Mapped to NIST 800-171 Requirement: 3.14.6
CMMC Assessment Objective: SI.L2-3.14.6[b]
What This Control Means
After identifying systems that need updates (SI.L2-3.14.6[a]), this objective ensures you:
• Document the systems and components that must be updated
• Define patching or update requirements for those systems
• Link CUI-related systems to vulnerability management processes
This documentation is typically housed in your:
• System Security Plan (SSP)
• Vulnerability Management Policy
• Asset inventory or CMDB (Configuration Management Database)
Why It Matters
Without documented patching scope:
• Critical CUI systems might be overlooked during update cycles
• Patch management efforts will be inconsistent
• New systems might be deployed without patch compliance enforcement
• Auditors won’t be able to verify you have a proactive patching strategy
Documenting your patching scope ensures nothing critical is missed.
How to Implement It
1. Update the SSP and Patch Management Policies Document:
• Which servers, endpoints, cloud systems, and network appliances require vulnerability updates
• How often these systems are reviewed for updates
• Special considerations for legacy or unsupported systems
2. List Systems by Category Examples:
• Windows servers and workstations
• Linux servers
• Mobile devices with CUI access
• Firewall and VPN appliances
• Cloud applications storing or processing CUI
3. Describe Update Sources
• Microsoft Update, Red Hat repositories, Cisco advisories, etc.
4. Assign Ownership
• Define who is responsible for updating and verifying each system type
Evidence the Assessor Will Look For
• SSP entries listing systems requiring patching
• Asset inventories or CMDBs showing CUI-related systems
• Patch management policies or playbooks
• Records of update schedules or patching deadlines
• Responsibility matrix for patch deployment and tracking
Common Gaps
• Patching policies exist but don’t tie to specific systems
• Only general OS patching mentioned—no cloud, application, or network device coverage
• No linkage between CUI sensitivity and update prioritization
• Systems onboarded without patching enforcement or documentation updates
How Cuick Trac Helps
Cuick Trac supports this requirement by:
• Documenting which systems require vulnerability updates tied to CUI protection
• Mapping patching requirements to specific asset types and ownership
• Tracking update schedules, deployment status, and overdue patches
• Alerting on missing or undocumented patching responsibilities
• Keeping your SSP and vulnerability management documentation audit-ready
With Cuick Trac, your update strategy is mapped, structured, and always aligned with compliance.
Final CTA
Good patching starts with knowing exactly what to protect.
Schedule a Cuick Trac demo to document your patching responsibilities and lock down your CUI systems.