Input Validation
What is Input Validation?
The process of verifying that user-supplied data meets expected formats and constraints before processing, preventing injection attacks and data corruption.
Terms that appear alongside input validation
Each of these is named in at least one of the same controls as input validation. The number is how many controls name both.
- owasp 5 shared controls
- authentication 4 shared controls
- api security 3 shared controls
- secure coding 3 shared controls
- gateway 2 shared controls
- security testing 2 shared controls
- application security 2 shared controls
- session management 2 shared controls
Frameworks that govern input validation
What the standards actually require on input validation
Requirements naming input validation across 6 standards, quoted from the control text.
Review and resolve input validation errors within [Assignment: organization-defined time period].
NIST800-SI-10(2) · SI-10(2) Information Input Validation | Review and Resolve Errors →The component shall check the syntax and the content of every input used as a process control input or that directly affects what it does. No enhancements.
iec-62443::CR 3.5 · Input validation →All input validation rules are documented, matched in code and tested with both positive and negative unit testing or integration testing.
ISM-2057 · Documenting and testing input validation rules →Rank 12 in the 2024 CWE Top 25 (frequency x severity of CVEs). The product does not validate, or incorrectly validates, input that affects the control flow or data flow of the program.
CWE-20 · Improper Input Validation →Check the validity of all inputs to web and application servers, database servers and any system or application input that may receive or process CJI.
fbi-cjis-security-policy::SI-10 · SI-10 Information Input Validation →The CBS shall check syntax, length and content of data arriving through untrusted networks that feeds process control or directly affects CBS actions. (from SR 3.5 of IEC 62443-3-3; applies only to CBSs that talk to untrusted networks)
iacs-unified-requirements-e26e27-cyber-resilience-of-ships-and-on-board-systems::E27-4.2-39 · E27 item 39: Input validation →Questions people ask about input validation
What is Input Validation?
Why is Input Validation important for compliance?
Which compliance frameworks address Input Validation?
Where can I learn more about Input Validation?
See how Input Validation applies across compliance frameworks
Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.