SI.L1-b.1.xiii
Malicious Code ProTection [FCI Data]
Source and approval
CMMC Assessment Guide — Level 1 · Revision 2.13
Publisher approved · Complete cited source edition 2026-10-31
Read the official guideSee SI.L1-b.1.xiii in the reference catalog with its NIST cross-references
Official requirement
Provide protection from malicious code at appropriate locations within organizational information systems.
Assessment objectives
a. designated locations for malicious code protection are identified; and
b. protection from malicious code at designated locations is provided.
Implementation guidance
Editorial examples to help you plan. Adapt them to your environment; the official requirement and objectives remain authoritative.
In plain language
Use malicious-code protection at the system locations where it is needed.
Implementation example
Example from the source assessment guide (not a mandatory implementation): Your company’s IT team is buying new computer s and wants to protect your company’s information from viruses and spyware. The computers will be used to process, store, and transmit FCI . They research anti -malware products , select an appropriate solution, and deploy antivirus software on all hosts for which satisfactory antivirus software is available [a,b].
Evidence examples
Examples suggested by the source guide (not an exhaustive or mandatory checklist): System and information integrity policy; configuration management policy and procedures; procedures addressing malicious code protection; records of malicious code protection updates; malicious code protection mechanisms; system security plan; system configuration settings and associated documentation; record of actions initiated by malicious code protection mechanisms in response to malicious code detection; scan results from malicious code protection mechanisms; system design documentation; system audit logs and records; other relevant documents or records
Common mistakes
Installing protection once without checking its coverage or whether it is operating.