SC-24 Fail in Known State
Guidance: nonePolicy clause: draftWhat these mean
sc24ctl| Baselines | Implementation level | Enhancements |
|---|---|---|
| High | System | None |
Related controls: CP-2, CP-4, CP-10, CP-12, SA-8, SC-7, SC-22, SI-13
Control statement
Section titled “Control statement”Fail to a [Assignment: organization-defined known system state] for the following failures on the indicated components while preserving [Assignment: organization-defined system state information] in failure: [Assignment: organization-defined types of system failures on system components].
NIST discussion
Failure in a known state addresses security concerns in accordance with the mission and business needs of organizations. Failure in a known state prevents the loss of confidentiality, integrity, or availability of information in the event of failures of organizational systems or system components. Failure in a known safe state helps to prevent systems from failing to a state that may cause injury to individuals or destruction to property. Preserving system state information facilitates system restart and return to the operational mode with less disruption of mission and business processes.
Assessment objectives (SP 800-53A)
Section titled “Assessment objectives (SP 800-53A)”Objectives and methods for SC-24
Determine if [Assignment: organization-defined types of system failures on system components] fail to a [Assignment: organization-defined known system state] while preserving [Assignment: organization-defined system state information] in failure.
Examine: System and communications protection policy; procedures addressing system failure to known state; system design documentation; system configuration settings and associated documentation; list of failures requiring system to fail in a known state; state information to be preserved in system failure; system audit records; system security plan; other relevant documents or records.
Interview: System/network administrators; organizational personnel with information security responsibilities; system developer.
Test: Mechanisms supporting and/or implementing the fail in known state capability; mechanisms preserving system state information in the event of a system failure.
Policy statement
- The System owner shall ensure system components fail to Fill in: known system state to which system components fail in the event of a system failure Typical: a state that denies access through the affected components for the following failures: Fill in: types of system failures for which the system components fail to a known state Typical: failure of a boundary protection device, an authentication service or a database. (SC-24)
- The System owner shall ensure the system preserves Fill in: system state information to be preserved in the event of a system failure Typical: transactions in progress, audit records and configuration settings when those failures occur. (SC-24)
From the System and Communications Protection Policy template (draft). Highlighted fields are values your organization sets.
Artifacts
Independent guidance, not an official NIST publication. Control text is from NIST SP 800-53 Rev. 5 and SP 800-53A (public domain). Original content is licensed CC BY 4.0; program templates and the downloadable kit are dedicated to the public domain under CC0 1.0.