a. Develop, document, and disseminate to {{ insert: param, si-1_prm_1 }}: 1. {{ insert: param, si-01_odp.03 }} system and information integrity policy that: (a) Addresses purpose, scope...

a. Identify, report, and correct system flaws; b. Test software and firmware updates related to flaw remediation for effectiveness and potential side effects before installation; c. Install s...

Determine if system components have applicable security-relevant software and firmware updates installed using {{ insert: param, si-02.02_odp.01 }} {{ insert: param, si-02.02_odp.02 }}.

(a) Measure the time between flaw identification and flaw remediation; and (b) Establish the following benchmarks for taking corrective actions: {{ insert: param, si-02.03_odp }}.

Employ automated patch management tools to facilitate flaw remediation to the following system components: {{ insert: param, si-02.04_odp }}.

Install {{ insert: param, si-02.05_odp.01 }} automatically to {{ insert: param, si-02.05_odp.02 }}.

Remove previous versions of {{ insert: param, si-02.06_odp }} after updated versions have been installed.

a. Conduct root cause analysis to identify underlying causes of issues or failures. b. Develop actions to address the root cause of the issue or failure. c. Implement the actions and monitor ...

a. Implement {{ insert: param, si-03_odp.01 }} malicious code protection mechanisms at system entry and exit points to detect and eradicate malicious code; b. Automatically update malicious cod...

Update malicious code protection mechanisms only when directed by a privileged user.

(a) Test malicious code protection mechanisms {{ insert: param, si-03.06_odp }} by introducing known benign code into the system; and (b) Verify that the detection of the code and the associate...

(a) Detect the following unauthorized operating system commands through the kernel application programming interface on {{ insert: param, si-03.08_odp.02 }}: {{ insert: param, si-03.08_odp.01 }} ...

(a) Employ the following tools and techniques to analyze the characteristics and behavior of malicious code: {{ insert: param, si-03.10_odp }} ; and (b) Incorporate the results from malicious c...

a. Monitor the system to detect: 1. Attacks and indicators of potential attacks in accordance with the following monitoring objectives: {{ insert: param, si-04_odp.01 }} ; and 2. Unauthor...

Connect and configure individual intrusion detection tools into a system-wide intrusion detection system.

Employ automated tools and mechanisms to support near real-time analysis of events.

Employ automated tools and mechanisms to integrate intrusion detection tools and mechanisms into access control and flow control mechanisms.

(a) Determine criteria for unusual or unauthorized activities or conditions for inbound and outbound communications traffic; (b) Monitor inbound and outbound communications traffic {{ insert: p...

Alert {{ insert: param, si-04.05_odp.01 }} when the following system-generated indications of compromise or potential compromise occur: {{ insert: param, si-04.05_odp.02 }}.

(a) Notify {{ insert: param, si-04.07_odp.01 }} of detected suspicious events; and (b) Take the following actions upon detection: {{ insert: param, si-04.07_odp.02 }}.

Test intrusion-monitoring tools and mechanisms {{ insert: param, si-04.09_odp }}.

Make provisions so that {{ insert: param, si-04.10_odp.01 }} is visible to {{ insert: param, si-04.10_odp.02 }}.

Analyze outbound communications traffic at the external interfaces to the system and selected {{ insert: param, si-04.11_odp }} to discover anomalies.

Alert {{ insert: param, si-04.12_odp.01 }} using {{ insert: param, si-04.12_odp.02 }} when the following indications of inappropriate or unusual activities with security or privacy implications occ...

(a) Analyze communications traffic and event patterns for the system; (b) Develop profiles representing common traffic and event patterns; and (c) Use the traffic and event profiles in tuning...

Employ a wireless intrusion detection system to identify rogue wireless devices and to detect attack attempts and potential compromises or breaches to the system.

Employ an intrusion detection system to monitor wireless communications traffic as the traffic passes from wireless to wireline networks.

Correlate information from monitoring tools and mechanisms employed throughout the system.

Correlate information from monitoring physical, cyber, and supply chain activities to achieve integrated, organization-wide situational awareness.

Analyze outbound communications traffic at external interfaces to the system and at the following interior points to detect covert exfiltration of information: {{ insert: param, si-04.18_odp }}.

Implement {{ insert: param, si-04.19_odp.01 }} of individuals who have been identified by {{ insert: param, si-04.19_odp.02 }} as posing an increased level of risk.

