MA.2.114 — Check media containing diagnostic programs for malicious code

CMMC Level 2SPRS if unmet: -3MEDIUM priority~2h to implement

Check media containing diagnostic and test programs for malicious code before the media are used in organizational systems.

What MA.2.114 means in plain English

Before your technician plugs in a USB drive with diagnostic software, or runs a downloaded maintenance tool on your company computer, you must scan it for viruses and malware first. This prevents an attacker from compromising a vendor's USB drive and using it to infect your systems during routine maintenance. For your team: require that any USB drive or external media used by a maintenance technician be scanned with Windows Defender before connecting it to any company computer that stores CUI.

The assessment question

“Is all external media (USB drives, CDs, diagnostic tools) scanned for malicious code using updated antivirus software before being connected to or used on organizational systems?”

How to implement MA.2.114

Create a standing rule in your Maintenance Policy: all external media used for diagnostics or maintenance must be scanned with updated antivirus before use on any company system.
Configure Windows Defender to auto-scan USB drives when inserted: Group Policy > Computer Configuration > Windows Defender Antivirus > Scan > check "Scan removable drives" and enable the removable drive scan on full scans.
Consider enabling Windows Defender's "USB scan on connect" feature (via PowerShell or Intune) so any inserted USB drive is automatically scanned in the background.
For downloaded diagnostic tools, require technicians to download to a sandboxed environment or scan the installer with VirusTotal (free web tool) before running on company systems.
Log each scan result in the Maintenance Record: tool name, scan date, scan result (clean/quarantined), and who performed the scan.

Evidence your assessor will ask for

Windows Defender configuration screenshot showing removable drive scan enabled
Maintenance Policy document with external media scan requirement
Sample Maintenance Log entries showing scan results for media used in recent maintenance
VirusTotal scan screenshots for any downloaded diagnostic tools used in the past year

Does AI prompt monitoring help with this control? Honestly, no.

MA.2.114 is met through the remediation steps above, not through AI traffic controls — an AI prompt firewall neither satisfies nor substitutes for it. We map AI monitoring only to the controls it genuinely evidences (flow control, boundary protection, audit, and incident support); for the full picture of where it does help, see the mapping guide linked below.

Full mapping: which 800-171 controls AI prompt monitoring evidences →

More Maintenance controls

MA.2.111

Perform maintenance on organizational systems

MA.2.112

Provide controls on tools and personnel for maintenance

MA.2.113

Ensure equipment removed for offsite maintenance is sanitized

MA.2.115

Require multifactor authentication for nonlocal maintenance

MA.2.116

Supervise maintenance activities without required access authorization

Score yourself against all 110 controls

The free ShieldReady assessment walks every NIST 800-171 requirement, computes your SPRS score, and shows exactly which gaps cost the most points.

Start the free assessment $499 AI risk assessment

NIST 800-171 Controls · Maintenance