SI-16 Memory protection
Requires organization-defined controls to be implemented to protect system memory from unauthorized code execution, such as platform level execution protection and exploit mitigation features.
4
artefacts
2
held by a system
1
at each review
easy
to go live
Cloud console / configuration management
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
- Configuration evidence that the protections are enabled on in scope components · Cloud console / configuration management
- Verification output confirming mitigations are active at runtime · Document repository
periodic reviewEvidence produced at each review
- Exception records where a protection had to be disabled, with compensating controls · Document repository
governing documentDocuments that govern the control
- Documented memory protection controls selected for the system · Document repository
First move
Automate the pull from your Cloud console / configuration management. Configuration snapshots and change history from the cloud console or IaC repository, diffed against the baseline.
Common gaps auditors find
- Protections available in the platform but disabled for legacy application compatibility
- Controls verified at build and never re-checked after platform updates
- Server and appliance components excluded while workstations are protected
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetSI-15 Information Output Filtering. Validate information output from the following software programs and/or applications to ensure that the information is consistent with the expected content: [organization-defined] · SI-17 Fail-safe Procedures. Implement the indicated fail-safe procedures when the indicated failures occur: [organization-defined]