CMMC Navigatorby Foxx Cyber Bedrock CMMC

↑↓ to move, Enter to open, Esc to close. Try 3.5.3, AC.L2-3.1.1, MFA or unmarked.

3.14.1Find and fix flaws on a clock

Named time frames for identifying, reporting, and correcting flaws, and evidence you met them.

The requirement, verbatim

NIST SP 800-171 Rev. 2 · 3.14.1

Identify, report, and correct system flaws in a timely manner.

Requirement 3.14.1, practice name in the CMMC assessment guide: Flaw Remediation.

NIST's discussion

Organizations identify systems that are affected by announced software and firmware flaws including potential vulnerabilities resulting from those flaws and report this information to designated personnel with information security responsibilities. Security-relevant updates include patches, service packs, hot fixes, and anti-virus signatures. Organizations address flaws discovered during security assessments, continuous monitoring, incident response activities, and system error handling. Organizations can take advantage of available resources such as the Common Weakness Enumeration (CWE) database or Common Vulnerabilities and Exposures (CVE) database in remediating flaws discovered in organizational systems.

Organization-defined time periods for updating security-relevant software and firmware may vary based on a variety of factors including the criticality of the update (i.e., severity of the vulnerability related to the discovered flaw). Some types of flaw remediation may require more testing than other types of remediation. NIST SP 800-40 provides guidance on patch management technologies.

NIST SP 800-171 Rev. 2, discussion under 3.14.1. Whitespace normalised; wording unchanged.

Assessment objectives

An assessor decides each of these separately. The requirement is met only when every objective is.

  1. [a] the time within which to identify system flaws is specified
  2. [b] system flaws are identified within the specified time frame
  3. [c] the time within which to report system flaws is specified
  4. [d] system flaws are reported within the specified time frame
  5. [e] the time within which to correct system flaws is specified
  6. [f] system flaws are corrected within the specified time frame

NIST SP 800-171A, determination statements for 3.14.1.

For assessors: examine, interview, test

NIST SP 800-171A names what an assessor may examine, whom they may interview, and what they may test for this requirement. Assessors select from these lists; they are not a checklist of everything you must produce.

Examine
  • System and information integrity policy
  • procedures addressing flaw remediation
  • procedures addressing configuration management
  • system security plan
  • list of flaws and vulnerabilities potentially affecting the system
  • list of recent security flaw remediation actions performed on the system (e.g., list of installed patches, service packs, hot fixes, and other software updates to correct system flaws)
  • test results from the installation of software and firmware updates to correct system flaws
  • installation/change control records for security-relevant software and firmware updates
  • other relevant documents or records
Interview
  • System or network administrators
  • personnel with information security responsibilities
  • personnel installing, configuring, and maintaining the system
  • personnel with responsibility for flaw remediation
  • personnel with configuration management responsibility
Test
  • Organizational processes for identifying, reporting, and correcting system flaws
  • organizational process for installing software and firmware updates
  • mechanisms supporting or implementing reporting, and correcting system flaws
  • mechanisms supporting or implementing testing software and firmware updates

NIST SP 800-171A, potential assessment methods and objects for 3.14.1.

Evidence

No evidence examples are published for this requirement yet. The objectives above are what an assessor checks; evidence is whatever shows each one is true in your environment, dated and kept with your system security plan.

Scoring weight

Worth 5 points. Not meeting this requirement subtracts 5 from your 110-point SPRS score. These are the requirements with the largest effect on your posture.

DoD NIST SP 800-171 Assessment Methodology v1.2.1 weighting, as carried in the Bedrock scoring table. The score starts at 110 and subtracts the weight of every requirement not met.

In Rev. 3

Rev. 2 is what your contract requires today. A standing DoD class deviation keeps Rev. 2 in force; NIST has published Rev. 3, but it is not adopted for contracts. In Rev. 3 this requirement is reworded: 03.14.01 Flaw Remediation. It gains organization-defined parameters.

See the Rev. 2 and Rev. 3 wording word by word, or start with the status page.

Where this page's facts come from
Requirement text
bedrock-cmmc-api@89b8e8e:migrations/004_reference_requirements.sql#Requirement.basicRequirement@rev2
Discussion
bedrock-cmmc-api@89b8e8e:migrations/004_reference_requirements.sql#Requirement.discussion@rev2
Practice name
bedrock-cmmc-api@89b8e8e:migrations/004_reference_requirements.sql#Requirement.title@rev2 (CMMC Assessment Guide practice name)
Objectives
bedrock-cmmc-api@89b8e8e:migrations/005_reference_objectives.sql#AssessmentObjective.description@rev2
Examine, interview, test
bedrock-cmmc-api@89b8e8e:migrations/005_reference_objectives.sql#AssessmentObjective.description@rev2 ({examineGuidance, interviewGuidance, testGuidance})
Level
bedrock-cmmc-api@89b8e8e:migrations/021_fix_level1_requirements.sql#Requirement.cmmcLevel@rev2
Weight
bedrock-cmmc-api@89b8e8e:internal/cmmc/requirement_values.go#requirementValues (DoD AM v1.2.1 / eMASS L2 template v3.8)
Rev. 3 mapping
bedrock-cmmc-api@89b8e8e:docs/reference/nist-800-171-rev3/normalized/r2_r3_transition_map.json#r2_to_r3
Plain-language title and summary
editorial/CMMC Navigator.dc.html#RAW (Foxx Cyber editorial)