Implement the following additional monitoring of privileged users: {{ insert: param, si-04.20_odp }}.

Implement the following additional monitoring of individuals during {{ insert: param, si-04.21_odp.02 }}: {{ insert: param, si-04.21_odp.01 }}.

(a) Detect network services that have not been authorized or approved by {{ insert: param, si-04.22_odp.01 }} ; and (b) {{ insert: param, si-04.22_odp.02 }} when detected.

Implement the following host-based monitoring mechanisms at {{ insert: param, si-04.23_odp.02 }}: {{ insert: param, si-04.23_odp.01 }}.

Discover, collect, and distribute to {{ insert: param, si-04.24_odp.02 }} , indicators of compromise provided by {{ insert: param, si-04.24_odp.01 }}.

Provide visibility into network traffic at external and key internal system interfaces to optimize the effectiveness of monitoring devices.

a. Receive system security alerts, advisories, and directives from {{ insert: param, si-05_odp.01 }} on an ongoing basis; b. Generate internal security alerts, advisories, and directives as dee...

Broadcast security alert and advisory information throughout the organization using {{ insert: param, si-05.01_odp }}.

a. Verify the correct operation of {{ insert: param, si-6_prm_1 }}; b. Perform the verification of the functions specified in SI-6a {{ insert: param, si-06_odp.03 }}; c. Alert {{ insert: para...

Implement automated mechanisms to support the management of distributed security and privacy function testing.

Report the results of security and privacy function verification to {{ insert: param, si-06.03_odp }}.

a. Employ integrity verification tools to detect unauthorized changes to the following software, firmware, and information: {{ insert: param, si-7_prm_1 }} ; and b. Take the following actions w...

Perform an integrity check of {{ insert: param, si-7.1_prm_1 }} {{ insert: param, si-7.1_prm_2 }}.

Employ automated tools that provide notification to {{ insert: param, si-07.02_odp }} upon discovering discrepancies during integrity verification.

Employ centrally managed integrity verification tools.

Automatically {{ insert: param, si-07.05_odp.01 }} when integrity violations are discovered.

Implement cryptographic mechanisms to detect unauthorized changes to software, firmware, and information.

Incorporate the detection of the following unauthorized changes into the organizational incident response capability: {{ insert: param, si-07.07_odp }}.

Upon detection of a potential integrity violation, provide the capability to audit the event and initiate the following actions: {{ insert: param, si-07.08_odp.01 }}.

Verify the integrity of the boot process of the following system components: {{ insert: param, si-07.09_odp }}.

Implement the following mechanisms to protect the integrity of boot firmware in {{ insert: param, si-07.10_odp.02 }}: {{ insert: param, si-07.10_odp.01 }}.

Require that the integrity of the following user-installed software be verified prior to execution: {{ insert: param, si-07.12_odp }}.

Implement cryptographic mechanisms to authenticate the following software or firmware components prior to installation: {{ insert: param, si-07.15_odp }}.

Prohibit processes from executing without supervision for more than {{ insert: param, si-07.16_odp }}.

Implement {{ insert: param, si-07.17_odp }} for application self-protection at runtime.

a. Employ spam protection mechanisms at system entry and exit points to detect and act on unsolicited messages; and b. Update spam protection mechanisms when new releases are available in accor...

Automatically update spam protection mechanisms {{ insert: param, si-08.02_odp }}.

Implement spam protection mechanisms with a learning capability to more effectively identify legitimate communications traffic.

Check the validity of the following information inputs: {{ insert: param, si-10_odp }}.

(a) Provide a manual override capability for input validation of the following information inputs: {{ insert: param, si-10_odp }}; (b) Restrict the use of the manual override capability to only...

Review and resolve input validation errors within {{ insert: param, si-10.2_prm_1 }}.

Verify that the system behaves in a predictable and documented manner when invalid inputs are received.

Account for timing interactions among system components in determining appropriate responses for invalid inputs.

Restrict the use of information inputs to {{ insert: param, si-10.05_odp.01 }} and/or {{ insert: param, si-10.05_odp.02 }}.

Prevent untrusted data injections.

a. Generate error messages that provide information necessary for corrective actions without revealing information that could be exploited; and b. Reveal error messages only to {{ insert: param...

Manage and retain information within the system and information output from the system in accordance with applicable laws, executive orders, directives, regulations, policies, standards, guidelines...

