Understanding SI.L2-3.14.6: Monitor Communications for AttacksThe practiceSI.L2-3.14.6fromNIST SP 800-171(aligned with CMMC Level 2) requires an organization tomonitor organizational communications for indicators of attack. This typically includes:
✅Intrusion Detection Systems (IDS)andIntrusion Prevention Systems (IPS)
✅Log analysis and network monitoring
✅Incident response planningfor detected threats
As part of aCMMC Level 2 assessment, theCertified CMMC Assessor (CCA)must ensure that theOSC (Organization Seeking Certification)hasproperly implemented and documenteditsmonitoring capabilities.
TheCCA must collect sufficient objective evidenceto determine compliance.
Reviewing anartifact(such as system configurations, IDS/IPS logs, or security policies)helps validatethat intrusion detection is properly implemented.
Configuration settings providedirect evidenceof whethermonitoring for attacksis effectively applied.
Why "Review an artifact to check key references for the configuration of the IDS or IPS" is Correct?Breakdown of Answer ChoicesOption
Description
Correct?
A. Conduct a penetration test
❌Incorrect–Penetration testing isnot requiredfor CMMC Level 2 assessments and falls outside an assessor's responsibilities.
B. Interview the intrusion detection system's supplier.
❌Incorrect–Thesupplier does not determine compliance; the assessor needs evidence from theOSC’s implementation.
C. Upload known malicious code and observe the system response.
❌Incorrect–This would beinvasive testing, which isnot part of a CMMC assessment.
D. Review an artifact to check key references for the configuration of the IDS or IPS practice for additional guidance on intrusion detection and prevention systems.
✅Correct – Reviewing system artifacts provides direct evidence of compliance with SI.L2-3.14.6.
NIST SP 800-171 SI.L2-3.14.6– Requires monitoring communications for attack indicators.
CMMC Assessment Process Guide (CAP)– Describesartifact reviewas an essential assessment method.
Official References from CMMC 2.0 and NIST SP 800-171 DocumentationFinal Verification and ConclusionThe correct answer isD. Review an artifact to check key references for the configuration of the IDS or IPS practice for additional guidance on intrusion detection and prevention systems.
This aligns withCMMC 2.0 Level 2 assessment requirementsandSI.L2-3.14.6 compliance verification.
Submit