System and Information Integrity (SI)¶
This page contains all 102 controls and control enhancements in the System and Information Integrity (SI) family from the vendored NIST SP 800-53 Revision 5 OSCAL catalog.
Official NIST OSCAL source
- Catalog version: 5.2.0
- OSCAL version: 1.2.2
- Catalog last modified: May 11, 2026
SI-01 (Policy and Procedures)¶
- a. Develop, document, and disseminate to [Assignment: organization-defined personnel or roles]:
- 1. [Selection: one or more of: organization-level; mission/business process-level; system-level] system and information integrity policy that:
- (a) Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and
- (b) Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and
- 2. Procedures to facilitate the implementation of the system and information integrity policy and the associated system and information integrity controls;
- 1. [Selection: one or more of: organization-level; mission/business process-level; system-level] system and information integrity policy that:
- b. Designate an [Assignment: organization-defined official] to manage the development, documentation, and dissemination of the system and information integrity policy and procedures; and
- c. Review and update the current system and information integrity:
- 1. Policy [Assignment: organization-defined frequency] and following [Assignment: organization-defined events]; and
- 2. Procedures [Assignment: organization-defined frequency] and following [Assignment: organization-defined events].
This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values.
External Link for Additional Information: myctrl.tools
SI-02 (Flaw Remediation)¶
- a. Identify, report, and correct system flaws;
- b. Test software and firmware updates related to flaw remediation for effectiveness and potential side effects before installation;
- c. Install security-relevant software and firmware updates within [Assignment: organization-defined time period] of the release of the updates; and
- d. Incorporate flaw remediation into the organizational configuration management process.
FedRAMP Guidance
Follow the FedRAMP Vulnerability Detection and Response and Vulnerability Evaluation and Reporting rules.
External Link for Additional Information: myctrl.tools
SI-02 (02) (Automated Flaw Remediation Status)¶
Determine if system components have applicable security-relevant software and firmware updates installed using [Assignment: organization-defined automated mechanisms] [Assignment: organization-defined frequency].
FedRAMP Guidance
Follow the FedRAMP Vulnerability Detection and Response and Vulnerability Evaluation and Reporting rules.
External Link for Additional Information: myctrl.tools
SI-02 (03) (Time to Remediate Flaws and Benchmarks for Corrective Actions)¶
- (a) Measure the time between flaw identification and flaw remediation; and
- (b) Establish the following benchmarks for taking corrective actions: [Assignment: organization-defined benchmarks].
This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values.
External Link for Additional Information: myctrl.tools
SI-02 (04) (Automated Patch Management Tools)¶
Employ automated patch management tools to facilitate flaw remediation to the following system components: [Assignment: organization-defined components].
This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values.
External Link for Additional Information: myctrl.tools
SI-02 (05) (Automatic Software and Firmware Updates)¶
Install [Assignment: organization-defined security-relevant software and firmware updates] automatically to [Assignment: organization-defined system components].
This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values.
External Link for Additional Information: myctrl.tools
SI-02 (06) (Removal of Previous Versions of Software and Firmware)¶
Remove previous versions of [Assignment: organization-defined software and firmware components] after updated versions have been installed.
This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values.
External Link for Additional Information: myctrl.tools
SI-02 (07) (Root Cause Analysis)¶
- a. Conduct root cause analysis to identify underlying causes of issues or failures.
- b. Develop actions to address the root cause of the issue or failure.
- c. Implement the actions and monitor the implementation for effectiveness.
This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values.
External Link for Additional Information: myctrl.tools
SI-03 (Malicious Code Protection)¶
- a. Implement [Selection: one or more of: signature-based; non-signature-based] malicious code protection mechanisms at system entry and exit points to detect and eradicate malicious code;
- b. Automatically update malicious code protection mechanisms as new releases are available in accordance with organizational configuration management policy and procedures;
- c. Configure malicious code protection mechanisms to:
- 1. Perform periodic scans of the system [Assignment: organization-defined frequency] and real-time scans of files from external sources at [Selection: one or more of: endpoint; network entry and exit points] as the files are downloaded, opened, or executed in accordance with organizational policy; and
- 2. [Selection: one or more of: block malicious code; quarantine malicious code; take]; and send alert to [Assignment: organization-defined personnel or roles] in response to malicious code detection; and
- d. Address the receipt of false positives during malicious code detection and eradication and the resulting potential impact on the availability of the system.
