SI-13 Predictable Failure Prevention

Guidance: nonePolicy clause: noneWhat these mean

Baselines	Implementation level	Enhancements
Not in a baseline	Organization	4 (0 in a baseline)

Related controls: CP-2, CP-10, CP-13, MA-2, MA-6, SA-8, SC-6

Control statement

• a. Determine mean time to failure (MTTF) for the following system components in specific environments of operation: [Assignment: organization-defined system components] ; and
• b. Provide substitute system components and a means to exchange active and standby components in accordance with the following criteria: [Assignment: organization-defined mean time to failure (MTTF) substitution criteria].

NIST discussion

While MTTF is primarily a reliability issue, predictable failure prevention is intended to address potential failures of system components that provide security capabilities. Failure rates reflect installation-specific consideration rather than the industry-average. Organizations define the criteria for the substitution of system components based on the MTTF value with consideration for the potential harm from component failures. The transfer of responsibilities between active and standby components does not compromise safety, operational readiness, or security capabilities. The preservation of system state variables is also critical to help ensure a successful transfer process. Standby components remain available at all times except for maintenance issues or recovery failures in progress.

Control enhancements

SI-13(1) Transferring Component Responsibilities

Baselines: Not in a baseline

Take system components out of service by transferring component responsibilities to substitute components no later than [Assignment: organization-defined fraction or percentage] of mean time to failure.

Discussion and assessment objectives for SI-13(1)

Transferring primary system component responsibilities to other substitute components prior to primary component failure is important to reduce the risk of degraded or debilitated mission or business functions. Making such transfers based on a percentage of mean time to failure allows organizations to be proactive based on their risk tolerance. However, the premature replacement of system components can result in the increased cost of system operations.

Determine if system components are taken out of service by transferring component responsibilities to substitute components no later than [Assignment: organization-defined fraction or percentage] of mean time to failure.

Examine: System and information integrity policy; system and information integrity procedures; procedures addressing predictable failure prevention; system design documentation; system configuration settings and associated documentation; system audit records; system security plan; other relevant documents or records.

Interview: Organizational personnel responsible for MTTF activities; organizational personnel with information security responsibilities; system/network administrators; organizational personnel with contingency planning responsibilities.

Test: Organizational processes for managing MTTF; automated mechanisms supporting and/or implementing the transfer of component responsibilities to substitute components.

SI-13(3) Manual Transfer Between Components

Baselines: Not in a baseline

Manually initiate transfers between active and standby system components when the use of the active component reaches [Assignment: organization-defined percentage] of the mean time to failure.

Discussion and assessment objectives for SI-13(3)

For example, if the MTTF for a system component is 100 days and the MTTF percentage defined by the organization is 90 percent, the manual transfer would occur after 90 days.

Determine if transfers are initiated manually between active and standby system components when the use of the active component reaches [Assignment: organization-defined percentage] of the mean time to failure.

Examine: System and information integrity policy; system and information integrity procedures; procedures addressing predictable failure prevention; system design documentation; system configuration settings and associated documentation; system audit records; system security plan; other relevant documents or records.

Interview: Organizational personnel responsible for MTTF activities; organizational personnel with information security responsibilities; system/network administrators; organizational personnel with contingency planning responsibilities.

Test: Organizational processes for managing MTTF and conducting the manual transfer between active and standby components.

SI-13(4) Standby Component Installation and Notification

Baselines: Not in a baseline

If system component failures are detected:

• (a) Ensure that the standby components are successfully and transparently installed within [Assignment: organization-defined time period] ; and
• (b) [Selection (one or more): activate [Assignment: organization-defined alarm] ; automatically shut down the system; [Assignment: organization-defined action] ].

Discussion and assessment objectives for SI-13(4)

Automatic or manual transfer of components from standby to active mode can occur upon the detection of component failures.

Determine if:

• SI-13(04)(a) the standby components are successfully and transparently installed within [Assignment: organization-defined time period] if system component failures are detected;
• SI-13(04)(b) [Selection (one or more): activate [Assignment: organization-defined alarm] ; automatically shut down the system; [Assignment: organization-defined action] ] are performed if system component failures are detected.

Examine: System and information integrity policy; system and information integrity procedures; procedures addressing predictable failure prevention; system design documentation; system configuration settings and associated documentation; list of actions to be taken once system component failure is detected; system audit records; system security plan; other relevant documents or records.

Interview: Organizational personnel responsible for MTTF activities; organizational personnel with information security responsibilities; system/network administrators; organizational personnel with contingency planning responsibilities.

Test: Organizational processes for managing MTTF; automated mechanisms supporting and/or implementing the transparent installation of standby components; automated mechanisms supporting and/or implementing alarms or system shutdown if component failures are detected.

SI-13(5) Failover Capability

Baselines: Not in a baseline

Provide [Selection: real-time; near real-time] [Assignment: organization-defined failover capability] for the system.

Discussion and assessment objectives for SI-13(5)

Failover refers to the automatic switchover to an alternate system upon the failure of the primary system. Failover capability includes incorporating mirrored system operations at alternate processing sites or periodic data mirroring at regular intervals defined by the recovery time periods of organizations.

Determine if [Selection: real-time; near real-time] [Assignment: organization-defined failover capability] is provided for the system.

Examine: System and information integrity policy; system and information integrity procedures; procedures addressing predictable failure prevention; system design documentation; system configuration settings and associated documentation; documentation describing the failover capability provided for the system; system audit records; system security plan; other relevant documents or records.

Interview: Organizational personnel responsible for the failover capability; organizational personnel with information security responsibilities; system/network administrators; organizational personnel with contingency planning responsibilities.

Test: Organizational processes for managing the failover capability; automated mechanisms supporting and/or implementing the failover capability.

Withdrawn enhancements: SI-13(2).

Assessment objectives (SP 800-53A)

Objectives and methods for SI-13

Determine if:

• SI-13a. mean time to failure (MTTF) is determined for [Assignment: organization-defined system components] in specific environments of operation;
• SI-13b. substitute system components and a means to exchange active and standby components are provided in accordance with [Assignment: organization-defined mean time to failure (MTTF) substitution criteria].

Examine: System and information integrity policy; system and information integrity procedures; procedures addressing predictable failure prevention; system design documentation; system configuration settings and associated documentation; list of MTTF substitution criteria; system audit records; system security plan; other relevant documents or records.

Interview: Organizational personnel responsible for MTTF determinations and activities; organizational personnel with information security responsibilities; system/network administrators; organizational personnel with contingency planning responsibilities.

Test: Organizational processes for managing MTTF.