NIST 800-171 Controls · System and Information Integrity

SI.1.002 — Provide Malicious Code Protection

CMMC Level 1SPRS if unmet: -5CRITICAL priority~4h to implement

Provide protection from malicious code at appropriate locations within organizational information systems.

What SI.1.002 means in plain English

Every computer needs antivirus software that is actually running and up to date. Windows Defender is free, built into Windows 10 and 11, and is good enough for most small defense contractors. Make sure it is turned on, real-time protection is enabled, and it is updating its virus definitions at least daily. Do not let employees disable it. Also, make sure your email has spam and malware filtering — most ransomware starts with a phishing email carrying a malicious attachment.

The assessment question

“Is antivirus or anti-malware software installed, actively running with real-time protection enabled, and automatically updating on all systems that store or process CUI?”

How to implement SI.1.002

Verify Windows Defender is enabled on all workstations: Windows Security > Virus & Threat Protection > verify "Real-time protection" is ON and "Cloud-delivered protection" is ON.
Ensure automatic definition updates are working: Windows Security > Virus & Threat Protection > Protection updates, verify definitions were updated within the last 24 hours.
Prevent users from disabling antivirus via Group Policy: Computer Configuration > Administrative Templates > Windows Components > Microsoft Defender Antivirus > "Turn off Microsoft Defender Antivirus" set to Not Configured or Disabled.
Enable email malware filtering: if using Microsoft 365 GCC, verify Microsoft Defender for Office 365 is configured with Safe Attachments and Safe Links policies.
Run a full system scan on all workstations monthly, in addition to the ongoing real-time protection.

Evidence your assessor will ask for

Windows Defender status screenshots showing real-time protection enabled on all systems
Antivirus definition update timestamps showing updates within the last 24 hours
Group Policy configuration preventing users from disabling antivirus
Email filtering configuration showing malware scanning is active
Monthly full scan logs or reports

Does AI prompt monitoring help with this control? Honestly, no.

SI.1.002 is met through the remediation steps above, not through AI traffic controls — an AI prompt firewall neither satisfies nor substitutes for it. We map AI monitoring only to the controls it genuinely evidences (flow control, boundary protection, audit, and incident support); for the full picture of where it does help, see the mapping guide linked below.

Full mapping: which 800-171 controls AI prompt monitoring evidences →

More System and Information Integrity controls

SI.1.001

Identify, Report, and Correct System Flaws

SI.1.004

Update Malicious Code Protection Mechanisms

SI.1.005

Perform Periodic and Real-Time Malware Scans

SI.2.003

Monitor Security Alerts and Advisories

SI.2.006

Monitor Systems for Attacks

SI.2.007

Identify Unauthorized System Use

Score yourself against all 110 controls

The free ShieldReady assessment walks every NIST 800-171 requirement, computes your SPRS score, and shows exactly which gaps cost the most points.

Start the free assessment $499 AI risk assessment