# SI-08 Spam Protection

NIST SP 800-53 control. Family: SI System and Information Integrity. Function: preventative. Baselines: moderate, high. Mapping licence: CC BY-SA 4.0.

Statement: a. Employ spam protection mechanisms at system entry and exit points to detect and act on unsolicited messages; and b. Update spam protection mechanisms when new releases are available in accordance with organizational configuration management policy and procedures.
Guidance: System entry and exit points include firewalls, remote-access servers, electronic mail servers, web servers, proxy servers, workstations, notebook computers, and mobile devices. Spam can be transported by different means, including email, email attachments, and web accesses. Spam protection mechanisms include signature definitions.

## Enhancements (2)
- SI-08(02) Automatic Updates. Baselines: moderate, high
- SI-08(03) Continuous Learning Capability
Withdrawn by NIST: SI-08(01) (now in PL-09).
Each enhancement's statement: /api/v1/controls/SI-08?fields=enhancements

## Patterns that use it (1)
- Standard (1): SP-016 DMZ Module

## Clauses by framework (27 frameworks)
- iso_27001_2022: A.8.7. OSA's own, not in NIST's crosswalk: A.8.7
- iso_27002_2022: 8.7
- pci_dss_v4: 5.4
- cis_controls_v8: CIS 9, CIS 9.5, CIS 9.7, CIS 10
- bsi_grundschutz: OPS.1.1.4
- anssi: Hygiene.21, Hygiene.22, SecNumCloud.13.1
- osfi_b13: B-13.3.2, B-13.3.3
- finma_circular: IV.B.d(59), IV.C(64)
- gdpr: Art.32(1)(b)
- dora: Art.9(4)(b)
- bio2: 8.7
- rbi_csf: Annex1.10, Annex1.14
- mlps_2: 8.1.3.4
- dnb_good_practice: DNB.19.1
- nca_ecc: 2-4
- qatar_nia: CS
- cbe_csf: CTO-8
- sa_js2: JS2-8.4
- ffiec_is: II.C.12
- hipaa_sr: §164.308(a)(5)(ii)(B)
- iosco_cyber: DET-3
- sebi_cscrf: EMAIL-SEC
- cmmc_2: SI
- hitrust_csf: 09.c
- iso_27799: 12.2
- lloyds_ms: MS8.10
- nhs_dspt: NDG-9.3, NDG-9.4
OSA's mapping for iso_27001_2022 takes NIST's published crosswalk as its base. A clause not marked as OSA's own is in that crosswalk.

## More
- This control as JSON, with guidance and ATT&CK techniques: /api/v1/controls/SI-08
- Clauses only: /api/v1/controls/SI-08?fields=mappings
- Page for people: /controls/si-08/