SI-10(5)

Requirement

Restrict the use of information inputs to [Assignment: organization-defined trusted sources] and/or [Assignment: organization-defined formats].

Discussion

Restricting the use of inputs to trusted sources and in trusted formats applies the concept of authorized or permitted software to information inputs. Specifying known trusted sources for information inputs and acceptable formats for such inputs can reduce the probability of malicious activity. The information inputs are those defined by the organization in the base control (SI-10).

Title

Information Input Validation | Restrict Inputs to Trusted Sources and Approved Formats
Family

System and Information Integrity
NIST 800-53B Baseline(s)

NIST 800-53A Assessment Guidance

Examine

[SELECT FROM: System and information integrity policy; system and information integrity procedures; procedures addressing information input validation; system design documentation; system configuration settings and associated documentation; list of trusted sources for information inputs; list of acceptable formats for input restrictions; system audit records; system security plan; other relevant documents or records].

Interview

[SELECT FROM: Organizational personnel responsible for information input validation; organizational personnel with information security responsibilities; system/network administrators; system developer].

Test

[SELECT FROM: Organizational processes for restricting information inputs; automated mechanisms supporting and/or implementing restriction of information inputs].

ID	Assessment Objectives
SI-10(05)	the use of information inputs is restricted to <SI-10(05)_ODP[01] trusted sources> and/or <SI-10(05)_ODP[02] formats>.

Our CMMC Overview Course simplifies CMMC. Enroll so you can make informed decisions!