SI System and Information Integrity

Control

1. Develop, document, and disseminate to [Assignement: organization-defined personnel or roles]:
   1. [Selection(one-or-more): organization-level; mission/business process-level; system-level] system and information integrity policy that:
      1. Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and
      2. Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and
   2. Procedures to facilitate the implementation of the system and information integrity policy and the associated system and information integrity controls;
2. Designate an [Assignement: official] to manage the development, documentation, and dissemination of the system and information integrity policy and procedures; and
3. Review and update the current system and information integrity:
   1. Policy [Assignement: frequency] and following [Assignement: events] ; and
   2. Procedures [Assignement: frequency] and following [Assignement: events].

Discussion

Assessment Objective

1. 1. a system and information integrity policy is developed and documented;
   2. the system and information integrity policy is disseminated to [Assignement: personnel or roles];
   3. system and information integrity procedures to facilitate the implementation of the system and information integrity policy and associated system and information integrity controls are developed and documented;
   4. the system and information integrity procedures are disseminated to [Assignement: personnel or roles];
   5. 1. 1. the [Selection(one-or-more): organization-level; mission/business process-level; system-level] system and information integrity policy addresses purpose;
         2. the [Selection(one-or-more): organization-level; mission/business process-level; system-level] system and information integrity policy addresses scope;
         3. the [Selection(one-or-more): organization-level; mission/business process-level; system-level] system and information integrity policy addresses roles;
         4. the [Selection(one-or-more): organization-level; mission/business process-level; system-level] system and information integrity policy addresses responsibilities;
         5. the [Selection(one-or-more): organization-level; mission/business process-level; system-level] system and information integrity policy addresses management commitment;
         6. the [Selection(one-or-more): organization-level; mission/business process-level; system-level] system and information integrity policy addresses coordination among organizational entities;
         7. the [Selection(one-or-more): organization-level; mission/business process-level; system-level] system and information integrity policy addresses compliance;
      2. the [Selection(one-or-more): organization-level; mission/business process-level; system-level] system and information integrity policy is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines;
2. the [Assignement: official] is designated to manage the development, documentation, and dissemination of the system and information integrity policy and procedures;
3. 1. 1. the current system and information integrity policy is reviewed and updated [Assignement: frequency];
      2. the current system and information integrity policy is reviewed and updated following [Assignement: events];
   2. 1. the current system and information integrity procedures are reviewed and updated [Assignement: frequency];
      2. the current system and information integrity procedures are reviewed and updated following [Assignement: events].

Assessment Method

Examine

Interview

Control

1. Identify, report, and correct system flaws;
2. Test software and firmware updates related to flaw remediation for effectiveness and potential side effects before installation;
3. Install security-relevant software and firmware updates within [Assignement: time period] of the release of the updates; and
4. Incorporate flaw remediation into the organizational configuration management process.

Discussion

Assessment Objective

1. 1. system flaws are identified;
   2. system flaws are reported;
   3. system flaws are corrected;
2. 1. software updates related to flaw remediation are tested for effectiveness before installation;
   2. software updates related to flaw remediation are tested for potential side effects before installation;
   3. firmware updates related to flaw remediation are tested for effectiveness before installation;
   4. firmware updates related to flaw remediation are tested for potential side effects before installation;
3. 1. security-relevant software updates are installed within [Assignement: time period] of the release of the updates;
   2. security-relevant firmware updates are installed within [Assignement: time period] of the release of the updates;
4. flaw remediation is incorporated into the organizational configuration management process.

Assessment Method

Examine

Interview

Control

1. Implement [Selection(one-or-more): signature-based; non-signature-based] malicious code protection mechanisms at system entry and exit points to detect and eradicate malicious code;
2. Automatically update malicious code protection mechanisms as new releases are available in accordance with organizational configuration management policy and procedures;
3. Configure malicious code protection mechanisms to:
   1. Perform periodic scans of the system [Assignement: frequency] and real-time scans of files from external sources at [Selection(one-or-more): endpoint; network entry and exit points] as the files are downloaded, opened, or executed in accordance with organizational policy; and
   2. [Selection(one-or-more): block malicious code; quarantine malicious code; take {{ insert: param, si-03_odp.05 }} ] ; and send alert to [Assignement: personnel or roles] in response to malicious code detection; and
4. Address the receipt of false positives during malicious code detection and eradication and the resulting potential impact on the availability of the system.

