System and Information Integrity Policy

Approval #

Revision History #

Review cycle: Every year, under the Policy and Procedure Management Policy.

1. Purpose and Scope #

In this policy, the CISO sets the Organization’s requirements for system and information integrity in every information system that the Organization operates or that others operate for it. The CISO issues the policy under these authorities:

• The Federal Information Security Modernization Act (FISMA) of 2014.
• National Institute of Standards and Technology (NIST) Special Publication 800-53 Revision 5.
• Office of Management and Budget (OMB) Circular A-130, Managing Information as a Strategic Resource.
• The OMB memoranda and Executive Orders that apply.

The Organization also uses this policy to carry out the NIST Cybersecurity Framework (CSF) 2.0, which Executive Order 13800 and OMB Circular A-130 require.

1.1 Program Objectives #

This policy covers system and information integrity: flaw remediation, malicious code protection, monitoring, and integrity verification. New flaws and malicious code appear daily, so remediation speed and detection depth determine the Organization’s exposure. The Organization must remediate flaws within risk-based timelines. It must deploy endpoint detection and response (EDR) across the enterprise under OMB M-22-01 and give the Cybersecurity and Infrastructure Security Agency (CISA) access as directed. It must protect against malicious code enterprise-wide, monitor systems continuously with the Security Operations Center (SOC), handle security alerts including CISA advisories, and comply with directed actions. It must verify the integrity of software, firmware, and information.

This policy applies to everyone in the program: executives who accept risk, System Owners who fund the controls, security officers who run them, and every user. By following it, the Organization meets its FISMA obligations for this control family and shows its maturity in the annual Inspector General (IG) FISMA evaluation. The Organization’s target is Level 4 (Managed and Measurable). The CISO tracks progress with the performance measures and the improvement commitments later in this policy.

1.2 CSF 2.0 Alignment #

The controls in this policy support these CSF 2.0 categories:

• ID.IM — Improvements (Identify function)
• PR.PS — Platform Security (Protect function)
• PR.IR — Technology Infrastructure Resilience (Protect function)
• DE.CM — Continuous Monitoring (Detect function)
• DE.AE — Adverse Event Analysis (Detect function)
• RS.AN — Incident Analysis (Respond function)
• RS.MI — Incident Mitigation (Respond function)
• RC.RP — Recovery Plan Execution (Recover function)

These categories fall under the Detect, Identify, Protect, Recover, Respond function(s) of CSF 2.0. The Organization’s CSF 2.0 Profile maps each category to the NIST SP 800-53 controls in this policy.

This policy covers every system and information integrity control in the high baseline of FIPS 200 and NIST SP 800-53B:

• SI-01 — Policy and Procedures
• SI-02 — Flaw Remediation
• SI-02(2) — Automated Flaw Remediation Status
• SI-02(3) — Time to Remediate Flaws and Benchmarks for Corrective Actions
• SI-03 — Malicious Code Protection
• SI-04 — System Monitoring
• SI-04(1) — System-wide Intrusion Detection System
• SI-04(10) — Visibility of Encrypted Communications
• SI-04(11) — Analyze Communications Traffic Anomalies
• SI-04(12) — Automated Organization-generated Alerts
• SI-04(14) — Wireless Intrusion Detection
• SI-04(16) — Correlate Monitoring Information
• SI-04(18) — Analyze Traffic and Covert Exfiltration
• SI-04(19) — Risk for Individuals
• SI-04(2) — Automated Tools and Mechanisms for Real-time Analysis
• SI-04(20) — Privileged Users
• SI-04(22) — Unauthorized Network Services
• SI-04(23) — Host-based Devices
• SI-04(4) — Inbound and Outbound Communications Traffic
• SI-04(5) — System-generated Alerts
• SI-05 — Security Alerts, Advisories, and Directives
• SI-05(1) — Automated Alerts and Advisories
• SI-06 — Security and Privacy Function Verification
• SI-07 — Software, Firmware, and Information Integrity
• SI-07(1) — Integrity Checks
• SI-07(15) — Code Authentication
• SI-07(2) — Automated Notifications of Integrity Violations
• SI-07(5) — Automated Response to Integrity Violations
• SI-07(7) — Integration of Detection and Response
• SI-08 — Spam Protection
• SI-08(2) — Automatic Updates
• SI-10 — Information Input Validation
• SI-11 — Error Handling
• SI-12 — Information Management and Retention
• SI-12(1) — Limit Personally Identifiable Information Elements
• SI-12(2) — Minimize Personally Identifiable Information in Testing, Training, and Research
• SI-12(3) — Information Disposal
• SI-16 — Memory Protection
• SI-18 — Personally Identifiable Information Quality Operations
• SI-18(4) — Individual Requests
• SI-19 — De-identification

2. Authority and References #

The CISO issues this policy under the authority of:

• FISMA 2014 (44 U.S.C. § 3551 et seq.) — Statutory mandate for federal information security programs
• NIST SP 800-53 Rev 5 — Security and Privacy Controls for Information Systems and Organizations
• OMB Circular A-130 — Managing Information as a Strategic Resource
• OMB Circular A-123 — Management’s Responsibility for Internal Control (revised March 10, 2026)
• NIST CSF 2.0 — Cybersecurity Framework (mandated by EO 13800 and OMB Circular A-130)
• EO 13800 — Strengthening the Cybersecurity of Federal Networks and Critical Infrastructure
• CISA BOD 26-04: Prioritizing Security Updates Based on Risk, June 10, 2026.
• CISA BOD 25-01: Implementing Secure Practices for Cloud Services, December 17, 2024.
• CISA BOD 20-01: Develop and Publish a Vulnerability Disclosure Policy, September 2, 2020.
• OMB M-22-01: Improving Detection of Cybersecurity Vulnerabilities and Incidents on Federal Government Systems through Endpoint Detection and Response (EDR), October 8, 2021.
• OMB M-26-15: Execution of the Migration to Post-Quantum Cryptography, June 24, 2026.
• Executive Order 14028: Improving the Nation’s Cybersecurity, May 12, 2021.

