# NIST 800-171 3.14.5 Perform periodic scans of organizational systems and real-time scans of files from external sources as files are downloaded, opened, or executed.

- Source: https://support.icompaas.com/support/solutions/articles/62000229236-nist-800-171-3-14-5-perform-periodic-scans-of-organizational-systems-and-real-time-scans-of-files-fro
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [NIST](https://support.icompaas.com/support/solutions/62000112528) › [800-171](https://support.icompaas.com/support/solutions/folders/62000168440)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description:**

Periodic scans of organizational systems and real-time scans of files from external sources can detect malicious code. Malicious code can be encoded in various formats (e.g., UUENCODE, Unicode), contained within compressed or hidden files or hidden in files using techniques such as steganography. Malicious code can be inserted into systems in a variety of ways including web accesses, electronic mail, electronic mail attachments, and portable storage devices. Malicious code insertions occur through the exploitation of system vulnerabilities.

  

**Priority**: High

**Category**:  Vulnerability Management 

  

**Services Associated with AWS:**

1.  Amazon Inspector
2.  AWS Security Hub
3.  AWS Systems Manager
4.  AWS WA
5.  Amazon GuardDuty

  

**  
Objective Evidence:**  

-   Administrative: documented policies, standards & procedures  
    
-   Administrative: supporting documentation to demonstrate the "secure practices" used to build technology platform-specific secure baseline configurations  
    
-   Administrative: supporting documentation of how anti-malware solutions are deployed and maintained  
    
-   Technical: screen shot of anti-malware configuration settings 

  

Possible Technology Considerations :  

-   Secure Baseline Configurations (SBC)  
    
-   Antimalware Solution 

  

**What needs to be answered?**

Does the company perform periodic scans of the information system for malware? Are scans performed within the timeframe specified in the policy or within the system security plan? Does the company perform real-time scans of files from external sources as the files are downloaded, opened, or executed? Does the system disinfect and quarantine infected files?  

-   Periodic System Scanning Check
    
    Description: This check verifies that periodic scans of organizational systems are conducted to detect the presence of malicious code. It ensures that scanning tools or software are regularly used to perform comprehensive scans across the systems to identify any potential threats or vulnerabilities.
    
-    Real-time File Scanning Check
    
    Description: This check ensures that files from external sources, such as downloads, email attachments, or executed files, are scanned in real-time to detect any malicious code. It verifies that scanning mechanisms are in place to automatically scan files as they are accessed or executed, providing immediate protection against potential threats."
    

  

**More Details:**

Periodic scans are performed on all systems within an organization.

## Related compliance guidance

- [NIST SP 800-53 Rev. 5: a practical implementation guide for cloud teams](https://support.icompaas.com/compliance/nist-sp-800-53-rev-5): How the 800-53 catalogue, baselines and the Risk Management Framework fit together, and which controls take the most work in the cloud.
- [NIST SP 800-171 and CMMC: a practical guide to protecting CUI in the cloud](https://support.icompaas.com/compliance/nist-sp-800-171-rev-3): If the driver is a DoD or federal contract handling CUI, 800-171 (and CMMC) is the scope you actually need.