NIST800 171 · Control 3.14.2 · Priority: critical · Component: System and Communications Protection

What this control covers

This control requires implementing malicious code protection mechanisms at system entry and exit points to detect and eradicate malicious code. It mandates updating these mechanisms as new releases become available, and configuring them to perform regular scans, real-time scans of external files, and take mitigation actions such as blocking or quarantining malicious code This control supports the Malicious Code Protection capability within the System and Communications Protection (3.14) family.

Why it matters

Vulnerabilities introduced in code are 100× cheaper to fix in development than in production; this control is the place where security shifts left.

How to implement

AWS

Use CodeBuild with VPC-isolated build environments and CodeArtifact for an internal package mirror so builds don't pull straight from the public registry. Sign artefacts with AWS Signer.

Azure

Use Azure DevOps Pipelines with mandatory approvals on production environments and Microsoft Defender for DevOps for secret scanning across GitHub/ADO/GitLab in one pane.

GitHub

Apply branch protection on default and release branches: require PR review, status checks, signed commits, linear history, and dismiss stale reviews on new commits. Use CODEOWNERS for required reviewers, Dependabot + CodeQL for SAST, and the Dependency graph / SBOM export for vendor disclosures.

Evidence to collect

  • code_repo_scan — See the iCompaas Evidence library for the canonical source for this evidence type.

Source control pipelines (GitHub, GitLab) enforce SDLC guardrails. Focus: Malicious Code Protection.

Quick checklist

  • Time — Time / Security
  • Protection — Time / Security
  • System — Time / Security
  • Security — Time / Security
  • Malicious — Time / Security
  • External — Time / Security

Related articles on this site