SI-3 Malicious Code Protection

a. Implement Selection (one or more): signature-based; non-signature-based malicious code protection mechanisms at system entry and exit points to detect and eradicate malicious code; b. Automatically update malicious code protection mechanisms as new releases are available in accordance with organizational configuration management policy and procedures; c. Configure malicious code protection mechanisms to: 1. Perform periodic scans of the system organization-defined frequency and real-time scans of files from external sources at Selection (one or more): endpoint; network entry and exit points as the files are downloaded, opened, or executed in accordance with organizational policy; and 2. Selection (one or more): block malicious code; quarantine malicious code; take [organization-defined action]; and send alert to organization-defined personnel or roles in response to malicious code detection; and d. Address the receipt of false positives during malicious code detection and eradication and the resulting potential impact on the availability of the system.

Source: NIST SP 800-53 Rev 5, SI-3. The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open NIST SP 800-53 Rev 5 in the compliance library.

Base controls and their enhancements. Which apply follows the baseline you are assessed against (for example FedRAMP Moderate or High, or the low, moderate and high baselines of SP 800-53B). Text in square brackets is a parameter your organisation sets.