{"data":{"id":"SI-08","name":"Spam Protection","family":"SI","family_name":"System and Information Integrity","withdrawn":false,"description":"a. Employ spam protection mechanisms at system entry and exit points to detect and act on unsolicited messages; and\nb. Update spam protection mechanisms when new releases are available in accordance with organizational configuration management policy and procedures.","supplemental_guidance":"System entry and exit points include firewalls, remote-access servers, electronic mail servers, web servers, proxy servers, workstations, notebook computers, and mobile devices. Spam can be transported by different means, including email, email attachments, and web accesses. Spam protection mechanisms include signature definitions.","enhancements":[{"id":"SI-08(01)","name":"Central Management","withdrawn":true,"incorporated_into":["PL-09"]},{"id":"SI-08(02)","name":"Automatic Updates","statement":"Automatically update spam protection mechanisms [Assignment: organization-defined frequency].","baselines":["moderate","high"]},{"id":"SI-08(03)","name":"Continuous Learning Capability","statement":"Implement spam protection mechanisms with a learning capability to more effectively identify legitimate communications traffic.","baselines":[]}],"baseline_low":false,"baseline_moderate":true,"baseline_high":true,"nist_800_53":{"rev5":{"id":"SI-08","name":"Spam Protection","description":"a. Employ spam protection mechanisms at system entry and exit points to detect and act on unsolicited messages; and\nb. Update spam protection mechanisms when new releases are available in accordance with organizational configuration management policy and procedures.","discussion":"System entry and exit points include firewalls, remote-access servers, electronic mail servers, web servers, proxy servers, workstations, notebook computers, and mobile devices. Spam can be transported by different means, including email, email attachments, and web accesses. Spam protection mechanisms include signature definitions.","related_controls":["PL-09","SC-05","SC-07","SC-38","SI-03","SI-04"],"baseline_low":false,"baseline_moderate":true,"baseline_high":true,"baseline_privacy":false,"new_in_rev5":false,"changes_from_rev4":""}},"compliance_mappings":{"iso_27001_2022":["A.8.7"],"iso_27002_2022":["8.7"],"cobit_2019":[],"pci_dss_v4":["5.4"],"nist_csf_2":[],"cis_controls_v8":["CIS 9","CIS 9.5","CIS 9.7","CIS 10"],"soc2_tsc":[],"finos_ccc":[],"iso_42001_2023":[],"iec_62443":[],"asd_e8":[],"nis2":[],"apra_cps_234":[],"mas_trm":[],"pra_op_resilience":[],"bsi_grundschutz":["OPS.1.1.4"],"anssi":["Hygiene.21","Hygiene.22","SecNumCloud.13.1"],"osfi_b13":["B-13.3.2","B-13.3.3"],"finma_circular":["IV.B.d(59)","IV.C(64)"],"gdpr":["Art.32(1)(b)"],"dora":["Art.9(4)(b)"],"bio2":["8.7"],"rbi_csf":["Annex1.10","Annex1.14"],"fisc":[],"lgpd_bcb":[],"hkma_tme1":[],"mlps_2":["8.1.3.4"],"dnb_good_practice":["DNB.19.1"],"cra":[],"swift_cscf":[],"nca_ecc":["2-4"],"qatar_nia":["CS"],"cbe_csf":["CTO-8"],"sa_js2":["JS2-8.4"],"ffiec_is":["II.C.12"],"hipaa_sr":["§164.308(a)(5)(ii)(B)"],"iosco_cyber":["DET-3"],"sebi_cscrf":["EMAIL-SEC"],"cmmc_2":["SI"],"nerc_cip":[],"nrc_73_54":[],"tsa_psd":[],"ieee_1686":[],"ferc_cip":[],"doe_c2m2":[],"api_1164":[],"awia":[],"iaea_nss":[],"pci_pts":[],"fips_140":[],"cbest":[],"tiber_eu":[],"pci_hsm":[],"common_criteria":[],"isae_3402":[],"fca_sysc_13":[],"fda_21_cfr_11":[],"fda_cyber":[],"hitrust_csf":["09.c"],"iso_27799":["12.2"],"lloyds_ms":["MS8.10"],"naic_ds":[],"nhs_dspt":["NDG-9.3","NDG-9.4"],"pra_ss1_23":[],"solvency_ii":[],"owasp_masvs_v2":[],"csa_ccm_v4":[],"csa_aicm":[],"ccss_v9":[],"mica":[],"basel_sco60":[],"bssc":[],"sec_custody_digital":[],"dpdpa":[]},"attack_techniques":[{"id":"T1137","name":"Office Application Startup","tactics":["persistence"],"mapping_type":"mitigates","mapping_rationale":"Spam protection mechanisms that filter malicious email content detect and block messages containing Office application startup payloads—malicious macros, add-ins, and template attachments—before they reach user inboxes."},{"id":"T1204","name":"User Execution","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"Spam protection that identifies and quarantines unsolicited messages containing social engineering lures reduces the volume of malicious content reaching users, limiting opportunities for adversary-triggered user execution."},{"id":"T1221","name":"Template Injection","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Spam filtering that detects messages with template injection payloads—documents configured to load remote templates—blocks delivery of malicious template injection attacks through email."},{"id":"T1566","name":"Phishing","tactics":["initial-access"],"mapping_type":"mitigates","mapping_rationale":"Spam protection mechanisms deployed at email gateways and mail servers directly filter phishing messages, reducing the volume of malicious emails that reach end users for initial access attempts."