Requirements / System and Information Integrity (SI)
SI.L2-3.14.7
Identify Unauthorized Use
Official Source Material
- SPRS score value
- 3 points.
- POA&M eligibility
- Not eligible. It is worth more than 1 point.
- Level 1
- Not a Level 1 requirement.
Facts: NIST SP 800-171 DoD Assessment Methodology, Version 1.2.1, June 24, 2020, Annex A; 32 CFR Part 170, § 170.21 and § 170.24, eCFR text current as of September 17, 2026; CMMC Assessment Guide - Level 1, Version 2.13, September 2024.
Identify unauthorized use of organizational systems.
Determine if:
- [a] authorized use of the system is defined; and
- [b] unauthorized use of the system is identified.
Source: CMMC Assessment Guide - Level 2, Version 2.13, September 2024
Practitioner Guidance
How to meet it
Objective [a] is your acceptable use policy doing double duty.
Define authorized use of the system: who may use it, for what, with which software and services. The acceptable use policy people sign under your awareness program is the definition. Keep it specific enough that unauthorized has a meaning.
Not every prohibition needs a technical detector.
Objective [b] asks that unauthorized use is identified, not that every policy line has a sensor. Technical items get technical detection: alerts on unauthorized software from your inventory tooling, connections refused for unenrolled devices, log review flagging odd hours or odd volume. Non-technical prohibitions, such as photographing a screen, are covered by policy, training, and the duty to report that you place on everyone.
The mechanisms are ones you already run.
Endpoint detections, the log review from AU.L2-3.3.1, application inventory reports, and the network monitoring from SI.L2-3.14.6 all surface use outside the definition. Name them as the identification mechanisms in your system security plan. Objective [b] then points at running machinery instead of intent.
Over-engineering
- A user activity monitoring product that records screens. Objectives [a] and [b] are your acceptable use policy plus the logs and alerts you already collect.
- A technical detector for every prohibition in the policy. Some rules are enforced by supervision and reporting, and that is a legitimate mechanism.