SA-24 Design For Cyber Resiliency

Guidance: nonePolicy clause: noneWhat these mean

Baselines	Implementation level	Enhancements
Not in a baseline	Organization	None

Related controls: CA-7, CP-2, CP-4, CP-9, CP-10, CP-11, CP-12, CP-13, IA-10, IR-4, IR-5, PE-11, PE-17, PL-8, PM-7, PM-16, PM-30, PM-31, RA-3, RA-5, RA-9, RA-10, SA-3, SA-8, SA-9, SA-17, SC-3, SC-5, SC-7, SC-10, SC-11, SC-29, SC-30, SC-34, SC-35, SC-36, SC-37, SC-39, SC-44, SC-47, SC-48, SC-49, SC-50, SC-51, SI-3, SI-4, SI-6, SI-7, SI-10, SI-14, SI-15, SI-16, SI-19, SI-20, SI-21, SI-22, SI-23, SR-3, SR-4, SR-5, SR-6, SR-7, SR-9, SR-10, SR-11

Control statement

• a. Design organizational systems, system components, or system services to achieve cyber resiliency by:
  • 1. Defining the following cyber resiliency goals: [Assignment: organization-defined cyber resiliency goals].
  • 2. Defining the following cyber resiliency objectives: [Assignment: organization-defined cyber resiliency objectives].
  • 3. Defining the following cyber resiliency techniques: [Assignment: organization-defined cyber resiliency techniques].
  • 4. Defining the following cyber resiliency implementation approaches: [Assignment: organization-defined cyber resiliency implementation approaches].
  • 5. Defining the following cyber resiliency design principles: [Assignment: organization-defined cyber resiliency design principles].
• b. Implement the selected cyber resiliency goals, objectives, techniques, implementation approaches, and design principles as part of an organizational risk management process or systems security engineering process.

NIST discussion

Cyber resiliency is critical to ensuring the survivability of mission critical systems and high value assets. Cyber resiliency focuses on limiting the damage from adversity or the conditions that can cause a loss of assets. Damage can affect: (1) organizations (e.g., loss of reputation, increased existential risk); (2) missions or business functions (e.g., decreased capability to complete current missions and to accomplish future missions); (3) security (e.g., decreased capability to achieve security objectives or to prevent, detect, and respond to cyber incidents); (4) systems (e.g., unauthorized use of system resources or decreased capability to meet system requirements); or (5) specific system elements (e.g., physical destruction; corruption, modification, or fabrication of information).

Cyber resiliency goals are intended to help organizations maintain a state of informed preparedness for adversity, continue essential mission or business functions despite adversity, restore mission or business functions during and after adversity, and modify mission or business functions and their supporting capabilities in response to predicted changes in technical, operational, or threat environments.

NIST SP 800-160, Volume 2 provides additional information on the Cyber Resiliency Engineering Framework to include detailed descriptions of cyber resiliency goals, objectives, techniques, implementation approaches, and design principles. NIST SP 800-160, Vol 1 provides additional information on achieving cyber resiliency as an emergent property of an engineered system.

Assessment objectives (SP 800-53A)

Objectives and methods for SA-24

Determine if Determine if:

• SA-24a.
  • SA-24a.01 organizational systems, system components, or system services achieve cyber resiliency through [Assignment: organization-defined cyber resiliency goals];
  • SA-24a.02 organizational systems, system components, or system services achieve cyber resiliency through [Assignment: organization-defined cyber resiliency objectives];
  • SA-24a.03 organizational systems, system components, or system services achieve cyber resiliency through [Assignment: organization-defined cyber resiliency techniques];
  • SA-24a.04 organizational systems, system components, or system services achieve cyber resiliency through [Assignment: organization-defined cyber resiliency implementation approaches];
  • SA-24a.05 organizational systems, system components, or system services achieve cyber resiliency through [Assignment: organization-defined cyber resiliency design principles];
• SA-24b.
  • SA-24b.[01] selected cyber resiliency goals are implemented as part of an organizational risk management process of systems security engineering process;
  • SA-24b.[02] selected cyber resiliency objectives are implemented as part of an organizational risk management process of systems security engineering process;
  • SA-24b.[03] selected cyber resiliency techniques are implemented as part of an organizational risk management process of systems security engineering process;
  • SA-24b.[04] selected cyber resiliency implementation approaches are implemented as part of an organizational risk management process of systems security engineering process;
  • SA-24b.[05] selected cyber resiliency design principles are implemented as part of an organizational risk management process of systems security engineering process.

Examine: System and services acquisition policy;; system and services acquisition procedures;; assessment and authorization procedures;; procedures addressing cyber resiliency goals, objectives, techniques, implementation approaches, and design principles used in the specification, design, development, implementation, and modification of the system;; system design documentation;; security and privacy requirements and specifications for the system;; system security plan;; privacy plan;; privacy impact assessment;; privacy risk assessment documentation..

Interview: Organizational personnel with acquisition/contracting responsibilities;; organizational personnel with information security and privacy responsibilities;; organizational personnel with system specification, design, development, implementation, and modification responsibilities;; system developers..

Test: Organizational processes for applying cyber resiliency principles in system specification, design, development, implementation, and modification;; mechanisms supporting the application of cyber resiliency principles in system specification, design, development, implementation, and modification..