This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values.
External Link for Additional Information: myctrl.tools
SI-03 (04) (Updates Only by Privileged Users)¶
Update malicious code protection mechanisms only when directed by a privileged user.
This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values.
External Link for Additional Information: myctrl.tools
SI-03 (06) (Testing and Verification)¶
- (a) Test malicious code protection mechanisms [Assignment: organization-defined frequency] by introducing known benign code into the system; and
- (b) Verify that the detection of the code and the associated incident reporting occur.
This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values.
External Link for Additional Information: myctrl.tools
SI-03 (08) (Detect Unauthorized Commands)¶
- (a) Detect the following unauthorized operating system commands through the kernel application programming interface on [Assignment: organization-defined system hardware components]: [Assignment: organization-defined unauthorized operating system commands]; and
- (b) [Selection: one or more of: issue a warning; audit the command execution; prevent the execution of the command].
This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values.
External Link for Additional Information: myctrl.tools
SI-03 (10) (Malicious Code Analysis)¶
- (a) Employ the following tools and techniques to analyze the characteristics and behavior of malicious code: [Assignment: organization-defined tools and techniques]; and
- (b) Incorporate the results from malicious code analysis into organizational incident response and flaw remediation processes.
This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values.
External Link for Additional Information: myctrl.tools
SI-04 (System Monitoring)¶
- a. Monitor the system to detect:
- 1. Attacks and indicators of potential attacks in accordance with the following monitoring objectives: [Assignment: organization-defined monitoring objectives]; and
- 2. Unauthorized local, network, and remote connections;
- b. Identify unauthorized use of the system through the following techniques and methods: [Assignment: organization-defined techniques and methods];
- c. Invoke internal monitoring capabilities or deploy monitoring devices:
- 1. Strategically within the system to collect organization-determined essential information; and
- 2. At ad hoc locations within the system to track specific types of transactions of interest to the organization;
- d. Analyze detected events and anomalies;
- e. Adjust the level of system monitoring activity when there is a change in risk to organizational operations and assets, individuals, other organizations, or the Nation;
- f. Obtain legal opinion regarding system monitoring activities; and
- g. Provide [Assignment: organization-defined system monitoring information] to [Assignment: organization-defined personnel or roles] [Selection: one or more of: as needed].
FedRAMP Guidance
Follow all applicable rules within the Vulnerability and Detection Response and Incident Communication Procedure guidance.
External Link for Additional Information: myctrl.tools
SI-04 (01) (System-wide Intrusion Detection System)¶
Connect and configure individual intrusion detection tools into a system-wide intrusion detection system.
FedRAMP Guidance
Follow the FedRAMP Vulnerability Detection and Response and Vulnerability Evaluation and Reporting rules.
External Link for Additional Information: myctrl.tools
SI-04 (02) (Automated Tools and Mechanisms for Real-time Analysis)¶
Employ automated tools and mechanisms to support near real-time analysis of events.
FedRAMP Guidance
Follow the FedRAMP Vulnerability Detection and Response and Vulnerability Evaluation and Reporting rules.
External Link for Additional Information: myctrl.tools
SI-04 (03) (Automated Tool and Mechanism Integration)¶
Employ automated tools and mechanisms to integrate intrusion detection tools and mechanisms into access control and flow control mechanisms.
This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values.
External Link for Additional Information: myctrl.tools
SI-04 (04) (Inbound and Outbound Communications Traffic)¶
- (a) Determine criteria for unusual or unauthorized activities or conditions for inbound and outbound communications traffic;
- (b) Monitor inbound and outbound communications traffic [Assignment: organization-defined frequency] for [Assignment: organization-defined unusual or unauthorized activities or conditions].
FedRAMP Guidance
Follow the FedRAMP Vulnerability Detection and Response and Vulnerability Evaluation and Reporting rules.
External Link for Additional Information: myctrl.tools
SI-04 (05) (System-generated Alerts)¶
Alert [Assignment: organization-defined personnel or roles] when the following system-generated indications of compromise or potential compromise occur: [Assignment: organization-defined compromise indicators].
FedRAMP Guidance
Follow the FedRAMP Vulnerability Detection and Response and Vulnerability Evaluation and Reporting rules.
