SI-08 Spam Protectionsi-8
Whether an AWS call fetches evidence for this control, and what to run. Its Rev5 baselines, the indicators that reach it and the FedRAMP guidance attached to it open below.
Nothing names itNo recipe names SI-08. 3 reach an indicator it shares, which is adjacency and not coverage — worth reading, not worth recording as evidence for this control.
Collect evidence (0)
Authored AWS recipes whose output is evidence for SI-08. This mapping is this project’s opinion (overlay v3.0.0), versioned separately from the dataset — the upstream FedRAMP rules name none of these tools.
No authored recipe names SI-08. The nearest authored work is below.
Nobody has assessed SI-08 against AWS and pipeline yet. That is a gap in this project’s research — not a finding about the control, and not a claim that nothing collects it.
The KSIs that reach it are KSI-CNA-RNT, KSI-CNA-RVP — that is where the authoring would land. Browse /collect for the whole authored corpus.
Reaches the same indicator, not SI-08
These recipes prove a KSI that reaches it. None of them claims SI-08 — treat them as neighbours worth reading, not as coverage.
- Config compliance results proving the ports you declared unnecessary are not reachable from the internet and the software you declared prohibited is not installed, plus the actual installed-application set a periodic review has to read via KSI-CNA-RNT
- Every route in or out of the boundary, named and counted — internet gateways, NAT gateways, VPC endpoints and Site-to-Site VPN tunnels — alongside what each boundary device does with traffic that matched no rule: the network ACL entries, the closed default security group, subnets that hand out public IPs, and the firewall policy's stateless and stateful default actions via KSI-CNA-RNT
- The denial-of-service defences that are actually attached to the internet-facing resources — the Shield Advanced subscription and the list of resources it protects, the web ACL's rate-based rules and their limits, whether web ACL logging is on — plus what those defences observed: the attacks Shield recorded over the period and the CloudWatch detection and block counts underneath them via KSI-CNA-RVP
What NIST requires of SI-08
The control statement from NIST 800-53 Rev5, verbatim. Square brackets are organization-defined parameters — yours to set, not FedRAMP's to dictate.
a. Employ spam protection mechanisms at system entry and exit points to detect and act on unsolicited messages; and b. Update spam protection mechanisms when new releases are available in accordance with organizational configuration management policy and procedures.
NIST SP 800-53 Rev5 catalog 5.2.0, from usnistgov/oscal-content at 78650f0. The FedRAMP dataset carries no control text; this is borrowed and pinned.
Rev5 baseline membership
Membership is the whole relationship — a baseline is a set of control ids. Class A carries no baseline at all. The Low/Moderate/High labels are an interpretation from control counts, not a dataset fact.
KSI indicators reaching this control (2)
Under 20x, these indicators are how this control is demonstrated — automated KSI evidence stands in for narrative control evidence.
- CNAKSI-CNA-RNTRestricting Network Traffic
Machine-based information resources are persistently reviewed to ensure they are appropriately configured to limit inbound and outbound network traffic.
- CNAKSI-CNA-RVPReviewing Protections
The effectiveness of protection against denial of service attacks and other unwanted activity for machine-based information resources is persistently reviewed.
FedRAMP guidance & parameters
Where you read the rule. Guidance names an FRR document, never a clause, so the links below offer the whole document and leave the reading to you.
- When CSO sends email on behalf of the government as part of the business offering, Control Description should include implementation of Domain-based Message Authentication, Reporting & Conformance (DMARC) on the sending domain for outgoing messages as described in DHS Binding Operational Directive (BOD) 18-01. https://www.cisa.gov/news-events/directives
- SI-8 Guidance: CSPs should confirm DMARC configuration (where appropriate) to ensure that policy=reject and the rua parameter includes reports@dmarc.cyber.dhs.gov. DMARC compliance should be documented in the SI-08 control implementation solution description, and list the FROM: domain(s) when emails are sent on behalf of the government.
Pages exist for the 209 controls reached by at least one KSI. Baseline-only controls are the orphans on /coverage. Control titles and full text live in the NIST catalog, not this dataset.