SI.L2-3.14.2 Malicious Code Protection — CMMC Level 2
Malicious code poses a persistent threat to organizational systems and data. SI.L2-3.14.2 requires you to implement protective measures at strategic points across your information systems. This control is essential for defending against viruses, worms, trojans, and other code-based threats that target SMBs.
What this means
This control requires your organization to deploy malicious code protection mechanisms—such as antivirus, anti-malware, and endpoint protection tools—at appropriate locations throughout your information systems. 'Appropriate locations' means entry points, workstations, servers, and network boundaries where malicious code is most likely to enter or execute. The goal is to detect, quarantine, and remove malicious software before it compromises your systems or data.
How to comply
- 1.Identify all entry points and high-risk locations where malicious code could enter (email gateways, file shares, USB ports, network boundaries)
- 2.Deploy endpoint protection tools on all workstations, laptops, and servers with real-time scanning and quarantine capabilities
- 3.Implement mail gateway filtering to scan inbound and outbound email attachments
- 4.Enable automatic signature updates for all malicious code protection tools
- 5.Configure centralized management and monitoring of protection tools across all systems
- 6.Establish a process to review and respond to malicious code detection alerts
- 7.Conduct regular vulnerability scans and security assessments to validate coverage
Evidence auditors look for
- Antivirus/anti-malware software deployment reports showing coverage across all systems
- Endpoint protection console screenshots demonstrating active monitoring and real-time scanning
- Email gateway filter logs showing scanned attachments and detected threats
- Centralized management tool configurations confirming automatic updates are enabled
- Security incident logs documenting malicious code detections and remediation actions
- System inventory documenting protected assets and protection tool versions
- Vulnerability scan reports showing malware detection capabilities are functioning
Frequently asked questions
When will FAQs be available?
The FAQ for this control is currently being prepared.
GRCWatch automates malicious code protection monitoring by continuously tracking endpoint security tool deployment, update status, and detection logs across your environment—eliminating manual evidence gathering for SI.L2-3.14.2 audits.
See how GRCWatch handles this control automatically
Start free trial