| name | Malicious Code Protection (03.14.02)_malicious-code-protection |
| description | Implement malicious code protection mechanisms at system entry and exit points to detect and eradicate malicious code. |
| category | input-validation |
| version | 3.0 |
| author | cyberstrike-official |
| tags | ["nist","sp800-171","rev3","malicious code protection (03-14-02)","family-03.14","cui-protection","cmmc"] |
| tech_stack | ["aws","azure","gcp","linux","windows"] |
| cwe_ids | ["CWE-20"] |
| chains_with | [] |
| prerequisites | [] |
| severity_boost | {} |
Malicious Code Protection (03.14.02) Malicious Code Protection
High-Level Description
Family: System and Information Integrity
Framework: NIST SP 800-171 Rev 3
Applicability: Systems processing, storing, or transmitting CUI
Implement malicious code protection mechanisms at system entry and exit points to detect and eradicate malicious code.
Update malicious code protection mechanisms as new releases are available in accordance with configuration management policies and procedures.
Configure malicious code protection mechanisms to:
Perform scans of the system [organization-defined] and real-time scans of files from external sources at endpoints or system entry and exit points as the files are downloaded, opened, or executed; and
Block malicious code, quarantine malicious code, or take other mitigation actions in response to malicious code detection.
What to Check
How to Test
Step 1: Review System Security Plan
Examine the SSP for Malicious Code Protection (03.14.02) implementation description and responsible parties.
Step 2: Assess Implementation
# Verify security controls protecting CUI
# Check access controls, encryption, monitoring as applicable
# For Linux systems:
ls -la /etc/security/ 2>/dev/null
grep -r "CUI\|controlled" /etc/security/ 2>/dev/null
# For cloud:
# Use cloud-audit-mcp tools to assess posture
Step 3: CMMC Assessment Validation
Verify this requirement passes CMMC Level 2 assessment methodology per SP 800-171A Rev 3.
Tools
| Tool | Purpose | Usage |
|---|
| cloud-audit-mcp | Assess cloud CUI environment | cloud_audit_* tools |
| Manual Review | SSP and POA&M review | Documentation analysis |
Remediation Guide
Requirement Statement
Implement malicious code protection mechanisms at system entry and exit points to detect and eradicate malicious code.
Update malicious code protection mechanisms as new releases are available in accordance with configuration management policies and procedures.
Configure malicious code protection mechanisms to:
Perform scans of the system [organization-defined] and real-time scans of files from external sources at endpoints or system entry and exit points as the files are downloaded, opened, or executed; and
Block malicious code, quarantine malicious code, or take other mitigation actions in response to malicious code detection.
