CCI-002622

CCI-002622 Definition

The organization employs malicious code protection mechanisms at information system exit points to eradicate malicious code.

Status
Type	CheckType.policy

The controls below (if any) were marked by NIST as being related to CCI-002622.

Control	Description
SI-3	The organization: a: Employs malicious code protection mechanisms at information system entry and exit points to detect and eradicate malicious code; b: Updates malicious code protection mechanisms whenever new releases are available in accordance with organizational configuration management policy and procedures; c: Configures malicious code protection mechanisms to: 1: Perform periodic scans of the information system [one of ] and real-time scans of files from external sources at [one or more of "endpoint"/"network entry/exit points"] as the files are downloaded, opened, or executed in accordance with organizational security policy; and 2: [one or more of "block malicious code"/"quarantine malicious code"/"send alert to administrator"/" {{ insert: param, si-3_prm_4 }} "] in response to malicious code detection; and d: Addresses the receipt of false positives during malicious code detection and eradication and the resulting potential impact on the availability of the information system.

Control

Description

a: Employs malicious code protection mechanisms at information system entry and exit points to detect and eradicate malicious code;

b: Updates malicious code protection mechanisms whenever new releases are available in accordance with organizational configuration management policy and procedures;

c: Configures malicious code protection mechanisms to:
- 1: Perform periodic scans of the information system [one of ] and real-time scans of files from external sources at [one or more of "endpoint"/"network entry/exit points"] as the files are downloaded, opened, or executed in accordance with organizational security policy; and
- 2: [one or more of "block malicious code"/"quarantine malicious code"/"send alert to administrator"/" {{ insert: param, si-3_prm_4 }} "] in response to malicious code detection; and

d: Addresses the receipt of false positives during malicious code detection and eradication and the resulting potential impact on the availability of the information system.