SI.L2-3.14.6
Monitor Communications for Attacks
Source and approval
CMMC Assessment Guide — Level 2 · Revision 2.13
Publisher approved · Complete cited source edition 2026-10-31
Read the official guideSee SI.L2-3.14.6 in the reference catalog with its NIST cross-references
Official requirement
Monitor organizational systems, including inbound and outbound communications traffic, to detect attacks and indicators of potential attacks.
Assessment objectives
a. the system is monitored to detect attacks and indicators of potential attacks;
b. inbound communications traffic is monitored to detect attacks and indicators of potential attacks; and
c. outbound communications traffic is monitored to detect attacks and indicators of potential attacks.
Implementation guidance
Editorial examples to help you plan. Adapt them to your environment; the official requirement and objectives remain authoritative.
In plain language
Monitor systems and incoming and outgoing communications for attacks or indicators of attacks.
Implementation example
Example from the source assessment guide (not a mandatory implementation): It is your job to look for known indicators of attack or anomalous activity within your systems and communications traffic [a,b,c]. Because these indicators can show up in a variety of places on your network, you have created a checklist of places to check each week. These include the office firewall logs, the audit logs of the file server where CUI is stored, and the connection log for your VPN gateway [b]. You conduct additional reviews when you find an indicator, or something that does not perform as it should [a].
Evidence examples
Examples suggested by the source guide (not an exhaustive or mandatory checklist): System and information integrity policy; pr ocedures addressing system monitoring tools and techniques; continuous monitoring strategy; system and information integrity policy; procedures addressing system monitoring tools and techniques; facility diagram or layout; system security plan; system monitoring tools and techniques documentation; system design documentation; locations within system where monitoring devices are deployed; system protocols; system configuration settings and associated documentation; system audit logs and records; other relevant documents or records
Common mistakes
Monitoring inbound traffic while ignoring outbound activity or system-level indicators.