External Link for Additional Information: myctrl.tools
SI-04 (07) (Automated Response to Suspicious Events)¶
- (a) Notify [Assignment: organization-defined incident response personnel] of detected suspicious events; and
- (b) Take the following actions upon detection: [Assignment: organization-defined least-disruptive actions].
This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values.
External Link for Additional Information: myctrl.tools
SI-04 (09) (Testing of Monitoring Tools and Mechanisms)¶
Test intrusion-monitoring tools and mechanisms [Assignment: organization-defined frequency].
This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values.
External Link for Additional Information: myctrl.tools
SI-04 (10) (Visibility of Encrypted Communications)¶
Make provisions so that [Assignment: organization-defined encrypted communications traffic] is visible to [Assignment: organization-defined system monitoring tools and mechanisms].
This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values.
External Link for Additional Information: myctrl.tools
SI-04 (11) (Analyze Communications Traffic Anomalies)¶
Analyze outbound communications traffic at the external interfaces to the system and selected [Assignment: organization-defined interior points] to discover anomalies.
This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values.
External Link for Additional Information: myctrl.tools
SI-04 (12) (Automated Organization-generated Alerts)¶
Alert [Assignment: organization-defined personnel or roles] using [Assignment: organization-defined automated mechanisms] when the following indications of inappropriate or unusual activities with security or privacy implications occur: [Assignment: organization-defined activities that trigger alerts].
This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values.
External Link for Additional Information: myctrl.tools
SI-04 (13) (Analyze Traffic and Event Patterns)¶
- (a) Analyze communications traffic and event patterns for the system;
- (b) Develop profiles representing common traffic and event patterns; and
- (c) Use the traffic and event profiles in tuning system-monitoring devices.
This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values.
External Link for Additional Information: myctrl.tools
SI-04 (14) (Wireless Intrusion Detection)¶
Employ a wireless intrusion detection system to identify rogue wireless devices and to detect attack attempts and potential compromises or breaches to the system.
This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values.
External Link for Additional Information: myctrl.tools
SI-04 (15) (Wireless to Wireline Communications)¶
Employ an intrusion detection system to monitor wireless communications traffic as the traffic passes from wireless to wireline networks.
This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values.
External Link for Additional Information: myctrl.tools
SI-04 (16) (Correlate Monitoring Information)¶
Correlate information from monitoring tools and mechanisms employed throughout the system.
This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values.
External Link for Additional Information: myctrl.tools
SI-04 (17) (Integrated Situational Awareness)¶
Correlate information from monitoring physical, cyber, and supply chain activities to achieve integrated, organization-wide situational awareness.
This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values.
External Link for Additional Information: myctrl.tools
SI-04 (18) (Analyze Traffic and Covert Exfiltration)¶
Analyze outbound communications traffic at external interfaces to the system and at the following interior points to detect covert exfiltration of information: [Assignment: organization-defined interior points].
This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values.
External Link for Additional Information: myctrl.tools
SI-04 (19) (Risk for Individuals)¶
Implement [Assignment: organization-defined additional monitoring] of individuals who have been identified by [Assignment: organization-defined sources] as posing an increased level of risk.
This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values.
External Link for Additional Information: myctrl.tools
SI-04 (20) (Privileged Users)¶
Implement the following additional monitoring of privileged users: [Assignment: organization-defined additional monitoring].
This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values.
External Link for Additional Information: myctrl.tools
SI-04 (21) (Probationary Periods)¶
Implement the following additional monitoring of individuals during [Assignment: organization-defined probationary period]: [Assignment: organization-defined additional monitoring].
This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values.
External Link for Additional Information: myctrl.tools
SI-04 (22) (Unauthorized Network Services)¶
- (a) Detect network services that have not been authorized or approved by [Assignment: organization-defined authorization or approval processes]; and
- (b) [Selection: one or more of: audit; alert] when detected.
This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values.
External Link for Additional Information: myctrl.tools
SI-04 (23) (Host-based Devices)¶
Implement the following host-based monitoring mechanisms at [Assignment: organization-defined system components]: [Assignment: organization-defined host-based monitoring mechanisms].
This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values.
