BaselineWatch
1196 requirements
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

NIST SP 800-53 (controls) 5.2.0

1196 requirements · published 2026-10-22
Changes in this version
AllACATAUCACMCPIAIRMAMPPEPLPMPSPTRASASCSISR
RefTitleText
SI-01 Policy and Procedures a. Develop, document, and disseminate to [Assignment: organization-defined personnel or roles]: 1. [Selection (one or more): organization-level; mission/business process-level; system-level] system and information integrity policy that: (a)
SI-02 Flaw Remediation a. Identify, report, and correct system flaws; b. Test software and firmware updates related to flaw remediation for effectiveness and potential side effects before installation; c. Install security-relevant software and firmware updates wi
SI-02(01)
in SI-2
 Central Management withdrawn
SI-02(02)
in SI-2
 Automated Flaw Remediation Status Determine if system components have applicable security-relevant software and firmware updates installed using [Assignment: automated mechanisms] [Assignment: frequency].
SI-02(03)
in SI-2
 Time to Remediate Flaws and Benchmarks for Corrective Actions (a) Measure the time between flaw identification and flaw remediation; and (b) Establish the following benchmarks for taking corrective actions: [Assignment: benchmarks].
SI-02(04)
in SI-2
 Automated Patch Management Tools Employ automated patch management tools to facilitate flaw remediation to the following system components: [Assignment: components].
SI-02(05)
in SI-2
 Automatic Software and Firmware Updates Install [Assignment: security-relevant software and firmware updates] automatically to [Assignment: system components].
SI-02(06)
in SI-2
 Removal of Previous Versions of Software and Firmware Remove previous versions of [Assignment: software and firmware components] after updated versions have been installed.
SI-02(07)
in SI-2
 Root Cause Analysis a. Conduct root cause analysis to identify underlying causes of issues or failures. b. Develop actions to address the root cause of the issue or failure. c. Implement the actions and monitor the implementation for effectiveness.
SI-03 Malicious Code Protection a. Implement [Selection (one or more): signature-based; non-signature-based] malicious code protection mechanisms at system entry and exit points to detect and eradicate malicious code; b. Automatically update malicious code protection mech
SI-03(01)
in SI-3
 Central Management withdrawn
SI-03(02)
in SI-3
 Automatic Updates withdrawn
SI-03(03)
in SI-3
 Non-privileged Users withdrawn
SI-03(04)
in SI-3
 Updates Only by Privileged Users Update malicious code protection mechanisms only when directed by a privileged user.
SI-03(05)
in SI-3
 Portable Storage Devices withdrawn
SI-03(06)
in SI-3
 Testing and Verification (a) Test malicious code protection mechanisms [Assignment: frequency] by introducing known benign code into the system; and (b) Verify that the detection of the code and the associated incident reporting occur.
SI-03(07)
in SI-3
 Nonsignature-based Detection withdrawn
SI-03(08)
in SI-3
 Detect Unauthorized Commands (a) Detect the following unauthorized operating system commands through the kernel application programming interface on [Assignment: system hardware components]: [Assignment: unauthorized operating system commands] ; and (b) [Selection (one
SI-03(09)
in SI-3
 Authenticate Remote Commands withdrawn
SI-03(10)
in SI-3
 Malicious Code Analysis (a) Employ the following tools and techniques to analyze the characteristics and behavior of malicious code: [Assignment: tools and techniques] ; and (b) Incorporate the results from malicious code analysis into organizational incident resp
SI-04 System Monitoring a. Monitor the system to detect: 1. Attacks and indicators of potential attacks in accordance with the following monitoring objectives: [Assignment: monitoring objectives] ; and 2. Unauthorized local, network, and remote connections; b. Ide
SI-04(01)
in SI-4
 System-wide Intrusion Detection System Connect and configure individual intrusion detection tools into a system-wide intrusion detection system.
SI-04(02)
in SI-4
 Automated Tools and Mechanisms for Real-time Analysis Employ automated tools and mechanisms to support near real-time analysis of events.
