Malicious Code Protection

frameworkCMMC Level 2 sectionSI System and Information Integrity csf 2.0DE.CM-09 PR.DS-01 PR.DS-02 PR.DS-10 PR.PS-05 topicsEndpoint Protection, Email Security frameworks4 6 0

Official textProvide protection from malicious code at designated locations within organizational systems.NIST SP 800-171 Rev 2 requirement, the basis of the CMMC Level 2 practice (public domain)

gap from CMMC → gap to CMMC →

Wrong or missing mapping? Report it

Equivalents of SI.L2-3.14.2 in other frameworks
Framework	Requirement	Title	Link	Source / reason
NIST CSF 2.0	DE.CM-09 PR.DS-02 PR.PS-05	Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events; The confidentiality, integrity, and availability of data-in-transit are protected…	Crosswalk	Same topic: Endpoint Protection, Email Security 2 loosely related (not mappings) PR.DS-01 The confidentiality, integrity, and availability of data-at-rest are protected Loosely related Only shares CSF PR.DS-01: related, not a mapping PR.DS-10 The confidentiality, integrity, and availability of data-in-use are protected Loosely related Only shares CSF PR.DS-10: related, not a mapping
ISO 27001	A.5.14 A.8.1 A.8.7 A.8.19	Information transfer; User endpoint devices…	Crosswalk	Same topic: Email Security, Endpoint Protection 32 loosely related (not mappings) A.5.3 Segregation of duties Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping A.5.10 Acceptable use of information and other associated assets Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping A.5.13 Labelling of information Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping A.5.15 Access control Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping A.6.1 Screening Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping A.6.2 Terms and conditions of employment Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping A.6.5 Responsibilities after termination or change of employment Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping A.8.2 Privileged access rights Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping …and 24 more in the downloads
CIS v8.1	CIS 2.5 CIS 2.6 CIS 2.7 CIS 9.1 CIS 9.4 CIS 9.5 CIS 9.6 CIS 9.7 CIS 10.1 CIS 10.2 CIS 10.3 CIS 10.4 CIS 10.5 CIS 10.6 CIS 10.7	Allowlist Authorized Software; Allowlist Authorized Libraries…	Editorial	Same topic: Endpoint Protection, Email Security (editorial pick) 10 loosely related (not mappings) CIS 3.10 Encrypt Sensitive Data in Transit Loosely related Only shares CSF PR.DS-02: related, not a mapping CIS 3.11 Encrypt Sensitive Data at Rest Loosely related Only shares CSF PR.DS-01: related, not a mapping CIS 3.1 Establish and Maintain a Data Management Process Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping CIS 3.4 Enforce Data Retention Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping CIS 3.5 Securely Dispose of Data Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping CIS 3.12 Segment Data Processing and Storage Based on Sensitivity Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping CIS 3.13 Deploy a Data Loss Prevention Solution Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping CIS 3.6 Encrypt Data on End-User Devices Loosely related Only shares CSF PR.DS-01, PR.DS-02: related, not a mapping …and 2 more in the downloads
SOC 2	CC6.8	Preventing or detecting unauthorized or malicious software	Editorial	Same topic: Endpoint Protection, Email Security (editorial pick) 5 loosely related (not mappings) C1.2 Disposing of confidential information Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping CC6.5 Protection of data when assets are disposed of Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping CC6.7 Restricting transmission, movement and removal of information Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping CC6.1 Logical access security over information assets Loosely related Only shares CSF PR.DS-01, PR.DS-02: related, not a mapping CC7.2 Monitoring system components for anomalies Loosely related Only shares CSF DE.CM-09: related, not a mapping
PCI DSS	5.2.1 5.2.2 5.3.2 5.4.1	Anti-malware deployed on system components; Anti-malware detects, removes or contains known malware…	Editorial	Same topic: Endpoint Protection, Email Security (editorial pick) 27 loosely related (not mappings) 2.3.1 Wireless vendor defaults changed Loosely related Only shares CSF PR.DS-02: related, not a mapping 3.2.1 Account data storage minimised, with retention and disposal Loosely related Only shares CSF PR.DS-10: related, not a mapping 3.3.1 Sensitive authentication data not kept after authorisation Loosely related Only shares CSF PR.DS-01: related, not a mapping 3.4.1 PAN masked when displayed Loosely related Only shares CSF PR.DS-10: related, not a mapping 3.5.1 PAN rendered unreadable wherever stored Loosely related Only shares CSF PR.DS-01: related, not a mapping 3.5.1.3 Disk encryption access managed separately from OS access Loosely related Only shares CSF PR.DS-01: related, not a mapping 3.6.1 Procedures protect keys that secure stored account data Loosely related Only shares CSF PR.DS-01: related, not a mapping 3.6.1.1 Service providers document their cryptographic architecture Loosely related Only shares CSF PR.DS-01: related, not a mapping …and 19 more in the downloads