2.1 Derived Governance Requirements #

The requirements below come from federal governance sources and apply to the SI control family. They add to the NIST SP 800-53 control requirements in the Policy section.

OMB M-22-01: Improving Detection of Cybersecurity Vulnerabilities and Incidents through EDR

• The organization must ensure endpoint data is consolidated, retained, and archived to support analysis and insight as defined in CISA’s technical reference architecture. EDR solutions must be consistent with applicable privacy and statistical laws. (OMB M-22-01, §3)

CISA BOD 26-04: Prioritizing Security Updates Based on Risk

• The organization must follow CISA’s Internet Exposure Reduction Guidance to determine if vulnerable assets are publicly exposed, and must prioritize remediation of internet-exposed vulnerabilities over internal-only vulnerabilities. (CISA BOD 26-04, §2)
• The organization must track and report remediation status for all KEV catalog vulnerabilities, consolidating federal vulnerability remediation guidelines under a single directive. (CISA BOD 26-04, §3)

CISA BOD 23-01: Improving Asset Visibility and Vulnerability Detection

• The organization must conduct regular vulnerability detection across all assets and share results with CISA. Asset visibility is a prerequisite for effective patching, configuration management, and security lifecycle management. (CISA BOD 23-01, §2)

CISA BOD 20-01: Develop and Publish a Vulnerability Disclosure Policy

• The organization must develop and publish a vulnerability disclosure policy (VDP) that authorizes good-faith security research on internet-facing systems and gives a clear process for receiving and responding to reports. (CISA BOD 20-01, §1)
• The organization must establish a vulnerability handling process that includes triage, remediation timelines, and communication with reporters. The VDP must include clear authorization language to protect good-faith researchers from legal action. (CISA BOD 20-01, §2)

OMB M-23-02: Migrating to Post-Quantum Cryptography

• The organization must conduct a prioritized inventory of all cryptographic systems, focusing first on systems that: use asymmetric encryption for logical access control, contain data expected to remain sensitive beyond 2035, or use algorithms vulnerable to quantum cryptanalysis. (OMB M-23-02, §II.A)

OMB M-26-15: Execution of the Migration to Post-Quantum Cryptography

• The organization must establish or update an internal governance structure with defined roles to oversee PQC migration, integrate PQC readiness into existing governance, and submit a PQC Migration Plan to OMB and ONCD within 120 days of the memo, aligned to NIST IR 8547, containing a risk-based system prioritization strategy and timelines and milestones for all migration phases. Deadline: Plan due 2026-10-22. (OMB M-26-15, Action Two)

44 U.S.C. 2911: Disclosure requirement for official business conducted using non-official electronic messaging accounts

• The organization must make sure that staff who create or send a record from a non-official messaging account copy an official account, or forward a complete copy to it within 20 days. Deadline: 20 days after the message is created or sent. (44 U.S.C. 2911)

NARA Bulletin 2023-02: Expanding the Use of a Role-Based Approach (Capstone) for Electronic Messages

• The organization must manage text, chat, and instant messages about agency business as federal records, and do not let messaging tools delete them before the records schedule allows. (NARA Bulletin 2023-02)

3. Policy #

The Organization must implement and maintain its system and information integrity controls to meet the following requirements:

SI-01 — Policy and Procedures #

Baselines: Low / Moderate / High / Privacy CSF 2.0: DE.CM (Continuous Monitoring)

Requirement:

1. Develop, document, and disseminate to [Assignment: organization-defined personnel or roles — to be defined]:

1. [Selection (one or more): organization-level; mission/business process-level; system-level — to be defined] system and information integrity policy that:

1. Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and
2. Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and

2. Procedures to facilitate the implementation of the system and information integrity policy and the associated system and information integrity controls;

2. Designate an [Assignment: organization-defined official — to be defined] to manage the development, documentation, and dissemination of the system and information integrity policy and procedures; and
3. Review and update the current system and information integrity:

1. Policy at least annually and following significant changes; and
2. Procedures at least annually and following [Assignment: organization-defined events — to be defined].

Implementation guidance:

The Organization must keep a system and information integrity policy at the organization level and at the system level, with procedures that put each requirement into practice. The CISO manages the development, documentation, and distribution of both documents. The CISO delivers them to the Authorizing Official, System Owners, Information System Security Officers (ISSOs), and key stakeholders when they are issued and after every revision. The policy and procedures must stay consistent with the laws, directives, and standards that apply to the Organization. These include the endpoint detection requirements in OMB M-22-01 and the CISA vulnerability directives that apply to this family. The CISO must review and update both documents every two years, and sooner when the Organization’s technology, enterprise architecture, or data types change.

SI-02 — Flaw Remediation #

Baselines: Low / Moderate / High / High Value Asset (HVA) overlay CSF 2.0: ID.IM (Improvements), PR.PS (Platform Security), PR.IR (Technology Infrastructure Resilience), DE.CM (Continuous Monitoring)

Requirement:

1. Identify, report, and correct system flaws;
2. Test software and firmware updates related to flaw remediation for effectiveness and potential side effects before installation;
3. Install security-relevant software and firmware updates within thirty (30) days of release of updates of the release of the updates; and
4. Incorporate flaw remediation into the organizational configuration management process.

Implementation guidance:

System Owners must identify, report, and correct flaws in their systems. Administrators must test security-relevant software and firmware updates for effectiveness and side effects before they install them. System Owners must install each update by the finding’s due date: the earliest of the CISA Binding Operational Directive (BOD) 26-04 Table 1 timeline and the RA-05 timeframe for its severity. Under CISA BOD 26-04, the Organization tracks each vulnerability listed in the CISA Known Exploited Vulnerabilities (KEV) catalog until it is fixed and reports its status. Vulnerabilities on internet-exposed systems take priority over vulnerabilities on internal-only systems. System Owners must remediate flaws through the configuration management process, so that each fix is a tracked and verifiable change. System Owners own remediation for their systems, and the ISSO reports remediation status. Administrators must accept updates only from authorized sources.

