Navigate

SI-2(2)

SI-2(2): Automated Flaw Remediation Status

Determine if system components have applicable security-relevant software and firmware updates installed using [automated mechanisms to determine if applicable security-relevant software and firmware updates are installed on system components are defined;] [the frequency at which to determine if applicable security-relevant software and firmware updates are installed on system components is defined;].

Supplemental

Automated mechanisms can track and determine the status of known flaws for system components.

CIA Levels
Confidentiality	unknown
Integrity	low
Availability	unknown

Overlays
DAF Baseline

CSF Categories
None

Related Controls

The controls below (if any) were marked by NIST as being related to SI-2(2).

Control	Description
CA-7	Develop a system-level continuous monitoring strategy and implement continuous monitoring in accordance with the organization-level continuous monitoring strategy that includes: a: Establishing the following system-level metrics to be monitored: [system-level metrics to be monitored are defined;]; b: Establishing [frequencies at which to monitor control effectiveness are defined;] for monitoring and [frequencies at which to assess control effectiveness are defined;] for assessment of control effectiveness; c: Ongoing control assessments in accordance with the continuous monitoring strategy; d: Ongoing monitoring of system and organization-defined metrics in accordance with the continuous monitoring strategy; e: Correlation and analysis of information generated by control assessments and monitoring; f: Response actions to address results of the analysis of control assessment and monitoring information; and g: Reporting the security and privacy status of the system to [one of ] [one of ].
SI-4	a: Monitor the system to detect: 1: Attacks and indicators of potential attacks in accordance with the following monitoring objectives: [monitoring objectives to detect attacks and indicators of potential attacks on the system are defined;] ; and 2: Unauthorized local, network, and remote connections; b: Identify unauthorized use of the system through the following techniques and methods: [techniques and methods used to identify unauthorized use of the system are defined;]; c: Invoke internal monitoring capabilities or deploy monitoring devices: 1: Strategically within the system to collect organization-determined essential information; and 2: At ad hoc locations within the system to track specific types of transactions of interest to the organization; d: Analyze detected events and anomalies; e: Adjust the level of system monitoring activity when there is a change in risk to organizational operations and assets, individuals, other organizations, or the Nation; f: Obtain legal opinion regarding system monitoring activities; and g: Provide [system monitoring information to be provided to personnel or roles is defined;] to [personnel or roles to whom system monitoring information is to be provided is/are defined;] [one or more of "as needed"/"{{ insert: param, si-04_odp.06 }} "].

Control

Description

CA-7

Develop a system-level continuous monitoring strategy and implement continuous monitoring in accordance with the organization-level continuous monitoring strategy that includes:

a: Establishing the following system-level metrics to be monitored: [system-level metrics to be monitored are defined;];

b: Establishing [frequencies at which to monitor control effectiveness are defined;] for monitoring and [frequencies at which to assess control effectiveness are defined;] for assessment of control effectiveness;

c: Ongoing control assessments in accordance with the continuous monitoring strategy;

d: Ongoing monitoring of system and organization-defined metrics in accordance with the continuous monitoring strategy;

e: Correlation and analysis of information generated by control assessments and monitoring;

f: Response actions to address results of the analysis of control assessment and monitoring information; and

g: Reporting the security and privacy status of the system to [one of ] [one of ].

SI-4

a: Monitor the system to detect:
- 1: Attacks and indicators of potential attacks in accordance with the following monitoring objectives: [monitoring objectives to detect attacks and indicators of potential attacks on the system are defined;] ; and
- 2: Unauthorized local, network, and remote connections;

b: Identify unauthorized use of the system through the following techniques and methods: [techniques and methods used to identify unauthorized use of the system are defined;];

c: Invoke internal monitoring capabilities or deploy monitoring devices:
- 1: Strategically within the system to collect organization-determined essential information; and
- 2: At ad hoc locations within the system to track specific types of transactions of interest to the organization;

d: Analyze detected events and anomalies;

e: Adjust the level of system monitoring activity when there is a change in risk to organizational operations and assets, individuals, other organizations, or the Nation;

f: Obtain legal opinion regarding system monitoring activities; and

g: Provide [system monitoring information to be provided to personnel or roles is defined;] to [personnel or roles to whom system monitoring information is to be provided is/are defined;] [one or more of "as needed"/"{{ insert: param, si-04_odp.06 }} "].

Enhancements

The controls below (if any) add on to the requirements of SI-2(2).

Control	Description
No controls

Related CCIs

The CCIs below are tied to SI-2(2).

CCI	Definition
CCI-004955	Determine if system components have applicable security-related software updates installed using organization-defined mechanisms on an organization-defined frequency.
CCI-004956	Determine if system components have applicable security-related firmware updates installed using organization-defined mechanisms on an organization-defined frequency.
CCI-004957	Defines a frequency for installing security-relevant software updates using organization-defined automated mechanisms.
CCI-004958	Defines a frequency for installing security-relevant firmware updates using organization-defined automated mechanisms.
CCI-004959	Defines the automated mechanisms for determining if system components have applicable security-related software updates installed.
CCI-004960	Defines the automated mechanisms for determining if system components have applicable security-related firmware updates installed.