External Link for Additional Information: myctrl.tools
SI-04 (24) (Indicators of Compromise)¶
Discover, collect, and distribute to [Assignment: organization-defined personnel or roles], indicators of compromise provided by [Assignment: organization-defined sources].
This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values.
External Link for Additional Information: myctrl.tools
SI-04 (25) (Optimize Network Traffic Analysis)¶
Provide visibility into network traffic at external and key internal system interfaces to optimize the effectiveness of monitoring devices.
This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values.
External Link for Additional Information: myctrl.tools
SI-05 (Security Alerts, Advisories, and Directives)¶
- a. Receive system security alerts, advisories, and directives from [Assignment: organization-defined external organizations] on an ongoing basis;
- b. Generate internal security alerts, advisories, and directives as deemed necessary;
- c. Disseminate security alerts, advisories, and directives to: [Assignment: si-05_odp.02]; and
- d. Implement security directives in accordance with established time frames, or notify the issuing organization of the degree of noncompliance.
FedRAMP Guidance
Follow the FedRAMP Addressing FedRAMP Communication rules.
External Link for Additional Information: myctrl.tools
SI-05 (01) (Automated Alerts and Advisories)¶
Broadcast security alert and advisory information throughout the organization using [Assignment: organization-defined automated mechanisms].
This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values.
External Link for Additional Information: myctrl.tools
SI-06 (Security and Privacy Function Verification)¶
- a. Verify the correct operation of [Assignment: organization-defined security and privacy functions];
- b. Perform the verification of the functions specified in SI-6a [Selection: one or more of: upon command by user with appropriate privilege];
- c. Alert [Assignment: organization-defined personnel or roles] to failed security and privacy verification tests; and
- d. [Selection: one or more of: shut the system down; restart the system] when anomalies are discovered.
This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values.
External Link for Additional Information: myctrl.tools
SI-06 (02) (Automation Support for Distributed Testing)¶
Implement automated mechanisms to support the management of distributed security and privacy function testing.
This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values.
External Link for Additional Information: myctrl.tools
SI-06 (03) (Report Verification Results)¶
Report the results of security and privacy function verification to [Assignment: organization-defined personnel or roles].
This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values.
External Link for Additional Information: myctrl.tools
SI-07 (Software, Firmware, and Information Integrity)¶
- a. Employ integrity verification tools to detect unauthorized changes to the following software, firmware, and information: [Assignment: organization-defined software, firmware, and information]; and
- b. Take the following actions when unauthorized changes to the software, firmware, and information are detected: [Assignment: organization-defined actions].
This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values.
External Link for Additional Information: myctrl.tools
SI-07 (01) (Integrity Checks)¶
Perform an integrity check of [Assignment: organization-defined software, firmware, and information] [Selection: one or more of: at startup; at].
This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values.
External Link for Additional Information: myctrl.tools
SI-07 (02) (Automated Notifications of Integrity Violations)¶
Employ automated tools that provide notification to [Assignment: organization-defined personnel or roles] upon discovering discrepancies during integrity verification.
This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values.
External Link for Additional Information: myctrl.tools
SI-07 (03) (Centrally Managed Integrity Tools)¶
Employ centrally managed integrity verification tools.
This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values.
External Link for Additional Information: myctrl.tools
SI-07 (05) (Automated Response to Integrity Violations)¶
Automatically [Selection: one or more of: shut down the system; restart the system; implement] when integrity violations are discovered.
This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values.
External Link for Additional Information: myctrl.tools
SI-07 (06) (Cryptographic Protection)¶
Implement cryptographic mechanisms to detect unauthorized changes to software, firmware, and information.
This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values.
External Link for Additional Information: myctrl.tools
SI-07 (07) (Integration of Detection and Response)¶
Incorporate the detection of the following unauthorized changes into the organizational incident response capability: [Assignment: organization-defined changes].
This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values.
External Link for Additional Information: myctrl.tools
SI-07 (08) (Auditing Capability for Significant Events)¶
Upon detection of a potential integrity violation, provide the capability to audit the event and initiate the following actions: [Selection: one or more of: generate an audit record; alert current user; alert].
This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values.
External Link for Additional Information: myctrl.tools
SI-07 (09) (Verify Boot Process)¶
Verify the integrity of the boot process of the following system components: [Assignment: organization-defined system components].
This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values.
