The organization: a. Develops, documents, and disseminates to {{ insert: param, si-1_prm_1 }}: 1. A system and information integrity policy that addresses purpose, scope, roles, responsibilit...

The organization: a. Identifies, reports, and corrects information system flaws; b. Tests software and firmware updates related to flaw remediation for effectiveness and potential side effects ...

The organization centrally manages the flaw remediation process.

The organization employs automated mechanisms {{ insert: param, si-2.2_prm_1 }} to determine the state of information system components with regard to flaw remediation.

The organization: (a) Measures the time between flaw identification and flaw remediation; and (b) Establishes {{ insert: param, si-2.3_prm_1 }} for taking corrective actions.

The organization installs {{ insert: param, si-2.5_prm_1 }} automatically to {{ insert: param, si-2.5_prm_2 }}.

The organization removes {{ insert: param, si-2.6_prm_1 }} after updated versions have been installed.

The organization: a. Employs malicious code protection mechanisms at information system entry and exit points to detect and eradicate malicious code; b. Updates malicious code protection mechan...

The organization centrally manages malicious code protection mechanisms.

The information system automatically updates malicious code protection mechanisms.

The information system updates malicious code protection mechanisms only when directed by a privileged user.

The organization: (a) Tests malicious code protection mechanisms {{ insert: param, si-3.6_prm_1 }} by introducing a known benign, non-spreading test case into the information system; and (b) Ve...

The information system implements nonsignature-based malicious code detection mechanisms.

The information system detects {{ insert: param, si-3.8_prm_1 }} through the kernel application programming interface at {{ insert: param, si-3.8_prm_2 }} and {{ insert: param, si-3.8_prm_3 }}.

The information system implements {{ insert: param, si-3.9_prm_1 }} to authenticate {{ insert: param, si-3.9_prm_2 }}.

The organization: (a) Employs {{ insert: param, si-3.10_prm_1 }} to analyze the characteristics and behavior of malicious code; and (b) Incorporates the results from malicious code analysis int...

The organization: a. Monitors the information system to detect: 1. Attacks and indicators of potential attacks in accordance with {{ insert: param, si-4_prm_1 }}; and 2. Unauthorized loca...

The organization connects and configures individual intrusion detection tools into an information system-wide intrusion detection system.

The organization employs automated tools to support near real-time analysis of events.

The organization employs automated tools to integrate intrusion detection tools into access control and flow control mechanisms for rapid response to attacks by enabling reconfiguration of these me...

The information system monitors inbound and outbound communications traffic {{ insert: param, si-4.4_prm_1 }} for unusual or unauthorized activities or conditions.

The information system alerts {{ insert: param, si-4.5_prm_1 }} when the following indications of compromise or potential compromise occur: {{ insert: param, si-4.5_prm_2 }}.

The information system notifies {{ insert: param, si-4.7_prm_1 }} of detected suspicious events and takes {{ insert: param, si-4.7_prm_2 }}.

The organization tests intrusion-monitoring tools {{ insert: param, si-4.9_prm_1 }}.

The organization makes provisions so that {{ insert: param, si-4.10_prm_1 }} is visible to {{ insert: param, si-4.10_prm_2 }}.

The organization analyzes outbound communications traffic at the external boundary of the information system and selected {{ insert: param, si-4.11_prm_1 }} to discover anomalies.

The organization employs automated mechanisms to alert security personnel of the following inappropriate or unusual activities with security implications: {{ insert: param, si-4.12_prm_1 }}.

The organization: (a) Analyzes communications traffic/event patterns for the information system; (b) Develops profiles representing common traffic patterns and/or events; and (c) Uses the tra...

The organization employs a wireless intrusion detection system to identify rogue wireless devices and to detect attack attempts and potential compromises/breaches to the information system.

The organization employs an intrusion detection system to monitor wireless communications traffic as the traffic passes from wireless to wireline networks.

The organization correlates information from monitoring tools employed throughout the information system.

The organization correlates information from monitoring physical, cyber, and supply chain activities to achieve integrated, organization-wide situational awareness.

The organization analyzes outbound communications traffic at the external boundary of the information system (i.e., system perimeter) and at {{ insert: param, si-4.18_prm_1 }} to detect covert exfi...

The organization implements {{ insert: param, si-4.19_prm_1 }} of individuals who have been identified by {{ insert: param, si-4.19_prm_2 }} as posing an increased level of risk.

The organization implements {{ insert: param, si-4.20_prm_1 }} of privileged users.

The organization implements {{ insert: param, si-4.21_prm_1 }} of individuals during {{ insert: param, si-4.21_prm_2 }}.

The information system detects network services that have not been authorized or approved by {{ insert: param, si-4.22_prm_1 }} and {{ insert: param, si-4.22_prm_2 }}.

The organization implements {{ insert: param, si-4.23_prm_1 }} at {{ insert: param, si-4.23_prm_2 }}.

The information system discovers, collects, distributes, and uses indicators of compromise.

The organization: a. Receives information system security alerts, advisories, and directives from {{ insert: param, si-5_prm_1 }} on an ongoing basis; b. Generates internal security alerts, adv...

