NIST 800-171 Controls · System and Information Integrity

SI.2.006 — Monitor Systems for Attacks

CMMC Level 2SPRS if unmet: -3HIGH priority~16h to implement

Monitor organizational systems, including inbound and outbound communications traffic, to detect attacks and indicators of potential attacks.

What SI.2.006 means in plain English

You need to be watching what is happening on your network — not just blocking things with a firewall, but actively looking for suspicious activity. This means monitoring network traffic for unusual patterns, checking for failed login attempts, watching for large data transfers, and looking for connections to known-bad IP addresses. You do not need a full security operations center — free tools like Windows Defender with its built-in firewall logging, or Wazuh (free SIEM), can give you visibility into what is happening.

The assessment question

“Do you actively monitor your network and systems for indicators of attack, including unusual login attempts, unexpected data transfers, connections to suspicious destinations, and malware indicators?”

How to implement SI.2.006

Enable Windows Defender Firewall logging on all workstations: Windows Defender Firewall > Advanced Settings > Properties > select each profile (Domain, Private, Public) > Logging > enable log dropped packets and successful connections.
If using pfSense, enable Snort or Suricata IDS package (free) to monitor network traffic for attack signatures. Configure it to alert on suspicious traffic patterns.
Set up failed login monitoring: in Windows Event Viewer, create a custom view filtering for Event ID 4625 (failed logon) and review weekly for brute force attempts.
Consider deploying Wazuh (free, open-source SIEM) on a dedicated machine to centralize log collection and alerting from all your systems.
Review monitoring dashboards or logs at least weekly. Document any suspicious findings and actions taken in your security log.

Evidence your assessor will ask for

Network monitoring tool configuration (IDS, SIEM, or firewall logging)
Sample monitoring reports or dashboard screenshots showing active monitoring
Log review records showing weekly or more frequent analysis of security events
Evidence of response to detected suspicious activity (incident tickets or log entries)
Written monitoring procedure describing what is monitored, how often, and by whom

Does AI prompt monitoring help with this control? It supports it.

AI prompt monitoring does not satisfy SI.2.006 on its own, but its output feeds the capability this control requires: the tamper-evident event stream of allowed and blocked AI prompts becomes detection signal, incident record, and reviewable audit material. Treat the AI firewall as one input to this practice, alongside the remediation steps above.

Full mapping: which 800-171 controls AI prompt monitoring evidences →

More System and Information Integrity controls

SI.1.001

Identify, Report, and Correct System Flaws

SI.1.002

Provide Malicious Code Protection

SI.1.004

Update Malicious Code Protection Mechanisms

SI.1.005

Perform Periodic and Real-Time Malware Scans

SI.2.003

Monitor Security Alerts and Advisories

SI.2.007

Identify Unauthorized System Use

Score yourself against all 110 controls

The free ShieldReady assessment walks every NIST 800-171 requirement, computes your SPRS score, and shows exactly which gaps cost the most points.

Start the free assessment $499 AI risk assessment