Mapped to NIST 800-171 Requirement: 3.13.6
CMMC Assessment Objective: SC.L2-3.13.6[c]
What This Control Means
Assessors will want to confirm that:
• Security functions (e.g., audit logging, access control enforcement, system integrity checks)
• Are running in your environment
• Are operationally separated from general user functions
• And are performing as expected
These controls help prevent accidental or unauthorized tampering with critical protections.
Why It Matters
Security functions that exist in documentation—but not in practice—offer no protection.
• Logs can’t be trusted if users can disable or alter them
• Access controls fail if users can bypass or modify them
• System integrity checks are meaningless if they aren’t running
This control verifies that isolation = action, not just design.
How to Implement It
1. Review Live System Configurations
• Confirm audit logging is active and restricted to admins
• Ensure firewall and endpoint protection software is running as a separate service or module
• Validate IAM systems enforce access roles separately from business applications
2. Use Technical Validation Tools
• Log reviews
• Network scans
• Operating system security status reports
• File integrity monitoring outputs
3. Isolate Security Services
• Confirm that services such as:
◦ Anti-malware
◦ Audit logging
◦ Access policy enforcement
◦ MFA and authentication
…are installed and run separately from user applications or data storage
4. Monitor and Audit Security Functionality
• Set up alerts or dashboards to notify you if:
◦ Logs are disabled
◦ Security agents stop running
◦ Admin functions are accessed unexpectedly
Evidence the Assessor Will Look For
• Running services or system processes for isolated security functions
• Configurations showing logical/physical separation of roles
• Logs or reports proving the modules are active
• Screenshots showing modules cannot be accessed or modified by standard users
• Evidence of recent use (e.g., log entries, system alerts, access decisions)
Common Gaps
• Documentation exists, but services are inactive or misconfigured
• Logging turned off to save space or improve performance
• No enforcement around system integrity or access control modules
• General users can disable or bypass critical protections
How Cuick Trac Helps
Cuick Trac supports this requirement by:
• Monitoring whether critical security services are installed, isolated, and active
• Tracking the operational status of modules tied to CUI protection
• Logging audit trail data from security function usage
• Alerting when separation fails or modules are disabled
• Providing real-time dashboards and audit-ready records
With Cuick Trac, security functions are more than theoretical—they’re live, isolated, and working as designed.
Final CTA
Separation is only security if it’s enforced in practice.
Schedule a Cuick Trac demo to validate that your security functions are active, isolated, and protecting your CUI right now.