SI-7 The information system detects unauthorized changes to The organization employs automated Software and Information software and information. tools that provide notification to Integrity (1) The organization reassesses the integrity of software designated individuals upon discovering and information by performing [Assignment: discrepancies during integrity organization-defined frequency] integrity of the verification. information system. SI-8 The organization: The organization centrally manages Spam Protection Employs spam protection mechanisms at information spam protection mechanisms. system entry and exit points and at workstations, servers, or mobile computing devices on the network to detect and take action on unsolicited messages transported by electronic mail, electronic mail attachments, web accesses, or other common means; and Updates spam protection mechanisms (including signature definitions) when new releases are available in accordance with organizational configuration management policy and procedures. SI-9 The organization restricts the capability to input information to Information the information system to authorized personnel. Restrictions SI-10 The information system checks the validity of information Information inputs. Validation SI-11 The information system: Error Handling Identifies potentially security-relevant error conditions; Generates error messages that provide information necessary for corrective actions without revealing [Assignment: organization-defined sensitive or potentially harmful information] in error logs and administrative messages that could be exploited by adversaries; and Reveals error messages only to authorized personnel. SI-12 The organization handles and retains both information Information Output within and output from the information system in Handling and Retention accordance with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and operational requirements.
SI-7 Software and Information Integrity The information system detects unauthorized changes to software and information. (1) The organization reassesses the integrity of software and information by performing [Assignment: organization-defined frequency] integrity of the information system. The organization employs automated tools that provide notification to designated individuals upon discovering discrepancies during integrity verification. SI-8 Spam Protection The organization: Employs spam protection mechanisms at information system entry and exit points and at workstations, servers, or mobile computing devices on the network to detect and take action on unsolicited messages transported by electronic mail, electronic mail attachments, web accesses, or other common means; and Updates spam protection mechanisms (including signature definitions) when new releases are available in accordance with organizational configuration management policy and procedures. The organization centrally manages spam protection mechanisms. SI-9 Information Restrictions The organization restricts the capability to input information to the information system to authorized personnel. SI-10 Information Validation The information system checks the validity of information inputs. SI-11 Error Handling The information system: Identifies potentially security-relevant error conditions; Generates error messages that provide information necessary for corrective actions without revealing [Assignment: organization-defined sensitive or potentially harmful information] in error logs and administrative messages that could be exploited by adversaries; and Reveals error messages only to authorized personnel. SI-12 Information Output Handling and Retention The organization handles and retains both information within and output from the information system in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and operational requirements.