Frameworks / CMMC 2.0 / SI.L2-3.14.6 CMMC 2.0
System and Information Integrity
CMMC 2.0 SI.L2-3.14.6: Monitor Communications for Attacks Watch organizational systems, and both inbound and outbound traffic, for attacks and for indicators that an attack may be developing.
Maintained by Gerard Blokdyk · Verified against the published standard 31 May 2026 · Control text last updated 21 May 2026 What else in your programme already covers this This control maps to 73 controls across 23 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
10.2.1 10.2.1 Audit logging enabled on all system components 10.4.1 10.4.1 Daily review of security-relevant logs 10.4.1.1 10.4.1.1 Automated mechanisms used for audit log review 10.7.1 10.7.1 Service providers detect critical control failures (superseded) 11.5.1 11.5.1 IDS/IPS monitoring of CDE traffic 11.5.1.1 11.5.1.1 Service providers detect covert malware channels 5.4.1 5.4.1 Mechanisms detect and protect against phishing 6.4.1 6.4.1 Public web application review or automated protection 6.4.2 6.4.2 Automated web attack detection and prevention 5.2.2 5.2.2 Anti-malware detects and handles all known malware ASD37-07 Web content filtering (Excellent) ASD37-26 Software firewall - outbound (Very Good) ASD37-27 Outbound data loss prevention (Very Good) ASD37-28 Continuous incident detection and response (Excellent) ASD37-29 Host-based IDS/IPS (Very Good) ASD37-30 Endpoint detection and response (Very Good) ASD37-32 Network-based IDS/IPS (Limited) ASD37-33 Capture network traffic (Limited) CIS-13.1 Centralize Security Event Alerting CIS-13.2 Deploy a Host-Based Intrusion Detection Solution CIS-13.3 Deploy a Network Intrusion Detection Solution CIS-13.6 Collect Network Traffic Flow Logs CIS-13.7 Deploy a Host-Based Intrusion Prevention Solution CIS-13.8 Deploy a Network Intrusion Prevention Solution CIS-8.6 Collect DNS Query Audit Logs ASBv3-IR-3 Detection and analysis - create incidents based on high-quality alerts ASBv3-LT-1 Enable threat detection capabilities ASBv3-NS-4 Deploy intrusion detection/intrusion prevention systems (IDS/IPS) DP-2 Monitor anomalies and threats targeting sensitive data ES-1 Use Endpoint Detection and Response (EDR) LT-4 Enable network logging for security investigation 5.24 Information security incident management planning and preparation 8.16 Monitoring activities 8.20 Networks security 8.7 Protection against malware SOC2-CC6.6 CC6.6 Protection against threats from outside the system boundary SOC2-CC7.1 CC7.1 Detecting configuration changes and new vulnerabilities SOC2-CC7.2 CC7.2 Monitoring system components for anomalies SOC2-CC7.3 CC7.3 Evaluating security events to identify incidents C5-COS-01 Technical safeguards C5-COS-03 Monitoring of connections in the Cloud Service Provider's network C5-OPS-13 Logging and Monitoring - Identification of Events SI-4 System Monitoring SI-4(18) System Monitoring | Analyze Traffic and Covert Exfiltration (SI-4(18)) SI-4(4) Inbound and Outbound Communications Traffic SI-4 System Monitoring SI-4(18) System Monitoring | Analyze Traffic and Covert Exfiltration (SI-4(18)) SI-4(4) Inbound and Outbound Communications Traffic NIST-CSF-DE.AE-02 Potentially adverse events are analyzed to better understand associated activities NIST-CSF-DE.CM-01 Networks and network services are monitored to find potentially adverse events NIST-CSF-DE.CM-09 Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events 8.16 Monitoring activities 8.23 Web filtering 3.11.2e Threat Hunting 3.14.2e Monitor Organizational Systems with Specialized Capabilities E8-APP-ML3 Application Control (ML3) CPS234-30 Detection and Response Mechanisms 6.9.4 Logging and monitoring Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected .
Other controls in System and Information Integrity You are reading one control. How much of CMMC 2.0 have you already done? CMMC 2.0 SI.L2-3.14.6 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of CMMC 2.0 your existing evidence covers. Hold FedRAMP Moderate and 108 of 110 CMMC 2.0 controls already carry evidence.
Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 1 were rejected on the FedRAMP Moderate pair alone.
Query this from an agent The graph holds this control, the 73 it maps to, and the evidence behind each claim, over MCP and REST.