SI-8 Spam Protection. Employ spam protection mechanisms at system entry and exit points to detect and act on unsolicited messages; and Update spam protection mechanisms when new releases are available in accordance with organizational configuration
Spam Protection. Employ spam protection mechanisms at system entry and exit points to detect and act on unsolicited messages; and Update spam protection mechanisms when new releases are available in accordance with organ.
5
artefacts
2
held by a system
2
at each review
moderate
to go live
Cloud console / configuration management
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
- Configuration of the mechanisms, including the actions taken on detection such as quarantine, tag or reject · Cloud console / configuration management
- Update records showing signature and engine releases applied under the organisational configuration management process · Cloud console / configuration management
periodic reviewEvidence produced at each review
- Evidence protection is applied at exit as well as entry, which the control requires · Document repository
- Detection statistics and records of false positive handling · Document repository
governing documentDocuments that govern the control
- Identification of the system entry and exit points where spam protection mechanisms are deployed · Document repository
First move
Start with the 2 of 5 artefacts that already live in a system (Cloud console / configuration management); keep the periodic reviews but log each one as a dated record with a named reviewer.
Common gaps auditors find
- Inbound filtering deployed while outbound messaging passes unfiltered, missing compromised account abuse
- Updates applied automatically outside configuration management, so the deployed version is unknown
- No false positive handling route, so users bypass the mechanism with alternative channels
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetSI-7 Software, firmware, and information integrity · SI-10 Information input validation