SI-02(2) — Automated Flaw Remediation Status #

Baselines: Moderate / High

Requirement:

Determine if system components have applicable security-relevant software and firmware updates installed using [Assignment: organization-defined automated mechanisms — to be defined] at least monthly.

Implementation guidance:

The Organization must use automated scanning to find out whether each system component has the security-relevant software and firmware updates that apply to it. The vulnerability scanner scans for missing updates at least every month. System Owners must keep every component of their systems enrolled in scanning coverage. Administrators must treat a component that the scan does not cover as noncompliant until a scan shows it is current.

SI-02(3) — Time to Remediate Flaws and Benchmarks for Corrective Actions #

Baselines: Moderate / High

Requirement:

1. Measure the time between flaw identification and flaw remediation; and
2. Establish the following benchmarks for taking corrective actions: [Assignment: organization-defined benchmarks — to be defined].

Implementation guidance:

The Organization must measure the time between finding a flaw and fixing it. The Organization must set benchmarks for corrective action that scale with the severity of the vulnerability. System Owners must meet the benchmarks for their systems. The ISSO must report performance against the benchmarks to the CISO and System Owners. When a system misses a benchmark repeatedly, the ISSO must find the cause and track corrective changes to the remediation process.

SI-03 — Malicious Code Protection #

Baselines: Low / Moderate / High / HVA overlay CSF 2.0: PR.PS (Platform Security), DE.CM (Continuous Monitoring), DE.AE (Adverse Event Analysis)

Requirement:

1. Implement signature based and non-signature based malicious code protection mechanisms at system entry and exit points to detect and eradicate malicious code;
2. Automatically update malicious code protection mechanisms as new releases are available in accordance with organizational configuration management policy and procedures;
3. Configure malicious code protection mechanisms to:

1. Perform periodic scans of the system at least weekly and real-time scans of files from external sources at to include endpoints and network entry and exit points as the files are downloaded, opened, or executed in accordance with organizational policy; and
2. to include blocking and quarantining malicious code; and send alert to administrator or defined security personnel near-realtime in response to malicious code detection; and

4. Address the receipt of false positives during malicious code detection and eradication and the resulting potential impact on the availability of the system.

Implementation guidance:

The Organization must run signature-based and behavior-based malicious code protection at system entry and exit points and on every endpoint. The EDR tools detect and remove malicious code on hosts, and the secure web gateway inspects web traffic at the network edge. Administrators must keep the protection content updating automatically as vendors release it, under the configuration management process. Administrators must configure the tools to scan each system at least every week. The tools must also scan files from external sources in real time, at endpoints and at network entry and exit points, as users download, open, or run them. When a tool detects malicious code, it blocks and quarantines the code and alerts the SOC, the incident response team, the System Owner, the ISSO, and the system administrators. The SOC must assess each suspected false positive and tune the tools, so that the protection does not disrupt availability.

SI-04 — System Monitoring #

Baselines: Low / Moderate / High / HVA overlay CSF 2.0: ID.IM (Improvements), PR.PS (Platform Security), PR.IR (Technology Infrastructure Resilience), DE.CM (Continuous Monitoring)

Requirement:

1. Monitor the system to detect:

1. Attacks and indicators of potential attacks in accordance with the following monitoring objectives: [Assignment: organization-defined monitoring objectives — to be defined]; and
2. Unauthorized local, network, and remote connections;

2. Identify unauthorized use of the system through the following techniques and methods: [Assignment: organization-defined techniques and methods — to be defined];
3. Invoke internal monitoring capabilities or deploy monitoring devices:

1. Strategically within the system to collect organization-determined essential information; and
2. At ad hoc locations within the system to track specific types of transactions of interest to the organization;

4. Analyze detected events and anomalies;
5. Adjust the level of system monitoring activity when there is a change in risk to organizational operations and assets, individuals, other organizations, or the Nation;
6. Obtain legal opinion regarding system monitoring activities; and
7. Provide [Assignment: organization-defined system monitoring information — to be defined] to [Assignment: organization-defined personnel or roles — to be defined] [Selection (one or more): as needed; [organization-defined] — to be defined].

Implementation guidance:

The Organization must monitor its systems to detect attacks and signs of attack. Monitoring follows the objectives in the Incident Response Plan and the Continuous Monitoring Plan. The SOC must monitor for the irregularities and anomalies that signal a malfunction or a compromise, and for unauthorized local, network, and remote connections. The secure web gateway monitors the boundary, the EDR tools collect endpoint telemetry, and the security information and event management (SIEM) system correlates all of it. The SOC must analyze the events these tools detect. The CISO must raise the level of monitoring when the risk to operations, assets, or individuals rises. The Organization must have a legal opinion that covers the scope of its monitoring. The SOC must send alerts, log entries, and artifacts of potential or actual cybersecurity events to the SOC Manager, the incident response team, the System Owner, the ISSO, and the CISO. The SOC must send them [SI-04 parameter 5 — to be defined], after a significant change in the threat environment, and as events require.

SI-04(1) — System-wide Intrusion Detection System #

Baselines: Moderate / High

Requirement:

Connect and configure individual intrusion detection tools into a system-wide intrusion detection system.

Implementation guidance:

The Organization must connect its individual intrusion detection tools into one system-wide detection capability. Administrators must connect endpoint sensing from the EDR tools, and network sensing from the secure web gateway, to the SIEM system, where the SOC can see and work all detections together. System Owners must not operate a detection sensor outside this central view unless they hold a documented exception.

