Mapped to NIST 800-171 Requirement: 3.14.6
CMMC Assessment Objective: SI.L2-3.14.6[a]
What This Control Means
You must know and document which systems are within scope for vulnerability updates and patch management. This includes:
• Servers
• Endpoints (laptops, desktops, mobile devices)
• Cloud services and SaaS platforms
• Firewalls, routers, and other network infrastructure
• Security and backup systems
• Custom applications and third-party software components
If the system touches CUI, it must be patched appropriately.
Why It Matters
If you don’t know which systems need patching:
• Critical vulnerabilities could persist across your environment
• Systems storing CUI could be exploited without you realizing it
• Patching gaps would be flagged during CMMC or DFARS audits
• Attackers often target known, unpatched vulnerabilities as a first move
Visibility into your update scope is the foundation of good patch management.
How to Implement It
1. Create or Update a System Inventory
• List:
◦ CUI-handling servers and workstations
◦ Cloud platforms and apps
◦ Network and security appliances
◦ Mobile devices and remote endpoints
2. Link Systems to Vulnerability Sources
• Track:
◦ OS patches (Windows Update, Linux repositories, Apple updates)
◦ Application updates (Adobe, Java, Microsoft Office, etc.)
◦ Network device firmware updates (firewalls, switches, etc.)
3. Document Critical Systems First
• Prioritize systems based on:
◦ CUI sensitivity
◦ External exposure (e.g., public-facing servers)
◦ Privileged access roles
4. Assign Patch Management Responsibility
• Identify who is responsible for tracking and deploying patches across each category
Evidence the Assessor Will Look For
• System inventory or asset register listing patchable systems
• SSP entries describing systems under patch management
• Patching schedules or records linked to asset types
• Roles and responsibilities assigned for patch management oversight
• Past vulnerability scan reports tied to systems needing updates
Common Gaps
• No system inventory connected to patching efforts
• Only OS patching covered—ignoring applications, cloud, or network gear
• No documentation prioritizing CUI-relevant systems for patching
• Inconsistent tracking of patch deployment across the enterprise
How Cuick Trac Helps
Cuick Trac supports this requirement by:
• Maintaining a centralized inventory of CUI systems requiring vulnerability updates
• Mapping systems to update sources and patch schedules
• Tracking update compliance status and exceptions
• Assigning patch management ownership for different system types
• Providing real-time visibility into patch status for audit and security teams
With Cuick Trac, no system gets left behind—and no vulnerability goes untracked.
Final CTA
You can’t patch what you don’t track.
Schedule a Cuick Trac demo to map, monitor, and manage system updates across your CUI environment.