Example, read only. A sample company whose own team runs its CMMC program here, reviewed by a credentialed officer and kept current.
SI.L1-3.14.5 · FAR 52.204-21 (b)(1)(xv) · NIST SP 800-171 3.14.5
System & File Scanning
Perform periodic scans of the information system and real-time scans of files from external sources as files are downloaded, opened, or executed
Reviewed by a credentialed officer on June 12, 2026. The officer advises and never signs; this corroborates your own self assessment and certifies nothing. The finding, and the affirmation, stay yours.
Who is accountable for this safeguard
They get the reminder when this evidence goes stale. Carries into next year's cycle.
What it means
Run full scans regularly, and have antivirus inspect files the moment they're downloaded or opened.
Why it matters
Real-time protection on plus a scheduled full scan at least weekly is the industry-standard baseline. Screenshot both settings and a recent successful scan.
The proof on file
- defender-scan-history.pngUploaded, checked by Charlie · June 10, 2026Sufficient
Every uploaded file is checked by Charlie the moment it arrives, so a gap is caught on the spot, not at the assessment. Pulls from Microsoft 365 and references to the Policy Center and registers come straight from where they live, so they skip that check.
The narrative on file
Real time and scheduled scans run on every managed workstation, and downloads and email attachments are scanned as they arrive. Scan results feed the Defender dashboard the owner reviews weekly.
You answer in plain English. Charlie drafts the narrative for your System Security Plan, and you confirm it.
What makes it pass
- Real-time protection visible as ON in product or policy UI
- Scheduled-scan setting shows a recurring frequency (weekly or more often)
- At least one recent successful full scan is visible in scan history
- Schedule lands when the device is awake (not 2am for a closed laptop)
Assessment objectives, NIST SP 800-171A
The team at Cedar Ridge Machine Works, LLC confirmed this safeguard MET. The evidence above is a living document: refresh rosters, devices, and accounts whenever the business changes and the safeguard stays current. The single signature happens in Attest & file, once all 17 are met.
Back to overview →Need the exact clicks?Microsoft 365 / Defender, step by step
- 1Go to Defender antivirus policy and screenshot the real-time protection and scheduled-scan settings
- 2For a representative device, screenshot Windows Security → Virus & threat protection → Scan options / scan history showing a recent full scan completed
Capture: Policy screenshot + recent scan-history screenshot.
This is one of 17
Answer in plain English, file the proof, confirm it MET.
The team at Cedar Ridge Machine Works, LLC walked all 17 the same way. The platform explains each one in plain English and tells you what proof to grab or pulls it from Microsoft 365, Charlie drafts the paperwork with you, a credentialed officer reviews it, and your team confirms each one MET. The self assessment stays your act. Start free for 30 days, no credit card, or book a free advisory call if you would rather talk it through first.