External Link for Additional Information: myctrl.tools
SI-07 (10) (Protection of Boot Firmware)¶
Implement the following mechanisms to protect the integrity of boot firmware in [Assignment: organization-defined system components]: [Assignment: organization-defined mechanisms].
This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values.
External Link for Additional Information: myctrl.tools
SI-07 (12) (Integrity Verification)¶
Require that the integrity of the following user-installed software be verified prior to execution: [Assignment: organization-defined user-installed software].
This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values.
External Link for Additional Information: myctrl.tools
SI-07 (15) (Code Authentication)¶
Implement cryptographic mechanisms to authenticate the following software or firmware components prior to installation: [Assignment: organization-defined software or firmware components].
This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values.
External Link for Additional Information: myctrl.tools
SI-07 (16) (Time Limit on Process Execution Without Supervision)¶
Prohibit processes from executing without supervision for more than [Assignment: organization-defined time period].
This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values.
External Link for Additional Information: myctrl.tools
SI-07 (17) (Runtime Application Self-protection)¶
Implement [Assignment: organization-defined controls] for application self-protection at runtime.
This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values.
External Link for Additional Information: myctrl.tools
SI-08 (Spam Protection)¶
- a. Employ spam protection mechanisms at system entry and exit points to detect and act on unsolicited messages; and
- b. Update spam protection mechanisms when new releases are available in accordance with organizational configuration management policy and procedures.
FedRAMP Guidance
When CSO sends email on behalf of the government as part of the business offering, Control Description should include implementation of Domain-based Message Authentication, Reporting & Conformance (DMARC) on the sending domain for outgoing messages as described in DHS Binding Operational Directive (BOD) 18-01. https://www.cisa.gov/news-events/directives
SI-8 Guidance: CSPs should confirm DMARC configuration (where appropriate) to ensure that policy=reject and the rua parameter includes reports@dmarc.cyber.dhs.gov. DMARC compliance should be documented in the SI-08 control implementation solution description, and list the FROM: domain(s) when emails are sent on behalf of the government.
External Link for Additional Information: myctrl.tools
SI-08 (02) (Automatic Updates)¶
Automatically update spam protection mechanisms [Assignment: organization-defined frequency].
This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values.
External Link for Additional Information: myctrl.tools
SI-08 (03) (Continuous Learning Capability)¶
Implement spam protection mechanisms with a learning capability to more effectively identify legitimate communications traffic.
This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values.
External Link for Additional Information: myctrl.tools
SI-10 (Information Input Validation)¶
Check the validity of the following information inputs: [Assignment: organization-defined information inputs].
This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values.
External Link for Additional Information: myctrl.tools
SI-10 (01) (Manual Override Capability)¶
- (a) Provide a manual override capability for input validation of the following information inputs: [Assignment: organization-defined information inputs];
- (b) Restrict the use of the manual override capability to only [Assignment: organization-defined authorized individuals]; and
- (c) Audit the use of the manual override capability.
This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values.
External Link for Additional Information: myctrl.tools
SI-10 (02) (Review and Resolve Errors)¶
Review and resolve input validation errors within [Assignment: organization-defined time period].
This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values.
External Link for Additional Information: myctrl.tools
SI-10 (03) (Predictable Behavior)¶
Verify that the system behaves in a predictable and documented manner when invalid inputs are received.
This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values.
External Link for Additional Information: myctrl.tools
SI-10 (04) (Timing Interactions)¶
Account for timing interactions among system components in determining appropriate responses for invalid inputs.
This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values.
External Link for Additional Information: myctrl.tools
SI-10 (05) (Restrict Inputs to Trusted Sources and Approved Formats)¶
Restrict the use of information inputs to [Assignment: organization-defined trusted sources] and/or [Assignment: organization-defined formats].
This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values.
External Link for Additional Information: myctrl.tools
SI-10 (06) (Injection Prevention)¶
Prevent untrusted data injections.
This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values.
External Link for Additional Information: myctrl.tools
SI-11 (Error Handling)¶
- a. Generate error messages that provide information necessary for corrective actions without revealing information that could be exploited; and
- b. Reveal error messages only to [Assignment: organization-defined personnel or roles].
This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values.
