Malicious Code Protection

frameworkNIST SP 800-53 Rev 5.2 sectionSI System and Information Integrity csf 2.0DE.CM-09 PR.DS-01 PR.DS-02 PR.DS-10 PR.PS-05 topicsEndpoint Protection, Email Security frameworks4 6 0

Official texta. Implement [Selection (one or more): signature-based; non-signature-based] malicious code protection mechanisms at system entry and exit points to detect and eradicate malicious code;
b. Automatically update malicious code protection mechanisms as new releases are available in accordance with organizational configuration management policy and procedures;
c. Configure malicious code protection mechanisms to:
1. Perform periodic scans of the system [Assignment: organization-defined frequency] and real-time scans of files from external sources at [Selection (one or more): endpoint; network entry and exit points] as the files are downloaded, opened, or executed in accordance with organizational policy; and
2. [Selection (one or more): block malicious code; quarantine malicious code; take [Assignment: organization-defined action] ]; and send alert to [Assignment: organization-defined personnel or roles] in response to malicious code detection; and
d. Address the receipt of false positives during malicious code detection and eradication and the resulting potential impact on the availability of the system.NIST SP 800-53 Rev 5.2 control statement (public domain)

gap from 800-53 → gap to 800-53 →

Wrong or missing mapping? Report it

Equivalents of SI-3 in other frameworks
Framework	Requirement	Title	Link	Source / reason
NIST CSF 2.0	DE.CM-09 PR.DS-02 PR.PS-05	Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events; The confidentiality, integrity, and availability of data-in-transit are protected…	Crosswalk	Same topic: Endpoint Protection, Email Security 2 loosely related (not mappings) PR.DS-01 The confidentiality, integrity, and availability of data-at-rest are protected Loosely related Only shares CSF PR.DS-01: related, not a mapping PR.DS-10 The confidentiality, integrity, and availability of data-in-use are protected Loosely related Only shares CSF PR.DS-10: related, not a mapping
ISO 27001	A.5.14 A.8.1 A.8.7 A.8.19	Information transfer; User endpoint devices…	Crosswalk	Same topic: Email Security, Endpoint Protection 32 loosely related (not mappings) A.5.3 Segregation of duties Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping A.5.10 Acceptable use of information and other associated assets Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping A.5.13 Labelling of information Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping A.5.15 Access control Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping A.6.1 Screening Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping A.6.2 Terms and conditions of employment Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping A.6.5 Responsibilities after termination or change of employment Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping A.8.2 Privileged access rights Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping …and 24 more in the downloads
CIS v8.1	CIS 2.5 CIS 2.6 CIS 2.7 CIS 9.1 CIS 9.4 CIS 9.5 CIS 9.6 CIS 9.7 CIS 10.1 CIS 10.2 CIS 10.3 CIS 10.4 CIS 10.5 CIS 10.6 CIS 10.7	Allowlist Authorized Software; Allowlist Authorized Libraries…	Editorial	Same topic: Endpoint Protection, Email Security (editorial pick) 10 loosely related (not mappings) CIS 3.10 Encrypt Sensitive Data in Transit Loosely related Only shares CSF PR.DS-02: related, not a mapping CIS 3.11 Encrypt Sensitive Data at Rest Loosely related Only shares CSF PR.DS-01: related, not a mapping CIS 3.1 Establish and Maintain a Data Management Process Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping CIS 3.4 Enforce Data Retention Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping CIS 3.5 Securely Dispose of Data Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping CIS 3.12 Segment Data Processing and Storage Based on Sensitivity Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping CIS 3.13 Deploy a Data Loss Prevention Solution Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping CIS 3.6 Encrypt Data on End-User Devices Loosely related Only shares CSF PR.DS-01, PR.DS-02: related, not a mapping …and 2 more in the downloads
SOC 2	CC6.8	Preventing or detecting unauthorized or malicious software	Editorial	Same topic: Endpoint Protection, Email Security (editorial pick) 5 loosely related (not mappings) C1.2 Disposing of confidential information Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping CC6.5 Protection of data when assets are disposed of Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping CC6.7 Restricting transmission, movement and removal of information Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping CC6.1 Logical access security over information assets Loosely related Only shares CSF PR.DS-01, PR.DS-02: related, not a mapping CC7.2 Monitoring system components for anomalies Loosely related Only shares CSF DE.CM-09: related, not a mapping
PCI DSS	5.2.1 5.2.2 5.3.2 5.4.1	Anti-malware deployed on system components; Anti-malware detects, removes or contains known malware…	Editorial	Same topic: Endpoint Protection, Email Security (editorial pick) 27 loosely related (not mappings) 2.3.1 Wireless vendor defaults changed Loosely related Only shares CSF PR.DS-02: related, not a mapping 3.2.1 Account data storage minimised, with retention and disposal Loosely related Only shares CSF PR.DS-10: related, not a mapping 3.3.1 Sensitive authentication data not kept after authorisation Loosely related Only shares CSF PR.DS-01: related, not a mapping 3.4.1 PAN masked when displayed Loosely related Only shares CSF PR.DS-10: related, not a mapping 3.5.1 PAN rendered unreadable wherever stored Loosely related Only shares CSF PR.DS-01: related, not a mapping 3.5.1.3 Disk encryption access managed separately from OS access Loosely related Only shares CSF PR.DS-01: related, not a mapping 3.6.1 Procedures protect keys that secure stored account data Loosely related Only shares CSF PR.DS-01: related, not a mapping 3.6.1.1 Service providers document their cryptographic architecture Loosely related Only shares CSF PR.DS-01: related, not a mapping …and 19 more in the downloads
