id: "SI-08" title: "Spam Protection" family: "SI" family_name: "System and Information Integrity" sort_id: "si-08" priority: "P1" implementation_level: "organization" enhancements: - si-8.1 - si-8.2 - si-8.3
Employ spam protection mechanisms at system entry and exit points to detect and act on unsolicited messages; and
Update spam protection mechanisms when new releases are available in accordance with organizational configuration management policy and procedures.
Guidance
System entry and exit points include firewalls, remote-access servers, electronic mail servers, web servers, proxy servers, workstations, notebook computers, and mobile devices. Spam can be transported by different means, including email, email attachments, and web accesses. Spam protection mechanisms include signature definitions.
Assessment Objective: spam protection mechanisms are employed at system entry points to detect unsolicited messages;
Assessment Objective: spam protection mechanisms are employed at system exit points to detect unsolicited messages;
Assessment Objective: spam protection mechanisms are employed at system entry points to act on unsolicited messages;
Assessment Objective: spam protection mechanisms are employed at system exit points to act on unsolicited messages;
Assessment Objective: spam protection mechanisms are updated when new releases are available in accordance with organizational configuration management policies and procedures.
System and information integrity policy
system and information integrity procedures
configuration management policies and procedures (CM-01)
procedures addressing spam protection
spam protection mechanisms
records of spam protection updates
system design documentation
system configuration settings and associated documentation
system audit records
system security plan
other relevant documents or records
Organizational personnel responsible for spam protection
organizational personnel with information security responsibilities
system/network administrators
system developer
Organizational processes for implementing spam protection
mechanisms supporting and/or implementing spam protection