SI-3: Malicious Code Protection

Quick-reference card

What this control requires

SI-03 requires organizations to deploy malicious code protection at every system entry and exit point, using both signature-based and behavioral detection. Most security teams treat malware protection as a solved problem, but the control goes well beyond installing antivirus software. It mandates a layered, actively managed defense that covers detection, automated response, and continuous updates.

In practice, this control means you need protection mechanisms at firewalls, remote access servers, email servers, web servers, proxy servers, workstations, and mobile devices. You must configure both periodic scans and real-time scans of files from external sources. When the system detects malicious code, it must automatically block or quarantine the threat, take a defined response action, and send alerts to designated personnel. Your organization also needs a documented process for handling false positives so that legitimate operations aren’t disrupted.

The requirement to support non-signature-based detection is critical. Malicious code today includes polymorphic malware that changes its structure to evade signature matching, fileless attacks that operate entirely in memory, and threats concealed through steganography or compressed archives. Signature-based tools alone can’t keep pace. SI-03 explicitly calls for heuristic, behavioral, reputation-based, or AI-driven detection methods alongside traditional signatures, with automatic updates governed by your configuration management policy. This control is part of the NIST SP 800-53 System and Information Integrity family and applies across LOW, MODERATE, and HIGH baselines.

Why it matters

The most dangerous malware incidents don’t involve novel attack techniques. They exploit the gap between having protection software installed and having protection that detects current threats. Custom-modified malware variants routinely evade signature-based detection, and organizations that rely on signatures alone often discover breaches months after initial compromise.

Home Depot Point-of-Sale Malware breach

In April 2014, attackers used credentials stolen from a third-party vendor to access Home Depot’s network and deploy a custom variant of the BlackPOS memory-scraping malware onto point-of-sale terminals across stores in the United States and Canada. BlackPOS scraped payment card Track 1 and Track 2 data from RAM at the moment cards were swiped, the only point at which that data exists in plaintext.

Home Depot’s endpoint protection software from Symantec was running on the affected systems. The custom malware variant had been specifically modified to evade signature-based detection, and it operated undetected from April through September 2014, approximately five months, until an external tip prompted an investigation. By then, data from approximately 56 million payment cards had been collected and exfiltrated. (Krebs on Security)

The SI-03 failure was twofold. Home Depot relied on signature-based detection without behavioral analysis, and lacked the operational discipline to detect an active threat over a multi-month window. BlackPOS wasn’t novel in concept; the same malware family had been used against Target seven months earlier. But custom modification allowed it to evade the signatures in use. A $179.5 million class action settlement followed. SI-03 requires not just that malicious code protection be deployed, but that it be capable of detecting current threats and that its outputs be monitored and acted upon.

Malware doesn’t need to be sophisticated to succeed. It needs to outlast your detection capabilities. The following attack vectors represent the gaps that SI-03 is designed to close:

• Signature evasion through custom modification. Attackers take known malware families and modify them just enough to bypass signature databases, creating variants that existing definitions don’t recognize.
• Memory-resident and fileless threats. Malware types that operate entirely in RAM or leverage legitimate system tools leave no traditional file-based artifacts for scanners to detect.
• Delayed or manual definition updates. Organizations that don’t automate signature and detection-engine updates create windows where newly identified threats pass through undetected.
• Unmonitored alert queues. Detection tools that generate alerts no one reviews provide a false sense of security while threats persist on compromised systems.

How to implement

The most common implementation failure is treating malware protection as a deployment task rather than an operational program. Organizations install endpoint agents and consider SI-03 satisfied, but the control requires ongoing management of detection capabilities, update cadences, scan schedules, response actions, and alert monitoring.

For your organization

Start by mapping every system entry and exit point where malicious code could enter your environment. This mapping should include firewalls, email gateways, web proxies, remote access servers, workstations, laptops, and mobile devices. Each entry point needs a protection mechanism capable of both signature-based and behavioral detection.

Deploy endpoint detection and response (EDR) platforms on all endpoints, configured for both scheduled and real-time scanning. Scheduled scans should run at a defined frequency documented in your security plan. Real-time scanning must cover all files from external sources, including email attachments, web downloads, and removable media. Your EDR solution should support behavioral analysis, heuristic detection, and reputation-based assessment alongside traditional signature matching.

Configure automatic updates for all detection mechanisms. Updates should follow your configuration management policy and occur without manual intervention. Document the update frequency and verify that endpoints are receiving current definitions through regular compliance checks.

Define explicit response actions for detected threats. At minimum, configure your tools to block execution, quarantine the file, and generate an alert to designated security personnel. Establish escalation procedures so that alerts are reviewed within a defined timeframe, not just logged.

Build a false positive handling process. Without documented procedures for investigating and dispositioning false positives, security teams either ignore alerts entirely or waste cycles on benign detections. Your process should include criteria for suppression, a review cadence, and an approval workflow.

