SI.L1-3.14.5  

Reference: CMMC 2.0

Family: SI

Level Introduced: 1

Title: System & File Scanning

Practice:
Perform periodic scans of the information system and real-time scans of files from external sources as files are downloaded, opened, or executed.

CMMC Clarification:
Companies should use anti-malware software to scan and identify viruses in their computer systems, and have a plan for how often scans are conducted. Real-time scans will look at the system whenever new files are downloaded, opened, and saved. Periodic scans check previously saved files against updated malware information.

Example
While cleaning up your office, you find your old thumb drive. You are not sure if you should use it. Then you remember something: Your company just purchased anti-malware software that auto-updates with the latest antivirus code and definitions of all known malware. With this in mind, you decide to plug in the thumb drive. The new anti-malware software scans the thumb drive, finds a virus, then deletes the file.

Source: CMMC v2.0