SI.L2-3.14.7
Identify Unauthorized Use
Source and approval
CMMC Assessment Guide — Level 2 · Revision 2.13
Publisher approved · Complete cited source edition 2026-10-31
Read the official guideSee SI.L2-3.14.7 in the reference catalog with its NIST cross-references
Official requirement
Identify unauthorized use of organizational systems.
Assessment objectives
a. authorized use of the system is defined; and
b. unauthorized use of the system is identified.
Implementation guidance
Editorial examples to help you plan. Adapt them to your environment; the official requirement and objectives remain authoritative.
In plain language
Identify unauthorized use of organizational systems.
Implementation example
Example from the source assessment guide (not a mandatory implementation): You are in charge of IT operations. You need to ensure that everyone using an organizational system is authorized to do so and conforms to the written authorized use policy . To do this, you deploy an application that monitors user activity and records the information for later analysis. You review the data from this application for signs of activity that does not conform to the acceptable use policy [a,b]. Example 2 You are alerted through your Intrusion Detection System (IDS) that one of your users is connecting to a server that is from a high-risk domain (based on your commercial domain reputation service). You investigate and determine that it’s not the user, but instead an unauthorized connection attempt [b]. You add the domain to your list of blocked domains to prevent connections in the future.
Evidence examples
Examples suggested by the source guide (not an exhaustive or mandatory checklist): Continuous monitoring strategy; system and information integrity policy; procedures addressing system monitoring tools and techniques; facility diagram/layout; system security plan; system design documentation; system monitoring tools and techniques documentation; locations within system where monitoring devices are deployed; system configuration settings and associated documentation; other relevant documents or records
Common mistakes
Collecting activity records without a process to recognize and investigate unauthorized use.