NIST SP 800-171 & CMMC 2.0 Control 3.14.7 Requirement:

Identify unauthorized use of organizational systems.

NIST SP 800-171 & CMMC 2.0 3.14.7 Requirement Explanation:

Your company's systems should only be used to support business functions. By defining unauthorized use of your system and using tools to identify unauthorized use you can enforce you security policies.

Example NIST SP 800-171 & CMMC 2.0 3.14.7 Implementation:

Create an IT acceptable use policy and have your system users sign off on it. The policy should define acceptable and unacceptable use of your systems. To identify unauthorized use of your system, review your intrusion detection system alerts, anti-virus software alerts, and firewall logs.

NIST SP 800-171 & CMMC 2.0 3.14.7 Scenario(s):

- Scenario 1:

The anti-virus software deployed to your company's workstations have a web content filtering capability. It filters out various unauthorized websites such as gambling and pornographic sites. Your company's acceptable use policy (signed by each employee) prevents users from using your system to view pornography. One day while reviewing system logs you determine that a user has been regularly viewing pornography. You report the policy violation and the employee is sanctioned.

- Scenario 2:

Upon reviewing network usage logs you identify a workstation on your network that is downloading large mp3 files. Upon further investigation you determine that an employee has been downloading pirated music in violation of yourIT acceptable use policy. You escalate this and the employee is sanctioned.

Discover Our NIST SP 800-171 & CMMC 2.0 Solutions:


Compliance Accelerator

Power through compliance. Meet and maintain your NIST SP 800-171 & CMMC 2.0 compliance requirements.

Quantum Assessor

Transform your business. Create new revenue streams and provide scalability for your NIST SP 800-171 and CMMC 2.0 services.

Supply Chain Verifier

Trust is everything. Verify, monitor, and support subcontactor compliance.