SI-04(03)
in SI-4
 Automated Tool and Mechanism Integration Employ automated tools and mechanisms to integrate intrusion detection tools and mechanisms into access control and flow control mechanisms.
SI-04(04)
in SI-4
 Inbound and Outbound Communications Traffic (a) Determine criteria for unusual or unauthorized activities or conditions for inbound and outbound communications traffic; (b) Monitor inbound and outbound communications traffic [Assignment: organization-defined frequency] for [Assignmen
SI-04(05)
in SI-4
 System-generated Alerts Alert [Assignment: personnel or roles] when the following system-generated indications of compromise or potential compromise occur: [Assignment: compromise indicators].
SI-04(06)
in SI-4
 Restrict Non-privileged Users withdrawn
SI-04(07)
in SI-4
 Automated Response to Suspicious Events (a) Notify [Assignment: incident response personnel] of detected suspicious events; and (b) Take the following actions upon detection: [Assignment: least-disruptive actions].
SI-04(08)
in SI-4
 Protection of Monitoring Information withdrawn
SI-04(09)
in SI-4
 Testing of Monitoring Tools and Mechanisms Test intrusion-monitoring tools and mechanisms [Assignment: frequency].
SI-04(10)
in SI-4
 Visibility of Encrypted Communications Make provisions so that [Assignment: encrypted communications traffic] is visible to [Assignment: system monitoring tools and mechanisms].
SI-04(11)
in SI-4
 Analyze Communications Traffic Anomalies Analyze outbound communications traffic at the external interfaces to the system and selected [Assignment: interior points] to discover anomalies.
SI-04(12)
in SI-4
 Automated Organization-generated Alerts Alert [Assignment: personnel or roles] using [Assignment: automated mechanisms] when the following indications of inappropriate or unusual activities with security or privacy implications occur: [Assignment: activities that trigger alerts].
SI-04(13)
in SI-4
 Analyze Traffic and Event Patterns (a) Analyze communications traffic and event patterns for the system; (b) Develop profiles representing common traffic and event patterns; and (c) Use the traffic and event profiles in tuning system-monitoring devices.
SI-04(14)
in SI-4
 Wireless Intrusion Detection Employ a wireless intrusion detection system to identify rogue wireless devices and to detect attack attempts and potential compromises or breaches to the system.
SI-04(15)
in SI-4
 Wireless to Wireline Communications Employ an intrusion detection system to monitor wireless communications traffic as the traffic passes from wireless to wireline networks.
SI-04(16)
in SI-4
 Correlate Monitoring Information Correlate information from monitoring tools and mechanisms employed throughout the system.
SI-04(17)
in SI-4
 Integrated Situational Awareness Correlate information from monitoring physical, cyber, and supply chain activities to achieve integrated, organization-wide situational awareness.
SI-04(18)
in SI-4
 Analyze Traffic and Covert Exfiltration Analyze outbound communications traffic at external interfaces to the system and at the following interior points to detect covert exfiltration of information: [Assignment: interior points].
SI-04(19)
in SI-4
 Risk for Individuals Implement [Assignment: additional monitoring] of individuals who have been identified by [Assignment: sources] as posing an increased level of risk.
SI-04(20)
in SI-4
 Privileged Users Implement the following additional monitoring of privileged users: [Assignment: additional monitoring].
SI-04(21)
in SI-4
 Probationary Periods Implement the following additional monitoring of individuals during [Assignment: probationary period]: [Assignment: additional monitoring].
SI-04(22)
in SI-4
 Unauthorized Network Services (a) Detect network services that have not been authorized or approved by [Assignment: authorization or approval processes] ; and (b) [Selection (one or more): audit; alert {{ insert: param, si-04.22_odp.03 }} ] when detected.
SI-04(23)
in SI-4
 Host-based Devices Implement the following host-based monitoring mechanisms at [Assignment: system components]: [Assignment: host-based monitoring mechanisms].
SI-04(24)
in SI-4
 Indicators of Compromise Discover, collect, and distribute to [Assignment: personnel or roles] , indicators of compromise provided by [Assignment: sources].
