Security threats emerge constantly. SI.L2-3.14.3 requires that you monitor security alerts and advisories from vendors and security organizations. When relevant threats are identified, you must respond. The assessor will verify you have a process to stay informed and take action. Alerts often drive patching decisions covered in SI.L2-3.14.1, and critical alerts feed into RA.L2-3.11.1 (risk assessment) and IR.L2-3.6.1 (incident response).
What the assessor is actually evaluating
The assessor will check:
Alert monitoring process: You should have a documented process for how you monitor security alerts (e.g., “We subscribe to CISA alerts, Microsoft Security Updates, and our software vendors’ mailing lists”).
Alert tracking: When you receive an alert, you should document it and assess whether it is relevant to your systems.
Response action: For relevant alerts, you should take action. This might be patching, scanning, or updating configurations.
What a realistic SSP definition looks like
Policy: “The organization monitors security alerts and advisories from multiple sources. Sources include CISA, Microsoft, software vendors, and MSSP threat briefings. When an alert is received, the IT manager assesses relevance and creates a remediation plan if action is needed. High-severity alerts are escalated immediately.”
Supporting details:
- Alert sources: CISA weekly alerts, Microsoft Security Updates, vendor mailing lists for all in-scope software, threat feeds from MSSP.
- Monitoring responsibility: IT manager checks alerts daily. MSSP provides threat briefings weekly.
- Assessment process: When an alert is received, IT determines whether the organization uses the affected software or system. If yes, a remediation plan is created.
- Response timeline: Critical alerts are actioned within 48 hours. High alerts within one week. Medium alerts within 30 days.
- Documentation: All alerts and responses are tracked in a spreadsheet or ticket system.
How to present your evidence
- Alert monitoring policy document with sources and response timelines
- Subscriptions or access to CISA, Microsoft, and vendor alert sources
- Alert tracking log from past 3-6 months with assessment and response
- Response examples showing timely action on critical alerts
- Documentation linking alerts to patches or mitigations
Keep answers short. Show the evidence, don't describe it. Let the assessor drive. For more on how to present in the assessment room, see How to Present Evidence in the Assessment Room.
Assessor: “How do you stay informed of security threats and vulnerabilities?”
You: “We monitor CISA advisories, Microsoft updates, and vendor mailing lists. When an alert is relevant, we assess impact and respond.” [Pull up monitoring sources and alert tracking log]
Assessor: “Show me recent alerts you have received.”
You: [Pull up the alert log from the past 3-6 months. Show several alerts with assessment and response]
Assessor: “Take this one. What was the alert, and what did you do?”
You: “This was a critical vulnerability in OpenSSL. We scanned systems on December 10th and found two affected servers. We patched them on December 11th.” [Show alert details, scan results, and patch record]
Common failures
No documented alert monitoring process: The organization receives alerts haphazardly. There is no subscription to formal alert sources.
Alerts are received but not tracked: The IT manager sees alerts but does not document them. When an assessor asks “Did you receive this alert?”, there is no record.
No assessment of relevance: Every alert gets a response, even if not applicable. Or relevant alerts are ignored because the organization did not realize they applied.
Slow or no response: An alert is received, but weeks pass with no action.
Short, practical breakdowns of what assessors actually ask and how to answer. No compliance jargon, no sales pitch. Subscribe free on Substack.
Formal alert monitoring: Subscriptions to CISA, Microsoft, and key vendors. Daily or weekly checks.
Tracked and documented responses: All alerts are logged with assessment and response. Responses are timely.
If you use an MSP/MSSP
If your MSSP monitors alerts on your behalf, request copies of threat briefings or weekly alert summaries. Ensure the MSSP is assessing relevance to your specific systems and recommending action when needed. Ask how the MSSP escalates critical alerts to you. You are responsible for responding to alerts, even if monitoring is outsourced.
This guide is for reference only and does not replace official CMMC documentation or professional compliance advice.