Testing and Verification (SI-3(6))

Test malicious code protection mechanisms [organization-defined] by introducing known benign code into the system; and Verify that the detection of the code and the associated incident reporting occur.