SI-8

Requirement
1. Employ spam protection mechanisms at system entry and exit points to detect and act on unsolicited messages; and
2. Update spam protection mechanisms when new releases are available in accordance with organizational configuration management policy and procedures.

Discussion

System entry and exit points include firewalls, remote-access servers, electronic mail servers, web servers, proxy servers, workstations, notebook computers, and mobile devices. Spam can be transported by different means, including email, email attachments, and web accesses. Spam protection mechanisms include signature definitions.

NIST 800-53A Assessment Guidance

Examine

[SELECT FROM: System and information integrity policy; system and information integrity procedures; configuration management policies and procedures (CM-01); procedures addressing spam protection; spam protection mechanisms; records of spam protection updates; system design documentation; system configuration settings and associated documentation; system audit records; system security plan; other relevant documents or records].

Interview

[SELECT FROM: Organizational personnel responsible for spam protection; organizational personnel with information security responsibilities; system/network administrators; system developer].

Test

[SELECT FROM: Organizational processes for implementing spam protection; mechanisms supporting and/or implementing spam protection].

ID	Assessment Objectives
SI-08b.	spam protection mechanisms are updated when new releases are available in accordance with organizational configuration management policies and procedures.
SI-08a.[01]	spam protection mechanisms are employed at system entry points to detect unsolicited messages;
SI-08a.[02]	spam protection mechanisms are employed at system exit points to detect unsolicited messages;
SI-08a.[03]	spam protection mechanisms are employed at system entry points to act on unsolicited messages;
SI-08a.[04]	spam protection mechanisms are employed at system exit points to act on unsolicited messages;

Our CMMC Overview Course simplifies CMMC. Enroll so you can make informed decisions!