NIST SP 800-53 (controls) 5.1.1+u4

1193 requirements · published 2024-02-04
Changes in this version

All AC AT AU CA CM CP IA IR MA MP PE PL PM PS PT RA SA SC SI SR

Controls in this version
Ref	Title	Text
SI-01	Policy and Procedures	a. Develop, document, and disseminate to [Assignment: organization-defined personnel or roles]: 1. [Selection (one or more): organization-level; mission/business process-level; system-level] system and information integrity policy that: (a)
SI-02	Flaw Remediation	a. Identify, report, and correct system flaws; b. Test software and firmware updates related to flaw remediation for effectiveness and potential side effects before installation; c. Install security-relevant software and firmware updates wi
SI-02(01) in SI-2	Central Management withdrawn
SI-02(02) in SI-2	Automated Flaw Remediation Status	Determine if system components have applicable security-relevant software and firmware updates installed using [Assignment: automated mechanisms] [Assignment: frequency].
SI-02(03) in SI-2	Time to Remediate Flaws and Benchmarks for Corrective Actions	(a) Measure the time between flaw identification and flaw remediation; and (b) Establish the following benchmarks for taking corrective actions: [Assignment: benchmarks].
SI-02(04) in SI-2	Automated Patch Management Tools	Employ automated patch management tools to facilitate flaw remediation to the following system components: [Assignment: components].
SI-02(05) in SI-2	Automatic Software and Firmware Updates	Install [Assignment: security-relevant software and firmware updates] automatically to [Assignment: system components].
SI-02(06) in SI-2	Removal of Previous Versions of Software and Firmware	Remove previous versions of [Assignment: software and firmware components] after updated versions have been installed.
SI-03	Malicious Code Protection	a. Implement [Selection (one or more): signature-based; non-signature-based] malicious code protection mechanisms at system entry and exit points to detect and eradicate malicious code; b. Automatically update malicious code protection mech
SI-03(01) in SI-3	Central Management withdrawn
SI-03(02) in SI-3	Automatic Updates withdrawn
SI-03(03) in SI-3	Non-privileged Users withdrawn
SI-03(04) in SI-3	Updates Only by Privileged Users	Update malicious code protection mechanisms only when directed by a privileged user.
SI-03(05) in SI-3	Portable Storage Devices withdrawn
SI-03(06) in SI-3	Testing and Verification	(a) Test malicious code protection mechanisms [Assignment: frequency] by introducing known benign code into the system; and (b) Verify that the detection of the code and the associated incident reporting occur.
SI-03(07) in SI-3	Nonsignature-based Detection withdrawn
SI-03(08) in SI-3	Detect Unauthorized Commands	(a) Detect the following unauthorized operating system commands through the kernel application programming interface on [Assignment: system hardware components]: [Assignment: unauthorized operating system commands] ; and (b) [Selection (one
SI-03(09) in SI-3	Authenticate Remote Commands withdrawn
SI-03(10) in SI-3	Malicious Code Analysis	(a) Employ the following tools and techniques to analyze the characteristics and behavior of malicious code: [Assignment: tools and techniques] ; and (b) Incorporate the results from malicious code analysis into organizational incident resp
SI-04	System Monitoring	a. Monitor the system to detect: 1. Attacks and indicators of potential attacks in accordance with the following monitoring objectives: [Assignment: monitoring objectives] ; and 2. Unauthorized local, network, and remote connections; b. Ide
SI-04(01) in SI-4	System-wide Intrusion Detection System	Connect and configure individual intrusion detection tools into a system-wide intrusion detection system.
SI-04(02) in SI-4	Automated Tools and Mechanisms for Real-time Analysis	Employ automated tools and mechanisms to support near real-time analysis of events.
SI-04(03) in SI-4	Automated Tool and Mechanism Integration	Employ automated tools and mechanisms to integrate intrusion detection tools and mechanisms into access control and flow control mechanisms.
