Skip to content
ControlVerdict
Sign in
SI.L2-3.14.5CMMC Level 2Level 2

System & File Scanning [CUI Data]

Submit your own example

Practice statement

Perform periodic scans of organizational systems and real-time scans of files from external sources as files are downloaded, opened, or executed.

Quoted verbatim from NIST SP 800-171 Rev. 2 §3.14.5.Source

The source document’s non-normative “Discussion” section is not reproduced here. ControlVerdict quotes normative text verbatim or omits it — it never paraphrases a standard. Follow the source link above for the full context.

Assessment Objectives(3)

An assessor determines each objective separately. “Mostly implemented” is not a result — every objective below has to stand on its own.

  1. [a]

    the frequency for malicious code scans is defined;

    1 example covers this

  2. [b]

    malicious code scans are performed with the defined frequency; and

    1 example covers this

  3. [c]

    real-time malicious code scans of files from external sources as files are downloaded, opened, or executed are performed.

    1 example covers this

Objective text quoted verbatim from NIST SP 800-171A via the CMMC Level 2 assessment guide.

Implementation examples(1)

Submit your own example
  • addresses
    SI.L2-3.14.5System & File Scanning [CUI Data]
    Perform periodic scans of organizational systems and real-time scans of files from external sources as files are downloaded, opened, or executed.

    • [a]

      the frequency for malicious code scans is defined;

    • [b]

      malicious code scans are performed with the defined frequency; and

    • [c]

      real-time malicious code scans of files from external sources as files are downloaded, opened, or executed are performed.

    Weekly full scans plus real-time scanning of every externally sourced file

    ControlVerdict Corpus@cv-corpusOSCJul 31, 2026
    Community is just starting — add yours. No verdicts yet.

    Implementation

    AO coverage. Addresses all three System & File Scanning objectives: the scan frequency is defined, periodic scans happen at that frequency, and files from external sources are scanned in real time.

    Defined frequency [a]. The standard states it plainly: a full scan weekly on every managed endpoint and server, a quick scan daily, and real-time protection continuously. Internet-facing servers get a full scan every 72 hours. The value is written down with its rationale so the defined-versus-performed comparison is a document check rather than an interview.

    Performing them [b]. Scheduled scans are configured centrally with a randomized start window inside the overnight period, catch-up enabled so a laptop that was off overnight scans on next power-on, and a maximum CPU ceiling so users do not have a reason to want them gone. Completion is tracked as a report, not assumed: devices with no completed full scan in 10 days appear on the weekly exception list and become tickets past 14 days. Linux build servers run the same cadence through their scheduler.

    Real-time scanning of external files [c]. Real-time protection is enabled and tamper-protected, covering the download, open, and execute paths. Browser downloads are scanned on write. Mail attachments are scanned at the gateway before delivery and again on the endpoint at open. Archives are scanned on extraction, which matters here because supplier CAD deliverables arrive as large nested archives — the endpoint policy has archive scanning enabled rather than relying on the default size cap, and archives above the practical scan limit route to the detonation sandbox instead of being skipped. Files arriving through the customer portal are scanned before the enclave retrieves them. Removable media on the two permitted hosts scans on insertion with autorun disabled.

    Exclusions discipline. Every scan exclusion is ticketed, scoped to a specific path or process rather than a whole drive, justified by a vendor requirement, and reviewed quarterly. Broad exclusions inherited from old vendor guidance are the most common way real-time protection becomes decorative, so the exclusion list is a standing review item.

    Maintenance. Weekly scan-completion and exclusion report. Quarterly exclusion review with the requesting owner re-justifying each entry. Annual test using a benign detection-test file on each platform to confirm real-time, download, and archive paths all trigger.

    Accepted gap. A large simulation dataset directory is excluded from full scans for performance reasons. It is write-restricted to the simulation service account, its inputs are scanned before they land there, and the exclusion carries a quarterly re-justification.

    What the evidence looks like

    • Configuration standard stating the defined scan frequency per asset class
    • Scan policy export showing schedule, catch-up, real-time protection, and archive scanning
    • Weekly scan-completion report with the exception list and resulting tickets
    • Scan exclusion register with justification and last review date per entry
    • Annual detection-test results for real-time, download, and archive paths

    Environment

    Windows fleet, macOS engineers, Linux build servers. Staff routinely download supplier CAD archives and firmware images from partner portals.

    Tools

Discussion(0)

No discussion on this control yet

Edge cases, scoping questions, and “would this pass?” scenarios belong here.

Sign in to start a thread.