SI-04(2) — Automated Tools and Mechanisms for Real-time Analysis #

Baselines: Moderate / High

Requirement:

Employ automated tools and mechanisms to support near real-time analysis of events.

Implementation guidance:

The Organization must use automated tools for near real-time analysis of events. The SIEM system analytics evaluate telemetry as it arrives and raise incidents without waiting for a scheduled human review. The SOC must keep the analytics rules current with the threat picture. Automated correlation can join records in ways that create privacy risk. The ISSO must ensure that the Organization assesses those risks with the Senior Agency Official for Privacy (SAOP).

SI-04(4) — Inbound and Outbound Communications Traffic #

Baselines: Moderate / High

Requirement:

1. Determine criteria for unusual or unauthorized activities or conditions for inbound and outbound communications traffic;
2. Monitor inbound and outbound communications traffic continuously for [Assignment: organization-defined unusual or unauthorized activities or conditions — to be defined].

Implementation guidance:

The Organization must define what counts as unusual or unauthorized activity on inbound and outbound communications traffic. The SOC must monitor that traffic continually and in near real time. The SOC looks for command and control patterns, large outbound data transfers, unauthorized encrypted tunnels, known advanced persistent threat indicators, and the other indicators of compromise the SOC identifies. The SOC must investigate each match as a potential incident. The SOC must update the criteria as new intelligence arrives, not on a fixed schedule.

SI-04(5) — System-generated Alerts #

Baselines: Moderate / High

Requirement:

Alert [Assignment: organization-defined personnel or roles — to be defined] when the following system-generated indications of compromise or potential compromise occur: [Assignment: organization-defined compromise indicators — to be defined].

Implementation guidance:

The Organization must configure its systems to raise an alert when a compromise indicator fires. Indicators include known advanced persistent threat activity, an indicator the SOC supplies, and a security-relevant event the Organization defines. Each alert must reach at least the SOC, the incident response team, the System Owner, the ISSO, and the system administrators. The SOC must keep the alert routing current. Each alert must reach the people responsible and not an unused mailbox.

SI-04(10) — Visibility of Encrypted Communications #

Baselines: High

Requirement:

Make provisions so that [Assignment: organization-defined encrypted communications traffic — to be defined] is visible to [Assignment: organization-defined system monitoring tools and mechanisms — to be defined].

Implementation guidance:

The Organization must keep [SI-04(10) parameter 1 — to be defined] visible to [SI-04(10) parameter 2 — to be defined]. The CISO must decide which encrypted flows the security team must inspect and which flows stay exempt for privacy or legal reasons. System Owners must design each system so that monitoring can see the traffic in scope, either by decrypting at an approved point or by collecting endpoint data. The ISSO must record the inspection approach and any exemptions in the System Security Plan.

SI-04(11) — Analyze Communications Traffic Anomalies #

Baselines: High

Requirement:

Analyze outbound communications traffic at the external interfaces to the system and selected [Assignment: organization-defined interior points — to be defined] to discover anomalies.

Implementation guidance:

The Organization must analyze outbound traffic at every external boundary of each system to find unusual activity. The security team must also analyze traffic at [SI-04(11) parameter 1 — to be defined]. The Chief Information Security Officer (CISO) must define what counts as unusual, such as large transfers, long-lived sessions, odd ports or protocols, and contact with known bad addresses. System Owners must make sure each system sends the needed traffic records to central logging.

SI-04(12) — Automated Organization-generated Alerts #

Baselines: High

Requirement:

Alert [Assignment: organization-defined personnel or roles — to be defined] using [Assignment: organization-defined automated mechanisms — to be defined] when the following indications of inappropriate or unusual activities with security or privacy implications occur: [Assignment: organization-defined activities that trigger alerts — to be defined].

Implementation guidance:

The Organization must send automated alerts to [SI-04(12) parameter 1 — to be defined] using [SI-04(12) parameter 2 — to be defined]. Alerts must fire on each type of inappropriate or unusual activity that the Organization defines for this control. The CISO must own the alert rules and the notification list. System Owners must keep the list of alert recipients for their systems current.

SI-04(14) — Wireless Intrusion Detection #

Baselines: High

Requirement:

Employ a wireless intrusion detection system to identify rogue wireless devices and to detect attack attempts and potential compromises or breaches to the system.

Implementation guidance:

The Organization must run wireless intrusion detection for every facility that hosts its systems. The detection must find rogue wireless devices and detect attacks or signs of compromise on wireless networks. The CISO must own the wireless detection program. System Owners must report each approved wireless access point so that the security team can tell approved devices from rogue ones. The security team must treat each confirmed rogue device as a security incident.

SI-04(16) — Correlate Monitoring Information #

Baselines: Moderate / High

Requirement:

Correlate information from monitoring tools and mechanisms employed throughout the system.

Implementation guidance:

The Organization must correlate the information from the monitoring tools deployed across the environment. Administrators must send endpoint telemetry from the EDR tools, web telemetry from the secure web gateway, and the collected system logs to the SIEM system. Cross-source correlation rules in the SIEM system find patterns that no single tool detects on its own. The SOC must build and maintain the correlation rules and act on the incidents they produce.

SI-04(18) — Analyze Traffic and Covert Exfiltration #

Baselines: Moderate / High

Requirement:

Analyze outbound communications traffic at external interfaces to the system and at the following interior points to detect covert exfiltration of information: [Assignment: organization-defined interior points — to be defined].

Implementation guidance:

The Organization must analyze outbound communications traffic at the external boundary and at the interior points it designates, to detect covert removal of information. The secure web gateway inspects outbound traffic under policy, including encrypted sessions. The SIEM system analytics evaluate the flow records for patterns that hide data removal. The SOC must treat any indicator of a covert channel as a potential incident and must involve the data owner in the investigation.

