SI-15 asks you to validate information output from the programs you name, so that what comes out is consistent with the expected content. It is the mirror image of input validation in SI-10.
800-53 binds federal systems and contractors. For product teams it is a way to talk about data leakage controls in applications.
What it means in practice
NIST gives SQL injection as an example. Some attacks produce results that are unexpected, such as a query returning far more rows than normal. Output filtering detects that extra content, stops it from being displayed, and alerts monitoring tools that something odd happened.
In practice that can mean response size limits, schema checked responses, masking of sensitive fields, and alerts on abnormal result counts.
Evidence to collect
- Output validation rules, such as response schemas or serializers that allow only listed fields.
- Configuration for masking or redaction.
- Alert rules for abnormal response size or row counts.
- A test showing an unexpected output is blocked and alerted.
Common gaps
APIs that return whole database objects and rely on the client to hide fields. No alerting on unusual volumes of output.
How to implement it
Return only listed fields, cap result sizes, and send anomalies to the same monitoring you use for other alerts.
Quick check
What does NIST say output filtering should do besides block extra content?
Alert monitoring tools that anomalous behavior was discovered.