SI-04(04) in SI-4	Inbound and Outbound Communications Traffic	(a) Determine criteria for unusual or unauthorized activities or conditions for inbound and outbound communications traffic; (b) Monitor inbound and outbound communications traffic [Assignment: organization-defined frequency] for [Assignmen
SI-04(05) in SI-4	System-generated Alerts	Alert [Assignment: personnel or roles] when the following system-generated indications of compromise or potential compromise occur: [Assignment: compromise indicators].
SI-04(06) in SI-4	Restrict Non-privileged Users withdrawn
SI-04(07) in SI-4	Automated Response to Suspicious Events	(a) Notify [Assignment: incident response personnel] of detected suspicious events; and (b) Take the following actions upon detection: [Assignment: least-disruptive actions].
SI-04(08) in SI-4	Protection of Monitoring Information withdrawn
SI-04(09) in SI-4	Testing of Monitoring Tools and Mechanisms	Test intrusion-monitoring tools and mechanisms [Assignment: frequency].
SI-04(10) in SI-4	Visibility of Encrypted Communications	Make provisions so that [Assignment: encrypted communications traffic] is visible to [Assignment: system monitoring tools and mechanisms].
SI-04(11) in SI-4	Analyze Communications Traffic Anomalies	Analyze outbound communications traffic at the external interfaces to the system and selected [Assignment: interior points] to discover anomalies.
SI-04(12) in SI-4	Automated Organization-generated Alerts	Alert [Assignment: personnel or roles] using [Assignment: automated mechanisms] when the following indications of inappropriate or unusual activities with security or privacy implications occur: [Assignment: activities that trigger alerts].
SI-04(13) in SI-4	Analyze Traffic and Event Patterns	(a) Analyze communications traffic and event patterns for the system; (b) Develop profiles representing common traffic and event patterns; and (c) Use the traffic and event profiles in tuning system-monitoring devices.
SI-04(14) in SI-4	Wireless Intrusion Detection	Employ a wireless intrusion detection system to identify rogue wireless devices and to detect attack attempts and potential compromises or breaches to the system.
SI-04(15) in SI-4	Wireless to Wireline Communications	Employ an intrusion detection system to monitor wireless communications traffic as the traffic passes from wireless to wireline networks.
SI-04(16) in SI-4	Correlate Monitoring Information	Correlate information from monitoring tools and mechanisms employed throughout the system.
SI-04(17) in SI-4	Integrated Situational Awareness	Correlate information from monitoring physical, cyber, and supply chain activities to achieve integrated, organization-wide situational awareness.
SI-04(18) in SI-4	Analyze Traffic and Covert Exfiltration	Analyze outbound communications traffic at external interfaces to the system and at the following interior points to detect covert exfiltration of information: [Assignment: interior points].
SI-04(19) in SI-4	Risk for Individuals	Implement [Assignment: additional monitoring] of individuals who have been identified by [Assignment: sources] as posing an increased level of risk.
SI-04(20) in SI-4	Privileged Users	Implement the following additional monitoring of privileged users: [Assignment: additional monitoring].
SI-04(21) in SI-4	Probationary Periods	Implement the following additional monitoring of individuals during [Assignment: probationary period]: [Assignment: additional monitoring].
SI-04(22) in SI-4	Unauthorized Network Services	(a) Detect network services that have not been authorized or approved by [Assignment: authorization or approval processes] ; and (b) [Selection (one or more): audit; alert {{ insert: param, si-04.22_odp.03 }} ] when detected.
SI-04(23) in SI-4	Host-based Devices	Implement the following host-based monitoring mechanisms at [Assignment: system components]: [Assignment: host-based monitoring mechanisms].
SI-04(24) in SI-4	Indicators of Compromise	Discover, collect, and distribute to [Assignment: personnel or roles] , indicators of compromise provided by [Assignment: sources].
SI-04(25) in SI-4	Optimize Network Traffic Analysis	Provide visibility into network traffic at external and key internal system interfaces to optimize the effectiveness of monitoring devices.
