implement it creates conditions for network exploitation. SI.L2-3.14.7 is classified as a derived security requirement worth 3 points for its specific and confined effect on detecting internal misuse.

Together these two requirements represent 8 SPRS points. A contractor missing only these two scores a 102 — still strong. But organizations that lack active monitoring typically have adjacent gaps in the AU domain (logging deficiencies), IR domain (incident plan not grounded in real detection capability), and CA.L2-3.12.3 (continuous monitoring). The combined deduction is often substantially higher than 8 points.

Why These Requirements Show Up So Often in Assessments

The pattern is consistent across small DIB assessments: organizations have endpoint protection satisfying 3.14.2, apply patches addressing 3.14.1, and run antimalware scans covering 3.14.5 — but have no active monitoring capability watching for attack patterns or anomalous behavior in real time.

No dedicated monitoring tool

Many small contractors rely on Windows Defender, a perimeter firewall, and an email filter. Those tools block known threats. They do not provide visibility into network behavior, authentication anomalies, or lateral movement patterns that 3.14.6 requires detecting. Without a SIEM, an EDR with behavioral detection, or a network monitoring solution, 3.14.6 cannot be satisfied.

Logging confused with monitoring

Having Windows Event Logs enabled does not satisfy 3.14.6. The requirement uses the word "detect," which requires active logic acting on log data — not passive collection waiting to be reviewed. This distinction trips up organizations that believe log storage equals compliance. It does not.

Informal monitoring that is not documented

Some organizations review logs or watch for unusual activity, but nothing about that process is written down. There is no procedure, no assigned reviewer, no defined review frequency, no criteria for what constitutes suspicious behavior. Undocumented controls fail assessments. "We check things when something seems off" does not satisfy a C3PAO assessor asking for evidence of a repeatable, documented monitoring process.

No behavioral baseline for 3.14.7

Identifying unauthorized use requires knowing what authorized use looks like. Without a documented baseline — which accounts access which systems, during what hours, from what locations — there is no reference point for detecting deviation. An organization cannot credibly claim to identify unauthorized use if it has never defined what authorized use is.

SI.L2-3.14.6 In Depth: What "Monitor to Detect Attacks" Requires

The full requirement text: "Monitor organizational systems, including inbound and outbound communications traffic, to detect attacks and indicators of potential attacks."

Three components of that text carry distinct weight under CMMC assessment:

"Monitor organizational systems"

All systems within your CMMC assessment boundary — not just the perimeter. Endpoints, domain controllers, network devices, email gateways, VPN concentrators, and any in-scope cloud services all need to feed data into a monitoring capability. A firewall log reviewed monthly does not constitute monitoring of organizational systems.

"Including inbound and outbound communications traffic"

Network-layer visibility is explicit in the requirement text. Inbound monitoring catches reconnaissance, exploitation attempts, and command-and-control communications entering your network. Outbound monitoring catches exfiltration, beaconing to attacker infrastructure, and anomalous data transfers leaving your boundary. Both directions are required. Endpoint-only monitoring that ignores network traffic is an incomplete implementation.

"To detect attacks and indicators of potential attacks"

Detection requires logic — rules, signatures, behavioral models, or anomaly thresholds that trigger when attack patterns are observed. The CMMC Assessment Guide specifies that assessors will verify monitoring tools are in place, examine boundary coverage, and review documented alert rules. A monitoring tool with no configured detection rules satisfies no part of this requirement.

SI.L2-3.14.7 In Depth: What "Identify Unauthorized Use" Requires

The full requirement text: "Identify unauthorized use of organizational systems."

This requirement is deceptively brief. Satisfying it depends on three capabilities all being in place:

A definition of authorized use

You cannot identify unauthorized use without first defining what authorized use is. This means documented user roles, access permissions aligned to job function, defined systems each role may access, approved hours of operation, and approved access methods. This definition ties directly to your AC domain controls — specifically AC.L2-3.1.1 and AC.L2-3.1.2. If those controls are implemented and documented, you have the foundation for 3.14.7.

Monitoring capable of detecting deviations

The monitoring capability for 3.14.6 is also the mechanism for 3.14.7. The distinction is in what the alert rules target. For 3.14.6, rules target external threat indicators. For 3.14.7, rules target insider behavior that deviates from the authorized use baseline: after-hours access to CUI directories, large file copies to removable media, logins to systems the user has no documented need to access, use of administrative tools by non-administrator accounts.

A process for acting on detections

Identifying unauthorized use means more than generating an alert. Someone must review that alert, determine whether it represents a policy violation, and take appropriate action. Documented procedures for alert review and escalation are required evidence. An alert that fires and sits unacknowledged in a dashboard does not constitute identification of unauthorized use.

The Logging vs. Monitoring Distinction

This is the single most common misconception that produces 3.14.6 and 3.14.7 findings. C3PAO assessors probe for it specifically.

An organization with Windows Event Logs stored locally and reviewed manually when something seems wrong has logging. It does not have monitoring. That same organization with logs forwarded to a SIEM running correlation rules that generate alerts when attack patterns are detected has both. The assessor's question for 3.14.6 is not "do you have logs." It is "what detects attacks, and show me that it works."

Implementation Options for Small DIB Contractors

There is no single required tool. The requirement is for a capability, not a specific product. Practical options for small contractors fall into three categories:

SIEM (Security Information and Event Management)

A SIEM collects logs from all boundary systems and applies correlation rules to detect attack patterns and anomalous behavior. It is the most common and assessor-accepted mechanism for satisfying both requirements simultaneously. Open-source options (Wazuh, OpenSearch Security) are viable for small contractors without enterprise security budgets. 1TEN's optional Wazuh integration provides on-premises SIEM capability within the same air-gapped environment as your compliance documentation, with pre-built rules mapped directly to the AU and SI requirements they satisfy.

EDR with behavioral detection

Endpoint Detection and Response platforms (CrowdStrike, SentinelOne, Microsoft Defender for Endpoint) provide behavioral monitoring at the endpoint level. A well-configured EDR satisfies the endpoint portion of 3.14.6 and can support 3.14.7 through process-level behavioral alerting. EDR alone does not address network-layer traffic monitoring, so a combined approach is typically required to cover the full scope of 3.14.6.

Minimum viable implementation

An organization that cannot afford an enterprise SIEM can satisfy these requirements with: centralized Windows Event Log forwarding with alert rules, firewall logging with defined review procedures, documented review frequency and assigned responsibilities, and written alert response procedures. The tools matter less than the documented, evidenced process. A modest solution that is thoroughly documented beats an expensive tool whose alerts no one reviews.

Evidence Your C3PAO Assessor Will Request

For both requirements, assessors use examination, interview, and testing. Prepare the following before your assessment:

All of the above should be linked to your 3.14.6 and 3.14.7 requirements in 1TEN's Evidence Manager before assessment. Assessors work from your SSP's evidence index. If artifacts are not organized and linked, you are searching for them on assessment day.

Frequently Asked Questions