SI-04(19) — Risk for Individuals #

Baselines: High

Requirement:

Implement [Assignment: organization-defined additional monitoring — to be defined] of individuals who have been identified by [Assignment: organization-defined sources — to be defined] as posing an increased level of risk.

Implementation guidance:

The Organization must apply [SI-04(19) parameter 1 — to be defined] to individuals whom [SI-04(19) parameter 2 — to be defined] identify as posing increased risk. The CISO must approve each case before monitoring starts. The CISO must coordinate each case with management, legal counsel, the SAOP, and human resources. The monitoring must follow applicable law and privacy rules and must end when the risk no longer applies.

SI-04(20) — Privileged Users #

Baselines: High

Requirement:

Implement the following additional monitoring of privileged users: [Assignment: organization-defined additional monitoring — to be defined].

Implementation guidance:

The Organization must apply this added monitoring to privileged users: [SI-04(20) parameter 1 — to be defined]. System Owners must make each system send privileged activity records to central logging. The CISO must own the monitoring rules for privileged accounts. Account managers must keep the list of privileged accounts current, so that the monitoring covers each one.

SI-04(22) — Unauthorized Network Services #

Baselines: High

Requirement:

1. Detect network services that have not been authorized or approved by [Assignment: organization-defined authorization or approval processes — to be defined]; and
2. [Selection (one or more): audit; alert [organization-defined] — to be defined] when detected.

Implementation guidance:

The Organization must detect network services that lack approval through [SI-04(22) parameter 1 — to be defined]. When the security team finds such a service, it must [SI-04(22) parameter 2 — to be defined]. System Owners must list each approved network service in the system’s security documentation. The ISSO must keep that list current as the system changes.

SI-04(23) — Host-based Devices #

Baselines: Moderate / High

Requirement:

Implement the following host-based monitoring mechanisms at [Assignment: organization-defined system components — to be defined]: [Assignment: organization-defined host-based monitoring mechanisms — to be defined].

Implementation guidance:

The Organization must run host-based monitoring on its endpoints and servers. Administrators deploy the EDR tools on the endpoints each tool supports, so every endpoint runs EDR, as OMB M-22-01 requires. System Owners must keep the agents installed and reporting on every host. Administrators must treat a host without a healthy agent as out of compliance until they restore the agent.

SI-05 — Security Alerts, Advisories, and Directives #

Baselines: Low / Moderate / High CSF 2.0: ID.IM (Improvements), DE.CM (Continuous Monitoring), DE.AE (Adverse Event Analysis), RS.AN (Incident Analysis)

Requirement:

1. Receive system security alerts, advisories, and directives from CISA on an ongoing basis;
2. Generate internal security alerts, advisories, and directives as deemed necessary;
3. Disseminate security alerts, advisories, and directives to: to include system security personnel and administrators with configuration/patch-management responsibilities; and
4. Implement security directives in accordance with established time frames, or notify the issuing organization of the degree of noncompliance.

Implementation guidance:

The Organization must receive security alerts, advisories, and directives on an ongoing basis from at least the Enterprise Security Operations Center, the agency incident response team, CISA, OMB, and product vendors. The SOC must issue internal alerts and advisories when conditions call for them. The SOC must send alerts, advisories, and directives to the System Owners, ISSOs, and system administrators who must act on them. When the scope requires, the SOC must also send them to the IT office, the wider workforce, contract vendors, and the Organization’s Federal Risk and Authorization Management Program (FedRAMP) cloud service providers. The owner of each security directive must implement it within the timeframe the directive sets. When the Organization cannot comply in time, the CISO must notify the issuing organization of the degree of noncompliance. Every directive must have an owner, a deadline, and a tracked status.

SI-05(1) — Automated Alerts and Advisories #

Baselines: High

Requirement:

Broadcast security alert and advisory information throughout the organization using [Assignment: organization-defined automated mechanisms — to be defined].

Implementation guidance:

The Organization must send security alerts and advisories to the people who need them through [SI-05(1) parameter 1 — to be defined]. The CISO must decide which alerts and advisories go to which roles. System Owners and ISSOs must act on alerts that affect their systems. All personnel must read alerts addressed to them.

SI-06 — Security and Privacy Function Verification #

Baselines: Moderate / High CSF 2.0: DE.CM (Continuous Monitoring), DE.AE (Adverse Event Analysis)

Requirement:

1. Verify the correct operation of [Assignment: organization-defined security and privacy functions — to be defined];
2. Perform the verification of the functions specified in SI-6a [Selection (one or more): [organization-defined]; upon command by user with appropriate privilege; [organization-defined] — to be defined];
3. Alert to include system administrators and security personnel to failed security and privacy verification tests; and
4. [Selection (one or more): shut the system down; restart the system; [organization-defined] — to be defined] when anomalies are discovered.

Implementation guidance:

The Organization must verify that its defined security and privacy functions work correctly. These functions include auditing, alerting, detection, and the services approved in the System Security and Privacy Plan (SSPP). Administrators must run the verification when a system starts, restarts, shuts down, or aborts, and when a privileged user requests it. When a verification fails, the system must alert the SOC, the System Owner, the ISSO, and the system administrators. When a verification finds an anomaly, administrators must apply the response selected in advance for that system: shut the system down, restart it, or take the approved alternative action. System Owners must define the set of functions to verify and the response for each of their systems.

SI-07 — Software, Firmware, and Information Integrity #

Baselines: Moderate / High CSF 2.0: PR.PS (Platform Security), DE.CM (Continuous Monitoring), DE.AE (Adverse Event Analysis)

Requirement:

1. Employ integrity verification tools to detect unauthorized changes to the following software, firmware, and information: [Assignment: organization-defined software, firmware, and information — to be defined]; and
2. Take the following actions when unauthorized changes to the software, firmware, and information are detected: [Assignment: organization-defined actions — to be defined].

