Malicious Code Protection SI-3
System and Information Integrity · Low baseline ✗ Not implemented
Status — program-wide
What references this control
No risks name this control in their Framework field yet.
No policies reference it yet.
Link a risk or policy to this control
Attaching adds SI-3 to the item's Framework field; the ✨ AI button suggests the best match. You can also edit the Framework field on a risk / policy directly.
Source: NIST SP 800-53 Rev.5, System and Information Integrity family NIST SP 800-53 Rev.5. The baseline shows the lowest SP 800-53B baseline (Low / Moderate / High) this control appears in NIST SP 800-53B.
Control guide — plain-English, per NIST SP 800-53
SI-3 (Malicious Code Protection) requires deploying anti-malware at system entry and exit points and on hosts to detect and eradicate malicious code. You keep signatures current, scan both periodically and in real time on file activity, and define the response — block, quarantine, or alert — to any detection.
What good looks like
- Deploy anti-malware on hosts and at entry/exit points (email, web, file transfer).
- Update signatures and the engine automatically as new definitions release.
- Scan in real time on file access and run periodic full scans.
- Define the automatic response — block, quarantine, or alert — and log every detection.
Framework mapping
- NIST CSF 2.0 — DE.CM-09 — Computing hardware, software, and their data are monitored for malicious activity
- CIS Controls v8 — Control 10 — Malware Defenses
How to move it toward Implemented
- SI-3 is not started on this asset — Suricata (network Intrusion Detection System, IDS) maps to SI-4 and AIDE (Advanced Intrusion Detection Environment, file integrity) maps to SI-7; neither is malicious-code protection.
- Concrete step: install an endpoint anti-malware engine —
sudo apt install -y clamav clamav-daemon— enablefreshclamfor automatic signature updates, and schedule aclamscanof the web-upload and home directories. - Run a negative control: drop an EICAR test file and confirm it is detected and quarantined, then attach the scan log naming SI-3 to move from 'Planned' toward 'Completed'.