Skip to content
ControlVerdict
Sign in
SI.L2-3.14.7CMMC Level 2Level 2

Identify Unauthorized Use

Submit your own example

Practice statement

Identify unauthorized use of organizational systems.

Quoted verbatim from NIST SP 800-171 Rev. 2 §3.14.7.Source

The source document’s non-normative “Discussion” section is not reproduced here. ControlVerdict quotes normative text verbatim or omits it — it never paraphrases a standard. Follow the source link above for the full context.

Assessment Objectives(2)

An assessor determines each objective separately. “Mostly implemented” is not a result — every objective below has to stand on its own.

  1. [a]

    authorized use of the system is defined; and

    1 example covers this

  2. [b]

    unauthorized use of the system is identified.

    1 example covers this

Objective text quoted verbatim from NIST SP 800-171A via the CMMC Level 2 assessment guide.

Implementation examples(1)

Submit your own example
  • addresses
    SI.L2-3.14.7Identify Unauthorized Use
    Identify unauthorized use of organizational systems.

    • [a]

      authorized use of the system is defined; and

    • [b]

      unauthorized use of the system is identified.

    Write down what authorized use looks like, then alert on what falls outside it

    ControlVerdict Corpus@cv-corpusOSCJul 31, 2026
    Community is just starting — add yours. No verdicts yet.

    Implementation

    AO coverage. Addresses both Identify Unauthorized Use objectives: authorized use of the system is defined, and unauthorized use is identified.

    Defining authorized use [a]. This is the objective most organizations skip, so it is written down explicitly and reviewed with the business. The authorized-use baseline states: which roles may access which CUI applications; that CUI is accessed only from managed, compliant devices; that administrative actions occur from the privileged account on the management path; that bulk export of CUI is limited to named roles and expected to be rare; that automated access happens through inventoried service principals rather than human accounts; and the normal working-hours envelope per team, with on-call and overseas-travel exceptions named rather than left implicit. Users acknowledge the acceptable-use standard at hire and annually.

    Identifying unauthorized use [b]. Detections are written against the baseline rather than against a generic template, which is what makes them low-noise here. Standing detections: access attempt to a CUI application from a noncompliant or unmanaged device; sign-in from a country outside the travel-approved list; administrative action taken from a standard account or from outside the management path; human credential used from a datacenter address range, which usually means a service account pattern on a person's identity; bulk download or mass file access exceeding the role's normal envelope; access to CUI applications by an account outside the authorizing group, which should be impossible and therefore is high-signal; DLP alert on labeled content leaving through an unapproved path; and a dormant account reactivating.

    Corroborating reviews. Quarterly access reviews compare group membership against the job roster, and the same review looks at activity rather than only entitlement: a member of a CUI group with no access in 90 days is a candidate for removal, and an account with activity far outside its role's pattern is a candidate for investigation. Service principal activity is reviewed against its documented purpose.

    Response path. An off-baseline detection is triaged as a possible incident, not silently closed. Triage records the finding, the user contact if applicable, and one of three outcomes: authorized but undocumented — update the baseline; misuse — HR and policy path; or suspected compromise — incident response. Updating the baseline is an explicit, allowed outcome, which is what keeps the definition honest instead of frozen.

    Maintenance. Monthly review of detection volume and false-positive rate. Quarterly review of the authorized-use baseline with team leads, since a baseline nobody maintains produces alerts everyone ignores. Annual tabletop walking an insider-misuse scenario through the detection and response path.

    Accepted gap. Field engineers travel with little notice, so travel-based location detections carry a higher false-positive rate than the rest. Rather than disabling them, the process requires a travel notification ticket that suppresses the detection for a bounded window, and un-notified travel is triaged by contacting the user.

    What the evidence looks like

    • Authorized-use baseline document with version history and business sign-off
    • Acceptable-use acknowledgment records for a sample of users
    • Detection catalog mapped to specific baseline statements
    • Triage records for off-baseline detections, including one that resulted in a baseline update
    • Quarterly access-and-activity review report with resulting removals

    Environment

    ~180 users; CUI applications behind SSO; documented acceptable-use standard and a written baseline of normal administrative activity.

    Tools

Discussion(0)

No discussion on this control yet

Edge cases, scoping questions, and “would this pass?” scenarios belong here.

Sign in to start a thread.