SI-05	Security Alerts, Advisories, and Directives	a. Receive system security alerts, advisories, and directives from [Assignment: external organizations] on an ongoing basis; b. Generate internal security alerts, advisories, and directives as deemed necessary; c. Disseminate security alert
SI-05(01) in SI-5	Automated Alerts and Advisories	Broadcast security alert and advisory information throughout the organization using [Assignment: automated mechanisms].
SI-06	Security and Privacy Function Verification	a. Verify the correct operation of [Assignment: organization-defined security and privacy functions]; b. Perform the verification of the functions specified in SI-6a [Selection (one or more): {{ insert: param, si-06_odp.04 }} ; upon command
SI-06(01) in SI-6	Notification of Failed Security Tests withdrawn
SI-06(02) in SI-6	Automation Support for Distributed Testing	Implement automated mechanisms to support the management of distributed security and privacy function testing.
SI-06(03) in SI-6	Report Verification Results	Report the results of security and privacy function verification to [Assignment: personnel or roles].
SI-07	Software, Firmware, and Information Integrity	a. Employ integrity verification tools to detect unauthorized changes to the following software, firmware, and information: [Assignment: organization-defined software, firmware, and information] ; and b. Take the following actions when unau
SI-07(01) in SI-7	Integrity Checks	Perform an integrity check of [Assignment: organization-defined software, firmware, and information] [Selection (one or more): at startup; at {{ insert: param, si-7.1_prm_3 }} ; {{ insert: param, si-7.1_prm_4 }} ].
SI-07(02) in SI-7	Automated Notifications of Integrity Violations	Employ automated tools that provide notification to [Assignment: personnel or roles] upon discovering discrepancies during integrity verification.
SI-07(03) in SI-7	Centrally Managed Integrity Tools	Employ centrally managed integrity verification tools.
SI-07(04) in SI-7	Tamper-evident Packaging withdrawn
SI-07(05) in SI-7	Automated Response to Integrity Violations	Automatically [Selection (one or more): shut down the system; restart the system; implement {{ insert: param, si-07.05_odp.02 }} ] when integrity violations are discovered.
SI-07(06) in SI-7	Cryptographic Protection	Implement cryptographic mechanisms to detect unauthorized changes to software, firmware, and information.
SI-07(07) in SI-7	Integration of Detection and Response	Incorporate the detection of the following unauthorized changes into the organizational incident response capability: [Assignment: changes].
SI-07(08) in SI-7	Auditing Capability for Significant Events	Upon detection of a potential integrity violation, provide the capability to audit the event and initiate the following actions: [Selection (one or more): generate an audit record; alert current user; alert {{ insert: param, si-07.08_odp.02
SI-07(09) in SI-7	Verify Boot Process	Verify the integrity of the boot process of the following system components: [Assignment: system components].
SI-07(10) in SI-7	Protection of Boot Firmware	Implement the following mechanisms to protect the integrity of boot firmware in [Assignment: system components]: [Assignment: mechanisms].
SI-07(11) in SI-7	Confined Environments with Limited Privileges withdrawn
SI-07(12) in SI-7	Integrity Verification	Require that the integrity of the following user-installed software be verified prior to execution: [Assignment: user-installed software].
SI-07(13) in SI-7	Code Execution in Protected Environments withdrawn
SI-07(14) in SI-7	Binary or Machine Executable Code withdrawn
SI-07(15) in SI-7	Code Authentication	Implement cryptographic mechanisms to authenticate the following software or firmware components prior to installation: [Assignment: software or firmware components].
SI-07(16) in SI-7	Time Limit on Process Execution Without Supervision	Prohibit processes from executing without supervision for more than [Assignment: time period].
SI-07(17) in SI-7	Runtime Application Self-protection	Implement [Assignment: controls] for application self-protection at runtime.
