System and Information Integrity · SI.L1-b.1.xii(a)
The time within which to identify system flaws is specified
An assessment objective under requirement SI.L1-b.1.xii, Flaw Remediation, in the System and Information Integrity domain.
Objective Statement
The time within which to identify system flaws is specified
Objective identity
- Framework
- Cybersecurity Maturity Model Certification · Level 1
- Domain
- System and Information Integrity (SI)
- Objective ID
- SI.L1-b.1.xii(a)
- Parent Requirement
- SI.L1-b.1.xii · Identify, report, and correct system flaws
Assessment Procedures
The official government assessment method for this objective, exactly as printed in the DoD CMMC Assessment Guide, Level 1, which reprints it from NIST SP 800-171A (June 2018). An assessor examines artifacts, interviews people, and tests mechanisms to determine the result.
Examine
- System and information integrity policy
- Procedures addressing flaw remediation
- Procedures addressing configuration management
- System security plan
- List of flaws and vulnerabilities potentially affecting the system
- List of recent security flaw remediation actions performed on the system (e.g., list of installed patches, service packs, hot fixes, and other software updates to correct system flaws)
- Test results from the installation of software and firmware updates to correct system flaws
- Installation/change control records for security-relevant software and firmware updates
- Other relevant documents or records
Interview
- System or network administrators
- Personnel with information security responsibilities
- Personnel installing, configuring, and maintaining the system
- Personnel with responsibility for flaw remediation
- Personnel with configuration management responsibility
Test
- Organizational processes for identifying, reporting, and correcting system flaws
- Organizational process for installing software and firmware updates
- Mechanisms supporting or implementing reporting, and correcting system flaws
- Mechanisms supporting or implementing testing software and firmware updates
Related Objectives
- SI.L1-b.1.xii(b)system flaws are identified within the specified time frame
- SI.L1-b.1.xii(c)the time within which to report system flaws is specified
- SI.L1-b.1.xii(d)system flaws are reported within the specified time frame
- SI.L1-b.1.xii(e)the time within which to correct system flaws is specified
- SI.L1-b.1.xii(f)system flaws are corrected within the specified time frame
Source Authority
- Primary Authority
- NIST SP 800-171A (June 2018)
- Official Text
- Requirement Authority
- FAR 52.204-21(b)(1)
- Program Authority
- 32 CFR 170.15(c)(1)(ii) Table 2
- Framework Version
- CMMC Assessment Guide, Level 1 v2.13 (September 2024)
- Effective Date
- 2024-12-16
- Last Verified
- 2026-10-02
Cite This Page
“CMMC SI.L1-b.1.xii(a): The time within which to identify system flaws is specified.” AssessrLog, a product of ProfytAI Pte. Ltd.. Last verified 2026-10-02. https://assessrlog.com/cmmc/objectives/the-time-within-which-to-identify-system-flaws-is-specified/
Build the Record Behind This
AssessrLog logs the determination for this objective with its evidence and source record, so your Level 1 self-assessment stays traceable and ready to affirm. The MET, NOT MET, or N/A call is always yours to make.