SI-04(25)
in SI-4
 Optimize Network Traffic Analysis Provide visibility into network traffic at external and key internal system interfaces to optimize the effectiveness of monitoring devices.
SI-05 Security Alerts, Advisories, and Directives a. Receive system security alerts, advisories, and directives from [Assignment: external organizations] on an ongoing basis; b. Generate internal security alerts, advisories, and directives as deemed necessary; c. Disseminate security alert
SI-05(01)
in SI-5
 Automated Alerts and Advisories Broadcast security alert and advisory information throughout the organization using [Assignment: automated mechanisms].
SI-06 Security and Privacy Function Verification a. Verify the correct operation of [Assignment: organization-defined security and privacy functions]; b. Perform the verification of the functions specified in SI-6a [Selection (one or more): {{ insert: param, si-06_odp.04 }} ; upon command
SI-06(01)
in SI-6
 Notification of Failed Security Tests withdrawn
SI-06(02)
in SI-6
 Automation Support for Distributed Testing Implement automated mechanisms to support the management of distributed security and privacy function testing.
SI-06(03)
in SI-6
 Report Verification Results Report the results of security and privacy function verification to [Assignment: personnel or roles].
SI-07 Software, Firmware, and Information Integrity a. Employ integrity verification tools to detect unauthorized changes to the following software, firmware, and information: [Assignment: organization-defined software, firmware, and information] ; and b. Take the following actions when unau
SI-07(01)
in SI-7
 Integrity Checks Perform an integrity check of [Assignment: organization-defined software, firmware, and information] [Selection (one or more): at startup; at {{ insert: param, si-7.1_prm_3 }} ; {{ insert: param, si-7.1_prm_4 }} ].
SI-07(02)
in SI-7
 Automated Notifications of Integrity Violations Employ automated tools that provide notification to [Assignment: personnel or roles] upon discovering discrepancies during integrity verification.
SI-07(03)
in SI-7
 Centrally Managed Integrity Tools Employ centrally managed integrity verification tools.
SI-07(04)
in SI-7
 Tamper-evident Packaging withdrawn
SI-07(05)
in SI-7
 Automated Response to Integrity Violations Automatically [Selection (one or more): shut down the system; restart the system; implement {{ insert: param, si-07.05_odp.02 }} ] when integrity violations are discovered.
SI-07(06)
in SI-7
 Cryptographic Protection Implement cryptographic mechanisms to detect unauthorized changes to software, firmware, and information.
SI-07(07)
in SI-7
 Integration of Detection and Response Incorporate the detection of the following unauthorized changes into the organizational incident response capability: [Assignment: changes].
SI-07(08)
in SI-7
 Auditing Capability for Significant Events Upon detection of a potential integrity violation, provide the capability to audit the event and initiate the following actions: [Selection (one or more): generate an audit record; alert current user; alert {{ insert: param, si-07.08_odp.02
SI-07(09)
in SI-7
 Verify Boot Process Verify the integrity of the boot process of the following system components: [Assignment: system components].
SI-07(10)
in SI-7
 Protection of Boot Firmware Implement the following mechanisms to protect the integrity of boot firmware in [Assignment: system components]: [Assignment: mechanisms].
SI-07(11)
in SI-7
 Confined Environments with Limited Privileges withdrawn
SI-07(12)
in SI-7
 Integrity Verification Require that the integrity of the following user-installed software be verified prior to execution: [Assignment: user-installed software].
SI-07(13)
in SI-7
 Code Execution in Protected Environments withdrawn
SI-07(14)
in SI-7
 Binary or Machine Executable Code withdrawn
SI-07(15)
in SI-7
 Code Authentication Implement cryptographic mechanisms to authenticate the following software or firmware components prior to installation: [Assignment: software or firmware components].
SI-07(16)
in SI-7
 Time Limit on Process Execution Without Supervision Prohibit processes from executing without supervision for more than [Assignment: time period].
SI-07(17)
in SI-7
 Runtime Application Self-protection Implement [Assignment: controls] for application self-protection at runtime.