Discussion

Assessment Objective

1. 1. [Selection(one-or-more): signature-based; non-signature-based] malicious code protection mechanisms are implemented at system entry and exit points to detect malicious code;
   2. [Selection(one-or-more): signature-based; non-signature-based] malicious code protection mechanisms are implemented at system entry and exit points to eradicate malicious code;
2. malicious code protection mechanisms are updated automatically as new releases are available in accordance with organizational configuration management policy and procedures;
3. 1. 1. malicious code protection mechanisms are configured to perform periodic scans of the system [Assignement: frequency];
      2. malicious code protection mechanisms are configured to perform real-time scans of files from external sources at [Selection(one-or-more): endpoint; network entry and exit points] as the files are downloaded, opened, or executed in accordance with organizational policy;
   2. 1. malicious code protection mechanisms are configured to [Selection(one-or-more): block malicious code; quarantine malicious code; take {{ insert: param, si-03_odp.05 }} ] in response to malicious code detection;
      2. malicious code protection mechanisms are configured to send alerts to [Assignement: personnel or roles] in response to malicious code detection;
4. the receipt of false positives during malicious code detection and eradication and the resulting potential impact on the availability of the system are addressed.

Assessment Method

Examine

Interview

Control

1. Monitor the system to detect:
   1. Attacks and indicators of potential attacks in accordance with the following monitoring objectives: [Assignement: monitoring objectives] ; and
   2. Unauthorized local, network, and remote connections;
2. Identify unauthorized use of the system through the following techniques and methods: [Assignement: techniques and methods];
3. Invoke internal monitoring capabilities or deploy monitoring devices:
   1. Strategically within the system to collect organization-determined essential information; and
   2. At ad hoc locations within the system to track specific types of transactions of interest to the organization;
4. Analyze detected events and anomalies;
5. Adjust the level of system monitoring activity when there is a change in risk to organizational operations and assets, individuals, other organizations, or the Nation;
6. Obtain legal opinion regarding system monitoring activities; and
7. Provide [Assignement: system monitoring information] to [Assignement: personnel or roles] [Selection(one-or-more): as needed; {{ insert: param, si-04_odp.06 }} ].

Discussion

Assessment Objective

1. 1. the system is monitored to detect attacks and indicators of potential attacks in accordance with [Assignement: monitoring objectives];
   2. 1. the system is monitored to detect unauthorized local connections;
      2. the system is monitored to detect unauthorized network connections;
      3. the system is monitored to detect unauthorized remote connections;
2. unauthorized use of the system is identified through [Assignement: techniques and methods];
3. 1. internal monitoring capabilities are invoked or monitoring devices are deployed strategically within the system to collect organization-determined essential information;
   2. internal monitoring capabilities are invoked or monitoring devices are deployed at ad hoc locations within the system to track specific types of transactions of interest to the organization;
4. 1. detected events are analyzed;
   2. detected anomalies are analyzed;
5. the level of system monitoring activity is adjusted when there is a change in risk to organizational operations and assets, individuals, other organizations, or the Nation;
6. a legal opinion regarding system monitoring activities is obtained;
7. [Assignement: system monitoring information] is provided to [Assignement: personnel or roles] [Selection(one-or-more): as needed; {{ insert: param, si-04_odp.06 }} ].

Assessment Method

Examine

Interview

Control

1. Receive system security alerts, advisories, and directives from [Assignement: external organizations] on an ongoing basis;
2. Generate internal security alerts, advisories, and directives as deemed necessary;
3. Disseminate security alerts, advisories, and directives to: [Selection(one-or-more): {{ insert: param, si-05_odp.03 }} ; {{ insert: param, si-05_odp.04 }} ; {{ insert: param, si-05_odp.05 }} ] ; and
4. Implement security directives in accordance with established time frames, or notify the issuing organization of the degree of noncompliance.

