Assessment NOTES: A CMMC assessor may want to review, observe, or test the following

·      Procedures to identify how the organizations receive security alerts, advisories, and directives from external organizations and how internal alerts of similar nature are generated and effectively communicated.

·      Procedures and processes to ensure an appropriate action is taken in response to the alerts and advisories with relevant external entities, such as supply chain partners.

Threat Actors:   

i) may take advantage of a poor network monitoring capability and use intrusion techniques to gain persistent access to your network

·  Procedures that addresses system monitoring tools and methods used to detect potential threats for all inbound and outbound communications, as well as,  unauthorized local, network or remote connectivity.

·  Supporting documentation that identifies network monitoring tools, security detection and monitoring systems, roles and responsibilities of individuals that monitor and respond to potential threats, or any third-party services supporting this practice.

·  If emails are scanned for malicious code, links, or attachments.