Navigate

SI-8

SI-8: Spam Protection

The organization:

a: Employs spam protection mechanisms at information system entry and exit points to detect and take action on unsolicited messages; and

b: Updates spam protection mechanisms when new releases are available in accordance with organizational configuration management policy and procedures.

Supplemental

Information system entry and exit points include, for example, firewalls, electronic mail servers, web servers, proxy servers, remote-access servers, workstations, mobile devices, and notebook/laptop computers. Spam can be transported by different means including, for example, electronic mail, electronic mail attachments, and web accesses. Spam protection mechanisms include, for example, signature definitions.

CIA Levels
Confidentiality	unknown
Integrity	high
Availability	high

Overlays
Privacy (PHI)

CSF Categories
DE.CM-4

Related Controls

The controls below (if any) were marked by NIST as being related to SI-8.

Control	Description
AT-2	The organization provides basic security awareness training to information system users (including managers, senior executives, and contractors): a: As part of initial training for new users; b: When required by information system changes; and c: [organization-defined frequency] thereafter.
AT-3	The organization provides role-based security training to personnel with assigned security roles and responsibilities: a: Before authorizing access to the information system or performing assigned duties; b: When required by information system changes; and c: [organization-defined frequency] thereafter.
SC-5	The information system protects against or limits the effects of the following types of denial of service attacks: [organization-defined types of denial of service attacks or references to sources for such information] by employing [organization-defined security safeguards].
SC-7	The information system: a: Monitors and controls communications at the external boundary of the system and at key internal boundaries within the system; b: Implements subnetworks for publicly accessible system components that are [] separated from internal organizational networks; and c: Connects to external networks or information systems only through managed interfaces consisting of boundary protection devices arranged in accordance with an organizational security architecture.
SI-3	The organization: a: Employs malicious code protection mechanisms at information system entry and exit points to detect and eradicate malicious code; b: Updates malicious code protection mechanisms whenever new releases are available in accordance with organizational configuration management policy and procedures; c: Configures malicious code protection mechanisms to: 1: Perform periodic scans of the information system [organization-defined frequency] and real-time scans of files from external sources at [one or more of endpoint/network entry/exit points] as the files are downloaded, opened, or executed in accordance with organizational security policy; and 2: [one or more of block malicious code/quarantine malicious code/send alert to administrator/ {{ insert: param, si-3_prm_4 }} ] in response to malicious code detection; and d: Addresses the receipt of false positives during malicious code detection and eradication and the resulting potential impact on the availability of the information system.

Enhancements

The controls below (if any) add on to the requirements of SI-8.

Control	Description
SI-8(1)	The organization centrally manages spam protection mechanisms.
SI-8(2)	The information system automatically updates spam protection mechanisms.
SI-8(3)	The information system implements spam protection mechanisms with a learning capability to more effectively identify legitimate communications traffic.

Related CCIs

The CCIs below are tied to SI-8.

CCI	Definition
CCI-001306	The organization updates spam protection mechanisms when new releases are available in accordance with organizational configuration management policy and procedures.
CCI-002741	Employ spam protection mechanisms at system entry points to detect and take action on unsolicited messages.
CCI-002742	Employ spam protection mechanisms at system exit points to detect and take action on unsolicited messages.