Discussion

Assessment Objective

1. system security alerts, advisories, and directives are received from [Assignement: external organizations] on an ongoing basis;
2. internal security alerts, advisories, and directives are generated as deemed necessary;
3. security alerts, advisories, and directives are disseminated to [Selection(one-or-more): {{ insert: param, si-05_odp.03 }} ; {{ insert: param, si-05_odp.04 }} ; {{ insert: param, si-05_odp.05 }} ];
4. security directives are implemented in accordance with established time frames or if the issuing organization is notified of the degree of noncompliance.

Assessment Method

Examine

Interview

Control

1. Verify the correct operation of [Assignement: organization-defined security and privacy functions];
2. Perform the verification of the functions specified in SI-6a [Selection(one-or-more): {{ insert: param, si-06_odp.04 }} ; upon command by user with appropriate privilege; {{ insert: param, si-06_odp.05 }} ];
3. Alert [Assignement: personnel or roles] to failed security and privacy verification tests; and
4. [Selection(one-or-more): shut the system down; restart the system; {{ insert: param, si-06_odp.08 }} ] when anomalies are discovered.

Discussion

Assessment Objective

1. 1. [Assignement: security functions] are verified to be operating correctly;
   2. [Assignement: privacy functions] are verified to be operating correctly;
2. 1. [Assignement: security functions] are verified [Selection(one-or-more): {{ insert: param, si-06_odp.04 }} ; upon command by user with appropriate privilege; {{ insert: param, si-06_odp.05 }} ];
   2. [Assignement: privacy functions] are verified [Selection(one-or-more): {{ insert: param, si-06_odp.04 }} ; upon command by user with appropriate privilege; {{ insert: param, si-06_odp.05 }} ];
3. 1. [Assignement: personnel or roles] is/are alerted to failed security verification tests;
   2. [Assignement: personnel or roles] is/are alerted to failed privacy verification tests;
4. [Selection(one-or-more): shut the system down; restart the system; {{ insert: param, si-06_odp.08 }} ] is/are initiated when anomalies are discovered.

Assessment Method

Examine

Interview

Control

1. Employ integrity verification tools to detect unauthorized changes to the following software, firmware, and information: [Assignement: organization-defined software, firmware, and information] ; and
2. Take the following actions when unauthorized changes to the software, firmware, and information are detected: [Assignement: organization-defined actions].

Discussion

Assessment Objective

1. 1. integrity verification tools are employed to detect unauthorized changes to [Assignement: software];
   2. integrity verification tools are employed to detect unauthorized changes to [Assignement: firmware];
   3. integrity verification tools are employed to detect unauthorized changes to [Assignement: information];
2. 1. [Assignement: actions] are taken when unauthorized changes to the software, are detected;
   2. [Assignement: actions] are taken when unauthorized changes to the firmware are detected;
   3. [Assignement: actions] are taken when unauthorized changes to the information are detected.

Assessment Method

Examine

Interview

Control

1. Employ spam protection mechanisms at system entry and exit points to detect and act on unsolicited messages; and
2. Update spam protection mechanisms when new releases are available in accordance with organizational configuration management policy and procedures.

Discussion

Assessment Objective

1. 1. spam protection mechanisms are employed at system entry points to detect unsolicited messages;
   2. spam protection mechanisms are employed at system exit points to detect unsolicited messages;
   3. spam protection mechanisms are employed at system entry points to act on unsolicited messages;
   4. spam protection mechanisms are employed at system exit points to act on unsolicited messages;
2. spam protection mechanisms are updated when new releases are available in accordance with organizational configuration management policies and procedures.

Assessment Method

Examine

Interview

Control

Discussion

Assessment Objective

Assessment Method

Examine

Interview

Control

Discussion

Assessment Objective

Assessment Method

Examine

Interview

Control

1. Generate error messages that provide information necessary for corrective actions without revealing information that could be exploited; and
2. Reveal error messages only to [Assignement: personnel or roles].

