SI-10 — Information Input Validation

Official NIST control content

Control statement

Check the validity of the following information inputs: [Organization-defined: information inputs].

Official NIST discussion

Discussion

Checking the valid syntax and semantics of system inputs—including character set, length, numerical range, and acceptable values—verifies that inputs match specified definitions for format and content. For example, if the organization specifies that numerical values between 1-100 are the only acceptable inputs for a field in a given application, inputs of "387," "abc," or "%K%" are invalid inputs and are not accepted as input to the system. Valid inputs are likely to vary from field to field within a software application. Applications typically follow well-defined protocols that use structured messages (i.e., commands or queries) to communicate between software modules or system components. Structured messages can contain raw or unstructured data interspersed with metadata or control information. If software applications use attacker-supplied inputs to construct structured messages without properly encoding such messages, then the attacker could insert malicious commands or special characters that can cause the data to be interpreted as control information or metadata. Consequently, the module or component that receives the corrupted output will perform the wrong operations or otherwise interpret the data incorrectly. Prescreening inputs prior to passing them to interpreters prevents the content from being unintentionally interpreted as commands. Input validation ensures accurate and correct inputs and prevents attacks such as cross-site scripting and a variety of injection attacks.

Official OSCAL parameters

Organization-defined parameters

These values must be resolved through the organization’s tailoring and governance process. Bracketed parameter references in the control text identify where a decision is required.

information inputsinformation inputs to the system requiring validity checks are defined;

Original Bare Metal Cyber perspective

From control text to operational evidence

Use Information Input Validation as a testable risk decision. Translate the official statement into accountable people, repeatable processes, configured technology, and evidence that demonstrates the outcome over time. In this family, pay particular attention to flaw remediation, malicious-code protection, monitoring, integrity, and trustworthy information handling.

Implementation workflow

Define the control boundary, responsible owner, inherited portions, and systems or processes in scope.
Resolve each organization-defined parameter before declaring the control implemented.
Document how the implementation satisfies every clause of the official control statement.
Collect evidence as a normal byproduct of operation rather than only before an assessment.
Review exceptions, changes, and monitoring results on a risk-based cadence.

Evidence examples

patch and remediation records
malware protection configuration
monitoring alerts and response records
integrity validation and exception reports

Common failure patterns

patch compliance hides unsupported assets
alerts generated without response ownership
exceptions never expire
integrity monitoring excludes critical configurations

Questions practitioners should ask

What risk decision is this control intended to support in this system?
Which parts are implemented locally, inherited, shared, or not applicable—and what evidence supports that decision?
Do the documented narrative, deployed configuration, operating process, and collected evidence agree?
What event or threshold requires the implementation to be reviewed or changed?

Official NIST SP 800-53A content

Assessment objectives and methods

Show the assessment objective

the validity of the [Organization-defined: information inputs] is checked.

Examine

System and information integrity policy
system and information integrity procedures
access control policy and procedures
separation of duties policy and procedures
procedures addressing information input validation
documentation for automated tools and applications to verify the validity of information
list of information inputs requiring validity checks
system design documentation
system configuration settings and associated documentation
system audit records
system security plan
other relevant documents or records

Interview

Organizational personnel responsible for information input validation
organizational personnel with information security responsibilities
system/network administrators
system developer

Test

Mechanisms supporting and/or implementing validity checks on information inputs

Official CUI requirement crosswalk

Related NIST SP 800-172 requirements

These Rev. 3 requirements cite this base control or one of its enhancements as a source. The relationship does not by itself determine contractual applicability or complete implementation.

03.14.12EInformation Input ValidationSI-10 →

Official NIST enhancements

Control enhancements

Enhancements add specificity, strength, or scope to the base control. Baseline badges show explicit selections in the official SP 800-53B OSCAL profiles.

Official NIST control enhancement

SI-10(1) — Manual Override Capability

(a)Provide a manual override capability for input validation of the following information inputs: [Organization-defined: si-10_odp];
(b)Restrict the use of the manual override capability to only [Organization-defined: authorized individuals] ; and
(c)Audit the use of the manual override capability.

Official discussion

In certain situations, such as during events that are defined in contingency plans, a manual override capability for input validation may be needed. Manual overrides are used only in limited circumstances and with the inputs defined by the organization.

Organization-defined parameters (1)

authorized individualsauthorized individuals who can use the manual override capability are defined;

Assessment objectives and methods

SI-10(01)(a)a manual override capability for the validation of [Organization-defined: si-10_odp] is provided;
SI-10(01)(b)the use of the manual override capability is restricted to only [Organization-defined: authorized individuals];
SI-10(01)(c)the use of the manual override capability is audited.

Examine

System and information integrity policy
system and information integrity procedures
access control policy and procedures
separation of duties policy and procedures
procedures addressing information input validation
system design documentation
system configuration settings and associated documentation
system audit records
system security plan
other relevant documents or records

Interview

Organizational personnel responsible for information input validation
organizational personnel with information security responsibilities
system/network administrators
system developer

Test

Organizational processes for the use of a manual override capability
mechanisms supporting and/or implementing a manual override capability for input validation
mechanisms supporting and/or implementing auditing of the use of a manual override capability

Related controls

Official NIST control enhancement

SI-10(2) — Review and Resolve Errors

Review and resolve input validation errors within [Organization-defined: organization-defined time period].

Official discussion

Resolution of input validation errors includes correcting systemic causes of errors and resubmitting transactions with corrected input. Input validation errors are those related to the information inputs defined by the organization in the base control ( [SI-10](#si-10)).

Organization-defined parameters (3)

organization-defined time period

time periodthe time period within which input validation errors are to be reviewed is defined;

time periodthe time period within which input validation errors are to be resolved is defined;

Assessment objectives and methods

SI-10(02)[01]input validation errors are reviewed within [Organization-defined: time period];
SI-10(02)[02]input validation errors are resolved within [Organization-defined: time period].