Implementation guidance:

The Organization must use integrity verification tools to detect unauthorized changes to operating system software, application software, and firmware. The EDR tools monitor hosts for tampering, and the vulnerability scanner verifies the installed software against the approved configuration. When a tool detects an unauthorized change, it must notify the SOC and the system administrators. The administrator must restore the component to its approved state or contain it until the investigation ends. System Owners must define the integrity-critical software set for each of their systems. The SOC must handle any unexplained change as a potential incident.

SI-07(1) — Integrity Checks #

Baselines: Moderate / High

Requirement:

Perform an integrity check of [Assignment: organization-defined software, firmware, and information — to be defined] [Selection (one or more): at startup; at [organization-defined]; [organization-defined] — to be defined].

Implementation guidance:

Administrators must run integrity checks on operating system software, application software, and firmware at least monthly. They must also run a check when a system starts, restarts, shuts down, or aborts, and when a privileged user requests one. A newly identified threat or an installation of new hardware, software, or firmware also requires a check. System Owners must ensure that the checks run on their systems and that administrators review the results.

SI-07(2) — Automated Notifications of Integrity Violations #

Baselines: High

Requirement:

Employ automated tools that provide notification to include the ISSO and/or similar role within the organization upon discovering discrepancies during integrity verification.

Implementation guidance:

The Organization must use automated tools to notify to include the ISSO and/or similar role within the organization when an integrity check finds a mismatch. The CISO must own the notification rules. System Owners must make sure each system’s integrity checks send their results to central logging. Recipients must review each notice and act on it.

SI-07(5) — Automated Response to Integrity Violations #

Baselines: High

Requirement:

Automatically [Selection (one or more): shut down the system; restart the system; implement [organization-defined] — to be defined] when integrity violations are discovered.

Implementation guidance:

When an integrity check finds a violation, the affected system must automatically [SI-07(5) parameter 1 — to be defined]. The automated controls named for that response are [SI-07(5) parameter 2 — to be defined]. System Owners must configure each system to take the required action without waiting for a person. The Chief Information Security Officer (CISO) must approve the response for each type of violation.

SI-07(7) — Integration of Detection and Response #

Baselines: Moderate / High

Requirement:

Incorporate the detection of the following unauthorized changes into the organizational incident response capability: [Assignment: organization-defined changes — to be defined].

Implementation guidance:

Detections of unauthorized changes to configuration settings, unauthorized elevation of privileges, and the other security-relevant changes the Organization defines must go to the incident response capability. The SOC must route these detections into the incident process, where they are tracked, corrected, and kept for later analysis. The SOC must not close them as routine operational events. A detected change that never reaches incident response is never corrected or analyzed.

SI-07(15) — Code Authentication #

Baselines: High

Requirement:

Implement cryptographic mechanisms to authenticate the following software or firmware components prior to installation: to include all software and firmware inside the boundary.

Implementation guidance:

The Organization must check the digital signature of to include all software and firmware inside the boundary before anyone installs them. Only code signed with a certificate the Organization trusts must install. System Owners must make sure each system enforces this check. The CISO must approve the list of trusted signing certificates. Administrators must not bypass the check without a documented exception the CISO approves.

SI-08 — Spam Protection #

Baselines: Moderate / High CSF 2.0: PR.PS (Platform Security)

Requirement:

1. Employ spam protection mechanisms at system entry and exit points to detect and act on unsolicited messages; and
2. Update spam protection mechanisms when new releases are available in accordance with organizational configuration management policy and procedures.

Implementation guidance:

The Organization must run spam protection at system entry and exit points, most importantly at the email service boundary. Administrators must update the spam protection as new releases become available, under the configuration management process. The System Owner for the messaging environment must keep filtering active on both inbound and outbound mail. As CISA BOD 18-01 requires, the email administrators must publish a Sender Policy Framework (SPF) record for every second-level domain. They must also publish a Domain-based Message Authentication, Reporting, and Conformance (DMARC) policy of reject, with aggregate reports sent to CISA. Mail servers must offer opportunistic Transport Layer Security (STARTTLS) and must disable Secure Sockets Layer (SSL) 2.0 and 3.0, Rivest Cipher 4 (RC4), and 3DES. All personnel must report suspected spam and phishing that reaches their inbox. The SOC uses those reports to adjust the filtering.

SI-08(2) — Automatic Updates #

Baselines: Moderate / High

Requirement:

Automatically update spam protection mechanisms [Assignment: organization-defined frequency — to be defined].

Implementation guidance:

Spam protection mechanisms must update automatically and in near real time as new protection content becomes available, without waiting for an administrator to act. Administrators must verify that automatic updating stays enabled and that a failed update raises a ticket for correction. The System Owner must treat a filter that runs on old definitions as a protection gap, not a minor delay.

SI-10 — Information Input Validation #

Baselines: Moderate / High CSF 2.0: PR.PS (Platform Security)

Requirement:

Check the validity of the following information inputs: [Assignment: organization-defined information inputs — to be defined].

Implementation guidance:

Development teams must build applications to check the validity of the information inputs the Organization defines for them before the application processes the input. The checks cover syntax, length, numerical range, and permitted values, so that crafted content in a user field cannot run commands or inject queries. System Owners must define the set of validated inputs for each application. The development standard requires validation at every boundary where untrusted data enters an application. When testing or scanning shows that validation is missing, the System Owner must fix it on the vulnerability remediation timeline and must not defer it as feature work.

SI-11 — Error Handling #

Baselines: Moderate / High CSF 2.0: PR.PS (Platform Security)

Requirement:

1. Generate error messages that provide information necessary for corrective actions without revealing information that could be exploited; and
2. Reveal error messages only to include the ISSO and/or similar role within the organization.