Limit personally identifiable information being processed in the information life cycle to the following elements of personally identifiable information: {{ insert: param, si-12.01_odp }}.

Use the following techniques to minimize the use of personally identifiable information for research, testing, or training: {{ insert: param, si-12.2_prm_1 }}.

Use the following techniques to dispose of, destroy, or erase information following the retention period: {{ insert: param, si-12.3_prm_1 }}.

a. Determine mean time to failure (MTTF) for the following system components in specific environments of operation: {{ insert: param, si-13_odp.01 }} ; and b. Provide substitute system componen...

Take system components out of service by transferring component responsibilities to substitute components no later than {{ insert: param, si-13.01_odp }} of mean time to failure.

Manually initiate transfers between active and standby system components when the use of the active component reaches {{ insert: param, si-13.03_odp }} of the mean time to failure.

If system component failures are detected: (a) Ensure that the standby components are successfully and transparently installed within {{ insert: param, si-13.04_odp.01 }} ; and (b) {{ insert: p...

Provide {{ insert: param, si-13.05_odp.01 }} {{ insert: param, si-13.05_odp.02 }} for the system.

Implement non-persistent {{ insert: param, si-14_odp.01 }} that are initiated in a known state and terminated {{ insert: param, si-14_odp.02 }}.

Obtain software and data employed during system component and service refreshes from the following trusted sources: {{ insert: param, si-14.01_odp }}.

(a) {{ insert: param, si-14.02_odp.01 }} ; and (b) Delete information when no longer needed.

Establish connections to the system on demand and terminate connections after {{ insert: param, si-14.03_odp }}.

Validate information output from the following software programs and/or applications to ensure that the information is consistent with the expected content: {{ insert: param, si-15_odp }}.

Implement the following controls to protect the system memory from unauthorized code execution: {{ insert: param, si-16_odp }}.

Implement the indicated fail-safe procedures when the indicated failures occur: {{ insert: param, si-17_prm_1 }}.

a. Check the accuracy, relevance, timeliness, and completeness of personally identifiable information across the information life cycle {{ insert: param, si-18_prm_1 }} ; and b. Correct or dele...

Correct or delete personally identifiable information that is inaccurate or outdated, incorrectly determined regarding impact, or incorrectly de-identified using {{ insert: param, si-18.01_odp }}.

Employ data tags to automate the correction or deletion of personally identifiable information across the information life cycle within organizational systems.

Collect personally identifiable information directly from the individual.

Correct or delete personally identifiable information upon request by individuals or their designated representatives.

Notify {{ insert: param, si-18.05_odp }} and individuals that the personally identifiable information has been corrected or deleted.

a. Remove the following elements of personally identifiable information from datasets: {{ insert: param, si-19_odp.01 }} ; and b. Evaluate {{ insert: param, si-19_odp.02 }} for effectiveness of...

De-identify the dataset upon collection by not collecting personally identifiable information.

Prohibit archiving of personally identifiable information elements if those elements in a dataset will not be needed after the dataset is archived.

Remove personally identifiable information elements from a dataset prior to its release if those elements in the dataset do not need to be part of the data release.

Remove, mask, encrypt, hash, or replace direct identifiers in a dataset.

Manipulate numerical data, contingency tables, and statistical findings so that no individual or organization is identifiable in the results of the analysis.

Prevent disclosure of personally identifiable information by adding non-deterministic noise to the results of mathematical operations before the results are reported.

Perform de-identification using validated algorithms and software that is validated to implement the algorithms.

Perform a motivated intruder test on the de-identified dataset to determine if the identified data remains or if the de-identified data can be re-identified.

Embed data or capabilities in the following systems or system components to determine if organizational data has been exfiltrated or improperly removed from the organization: {{ insert: param, si-2...

Refresh {{ insert: param, si-21_odp.01 }} at {{ insert: param, si-21_odp.02 }} or generate the information on demand and delete the information when no longer needed.

a. Identify the following alternative sources of information for {{ insert: param, si-22_odp.02 }}: {{ insert: param, si-22_odp.01 }} ; and b. Use an alternative information source for the exec...

Based on {{ insert: param, si-23_odp.01 }}: a. Fragment the following information: {{ insert: param, si-23_odp.02 }} ; and b. Distribute the fragmented information across the following systems ...