Examine

System and information integrity policy
system and information integrity procedures
procedures addressing information input validation
system design documentation
system configuration settings and associated documentation
review records of information input validation errors and resulting resolutions
information input validation error logs or records
system audit records
system security plan
other relevant documents or records

Interview

Organizational personnel responsible for information input validation
organizational personnel with information security responsibilities
system/network administrators

Test

Organizational processes for the review and resolution of input validation errors
mechanisms supporting and/or implementing the review and resolution of input validation errors

Official NIST control enhancement

SI-10(3) — Predictable Behavior

Verify that the system behaves in a predictable and documented manner when invalid inputs are received.

Official discussion

A common vulnerability in organizational systems is unpredictable behavior when invalid inputs are received. Verification of system predictability helps ensure that the system behaves as expected when invalid inputs are received. This occurs by specifying system responses that allow the system to transition to known states without adverse, unintended side effects. The invalid inputs are those related to the information inputs defined by the organization in the base control ( [SI-10](#si-10)).

Assessment objectives and methods

SI-10(03)[01]the system behaves in a predictable manner when invalid inputs are received;
SI-10(03)[02]the system behaves in a documented manner when invalid inputs are received.

Examine

System and information integrity policy
system and information integrity procedures
procedures addressing information input validation
system design documentation
system configuration settings and associated documentation
system audit records
system security plan
other relevant documents or records

Interview

Organizational personnel responsible for information input validation
organizational personnel with information security responsibilities
system/network administrators
system developer

Test

Automated mechanisms supporting and/or implementing predictable behavior when invalid inputs are received

Official NIST control enhancement

SI-10(4) — Timing Interactions

Account for timing interactions among system components in determining appropriate responses for invalid inputs.

Official discussion

In addressing invalid system inputs received across protocol interfaces, timing interactions become relevant, where one protocol needs to consider the impact of the error response on other protocols in the protocol stack. For example, 802.11 standard wireless network protocols do not interact well with Transmission Control Protocols (TCP) when packets are dropped (which could be due to invalid packet input). TCP assumes packet losses are due to congestion, while packets lost over 802.11 links are typically dropped due to noise or collisions on the link. If TCP makes a congestion response, it takes the wrong action in response to a collision event. Adversaries may be able to use what appear to be acceptable individual behaviors of the protocols in concert to achieve adverse effects through suitable construction of invalid input. The invalid inputs are those related to the information inputs defined by the organization in the base control ( [SI-10](#si-10)).

Assessment objectives and methods

timing interactions among system components are accounted for in determining appropriate responses for invalid inputs.

Examine

System and information integrity policy
system and information integrity procedures
procedures addressing information input validation
system design documentation
system configuration settings and associated documentation
system audit records
system security plan
other relevant documents or records

Interview

Organizational personnel responsible for information input validation
organizational personnel with information security responsibilities
system/network administrators
system developer

Test

Organizational processes for determining appropriate responses to invalid inputs
automated mechanisms supporting and/or implementing responses to invalid inputs

Official NIST control enhancement

SI-10(5) — Restrict Inputs to Trusted Sources and Approved Formats

Restrict the use of information inputs to [Organization-defined: trusted sources] and/or [Organization-defined: formats].

Official discussion

Restricting the use of inputs to trusted sources and in trusted formats applies the concept of authorized or permitted software to information inputs. Specifying known trusted sources for information inputs and acceptable formats for such inputs can reduce the probability of malicious activity. The information inputs are those defined by the organization in the base control ( [SI-10](#si-10)).

Organization-defined parameters (2)

trusted sourcestrusted sources to which the use of information inputs is to be restricted are defined;

formatsformats to which the use of information inputs is to be restricted are defined;

Assessment objectives and methods

the use of information inputs is restricted to [Organization-defined: trusted sources] and/or [Organization-defined: formats].

Examine

System and information integrity policy
system and information integrity procedures
procedures addressing information input validation
system design documentation
system configuration settings and associated documentation
list of trusted sources for information inputs
list of acceptable formats for input restrictions
system audit records
system security plan
other relevant documents or records

Interview

Organizational personnel responsible for information input validation
organizational personnel with information security responsibilities
system/network administrators
system developer

Test

Organizational processes for restricting information inputs
automated mechanisms supporting and/or implementing restriction of information inputs

Related controls

Official NIST control enhancement

SI-10(6) — Injection Prevention

Prevent untrusted data injections.

Official discussion

Untrusted data injections may be prevented using a parameterized interface or output escaping (output encoding). Parameterized interfaces separate data from code so that injections of malicious or unintended data cannot change the semantics of commands being sent. Output escaping uses specified characters to inform the interpreter’s parser whether data is trusted. Prevention of untrusted data injections are with respect to the information inputs defined by the organization in the base control ( [SI-10](#si-10)).

Assessment objectives and methods

untrusted data injections are prevented.

Examine

System and information integrity policy
system and information integrity procedures
procedures addressing information input validation
system design documentation
system configuration settings and associated documentation
list of trusted sources for information inputs
list of acceptable formats for input restrictions
system audit records
system security plan
other relevant documents or records

Interview

Organizational personnel responsible for information input validation
organizational personnel with information security responsibilities
system/network administrators
system developer

Test

Organizational processes for preventing untrusted data injections
automated mechanisms supporting and/or implementing injection prevention

Related controls

Source record

Authoritative sources

OMB A-130 ↗

Bare Metal Cyber is an independent educational publisher and is not affiliated with or endorsed by NIST. Official control requirements and interpretations remain with NIST and the responsible authorizing organization.