SI-08 Spam Protection a. Employ spam protection mechanisms at system entry and exit points to detect and act on unsolicited messages; and b. Update spam protection mechanisms when new releases are available in accordance with organizational configuration managem
SI-08(01)
in SI-8
 Central Management withdrawn
SI-08(02)
in SI-8
 Automatic Updates Automatically update spam protection mechanisms [Assignment: frequency].
SI-08(03)
in SI-8
 Continuous Learning Capability Implement spam protection mechanisms with a learning capability to more effectively identify legitimate communications traffic.
SI-09 Information Input Restrictions withdrawn
SI-10 Information Input Validation Check the validity of the following information inputs: [Assignment: information inputs].
SI-10(01)
in SI-10
 Manual Override Capability (a) Provide a manual override capability for input validation of the following information inputs: [Assignment: information inputs]; (b) Restrict the use of the manual override capability to only [Assignment: authorized individuals] ; and (
SI-10(02)
in SI-10
 Review and Resolve Errors Review and resolve input validation errors within [Assignment: organization-defined time period].
SI-10(03)
in SI-10
 Predictable Behavior Verify that the system behaves in a predictable and documented manner when invalid inputs are received.
SI-10(04)
in SI-10
 Timing Interactions Account for timing interactions among system components in determining appropriate responses for invalid inputs.
SI-10(05)
in SI-10
 Restrict Inputs to Trusted Sources and Approved Formats Restrict the use of information inputs to [Assignment: trusted sources] and/or [Assignment: formats].
SI-10(06)
in SI-10
 Injection Prevention Prevent untrusted data injections.
SI-11 Error Handling a. Generate error messages that provide information necessary for corrective actions without revealing information that could be exploited; and b. Reveal error messages only to [Assignment: personnel or roles].
SI-12 Information Management and Retention Manage and retain information within the system and information output from the system in accordance with applicable laws, executive orders, directives, regulations, policies, standards, guidelines and operational requirements.
SI-12(01)
in SI-12
 Limit Personally Identifiable Information Elements Limit personally identifiable information being processed in the information life cycle to the following elements of personally identifiable information: [Assignment: elements of personally identifiable information].
SI-12(02)
in SI-12
 Minimize Personally Identifiable Information in Testing, Training, and Research Use the following techniques to minimize the use of personally identifiable information for research, testing, or training: [Assignment: organization-defined techniques].
SI-12(03)
in SI-12
 Information Disposal Use the following techniques to dispose of, destroy, or erase information following the retention period: [Assignment: organization-defined techniques].
SI-13 Predictable Failure Prevention a. Determine mean time to failure (MTTF) for the following system components in specific environments of operation: [Assignment: system components] ; and b. Provide substitute system components and a means to exchange active and standby com
SI-13(01)
in SI-13
 Transferring Component Responsibilities Take system components out of service by transferring component responsibilities to substitute components no later than [Assignment: fraction or percentage] of mean time to failure.
SI-13(02)
in SI-13
 Time Limit on Process Execution Without Supervision withdrawn
SI-13(03)
in SI-13
 Manual Transfer Between Components Manually initiate transfers between active and standby system components when the use of the active component reaches [Assignment: percentage] of the mean time to failure.
SI-13(04)
in SI-13
 Standby Component Installation and Notification If system component failures are detected: (a) Ensure that the standby components are successfully and transparently installed within [Assignment: time period] ; and (b) [Selection (one or more): activate {{ insert: param, si-13.04_odp.03 }
SI-13(05)
in SI-13
 Failover Capability Provide [Selection: real-time; near real-time] [Assignment: failover capability] for the system.
SI-14 Non-persistence Implement non-persistent [Assignment: system components and services] that are initiated in a known state and terminated [Selection (one or more): upon end of session of use; {{ insert: param, si-14_odp.03 }} ].
SI-14(01)
in SI-14
 Refresh from Trusted Sources Obtain software and data employed during system component and service refreshes from the following trusted sources: [Assignment: trusted sources].