Implementation guidance:

Systems must generate error messages that tell users what they need to do and nothing an attacker can use. An error message must not show internal paths, stack traces, credentials, or personal identifiers. Applications must show detailed diagnostic output only to technical support staff with a valid need for it and to the ISSO. System Owners must ensure that their applications keep the user-facing message separate from the diagnostic record. System Owners must also ensure that the release review of each new or changed application checks its error output before release.

SI-12 — Information Management and Retention #

Baselines: Low / Moderate / High / Privacy CSF 2.0: PR.PS (Platform Security)

Requirement:

Manage and retain information within the system and information output from the system in accordance with applicable laws, executive orders, directives, regulations, policies, standards, guidelines and operational requirements.

Implementation guidance:

System Owners must manage and retain the information in their systems and the information those systems produce. They must follow the laws, executive orders, directives, regulations, standards, guidelines, and operational requirements that apply, and the National Archives and Records Administration (NARA)-approved records schedules. System Owners must apply the retention period each information type requires and coordinate with records management personnel. Security records follow the same rules. The SIEM system keeps audit logs for twelve months in active storage and eighteen months in cold storage, under the logging requirements. When the retention period ends, System Owners must dispose of the information deliberately and document the disposal. They must never leave disposal to storage defaults.

SI-12(1) — Limit Personally Identifiable Information Elements #

Baselines: Privacy

Requirement:

Limit personally identifiable information being processed in the information life cycle to the following elements of personally identifiable information: [Assignment: organization-defined elements of personally identifiable information — to be defined].

Implementation guidance:

Systems must process only these elements of personally identifiable information (PII): [SI-12(1) parameter 1 — to be defined]. The System Owner must make sure the system collects, uses, stores, shares, and disposes of no other PII elements. Before adding a new PII element, the System Owner must update the privacy impact assessment and get approval from the Senior Agency Official for Privacy (SAOP). The Privacy Officer must review each system’s PII elements during every privacy impact assessment update.

SI-12(2) — Minimize Personally Identifiable Information in Testing, Training, and Research #

Baselines: Privacy

Requirement:

Use the following techniques to minimize the use of personally identifiable information for research, testing, or training: [Assignment: organization-defined techniques — to be defined].

Implementation guidance:

Staff must minimize the use of personally identifiable information (PII) outside production systems. For research, they must apply this technique: [SI-12(2) parameter 1 — to be defined]. For testing, they must apply this technique: [SI-12(2) parameter 2 — to be defined]. For training, they must apply this technique: [SI-12(2) parameter 3 — to be defined]. The System Owner must approve each test, research, or training data set before staff use it. Any exception requires written approval from the Senior Agency Official for Privacy (SAOP).

SI-12(3) — Information Disposal #

Baselines: Privacy

Requirement:

Use the following techniques to dispose of, destroy, or erase information following the retention period: [Assignment: organization-defined techniques — to be defined].

Implementation guidance:

When the retention period in the approved records schedule ends, staff must dispose of information that contains personally identifiable information (PII). To dispose of information, they must use [SI-12(3) parameter 1 — to be defined]. To destroy media, they must use [SI-12(3) parameter 2 — to be defined]. To erase data, they must use [SI-12(3) parameter 3 — to be defined]. These rules cover originals, copies, backups, archives, and system logs that contain PII. The System Owner must make sure staff record each disposal.

SI-16 — Memory Protection #

Baselines: Moderate / High CSF 2.0: PR.PS (Platform Security)

Requirement:

Implement the following controls to protect the system memory from unauthorized code execution: [Assignment: organization-defined controls — to be defined].

Implementation guidance:

The Organization must protect system memory from unauthorized code execution. The Organization must buy hardware and software designed to resist memory manipulation attacks. These attacks include buffer overruns, data space violations, and the other techniques the Cybersecurity Team defines. Administrators must keep platform memory protections enabled on every system. Administrators must enforce execution restrictions on writable memory and randomized memory layouts through group policy and the mobile device management (MDM) tool baselines. They must also turn on the exploit protections in the EDR tool. Anyone who needs to disable a memory protection must hold a documented exception approved by the CISO.

SI-18 — Personally Identifiable Information Quality Operations #

Baselines: Privacy

Requirement:

1. Check the accuracy, relevance, timeliness, and completeness of personally identifiable information across the information life cycle [Assignment: organization-defined frequency — to be defined]; and
2. Correct or delete inaccurate or outdated personally identifiable information.

Implementation guidance:

System Owners must check the personally identifiable information (PII) in their systems for accuracy [SI-18 parameter 1 — to be defined], for relevance [SI-18 parameter 2 — to be defined], for timeliness [SI-18 parameter 3 — to be defined], and for completeness [SI-18 parameter 4 — to be defined]. The check covers PII at each stage, from collection to disposal. System Owners must correct or delete any PII they find to be wrong or out of date. They must keep a record of each change. Systems that support decisions about a person’s rights, benefits, or privileges must receive the most thorough checks. The Privacy Officer must review the results and report problems to the Senior Agency Official for Privacy (SAOP).

SI-18(4) — Individual Requests #

Baselines: Privacy

Requirement:

Correct or delete personally identifiable information upon request by individuals or their designated representatives.

Implementation guidance:

The Organization must correct or delete personally identifiable information (PII) when the individual or the individual’s designated representative asks, unless the law requires the Organization to keep it. The Privacy Officer must track each request. The Privacy Officer must consult the Senior Agency Official for Privacy (SAOP) and General Counsel before denying a request in whole or in part. The Privacy Officer must tell the requester the decision and, for a denial, the reason and how to appeal.

SI-19 — De-identification #

Baselines: Privacy

Requirement:

1. Remove the following elements of personally identifiable information from datasets: [Assignment: organization-defined elements — to be defined]; and
2. Evaluate [Assignment: organization-defined frequency — to be defined] for effectiveness of de-identification.

