SI-1 Policy and procedures
The system and information integrity policy and procedures: ownership, scope, review frequency and how this -1 control governs patching, malware protection, monitoring and integrity controls in the SI family.
SI System and information integrity
System and information integrity family: flaw remediation, malicious code protection, system monitoring, security alerts, integrity verification, input validation, error handling, information retention and PII quality and de-identification.
SI-2 Flaw remediation
Flaw remediation: finding, testing and installing patches within defined timeframes, automated flaw remediation status, and the root cause analysis enhancement added in Release 5.2.0.
SI-3 Malicious code protection
Malicious code protection: anti-malware at endpoints and network entry and exit points, update cadence, scan configuration, response actions and false positive handling. A FedRAMP annual assessment control.
SI-4 System monitoring
System monitoring: intrusion detection, monitoring objectives, sensor placement, event analysis and alerting. It has the most enhancements in the SI family and is mapped to many FedRAMP 20x Key Security Indicators.
SI-5 Security alerts, advisories, and directives
Security alerts, advisories and directives: subscribing to sources such as CISA, distributing alerts internally and acting on binding directives within required timeframes.
SI-6 Security and privacy function verification
Security and privacy function verification: automated self-tests that confirm security functions work, with alerting and defined responses to failures. High baseline under NIST, but required by FedRAMP at Classes C and D.
SI-7 Software, firmware, and information integrity
Software, firmware and information integrity: integrity checking, file integrity monitoring, code signing and boot verification, including the SI-7(12) enhancement revised in Release 5.2.0.
SI-8 Spam protection
Spam protection: filtering unsolicited email at entry and exit points and keeping filters updated, plus FedRAMP's DMARC expectation for providers that send email on behalf of the government.
SI-10 Information input validation
Information input validation: checking syntax and semantics of inputs to prevent injection and similar attacks, with enhancements for manual override, review of errors and predictable behavior. A FedRAMP annual assessment control at Classes C and D.
SI-11 Error handling
Error handling: error messages that help users and administrators without leaking stack traces, credentials or system details to attackers. In the moderate and high baselines.
SI-12 Information management and retention
Information management and retention: keeping and disposing of information according to legal and operational requirements, with enhancements to limit PII elements and minimize PII in testing.
SI-13 Predictable failure prevention
Predictable failure prevention: tracking mean time to failure and preparing standby components so failures are replaced before they cause outages. Not in any SP 800-53B baseline.
SI-14 Non-persistence
Non-persistence: rebuilding components from a known state on a schedule or per session, for example by reimaging or using virtualization, so attackers cannot persist. Not in any baseline.
SI-15 Information output filtering
Information output filtering: checking application output for unexpected content that could indicate compromise or data leakage. Not in any SP 800-53B baseline.
SI-16 Memory protection
Memory protection: data execution prevention, address space layout randomization and similar protections against code execution in memory. In the moderate and high baselines.
SI-17 Fail-safe procedures
Fail-safe procedures: predefined responses to failure conditions, such as alerting operators or shutting down safely, distinct from SC-24's known-state failure. Not in any SP 800-53B baseline.
SI-18 Personally identifiable information quality operations
PII quality operations: checking and correcting the accuracy, relevance, timeliness and completeness of personal data. Assigned only to the SP 800-53B privacy baseline.
SI-19 De-identification
De-identification: removing identifiers from datasets and testing that the result cannot be re-identified, with enhancements for statistical disclosure control and differential privacy. Privacy baseline only.
SI-20 Tainting
Tainting: embedding markers or capabilities in data so exfiltration or improper removal can be detected. Not in any SP 800-53B baseline.
SI-21 Information refresh
Information refresh: regenerating or deleting information on a schedule to limit how long stale or compromised information can be exploited. Not in any SP 800-53B baseline.
SI-22 Information diversity
Information diversity: alternative information sources that essential functions can switch to when the primary source is corrupted or unavailable. Not in any SP 800-53B baseline.
SI-23 Information fragmentation
Information fragmentation: splitting sensitive information across systems so compromise of one component does not expose it all. Not in any SP 800-53B baseline.