Avoid these common mistakes:

• Relying solely on signature-based detection without enabling behavioral or heuristic analysis
• Allowing definition updates to fall behind because automatic updates are disabled or blocked
• Generating alerts that no one monitors or investigates
• Running no false positive review process, leading to alert fatigue and missed detections

For your vendors

When assessing vendors against SI-03, your goal is to verify that their malware protection goes beyond basic antivirus deployment to include active management, behavioral detection, and monitored alerting.

Include these questions in your vendor security assessments:

• What anti-malware solutions are deployed across endpoints, servers, and network entry points?
• How frequently are malware signatures and detection engines updated, and are updates automated?
• Does the organization use behavioral, heuristic, or AI-based detection in addition to signatures?
• What is the incident response procedure when malware is detected on a system?
• How are false positives handled and documented?

Request the following evidence during assessments:

• Anti-malware policy documenting scope, scan schedules, update requirements, and response procedures
• Screenshots or exports of current scan configurations across representative endpoints
• Update logs showing signature and engine update frequency over the past 90 days
• Incident response records for any malware detections within the review period
• False positive disposition records

Watch for these red flags during vendor review:

• No behavioral or heuristic detection capabilities, only signature-based tools
• Manual-only update processes with no automated deployment
• No centralized alerting or monitoring for malware detections
• Inability to produce scan configuration evidence or update logs

Verify vendor claims by requesting recent scan reports that show both scheduled and real-time scan activity. Check update frequency logs against their stated policy to confirm that automated updates are functioning as described.

Evidence examples

Cross-framework mapping

Related controls

The following controls from the System and Information Integrity family and other NIST SP 800-53 families support or interact with SI-03:

• AC-04 — Information Flow Enforcement: Restricts how information moves between systems and security domains, limiting the pathways through which malicious code can propagate.
• AC-19 — Access Control for Mobile Devices: Governs mobile device security policies that determine whether malicious code protection is enforced on devices connecting to organizational networks.
• CM-03 — Configuration Change Control: Ensures changes to malicious code protection configurations, such as scan schedules or detection engine settings, follow an approved change management process.
• CM-08 — System Component Inventory: Maintains an accurate inventory of system components, enabling verification that all endpoints have malicious code protection mechanisms installed and operational.
• IR-04 — Incident Handling: Defines the response procedures triggered when malicious code protection mechanisms detect and alert on a threat.
• MA-03 — Maintenance Tools: Requires inspection and approval of maintenance tools brought into the environment, preventing introduction of malicious code through unauthorized software.
• MA-04 — Nonlocal Maintenance: Addresses security requirements for remote maintenance sessions, which represent potential entry points for malicious code if not properly protected.
• PL-09 — Central Management: Supports centralized management of malicious code protection mechanisms across the organization, ensuring consistent configuration and monitoring.
• RA-05 — Vulnerability Monitoring and Scanning: Complements malicious code protection by identifying vulnerabilities that malware could exploit for initial access or privilege escalation.
• SC-07 — Boundary Protection: Controls network boundary defenses at entry and exit points where SI-03 requires malicious code detection and blocking capabilities.

Frequently asked questions

What is NIST SP 800-53 SI-03?

SI-03 is the NIST SP 800-53 control that requires organizations to deploy malicious code protection mechanisms at system entry and exit points, using both signature-based and non-signature-based detection methods. The control mandates automatic updates of protection mechanisms, periodic and real-time scans of files from external sources, and defined response actions including blocking, quarantining, and alerting designated personnel. It also requires organizations to address the risk of false positives that could impact system availability.

What happens if SI-03 is not implemented?

Without SI-03 controls in place, malicious code can enter and persist in your environment undetected, leading to data exfiltration, system compromise, and extended dwell times measured in months. The absence of automated updates to malicious code protection mechanisms means your defenses fall behind as new malware variants emerge. Organizations that lack real-time scanning of files from external sources and fail to configure alert notifications leave themselves exposed to threats that signature-based detection alone cannot catch.

How do you audit SI-03?

Auditing SI-03 involves verifying that malicious code protection mechanisms are deployed at all identified system entry and exit points, with both signature-based and behavioral detection enabled. Auditors review configuration settings to confirm periodic scan schedules, real-time scan coverage, and automatic update compliance against the organization’s configuration management policy. They also examine records of actions taken in response to malicious code detections, alert routing to designated personnel, and the organization’s documented procedures for handling false positives.

What is the difference between signature-based and non-signature-based malware detection?

Signature-based detection compares files and code against a database of known malware signatures, identifying threats that match previously cataloged patterns. Non-signature-based detection uses behavioral analysis, heuristics, AI models, and reputation scoring to identify malicious activity based on how code behaves rather than what it looks like. SI-03 requires both approaches because polymorphic malware and custom-modified variants can evade signature databases, while behavioral detection can flag suspicious activity even when no matching signature exists.