1. Home
  2. FedRAMP
  3. SI-8

BRACKETOLOGY | FEDRAMP

SI-8: SPAM PROTECTION

  • FedRAMP Baseline Membership SI-8:
  • MODERATE
  • HIGH

FedRAMP Bracketology

Use the FedRAMP Control Membership information above to determine if a control or control enhancement is required for each Impact Baseline — LOW, MODERATE, or HIGH

Click on the panel below each control or control enhancement to review the FedRAMP Impact Baseline-specific control configuration requirements for each of the [BRACKETS] in each control and/or control enhancement.

Review and use Additional Requirements and Guidance to build FedRAMP-compliant controls for your risk-based cybersecurity program.

To change the baseline view in the panel, click on LOW, MODERATE, or HIGH when the panel is open

Panels only appear where there are [BRACKETS] in the control or enhancement or where there is FedRAMP-specific requirements or guidance available.

The organization:

    • a. Employs spam protection mechanisms at information system entry and exit points to detect and take action on unsolicited messages; and
    • b. Updates spam protection mechanisms when new releases are available in accordance with organizational configuration management policy and procedures.

SUPPLEMENTAL GUIDANCE

Information system entry and exit points include, for example, firewalls, electronic mail servers, web servers, proxy servers, remote-access servers, workstations, mobile devices, and notebook/laptop computers. Spam can be transported by different means including, for example, electronic mail, electronic mail attachments, and web accesses. Spam protection mechanisms include, for example, signature definitions.

CONTROL ENHANCEMENTS

SI-8 (1) SPAM PROTECTION | CENTRAL MANAGEMENT
  • FedRAMP Baseline Membership SI-8 (1):
  • MODERATE
  • HIGH

The organization centrally manages spam protection mechanisms.

Supplemental Guidance:

Central management is the organization-wide management and implementation of spam protection mechanisms. Central management includes planning, implementing, assessing, authorizing, and monitoring the organization-defined, centrally managed spam protection security controls.

RELATED CONTROLS: SI-8 (1)

SI-8 (2) SPAM PROTECTION | AUTOMATIC UPDATES
  • FedRAMP Baseline Membership SI-8 (2):
  • MODERATE
  • HIGH

FedRAMP Bracketology

Use the FedRAMP Control Membership information above to determine if a control or control enhancement is required for each Impact Baseline — LOW, MODERATE, or HIGH

Click on the panel below each control or control enhancement to review the FedRAMP Impact Baseline-specific control configuration requirements for each of the [BRACKETS] in each control and/or control enhancement.

Review and use Additional Requirements and Guidance to build FedRAMP-compliant controls for your risk-based cybersecurity program.

To change the baseline view in the panel, click on LOW, MODERATE, or HIGH when the panel is open

Panels only appear where there are [BRACKETS] in the control or enhancement or where there is FedRAMP-specific requirements or guidance available.

The information system automatically updates spam protection mechanisms.

Supplemental Guidance: NONE

SI-8 (3) SPAM PROTECTION | CONTINUOUS LEARNING CAPABILITY

The information system implements spam protection mechanisms with a learning capability to more effectively identify legitimate communications traffic.

Supplemental Guidance:

Learning mechanisms include, for example, Bayesian filters that respond to user inputs identifying specific traffic as spam or legitimate by updating algorithm parameters and thereby more accurately separating types of traffic.

REFERENCES:

  • NIST Special Publication 800-45