SI-08	Spam Protection	a. Employ spam protection mechanisms at system entry and exit points to detect and act on unsolicited messages; and b. Update spam protection mechanisms when new releases are available in accordance with organizational configuration managem
SI-08(01) in SI-8	Central Management withdrawn
SI-08(02) in SI-8	Automatic Updates	Automatically update spam protection mechanisms [Assignment: frequency].
SI-08(03) in SI-8	Continuous Learning Capability	Implement spam protection mechanisms with a learning capability to more effectively identify legitimate communications traffic.
SI-09	Information Input Restrictions withdrawn
SI-10	Information Input Validation	Check the validity of the following information inputs: [Assignment: information inputs].
SI-10(01) in SI-10	Manual Override Capability	(a) Provide a manual override capability for input validation of the following information inputs: [Assignment: information inputs]; (b) Restrict the use of the manual override capability to only [Assignment: authorized individuals] ; and (
SI-10(02) in SI-10	Review and Resolve Errors	Review and resolve input validation errors within [Assignment: organization-defined time period].
SI-10(03) in SI-10	Predictable Behavior	Verify that the system behaves in a predictable and documented manner when invalid inputs are received.
SI-10(04) in SI-10	Timing Interactions	Account for timing interactions among system components in determining appropriate responses for invalid inputs.
SI-10(05) in SI-10	Restrict Inputs to Trusted Sources and Approved Formats	Restrict the use of information inputs to [Assignment: trusted sources] and/or [Assignment: formats].
SI-10(06) in SI-10	Injection Prevention	Prevent untrusted data injections.
SI-11	Error Handling	a. Generate error messages that provide information necessary for corrective actions without revealing information that could be exploited; and b. Reveal error messages only to [Assignment: personnel or roles].
SI-12	Information Management and Retention	Manage and retain information within the system and information output from the system in accordance with applicable laws, executive orders, directives, regulations, policies, standards, guidelines and operational requirements.
SI-12(01) in SI-12	Limit Personally Identifiable Information Elements	Limit personally identifiable information being processed in the information life cycle to the following elements of personally identifiable information: [Assignment: elements of personally identifiable information].
SI-12(02) in SI-12	Minimize Personally Identifiable Information in Testing, Training, and Research	Use the following techniques to minimize the use of personally identifiable information for research, testing, or training: [Assignment: organization-defined techniques].
SI-12(03) in SI-12	Information Disposal	Use the following techniques to dispose of, destroy, or erase information following the retention period: [Assignment: organization-defined techniques].
SI-13	Predictable Failure Prevention	a. Determine mean time to failure (MTTF) for the following system components in specific environments of operation: [Assignment: system components] ; and b. Provide substitute system components and a means to exchange active and standby com
SI-13(01) in SI-13	Transferring Component Responsibilities	Take system components out of service by transferring component responsibilities to substitute components no later than [Assignment: fraction or percentage] of mean time to failure.
SI-13(02) in SI-13	Time Limit on Process Execution Without Supervision withdrawn
SI-13(03) in SI-13	Manual Transfer Between Components	Manually initiate transfers between active and standby system components when the use of the active component reaches [Assignment: percentage] of the mean time to failure.
SI-13(04) in SI-13	Standby Component Installation and Notification	If system component failures are detected: (a) Ensure that the standby components are successfully and transparently installed within [Assignment: time period] ; and (b) [Selection (one or more): activate {{ insert: param, si-13.04_odp.03 }
SI-13(05) in SI-13	Failover Capability	Provide [Selection: real-time; near real-time] [Assignment: failover capability] for the system.
SI-14	Non-persistence	Implement non-persistent [Assignment: system components and services] that are initiated in a known state and terminated [Selection (one or more): upon end of session of use; {{ insert: param, si-14_odp.03 }} ].
SI-14(01) in SI-14	Refresh from Trusted Sources	Obtain software and data employed during system component and service refreshes from the following trusted sources: [Assignment: trusted sources].
