Select Page
Back to Full CMMC & NIST800-171 Requirements List

CMMC Practice Requirement:

System and Information Integrity – SI.5.222

Analyze system behavior to detect and mitigate execution of normal system commands and scripts that indicate malicious actions.

System and Information Integrity – SI.5.222- Clarification Statement

Normal system commands and scripts used by the adversary will be allowed by normal application whitelists. The adversary uses this fact to move around despite the presence of whitelisting or other defenses. An organization may use endpoint detection and response (EDR) to record system activities and events that occur. Analyzing EDR records is one way to identify execution of a script that operates outside of normal parameters, indicating an exploit is in progress. Another way to approach this is to use User and Entity Behavior Analytics solutions to identify malicious activity.


Need more help understanding this CMMC & NIST800-171 requirement?

ChatFortress has made available a series of tools to help you implement CMMC & NIST800-171 into your company. Here are some of the resources you might want to review.

How to Implement a CMMC Audit/Assessment using CMMC Software Tool?

How can ChatFortress help you implement CMMC?


Are you worried that your company is vulnerable to ransomware?

The Business Cybersecurity System protects you against real-world threats while building your cybersecurity culture. Using the latest in breach and attack simulation our team can show you which ransomware and malware attacks would cripple your company regardless of the cybersecurity protections you already have in place!

Who is ChatFortress

ChatFortress is a leading cybersecurity company that helps small and medium-size companies protect themselves from hacking attempts. Using Cybersecurity AI, Gamified cybersecurity awareness programs and providing virtual security analysts. Our goal is to help you create a cybersecurity aware culture.