3.14 System and Information Integrity: the NIST SP 800-171 requirements

Identify, report, and correct flaws on a defined timeline: subscribe to vendor and CISA advisories for your stack, run the monthly patch cycle across OS, applications, and firmware, and track exceptions with compensating controls. Measure patch compliance with your RMM or vulnerability scanner rather than assuming success. Evidence: the patch management policy with timelines, deployment reports, and the exception register.

Deploy malicious code protection at the endpoints and the gateway: a modern EDR/antivirus (Defender for Endpoint, CrowdStrike, SentinelOne) on every workstation and server, plus email attachment/link scanning in your mail platform. Verify coverage: unprotected servers are the usual gap. Evidence: the EDR console showing full device coverage and email protection policy screenshots.

Monitor security alerts and advisories and act on them: designate who watches CISA alerts, vendor bulletins, and your EDR/SIEM notifications; define response actions (emergency patch, config change, threat hunt); and log what was done for significant advisories. A weekly advisory review habit with notes satisfies this at small scale. Evidence: the monitoring responsibility assignment and dated records of advisories reviewed and actions taken.

Ensure malware protection updates automatically: cloud-managed EDR handles definitions continuously, but verify update status in the console and alert on agents that fall behind or go offline. Remediate stale agents as found. Evidence: console reports showing definition/agent currency across the fleet and the stale-agent alert configuration.

Enable both real-time protection and periodic scanning: on-access scanning everywhere, scheduled full or quick scans on a defined cadence, and automatic scanning of removable media and downloaded files on connection/receipt. These are policy toggles in your EDR/AV product. Evidence: the protection policy export showing real-time, scheduled, and removable-media scan settings.

Monitor systems and traffic for attack indicators: enable your firewall's IDS/IPS, alert on suspicious identity events (impossible travel, brute force) via your SIEM or cloud identity protection, and use EDR behavioral detections at both the boundary and endpoints. A managed detection and response (MDR) service is a cost-effective way for small teams to get 24/7 coverage. Evidence: enabled detection rules, sample alerts with triage notes, and the MDR agreement if used.

Detect unauthorized use of your systems: alert on logons at unusual hours or from unusual locations, new device connections, and unauthorized software execution, using your SIEM, identity protection, and EDR detections; define in writing what "authorized use" means so violations are recognizable. Review these alerts as part of your regular log review. Evidence: the acceptable use definition, configured alert rules, and samples of investigated alerts.