NIST 800-171 - Scanning for Malicious Code (3.14.5)

Overview:
Perform periodic scans of the information system and real-time scans of files from external sources as files are downloaded, opened, or executed.

Action Items:
3.14.5[a]
Determine if: the frequency for malicious code scans is defined.

3.14.5[b]
Determine if: malicious code scans are performed with the defined frequency.

3.14.5[c]
Determine if: real-time malicious code scans of files from external sources as files are downloaded, opened, or executed are performed.

POTENTIAL ASSESSMENT METHODS AND OBJECTS

1
Examine: System and information integrity policy; configuration management policy and procedures; procedures addressing malicious code protection; malicious code protection mechanisms; records of malicious code protection updates; system security plan; system design documentation; system configuration settings and associated documentation; scan results from malicious code protection mechanisms; record of actions initiated by malicious code protection mechanisms in response to malicious code detection; system audit logs and records; other relevant documents or records].

2
Interview: System or network administrators; personnel with information security responsibilities; personnel installing, configuring, and maintaining the system; personnel with responsibility for malicious code protection; personnel with configuration management responsibility].

3
Test: Organizational processes for employing, updating, and configuring malicious code protection mechanisms; organizational process for addressing false positives and resulting potential impact; mechanisms supporting or implementing malicious code protection mechanisms (including updates and configurations); mechanisms supporting or implementing malicious code scanning and subsequent actions].

Related Documents (document name and content will vary by organization):
1) System and information integrity policy
2) configuration management policy and procedures
3) procedures addressing malicious code protection
4) malicious code protection mechanisms
5) records of malicious code protection updates
6) system security plan
7) system design documentation
8) system configuration settings and associated documentation
9) scan results from malicious code protection mechanisms
10) record of actions initiated by malicious code protection mechanisms in response to malicious code detection
11) system audit logs and records
12) other relevant documents or records

Additional Guidance:
See discussion for 3.14.2.