Implementation guidance:

Before staff share or reuse a data set for a purpose that does not need identities, they must remove these elements: [SI-19 parameter 1 — to be defined]. Only staff trained in de-identification may do this work. The System Owner must approve each de-identified data set before its release. The Privacy Officer must test the effectiveness of de-identification [SI-19 parameter 2 — to be defined]. The test must consider new data sets and new analysis methods that could let someone link records back to a person. If a test shows that people can be identified, the System Owner must withdraw the data set and fix the method. The Senior Agency Official for Privacy (SAOP) must approve any change to the de-identification method.

4. Roles and Responsibilities #

These roles apply across this policy. Each System Owner records the system-specific assignments in the system’s System Security and Privacy Plan (SSPP).

5. Performance Measurement #

The CISO manages this policy with the measures below, which meet the IG FISMA maturity model’s Level 4 (Managed and Measurable) criteria. The CISO collects and trends the measures and reports them to the CIO and the Authorizing Officials. When a measure moves away from its target, the CISO starts corrective action through the plan of action and milestones (POA&M) process.

The CISO keeps the measurement data for the annual IG FISMA evaluation and for trend analysis across reporting periods.

6. Compliance and Enforcement #

Every employee, contractor, and other user with access to an information system that the Organization operates, or that others operate for it, must comply with this policy. The CISO records each case of non-compliance as a finding in the Organization’s continuous monitoring program. The ISSO tracks the finding to resolution as a POA&M item, as OMB Circular A-130 and NIST SP 800-37 Rev. 2 describe.

A violation of this policy can lead to suspension of system access, withdrawal of the system’s authorization to operate (ATO), and administrative or disciplinary action under applicable law, regulation, and human capital policy.

The Inspector General assesses the maturity of system and information integrity controls each year through the IG FISMA reporting metrics. The target maturity level for this policy area is Level 4: Managed and Measurable.

7. Continuous Improvement #

Level 4 is the minimum the Organization aims for. To meet the IG FISMA maturity model’s Level 5 (Optimized) criteria, the CISO improves system and information integrity through these commitments:

1. Review the performance measures in this document at least annually; where a measure has met its target for four consecutive periods, tighten the target or replace the measure with a more demanding indicator.
2. Conduct an annual effectiveness review of this policy area using IG FISMA audit results, assessment findings, incident data, and metric trends; document resulting changes in the revision history.
3. Feed lessons learned from incidents, assessments, and exercises into updates of this document and its procedures within 90 days of the triggering event.
4. Benchmark against the IG FISMA maturity model annually and maintain a documented plan to reach and sustain Level 4 (Managed and Measurable), with a roadmap toward Level 5 (Optimized).
5. Automate patch deployment rings with health-gated promotion, measuring reduction in mean time to remediate.
6. Tune detection content continuously using purple-team results and measure detection-gap closure.

8. Exceptions and Waivers #

The CISO may grant an exception to this policy only when compliance is not technically feasible or would harm the mission. To request one, the System Owner sends the CISO a written request that includes:

1. A business justification and a risk assessment.
2. Compensating controls that reduce the risk the exception creates, following the NIST SP 800-53B guidance on compensating controls.
3. A proposed end date no more than one year away.

The CISO decides each request in coordination with the Authorizing Official. An exception that involves privacy risk also needs the agreement of the Senior Agency Official for Privacy (SAOP). The CISO re-evaluates each exception when it comes up for renewal. The System Owner records each approved exception in the system’s SSPP, and the ISSO tracks it as a POA&M item.

9. References #

These are the sources this document cites, with a link to each official text.

• CISA BOD 18-01: Enhance Email and Web Security, October 16, 2017.
• CISA BOD 20-01: Develop and Publish a Vulnerability Disclosure Policy, September 2, 2020.
• CISA BOD 23-01: Improving Asset Visibility and Vulnerability Detection on Federal Networks, October 3, 2022.
• CISA BOD 25-01: Implementing Secure Practices for Cloud Services, December 17, 2024.
• CISA BOD 26-04: Prioritizing Security Updates Based on Risk, June 10, 2026.
• CISA Known Exploited Vulnerabilities Catalog, updated continuously.
• Disclosure requirement for official business conducted using non-official electronic messaging accounts (44 U.S.C. § 2911).
• Executive Order 13800: Strengthening the Cybersecurity of Federal Networks and Critical Infrastructure, May 11, 2017.
• Executive Order 14028: Improving the Nation’s Cybersecurity, May 12, 2021.
• Federal Information Security Modernization Act of 2014 (44 U.S.C. § 3551 et seq.), December 18, 2014.
• FIPS 200: Minimum Security Requirements for Federal Information and Information Systems, March 2006.
• NARA Bulletin 2023-02: Expanding the Use of a Role-Based Approach (Capstone) for Electronic Messages: Expanding the Use of a Role-Based Approach (Capstone) for Electronic Messages, January 5, 2023.
• NIST Cybersecurity Framework 2.0, February 26, 2024.
• NIST IR 8547: Transition to Post-Quantum Cryptography Standards, November 12, 2024.
• NIST SP 800-37 Rev. 2: Risk Management Framework for Information Systems and Organizations, December 2018.
• NIST SP 800-53 Rev. 5: Security and Privacy Controls for Information Systems and Organizations, September 2020.
• NIST SP 800-53B: Control Baselines for Information Systems and Organizations, September 2020.
• OMB Circular A-123: Management’s Responsibility for Internal Control, March 10, 2026.
• OMB Circular A-130: Managing Information as a Strategic Resource, July 28, 2016.
• OMB M-22-01: Improving Detection of Cybersecurity Vulnerabilities and Incidents on Federal Government Systems through Endpoint Detection and Response (EDR), October 8, 2021.
• OMB M-23-02: Migrating to Post-Quantum Cryptography, November 18, 2022.
• OMB M-26-15: Execution of the Migration to Post-Quantum Cryptography, June 24, 2026.