Request a demo

CMMC file integrity monitoring

Track every change on your CUI servers, with a reviewed record.

NIST SP 800-171 asks you to track and log changes to your systems, protect audit logs from change and deletion, and monitor for attacks. Alertica does that for the files on your Linux and SFTP servers from outside, and keeps a reviewed record of every change for your assessment.

Request a demo See the requirement mapping
  • Agentless, nothing to install
  • Supports 800-171 3.4.3 and 3.3.8

Who it's for

Defense suppliers working through NIST SP 800-171 for a CMMC Level 2 assessment.

Built for

  • Subcontractors of 20 to 300 people that handle CUI, and the consultants who help them
  • Linux and Unix servers and SFTP exchanges with the prime, in your assessment scope
  • Teams short on evidence for configuration management and system integrity

What Alertica covers in NIST SP 800-171

Five NIST SP 800-171 requirements, from configuration change control to protecting audit logs, with what stays with you in the last column.

NIST SP 800-171 Rev. 2, the requirement set for CMMC Level 2.
Requirement What it asks What Alertica does What you still do
3.4.3 Configuration change control Track, review, approve or disapprove, and log changes to systems. Tracks and logs every change to the files you watch. The note records the review and the change record. Approve or disapprove changes in your change process.
3.3.8 Protect audit information Protect audit logs and logging tools from unauthorized changes and deletion. Alerts when archived logs or logging configs change or disappear. Restrict who can reach the logs.
3.4.1 Baseline configurations Establish and maintain baseline configurations and inventories of systems. Each scan records the watched files as they are, and alerts on any change from the last one. Write and approve the baseline, and keep the inventory.
3.4.2 Security configuration settings Establish and enforce security configuration settings. Alerts when a config file changes, so a setting that drifts shows up the next scan. Set the settings, and enforce them.
3.14.6 Monitor for attacks Monitor systems, including traffic, to detect attacks and signs of potential attacks. Alerts on new programs, suspicious file names, mass deletion and changed system files. Monitor network traffic.

What your assessor sees

Assessors examine records, interview your team and test, under the methods in SP 800-171A. For the requirements above, Alertica keeps the records for every date.

  • Every change, with who reviewed it

    Each alert is acknowledged with a name, a time and a required note. That note is the review 3.4.3 asks you to log, tied to its change record.

  • Twelve months of history

    Pro keeps a year of alerts and scans, so any date your assessor asks about has its record.

  • Proof it ran every week

    Every Monday, a health email per rule: scans that ran, scans that failed, alerts, and what is still open. It shows the monitoring ran all year, week by week.

  • The record in one download

    Pick the period and download every alert with who reviewed it, when and the note. A PDF to hand over, or a spreadsheet to filter.

Why from outside the server

  • Nothing to install

    No agent to roll out or patch, and no change request on the server. Alertica logs in over SFTP with a read-only login.

  • Nothing to switch off

    An attacker on the server can stop an agent. Alertica runs on our servers, out of their reach.

  • Only fingerprints leave

    Alertica works out a fingerprint of each file on your server. File contents, and the CUI in them, never leave it.

  • Set up with you

    On Pro and Enterprise our team sets the rules for 3.4.3 and 3.3.8 with you, server by server.

Live in three steps

  1. Connect a server

    Add a server with an SFTP, FTPS or FTP login. A read-only login is enough.

  2. Set your rules

    Pick a folder and say what matters. We set up the rules for 3.4.3 and 3.3.8 with you on Pro.

  3. Choose who hears about it

    Add the people who should get alerts, by email, SMS or Slack. Each one is kept for your assessor.

Questions about CMMC

What Alertica covers in NIST SP 800-171, and how it fits your scope.

Working on your SSP? Tell us what's in scope
  • Does Alertica make us CMMC compliant?

    It supports five of the 110 requirements in NIST SP 800-171 Rev. 2, listed above, with a record your assessor can examine.

  • Where does CMMC stand?

    Phase 1 began on 10 November 2025. On 13 July 2026 the Department of War suspended Phase 2 and set up a reform task force. Check dodcio.defense.gov for the current status.

  • Is Alertica in our assessment scope?

    Yes. It holds security protection data: the names, sizes, dates and fingerprints of files on your servers. List it as an External Service Provider and a Security Protection Asset in your SSP. It never stores file contents. If your file names are themselves CUI, raise it with your assessor first.

  • Does it work on Windows file shares?

    No. Alertica reaches servers over SFTP, FTPS or FTP. Files on Windows shares and in Microsoft 365 are out of reach.

  • What does Alertica record for each change?

    What changed and when it was found, who was told, and who reviewed it, with their note. Who made the change is in your server's own logs, and the note is the place to record it.

More compliance frameworks

Set up 3.4.3 and 3.3.8 with our team

Tell us which servers are in your assessment scope. We'll set up the rules with you and go through the first scan together.

Request a demo