External Link for Additional Information: myctrl.tools
SI-12 (Information Management and Retention)¶
Manage and retain information within the system and information output from the system in accordance with applicable laws, executive orders, directives, regulations, policies, standards, guidelines and operational requirements.
This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values.
External Link for Additional Information: myctrl.tools
SI-12 (01) (Limit Personally Identifiable Information Elements)¶
Limit personally identifiable information being processed in the information life cycle to the following elements of personally identifiable information: [Assignment: organization-defined elements of personally identifiable information].
This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values.
External Link for Additional Information: myctrl.tools
SI-12 (02) (Minimize Personally Identifiable Information in Testing, Training, and Research)¶
Use the following techniques to minimize the use of personally identifiable information for research, testing, or training: [Assignment: organization-defined techniques].
This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values.
External Link for Additional Information: myctrl.tools
SI-12 (03) (Information Disposal)¶
Use the following techniques to dispose of, destroy, or erase information following the retention period: [Assignment: organization-defined techniques].
This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values.
External Link for Additional Information: myctrl.tools
SI-13 (Predictable Failure Prevention)¶
- a. Determine mean time to failure (MTTF) for the following system components in specific environments of operation: [Assignment: organization-defined system components]; and
- b. Provide substitute system components and a means to exchange active and standby components in accordance with the following criteria: [Assignment: organization-defined mean time to failure (MTTF) substitution criteria].
This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values.
External Link for Additional Information: myctrl.tools
SI-13 (01) (Transferring Component Responsibilities)¶
Take system components out of service by transferring component responsibilities to substitute components no later than [Assignment: organization-defined fraction or percentage] of mean time to failure.
This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values.
External Link for Additional Information: myctrl.tools
SI-13 (03) (Manual Transfer Between Components)¶
Manually initiate transfers between active and standby system components when the use of the active component reaches [Assignment: organization-defined percentage] of the mean time to failure.
This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values.
External Link for Additional Information: myctrl.tools
SI-13 (04) (Standby Component Installation and Notification)¶
If system component failures are detected:
- (a) Ensure that the standby components are successfully and transparently installed within [Assignment: organization-defined time period]; and
- (b) [Selection: one or more of: activate; automatically shut down the system].
This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values.
External Link for Additional Information: myctrl.tools
SI-13 (05) (Failover Capability)¶
Provide [Selection: one of: real-time; near real-time] [Assignment: organization-defined failover capability] for the system.
This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values.
External Link for Additional Information: myctrl.tools
SI-14 (Non-persistence)¶
Implement non-persistent [Assignment: organization-defined system components and services] that are initiated in a known state and terminated [Selection: one or more of: upon end of session of use].
This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values.
External Link for Additional Information: myctrl.tools
SI-14 (01) (Refresh from Trusted Sources)¶
Obtain software and data employed during system component and service refreshes from the following trusted sources: [Assignment: organization-defined trusted sources].
This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values.
External Link for Additional Information: myctrl.tools
SI-14 (02) (Non-persistent Information)¶
- (a) [Selection: one of: refresh; generate on demand]; and
- (b) Delete information when no longer needed.
This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values.
External Link for Additional Information: myctrl.tools
SI-14 (03) (Non-persistent Connectivity)¶
Establish connections to the system on demand and terminate connections after [Selection: one of: completion of a request; a period of non-use].
This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values.
External Link for Additional Information: myctrl.tools
SI-15 (Information Output Filtering)¶
Validate information output from the following software programs and/or applications to ensure that the information is consistent with the expected content: [Assignment: organization-defined software programs and/or applications].
This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values.
External Link for Additional Information: myctrl.tools
SI-16 (Memory Protection)¶
Implement the following controls to protect the system memory from unauthorized code execution: [Assignment: organization-defined controls].
This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values.
External Link for Additional Information: myctrl.tools
SI-17 (Fail-safe Procedures)¶
Implement the indicated fail-safe procedures when the indicated failures occur: [Assignment: organization-defined list of failure conditions and associated fail-safe procedures].
This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values.
External Link for Additional Information: myctrl.tools
SI-18 (Personally Identifiable Information Quality Operations)¶
- a. Check the accuracy, relevance, timeliness, and completeness of personally identifiable information across the information life cycle [Assignment: organization-defined frequency]; and
- b. Correct or delete inaccurate or outdated personally identifiable information.