SI-14(02)
in SI-14
 Non-persistent Information (a) [Selection: refresh {{ insert: param, si-14.02_odp.02 }} {{ insert: param, si-14.02_odp.03 }} ; generate {{ insert: param, si-14.02_odp.04 }} on demand] ; and (b) Delete information when no longer needed.
SI-14(03)
in SI-14
 Non-persistent Connectivity Establish connections to the system on demand and terminate connections after [Selection: completion of a request; a period of non-use].
SI-15 Information Output Filtering Validate information output from the following software programs and/or applications to ensure that the information is consistent with the expected content: [Assignment: software programs and/or applications].
SI-16 Memory Protection Implement the following controls to protect the system memory from unauthorized code execution: [Assignment: controls].
SI-17 Fail-safe Procedures Implement the indicated fail-safe procedures when the indicated failures occur: [Assignment: organization-defined list of failure conditions and associated fail-safe procedures].
SI-18 Personally Identifiable Information Quality Operations a. Check the accuracy, relevance, timeliness, and completeness of personally identifiable information across the information life cycle [Assignment: organization-defined frequency] ; and b. Correct or delete inaccurate or outdated personall
SI-18(01)
in SI-18
 Automation Support Correct or delete personally identifiable information that is inaccurate or outdated, incorrectly determined regarding impact, or incorrectly de-identified using [Assignment: automated mechanisms].
SI-18(02)
in SI-18
 Data Tags Employ data tags to automate the correction or deletion of personally identifiable information across the information life cycle within organizational systems.
SI-18(03)
in SI-18
 Collection Collect personally identifiable information directly from the individual.
SI-18(04)
in SI-18
 Individual Requests Correct or delete personally identifiable information upon request by individuals or their designated representatives.
SI-18(05)
in SI-18
 Notice of Correction or Deletion Notify [Assignment: recipients] and individuals that the personally identifiable information has been corrected or deleted.
SI-19 De-identification a. Remove the following elements of personally identifiable information from datasets: [Assignment: elements] ; and b. Evaluate [Assignment: frequency] for effectiveness of de-identification.
SI-19(01)
in SI-19
 Collection De-identify the dataset upon collection by not collecting personally identifiable information.
SI-19(02)
in SI-19
 Archiving Prohibit archiving of personally identifiable information elements if those elements in a dataset will not be needed after the dataset is archived.
SI-19(03)
in SI-19
 Release Remove personally identifiable information elements from a dataset prior to its release if those elements in the dataset do not need to be part of the data release.
SI-19(04)
in SI-19
 Removal, Masking, Encryption, Hashing, or Replacement of Direct Identifiers Remove, mask, encrypt, hash, or replace direct identifiers in a dataset.
SI-19(05)
in SI-19
 Statistical Disclosure Control Manipulate numerical data, contingency tables, and statistical findings so that no individual or organization is identifiable in the results of the analysis.
SI-19(06)
in SI-19
 Differential Privacy Prevent disclosure of personally identifiable information by adding non-deterministic noise to the results of mathematical operations before the results are reported.
SI-19(07)
in SI-19
 Validated Algorithms and Software Perform de-identification using validated algorithms and software that is validated to implement the algorithms.
SI-19(08)
in SI-19
 Motivated Intruder Perform a motivated intruder test on the de-identified dataset to determine if the identified data remains or if the de-identified data can be re-identified.
SI-20 Tainting Embed data or capabilities in the following systems or system components to determine if organizational data has been exfiltrated or improperly removed from the organization: [Assignment: systems or system components].
SI-21 Information Refresh Refresh [Assignment: information] at [Assignment: frequencies] or generate the information on demand and delete the information when no longer needed.
SI-22 Information Diversity a. Identify the following alternative sources of information for [Assignment: essential functions and services]: [Assignment: alternative information sources] ; and b. Use an alternative information source for the execution of essential fun
SI-23 Information Fragmentation Based on [Assignment: circumstances]: a. Fragment the following information: [Assignment: information] ; and b. Distribute the fragmented information across the following systems or system components: [Assignment: systems or system componen

119 of 1196.