---

id: "SI-03(06)" title: "Testing and Verification" family: "SI" family_name: "System and Information Integrity" sort_id: "si-03.06" priority: "P1" implementation_level: "organization" parent: "SI-03" enhancement: True

---

Test malicious code protection mechanisms {{ insert: param, si-03.06_odp }} by introducing known benign code into the system; and

Verify that the detection of the code and the associated incident reporting occur.

Guidance

None.

Assessment Objective: malicious code protection mechanisms are tested {{ insert: param, si-03.06_odp }} by introducing known benign code into the system;

Assessment Objective: the detection of (benign test) code occurs;

Assessment Objective: the associated incident reporting occurs.

System and information integrity policy

system and information integrity procedures

procedures addressing malicious code protection

system design documentation

system configuration settings and associated documentation

test cases

records providing evidence of test cases executed on malicious code protection mechanisms

system audit records

system security plan

other relevant documents or records

System/network administrators

organizational personnel with information security responsibilities

organizational personnel installing, configuring, and/or maintaining the system

organizational personnel responsible for malicious code protection

Mechanisms supporting and/or implementing the testing and verification of malicious code protection capabilities