SI.L2-3.14.3
Security Alerts & Advisories
Source and approval
CMMC Assessment Guide — Level 2 · Revision 2.13
Publisher approved · Complete cited source edition 2026-10-31
Read the official guideSee SI.L2-3.14.3 in the reference catalog with its NIST cross-references
Official requirement
Monitor system security alerts and advisories and take action in response.
Assessment objectives
a. response actions to system security alerts and advisories are identified;
b. system security alerts and advisories are monitored; and
c. actions in response to system security alerts and advisories are taken.
Implementation guidance
Editorial examples to help you plan. Adapt them to your environment; the official requirement and objectives remain authoritative.
In plain language
Monitor security alerts and advisories and take appropriate action.
Implementation example
Example from the source assessment guide (not a mandatory implementation): You monitor security advisories each week . You review the alert emails and online subscription service alerts to determine which ones apply [b] . You create a list of the applicable alerts and research what steps you need to take to address them. Next, you generate a plan that you review with your change management group so that the work can be scheduled [c].
Evidence examples
Examples suggested by the source guide (not an exhaustive or mandatory checklist): System and information integrity policy; procedures addressing security alerts, advisories, and directives; system security plan; records of security alerts and advisories; other relevant documents or records
Common mistakes
Subscribing to alerts without assigning responsibility for reviewing and acting on them.