SI.L2-3.14.2
Malicious Code Protection [CUI Data]
Source and approval
CMMC Assessment Guide — Level 2 · Revision 2.13
Publisher approved · Complete cited source edition 2026-10-31
Read the official guideSee SI.L2-3.14.2 in the reference catalog with its NIST cross-references
Official requirement
Provide protection from malicious code at designated locations within organizational systems.
Assessment objectives
a. designated locations for malicious code protection are identified; and
b. protection from malicious code at designated locations is provided.
Implementation guidance
Editorial examples to help you plan. Adapt them to your environment; the official requirement and objectives remain authoritative.
In plain language
Provide malicious-code protection at appropriate system locations.
Implementation example
Example from the source assessment guide (not a mandatory implementation): You are buying a new computer and want to protect your company ’s information from viruses, spyware, etc. You buy and install anti-malware software [a,b].
Evidence examples
Examples suggested by the source guide (not an exhaustive or mandatory checklist): System and information integrity policy; configuration management policy and procedures; procedures addressing malicious code protection; records of malicious code protection updates; malicious code protection mechanisms; system security plan; system configuration settings and associated documentation; record of actions initiated by malicious code protection mechanisms in response to malicious code detection; scan results from malicious code protection mechanisms; system design documentation; system audit logs and records; other relevant documents or records
Common mistakes
Assuming one protected endpoint proves protection across the in-scope environment.