SI.L2-3.14.1
Flaw Remediation [CUI Data]
Source and approval
CMMC Assessment Guide — Level 2 · Revision 2.13
Publisher approved · Complete cited source edition 2026-10-31
Read the official guideSee SI.L2-3.14.1 in the reference catalog with its NIST cross-references
Official requirement
Identify, report, and correct system flaws in a timely manner.
Assessment objectives
a. the time within which to identify system flaws is specified;
b. system flaws are identified within the specified time frame;
c. the time within which to report system flaws is specified;
d. system flaws are reported within the specified time frame;
e. the time within which to correct system flaws is specified; and
f. system flaws are corrected within the specified time frame.
Implementation guidance
Editorial examples to help you plan. Adapt them to your environment; the official requirement and objectives remain authoritative.
In plain language
Identify, report, and correct system flaws within the defined time frames.
Implementation example
Example from the source assessment guide (not a mandatory implementation): You know that software vendors typically release patches, service packs, hot fixes, etc. and want to make sure your software is up to date. You develop a policy that requires checking vendor websites for flaw notifications every week [a]. The policy further requires that those flaws be assessed for severity and patched on end -user computers once each week and servers once each month [c,e]. Consistent with that policy, you configure the system to check for updates weekly or daily depending on the criticality of the software [b,e]. Your team reviews available updates and implements the applicable ones according to the defined schedule [f]. 220 NIST SP 800-171 Rev. 2, pp. 40-41.
Evidence examples
Examples suggested by the source guide (not an exhaustive or mandatory checklist): System and information integrity policy; procedures addressing flaw remediation; procedures addressing configuration management; system security plan; list of flaws and vulnerabilities potentially affecting the system; list of recent security flaw remediation actions performed on the system (e.g., list of installed patches, service packs, hot fixes, and other software updates to correct system flaws); test results from th e installation of software and firmware updates to correct system flaws; installation/change control records for security -relevant software and firmware updates; other relevant documents or records
Common mistakes
Tracking a patch release without confirming its deployment or an approved handling decision.