CMMC	SI.L2-3.14.2 SI.L2-3.14.4 SI.L2-3.14.1 SI.L2-3.14.3 SI.L2-3.14.5	Malicious Code Protection; Update Malicious Code Protection…	Crosswalk	Same topic: Endpoint Protection, Email Security NIST SP 800-171r2 Appendix D; NIST SP 800-171r3 03.14.02 → SP 800-53 29 loosely related (not mappings) SI.L2-3.14.6 Monitor Communications for Attacks Loosely related Only shares CSF DE.CM-09, PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping SI.L2-3.14.7 Identify Unauthorized Use Loosely related Only shares CSF DE.CM-09, PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping SC.L2-3.13.1 Boundary Protection Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping SC.L2-3.13.2 Security Engineering Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping SC.L2-3.13.4 Shared Resource Control Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping SC.L2-3.13.5 Public-Access System Separation Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping SC.L2-3.13.6 Network Communication by Exception Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping SC.L2-3.13.11 CUI Encryption Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping …and 21 more in the downloads
HIPAA	§164.308(a)(5)(ii)(B)	Protection from Malicious Software	Editorial	Same topic: Endpoint Protection (editorial pick) 26 loosely related (not mappings) §164.308(a)(1)(ii)(D) Information System Activity Review Loosely related Only shares CSF DE.CM-09, PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping §164.312(c) Integrity Loosely related Only shares CSF DE.CM-09, PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping §164.312(c)(2) Mechanism to Authenticate Electronic Protected Health Information Loosely related Only shares CSF DE.CM-09, PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping §164.312(e)(2)(i) Integrity Controls Loosely related Only shares CSF DE.CM-09, PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping §164.308(a)(4)(ii)(A) Isolating Health care Clearinghouse Function Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping §164.308(b)(1) Business Associate Contracts and Other Arrangements Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping §164.308(b)(4) Written Contract or Other Arrangement Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping §164.312(a)(2)(iv) Encryption and Decryption Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping …and 18 more in the downloads
GDPR	Art.5(1)(e)Art.5(1)(f)Art.32(1)(b)Art.32(1)(a)	Principles relating to processing of personal data; Principles relating to processing of personal data…	Loosely related	No mapping. Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping +1 more loosely related (not mappings) Art.34(3)(a) Communication of a personal data breach to the data subject Loosely related Only shares CSF PR.DS-01, PR.DS-02: related, not a mapping
NIS2	6.9	Protection against malicious and unauthorised software	Crosswalk	Same topic: Endpoint Protection, Email Security 4 loosely related (not mappings) 9.1 Cryptography Loosely related Only shares CSF PR.DS-01, PR.DS-02: related, not a mapping 12.3 Removable media policy Loosely related Only shares CSF PR.DS-01: related, not a mapping 6.6 Security patch management Loosely related Only shares CSF DE.CM-09: related, not a mapping 6.7 Network security Loosely related Only shares CSF PR.PS-05: related, not a mapping
Essential Eight	ISM-0843 ISM-1488 ISM-1490 ISM-1544 ISM-1657 ISM-1870	Application control is implemented on workstations; Microsoft Office macros in files originating from the internet are blocked…	Editorial	Same topic: Endpoint Protection, Email Security (editorial pick) 20 loosely related (not mappings) ISM-0109 Event logs from workstations are analysed in a timely manner to detect cyber security… Loosely related Only shares CSF DE.CM-09: related, not a mapping ISM-1228 Cyber security events are analysed in a timely manner to identify cyber security incidents Loosely related Only shares CSF DE.CM-09: related, not a mapping ISM-1487 Only privileged human users responsible for checking that Microsoft Office macros are… Loosely related Only shares CSF PR.PS-05: related, not a mapping ISM-1489 Microsoft Office macro security settings cannot be changed by human users Loosely related Only shares CSF PR.PS-05: related, not a mapping ISM-1582 Application control rulesets are validated at least annually Loosely related Only shares CSF PR.PS-05: related, not a mapping ISM-1656 Application control is implemented on non-internet-facing servers Loosely related Only shares CSF PR.PS-05: related, not a mapping ISM-1658 Application control restricts the execution of drivers to an organisation-approved set Loosely related Only shares CSF PR.PS-05: related, not a mapping ISM-1659 Microsoft’s vulnerable driver blocklist is implemented Loosely related Only shares CSF PR.PS-05: related, not a mapping …and 12 more in the downloads
DORA	Art.9(2)Art.9(3)(c)Art.9(3)(d)Art.9(3)(a)	Protection and prevention; Protection and prevention…	Loosely related	No mapping. Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping +4 more loosely related (not mappings) Art.9(4)(d) Protection and prevention Loosely related Only shares CSF PR.DS-01, PR.DS-02: related, not a mapping Art.9(1) Protection and prevention Loosely related Only shares CSF DE.CM-09: related, not a mapping Art.10(1) Detection Loosely related Only shares CSF DE.CM-09: related, not a mapping Art.10(3) Detection Loosely related Only shares CSF DE.CM-09: related, not a mapping
CPS 234	Para 21	Timely controls commensurate with risk and asset life-cycle	Loosely related	No mapping. Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping
Cyber Essentials	CE 5	Malware protection	Editorial	Same topic: Endpoint Protection (editorial pick)

Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · Loosely related only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.