Back to Control Explorer



Control Acronym



System And Information Integrity

CMMC Level


800-171 Control #


CMMC Description

Update malicious code protection mechanisms when new releases are available.

CMMC Clarification

You can protect your company’s valuable IT systems by staying up to date on new security releases that stop malicious code and monitoring the system regularly. Malicious code is program code that is always changing, so it is important to always have up-to-date protections, such as anti-malware tools. Example You bought a new computer for your small business. You know that you need to protect your company’s information from viruses, spyware, etc. So, you also purchased and installed antimalware software. You configure the software to automatically update to the latest antivirus code and definitions of all known malware.

800-171 Description

Update malicious code protection mechanisms when new releases are available.

800-171 Discussion

Malicious code protection mechanisms include anti-virus signature definitions and reputation- based technologies. A variety of technologies and methods exist to limit or eliminate the effects of malicious code. Pervasive configuration management and comprehensive software integrity controls may be effective in preventing execution of unauthorized code. In addition to commercial off-the-shelf software, malicious code may also be present in custom-built software. This could include logic bombs, back doors, and other types of cyber-attacks that could affect organizational missions/business functions. Traditional malicious code protection mechanisms cannot always detect such code. In these situations, organizations rely instead on other safeguards including secure coding practices, configuration management and control, trusted procurement processes, and monitoring practices to help ensure that software does not perform functions other than the functions intended.

Other Source Discussion


CIS Control References

CIS Controls v7.1 8.2

NIST 800-53 Control Ref.

NIST SP 800-53 Rev 4 SI-3

CMMC Derived

NIST CSF Control References


NIST 800-171 References

NIST SP 800-171 Rev 1 3.14.4

Applicable FAR Clause

FAR Clause 52.204-21 b.1.xiv

NIST CSF Control Reference

CERT RMM Reference


Modification of NIST 800-171B Reference

NIST 800-171B Reference

UK NCSCCyber Reference

AS ACSC Reference


Assessment Sub-Criteria 1

SI.1.212.[a] malicious code protection mechanisms are updated when new releases are available.

Assessment Sub-Criteria 2

Assessment Sub-Criteria 3

Assessment Sub-Criteria 4

Assessment Sub-Criteria 5

Assessment Sub-Criteria 6

Assessment Sub-Criteria 7

Assessment Sub-Criteria 8

Assessment Sub-Criteria 9

Assessment Sub-Criteria 10

Assessment Sub-Criteria 11

Assessment Sub-Criteria 12

Assessment Sub-Criteria 13

Assessment Sub-Criteria 14

Assessment Sub-Criteria 15