This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values.
External Link for Additional Information: myctrl.tools
SI-18 (01) (Automation Support)¶
Correct or delete personally identifiable information that is inaccurate or outdated, incorrectly determined regarding impact, or incorrectly de-identified using [Assignment: organization-defined automated mechanisms].
This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values.
External Link for Additional Information: myctrl.tools
SI-18 (02) (Data Tags)¶
Employ data tags to automate the correction or deletion of personally identifiable information across the information life cycle within organizational systems.
This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values.
External Link for Additional Information: myctrl.tools
SI-18 (03) (Collection)¶
Collect personally identifiable information directly from the individual.
This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values.
External Link for Additional Information: myctrl.tools
SI-18 (04) (Individual Requests)¶
Correct or delete personally identifiable information upon request by individuals or their designated representatives.
This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values.
External Link for Additional Information: myctrl.tools
SI-18 (05) (Notice of Correction or Deletion)¶
Notify [Assignment: organization-defined recipients] and individuals that the personally identifiable information has been corrected or deleted.
This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values.
External Link for Additional Information: myctrl.tools
SI-19 (De-identification)¶
- a. Remove the following elements of personally identifiable information from datasets: [Assignment: organization-defined elements]; and
- b. Evaluate [Assignment: organization-defined frequency] for effectiveness of de-identification.
This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values.
External Link for Additional Information: myctrl.tools
SI-19 (01) (Collection)¶
De-identify the dataset upon collection by not collecting personally identifiable information.
This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values.
External Link for Additional Information: myctrl.tools
SI-19 (02) (Archiving)¶
Prohibit archiving of personally identifiable information elements if those elements in a dataset will not be needed after the dataset is archived.
This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values.
External Link for Additional Information: myctrl.tools
SI-19 (03) (Release)¶
Remove personally identifiable information elements from a dataset prior to its release if those elements in the dataset do not need to be part of the data release.
This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values.
External Link for Additional Information: myctrl.tools
SI-19 (04) (Removal, Masking, Encryption, Hashing, or Replacement of Direct Identifiers)¶
Remove, mask, encrypt, hash, or replace direct identifiers in a dataset.
This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values.
External Link for Additional Information: myctrl.tools
SI-19 (05) (Statistical Disclosure Control)¶
Manipulate numerical data, contingency tables, and statistical findings so that no individual or organization is identifiable in the results of the analysis.
This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values.
External Link for Additional Information: myctrl.tools
SI-19 (06) (Differential Privacy)¶
Prevent disclosure of personally identifiable information by adding non-deterministic noise to the results of mathematical operations before the results are reported.
This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values.
External Link for Additional Information: myctrl.tools
SI-19 (07) (Validated Algorithms and Software)¶
Perform de-identification using validated algorithms and software that is validated to implement the algorithms.
This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values.
External Link for Additional Information: myctrl.tools
SI-19 (08) (Motivated Intruder)¶
Perform a motivated intruder test on the de-identified dataset to determine if the identified data remains or if the de-identified data can be re-identified.
This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values.
External Link for Additional Information: myctrl.tools
SI-20 (Tainting)¶
Embed data or capabilities in the following systems or system components to determine if organizational data has been exfiltrated or improperly removed from the organization: [Assignment: organization-defined systems or system components].
This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values.
External Link for Additional Information: myctrl.tools
SI-21 (Information Refresh)¶
Refresh [Assignment: organization-defined information] at [Assignment: organization-defined frequencies] or generate the information on demand and delete the information when no longer needed.
This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values.
External Link for Additional Information: myctrl.tools
SI-22 (Information Diversity)¶
- a. Identify the following alternative sources of information for [Assignment: organization-defined essential functions and services]: [Assignment: organization-defined alternative information sources]; and
- b. Use an alternative information source for the execution of essential functions or services on [Assignment: organization-defined systems or system components] when the primary source of information is corrupted or unavailable.
This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values.
External Link for Additional Information: myctrl.tools
SI-23 (Information Fragmentation)¶
Based on [Assignment: organization-defined circumstances]:
- a. Fragment the following information: [Assignment: organization-defined information]; and
- b. Distribute the fragmented information across the following systems or system components: [Assignment: organization-defined systems or system components].
This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values.
External Link for Additional Information: myctrl.tools