NIST 800-53 REV 5 • SYSTEM AND INFORMATION INTEGRITY
SI-7(17) — Runtime Application Self-protection
Implement {{ insert: param, si-07.17_odp }} for application self-protection at runtime.
CMMC Practice Mapping
No direct CMMC mapping
NIST 800-171 Mapping
No direct NIST 800-171 mapping
Related Controls
Supplemental Guidance
Runtime application self-protection employs runtime instrumentation to detect and block the exploitation of software vulnerabilities by taking advantage of information from the software in execution. Runtime exploit prevention differs from traditional perimeter-based protections such as guards and firewalls which can only detect and block attacks by using network information without contextual awareness. Runtime application self-protection technology can reduce the susceptibility of software to attacks by monitoring its inputs and blocking those inputs that could allow attacks. It can also help protect the runtime environment from unwanted changes and tampering. When a threat is detected, runtime application self-protection technology can prevent exploitation and take other actions (e.g., sending a warning message to the user, terminating the user's session, terminating the application, or sending an alert to organizational personnel). Runtime application self-protection solutions can be deployed in either a monitor or protection mode.
Practitioner Notes
Runtime Application Self-Protection (RASP) embeds security checks directly inside the application so it can detect and block attacks from within, in real time.
Example 1: Deploy a RASP solution (like Contrast Security or Imperva RASP) inside your web applications. The RASP agent detects SQL injection, XSS, and other attacks from within the application context, blocking them even if they bypass your WAF.
Example 2: For .NET applications, enable the built-in request validation feature and configure custom input validation rules. The application itself rejects malicious input patterns rather than relying solely on external security devices to filter attacks.