# SI-15 Information Output Filtering

NIST SP 800-53 control. Family: SI System and Information Integrity. Function: preventative. In no baseline. Mapping licence: CC BY-SA 4.0.

Statement: Validate information output from the following software programs and/or applications to ensure that the information is consistent with the expected content: [Assignment: organization-defined software programs and/or applications].
Guidance: Certain types of attacks, including SQL injections, produce output results that are unexpected or inconsistent with the output results that would be expected from software programs or applications. Information output filtering focuses on detecting extraneous content, preventing such extraneous content from being displayed, and then alerting monitoring tools that anomalous behavior has been discovered.

## Patterns that use it (2)
- Important (2): SP-028 Secure DevOps Pipeline Pattern; SP-030 API Security

## Clauses by framework (10 frameworks)
- cobit_2019: DSS06
- rbi_csf: Annex1.6
- cbuae: CR-6
- bog_cisd: CISD-SDLC
- cbe_csf: CTO-4
- sa_js2: JS2-SA
- bcbs_239: Principle 3, Principle 7, Principle 9
- hitrust_csf: 10.b
- pra_ss1_23: P3.2
- basel_sco60: SCO60.70, SCO60.72

## More
- This control as JSON, with guidance and ATT&CK techniques: /api/v1/controls/SI-15
- Clauses only: /api/v1/controls/SI-15?fields=mappings
- Page for people: /controls/si-15/
- Found an error? Open an issue at https://github.com/opensecurityarchitecture/osa-data/issues with the id, what OSA says and what the source says.