NIST 800-171 Controls · System and Information Integrity
SI.2.003 — Monitor Security Alerts and Advisories
Monitor system security alerts and advisories and take action in response.
What SI.2.003 means in plain English
Stay informed about new security threats that could affect your systems. Subscribe to alerts from CISA (the US cybersecurity agency), Microsoft Security, and your firewall vendor. When a critical alert comes out — like a major Windows vulnerability or a widespread ransomware campaign — read it and take action. This might mean applying an emergency patch, blocking a specific website, or warning your employees about a phishing campaign. Do not just subscribe and ignore the emails.
The assessment question
“Do you subscribe to security alert sources (such as CISA, Microsoft Security, vendor advisories) and have a process to review alerts, determine applicability, and take timely action on relevant advisories?”
How to implement SI.2.003
- Subscribe to CISA alerts at cisa.gov/subscribe — select "Alerts" and "Current Activity" notifications. These are free and cover the most critical threats.
- Subscribe to Microsoft Security Response Center (MSRC) notifications at msrc.microsoft.com for Windows and Office vulnerability alerts.
- Designate one person (your IT point of contact) as the security alert reviewer. They should check alert emails at least twice per week and determine if any apply to your systems.
- Create a simple alert response log: date received, alert source, description, applicability (yes/no), action taken, and date completed.
- For critical alerts that apply to your systems, respond within 48 hours — whether that means patching, changing a configuration, or alerting employees.
Evidence your assessor will ask for
- Evidence of active subscriptions to security alert sources (email subscription confirmations)
- Alert response log showing received alerts, applicability assessments, and actions taken
- Examples of actions taken in response to security advisories (patches applied, configurations changed)
- Written procedure for monitoring and responding to security alerts
- Designated personnel responsible for alert monitoring
Does AI prompt monitoring help with this control? Honestly, no.
SI.2.003 is met through the remediation steps above, not through AI traffic controls — an AI prompt firewall neither satisfies nor substitutes for it. We map AI monitoring only to the controls it genuinely evidences (flow control, boundary protection, audit, and incident support); for the full picture of where it does help, see the mapping guide linked below.
Full mapping: which 800-171 controls AI prompt monitoring evidences →
More System and Information Integrity controls
Score yourself against all 110 controls
The free ShieldReady assessment walks every NIST 800-171 requirement, computes your SPRS score, and shows exactly which gaps cost the most points.