Back to Control Explorer
SI.1.212
Content
Control Acronym
SI
Family
System And Information Integrity
CMMC Level
1
800-171 Control #
3.14.4
CMMC Description
Update malicious code protection mechanisms when new releases are available.
CMMC Clarification
You can protect your company’s valuable IT systems by staying up to date on new security releases that stop malicious code and monitoring the system regularly. Malicious code is program code that is always changing, so it is important to always have up-to-date protections, such as anti-malware tools. Example You bought a new computer for your small business. You know that you need to protect your company’s information from viruses, spyware, etc. So, you also purchased and installed antimalware software. You configure the software to automatically update to the latest antivirus code and definitions of all known malware.
800-171 Description
Update malicious code protection mechanisms when new releases are available.
800-171 Discussion
Malicious code protection mechanisms include anti-virus signature definitions and reputation- based technologies. A variety of technologies and methods exist to limit or eliminate the effects of malicious code. Pervasive configuration management and comprehensive software integrity controls may be effective in preventing execution of unauthorized code. In addition to commercial off-the-shelf software, malicious code may also be present in custom-built software. This could include logic bombs, back doors, and other types of cyber-attacks that could affect organizational missions/business functions. Traditional malicious code protection mechanisms cannot always detect such code. In these situations, organizations rely instead on other safeguards including secure coding practices, configuration management and control, trusted procurement processes, and monitoring practices to help ensure that software does not perform functions other than the functions intended.
Other Source Discussion
N/A
CIS Control References
CIS Controls v7.1 8.2
NIST 800-53 Control Ref.
NIST SP 800-53 Rev 4 SI-3
CMMC Derived
NIST CSF Control References
NIST CSF v1.1 DE.CM-4
NIST 800-171 References
NIST SP 800-171 Rev 1 3.14.4
Applicable FAR Clause
FAR Clause 52.204-21 b.1.xiv
NIST CSF Control Reference
CERT RMM Reference
CERT RMM v1.2 VAR:SG3.SP1
Modification of NIST 800-171B Reference
NIST 800-171B Reference
UK NCSCCyber Reference
AS ACSC Reference
Sub-Criterias
Assessment Sub-Criteria 1
SI.1.212.[a] malicious code protection mechanisms are updated when new releases are available.