NIST 800-171 Controls · System and Information Integrity

SI.1.001 — Identify, Report, and Correct System Flaws

CMMC Level 1SPRS if unmet: -5CRITICAL priority~8h to implement

Identify, report, and correct information and information system flaws in a timely manner.

What SI.1.001 means in plain English

Keep your computers patched and updated. When Microsoft releases a Windows update or a software vendor pushes a security fix, apply it within 30 days for critical patches and within 90 days for everything else. Enable Windows Update on all machines and check weekly that it is actually working. This is one of the most basic and most important things you can do — the majority of cyberattacks exploit known vulnerabilities that already have patches available but were never installed.

The assessment question

“Do you apply security patches and updates to operating systems and software within defined timeframes (e.g., critical patches within 30 days) and verify that automatic updates are functioning on all systems?”

How to implement SI.1.001

Enable Windows Update on all workstations and servers: Settings > Update & Security > Windows Update > ensure updates are set to install automatically.
Check Windows Update weekly: verify no updates are pending or failed. Create a recurring calendar task for this check.
For third-party software (browsers, Adobe, Java, etc.), use Patch My PC or Ninite Pro to automate updates, or check manually monthly.
Establish patch management timeframes in your policy: Critical patches within 14 days, Important within 30 days, Moderate within 90 days.
Keep a patch log: record when patches were applied, which systems, and any issues encountered. A simple spreadsheet works fine.

Evidence your assessor will ask for

Windows Update settings showing automatic updates are enabled on all systems
Patch compliance report showing current patch level of all systems
Patch log documenting when patches were applied and to which systems
Written patch management policy with defined timeframes for different severity levels
Evidence of third-party software patching (update logs or tool reports)

Does AI prompt monitoring help with this control? Honestly, no.

SI.1.001 is met through the remediation steps above, not through AI traffic controls — an AI prompt firewall neither satisfies nor substitutes for it. We map AI monitoring only to the controls it genuinely evidences (flow control, boundary protection, audit, and incident support); for the full picture of where it does help, see the mapping guide linked below.

Full mapping: which 800-171 controls AI prompt monitoring evidences →

More System and Information Integrity controls

SI.1.002

Provide Malicious Code Protection

SI.1.004

Update Malicious Code Protection Mechanisms

SI.1.005

Perform Periodic and Real-Time Malware Scans

SI.2.003

Monitor Security Alerts and Advisories

SI.2.006

Monitor Systems for Attacks

SI.2.007

Identify Unauthorized System Use

Score yourself against all 110 controls

The free ShieldReady assessment walks every NIST 800-171 requirement, computes your SPRS score, and shows exactly which gaps cost the most points.

Start the free assessment $499 AI risk assessment