System & Information Integrity
That flaws are fixed, malicious code is stopped, and systems are monitored for attacks and unauthorized use.
The 7 requirements, in plain language.
Identify, report, and correct system flaws in a timely manner
Provide protection from malicious code at designated locations within organizational systems
Monitor system security alerts and advisories and take action in response
Update malicious code protection mechanisms when new releases are available
Perform periodic scans of organizational systems and real-time scans of files from external sources as files are downloaded, opened, or executed
Monitor organizational systems, including inbound and outbound communications traffic, to detect attacks and indicators of potential attacks
Identify unauthorized use of organizational systems
One owner across the whole family — built, run, and proven.
Enclave builds these controls into the boundary as code; Cadence keeps them enforced between assessments; Attest proves them to the C3PAO against every objective.
See all fourteen families →Not sure which families your contract puts in scope?
A readiness check maps your environment to all 110 controls and tells you exactly where you stand.