},{"id":"T1598","name":"Phishing for Information","tactics":["reconnaissance"],"mapping_type":"mitigates","mapping_rationale":"Spam filtering that identifies and blocks unsolicited information-gathering messages prevents adversaries from delivering phishing-for-information campaigns at scale through email channels."},{"id":"T1137.001","name":"Office Template Macros","tactics":["persistence"],"mapping_type":"mitigates","mapping_rationale":"Spam protection that detects and quarantines emails with malicious Office template macro attachments prevents delivery of persistence payloads that install through Office template startup mechanisms."},{"id":"T1137.002","name":"Office Test","tactics":["persistence"],"mapping_type":"mitigates","mapping_rationale":"Spam filtering that blocks emails containing payloads designed to modify Office Test registry paths prevents delivery of Office Test persistence mechanisms through email-borne attacks."},{"id":"T1137.003","name":"Outlook Forms","tactics":["persistence"],"mapping_type":"mitigates","mapping_rationale":"Spam protection that identifies and blocks messages carrying malicious Outlook form payloads prevents adversaries from distributing form-based persistence mechanisms through spam campaigns."},{"id":"T1137.004","name":"Outlook Home Page","tactics":["persistence"],"mapping_type":"mitigates","mapping_rationale":"Spam filtering that detects emails designed to exploit Outlook Home Page features blocks delivery of messages that configure malicious HTML content in Outlook folder home pages."},{"id":"T1137.005","name":"Outlook Rules","tactics":["persistence"],"mapping_type":"mitigates","mapping_rationale":"Spam protection that identifies and quarantines messages containing embedded Outlook rule configurations prevents adversaries from establishing persistent mail rules through spam delivery."},{"id":"T1137.006","name":"Add-ins","tactics":["persistence"],"mapping_type":"mitigates","mapping_rationale":"Spam filtering that detects emails with malicious Office add-in payloads prevents adversaries from distributing persistent add-in-based backdoors through unsolicited email campaigns."},{"id":"T1204.001","name":"Malicious Link","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"Spam protection that identifies and rewrites or blocks malicious URLs in unsolicited messages prevents adversaries from delivering malicious links that trigger user execution through spam campaigns."},{"id":"T1204.002","name":"Malicious File","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"Spam filtering that detects and quarantines messages with malicious file attachments prevents adversaries from delivering executable payloads that rely on user execution through email spam."},{"id":"T1204.003","name":"Malicious Image","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"Spam protection that identifies messages promoting malicious container images or software downloads prevents adversaries from distributing trojaned images through unsolicited email campaigns."},{"id":"T1566.001","name":"Spearphishing Attachment","tactics":["initial-access"],"mapping_type":"mitigates","mapping_rationale":"Spam filtering at email gateways that detects spearphishing attachments—malicious documents, executables, archives—prevents targeted phishing payloads from reaching intended recipients."},{"id":"T1566.002","name":"Spearphishing Link","tactics":["initial-access"],"mapping_type":"mitigates","mapping_rationale":"Spam protection that identifies and blocks spearphishing messages containing malicious links prevents adversaries from delivering credential harvesting or malware delivery URLs through targeted email."},{"id":"T1566.003","name":"Spearphishing via Service","tactics":["initial-access"],"mapping_type":"mitigates","mapping_rationale":"Spam filtering that extends to messaging platforms and social media services detects and blocks phishing attempts delivered through non-email communication channels used by adversaries."},{"id":"T1598.001","name":"Spearphishing Service","tactics":["reconnaissance"],"mapping_type":"mitigates","mapping_rationale":"Spam protection that identifies unsolicited information-gathering messages delivered through social platforms prevents adversaries from conducting phishing-for-information through third-party services."},{"id":"T1598.002","name":"Spearphishing Attachment","tactics":["reconnaissance"],"mapping_type":"mitigates","mapping_rationale":"Spam filtering that detects reconnaissance-phase spearphishing attachments—documents requesting information or establishing rapport—prevents adversaries from gathering target intelligence through email."},{"id":"T1598.003","name":"Spearphishing Link","tactics":["reconnaissance"],"mapping_type":"mitigates","mapping_rationale":"Spam protection that identifies and blocks reconnaissance spearphishing links designed to track recipient behavior or harvest preliminary intelligence prevents adversary information gathering."}],"metadata":{"last_reviewed":"2026-10-03","review_notes":"2026-10-03: baselines LMH to -MH, from NIST SP 800-53B Release 5.2.0.","mapping_status":"complete"},"function":"preventative","used_by_patterns":["SP-016"]}}