STIGs RMF Controls Compare

STIGhub

A free tool to search and browse the entire DISA STIG library. Saves up to 75% in security compliance research time.

Navigation

Browse STIGs
Search
RMF Controls
Compare Versions

Resources

About
Release Notes
VPAT
DISA STIG Library

STIGs updated 4 hours ago

Powered by Pylon

© 2026 Beacon Cloud Solutions, Inc. All rights reserved.

← SI-3 — Malicious Code Protection

CCI-004964

Definition

Automatically update malicious code protection mechanisms as new releases are available in accordance with organizational configuration management policy.

Parent Control

SI-3Malicious Code ProtectionSystem and Information Integrity

Linked STIG Checks (18)

V-204968CAT IIThe ALG providing content filtering must update malicious code protection mechanisms and signature definitions whenever new releases are available in accordance with organizational configuration management procedures.Application Layer Gateway Security Requirements Guide V-239885CAT IIThe Cisco ASA must be configured to install updates for signature definitions and vendor-provided rules.Cisco ASA IPS Security Technical Implementation Guide V-239889CAT IIThe Cisco ASA must be configured to automatically install updates to signature definitions and vendor-provided rules.Cisco ASA IPS Security Technical Implementation Guide V-206892CAT IIThe IDPS must automatically update malicious code protection mechanisms as new releases are available in accordance with organizational configuration management policy.Intrusion Detection and Prevention Systems Security Requirements Guide V-214632CAT IIThe Juniper Networks SRX Series Gateway IDPS must automatically install updates to signature definitions.Juniper SRX Services Gateway IDPS Security Technical Implementation Guide V-205526CAT IIThe Mainframe Product must update malicious code protection mechanisms whenever new releases are available in accordance with organizational configuration management policy.Mainframe Product Security Requirements Guide V-213452CAT IMicrosoft Defender AV spyware definition age must not exceed 7 days.Microsoft Defender Antivirus Security Technical Implementation Guide V-213453CAT IMicrosoft Defender AV virus definition age must not exceed 7 days.Microsoft Defender Antivirus Security Technical Implementation Guide V-259694CAT IIExchange antimalware agent must be enabled and configured.Microsoft Exchange 2019 Mailbox Server Security Technical Implementation Guide V-259695CAT IIThe Exchange malware scanning agent must be configured for automatic updates.Microsoft Exchange 2019 Mailbox Server Security Technical Implementation Guide V-228851CAT IIThe Palo Alto Networks security platform must automatically update malicious code protection mechanisms.Palo Alto Networks ALG Security Technical Implementation Guide V-207697CAT IIThe Palo Alto Networks security platform must automatically install updates to signature definitions, detection heuristics, and vendor-provided rules.Palo Alto Networks IDPS Security Technical Implementation Guide V-213322CAT IIThe Trellix Application Control Options Advanced Threat Defense (ATD) settings, if being used, must be confined to the organizations enclave.Trellix Application Control 8.x Security Technical Implementation Guide V-213330CAT IIThe Trellix Application Control Options Reputation setting must be configured to use the Trellix Global Threat Intelligence (Trellix GTI) option.Trellix Application Control 8.x Security Technical Implementation Guide V-213332CAT IIThe Trellix Application Control Options Advanced Threat Defense (ATD) settings must not be enabled unless an internal ATD is maintained by the organization.Trellix Application Control 8.x Security Technical Implementation Guide V-213333CAT IIThe Trellix Application Control Options Advanced Threat Defense (ATD) settings, if being used, must be configured to send all binaries with a reputation of Might be Trusted and below for analysis.Trellix Application Control 8.x Security Technical Implementation Guide V-213334CAT IIThe Trellix Application Control Options Advanced Threat Defense (ATD) settings, if being used, must be configured to only send binaries with a size of 5MB or less.Trellix Application Control 8.x Security Technical Implementation Guide V-242196CAT IIThe TPS must automatically install updates to signature definitions, detection heuristics, and vendor-provided rules.Trend Micro TippingPoint IDPS Security Technical Implementation Guide