SI-17 Fail-safe Procedures

Guidance: nonePolicy clause: noneWhat these mean

Baselines	Implementation level	Enhancements
Not in a baseline	System	None

Related controls: CP-12, CP-13, SC-24, SI-13

Control statement

Implement the indicated fail-safe procedures when the indicated failures occur: [Assignment: organization-defined list of failure conditions and associated fail-safe procedures].

NIST discussion

Failure conditions include the loss of communications among critical system components or between system components and operational facilities. Fail-safe procedures include alerting operator personnel and providing specific instructions on subsequent steps to take. Subsequent steps may include doing nothing, reestablishing system settings, shutting down processes, restarting the system, or contacting designated organizational personnel.

Assessment objectives (SP 800-53A)

Objectives and methods for SI-17

Determine if [Assignment: organization-defined fail-safe procedures] are implemented when [Assignment: organization-defined list of failure conditions] occur.

Examine: System and information integrity policy; system and information integrity procedures; documentation addressing fail-safe procedures for the system; system design documentation; system configuration settings and associated documentation; list of security safeguards protecting the system memory from unauthorized code execution; system audit records; system security plan; other relevant documents or records.

Interview: Organizational personnel responsible for fail-safe procedures; organizational personnel with information security responsibilities; system/network administrators; system developer.

Test: Organizational fail-safe procedures; automated mechanisms supporting and/or implementing fail-safe procedures.