The organization employs automated mechanisms to make security alert and advisory information available throughout the organization.

The information system: a. Verifies the correct operation of {{ insert: param, si-6_prm_1 }}; b. Performs this verification {{ insert: param, si-6_prm_2 }}; c. Notifies {{ insert: param, si-6...

The information system implements automated mechanisms to support the management of distributed security testing.

The organization reports the results of security function verification to {{ insert: param, si-6.3_prm_1 }}.

The organization employs integrity verification tools to detect unauthorized changes to {{ insert: param, si-7_prm_1 }}.

The information system performs an integrity check of {{ insert: param, si-7.1_prm_1 }} {{ insert: param, si-7.1_prm_2 }}.

The organization employs automated tools that provide notification to {{ insert: param, si-7.2_prm_1 }} upon discovering discrepancies during integrity verification.

The organization employs centrally managed integrity verification tools.

The information system automatically {{ insert: param, si-7.5_prm_1 }} when integrity violations are discovered.

The information system implements cryptographic mechanisms to detect unauthorized changes to software, firmware, and information.

The organization incorporates the detection of unauthorized {{ insert: param, si-7.7_prm_1 }} into the organizational incident response capability.

The information system, upon detection of a potential integrity violation, provides the capability to audit the event and initiates the following actions: {{ insert: param, si-7.8_prm_1 }}.

The information system verifies the integrity of the boot process of {{ insert: param, si-7.9_prm_1 }}.

The information system implements {{ insert: param, si-7.10_prm_1 }} to protect the integrity of boot firmware in {{ insert: param, si-7.10_prm_2 }}.

The organization requires that {{ insert: param, si-7.11_prm_1 }} execute in a confined physical or virtual machine environment with limited privileges.

The organization requires that the integrity of {{ insert: param, si-7.12_prm_1 }} be verified prior to execution.

The organization allows execution of binary or machine-executable code obtained from sources with limited or no warranty and without the provision of source code only in confined physical or virtua...

The organization: (a) Prohibits the use of binary or machine-executable code from sources with limited or no warranty and without the provision of source code; and (b) Provides exceptions to th...

The information system implements cryptographic mechanisms to authenticate {{ insert: param, si-7.15_prm_1 }} prior to installation.

The organization does not allow processes to execute without supervision for more than {{ insert: param, si-7.16_prm_1 }}.

The organization: a. Employs spam protection mechanisms at information system entry and exit points to detect and take action on unsolicited messages; and b. Updates spam protection mechanisms ...

The organization centrally manages spam protection mechanisms.

The information system automatically updates spam protection mechanisms.

The information system implements spam protection mechanisms with a learning capability to more effectively identify legitimate communications traffic.

The information system checks the validity of {{ insert: param, si-10_prm_1 }}.

The information system: (a) Provides a manual override capability for input validation of {{ insert: param, si-10.1_prm_1 }}; (b) Restricts the use of the manual override capability to only {{ ...

The organization ensures that input validation errors are reviewed and resolved within {{ insert: param, si-10.2_prm_1 }}.

The information system behaves in a predictable and documented manner that reflects organizational and system objectives when invalid inputs are received.

The organization accounts for timing interactions among information system components in determining appropriate responses for invalid inputs.

The organization restricts the use of information inputs to {{ insert: param, si-10.5_prm_1 }} and/or {{ insert: param, si-10.5_prm_2 }}.

The information system: a. Generates error messages that provide information necessary for corrective actions without revealing information that could be exploited by adversaries; and b. Reveal...

The organization handles and retains information within the information system and information output from the system in accordance with applicable federal laws, Executive Orders, directives, polic...

The organization: a. Determines mean time to failure (MTTF) for {{ insert: param, si-13_prm_1 }} in specific environments of operation; and b. Provides substitute information system components ...

The organization takes information system components out of service by transferring component responsibilities to substitute components no later than {{ insert: param, si-13.1_prm_1 }} of mean time...

The organization manually initiates transfers between active and standby information system components {{ insert: param, si-13.3_prm_1 }} if the mean time to failure exceeds {{ insert: param, si-13...

The organization, if information system component failures are detected: (a) Ensures that the standby components are successfully and transparently installed within {{ insert: param, si-13.4_prm_...

The organization provides {{ insert: param, si-13.5_prm_1 }} {{ insert: param, si-13.5_prm_2 }} for the information system.

The organization implements non-persistent {{ insert: param, si-14_prm_1 }} that are initiated in a known state and terminated {{ insert: param, si-14_prm_2 }}.

The organization ensures that software and data employed during information system component and service refreshes are obtained from {{ insert: param, si-14.1_prm_1 }}.

The information system validates information output from {{ insert: param, si-15_prm_1 }} to ensure that the information is consistent with the expected content.

The information system implements {{ insert: param, si-16_prm_1 }} to protect its memory from unauthorized code execution.

The information system implements {{ insert: param, si-17_prm_1 }} when {{ insert: param, si-17_prm_2 }}.