SI-8 asks you to employ spam protection at system entry and exit points to detect and act on unsolicited messages, and to update those mechanisms when new releases are available under your configuration management process. NIST 800-53 binds US federal systems and, by contract, some others. It is a common reference for everyone else.
What it means in practice
The guidance lists entry and exit points: firewalls, remote access servers, mail servers, web servers, proxies, workstations, notebooks and mobile devices. Spam travels by email, attachments and web access. Mechanisms include signature definitions.
For most companies that means a filtering layer on the mail platform, plus any web or endpoint filtering that blocks unsolicited content.
Evidence to collect
- Screenshots or exported settings of the mail filter, including quarantine and action rules.
- Proof that definitions or rules update automatically, or the update schedule.
- Reports of blocked and quarantined volume.
- The process for handling false positives.
Common gaps
- Filtering on inbound mail only, with nothing on outbound.
- Updates that depend on a person remembering.
- Allow lists that grew without review.
How to implement it
Turn on the filtering built into your mail provider, set automatic updates, review allow lists quarterly, and export a monthly report. The enhancements add central management (SI-8.1), automatic updates (SI-8.2) and continuous learning (SI-8.3) if you want more.
Quick check
Does SI-8 cover phishing?
It addresses unsolicited messages. Phishing overlaps, but many programs treat it under malicious code and awareness controls too.
