13 Jul 2026CMMC Phase II suspended: no C3PAO assessments can be designated. DFARS 7012 and Rev 2 still apply.What changed, and what did not →

NIST SP 800-171 Rev 2 · 3.14 System & Information Integrity

3.14.1 Flaw remediation

Identify, report, and correct system flaws in a timely manner.
SPRS weight
5
5 points deducted from 110 when not implemented.
CMMC level
L1 + L2
Level 1 practice SI.L1-3.14.1, from FAR 52.204-21(b)(1)(xii)
Assessment objectives
6
From NIST SP 800-171A, each one a “determine if” an assessor answers.

What an assessor checks

NIST SP 800-171A breaks 3.14.1 into 6 objectives. Every one has to be met for the requirement to be met; a partial answer scores as not implemented.

  1. [a]Determine if the time within which to identify system flaws is specified.
  2. [b]Determine if system flaws are identified within the specified time frame.
  3. [c]Determine if the time within which to report system flaws is specified.
  4. [d]Determine if system flaws are reported within the specified time frame.
  5. [e]Determine if the time within which to correct system flaws is specified.
  6. [f]Determine if system flaws are corrected within the specified time frame.
Examine
[SELECT FROM: System and information integrity policy; procedures addressing flaw remediation; procedures addressing configuration management; security plan; list of flaws and vulnerabilities potentially affecting the system; list of recent security flaw remediation actions performed on the system (e.g., list of installed patches, service packs, hot fixes, and other software updates to correct system flaws); test results from the installation of software and firmware updates to correct system flaws; installation/change control records for security-relevant software and firmware updates; other relevant documents or records].
Interview
[SELECT FROM: System or network administrators; personnel with information security responsibilities; personnel installing, configuring, and maintaining the system; personnel with responsibility for flaw remediation; personnel with configuration management responsibility].
Test
[SELECT FROM: Organizational processes for identifying, reporting, and correcting system flaws; organizational process for installing software and firmware updates; mechanisms supporting or implementing reporting, and correcting system flaws; mechanisms supporting or implementing testing software and firmware updates].

If it is open: POA&M eligibility

Not POA&M-eligible: above the 1-point ceiling · 5 points deducted

Worth 5 points. No requirement over 1 point may appear on a Level 2 POA&M, so this has to be closed before the assessment.

A POA&M is only permitted at a score of 88 or above, and closes in one 180-day window. Check a full gap list or compute your score.

Where 3.14.1 maps

NIST SP 800-53 Rev 5

  • SA-11 Developer Security Testing
  • SA-22 Unsupported System Components
  • SI-1 System and Information Integrity Policy
  • SI-2 Flaw Remediation
  • SI-7 Software, Firmware, and Information Integrity
  • SI-10 Information Input Validation
  • SI-11 Error Handling

NIST CSF 2.0

No direct mapping.

SOC 2

No direct mapping.

Query it from your own tools

This page and the MacTech CMMC MCP server render the same dataset. Ask your assistant and it will answer from the methodology, not from memory.

lookup_control 3.14.1
get_assessment_objectives 3.14.1
generate_poam_entries ["3.14.1"]

Install the MCP server, free, no account.

From MacZine

Working notes on System & Information Integrity

The full run →