Discussion

Assessment Objective

1. error messages that provide the information necessary for corrective actions are generated without revealing information that could be exploited;
2. error messages are revealed only to [Assignement: personnel or roles].

Assessment Method

Examine

Interview

Control

Discussion

Assessment Objective

1. information within the system is managed in accordance with applicable laws, Executive Orders, directives, regulations, policies, standards, guidelines, and operational requirements;
2. information within the system is retained in accordance with applicable laws, Executive Orders, directives, regulations, policies, standards, guidelines, and operational requirements;
3. information output from the system is managed in accordance with applicable laws, Executive Orders, directives, regulations, policies, standards, guidelines, and operational requirements;
4. information output from the system is retained in accordance with applicable laws, Executive Orders, directives, regulations, policies, standards, guidelines, and operational requirements.

Assessment Method

Examine

Interview

Control

1. Determine mean time to failure (MTTF) for the following system components in specific environments of operation: [Assignement: system components] ; and
2. Provide substitute system components and a means to exchange active and standby components in accordance with the following criteria: [Assignement: mean time to failure (MTTF) substitution criteria].

Discussion

Assessment Objective

1. mean time to failure (MTTF) is determined for [Assignement: system components] in specific environments of operation;
2. substitute system components and a means to exchange active and standby components are provided in accordance with [Assignement: mean time to failure (MTTF) substitution criteria].

Assessment Method

Examine

Interview

Control

Discussion

Assessment Objective

1. non-persistent [Assignement: system components and services] that are initiated in a known state are implemented;
2. non-persistent [Assignement: system components and services] are terminated [Selection(one-or-more): upon end of session of use; {{ insert: param, si-14_odp.03 }} ].

Assessment Method

Examine

Interview

Control

Discussion

Assessment Objective

Assessment Method

Examine

Interview

Control

Discussion

Assessment Objective

Assessment Method

Examine

Interview

Control

Discussion

Assessment Objective

Assessment Method

Examine

Interview

Control

1. Check the accuracy, relevance, timeliness, and completeness of personally identifiable information across the information life cycle [Assignement: organization-defined frequency] ; and
2. Correct or delete inaccurate or outdated personally identifiable information.

Discussion

Assessment Objective

1. 1. the accuracy of personally identifiable information across the information life cycle is checked [Assignement: frequency];
   2. the relevance of personally identifiable information across the information life cycle is checked [Assignement: frequency];
   3. the timeliness of personally identifiable information across the information life cycle is checked [Assignement: frequency];
   4. the completeness of personally identifiable information across the information life cycle is checked [Assignement: frequency];
2. inaccurate or outdated personally identifiable information is corrected or deleted.

Assessment Method

Examine

Interview

Control

1. Remove the following elements of personally identifiable information from datasets: [Assignement: elements] ; and
2. Evaluate [Assignement: frequency] for effectiveness of de-identification.

Discussion

Assessment Objective

1. [Assignement: elements] are removed from datasets;
2. the effectiveness of de-identification is evaluated [Assignement: frequency].

Assessment Method

Examine

Interview

Control

Discussion

Assessment Objective

Assessment Method

Examine

Interview

Control

Discussion

Assessment Objective

Assessment Method

Examine

Interview

Control

1. Identify the following alternative sources of information for [Assignement: essential functions and services]: [Assignement: alternative information sources] ; and
2. Use an alternative information source for the execution of essential functions or services on [Assignement: systems or system components] when the primary source of information is corrupted or unavailable.

Discussion

Assessment Objective

1. [Assignement: alternative information sources] for [Assignement: essential functions and services] are identified;
2. an alternative information source is used for the execution of essential functions or services on [Assignement: systems or system components] when the primary source of information is corrupted or unavailable.

Assessment Method

Examine

Interview

Control

1. Fragment the following information: [Assignement: information] ; and
2. Distribute the fragmented information across the following systems or system components: [Assignement: systems or system components].

Discussion

Assessment Objective

1. under [Assignement: circumstances], [Assignement: information] is fragmented;
2. under [Assignement: circumstances] , the fragmented information is distributed across [Assignement: systems or system components].

Assessment Method

Examine

Interview