id: "SI-03(04)" title: "Updates Only by Privileged Users" family: "SI" family_name: "System and Information Integrity" sort_id: "si-03.04" priority: "P1" implementation_level: "system" parent: "SI-03" enhancement: True
Statement
Update malicious code protection mechanisms only when directed by a privileged user.
Guidance
Protection mechanisms for malicious code are typically categorized as security-related software and, as such, are only updated by organizational personnel with appropriate access privileges.
Assessment Objective
malicious code protection mechanisms are updated only when directed by a privileged user.
System and information integrity policy
system and information integrity procedures
procedures addressing malicious code protection
list of privileged users on system
system design documentation
malicious code protection mechanisms
records of malicious code protection updates
system configuration settings and associated documentation
system audit records
system security plan
other relevant documents or records
System/network administrators
organizational personnel with information security responsibilities
system developers
organizational personnel installing, configuring, and/or maintaining the system
organizational personnel responsible for malicious code protection
Mechanisms supporting and/or implementing malicious code protection capabilities