NIST SP 800-171 & CMMC 2.0 3.14.7 Requirement:
Identify unauthorized use of organizational systems.
NIST SP 800-171 & CMMC 2.0 3.14.7 Requirement Explanation:
Your company's systems should only be used to support business functions. By defining unauthorized use of your system and using tools to identify unauthorized use you can enforce you security policies.
Example NIST SP 800-171 & CMMC 2.0 3.14.7 Implementation:
Create an IT acceptable use policy and have your system users sign off on it. The policy should define acceptable and unacceptable use of your systems. To identify unauthorized use of your system, review your intrusion detection system alerts, anti-virus software alerts, and firewall logs.
NIST SP 800-171 & CMMC 2.0 3.14.7 Scenario(s):
- Scenario 1:
The anti-virus software deployed to your company's workstations have a web content filtering capability. It filters out various unauthorized websites such as gambling and pornographic sites. Your company's acceptable use policy (signed by each employee) prevents users from using your system to view pornography. One day while reviewing system logs you determine that a user has been regularly viewing pornography. You report the policy violation and the employee is sanctioned.
- Scenario 2:
Upon reviewing network usage logs you identify a workstation on your network that is downloading large mp3 files. Upon further investigation you determine that an employee has been downloading pirated music in violation of yourIT acceptable use policy. You escalate this and the employee is sanctioned.
Quick & Simple
Discover Our Cybersecurity Compliance Solutions:
Whether you need to meet and maintain your compliance requirements, help your clients meet them, or verify supplier compliance we have the expertise and solution for you
NIST SP 800-171 & CMMC Compliance
Become compliant, provide compliance services, or verify partner compliance with NIST SP 800-171 and CMMC requirements.
HIPAA Compliance
Become compliant, provide compliance services, or verify partner compliance with HIPAA security rule requirements.
FAR 52.204-21 Compliance
Become compliant, provide compliance services, or verify partner compliance with FAR 52.204-21 Basic Safeguarding of Covered Contractor Information Systems requirements.
ISO 27001 Compliance
Become compliant, provide compliance services, or verify partner compliance with ISO 27001 requirements.