800-53	SI-3 CM-7(5)SI-4 SI-8 SI-2 SI-5	Malicious Code Protection; Authorized Software — Allow-by-exception…	Crosswalk	Same topic: Endpoint Protection, Email Security NIST SP 800-171r2 Appendix D 37 loosely related (not mappings) SI-7 Software, Firmware, and Information Integrity Loosely related Only shares CSF DE.CM-09, PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping CA-3 Information Exchange Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping SC-4 Information in Shared System Resources Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping SC-7 Boundary Protection Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping SC-13 Cryptographic Protection Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping SC-43 Usage Restrictions Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping AC-4 Information Flow Enforcement Loosely related Only shares CSF DE.CM-09, PR.DS-10: related, not a mapping CP-9 System Backup Loosely related Only shares CSF PR.DS-01, PR.DS-10: related, not a mapping …and 29 more in the downloads
HIPAA	§164.308(a)(5)(ii)(B)	Protection from Malicious Software	Editorial	Same topic: Endpoint Protection (editorial pick) 26 loosely related (not mappings) §164.308(a)(1)(ii)(D) Information System Activity Review Loosely related Only shares CSF DE.CM-09, PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping §164.312(c) Integrity Loosely related Only shares CSF DE.CM-09, PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping §164.312(c)(2) Mechanism to Authenticate Electronic Protected Health Information Loosely related Only shares CSF DE.CM-09, PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping §164.312(e)(2)(i) Integrity Controls Loosely related Only shares CSF DE.CM-09, PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping §164.308(a)(4)(ii)(A) Isolating Health care Clearinghouse Function Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping §164.308(b)(1) Business Associate Contracts and Other Arrangements Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping §164.308(b)(4) Written Contract or Other Arrangement Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping §164.312(a)(2)(iv) Encryption and Decryption Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping …and 18 more in the downloads
GDPR	Art.5(1)(e)Art.5(1)(f)Art.32(1)(b)Art.32(1)(a)	Principles relating to processing of personal data; Principles relating to processing of personal data…	Loosely related	No mapping. Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping +1 more loosely related (not mappings) Art.34(3)(a) Communication of a personal data breach to the data subject Loosely related Only shares CSF PR.DS-01, PR.DS-02: related, not a mapping
NIS2	6.9	Protection against malicious and unauthorised software	Crosswalk	Same topic: Endpoint Protection, Email Security 4 loosely related (not mappings) 9.1 Cryptography Loosely related Only shares CSF PR.DS-01, PR.DS-02: related, not a mapping 12.3 Removable media policy Loosely related Only shares CSF PR.DS-01: related, not a mapping 6.6 Security patch management Loosely related Only shares CSF DE.CM-09: related, not a mapping 6.7 Network security Loosely related Only shares CSF PR.PS-05: related, not a mapping
Essential Eight	ISM-0843 ISM-1488 ISM-1490 ISM-1544 ISM-1657 ISM-1870	Application control is implemented on workstations; Microsoft Office macros in files originating from the internet are blocked…	Editorial	Same topic: Endpoint Protection, Email Security (editorial pick) 20 loosely related (not mappings) ISM-0109 Event logs from workstations are analysed in a timely manner to detect cyber security… Loosely related Only shares CSF DE.CM-09: related, not a mapping ISM-1228 Cyber security events are analysed in a timely manner to identify cyber security incidents Loosely related Only shares CSF DE.CM-09: related, not a mapping ISM-1487 Only privileged human users responsible for checking that Microsoft Office macros are… Loosely related Only shares CSF PR.PS-05: related, not a mapping ISM-1489 Microsoft Office macro security settings cannot be changed by human users Loosely related Only shares CSF PR.PS-05: related, not a mapping ISM-1582 Application control rulesets are validated at least annually Loosely related Only shares CSF PR.PS-05: related, not a mapping ISM-1656 Application control is implemented on non-internet-facing servers Loosely related Only shares CSF PR.PS-05: related, not a mapping ISM-1658 Application control restricts the execution of drivers to an organisation-approved set Loosely related Only shares CSF PR.PS-05: related, not a mapping ISM-1659 Microsoft’s vulnerable driver blocklist is implemented Loosely related Only shares CSF PR.PS-05: related, not a mapping …and 12 more in the downloads
DORA	Art.9(2)Art.9(3)(c)Art.9(3)(d)Art.9(3)(a)	Protection and prevention; Protection and prevention…	Loosely related	No mapping. Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping +4 more loosely related (not mappings) Art.9(4)(d) Protection and prevention Loosely related Only shares CSF PR.DS-01, PR.DS-02: related, not a mapping Art.9(1) Protection and prevention Loosely related Only shares CSF DE.CM-09: related, not a mapping Art.10(1) Detection Loosely related Only shares CSF DE.CM-09: related, not a mapping Art.10(3) Detection Loosely related Only shares CSF DE.CM-09: related, not a mapping
CPS 234	Para 21	Timely controls commensurate with risk and asset life-cycle	Loosely related	No mapping. Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping
Cyber Essentials	CE 5	Malware protection	Editorial	Same topic: Endpoint Protection (editorial pick)

Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · Loosely related only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.