SI-14(02) in SI-14	Non-persistent Information	(a) [Selection: refresh {{ insert: param, si-14.02_odp.02 }} {{ insert: param, si-14.02_odp.03 }} ; generate {{ insert: param, si-14.02_odp.04 }} on demand] ; and (b) Delete information when no longer needed.
SI-14(03) in SI-14	Non-persistent Connectivity	Establish connections to the system on demand and terminate connections after [Selection: completion of a request; a period of non-use].
SI-15	Information Output Filtering	Validate information output from the following software programs and/or applications to ensure that the information is consistent with the expected content: [Assignment: software programs and/or applications].
SI-16	Memory Protection	Implement the following controls to protect the system memory from unauthorized code execution: [Assignment: controls].
SI-17	Fail-safe Procedures	Implement the indicated fail-safe procedures when the indicated failures occur: [Assignment: organization-defined list of failure conditions and associated fail-safe procedures].
SI-18	Personally Identifiable Information Quality Operations	a. Check the accuracy, relevance, timeliness, and completeness of personally identifiable information across the information life cycle [Assignment: organization-defined frequency] ; and b. Correct or delete inaccurate or outdated personall
SI-18(01) in SI-18	Automation Support	Correct or delete personally identifiable information that is inaccurate or outdated, incorrectly determined regarding impact, or incorrectly de-identified using [Assignment: automated mechanisms].
SI-18(02) in SI-18	Data Tags	Employ data tags to automate the correction or deletion of personally identifiable information across the information life cycle within organizational systems.
SI-18(03) in SI-18	Collection	Collect personally identifiable information directly from the individual.
SI-18(04) in SI-18	Individual Requests	Correct or delete personally identifiable information upon request by individuals or their designated representatives.
SI-18(05) in SI-18	Notice of Correction or Deletion	Notify [Assignment: recipients] and individuals that the personally identifiable information has been corrected or deleted.
SI-19	De-identification	a. Remove the following elements of personally identifiable information from datasets: [Assignment: elements] ; and b. Evaluate [Assignment: frequency] for effectiveness of de-identification.
SI-19(01) in SI-19	Collection	De-identify the dataset upon collection by not collecting personally identifiable information.
SI-19(02) in SI-19	Archiving	Prohibit archiving of personally identifiable information elements if those elements in a dataset will not be needed after the dataset is archived.
SI-19(03) in SI-19	Release	Remove personally identifiable information elements from a dataset prior to its release if those elements in the dataset do not need to be part of the data release.
SI-19(04) in SI-19	Removal, Masking, Encryption, Hashing, or Replacement of Direct Identifiers	Remove, mask, encrypt, hash, or replace direct identifiers in a dataset.
SI-19(05) in SI-19	Statistical Disclosure Control	Manipulate numerical data, contingency tables, and statistical findings so that no individual or organization is identifiable in the results of the analysis.
SI-19(06) in SI-19	Differential Privacy	Prevent disclosure of personally identifiable information by adding non-deterministic noise to the results of mathematical operations before the results are reported.
SI-19(07) in SI-19	Validated Algorithms and Software	Perform de-identification using validated algorithms and software that is validated to implement the algorithms.
SI-19(08) in SI-19	Motivated Intruder	Perform a motivated intruder test on the de-identified dataset to determine if the identified data remains or if the de-identified data can be re-identified.
SI-20	Tainting	Embed data or capabilities in the following systems or system components to determine if organizational data has been exfiltrated or improperly removed from the organization: [Assignment: systems or system components].
SI-21	Information Refresh	Refresh [Assignment: information] at [Assignment: frequencies] or generate the information on demand and delete the information when no longer needed.
SI-22	Information Diversity	a. Identify the following alternative sources of information for [Assignment: essential functions and services]: [Assignment: alternative information sources] ; and b. Use an alternative information source for the execution of essential fun
SI-23	Information Fragmentation	Based on [Assignment: circumstances]: a. Fragment the following information: [Assignment: information] ; and b. Distribute the fragmented information across the following systems or system components: [Assignment: systems or system componen

118 of 1193.